10% de réduction sur vos envois d'emailing --> CLIQUEZ ICI

Retour à l'accueil, cliquez ici

Voir également :

Documentation ORACLE

http://docs.oracle.com/cd/E19533-01/index.html

Getting Started with the LX Series

http://docs.oracle.com/cd/E19533-01/875-3510-10/875-3510-10.pdf

LX-Series Commands Reference Guide

http://docs.oracle.com/cd/E19533-01/875-3511-10/875-3511-10.pdf

LX-Series Configuration Guide :

http://docs.oracle.com/cd/E19533-01/875-3512-10/875-3512-10.pdf

Catalyst 3750 Switch Command Reference

http://docs.oracle.com/cd/E19533-01/875-3516-10/875-3516-10.pdf

Cisco Catalyst 3750 Switch Hardware Installation Guide

http://docs.oracle.com/cd/E19533-01/875-3517-10/875-3517-10.pdf

Catalyst 3750 Switch

http://docs.oracle.com/cd/E19533-01/875-3518-10/875-3518-10.pdf

Sun Fire Grid System visuelle

http://docs.oracle.com/cd/E19374-01/index.html

Sun Fire™ Visual Grid System Installation and User’s Guid

http://docs.oracle.com/cd/E19374-01/817-2365-10/817-2365-10.pdf

Oracle SPARC T-Series Serveurs

http://www.oracle.com/technetwork/documentation/sparc-tseries-servers-252697.html

SPARC documentation du serveur T4-1

http://docs.oracle.com/cd/E22985_01/index.html

SPARC T4-1 Server Safety and Compliance Guide Compliance Model No.: SERP2

http://docs.oracle.com/cd/E22985_01/pdf/E22991.pdf

SPARC T4-1 Server Installation Guide

http://docs.oracle.com/cd/E22985_01/pdf/E22988.pdf

SPARC T4-1 Server Service Manual

http://docs.oracle.com/cd/E22985_01/pdf/E22990.pdf

SPARC T4-1B Server Module Product Notes

http://docs.oracle.com/cd/E22735_01/pdf/E22737.pdf SPARC T4-1B Server Module Safety and Compliance Guide Compliance Model No.: T4BLD :

http://docs.oracle.com/cd/E22735_01/pdf/E22740.pdf SPARC T4-1B Server Module Installation Guide :

http://docs.oracle.com/cd/E22735_01/pdf/E22738.pdf

SPARC T4-1B Server Module Service Manual

http://docs.oracle.com/cd/E22735_01/pdf/E22739.pdf

SPARC T3-1 (Français) http://docs.oracle.com/cd/E19836-01/index-fr.html Integrated Lights Out Manager (ILOM) 3.0 http://docs.oracle.com/cd/E19860-01/index.html SPARC T3-1B SERVER DOCUMENTATION http://docs.oracle.com/cd/E22551_01/index.html SPARC T3-2 (Français)

http://docs.oracle.com/cd/E19166-01/index-fr.html

SPARC T3-4 (Français)

http://docs.oracle.com/cd/E21687_01/index.html

SPARC T3-4 Server Service Manual

http://docs.oracle.com/cd/E19417-01/E20813/E20813.pdf

Sun Microsystems, Inc. www.sun.com Submit comments about this document at: http://www.sun.com/hwdocs/feedback Sun Fire™ V60x Compute Grid Rack System Installation Guide Part No. 817-3072-10 October 2003, Revision APlease Recycle Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. THIS PRODUCT CONTAINS CONFIDENTIAL INFORMATION AND TRADE SECRETS OF SUN MICROSYSTEMS, INC. USE, DISCLOSURE OR REPRODUCTION IS PROHIBITED WITHOUT THE PRIOR EXPRESS WRITTEN PERMISSION OF SUN MICROSYSTEMS, INC. This document and the product to which it pertains are distributed under licenses restricting their use, copying, distribution, and decompilation. No part of the product or of this document may be reproduced in any form by any means without prior written authorization of Sun and its licensors, if any. This distribution may include materials developed by third parties. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and in other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun ONE, the Sun ONE logo, Sun Fire, AnswerBook2, docs.sun.com, Java, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and in other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and in other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. The OPEN LOOK and Sun™ Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry. Sun holds a non-exclusive license from Xerox to the Xerox Graphical User Interface, which license also covers Sun’s licensees who implement OPEN LOOK GUIs and otherwise comply with Sun’s written license agreements. Products covered by and information contained in this manual are controlled by U.S. Export Control laws and may be subject to the export or import laws in other countries. Nuclear, missile, chemical/ biological weapons, or nuclear maritime end uses or end users, whether direct or indirect, are strictly prohibited. Export or reexport to countries subject to U.S. embargo, or to entities identi?ed on U.S. export exclusion lists, including, but not limited to, the denied persons and specially designated nationals lists, is strictly prohibited. Use of any spare or replacement CPUs is limited to repair or one-for-one replacement of CPUs in products exported in compliance with U.S. export laws. Use of CPUs as product upgrades, unless authorized by the U.S. Government, is strictly prohibited. DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, Etats-Unis. Tous droits réservés. CE PRODUIT CONTIENT DES INFORMATIONS CONFIDENTIELLES ET DES SECRETS COMMERCIAUX DE SUN MICROSYSTEMS, INC. SON UTILISATION, SA DIVULGATION ET SA REPRODUCTION SONT INTERDITES SANS AUTORISATION EXPRESSE, ECRITE ET PREALABLE DE SUN MICROSYSTEMS, INC. Ce produit ou document est protégé par un copyright et distribué avec des licences qui en restreignent l’utilisation, la copie, la distribution, et la décompilation. Aucune partie de ce produit ou document ne peut être reproduite sous aucune forme, par quelque moyen que ce soit, sans l’autorisation préalable et écrite de Sun et de ses bailleurs de licence, s’il y ena. Cette distribution peut comprendre des composants développés par des tierces parties. Le logiciel détenu par des tiers, et qui comprend la technologie relative aux polices de caractères, est protégé par un copyright et licencié par des fournisseurs de Sun. Des parties de ce produit pourront être dérivées des systèmes Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque déposée aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun ONE, the Sun ONE logo, Sun Fire, AnswerBook2, docs.sun.com, Java, et Solaris sont des marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits protant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. Ce produit est soumis à la législation américaine en matière de contrôle des exportations et peut être soumis à la règlementation en vigueur dans d’autres pays dans le domaine des exportations et importations. Les utilisations , ou utilisateurs ?naux, pour des armes nucléaires, des missiles, des armes biologiques et chimiques ou du nucléaire maritime, directement ou indirectement, sont strictement interdites. Les exportations ou reexportations vers les pays sous embargo américain, ou vers des entités ?gurant sur les listes d’exclusion d’exportation américaines, y compris, mais de manière non exhaustive, la liste de personnes qui font objet d’un ordre de ne pas participer, d’une façon directe ou indirecte, aux exportations des produits ou des services qui sont régis par la législation américaine en matière de contrôle des exportations et la liste de ressortissants spéci?quement désignés, sont rigoureusement interdites. L’utilisation de pièces détachées ou d’unités centrales de remplacement est limitée aux réparations ou à l’échange standard d’unités centrales pour les produits exportés, conformément à la législation américaine en matière d’exportation. Sauf autorisation par les autorités des Etats-Unis, l’utilisation d’unités centrales pour procéder à des mises à jour de produits est rigoureusement interdite. LA DOCUMENTATION EST FOURNIE "EN L’ÉTAT" ET TOUTES AUTRES CONDITIONS, DECLARATIONS ET GARANTIES EXPRESSES OU TACITES SONT FORMELLEMENT EXCLUES, DANS LA MESURE AUTORISEE PAR LA LOI APPLICABLE, Y COMPRIS NOTAMMENT TOUTE GARANTIE IMPLICITE RELATIVE A LA QUALITE MARCHANDE, A L’APTITUDE A UNE UTILISATION PARTICULIERE OU A L’ABSENCE DE CONTREFAÇON.Contents iii Contents 1. Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 1 Installation Quick Path 1 Hardware Components Overview 3 Sun Rack 900 4 Network Switches 4 Terminal Server 5 Cluster Grid Manager Node 5 Grid Master Node 6 Compute Nodes 6 Keyboard, Video, Mouse Unit 6 Cabling Information 7 Single-Rack System 8 Multiple-Rack System 9 Installing the System Hardware 10 Powering On the System 12 Adding or Replacing Hardware Components 13 Tools Required 13 Replacing Sun Rack Parts 13 Adding or Replacing a Sun Fire V60x Node 14 Replacing a CGM Node 14 Replacing a Grid Master Node or Compute Node 14 Adding or Replacing a Network Switch 14iv Sun Fire V60x Compute Grid Rack System Installation Guide • September 2003 2. Sun Fire V60x Compute Grid Rack System Software Overview and Installation 15 Sun Fire V60x Compute Grid Software Components Overview 16 Red Hat Enterprise Linux Operating System 17 Cluster Grid Manager Software 17 Sun Control Station Software 17 AllStart Module 19 Grid Engine Module 19 Setting Up the Sun Fire V60x Compute Grid Software 21 Information Required For Software Setup 21 Logging In and Setting Up the System Identity 23 Using the AllStart Module to Deploy Software 27 Creating AllStart Distributions 28 Creating AllStart Payloads 30 Creating AllStart Profiles 33 Creating and Enabling Clients 41 Defining Network Service Settings 47 Deploying Software Payloads to Compute Nodes 49 Adding Compute Nodes as SCS Managed Hosts 50 Configuring the Grid Engine Module 53 Deploying the Sun ONE Grid Engine Software 53 Monitoring Compute Grid Tasks 57 Uninstalling Sun ONE Grid Engine Software 58 A. Product Specifications 61 Power Specifications 61 Physical Dimensions 62 Environmental Requirements 63v Preface This guide contains instructions for installing the Sun Fire™ V60x Compute Grid rack system hardware and for setting up and deploying the system software. This guide also provides overview information about the system and references to more detailed documentation for the system hardware and software components. How This Book Is Organized The information in this guide is organized into the following chapters and appendixes:
Chapter 1 provides hardware overview and installation instructions, including diagrams of the system cabling and components. Chapter 2 provides software overview information, and instructions for deploying and setting up software. Appendix A provides product specifications, including environmental requirements, for reference.vi Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Typographic Conventions Related Documentation The following table lists the documentation set that is shipped with your Sun Fire V60x Compute Grid rack system. Documentation that contains detailed information about using and servicing the system hardware and software components after installation are included with the system as a supplement to this installation guide. Typeface * * The settings on your browser might differ from these settings. Meaning Examples AaBbCc123 The names of commands, files, and directories; on-screen computer output Edit your.login file. Use ls -a to list all files. % You have mail. AaBbCc123 What you type, when contrasted with on-screen computer output % su Password: AaBbCc123 Book titles, new words or terms, words to be emphasized. Replace command-line variables with real names or values. Read Chapter 6 in the User’s Guide. These are called class options. You must be superuser to do this. To delete a file, type rm filename. Component Title Part Number Sun Fire V60x Compute Grid rack system Sun Fire V60x Compute Grid Rack System Installation Guide 801-3072 Sun Fire V60x Compute Grid rack system Sun Fire V60x Compute Grid Rack System Release Notes 801-3074 Sun Rack 900 Sun Rack Unpacking Instructions 816-6385 Sun Rack 900 Sun Rack Installation Guide 816-6386 Sun Rack 900 Sun Rack Service Manual 816-6387 Sun Rack 900 Sun Rack safety and Regulatory Compliance Information 816-7885 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Operating System Installation Guide 817-1956Preface vii Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Release Notes 817-2026 Sun Fire V60x Important Safety Information for Sun Hardware Systems 816-7190 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Warranty Card 817-2027 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Registration Card 817-2294 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Binary Code License 817-2029 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Safety and Compliance Guide 817-2028 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Documentation CD, includes the following: 705-0561 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server User Guide 817-2023 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Troubleshooting Guide 817-2024 Sun Fire V60x Sun Fire V60x and Sun Fire V65x Server Server Management Guide 817-2025 Sun Control Station software Sun Control Station 2.0 Software CD, includes the following documentation: 798-4889 Sun Control Station software Sun Control Station 2.0 Administration Manual 817-3603 Sun Control Station software Sun Control Station 2.0, Software Management Module 817-3611 Sun Control Station software Sun Control Station 2.0, Health Monitoring Module 817-3607 Sun Control Station software Sun Control Station 2.0, Performance Monitoring Module 817-3610 Sun Control Station software Sun Control Station 2.0, Inventory Module 817-3608 Sun Control Station software Sun Control Station 2.0, Lights-Out Management Module 817-3609 Sun Control Station software Sun Control Station 2.0, AllStart Module 817-3605 Sun Control Station software Sun Control Station 2.0, Grid Engine Module 817-3606 Component Title Part Numberviii Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Sun ONE Grid Engine, Enterprise Edition software Sun Grid Engine, Enterprise Edition 5.3 Administration and User’s Guide 816-4739 Sun ONE Grid Engine, Enterprise Edition software Sun Grid Engine 5.3 and Sun Grid Engine, Enterprise Edition 5.3 Reference Manual 816-4767 Sun ONE Grid Engine, Enterprise Edition software Sun Grid Engine, Enterprise Edition 5.3 Release Notes 816-5078 Sun ONE Grid Engine, Enterprise Edition software Sun Grid Engine, Enterprise Edition 5.3 Basics of Administration 816-7409 Third-party network switches Documents supplied from network switch vendor various Third-party terminal server Documents supplied from terminal server vendor various Third party keyboard, video, mouse (KVM) unit Documents supplied from KVM unit vendor various Component Title Part NumberPreface ix Accessing Sun Documentation In addition to the hard-copies and CDs that are shipped with your system, you can view, print, or purchase a broad selection of Sun documentation, including localized versions, at: http://www.sun.com/documentation You can search for the documentation by the titles or part numbers listed in “Related Documentation” on page vi. Contacting Sun Technical Support If you have technical questions about this product that are not answered in this document, go to: http://www.sun.com/service/contacting Sun Welcomes Your Comments Sun is interested in improving its documentation and welcomes your comments and suggestions. You can submit your comments by going to: http://www.sun.com/hwdocs/feedback Please include the title and part number of your document with your feedback: Sun Fire V60x Compute Grid Rack System Installation Guide, part number 817-3072-10x Sun Fire V60x Compute Grid Rack System Installation Guide • October 20031 C H A P T E R 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation The Sun Fire™ V60x Compute Grid rack system is shipped to your site fully assembled and cabled. This chapter is intended to familiarize you with the hardware in your Sun Fire V60x Compute Grid, and to provide installation and power-on instructions for the hardware. The information in this chapter is organized into the following sections.
“Installation Quick Path” on page 1
“Hardware Components Overview” on page 3
“Cabling Information” on page 7
“Installing the System Hardware” on page 10
“Powering On the System” on page 12
“Adding or Replacing Hardware Components” on page 13 Installation Quick Path This guide provides important overview and reference information, as well as procedures for an initial installation. The following diagram indicates the high-level steps for installing the system and provides pointers to that information in this guide.2 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 1-1 Installation Quick Path Flowchart Verify site-planning requirements are met. Unpack and position the system. Check preinstalled cable connections. Connect the system to power and Ethernet. Power on the system. Configure an identity for the terminal server and Cluster Grid Manager node. Deploy software to the compute nodes. Deploy Sun Grid Engine software, and define master and execution hosts. See “Environmental Requirements” on page 63. See “Installing the System Hardware” on page 10. See “Cabling Information” on page 7. See “Installing the System Hardware” on page 10. See “Powering On the System” on page 12. See “Logging In and Setting Up the System Identity” on page 23. See “Using the AllStart Module to Deploy Software” on page 27. See “Configuring the Grid Engine Module” on page 53. Add client nodes as Sun Control Station managed hosts. See “Adding Compute Nodes as SCS Managed Hosts” on page 50.Chapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 3 Hardware Components Overview FIGURE 1-2 shows the Sun Fire V60x Compute Grid front and rear views. The front and rear doors are not shown. Components of the system are described in the sections that follow. For a cabling diagram, see “Cabling Information” on page 7. FIGURE 1-2 Sun Fire V60x Compute Grid Front and Rear Views Sun Rack 900 Network switches (2) Terminal server Cluster Grid Manager node Keyboard, video, mouse unit (default position 23) Front filler panel Power switches (4 switches in 2 power sequencers) Front view Rear view Power inlets (4) with front label, “Sun Fire CGM”4 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Sun Rack 900 All of the Sun Fire V60x Compute Grid components and cabling are preinstalled in a Sun™ Rack 900. This rack is equipped with front and rear doors, and side covers. All Sun Fire V60x Compute Grid cables are precut, routed, and terminated in locations that provide minimal excess cable without impeding component access or replacement. The Sun Fire V60x Compute Grid is equipped with a full configuration of power distribution units and power sequencer units, which provide sufficient power outlets to cable all installed nodes. Each node has a separate 110/220 VAC power cord. The power cords are routed from the rear, with side-mounted outlet strips to minimize the impact on rear access to the components in the rack. There is minimal increase in load during rack power-on because all nodes are sequenced on in turn, minimizing the amplitude of power-on current spikes. Note – The four power cords that connect each rack to the AC outlets at your site must be ordered separately so that the correct connectors for your location are defined. For more detailed information about the Sun Rack 900, refer to the Sun Rack documentation set that is shipped with your Sun Fire V60x Compute Grid. Network Switches The Sun Fire V60x Compute Grid uses two 24-port Gigabit Ethernet switches to communicate with the network. Each of the Sun Fire V60x nodes is connected from its Eth1 port to a switch port using a Cat 5 Ethernet cable. You can optionally dedicate up to four of each switch’s ports to fiber-optic gigabit interface converters (GBICs). The two network switches in each rack are interconnected with preinstalled, 1.8-feet (.5-meter), 32-Gbps stacking cables connected to their stacking ports. Each network switch has two stacking ports on its rear panel (the rear panel of the network switch faces the front of the system rack). When you order a system with multiple racks, the network switches must be interconnected across the racks. You can order 9.8-feet (3-meter) stacking cables for this purpose. See “Multiple-Rack System” on page 9 for more information. For more detailed information about the network switches, refer to the third-party switch documentation that is shipped with your Sun Fire V60x Compute Grid.Chapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 5 Terminal Server All nodes in the rack and the network switches are connected via their serial console ports to a 48-port terminal server. The terminal server ports use consistent RJ-45 serial port wiring standards. The terminal server can then be used to perform individual configuration functions remotely, if this is necessary. The terminal server provides normal Telnet access to a serial port using the telnet IP-address port-number protocol. For more detailed information about the terminal server, refer to the third-party terminal server documentation that is shipped with your Sun Fire V60x Compute Grid. The terminal server ports are assigned Telnet port numbers at the factory. TABLE 1-1 describes the port allocations. Cluster Grid Manager Node One node in the system, called the Cluster Grid Manager (CGM) node, acts as a deployment and management host. After it is configured and given an identity by your system administrator, the CGM node deploys software and monitors system activities for the entire compute grid. In addition, it monitors the status of the grid jobs by communicating with the grid master node. The CGM node is pre-installed with the operating system and Cluster Grid Manager software modules that enable the CGM node to act as the management host. For more detailed information about the system software components, see “Sun Fire V60x Compute Grid Software Components Overview” on page 16. Note – The CGM node is identifiable by a label on the front bezel that is marked, “Sun Fire CGM.” TABLE 1-1 Terminal Server Port Allocations Port Number Device Telnet Port Number 34 Network switch console 7034 33 Cluster Grid Manager node 7033 32 to 1 Compute nodes 7032 to 70016 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Grid Master Node Your system administrator designates one node in the system to be the grid master node. This can be any node in the system other than the CGM node, because it is a dedicated management node rather than a managed host. All grid processes interact through this node, which typically acts as the queue master responsible for distributing jobs to the grid compute nodes. If you install multiple rack configurations, no additional grid master nodes are needed; the grid master node of the first rack manages all subsequent racks. Compute Nodes The grid compute nodes act as slave nodes to the grid master node. The compute nodes accept tasks from the grid master node, process them to completion, then pass the results back to the grid master node for accumulation. The number of compute nodes in the rack can be configured when the system is ordered. A fully configured rack can contain 32 compute nodes, including the grid master node. The minimum number of grid compute nodes that are supported is 2 and the maximum number is 128 (in 4 racks). Keyboard, Video, Mouse Unit A keyboard, video monitor, and mouse (KVM) unit is included in the rack system and is precabled to the CGM node. This KVM is used for the initial configuration process by which the CGM node is configured with an IP address. After the initial configuration, the CGM node can be accessed through a remote serial connection to the terminal server.Chapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 7 Cabling Information The Sun Fire V60x Compute Grid is shipped with all required cables already installed, routed, and connected in a cable harness assembly. The cables are labelled to make it easy to reconnect them if any come loose during shipping, or if components are subsequently replaced. Each cable-end is labeled with the device and port that it should connect to. For example, an Ethernet cable that connects Sun Fire V60x node #1 to network switch number one would have one end labeled, “V60x_1 eth0,” and the other end labeled, “Switch1 1.” Serial cables used for terminal server connections are RJ-45 to RJ-45 rollover cables (8-core, Cat 5 type Ethernet). Network cables used for network switch connections are RJ-45 to RJ-45 straight cables (8-core, Cat 5/5e type Ethernet). See TABLE 1-2 for the wiring specifications for the two types of cables. TABLE 1-2 Cable Wiring Specifications Serial Cable Pins (Rollover) Network Cable Pins (Straight) End A Pin End B Pin End A Pin End B Pin 1 8 1 1 2 7 2 2 3 6 3 3 4 5 4 4 5 4 5 5 6 3 6 6 7 2 7 7 8 1 8 88 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Single-Rack System The diagram in FIGURE 1-3 shows how the components of a system are interconnected. FIGURE 1-3 Single-Rack Cabling Diagram, Rear View To Telnet connection from terminal server To Ethernet connection from interconnected KVM unit connected to CGM node Serial connection from nodes to terminal server Ethernet connections from nodes to interconnected network AC power inputs (4) switches network switches KVM unit CGM nodeChapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 9 Multiple-Rack System The two network switches in each rack are interconnected with preinstalled, 1.8-feet (.5-meter), 32-Gbps stacking cables connected to their stacking ports. Each network switch has two stacking ports on its rear panel (the rear panel of the network switch faces the front of the system rack). Refer to the network switch documentation that is shipped with your system for more information about switch stacking. When you order a system with multiple racks, the network switches must be interconnected across the racks. You can order 9.8-feet (3-meter) stacking cables for this purpose. The diagram in FIGURE 1-4 represents a system with four fully-populated racks and a suggested stacking-cable configuration. The network switches and their stacking ports are represented. This configuration would enable interconnection of the data in all racks and enable an aggregated uplink to the network from the base rack. FIGURE 1-4 Multiple-Rack Cabling Diagram Aggregated uplink to network Rack 1 (base rack) Rack 2 (expansion rack) Rack 3 (expansion rack) Rack 4 (expansion rack) CGM node KVM unit Switch-stacking interconnects with 32-Gbps bandwidth10 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Installing the System Hardware The installation site must meet specified requirements, which are described during the sales process with your organization. For reference, the environmental requirements are described in Appendix A. 1. Verify that your installation site complies with the environmental specifications as described in Appendix A. Site-planning specifications are discussed as a part of the sales process, but are included in this guide for reference and verification. 2. Unpack each system rack from its shipping carton and position it at the installation location. Refer to the “Sun Rack Unpacking Instructions” (816-6385), which is shipped with your system. 3. Mount each system rack, level the rack feet, and install the anti-tilt bar to the rack as desired. Refer to the “Sun Rack Installation Guide” (816-6386), which is shipped with your system. 4. Check that all preinstalled cable connections between system components are firmly connected. The cables are labelled to make it easy to reconnect them if any come loose during shipping, or if components are subsequently replaced. Each cable-end is labeled with the device and port that it should connect to. For example, an Ethernet cable that connects Sun Fire V60x node #1 to network switch number one would have one end labeled, “V60x_1 eth0,” and the other end labeled, “Switch1 1.” 5. Connect each system rack to four power outlets at your installation site, as follows. The system rack’s power distribution system consists of four inputs (two sets of two: AC_Grid_0 and AC_Grid_1), two power sequencers (A and B), two power strips, and connecting cables. See FIGURE 1-5 for a diagram. Each power input to the rack should be connected to a dedicated 20 Amp (North America) or 16 Amp (International) branch circuit. Individual outlets are grouped into sets of four. Each individual rack outlet has a maximum current rating of 10 Amps. However, each outlet group has a maximum current rating of 10 Amps also. In other words, the total current for a group of four outlets cannot exceed 10 Amps.Chapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 11 FIGURE 1-5 Sun Rack 900 Power Distribution System Diagram a. Turn off the power to the branch circuits that will supply power to the system. b. Make sure both power sequencers in the rack are switched off. c. Connect one end of each of the provided power cables to a branch circuit. d. Connect the other end of each power cable to the rack’s power input panel. 6. Connect the system to the network by connecting an Ethernet cable at your site to the system’s network switch. Note – If you are installing expansion racks in addition to the base system rack, connect the base system (the rack with the CGM node) to the network and connect the expansion racks to the base system rack as shown in FIGURE 1-4. AC_Grid_0 AC_Grid_1 A B INPUT_A0 INPUT_A1 INPUT_B1 INPUT_B012 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Powering On the System 1. Power on the system rack as follows. a. Turn on power to the rack by switching on your site’s branch circuits. b. Turn on the four power sequencer switches on the front-right side of the rack.
The Power On indicator lights on both power sequencers should light.
The Power On indicator lights on both power strips should light. Power is automatically applied to the terminal server, network switch, and KVM unit. 2. Verify that the power is on in the network switches, terminal server, and KVM unit. It can take about a minute for the power indicator LEDs on the components to light. 3. Power on the CGM node, which is identifiable by its “Sun Fire CGM” label. a. If the front bezel is attached to the node, remove it by grasping the finger-hole at the left side of the bezel and swinging it open to the right until it disengages. b. Press and release the power button on the right-front of the node. See FIGURE 1-6 for the location of the power button. Note – If you are performing an initial installation, do not power on the other nodes of the system at this time. FIGURE 1-6 Sun Fire V60x Server Power and Reset Button Locations Power/Sleep button Reset buttonChapter 1 Sun Fire V60x Compute Grid Rack System Hardware Overview and Installation 13 4. Power on any expansion racks by repeating Step 1 and Step 3 for each expansion rack. Note – If you are performing an initial installation, do not power on the other nodes in the expansion racks at this time. 5. To continue with installation, go to “Setting Up the Sun Fire V60x Compute Grid Software” on page 21. Adding or Replacing Hardware Components You can order the following hardware component options and add them to the system after the initial installation:
Sun Fire V60x node
Network switches Tools Required The tools that are needed to add or replace Sun Fire V60x Compute Grid components in the rack are listed here:
Phillips-head screwdriver #1, used for attaching rack-mount kits
Phillips-head screwdriver #2, used for slide-rail securing screws Replacing Sun Rack Parts The Sun Rack Service Manual (816-6387) contains troubleshooting procedures, and removal and replacement procedures for the following rack parts:
Power sequencers
Power strips
Cable harnesses
Top panel The Sun Rack Service Manual is shipped with your system and is also available online at the following URL: http:\\docs.sun.com14 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Adding or Replacing a Sun Fire V60x Node The software configuration tasks required when adding or replacing a node differ, depending on how the node will be used in the system. Use the procedure listed here that is appropriate.
“Replacing a CGM Node” on page 14
“Replacing a Grid Master Node or Compute Node” on page 14 Replacing a CGM Node If you replace a CGM node, you must reload all of the software that was preloaded on the original node at the factory. If you need to replace a Sun Fire V60x node or a component inside the Sun Fire V60x node that acts as your CGM node, refer to the Sun Fire V60x and Sun Fire V65x Server Troubleshooting Guide and the Sun Fire V60x and Sun Fire V65x Server User Guide, which are included on the Sun Fire V60x and Sun Fire V65x Documentation CD (shipped with your system). These guides include instructions for removing and replacing Sun Fire V60x nodes in a Sun Rack 900, and for replacing internal node components. After you have replaced the node or node component, reload the operating system and Cluster Grid Manager software using the procedures in the Sun Fire V60x Compute Grid Rack System Release Notes (817-3074). Replacing a Grid Master Node or Compute Node If you need to replace a Sun Fire V60x node or a component inside the Sun Fire V60x node that acts as your grid master node, refer to the Sun Fire V60x and Sun Fire V65x Server Troubleshooting Guide and the Sun Fire V60x and Sun Fire V65x Server User Guide, which are included on the Sun Fire V60x and Sun Fire V65x Documentation CD (shipped with your system). After you have replaced the node or node component, you must use the Sun Control Station software on the CGM node to redefine the replacement node as a managed host, and as either the grid engine master host or as an execution host. Refer to the Sun Control Station 2.0 Administration Manual, which is included on the Sun Control Station 2.0 Software CD (shipped with your system), and “Configuring the Grid Engine Module” on page 53. Adding or Replacing a Network Switch If you need to replace a network switch, refer to the instructions that are shipped with the replacement switch for installation and configuration instructions.15 C H A P T E R 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation The Sun Fire V60x Compute Grid rack system is shipped with operating system and grid management software preinstalled to the Cluster Grid Manager (CGM) node. The grid master node and compute nodes are not shipped with preinstalled software. This chapter contains overview information and procedures for performing an initial setup and basic configuration of the system software components. The procedure for deploying the operating system to the grid master node and grid compute nodes is also included. The information in this chapter is organized into the following sections.
“Sun Fire V60x Compute Grid Software Components Overview” on page 16
“Setting Up the Sun Fire V60x Compute Grid Software” on page 21
“Information Required For Software Setup” on page 21
“Logging In and Setting Up the System Identity” on page 23
“Using the AllStart Module to Deploy Software” on page 27
“Adding Compute Nodes as SCS Managed Hosts” on page 50
“Configuring the Grid Engine Module” on page 5316 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Sun Fire V60x Compute Grid Software Components Overview The following diagram represents the software components that are preinstalled on the CGM node and how they are related. The sections that follow give brief descriptions of the components that are labeled in the diagram. FIGURE 2-1 Sun Fire V60x Compute Grid Software Components Red Hat Enterprise Linux ES (Enterprise Server Edition) Sun Control Station Cluster Grid Manager Installation and Setup Tools Sun Control Station AllStart module Sun Fire V60x Ethernet and SCSI Drivers Sun Control Station standard modules: Software Management, Health Monitoring, Performance Monitoring, Inventory, Lights-Out Management Sun ONE Grid Engine, Monitoring/Deployment Tools Sun Control Station Grid Engine module Sun Control Station Enterprise EditionChapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 17 Red Hat Enterprise Linux Operating System Red Hat Enterprise Linux (Enterprise Server Edition) is the Linux operating system that is preinstalled on the CGM node of the system. For detailed information about administering and customizing Linux operating system software, refer to the manual that was shipped with your Red Hat Enterprise Linux 2.1 media kit. Cluster Grid Manager Software As shown in FIGURE 2-1, the Cluster Grid Manager software is comprised of several components that supplement each other to enable you to install, set up, and monitor activities on your Sun Fire V60x Compute Grid. Sun Control Station and its standard control modules, plus the AllStart module and the Grid Engine module, comprise the Cluster Grid Manager interface that you use to administer your Sun Fire V60x Compute Grid. See FIGURE 2-2 for a sample Cluster Grid Manager main window. You access the Cluster Grid manager main window by using a browser to go to the IP address of your CGM node (for example, http:\\n.n.n.n, where n.n.n.n is the IP address of your CGM node). Instructions for setting up the CGM node so that it can be correctly accessed are described in “Logging In and Setting Up the System Identity” on page 23. Documentation for the Cluster Grid manager software components can be accessed with the Help button, which is the button with the question mark (?), in the upperright corner (see FIGURE 2-2). Sun Control Station Software Sun Control Station (SCS) is a server management and monitoring tool. Software control modules that are included with your system are easily accessed and controlled through the Cluster Grid Manager main window. There is both a server-side component and a client-side component for SCS.
The server-side component consists of two parts: A core framework that is the engine for executing control modules, and the built-in control modules themselves. This server-side component can be installed on any x86-based server running a qualified Linux operating system.
The client-side component, known as an agent, can run on both Linux and Solaris platforms.18 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 The standard control modules that are shipped with Sun Control Station are listed and described briefly here. All modules are accessed from the left-side panel in the Cluster Grid Manager main window (see an example in FIGURE 2-2). For detailed information about SCS software and the standard control modules that are integrated with it, refer to the Sun Control Station Administration Manual, (817- 3603). This manual and those for the control modules are accessed by clicking the Help button on the Cluster Grid Manager main window.
Software Management module This module enables you to manage software package files on your system. For example, you can view, download, and upload package files, view lists of required package files, and install and publish package files. See Sun Control Station Software Management Module (817-3611), which you can access with the Cluster Grid Manager Help button.
Health Monitoring module This module enables you to monitor the health status of your managed hosts according to parameters that you define. You can retrieve and view health-status data, verify network communication, and configure the parameters for health monitoring, including email alerts for critical system events. See Sun Control Station Health Monitoring Module (817-3607), which you can access with the Cluster Grid Manager Help button.
Performance Monitoring module This module enables you to view the performance of your managed hosts according to various parameters. You can view and update performance data for a host or group of hosts. See Sun Control Station Performance Monitoring Module (817-3610), which you can access with the Cluster Grid Manager Help button.
Inventory Module This module enables you to keep track of the hardware components in your system. You can view and update a summary inventory of the hardware components in a host or group of hosts. See Sun Control Station Inventory Module (817-3608), which you can access with the Cluster Grid Manager Help button.
Lights-Out Management module This module enables you to remotely perform certain management functions. For example, this module enables you to remotely power on and power off a host, perform a hardware reset, illuminate an LED for host identification, and view sensor data and the system event log. See Sun Control Station Lights-Out Management Module (817-3609), which you can access with the Cluster Grid Manager Help button. Note – Refer to the Sun Fire V60x Compute Grid Rack System Release Notes for a list of supported browsers and Java™ plug-ins for viewing SCS software.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 19 AllStart Module The AllStart module facilitates the installation of operating system software to the system nodes. This module integrates the KickStart utility of Linux. You can access the AllStart module through the Cluster Grid Manager main window. See Sun Control Station AllStart Module (817-3605), which you can access with the Cluster Grid Manager Help button. The AllStart control module provides a common user interface for creating operating system software payloads, defining client profiles, and deploying the software payloads to the clients. This module enables you to:
Select the distributions of operating systems to load onto a host
Select driver files to load onto a host
Create customized payloads made up of files and OS distributions
Create profiles containing client configuration information
Add client hosts on which the payloads and profiles are loaded, by using the Media Access Layer (MAC) address of the host Note – You can determine the MAC address for any node in the system by referring to the file, /usr/mgmt/diag/check.out, which is installed on your CGM node. The MAC addresses are listed by the node numbers that are assigned at the factory. The node numbers can be determined by the labels that are affixed to each node. Grid Engine Module The Grid Engine module is integrated with Sun ONE Grid Engine, Enterprise Edition (S1GEEE) software. The Grid Engine module deploys the S1GEEE software to the grid master node, which you can designate as the S1GEEE master host, and to the grid compute nodes, which you can designate as S1GEEE execution hosts. You can access the Grid Engine module and its functions through the Cluster Grid Manager main window. For basic instructions on using the Grid Engine module, refer to “Configuring the Grid Engine Module” on page 53. For more detailed information about the Grid Engine module, you can access the document, Sun Control Station Grid Engine Module (817-3606) with the Cluster Grid Manager Help button. S1GEEE documentation can also be accessed with the Cluster Grid Manager Help button.20 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-2 Sample Cluster Grid Manager Main WindowChapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 21 Setting Up the Sun Fire V60x Compute Grid Software The procedures in this section describe how to get the system software up and running during initial installation and login. For detailed information about customizing and administering your system after your installation, references to software documentation are provided. Information Required For Software Setup TABLE 2-1 shows the information that you will need to obtain from your site’s system administrator to complete the software setup for your system. Default settings are listed if they exist. The right-hand column is supplied for you to write down the settings that you will use for your site. Note – You can determine the MAC address for any node in the system by referring to the file, /usr/mgmt/diag/check.out, which is installed on your CGM node. The MAC addresses are listed by the node numbers that are assigned at the factory. The node numbers can be determined by the labels that are affixed to each node.22 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 TABLE 2-1 Software Setup Required Information System Setting Name Default Setting Setting For Your Site Terminal server IP address 192.168.160.10 Netmask 255.255.255.0 Gateway n/a CGM node IP address 192.168.160.5 Compute node 32 IP address n/a Compute node 31 IP address n/a Compute node 30 IP address n/a Compute node 29 IP address n/a Compute node 28 IP address n/a Compute node 27 IP address n/a Compute node 26 IP address n/a Compute node 25 IP address n/a Compute node 24 IP address n/a Compute node 23 IP address n/a Compute node 22 IP address n/a Compute node 21 IP address n/a Compute node 20 IP address n/a Compute node 19 IP address n/a Compute node 18 IP address n/a Compute node 17 IP address n/a Compute node 16 IP address n/a Compute node 15 IP address n/a Compute node 14 IP address n/a Compute node 13 IP address n/a Compute node 12 IP address n/a Compute node 11 IP address n/a Compute node 10 IP address n/a Compute node 9 IP address n/a Compute node 8 IP address n/a Compute node 7 IP address n/a Compute node 6 IP address n/a Compute node 5 IP address n/a Compute node 4 IP address n/a Compute node 3 IP address n/a Compute node 2 IP address n/a Compute node 1 IP address n/aChapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 23 Logging In and Setting Up the System Identity Note – Begin this procedure after you have powered on the system as described in “Powering On the System” on page 12. 1. Slide the KVM unit out from the rack until the video screen can be opened. The KVM is precabled directly to the CGM node. You should see the Red Hat Linux login display on the video screen. 2. Log in as root user at the Red Hat Linux login screen, using the default entries shown below. user: root password: admin 3. Open a terminal window and change the default Linux root password to a password of your choosing. Use the passwd command to change the root password on the system. 4. Configure an IP address for the system’s terminal server as follows: Note – No changes to routing tables are required if you leave the terminal server on the same subnet as the rest of the system components. If you put the terminal server on another subnet, you will have to update routing tables. a. Make a Telnet connection to the default IP address of the terminal server in your first rack. The default IP address of the terminal server is 192.168.160.10. The system has been preconfigured so that no changes to routing tables are required. telnet 192.168.160.10 Login: InReach Password: access b. At the InReach prompt, enter the enable command. InReach:0> enable c. Enter the following password when you are prompted. Password: system d. When the InReach prompt appears again, enter the config command. InReach:0>> config24 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 e. At the prompts, enter the following commands to configure the terminal server IP address. Config:0>> interface 1 Intf1-1:0>> address n.n.n.n Where n.n.n.n is an IP address compatible with your local network. You can safely ignore the message, Warning, interface active, which appears because you are about to change the interface. f. At the prompts, enter the following commands to configure the terminal server netmask setting. Intf1-1:0>> mask n.n.n.n Intf1-1:0>> exit Where n.n.n.n represents a netmask setting that is compatible with your local network. g. At the prompts, enter the following commands to configure the terminal server gateway setting. Config:0>> gateway n.n.n.n Config:0>> exit Where n.n.n.n represents a gateway setting that is compatible with your local network. It might take several seconds for the gateway setting to take effect. h. When the InReach prompt appears, save the changes with the following command. InReach:0>> save configuration flash i. At the InReach prompts, enter the exit command twice to return to the system’s root prompt. InReach:0>> exit InReach:0> exit 5. Configure an IP address for the CGM node as follows. a. Change to the network-scripts directory. # cd /etc/sysconfig/network-scripts/ b. Delete the ifcfg-eth0 file. # rm ifcfg-eth0 You can confirm the deletion by typing Y when prompted.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 25 c. Edit the ifcfg-eth1 file to read as follows, substituting your IP address, netmask, and gateway information. DEVICE=eth1 ONBOOT=yes BOOTPROTO=static IPADDR=n.n.n.n NETMASK=n.n.n.n GATEWAY=n.n.n.n Where n.n.n.n represents the respective settings that are compatible with your local network. Use vi or another file-editing tool, such as Gedit, which is supplied with your Gnome desktop (start Gedit by typing gedit at a command line). d. At the command line, use the following command to apply your changes. # service network restart 6. Verify that the IP addresses for the terminal server and CGM node are set correctly by pinging the address of the terminal server from the CGM node: ping n.n.n.n Where n.n.n.n represents the IP address of the terminal server. 7. After you have verified that the CGM node is visible on your network, start a browser and type the following URL. http://n.n.n.n Where n.n.n.n is the IP address that you assigned to the CGM node. Refer to The Sun Fire V60x Compute Grid Rack System Release Notes for a list of supported browsers and Java plug-ins for viewing SCS software. 8. Read the Sun Control Station license agreement that appears and accept the license agreement if you agree with the terms. A Sun Control Station Welcome page appears. 9. Go to the Sun Control Station login page for your CGM node by entering the URL in the format that is shown on the Welcome page: https://n.n.n.n:8443/sdui Where n.n.n.n is the IP address that you assigned to the CGM node. Note – The URL uses the https format.26 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 10. At the Sun Control Station login page (see FIGURE 2-3), log in as the SCS administrator using the default entries shown below, then click the Login button. User Name: admin Password: admin FIGURE 2-3 Sample Cluster Grid Manager Login Page 11. After the SCS main window opens (see FIGURE 2-2), change the default SCS admin password to a password of your choosing, as follows: a. In the left-side panel, click on Station Settings > Password. b. Enter the new password in the supplied fields, then click the Save button. The message, “Password changed successfully,” appears when the change is complete.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 27 Using the AllStart Module to Deploy Software The AllStart module deploys the software to the Sun Fire V60x clients. The following procedure provides a quick path through AllStart to accomplish this specific software deployment. For a complete description of the module, and instructions for using AllStart, refer to Sun Control Station 2.0 AllStart Module (817-3605) documentation provided with the AllStart module. Using the AllStart module to load software to system nodes consists of the following actions: 1. Creating the AllStart distributions. See “Creating AllStart Distributions” on page 28. 2. Creating a payload(s) from files and distributions. See “Creating AllStart Payloads” on page 30. 3. Creating a profile(s) containing configuration information. See “Creating AllStart Profiles” on page 33. 4. Creating and enabling clients to which you will load the payload. See “Creating and Enabling Clients” on page 41. 5. Defining network service settings for the network that your system is on. See “Defining Network Service Settings” on page 47. 6. Powering on or rebooting client nodes so that they network-boot and pull the payload from the Sun Control Station. See “Deploying Software Payloads to Compute Nodes” on page 49. The following sections walk you through each of these steps.28 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Creating AllStart Distributions You must first define the software distributions that you will later load to the compute nodes. 1. In the Cluster Grid Manager main window, select AllStart > Distributions from the left-side panel. The AllStart Distributions window appears on the right side of the screen. 2. Click on Add at the bottom of the AllStart Distributions window. The Upload Distribution From CDROM window appears on the right side of the screen. 3. In the Upload Distribution From CDROM window, fill in the fields to create a unique description for the distribution. See FIGURE 2-4 for an example. The CDROM Device field should contain /dev/cdrom as the default entry. FIGURE 2-4 Upload Distribution From CDROM Window 4. Insert the Linux CD 1 into the CGM node, then click Upload Now. A progress bar indicates the progress of the upload. If a file manager window opens when you insert the CD, you can close the file manager. 5. After the progress bar indicates that progress is 100%, click Done and remove the Linux CD 1 from the CGM node. You are prompted to insert the next CD.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 29 6. Insert the next CD in your Linux distribution, then click Continue. 7. Continue loading CDs when prompted until you have loaded the last CD in your Linux distribution, then click Done. When uploading is complete, the distribution that you created appears in the list in the AllStart Distributions window. See FIGURE 2-5 for an example. FIGURE 2-5 AllStart Distributions Window 8. Continue with “Creating AllStart Payloads” on page 30.30 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Creating AllStart Payloads After the required distributions are available, use AllStart to create payloads that will be deployed to the compute nodes. 1. In the Cluster Grid Manager main window, select AllStart > Payloads in the leftside panel. The AllStart Payloads window appears on the right side of the screen. 2. In the AllStart Payloads window, click Add. The Create AllStart Payload window appears on the right side of the screen. See FIGURE 2-6 for an example. FIGURE 2-6 Create AllStart Payload Window 3. In the Create AllStart Payload window, create the payload by filling in the fields and selecting the Linux distribution that you created. 4. When you are finished, click Next. The AllStart Payload Distribution Specific Options window appears on the right side of the screen. See FIGURE 2-7 for an example.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 31 FIGURE 2-7 AllStart Payload Distribution Specific Options Window 5. In the Distribution Groups To Include list, select the groups that you require for the applications that you will use and move them to the Groups Loaded column. You can select all groups by selecting the “Everything” option and moving it to the Groups Loaded column. 6. In the Files to Include list, verify that the Files Loaded selection list includes the base-mgmt-agent RPM file. If this file is not included, select it from the Files Not Loaded column and move it to the Files Loaded column. 7. Verify that the check-box for Sun Fire V60x/V65x server installation is selected. This selection ensures that the required drivers for the Sun Fire V60x server are included. 8. When you are finished, click Save. The payload is created, with the name you gave it. 9. Wait until the progress bar indicates 100%, then click Done. When payload creation is complete, the payload that you created appears in the list in the AllStart Payloads window. See FIGURE 2-8 for an example.32 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-8 AllStart Payloads Window 10. Continue with “Creating AllStart Profiles” on page 33.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 33 Creating AllStart Profiles After the payloads have been defined, use AllStart to create installation profiles for the compute nodes. 1. From the left-hand menu click on AllStart > Profiles. The AllStart Profiles window appears. 2. Click on Add at the bottom of the AllStart Profiles window. The Add AllStart Profile window appears on the right side of the screen. 3. Create the AllStart profile by defining the options in the series of windows that appear. Note – As you work through the series of windows to create the profile, you can accept the defaults or customize your system except for any required entries and selections listed in the following steps. a. In the Add AllStart Profile window, select the settings that are appropriate for your site (see FIGURE 2-9 for an example). Click Next when you are finished. Note – If you use the KVM unit that is provided with the system, you must select “U.S. English” as the Keyboard type. FIGURE 2-9 Add AllStart Profile Window34 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 b. In the Edit Boot Loader Options window, verify that the following required entries are selected (see FIGURE 2-10 for an example). Click Next when you are finished.
Install Boot Loader: Select
Choose Boot Loader: LILO
LILO Option, Use Linear Mode: Do not select
LILO Option, Force Use of lba32 Mode: Select FIGURE 2-10 Edit Boot Loader Options Window (AllStart Profiles)Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 35 c. In the Partition Options window, verify that the following required options are selected (see FIGURE 2-11 for an example). Click Next when you are finished.
Master Boot Record: Clear Master Boot Record
What Do You Want Done With Existing Partitions?: Remove All Existing Partitions
What Do You Want Done With Disk Label?: Initialize the Disk Label FIGURE 2-11 Partition Options Window (AllStart Profiles) d. Use the Disk Partition Information window to create the partitions you require on the client node that you are installing to, as follows: i. In the Disk Partition Information window, click Add. The Partition Options window appears, where you define the parameters for one disk partition. ii. Create your first disk partition by defining the partition parameters, then click Save when you are done. See FIGURE 2-12 for an example. After you click save, you are returned to the Disk partition Information window, where the partition you created appears in the list (see FIGURE 2-13). iii. To create another partition, click Add again in the Disk Partition Information window and define another partition as in Step ii.36 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-12 Partition Options Definition Window (AllStart Profiles) Three different example partition configurations are listed as follows:
Partition example 1:
Mount Point: /
File System Type: ext3
Size MB: 5000
Fixed Size: Select
Make Partition On Specific Drive: sda
Partition example 2:
Mount point: /boot
File System type: ext3
SizeMB: 100 Fixed Size: Select
Make Partition On Specific Drive: sda
Partition example 3:
Mount point: swap
File System type: swap
Size MB: 2048
Fixed Size: Select
Make Partition On Specific Drive: sdaChapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 37 FIGURE 2-13 Disk Partition Information Window (AllStart Profiles) iv. After you have created all your partitions, click Next on the Disk Partition Information window. e. In the Edit Authentication Information window, verify that the following required options are selected (see FIGURE 2-14 for an example). Click Next when you are finished.
Enable shadow passwords: Y
Enable MD5: Select38 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-14 Edit Authentification Information Window (AllStart Profiles) f. In the X Config Options window, make the selection that you require (see FIGURE 2-15 for an example). Click Next when you are finished. FIGURE 2-15 X Config Options Window (AllStart Profiles)Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 39 g. In the Edit Custom Script Options window, verify that the following required options are selected (see FIGURE 2-16 for an example). Click Save when you are finished. These scripts enable serial redirection.
lilo_remove_boot_msg.sh: Select
lilo_add_console.sh: Select The profile is created. FIGURE 2-16 Edit Custom Script Options Window (AllStart Profiles) 4. Wait until the progress bar indicates 100%, then click Done. When profile creation is complete, the profile that you created appears in the list in the AllStart Profiles window. See FIGURE 2-17 for an example.40 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-17 AllStart Profiles Window 5. Continue with “Creating and Enabling Clients” on page 41.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 41 Creating and Enabling Clients After the installation profiles have been defined, use AllStart to create and enable clients to which the payload will be deployed. 1. From the left-hand menu click AllStart > Clients. The AllStart Clients window opens. 2. Click on Add at the bottom of the window. The Create AllStart Client window appears in the right side of the screen. 3. In the Create AllStart Client window, create the client by defining the information for the node to which you will be loading the payload (see FIGURE 2-18 for an example). Verify that the following required options are selected:
Install Type: http
Console: ttyS1
Serial Console Baud: 9600
Install Network Device: eth1
Payload: Select the payload you created for this installation
Profile: Select the profile you created for this installation Note – You can get the MAC address for any node in the system by referring to the file, /usr/mgmt/diag/check.out, which is installed on your CGM node. The MAC addresses are listed by the node numbers that are assigned at the factory. The node numbers can be determined by the labels that are affixed to each node. Note – The Install IP Address field allows you to define an IP address for the client node that is temporary and that can be used for the AllStart installation only. To give you flexibility, this address can be the same or different than the permanent IP address that the node receives for normal use.42 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-18 Create AllStart Client Window 4. When you are finished defining the Client options, click Next. The Network Interfaces window appears. 5. In the Network Interfaces window, click Add. The Enter Network Interface Information window appears.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 43 6. In the Enter Network Interface Information window, create the network interface by defining the information for the node to which you will be loading the payload (see FIGURE 2-19 for an example). Verify that the following required options are selected:
Network device: eth1
Network Type: Static IP Note – When you enter a host name, use the short host name format, not the full host name format that would include the domain name. FIGURE 2-19 Enter Network Interface Information Window (AllStart Clients) 7. When you are finished defining the network interface, click Save. You are returned to the Network Interfaces window. The network interface that you created is listed (see FIGURE 2-20 for an example).44 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-20 Network Interfaces Window (AllStart Clients) 8. In the Network Interfaces window, click Save. A progress bar indicates the progress of the network interface creation. 9. When the progress bar indicates 100%, click Done. You are returned to the AllStart Clients page. The client that you created is listed (see FIGURE 2-21 for an example).Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 45 FIGURE 2-21 AllStart Clients Window 10. In the AllStart Clients window, select the clients that you want to enable, then click Enable. A progress bar indicates the progress of the client enabling. 11. When the progress bar indicates 100%, click Done. The client entry is enabled so that it is visible to that node in the system. Enabled clients are indicated by a Y character under the Enabled heading on the AllStart Clients window. See FIGURE 2-22 for an example.46 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-22 AllStart Clients Window With Enabled Client 12. Repeat Step 3 through Step 11 for all nodes in your system. 13. Continue with “Defining Network Service Settings” on page 47.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 47 Defining Network Service Settings 1. In the Cluster Grid Manager main window, select AllStart > Service from the leftside panel. The AllStart Current Service Settings window appears on the right side of the screen. 2. Click Modify. The Modify Service Settings window appears. 3. In the Modify Service Settings window, make the following required settings (see FIGURE 2-23 for an example):
DHCP Enabled: Select
DHCP Interface: eth1 FIGURE 2-23 Modify Service Settings Window 4. When you are finished with the settings, click Save. A progress bar indicates the progress of the service setting. 5. When the progress bar indicates 100%, click Done. The settings that you made are shown in the AllStart Current Service Settings window (see for an example).48 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-24 AllStart Current Service Settings Window 6. Continue with “Deploying Software Payloads to Compute Nodes” on page 49.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 49 Deploying Software Payloads to Compute Nodes After you have created clients to which you will deploy payloads, you start the deployment by powering on or resetting the client nodes. 1. In a terminal window, telnet to the terminal server IP address and port that corresponds to the node to which you are deploying software. # telnet n.n.n.n 70xx Where n.n.n.n is the IP address of the terminal server and xx is the two-digit number that corresponds to the number of the node to which you are deploying software (see the following note). Note – The nodes of the system are assigned a number in the factory and this number is indicated by a label on each node. The ports of the terminal server are assigned a four-digit number that always starts with 70 and ends with the two-digit number that corresponds to the node the port is attached to at the factory. For example, node #2 is attached to port 7002 and node #30 is attached to port 7030. 2. Power on or reset the client node to start the deployment of the payload that was selected in the client profile.
If the node contains no OS yet, power on the node by pressing the Power button. The node automatically boots from the network and pulls the payload from the CGM node.
If an OS was previously installed on the node, perform the following steps: a. Press the Reset button on the node (see FIGURE 2-25). b. When a prompt appears with the option to press F2 to enter setup, press Escape to initiate a network boot. c. When you are prompted to select the boot device, select IBA 1.1.08 slot 0338 and press Return. The client node pulls the payload from the CGM node. FIGURE 2-25 Sun Fire V60x Server Power and Reset Button Locations Reset button Power/Sleep button50 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 3. Wait until the deployment progress indicator messages are finished and the terminal window returns to a login prompt. 4. When you are finished downloading the payload to the client node, reboot the client node (if it does not reboot automatically). Repeat this procedure for each client node to which you are deploying software. Adding Compute Nodes as SCS Managed Hosts Use the following procedure to define the compute nodes of your system as SCS managed hosts. Note – Before you can deploy the Sun ONE Grid Engine, Enterprise Edition software to the system compute nodes so that they can be managed as a grid, you must first add the nodes as Sun Control Station managed hosts. Note – You cannot add the CGM node as an SCS managed host because it is the dedicated management node of the system, from which SCS managed hosts are managed. 1. In the Cluster Grid Manager main window, select Administration > Hosts from the left-side panel. The Managed Hosts window appears on the right side of the screen. 2. In the Managed Hosts window, click Add. The Add Host window appears. 3. In the Add Host window, define the settings for the node that you are defining as an SCS managed host. See FIGURE 2-26 for an example. 4. Verify that the Install All Possible Modules box is selected. This ensures that all of the SCS agents are installed on the newly managed host.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 51 FIGURE 2-26 Add Host Window 5. When you are finished with the settings, click Add Host. A progress bar indicates the progress of the managed host addition. 6. When the progress bar indicates 100%, click Done. You are returned to the Managed Hosts window. The managed host you added is listed (see FIGURE 2-27 for an example).52 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-27 Managed Hosts Window 7. Repeat this procedure for all compute nodes in your system.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 53 Configuring the Grid Engine Module The Compute Grid software module provides the following main functions.
Deployment of the Sun™ ONE Grid Engine, Enterprise Edition (S1GEEE)
High-level monitoring of system tasks
Uninstall of the S1GEEE software Note – Before you can manage the compute nodes of your system with S1GEEE software, you must add the nodes as SCS managed hosts. See “Adding Compute Nodes as SCS Managed Hosts” on page 50. Deploying the Sun ONE Grid Engine Software The Grid Engine module automatically deploys S1GEEE to any number of selected nodes on the compute grid. It deploys the S1GEEE master host onto a grid master node of your choosing (see “Grid Master Node” on page 6), and then deploys S1GEEE execution hosts onto specified compute nodes (see “Compute Nodes” on page 6). You can also choose to uninstall an execution host at a later time, or uninstall all hosts, including the master host. You can then later reinstall a host on any systems. Note – The Grid Engine module deploys only a dedicated S1GEEE master host system. Unless you plan to have relatively low job throughput on your grid, it is not recommended to use the S1GEEE master host system also as an execution host. However, if you would like to make use of the CPUs on the grid master node to perform compute tasks, you can manually deploy S1GEEE execution host software onto the grid master node. If you wish to remove this functionality at a later point, this must also be done manually. (However, if you choose to uninstall all systems, it is not necessary to remove the execution host functionality from the grid master node before uninstalling all systems.) These procedures are recommend only for experienced S1GEEE users. For more information, S1GEEE documentation can be accessed with the Cluster Grid Manager help button.54 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Defining the Sun ONE Grid Engine Master Host To use the Grid Engine module to deploy a S1GEEE master host (grid master node), perform the following steps. 1. In the Cluster Grid Manager main window, click on the Grid Engine menu item in the left-hand menu. A drop-down menu of choices for the Grid Engine module appears. 2. Click on Install Master. If this is an initial installation, a license agreement appears. 3. Read any license agreement that appears and accept it if you agree with the terms. Note – You are instructed on-screen to click on Install Master again after accepting the license agreement. The Install Sun ONE Grid Engine Master window appears. 4. In the Install Sun ONE Grid Engine Master window, select one node from the list of managed hosts to act as the S1GEEE master host (grid master node). See FIGURE 2-28 for an example. FIGURE 2-28 Install Sun ONE Grid Engine Master WindowChapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 55 5. Click on Install. A progress bar indicates the progress of the S1GEEE software deployment to the node. Note – You can define only one grid master node for each system (including expansion racks with up to 128 nodes). If you try to install a second grid master node, the system instructs you to first uninstall the current grid master node. 6. When the progress bar indicates 100%, click Done. The browser is directed to the Install Sun ONE Grid Engine Compute Hosts window. Defining the Sun ONE Grid Engine Compute Hosts To use the Grid Engine module to define S1GEEE compute hosts (compute nodes), perform the following steps. Note – You can only install execution hosts after installing a master host. If you try to install execution hosts without first defining a master host, the system instructs you to first install the master host. 1. In the Cluster Grid Manager main window, click on the Grid Engine menu item in the left-hand menu. A drop-down menu of choices for the Grid Engine module appears. 2. Click on Install Host. The Install Sun ONE Grid Engine Compute Hosts window appears. 3. Select the nodes that you want to include in the S1GEEE grid. Unless you want to dedicate a system for non-grid tasks, select all systems by clicking Select All. See FIGURE 2-29 for an example.56 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 FIGURE 2-29 Install Sun ONE Grid Engine Compute Hosts Window 4. Click on Install. The S1GEEE software is deployed to each selected node in sequence and a progress bar indicates the progress of the software deployment. 5. When the progress bar indicates 100%, click Done. When you are finished with installing, your browser is redirected to the Grid Engine Monitor page (see “Monitoring Compute Grid Tasks” on page 57). If, at a later point, you wish to add more nodes to the S1GEEE grid, you can return to the Install Compute Hosts page by clicking on the Grid Engine > Install Compute Hosts menu item in the left-side panel.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 57 Monitoring Compute Grid Tasks When you are finished with installation procedure, your browser is redirected to the Monitor page. From this page, you can view various S1GEEE statistics on your Sun Fire V60x Compute Grid. These include:
The number of pending, running, and suspended jobs
The load on each execution host
The current statistics for each queue that has been configured
The average load across all compute nodes in the grid, and the used and total memory across all nodes in the grid The Monitor page is automatically refreshed every two minutes. The information on the page is drawn from a database that is updated every two minutes. For every statistic, a time stamp is given to indicate when the statistic was last updated. You can always return to the Monitor page by clicking the Grid Engine > Monitor menu item in the left-side panel. See FIGURE 2-2 for a sample Monitor window. FIGURE 2-30 Grid Engine Monitor Window58 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Uninstalling Sun ONE Grid Engine Software You can uninstall Sun ONE Grid Engine software, either from individual S1GEEE execution hosts, or from all hosts in the S1GEEE grid, including the S1GEEE master host. Note – You cannot uninstall only the S1GEEE master host, since it is not possible to operate S1GEEE execution hosts without an S1GEEE master host. After you have uninstalled an S1GEEE execution host, Sun Fire V60x Compute Grid tasks are no longer sent to that node for execution. However, the other installed modules, such as Inventory, Health, and Performance, continue to operate as before. Any other software that has been installed on that system should also continue to operate normally. Uninstalling One or More Sun ONE Grid Engine Execution Hosts 1. In the Cluster Grid Manager main window, click on the Grid Engine module menu item in the left-hand menu. A drop-down menu of choices for the Grid Engine module appears. 2. Click on Uninstall Nodes. 3. Select one or more nodes from which to uninstall S1GEEE software. 4. Ensure that no jobs are running on the systems to be uninstalled. Refer to Sun Grid Engine, Enterprise Edition 5.3 Administration and User’s Guide (816- 4739) for instructions on managing queues. Note – Any jobs that are currently running on the nodes that you have selected for uninstall are terminated. If the jobs are marked as “re-runnable”, they are automatically resubmitted to the S1GEEE grid for execution elsewhere. However, if they are marked as “not re-runnable,” then they are not rescheduled and are not automatically run elsewhere. For more information, S1GEEE documentation can be accessed with the Cluster Grid Manager help button. 5. Click on Uninstall. The S1GEEE software is shutdown and removed from the selected systems, and the S1GEEE master host is instructed to remove those execution hosts from the S1GEEE system.Chapter 2 Sun Fire V60x Compute Grid Rack System Software Overview and Installation 59 Uninstalling the Entire Sun ONE Grid Engine 1. In the Cluster Grid Manager main window, click on the Grid Engine module menu item in the left-hand menu. A drop-down menu of choices for the Grid Engine module appears. 2. Click on Uninstall Everything. Note – Do not go to the next step until you are certain that you want to terminate all running jobs and remove all record of previous jobs. 3. Click on Uninstall. This immediately terminates all running jobs, removes all S1GEEE software from all nodes in the S1GEEE, and removes all record of previously run jobs and all record of S1GEEE utilization.60 Sun Fire V60x Compute Grid Rack System Installation Guide • October 200361 A P P E N D I X A Product Specifications This appendix contains product specifications, organized into the following sections:
“Power Specifications” on page 61
“Physical Dimensions” on page 62
“Environmental Requirements” on page 63 Power Specifications The following table lists the system power specifications. TABLE A-1 Sun Fire V60x Compute Grid Power Specifications Parameter Value Nominal voltage 200, 208, 220, 230, or 240 VAC Operating voltage Single-phase 180 to 240 VAC Frequency 47 to 63 Hz Current Maximum 64Amps (4 x 16Amps) Nominal 40Amps(4 x 10Amps), fully populated rack AC plug NEMA L6-20P Domestic U.S.A. IEC 309 16A 3-position International AC plugs required Four AC plugs required per rack62 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Physical Dimensions The following table lists the physical dimensions of the system. TABLE A-2 Sun Fire V60x Compute Grid Physical Dimensions Parameter value Dimensions 74 inches height x 23.5 in. width x 35.4 in. depth (188 centimeters height x 60 cm width x 90 cm depth) Weight (fully populated rack) 1600 pounds (727 kilograms) Rack units 38 Single rack unit dimensions 1.75 inches height x 19 in. width x 23.6 in. depth (4.45 centimeters height x 48.26 cm width x 60 cm depth)Appendix A Product Specifications 63 Environmental Requirements This section contains the environmental requirements for a fully-populated, singlerack Sun Fire V60x Compute Grid rack system. The requirements are described in two separate tables for the 2.8-GHz CPU Compute Grid rack system and the 3.06-GHz CPU Compute Grid rack system. Refer to either of the following two tables:
TABLE A-3, 2.8-GHz CPU Compute Grid Environmental Specifications
TABLE A-4, 3.06-GHz CPU Compute Grid Environmental Specifications TABLE A-3 2.8 GHz CPU Sun Fire V60x Compute Grid Environmental Specifications Parameter Operating Non-Operating Temperature 86°F maximum ambient temperature at 0 feet elevation (30°C maximum ambient temperature at 0 meters elevation) -40°F to 158°F (-40°C to 65°C) Altitude Up to 9000 feet, maximum ambient temperature derated by 1.8°F per 1500 feet rise in elevation above 0 feet. (Up to 3000 meters, maximum ambient temperature derated by 1°C per 500 meter rise in elevation above 0 meters.) Up to 35000 feet (Up to 12000 meters) Humidity 10% to 90% relative humidity at 80°F maximum wet bulb, non-condensing. (10% to 90% relative humidity at 27°C maximum wet bulb, non-condensing.) 10% to 90% relative humidity Vibration .25 g’s 5Hz to 500Hz to 5Hz, 1.0 octaves per minute, swept-sine 5 sweeps in X, Y, and Z. n/a64 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 TABLE A-4 3.06 GHz CPU Sun Fire V60x Compute Grid Environmental Specifications Parameter Operating Non-Operating Temperature 77°F maximum ambient temperature at 0 feet elevation (25°C maximum ambient temperature at 0 meters elevation) -40°F to 158°F (-40°C to 65°C) Altitude Up to 4500 feet, maximum ambient temperature derated by 1.8°F per 1000 feet rise in elevation above 0 feet. (Up to 1500 meters, maximum ambient temperature derated by 1°C per 300 meter rise in elevation above 0 meters.) Up to 35000 feet (Up to 12000 meters) Humidity 10% to 90% relative humidity at 80°F maximum wet bulb, non-condensing. (10% to 90% relative humidity at 27°C maximum wet bulb, non-condensing.) 10% to 90% relative humidity Vibration .25 g’s 5Hz to 500Hz to 5Hz, 1.0 octaves per minute, swept-sine 5 sweeps in X, Y, and Z. n/a65 Index Numerics 2.8 GHz CPU system environmental requirements 63 3.06 GHz CPU system environmental requirements 64 A adding hardware components 13 adding managed hosts to Sun Control Station 50 AllStart module Clients, creating 41 deploying payloads procedure 49 deploying software to nodes 27 Distributions, creating 28 overview 19 Payloads, creating 30 Profiles, creating 33 Service Settings, defining 47 B button, Help 17 button, power 12 button, reset 49 C cables diagram, multiple-rack 9 diagram, single-rack 8 labeling 7 network cable pins 7 overview information 7 serial cable pins 7 cabling diagram, multiple-rack 9 cabling diagram, single rack 8 CGM node, see Cluster Grid Manager node Clients, creating in AllStart module 41 Cluster Grid Manager node configuring IP address 24 default IP address 22 overview information 5 Cluster Grid Manager software Help button 17 overview of components 17 Sun Control Station 17 compute hosts, defining in Grid Engine 55 compute nodes overview information 6 compute nodes, see also Grid Engine compute hosts connecting power source 1166 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 D deploying software with AllStart module 27 Distributions, creating in AllStart module 28 documentation online URL ix references for replacement procedures 13 related vi E electrical specifications 61 environmental requirements, 2.8 GHz system 63 environmental requirements, 3.06 GHz system 64 Ethernet cable pins 7 F flowchart of installation tasks 2 G gateway, configuring 24 Grid Engine compute hosts, see also compute nodes Grid Engine master host, see also grid master node Grid Engine module compute hosts, defining 55 configuring 53 master host, defining 54 monitoring grid tasks 57 overview 19 uninstalling entire grid engine 59 uninstalling execution hosts 58 grid master node overview information 6 grid master node, see also Grid Engine master host H hardware adding or replacing 13 installation procedure 10 overview diagram 3 tools required 13 Health Monitoring module 18 Help button location 17 I information required for software setup 22 initial login procedure 23 installation tasks flowchart 2 installing system hardware 10 Inventory module 18 IP address configuration for Cluster Grid Manager node 24 IP address configuration for terminal server 23 K keyboard, video, mouse unit cabling 8 overview information 6 position 3 KVM unit, see keyboard, video, mouse unit 6 L labels on cabling 7 Lights-Out Management module 18 Linux operating system overview 17 logging in the first time 23 M managed hosts, adding 50 master host, defining in Grid Engine 54 modules, see Sun Control Station software monitoring Grid Engine tasks 57 multiple-rack cabling diagram 9Index 67 N netmask, configuring 24 network cable pins 7 network service settings, defining in AllStart module 47 network switches overview 4 nodes 49 adding or replacing 13 Cluster Grid Manager IP address 22 Cluster Grid Manager node 5 compute nodes 6 defining compute nodes 55 defining grid master host 54 grid master node 6 power button 12 supported number 6 O online documentation URL ix P password, changing for Sun Control Station 26 Payloads, creating in AllStart module 30 Performance Monitoring module 18 physical dimensions 62 port number allocations on terminal server 5 power connecting power source 11 inputs location 8 node power button 12 node reset button 49 powering on sequence 12 rack distribution system diagram 11 rack distribution system overview 10 specifications 61 preinstalled software, see software product specifications 61 Profiles, creating in AllStart module 33 R rack overview information 4 power distribution system overview 10 power inputs location 8 replacing components 13 Red Hat Linux overview 17 related documentation vi relation of software components, diagram 16 replacing hardware components 13 reset button on node 49 RJ-45 cable specifications 7 S S1GEEE, see Sun ONE Grid Engine, Enterprise Edition SCS, see Sun Control Station software serial cable pins 7 Service Settings, defining in AllStart module 47 single-rack cabling diagram 8 site-planning requirements, 2.8 GHz system 63 site-planning requirements, 3.06 GHz system 64 software Cluster Grid Manager overview 17 diagram of components 16 information required for setup 21 initial login procedure 23 overview of preinstalled software 16 Red Hat Linux overview 17 setting up procedures 21 Sun Control Station 17 Sun ONE Grid Engine Enterprise Edition software Help 17 Software Management module 18 specifications 61 environmental requirements, 2.8 GHz system 63 environmental requirements, 3.06 GHz system 64 physical dimensions 62 power 61 stacking switches 968 Sun Fire V60x Compute Grid Rack System Installation Guide • October 2003 Sun Control Station software adding managed hosts 50 AllStart module 19 AllStart module, using to deploy software 27 changing password 26 Grid Engine module configuration 53 Grid Engine module overview 19 Health Monitoring module 18 Inventory module 18 Lights-Out Management module 18 Performance Monitoring module 18 Software Management module 18 standard modules overview 17 Sun Fire V60x node, see nodes Sun ONE Grid Engine, Enterprise Edition overview 53 Sun Rack 900, see rack switches interconnects 9 overview information 4 position 8 replacing 13 stacking 9 system hardware diagram 3 T table of setup information requirements 22 Telnet port allocations 5 terminal server configuring gateway 24 configuring IP address 23 configuring netmask 24 default IP address 22 default netmask 22 overview information 5 port numbers 5 position 8 tools required for component replacement 13 U uninstalling entire grid engine 59 uninstalling Grid Engine execution hosts 58 Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A. 650-960-1300 Submit comments about this document at: http://www.sun.com/hwdocs/feedback Sun Fire™ V60x Compute Grid Rack System Release Notes Part No. 817-3074-11 October 2003, Revision APlease Recycle Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. THIS PRODUCT CONTAINS CONFIDENTIAL INFORMATION AND TRADE SECRETS OF SUN MICROSYSTEMS, INC. USE, DISCLOSURE OR REPRODUCTION IS PROHIBITED WITHOUT THE PRIOR EXPRESS WRITTEN PERMISSION OF SUN MICROSYSTEMS, INC. This document and the product to which it pertains are distributed under licenses restricting their use, copying, distribution, and decompilation. No part of the product or of this document may be reproduced in any form by any means without prior written authorization of Sun and its licensors, if any. This distribution may include materials developed by third parties. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and in other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun ONE, the Sun ONE logo, Sun Fire, AnswerBook2, docs.sun.com, Java, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and in other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and in other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. The OPEN LOOK and Sun™ Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry. Sun holds a non-exclusive license from Xerox to the Xerox Graphical User Interface, which license also covers Sun’s licensees who implement OPEN LOOK GUIs and otherwise comply with Sun’s written license agreements. Products covered by and information contained in this manual are controlled by U.S. Export Control laws and may be subject to the export or import laws in other countries. Nuclear, missile, chemical/ biological weapons, or nuclear maritime end uses or end users, whether direct or indirect, are strictly prohibited. Export or reexport to countries subject to U.S. embargo, or to entities identi?ed on U.S. export exclusion lists, including, but not limited to, the denied persons and specially designated nationals lists, is strictly prohibited. Use of any spare or replacement CPUs is limited to repair or one-for-one replacement of CPUs in products exported in compliance with U.S. export laws. Use of CPUs as product upgrades, unless authorized by the U.S. Government, is strictly prohibited. DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, Etats-Unis. Tous droits réservés. CE PRODUIT CONTIENT DES INFORMATIONS CONFIDENTIELLES ET DES SECRETS COMMERCIAUX DE SUN MICROSYSTEMS, INC. SON UTILISATION, SA DIVULGATION ET SA REPRODUCTION SONT INTERDITES SANS AUTORISATION EXPRESSE, ECRITE ET PREALABLE DE SUN MICROSYSTEMS, INC. Ce produit ou document est protégé par un copyright et distribué avec des licences qui en restreignent l’utilisation, la copie, la distribution, et la décompilation. Aucune partie de ce produit ou document ne peut être reproduite sous aucune forme, par quelque moyen que ce soit, sans l’autorisation préalable et écrite de Sun et de ses bailleurs de licence, s’il y ena. Cette distribution peut comprendre des composants développés par des tierces parties. Le logiciel détenu par des tiers, et qui comprend la technologie relative aux polices de caractères, est protégé par un copyright et licencié par des fournisseurs de Sun. Des parties de ce produit pourront être dérivées des systèmes Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque déposée aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun ONE, the Sun ONE logo, Sun Fire, AnswerBook2, docs.sun.com, Java, et Solaris sont des marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits protant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. Ce produit est soumis à la législation américaine en matière de contrôle des exportations et peut être soumis à la règlementation en vigueur dans d’autres pays dans le domaine des exportations et importations. Les utilisations , ou utilisateurs ?naux, pour des armes nucléaires, des missiles, des armes biologiques et chimiques ou du nucléaire maritime, directement ou indirectement, sont strictement interdites. Les exportations ou reexportations vers les pays sous embargo américain, ou vers des entités ?gurant sur les listes d’exclusion d’exportation américaines, y compris, mais de manière non exhaustive, la liste de personnes qui font objet d’un ordre de ne pas participer, d’une façon directe ou indirecte, aux exportations des produits ou des services qui sont régis par la législation américaine en matière de contrôle des exportations et la liste de ressortissants spéci?quement désignés, sont rigoureusement interdites. L’utilisation de pièces détachées ou d’unités centrales de remplacement est limitée aux réparations ou à l’échange standard d’unités centrales pour les produits exportés, conformément à la législation américaine en matière d’exportation. Sauf autorisation par les autorités des Etats-Unis, l’utilisation d’unités centrales pour procéder à des mises à jour de produits est rigoureusement interdite. LA DOCUMENTATION EST FOURNIE "EN L’ÉTAT" ET TOUTES AUTRES CONDITIONS, DECLARATIONS ET GARANTIES EXPRESSES OU TACITES SONT FORMELLEMENT EXCLUES, DANS LA MESURE AUTORISEE PAR LA LOI APPLICABLE, Y COMPRIS NOTAMMENT TOUTE GARANTIE IMPLICITE RELATIVE A LA QUALITE MARCHANDE, A L’APTITUDE A UNE UTILISATION PARTICULIERE OU A L’ABSENCE DE CONTREFAÇON.Contents iii Contents Sun Fire V60x Compute Grid Rack System Documentation Set Summary 2 Software Recovery Procedures 3 Recovering Red Hat Enterprise Linux 2.1 3 Reinstalling the Operating System Software 3 Reconfiguring the Operating System Software 10 Cluster Grid Manager Software Recovery 11 Reinstalling Sun Control Station 2.0 Software 11 Reconfiguring the Java Plug-In Version For Mozilla 12 Installing the SCS Grid Engine Module 14 Installing Custom Scripts For Advanced Users 15 Using Scripts to Automate Installation Tasks 16 Using Scripts to Recreate a Lost check.out File 16 Using Scripts to Auto-Populate the AllStart Clients List 17 Using Scripts to Force All Nodes to Network Boot 18 Using Scripts to Add All Nodes as SCS Managed Hosts 19 Sun ONE Grid Engine Notes 20 AllStart Client Host Name Limitations 20 Grid Engine Settings 20 Grid Engine Configuration 21iv Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Important Notes 22 Location of Kickstart Files For AllStart Clients 22 PXE Network Booting Conflict With LAN Management 22 Supported Browsers and Plug-Ins 231 Sun Fire V60x Compute Grid Rack System Release Notes These release notes supplement the information in the Sun Fire V60x Compute Grid Rack System Installation Guide (817-3072). The information is organized into the following sections:
“Sun Fire V60x Compute Grid Rack System Documentation Set Summary” on page 2
“Software Recovery Procedures” on page 3
“Using Scripts to Automate Installation Tasks” on page 16
“Sun ONE Grid Engine Notes” on page 20
“Important Notes” on page 22
“Supported Browsers and Plug-Ins” on page 232 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Sun Fire V60x Compute Grid Rack System Documentation Set Summary In addition to the documents created for the installation of the Sun Fire V60x Compute Grid system, many other documents are provided to supplement the information and to provide detailed information about system components after installation. This section provides a summary of the document set. For a full list of the documents shipped with the system, see “Related Documentation” in the Preface of the Sun Fire V60x Compute Grid Rack System Installation Guide (817-3072).
Sun Fire V60x Compute Grid Rack System documents: Use these documents for initial system installation, power-on, and software setup. These two documents are shipped in hard copy with your system.
Sun Fire V60x Compute Grid Rack System Installation Guide (817-3072)
Sun Fire V60x Compute Grid Rack System Release Notes (817-3074)
Sun Rack 900 documents: Use these documents for more detailed information about the system rack. Tasks covered include unpacking, installation, and service of replaceable parts. The Sun Rack documents are shipped in hard-copy with the system.
Sun Fire V60x documents: Use these documents for more detailed information about the Sun Fire V60x servers that are used as the system nodes. Tasks covered include removal and installation from the slide-rails in the rack, and detailed diagnostics and service of replaceable parts. The Sun Fire V60x documents are shipped in a set that is a combination of hardcopy documents and PDF documents that are on the Sun Fire V60x and Sun Fire V65x Servers Documentation CD.
Sun Control Station and Sun ONE Grid Engine, Enterprise Edition documents: Use these documents for detailed information about setting up and using the software after the initial installation. Tasks covered include advanced settings for using the software to monitor and run the system as a grid. The Sun Control Station and Sun ONE Grid Engine, Enterprise Edition documents are include as PDF documents that are integrated into the Help system of the Sun Control Station software. They are also shipped as PDF files on their respective CDs.
The documents for the third-party hardware components are also included and vary, based on the supplier that is used. Documents for replacing and using the network switches, terminal server, and keyboard unit are shipped in hard-copy and as PDF files on included CDs.Sun Fire V60x Compute Grid Rack System Release Notes 3 Software Recovery Procedures Your Sun Fire V60x Compute Grid is shipped with the Red Hat Enterprise Linux 2.1 operating system and the Cluster Grid Manager software suite preinstalled on the Cluster Grid Manager (CGM) node. This section contains the procedures for recovering or reinstalling the Red Hat Enterprise Linux 2.1 operating system software and the Cluster Grid Manager software suite to the CGM node in the case that you have to replace a CGM node or reinstall the software for any reason.
“Recovering Red Hat Enterprise Linux 2.1” on page 3
“Cluster Grid Manager Software Recovery” on page 11 Recovering Red Hat Enterprise Linux 2.1 Use this procedure if you need to reinstall the Red Hat Enterprise Linux 2.1 distribution that was preinstalled on your CGM node. This section is divided into two procedures:
“Reinstalling the Operating System Software” on page 3
“Reconfiguring the Operating System Software” on page 10 Reinstalling the Operating System Software Use this procedure to reinstall the Linux operating system software. CDs Required For This procedure:
Red Hat Enterprise Linux 2.1 distribution CDs
Sun Fire V60x and Sun Fire V65x Servers Resource CD (705-0601) 1. Insert the Red Hat Enterprise Linux 2.1 CD 1 into the CGM node and wait for the first Red Hat installation screen to appear, then press Enter. 2. At the Language Selection screen, select the language for your location, then click Next. The default setting is English.4 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 3. At the Keyboard Configuration screen, accept the default settings shown below, then click Next. The default settings are:
Model: Generic 105-key international PC
Layout: US English
Dead keys: Enable dead keys 4. At the Mouse Configuration screen, select Generic 3-button mouse (PS/2), then click Next. The default setting is generic 3-button mouse (PS/2). 5. At the Welcome to Red Hat Linux screen, click Next. 6. At the Installation Type screen, choose Custom Installation Type, then click Next. The Disk Partitioning Setup screen appears. 7. Create five RAID 1 partitions on each of the two hard drives, as follows: a. At the Disk Partitioning Setup screen, select Manually Partition With Disk Druid, then click Next. The Disk Setup screen appears. b. At the Disk Setup screen, click New to begin creating a new partition. A New Partition dialog box appears. c. In the New Partition dialog box, select hard drive sda from the list of Allowable Drives to create partitions on that drive first. d. In the New Partition dialog box, select Software RAID from the Filesystem Type pull-down menu. e. In the New Partition dialog box, define one of the five Software RAID partitions listed in TABLE 1. Note – Make the /boot partition your primary partition by selecting the box labeled, “Force to be primary partition.” Note – You cannot enter the mount point for a partition until after you create the RAID 1 device in a later step.Sun Fire V60x Compute Grid Rack System Release Notes 5 f. After you have defined the partition, click OK. You are returned to the Disk Setup screen, where your new partition is listed. g. Repeat Step b through Step f until you have created all five partitions in TABLE 1 on hard drive sda, then continue with Step h. h. Create the same five partitions on hard drive sdb so that it will mirror hard drive sda. Repeat Step b through Step f until you have defined the five partitions in TABLE 1 on hard drive sdb, then continue with Step i. You are returned to the Disk Setup screen, where the 10 partitions you created are listed (5 partitions on hard drive sda and 5 partitions on hard drive sdb). i. At the Disk Setup screen, click Make RAID. A dialog box appears where you can select available partitions to make RAID. j. In the dialog box, select a partition and edit the settings for the selected partition as follows, then click OK:
Define the mount point for the partition. Refer to TABLE 1 and ensure that the mount point corresponds to the partition size that you defined earlier. Note – There is no mount point for the swap partition.
Select RAID 1 for the RAID Level.
Select the Format Partition box. k. Repeat Step j until you have defined the mount point and RAID Level for all 10 of the partitions. TABLE 1 RAID 1 Partition Settings For System Recovery Mount Point File System Type RAID level Partition Size (Mb) / ext3 RAID 1 10000 swap swap RAID 1 2000 /boot ext3 RAID 1 64 /var ext3 RAID 1 2000 /scs ext3 RAID 1 200006 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 8. After you have defined all of your partition settings, click Next to close the Disk Druid Disk Setup screen. The Bootloader Configuration screen appears. 9. At the Bootloader Configuration screen, select LILO as the bootloader, then click Next. 10. At the Firewall Configuration screen, select No Firewall, then click Next. 11. At the Additional Language Support Selection screen, click Next. 12. At the Time Zone Selection screen, select the correct time zone for your locale, then click Next. 13. At the Account Configuration screen, type the root password, then click Next. 14. At the Authentification Configuration screen, click Next. 15. At the Package Group Selection screen, select the following group options, then click Next:
Printing Support
X Window System
GNOME
Network Support
Messaging and Web Tools
NFS File Server
SQL Database Server
Web Server
Network Managed Workstation
Emacs
Software Development
Kernel Development
Everything The Video Card Configuration screen appears. 16. At the Graphical Interface (X) Configuration screen, make the following selections, then click Next.
ATI Mach64
Video Card RAM: 16 Mb 17. When the prompt that says About to Install appears, click Next. The installation takes several minutes as the packages are installed and the partitions are formatted. 18. When you are prompted for the next CD in the Linux distribution, remove the current CD and replace it with the next CD. When the installation is complete, the Boot Disk Creation screen appears.Sun Fire V60x Compute Grid Rack System Release Notes 7 19. At the Boot Disk Creation screen, select Skip Boot Disk Creation, then click Next. 20. At the Monitor Configuration screen, accept the default, then click Next. If you are using a different monitor than the one in the KVM unit, select your monitor type rather than accepting the default. 21. At the Custom Graphics Configuration screen, make the following selections, then click Next.
Color depth: High-color 16-bit
Screen resolution: 1024x768
Desktop environment: Gnome
Login type: Graphical 22. At the screen that says, “Congratulations, Your installation is now complete,” click Exit. The node reboots automatically. 23. After the system returns to a Red Hat login screen, log in as the root user. 24. Install the required E1000 network drivers and configure the Ethernet device as follows: a. Insert the Sun Fire V60x and Sun Fire V65x Server Resource CD (shipped with your system) into the CGM node and mount the CD by typing the following command. # mount /dev/cdrom /mnt/cdrom b. Copy the required network drivers from the Resource CD and install them to the CGM node by typing the following commands: # cd /mnt/cdrom/drivers/src # cp e1000-4.4.19.tar.gz /root # cd /root # tar -zxf e1000-4.4.19.tar # cd e1000-4.4.19/src # make install # insmod e1000 c. Remove the Resource CD from the system after you type the following command: # umount /dev/cdrom d. Reboot the system by typing the following command: # reboot e. After the system returns to a Red Hat login screen, log in as the root user.8 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 f. Verify that the e1000 network drivers were installed by typing the following commands and looking for the e1000 entry for eth1 in the /etc/modules.conf file. # cd /etc # more /etc/modules.conf Sample file contents are shown here: alias parport_lowlevel parport_pc alias scsi_hostadapter aic79xx alias eth0 e1000_4412k1 alias usb-controller usb-uhci alias eth1 e1000 g. h. From the Gnome desktop menu bar, select Program > System > Internet Configuration Wizard. i. In the Add New Device Type dialog box, select your Ethernet connection, then use the wizard to configure the Ethernet device and to activate it. Consult with your system administrator to select settings that are compatible with your network. The factory-default IP address of the CGM node is 192.168.160.5. j. Restart the network service by typing the following the command: # service network restart k. Verify that the system sees the Ethernet device by typing the following command. # ifconfig -a 25. Download and install the required Adaptec SCSI driver as follows: a. On the CGM node, use a browser to go to the Sun Fire V60x download site: http://www.sun.com/servers/entry/v60x/downloads.html b. Navigate to the Device Drivers download links for Red Hat Enterprise Linux 2.1 software. c. Download the following tar file to a /tmp directory on the CGM node: Adaptec SCSI Driver RPMs 1.3.10 for Red Hat Enterprise Linux 2.1 (as-aic79xx.tar.gz) d. Extract the contents of the tar file into the /tmp directory by typing the following commands: # cd /tmp # tar -zxf /tmp/as-aic79xx.tar.gzSun Fire V60x Compute Grid Rack System Release Notes 9 e. Determine which kernel version is running on your system by typing the following commands: # uname -a | awk ‘{print $3}’ The kernel version on your system is displayed similar to the following example: 2.4.9-e.12smp f. Locate the correct drivers for your kernel version in the as-aic79xx folder by typing the following commands: # cd as-aic79xx/ # ls *kernel-version* Where kernel-version is the kernel version you determined in Step e. Using the example in the previous step, the command and response would look as follows: # ls *e.12* aic79xx-1.3.10_2.4.9_e.12-rh21as_1.i686.rpm aic79xx-1.3.10_2.4.9_e.12-rh21as_1.src.rpm aic79xx-enterprise-1.3.10_2.4.9_e.12-rh21as_1.i686.rpm aic79xx-smp-1.3.10_2.4.9_e.12-rh21as_1.i686.rpm g. Install the required SCSI drivers by typing the following commands: # rpm -ivh driver-version Where driver-version is the driver that you determined in Step f. Using the example in the previous step, the commands would look as follows: # rpm -ivh aic79xx-1.3.10_2.4.9_e.12-rh21as_1.i686.rpm # rpm -ivh aic79xx-smp-1.3.10_2.4.9_e.12-rh21as_1.i686.rpm Note – The two required SCSI drivers are the smp/i686 driver and the uniprocessor i686 driver (non-enterprise), as shown in the previous example. h. Inform the boot loader where to find the new initial ramdisk (initrd) image by typing the following commands: # lilo # reboot 26. Continue with “Reconfiguring the Operating System Software” on page 10.10 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Reconfiguring the Operating System Software Use this procedure to reconfigure the Linux operating system after you reinstall it. 1. Enable serial redirection on the CGM node as follows: a. Modify the CGM nodes’s /etc/lilo.conf file to add the following line after the lines that read, read-only: append="console=tty0 console=ttyS1,9600" This change enables serial redirection of the output from the LILO boot loader and the early boot process. b. Modify the CGM nodes’s /etc/inittab file to add the following line after the line that reads, 6:2345:respawn:/sbin/mingetty tty6: 7:2345:respawn:/sbin/mingetty ttyS1 c. Modify the CGM nodes’s /etc/securetty file to add the following line at the end of the file: ttyS1 d. Reboot the server to enable the serial redirection settings. 2. Configure the X windows environment on the CGM node as follows: a. At a Linux command line, log in as the root user. b. Start the Red Hat Linux configuration utility by typing the following command: # setup c. Select X Configuration from the menu of setup selections. d. Accept all default X configuration options, except for the following changes you must make:
Video card memory = 8MB
Color resolution = 24-bit, 1024x768 After you make these configuration changes, you can start the X windows environment by typing the startx command at a Linux command line. Note – You might not be able to resize the X windows because of a Red Hat bug. You can work around this bug by performing the following steps: i) Click on MainMenu on the toolbar at the bottom of the screen. ii) Select Programs > Setting > Sawfish Window Manager > Moving and Resizing iii) Deselect the box labeled, “Show current dimensions of window while resizing.” iv) Click Apply. v) Click OK. 3. Continue with “Cluster Grid Manager Software Recovery” on page 11.Sun Fire V60x Compute Grid Rack System Release Notes 11 Cluster Grid Manager Software Recovery Use this procedure to reinstall the Cluster Grid Manager software suite that was preinstalled on your CGM node. This section is organized into the following procedures that should be performed in the order they are listed here:
“Reinstalling Sun Control Station 2.0 Software” on page 11
“Reconfiguring the Java Plug-In Version For Mozilla” on page 12
“Installing the SCS Grid Engine Module” on page 14
“Installing Custom Scripts For Advanced Users” on page 15 CD Required For These Procedures
Cluster Grid Manager Software Recovery CD (798-4973) Note – You must install the operating system before performing this procedure, as described in “Recovering Red Hat Enterprise Linux 2.1” on page 3. Reinstalling Sun Control Station 2.0 Software Use this procedure to reinstall the Sun Control Station (SCS) software. 1. Insert the Cluster Grid Manager Software Recovery CD into your CGM node. If the CD does not mount automatically, mount it by typing the following commands: # mount /dev/cdrom /mnt/cdrom # cd /mnt/cdrom 2. Copy the SCS tar file from the CD to the /scs directory on your CGM node by typing the following command: # cp scs-2.0-release.tgz /scs This file is approximately 370 Mb, so the copying might take several minutes. 3. After the copy operation has finished, type the following commands to install the new SCS software: # cd /scs # tar -zxvf scs-2.0-release.tgz # cd scs-2.0/install # ./install -factoryinstall The installation might take several minutes.12 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 4. Install the SCS patch as follows: a. Copy the SCS patch from the CD to the root directory on the CGM node by typing the following command: # cp scs-2.0p1.tgz /root b. After copy operation finishes, extract the tar file by typing the following commands: # cd /root # tar -zxvf scs-2.0p1.tgz c. Install the SCS patch by typing the following commands: # cd scs-2.0p1 # ./install/install d. Delete the patch tar file after the installation finishes by typing the following commands: # cd .. # cd /root # rm scs-2.0p1.tgz e. Reboot the CGM node to initialize the SCS database by typing the following command: # reboot 5. Continue with “Reconfiguring the Java Plug-In Version For Mozilla” on page 12. Reconfiguring the Java Plug-In Version For Mozilla The Java™ plug-in for the Mozilla™ browser that is supplied with the RedHat Linux software is not compatible and it must be replaced by the Java plug-in supplied with the SCS software. Use the following procedure to reconfigure the Java plug-in version. 1. Configure the Java plug-in version by typing the following commands: # cd /usr/lib/mozilla/plugins # rm libjavaplugin_oji.so # ln -s \ /usr/java/j2sdk1.4.1_02/jre/plugin/i386/ns610/libjavaplugin_oji. so 2. Verify that the new Java plug-in version was configured as follows: a. Close all Mozilla applications. b. Start a Mozilla browser.Sun Fire V60x Compute Grid Rack System Release Notes 13 c. At the top of the Mozilla window, click on Help > About Plug-ins. d. Verify that the following version of the Java plug-in is listed: Java™ Plug-in1.4.1_02-b06 3. Continue with “Installing the SCS Grid Engine Module” on page 14.14 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Installing the SCS Grid Engine Module After you install the SCS software, you must install the Grid Engine module separately. 1. Start a browser and type the following URL. http://n.n.n.n Where n.n.n.n is the IP address that you assigned to the CGM node. 2. Read the Sun Control Station license agreement that appears and accept the license agreement if you agree with the terms. A Sun Control Station Welcome page appears. 3. Go to the Sun Control Station login page for your CGM node by entering the URL in the format that is shown on the Welcome page: https://n.n.n.n:8443/sdui Where n.n.n.n is the IP address that you assigned to the CGM node. Note – The URL uses the https format. 4. At the Sun Control Station login page, log in as the SCS administrator using the default entries shown below, then click the Login button. User Name: admin Password: admin 5. On the Cluster Grid Manager main page, click on Administration > Modules in the left-side panel. The Control Modules window appears. 6. On the Control Modules window, click on Add Module. The Add Module window appears. 7. Select Location as File and browse to the Grid Engine module file on the Cluster Grid Manager Software Recovery CD: /mnt/cdrom/gridModule-1.0-14.mapp 8. Click on Install Now. Accept any security certificates or warnings that appear. Note – You might have to log in to SCS again after you install the Grid Engine module to see the Grid Engine module selection in the menu. 9. Continue with “Installing Custom Scripts For Advanced Users” on page 15.Sun Fire V60x Compute Grid Rack System Release Notes 15 Installing Custom Scripts For Advanced Users Several useful scripts are included on the Cluster Grid manager Software Recovery CD. Use the following procedure to install the scripts to your CGM node. 1. Create a /usr/mgmt/diag directory on your CGM node by typing the following command: # mkdir /usr/mgmt/diag 2. Copy and extract the scripts tar file from the Cluster Grid manager Software Recovery CD to your CGM node by typing the following commands: # cp /mnt/cdrom/customerdiag1.2.tar /usr/mgmt/diag # cd /usr/mgmt/diag # tar -xvf customerdiag1.2.tar 3. Remove the Cluster Grid manager Software Recovery CD from your CGM node after you type the following command: # umount /dev/cdrom Note – After you install the custom scripts, you can use them to automate several of the more redundant SCS AllStart software deployment activities. The procedures in the following sections describe how to use the scripts, but they are optional and recommended for advanced users.16 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Using Scripts to Automate Installation Tasks This section contains procedures that describe how to use scripts that are included on the Cluster Grid Manager Software Recovery CD. These scripts can be used to automate some of the redundant tasks that are required when using the SCS AllStart module to deploy software to the compute nodes. You should first review the basic AllStart module procedures in the Sun Fire V60x Compute Grid Rack System Installation Guide (817-3072) before you use these procedures. Note – You must first install the scripts, as described in “Installing Custom Scripts For Advanced Users” on page 15. Using Scripts to Recreate a Lost check.out File When your system is manufactured, a file named check.out is created on the CGM node that lists the MAC addresses for all the nodes in your system. If this file is lost for any reason, you can use one of the custom scripts as described in this procedure to recreate the check.out file. 1. Type the following commands to run the script: # cd /usr/mgmt/diag # ./config -c n.n.n.n check TS-port-numbers Where n.n.n.n is the IP address of the system’s terminal server and TS-port-numbers is a range or list of terminal server ports to which compute nodes are connected. For example, 1-32 would denote the range for a fully configured, 32-node system. If your system is not fully configured, your TS-port-numbers value might look like 1,2,4,6-16. 2. Reset each compute node by pressing the Reset button on each node’s front panel. As each node resets, it will provide output of MAC addresses to a file named /usr/mgmt/diag/customer_check.out.Sun Fire V60x Compute Grid Rack System Release Notes 17 Using Scripts to Auto-Populate the AllStart Clients List Perform the following procedure to use the MAC addresses from your customer_check.out file to auto-populate the AllStart Clients list. Note – Use this procedure after you have already used AllStart to create your Distribution, Payload, and Profile, as described in the Sun Fire V60x Compute Grid Rack System Installation Guide (817-3072). 1. Type the following commands to run the script: # cd /usr/mgmt/diag # ./as_mac.pl -i NODE_BASE_IP -f customer_check.out Where NODE_BASE_IP is the base, or starting IP address for your node range. All nodes have their IP addresses incremented by one, following this lowest IP address. The script uses the MAC addresses in the customer_check.out file to populate the AllStart Clients list. Allstart adds clients, starting with NODE_BASE_IP, for each MAC address in the customer_check.out file, up to, but not including, the CGM node. 2. Verify that the clients were added by looking at the AllStart Clients list. At the Cluster Grid Manager main window, click on AllStart > Clients. All of the new clients should be listed, although they have no payload or profile associated with them yet. 3. Modify the clients that you just created to associate them with the AllStart deployment you are creating, as follows: a. On the AllStart Clients window, click Select All. b. Click Modify. c. Modify the settings for the clients as described in the Sun Fire V60x Compute Grid Rack System Installation Guide. When you finish making the settings, you are returned to the AllStart Clients window. Note – Be sure to set up the clients settings so that they are associated with the settings for the distribution, payload, and profiles that you have already created for this AllStart deployment. d. In the AllStart Clients window, click Select All.18 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 e. Click Enable. All client entries are enabled so that they are visible to the system. Enabled clients are indicated by a Y character under the Enabled heading on the AllStart Clients window. 4. Modify the DHCP configurations for the clients as follows: a. On the Cluster Grid Manager main window, click AllStart > Service. The AllStart Current Service Settings window appears. b. Click Modify. The Modify Service Settings window appears. c. Verify that the DHCP Enabled box is selected. d. Click Modify DHCP Info. e. Select the DHCP subnet and click Edit. f. Enter the router and DNS server IP addresses for your servers. Do not add anything to the Network/netmask or IP Range fields. Using Scripts to Force All Nodes to Network Boot Use the following procedure to force all nodes to network boot, as required when you are deploying software to compute nodes. 1. Type the following commands to run the script: # cd /usr/mgmt/diag # ./config -c n.n.n.n pxe TS-port-numbers Note – You must ensure that none of the ports given in the TS-port-numbers node range are currently in use when you use the command to run this script. The script must have access to the serial ports of each node to take control of the nodes. Where n.n.n.n is the IP address of the system’s terminal server and TS-port-numbers is a range or list of terminal server ports to which compute nodes are connected. For example, 1-32 would denote the range for a fully configured, 32-node system. If your system is not fully configured, your TS-port-numbers value might look like 1,2,4,6-16. 2. Reset or power on the nodes by pressing the Reset or Power buttons on the front panel of each node. The script causes each node to network boot and pull the software deployment from the CGM node.Sun Fire V60x Compute Grid Rack System Release Notes 19 Using Scripts to Add All Nodes as SCS Managed Hosts Before you can deploy the Sun ONE Grid Engine, Enterprise Edition software to the system compute nodes so that they can be managed as a grid, you must first add the nodes as Sun Control Station managed hosts. Perform this procedure to use a script to add all nodes as SCS managed hosts. 1. Type the following command to create a file named nodelist, which contains the list of Allstart clients that will be added as SCS managed hosts: # cd /usr/mgmt/diag # ./createNodeList.pl > nodelist 2. Type the following command to run the script that adds the clients as SCS managed hosts and installs the SCS client daemons on them: Note – Do not run this script in the background. Monitor the progress of the activity by watching the SCS Administration > Hosts window. Refresh the window until all the added hosts appear in the list. # ./devMgrParallel.pl add file nodelist20 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Sun ONE Grid Engine Notes This section contains information about the Sun ONE Grid Engine, Enterprise Edition (S1GEEE) v 5.3p4 software that is preinstalled on your system’s CGM node. AllStart Client Host Name Limitations When you use the SCS AllStart module to create the client nodes to which you will deploy the software payloads, you are required to enter network interface information for those clients. In the AllStart Clients > Enter Network Interface Information window, you must enter the host name for the client node that you are creating. (See the Sun Fire V60x Compute Grid Rack System Installation Guide for the full procedure.) When entering the host name, you cannot use the full host name format, which would include the domain name. Instead, you must use a short host name format. For example: Use this host name format: host1 Do not use this format: host1.mydomain.com If you use the full host name format, the S1GEEE software cannot resolve the host name properly and the host (client node) is not able to join the grid or act as the grid master host. Grid Engine Settings When the grid engine is deployed, the following settings are automatically used:
SGE admin user name: sgeadmin
SGE admin user ID: 268
SGE commd TCP port: 536
SGE root directory: /gridware/sge
SGE cell name: default
NFS sharing: the /gridware/sge/default/common directory is NFS-shared from the designated master host to all other hosts. All other files and directories, such as binaries and spool directories, are installed locally on all grid hosts.Sun Fire V60x Compute Grid Rack System Release Notes 21 Grid Engine Configuration When you configure a compute host, one default queue is created for it. The queue settings are the same as that for a regular (standalone) S1GEEE deployment, with the exception of the following: In the Sun Fire V60x Compute Grid environment, the rerunnable parameter is set to "y". In other words, jobs running in the queue can be restarted on other compute hosts of the system in certain circumstances; for example, when a compute host is being removed from the grid. After you have deployed the grid engine, you can modify the configuration parameters on the queues that were automatically set up to anything you want, or even delete the queues entirely. For details on grid engine settings, refer to the Sun ONE Grid Engine, Enterprise Edition 5.3 Administration and User’s Guide. This document is accessible through the Help interface of the SCS software, or at the following URL: http://www.sun.com/products-n-solutions/ hardware/docs/Software/S1GEEE/index.html22 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Important Notes This section contains information about known issues and considerations regarding the system and its operation. Location of Kickstart Files For AllStart Clients You can verify that your AllStart clients have been correctly configured by checking for their listing in the /scs/allstart/ksconfig/ directory on your CGM node. Each compute node that has been configured as an AllStart client is identifiable by its MAC address, as listed in the following Kickstart file format: /scs/allstart/ksconfig/ks.MAC-address.cfg PXE Network Booting Conflict With LAN Management When you use the Sun Control Station AllStart module to deploy software from the CGM node to the compute nodes, you force the target compute node to network (PXE) boot and pull the software from the CGM node. The PXE boot process involves UDP network transactions. If the DHCP/PXE server tries to assign an IP address that already belongs to another locally networked node that has LAN management enabled, the PXE boot process might fail. Note that even if the bootloader appears successful, the LAN-managed node might still have corrupted the transaction. If you encounter this problem, there are several solutions:
Deactivate LAN management software on the local network before you perform the PXE booting process.
Assign different IP addresses to the LAN-managed nodes that are in conflict with the DHCP/PXE server’s assignments.
Do not use the client node’s LAN-managed Ethernet interface; use the other Ethernet interface. Note that this would require you to reconfigure any Kickstart information to use the new interface.Sun Fire V60x Compute Grid Rack System Release Notes 23 Supported Browsers and Plug-Ins For viewing Sun Control Station 2.0 software, the following browsers and plug-ins have been tested and are officially supported on the indicated operating system platforms at this time.
Linux software (tested on Red hat Linux 7.3 and Red Hat Enterprise Linux 2.1):
Browser: Mozilla 1.2.1
Java™ Plug-in: Java Plug-in 1.4.1
Solaris 8 and Solaris 9 operating system software:
Browser: Netscape 7.0
Java Plug-in: Java Plug-in 1.4.1
Windows NT 4.0:
Browser: Internet Explorer 6
Java Plug-in: Java Plug-in 1.4.124 Sun Fire V60x Compute Grid Rack System Release Notes • October 2003 Console Drawer (FD-1000AT) (for PC SERVER) User’s Manual Linux is a registered trademark or trademark of Linus Trovalds in the United States of America and other countries. The name and logo TurboLinux are trademarks or registered trademarks of TurboLinux, Inc. Caldera System and OpenLinux are trademarks or registered trademarks of Caldera Systems Inc. Red Hat and any trademarks or logos based on Red Hat are the trademark or registered trademarks of Red Hat, Inc. in the United States of America and other countries. Other names such as product names are the registered trademarks or trademarks of their respective companies. All Rights Reserved, Copyright© FUJITSU COMPONENT LIMITED 2003 Declaration of Conformity Model Number : FD-1000AT series Trade Name : CONSOLE Drawer Responsible party : FUJITSU COMPONENT AMERICA, INC. Address : 250 East Caribbean Drive, Sunnyvale,CA94089 Telephone number : (408) 745-4900 This device complies with Part 15 of the FCC Rules. Operation Is subject to the following two conditions : (1) this device may not cause harmful Interference, and (2) this device must accept any Interference received, Including Interference that may cause undesired operation. This Product is designed, developed and manufactured as contemplated for general use, including without limitation, general office use, personal use, household use, and ordinary industrial use, but is not designed, developed and manufactured as contemplated for use accompanying fatal risks or dangers that, unless extremely high safety is secured, could lead directly to death, personal injury, severe physical damage or other loss (hereinafter "High Safety Required Use"), including without limitation, reaction core control in nuclear power facilities, aircraft autopilot flight control, air traffic control, operation control in mass transport control systems, medical instruments for life support systems, missile launching control in weapon systems. You shall not use this Product without securing the sufficient safety required for the High Safety Required Use. If you wish to use this Product for High Safety Required Use, please consult with our sales person representatives in charge before such use. i Contents PREFACE .....................................................................................................................1 Conventions .............................................................................................................1 Packing List ..............................................................................................................1 IMPORTANT NOTICES ................................................................................................3 Safety .......................................................................................................................3 Precautions..........................................................................................................3 Disposal...............................................................................................................4 Moving Console Drawer ...........................................................................................4 INSTALLATION ............................................................................................................5 Installing Guide Rails................................................................................................5 Installing Console Drawer ........................................................................................7 Installing the 4-port KVM Switch (CRT/KB Switcher) ...............................................8 CONNECTING AND REMOVING CABLES ...............................................................12 Connecting Cables .................................................................................................12 Removing Cables ...................................................................................................12 Connecting to Ports ................................................................................................13 OPERATION ...............................................................................................................14 Operating the Console Drawer ...............................................................................14 Adjusting the Monitor..............................................................................................17 Basic Adjustment Procedure .............................................................................18 Menu Screen Display Example .........................................................................18 Menu Description...............................................................................................19 Resolution and Refresh Rate ............................................................................20 Using a Linux Operating System............................................................................21 Keyboard Operation ...............................................................................................22 Pointing Device Operation......................................................................................22 The Hot-key and Reset Buttons .............................................................................23 Using CRT/KB Switcher .........................................................................................23 Storing Console Drawer .........................................................................................24 Cleaning Console Drawer ......................................................................................26 TECHNICAL SPECIFICATIONS ................................................................................27 i i 1 Preface Congratulations on your purchase of the server rack mountable Console Drawer. Using this product will greatly improve the efficiency and functionality of the workspace around your racks. Space that was used in previous layouts can now be used more freely due to our compact sliding module design. The 15-inch TFT monitor has a resolution of 1024 to 768 dots with 16,770,000 colors. Also, it is equipped with a keyboard and 2-button pointing device. Conventions Symbols and terminology that are used in this manual are described below. This symbol indicates the possibility of physical damage (such as damage to the Console Drawer) or physical injury, which may result if by ignoring this symbol the Console Drawer is operated incorrectly. This logo indicates supplemental information, comments or hints. ? Text that is preceded by a number (such as 1.) indicates that the operation must be done in the order indicated. ? Reference to important chapter titles and terminology are in brackets [ ]. Packing List Make sure that the items in the following list were included in the shipping package. ? Console Drawer 1 ea. ? Power Cable (2 m) 1 ea. (Not included in European configuration [FD-1000AT/E]) ? Operation Manual (this manual) 1 ea. ? Warranty 1 ea. (Make sure that the warranty includes all the required information.) We recommend keeping the box and packing material in which the Console Drawer was purchased. They may be required when moving it to another location. If something is missing from the package, contact your place of purchase or a Fujitsu maintenance person. CAUTION 2 Please note the safety information in [Important Notices]. 1. Check the package delivered and whether the Console Drawer has been damaged when unpacking. 2. Remove the rubber stabilizer from the front left side of the Console Drawer. The rubber stabilizer is inserted to prevent the Console Drawer from sliding when installing or moving it. Be sure to keep it after finishing the installation for when it needs to be used again. Rubber stabilizer removal diagram CAUTION 3 Important Notices This chapter contains cautions that must be taken when operating the Console Drawer and information related to safety. Carefully read this chapter to use the Console Drawer correctly. Safety Precautions This device adheres to the safety regulations related to information processing equipment such as electronic office machines that are used in an office environment. If you have any questions please contact your place of purchase or a Fujitsu maintenance person. ? To prevent extreme bumping or shaking when moving the Console Drawer use the original shipping container or a box similar to it. ? During installation and before using the Console Drawer, carefully read [Installation] and the section about environmental conditions in [Technical Specifications] to use the Console Drawer correctly. ? Moving the Console Drawer from a cold environment to the installation location may cause condensation to occur. Before using the Console Drawer allow it to dry out completely and to reach the ambient temperature of the installation location. ? Make sure that the local power supply voltage is within the acceptable range of the Console Drawer. Make sure that the rated voltage meets the specifications of this device (Refer to [Technical Specifications] and the model plate on this device). ? The power cable for the Console Drawer is specially certified. Do not connect it to anyplace other than a grounded wall outlet. ? Arrange the immediate area around the Console Drawer's power socket and the rack's power outlet so that the plug can be quickly pulled. ? Lay all the cables so that they will not be damaged. Refer to the relevant sections in [Installation] when connecting and removing cables. ? Do not connect or remove the data transmission cables during thunderstorms. ? Do not allow foreign substances (such as necklaces or paperclips) or liquids inside the Console Drawer. ? In an emergency (such as: damage to the housing, parts or cables; or liquid or a foreign object has fallen into the Console Drawer) remove the power cable as soon as possible and contact your place of purchase or a Fujitsu maintenance person. ? Only licensed engineers can repair the Console Drawer. An unlicensed user that opens the Console Drawer and makes incorrect repairs may cause electric shock or fire. ? Avoid using the keyboard when in poor health or for extended periods of time. ? Always hold the connector portion and do not jerk the cables when removing them. ? Avoid operating the Console Drawer with wet hands. CAUTION 4 ? Do not unplug connectors with wet hands. ? Do not place such unnecessary items as cups on the top of the Console Drawer. ? Do not modify or repair the Console Drawer. ? Only licensed personal can uncouple, remove or switch parts (such as electromagnetic wave devices) which bear a warning mark (such as a lightening bolt). ? Only the resolution and refresh rate specified in the monitor explanation in [Technical Specifications] can be set. Doing settings other than those noted may damage the monitor. Contact your place of purchase or a Fujitsu maintenance person if you have any questions. ? To prevent interference it is necessary to adequately isolate the data cables connected to peripheral equipment. ? Unplug the power plug from the grounded power outlet if there is a power outage. ? Follow the instructions in the appropriate section in [Operation] when cleaning the server. ? Keep this manual with the Console Drawer. If you give the Console Drawer to a third party give them this manual also. ? Do not use the Console Drawer as a foot rest or lean against it with it drawn out. Doing so may unbalance the rack, causing it to fall over. Disposal This device is manufactured with metal and plastic parts. Dispose of it according the relevant government regulations. Moving Console Drawer When moving the Console Drawer to a different location, use the box in which it was purchased or a box that protects the product from bumping and shaking. Do not unpack the Console Drawer until the move has been completed. CAUTION 5 Installation Please note the safety information in [Important Notices]. Maintain the area around the equipment when using the Console Drawer (See [Technical Specifications] for more information). Avoid dust, humidity and extreme temperatures. Installation may require more than two people in some situations. Be careful not to pinch your fingers or hands between the guide rails and the Console Drawer. Installing Guide Rails Install the guide rails with the guides toward the front so that the Console Drawer can be mounted on them. (Rear Spacers will be at the back) See the installing the guide rail diagram on page 6. 1. Insert the rear spacer studs of the guide rails into the holes in the rear rack pillars. Fasten each guide rail with two screws inserted from the outside of the pillar, one into each of the top and bottom holes of the rear spacer. 2. Extend the guide rails to reach the inside of the front rack pillar. Fasten each guide rail in place with two screws, one into each of the top and bottom holes of the front spacer. (Attach the guide rails inside the front/rear rack pillar so that the guides face inwards.) 3. Install the left and right guide rails at the same height. z Refer to the enclosed manual for details on how to install additional guide rails. CAUTION 6 Installing the Guide Rails diagram 7 Installing Console Drawer Be careful that the latch lever (see page 15) does not come loose. If the latch lever comes loose the Console Drawer may slip. If the Console Drawer does not slide easily into the guide rail or is heavy, lift and insert it with two or more people. 1. After installing the guide rails, insert the Console Drawer into the front end of the guide rails. 2. Push the Console Drawer in until it stops, then fasten with two screws, one on each side of the front of the Console Drawer. Installing the Console Drawer diagram 8 Installing the 4-port KVM Switch (CRT/KB Switcher) Three methods are used for installing the 4-port KVM switch (Installation Methods 1 - 3). After removing the rubber feet from this device 4-port KVM switch, use the appropriate installation method for this device configuration. Refer to [Connecting to Ports] on page 13 for details on connecting the 4-port KVM switch. The 4-port KVM switch will not fit inside of this device unless the rubber feet have been removed. To avoid electric shocks and/or short circuits, make certain that the power cable of this device is not plugged in. Since this device can cause injury if it falls or tips over, be certain to only work on a stable surface. This device contains the components that store and release high voltage electric charges. Only work on this device after checking that it has been electrically discharged. Some metal edges may be sharp. Be careful to not cut yourself. To avoid damaging this device, do not place foreign objects (including metal objects, water, and/or liquids) inside it. Also, do not touch except as necessary. To avoid damage, only licensed engineers should install the 4-port KVM switch. Philips screwdrivers (large, small) are required to install the Console Drawer. Have these ready before proceeding. The screws for installation method 2 are not included with the 4-port KVM switch. These four 3 x 6 mm flathead screws must be separately obtained. Installation Method 1 No extra screws are needed. It is not necessary to remove the Console Drawer from the guide rails if there is sufficient workspace above the unit after it has been attached to the rack. If the Console Drawer needs to be removed, reverse the [Installing Console Drawer] operation on page 7. CAUTION 9 1. Remove the four screws that secure the KVM holder in place. 2. Insert the 4-port switch into the open space in the rear top panel, making sure that the 4-port KVM switch's connectors face out from the rear of the Console Drawer. 3. Reattach the KVM holder to the rear top panel with the four screws removed in step 1. Installation Method 1: 4-port KVM switch Assembly Diagram (viewed from the left rear) 1 0 Installation Method 2 An extra four 3 x 6 mm flathead screws (not provided) are required to fasten the 4-port KVM switch in place. It is not necessary to remove the Console Drawer from the guide rails if there is sufficient workspace above and below the unit after it has been attached to the rack. If the Console Drawer needs to be removed, reverse the [Installing Console Drawer] operation on page 7. 1. Remove the four screws that secure the KVM holder in place. 2 Insert the 4-port switch into the open space in the rear top panel, making sure that the 4-port KVM switch's connectors face out from the rear of the Console Drawer. 3. Fasten the 4-port KVM switch in place with the four new screws inserted from underneath the rear panel. 4. Reattach the KVM holder to the rear top panel with the four screws removed in step 1. Installation Method 2: 4-port KVM switch Assembly Diagram (viewed from the left rear) 1 1 Installation Method 3 Rear top panel must be removed, but no extra screws are needed. Remove the Console Drawer from the rack guide rails by reversing the [Installing Console Drawer] operation on page 7. 1. Remove the ten screws that secure the rear top panel in place. 2. Remove the four screws from the left and right sides of the 4-port KVM switch. Insert the 4-port KVM switch under the KVM holder between the two bent down flaps of the rear top panel, making sure that the 4-port KVM switch's will face out from the rear of the Console Drawer. Fasten it in place with the four screws removed in step 2. 3. Reattach the rear top panel with 4-port KVM switch attached to the rear plate Comp using the ten screws removed in step 1. Installation Method 3: 4-port KVM switch Assembly Diagram (viewed from the left rear) 1 2 Connecting and Removing Cables Read the Console Drawer manual before connecting the cables. Do not connect or remove the cables during a thunderstorm. When unplugging cables hold them by the plug, not the cable. Connect and remove cables in the following order. Connecting Cables 1. Unplug the power cords, from the power outlets, of all the equipment that is effected. 2. Connect the keyboard cable, mouse cable and the monitor cable to their respective pieces of equipment. 3. Plug the power cable into the Console Drawer. 4. Plug the power cable into a grounded power outlet. Connecting cables to Console Drawer diagram Removing Cables Unplug the power cords, from the power outlets, of all the equipment that are effected, then remove each cable. CAUTION 1 3 Connecting to Ports (When CRT/KB Switcher is attached to the back of the Console Drawer.) Adhere to the cautions in [Connecting and Removing Cables] when connecting and disconnecting ports. Also, cut the power of the effected equipment while you are working. You can connect as many servers as there are ports. 1. Connect the keyboard cable to the KB port, the mouse cable to the Mouse port and the monitor cable to the COMMON DISP port. 2. Use the dedicated cable to connect the server keyboard port (PS/2) and the mouse port (PS/2) to the KB/Mouse port (6-pin mini DIN). 3. Connect the terminal monitor cable to the 1 DISP port (15-pin mini D-SUB). Connecting ports diagram If you are using a separate CRT/KB switcher, rather than the back of the Console Drawer, refer to the operation manual for the CRT/KB switcher. CAUTION 1 4 Operation Pull the Console Drawer toward slowly until the slide rails lock. If they do not lock, the weight of the Console Drawer may cause it to move. Be careful not to pinch your hand when doing such activities as pulling or pushing the slide module and opening and closing the LCD. Operating the Console Drawer 1. If the rubber stabilizer has not been removed yet, remove it now. 2. Push down on the latch lever on the front left side of the Console Drawer. Pull out the Console Drawer until it clicks. Before pulling it out, make sure that the two screws on the front of the Console Drawer are tightly fixed to the rack. CAUTION 1 5 Pulling out the slide module diagram 3. Push up on the LCD lock on the left side of the handle, and then grasp the handle and open the top of the monitor. 4. Turn on the power by pushing the POWER button. Open the monitor completely. 1 6 Opening the LCD diagram 1 7 Adjusting the Monitor The five buttons and two LEDs on the monitor are explained in order from left to right. Power button: Power button: Push this button to turn on the power to the monitor. Also, pushing this button while the monitor is on cuts the power to the monitor. Power lamp (green): This lamp lights when the power to the monitor is on and goes out when the power to the monitor is off. Indicator lamp (orange): This lamp lights when the monitor is in energy-saving mode. Menu button: Push this button to adjust the monitor. ?Button: Push this button when selecting downward and to change values in a decreasing direction. ?Button: Push this button when selecting upward and to change values an increasing direction. Button: Push this button to select or enter things. You can eliminate screen noise by adjusting the PHASE on the setting menu. Be careful when applying a strong force to the equipment when the Console Drawer is pulled out and the monitor is opened and being used, as there is a risk that the rack may fall over. Do not strongly press on the monitor's screen, scratch it with sharp objects or place magnetic objects near it. Doing so may damage the monitor. CAUTION 1 8 Basic Adjustment Procedure 1. Push the menu button to open the menu. 2. Select the item to be adjusted with the?button and the?button. 3. Switch to the various adjustment screens with the button. 4. Change setting values with the?button and the?button. 5. Apply setting values and return to the menu screen with the button. 6. Push the menu button to close the menu. (The menu button automatically closes if no button operations are done for a set time.) *. and are automatically set after the button is pressed. Menu Screen Display Example 1 9 Menu Description Symbol Displayed term Adjustment details Brightness Adjust the brightness. Contrast Adjust the contrast. H.Position Adjust the horizontal position of the image. V.Position Adjust the vertical position of the image. Phase Adjust the phase (eliminate screen noise). Clock Adjust the width of the display. Auto Setup Adjusts automatically. Language Select the language used for the menu. Color Adjusts the color. Special Press to change the settings shown below. Factory Setting Return to factory default status. DOS Mode Switch between 640 and 720 of the horizontal resolution in DOS mode. Video Level Adjust the level of the input signal. Zoom Sharpness Adjust the focus. 2 0 Resolution and Refresh Rate Resolution Horizontal frequency (KHz) Vertical frequency (Hz) Mode 31.47 60.0 37.86 72.0 600 × 480 37.5 75.0 37.9 60.0 48.1 72.0 800 × 600 46.9 75.0 48.4 60.0 56.5 70.0 1024 × 768 60.0 75.0 VESA 2 1 Using a Linux Operating System Carefully read the cautions on page 16 to correctly set and use the Console Drawer with a Linux operating system. Precautions when using the Caldera OpenLinux Server 3.1.1 Installation Precautions When using Caldera OpenLinux Server 3.1.1 with this unit, immediately after installation X Windows may fail at startup with the following message: INIT : rc.gui : /opt/kde2/bin/kdm or X11 startup problem ! For X11, try running 'kxconfig' as root … INIT : Switching to runlevel:3 INIT : Sending processes the TERM signal press to continue. Follow the procedure listed below to reinstall X Windows so that it will start normally. ? Startup the system using the installation CD, then select the installation mode listed below to begin the installation. - Standard install mode ? Select " Programmable up to (MHz):" as the mode clock on the " Select Video Card " screen. ? The values that should be set for the " Select Video Card " screen are as follows: Resolution Refresh Depth Horiz. Sync Mode Clock 1024 x 768 70 Hz 8-32 bpp 56.5 KHz 75 MHz (When all items except the resolution show " Not available ", set the resolution to "1024 x 768") CAUTION 2 2 Keyboard Operation Full keyboard operation is possible by working with the Fn key. Pointing Device Operation Lightly touch or tap the operation surface to operate the pointing device. Moving the pointer: Just lightly touch the operation surface in the direction you want to move the cursor. Single click: Lightly tap the operation surface once, or click the left button once. Double click: Lightly tap the operation surface twice, or click the left button twice. 1.The pointing device has been designed to be operated with one finger, do not use it in the following ways: 1) while wearing gloves; 2) with a pen, ballpoint pen or pencil etc; 3) with two or more fingers; 4) operating while something is placed on the operation surface. 2. Normal operation may become impossible if the operation surface gets wet such as when there is high humidity or the operator's hands are damp or sweaty. Thoroughly dry or wipe the operation surface before use. 3. Do not do operations with pointed metal objects such as pens as it may damage the pointing device. CAUTION 2 3 The Hot-key and Reset Buttons Hot-key Button Outputs the [Ctrl] + [Alt] + [Shift] key Make/Break code. This will also be the Hot-key mode (OSD display) when connected to a KVM switch. Reset Button Resets the keyboard and mouse. KVM switch, keyboard and mouse will be reset if connected to a FS-10XX Series KVM switch. KVM Switch Reset is only valid with the following series: FS-1004, 1008, and 1016. Using CRT/KB Switcher Even if the settings are the same, the image position may be different when using various types of CRT controllers when setting up multiple servers. Generally resolution and refresh rate (vertical frequency) are the same for all servers, therefore just a set of one type of parameters supports these settings, which are stored for the screen. Displays on other servers are effected by correcting an on-screen image that has shifted. To correct shifted displays, change the following settings. 1. Set the refresh rate of servers that have displays with incorrect images to a different value. 2. Select the best screen display and the save it. As multiple refresh rates for resolution can generally be set, you can use multiple options for the screens. CAUTION 2 4 Storing Console Drawer The Console Drawer can be stored in the rack when a monitor and keyboard are not needed. Slide the Console Drawer in and out of the rack slowly. 1. Push the monitor power button to turn off the power to the monitor. 2. Hold the handle and slowly close the monitor. Be sure that the LCD lock catches. 3. Push the locking springs on both sides of the slide rail and slide the Console Drawer into the rack. Be sure the latch lever catches. Be careful not to pinch your fingers or hands in the guide rails, slide rails, or the Console Drawer itself when storing the Console Drawer. If the latch lever is not set the Console Drawer may slide out if the rack is moved. We recommend turning off the monitor's power when it is not in use, to conserve electricity. CAUTION 2 5 Inserting the slide module diagram 2 6 Cleaning Console Drawer Turn off the power and unplug the power cable from the power socket. Do not use cleansers that contain abrasives; or such organic solvents as benzene or thinner; or disinfectant alcohol. Do not apply water and cleanser or spray type cleaners directly to the Console Drawer. If liquids enter the interior of the Console Drawer it may result in malfunctions or damage. Wipe the Console Drawer and monitor with a dry cloth. If the dirt is excessive, wipe it off with a soft cloth that has been thoroughly wrung out after being dipped in household cleanser diluted with water. Remove dust with a soft brush. Clean the keyboard and pointing device with a sterile cloth. Lightly wipe the monitor screen with a soft dry cloth such as gauze. Remove dust with a soft brush. CAUTION 2 7 Technical Specifications Model: FD-1000AT/J (Japanese configuration) FD-1000AT/U (US configuration) FD-1000AT/E (European configuration) • Power Specifications Rated voltage range: 100 - 240V AC Frequency: 50/60Hz Rated current: 100V/0.4 A, 200V/0.2 A • Size Main part: (W) x (D) x (H) (1) Slide rail contracted 485 mm x 642 mm x 42 mm (2) Slide rail extended 485 mm x 1117 mm x 42 mm (3) (2)+the LCD are fully opened 485 mm x 1077 mm x 345 mm • Weight: 12.0 Kg • Required Environment Operating Temperature: 15 - 35 °C (Avoid condensation during use.) According to the server environment. • Monitor Panel monitor: 15” TFT color LCD Resolution: Max. horizontal 1024 (dots) x vertical 768 (line) Pitch: 0.297 x 0.297mm Refresh rate: Max. 75Hz Colors: Max. 16,777,216 (dithering) Brightness: 250 cd/m² Connector: mini D-SUB 15-pin (analog RGB) Power consumption: Max. 22 W or less During standby: 3.6 W or less During back right OFF: 7.2 W or less During LCD power switch OFF: 3.6 W or less 2 8 • Keyboard Layout: Japanese layout, US layout, European layout Number of keys: Japanese layout (87), US layout (83), European layout (84) Connector: mini DIN 6-pin • Pointing Device Model: Static Touch Pad Resolution: 240 cpi (counts/inch) Connector: mini DIN 6-pin • Button Number of buttons: 3 Console Drawer User’s Manual Published August 2003 Published by FUJITSU COMPONENT LIMITED Printed in Japan ? The contents of this manual may be modified for improvements without prior notice. ? Fujitsu bears no responsibility for infringement of patent or other rights of third parties ascribable to the use of data in this manual. ? Reprinting of this manual without permission is prohibited. This manual is made of recycled paper. 021220 Getting Started with the LX Series 451-0308E Corporate Headquarters MRV Communications, Inc. Corporate Center 20415 Nordhoff Street Chatsworth, CA 91311 Tel: 818-773-0900 Fax: 818-773-0906 www.mrv.com (Internet) Sales and Customer Support MRV Americas 295 Foster Street Littleton, MA 01460 Tel: 800-338-5316 (U.S.) Tel: +011 978-952-4888 (Outside U.S.) sales@mrv.com (email) www.mrv.com (Internet) MRV International Industrial Zone P.O. Box 614 Yokneam, Israel 20682 Tel: 972-4-993-6200 sales@mrv.com (email) www.mrv.com (Internet)2 451-0308 All rights reserved. No part of this publication may be reproduced without the prior written consent of MRV Communications, Inc. The information in this document is subject to change without notice and should not be construed as a commitment by MRV Communications, Inc. MRV Communications, Inc. reserves the right to revise this publication, and to make changes in content from time to time, without obligation to provide notification of such revision or changes. MRV Communications, Inc. assumes no responsibility for errors that may appear in this document. Copyright © 2003 by MRV Communications, Inc. Should you experience trouble with this equipment, please contact one of the following support locations: • If you purchased your equipment in the Americas, contact MRV Americas Service and Support in the U.S. at 978-952-4888. (If you are calling from outside the U.S., call +011 978-952-4888.) • If you purchased your equipment outside the Americas (Europe, EU, Middle-East, Africa, Asia), contact MRV International Service and Support at 972-4-993-6200. 451-0308 3 CAUTION This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, can cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: • Reorient or relocate the receiving antenna. • Increase the separation between the equipment and receiver. • Connect the power cord of the equipment into an outlet on a circuit that is different from that to which the receiver is connected. • Consult the dealer or experienced radio/TV technician for help. Changes or modifications not expressly approved by MRV Communications, Inc. could void the user's authority to operate the equipment.4 451-0308451-0308 5 Table of Contents Preface................................................................................................................ 11 Customer Support ........................................................................................................11 Other Documentation ..................................................................................................11 Overview of the LX Series ................................................................................ 13 Conventions ..................................................................................................................13 System Specifications ..................................................................................................15 Installing the LX Series ..................................................................................... 17 Hardware Installation .................................................................................................17 Unpack and Inspect the Unit ................................................................................ 17 Package Contents................................................................................................... 17 LX Indicators and Interfaces.......................................................................................18 Front Panel LEDs .................................................................................................. 18 Rear Panel LEDs ................................................................................................... 19 Environmental and Installation Considerations........................................................23 Mounting the Unit into a 19-inch or 23-inch Rack ....................................................24 Cable Connections........................................................................................................25 Connect the Power Cable....................................................................................... 25 Connecting the Ethernet Interface ....................................................................... 25 Connect Serial Device Cables................................................................................ 25 Connecting Your Management Station................................................................. 25 Connecting DC Power............................................................................................ 26 Modem Port (Optional) ................................................................................................27 Powering On .................................................................................................................27 System Login and Passwords ......................................................................................28 Resetting the Unit........................................................................................................29 Configuring the LX Unit for the First Time ...............................................................30 First Time Quick Configuration............................................................................ 30 Assigning an IP Address via the Network............................................................ 33 Accessing and Configuring the Graphical User Interface (GUI)...............................33 Software Upgrades.......................................................................................................38 IP Configuration Menu ................................................................................................38 Booting from Defaults..................................................................................................38 Accessing and Configuring Additional Features ........................................................39 Connecting to the LX Series via Telnet or SSH ................................................... 39 Accessing from a Terminal Attached to an LX Series Serial Port ...................... 40 Additional Considerations ...........................................................................................406 451-0308 Sensor (Temperature/Humidity) Ports .......................................................................40 Connecting the Temperature/Humidity Sensor ................................................... 40 Command Line Interface (CLI) Tree Structure..........................................................42 ppciboot Factory Default Settings...............................................................................43 Additional Considerations for an Internet Environment ..........................................44 Autobauding Feature ...................................................................................................44 Reinitializing/Powering Off the Unit ..........................................................................44 Appendix A - Technical Specifications ........................................................... 45 Appendix B - POST Test Error Codes ............................................................. 49 Error Code Definitions.................................................................................................49 POST Test Error Code Sample....................................................................................51 Appendix C - Cabling the LX Series ................................................................ 55 Cabling Considerations................................................................................................55 Serial Device Connectors ....................................................................................... 55 Diagnostic Port Connector (Port 0) ....................................................................... 55 10/100 Connector.................................................................................................... 56 Ordering Cables ..................................................................................................... 56 Modular Adapters ........................................................................................................56 Pin Assignments .................................................................................................... 57 Ordering and Installing the Inlet Connector Lock.....................................................59 Connecting to the Diagnostic Port (Port 0) .................................................................59 Modem Control/Hardware Flow Control ....................................................................60 RJ-45 Wiring Considerations ......................................................................................60 Modular Adapters (RJ-45 to DB-25) ...........................................................................61 MRV Communications 8-Wire Cabling.......................................................................64451-0308 7 Figures LX Series 4008 Front Panel.............................................................................. 18 LX Series 4016 Front Panel.............................................................................. 18 LX Series 4032 Front Panel.............................................................................. 18 LX Series 4048 Front Panel.............................................................................. 18 LX Series 4008 Rear Panel ............................................................................... 19 LX Series 4008M with Modem Rear Panel ...................................................... 20 LX Series 4016M with Modem Rear Panel ...................................................... 20 LX Series 4016 DC Version Rear Panel ........................................................... 21 LX Series 4032M with Modem Rear Panel ...................................................... 21 LX Series 4032M DC Version Rear Panel ....................................................... 22 LX Series 4048 AC Rear Panel ......................................................................... 22 Mounting an LX Series in Rack ....................................................................... 24 Connecting DC Power ....................................................................................... 26 LX Series RESET Switch Location .................................................................. 29 Connecting the Temperature/Humidity Sensor .............................................. 41 Basic Menu Structure ....................................................................................... 42 POST Test Error Code Sample......................................................................... 53 Serial Device Connector (RJ-45) Signal Assignments .................................... 55 10/100 Connector Assignments ........................................................................ 56 DB-25 Pins......................................................................................................... 58 Installing the Inlet Connector Lock ................................................................. 59 Adapter Wiring, LX Series to DTE .................................................................. 61 Adapter Wiring, RJ-45 to DB-9, LX Series to DTE......................................... 62 Adapter Wiring, LX Series to DCE .................................................................. 63 Modular Cables for RTS/CTS Flow Control (Eight-Wire), Concurrent with Modem Control Signalling ..................................................................................... 658 451-0308451-0308 9 Tables LX Series Specifications ....................................................................................45 POST Test Error Codes ....................................................................................4910 451-0308451-0308 11 Preface This guide describes how to install the software, describes the hardware and cabling, as well as how to rack-mount the LX Series. This guide is organized as follows: • Preface - Describes the manual’s organization and how to contact customer support. • Chapter 1 – Provides an overview of the LX Series, including supported communication speeds, software requirements, and conventions. • Chapter 2 – Describes how to install and connect the LX Series, as well as the unit’s LEDs and connectors. Also explains how to connect to the unit, access the Graphical User Interface, install Java Runtime Environment (JRE), and connect to the LX Series via telnet and SSH. • Appendix A – Provides the electrical, environmental, and physical requirements for the LX Series installation. • Appendix B – Provides the error code definitions for the POST test error codes. • Appendix C - Describes how to cable the LX Series unit. Customer Support Should you experience trouble with this equipment, please contact your MRV Americas Service and Support customer representative in the USA at 978-952-4888. International customers call +011 978-952-4888. Other Documentation Other manuals in the LX documentation set are: • LX-Series Commands Reference Guide - Describes each individual command in the LX CLI tree.Preface 12 451-0308 • Getting Started with MRV Communications LX Series MIBs - Provides basic information regarding the Network Management System (NMS), and procedures on how to use the Management Information Base (MIB) structure (as pointers to objects in the devices) to manage these units. • LX-Series Configuration Guide - Provides information on network configuration, initial setup, how to set up for remote console functions, RADIUS, and system administration. • Software Release Notes - Cites supported features as well as any notes and restrictions for the current software version.451-0308 13 Chapter 1 Overview of the LX Series The LX Series is a secure standalone communication server that is designed for applications requiring secure console or serial port management. The LX Series provides the most secure and robust feature set to meet your remote console management and terminal server needs. The LX Series includes the most comprehensive security features, such as per port access protection, RADIUS, Secure Shell v2.0, PPP PAP/CHAP, PPP dial-back, on-board database, menus, and others. The LX Series console management solution enables centrally located or remote personnel to connect to the console or craft ports of any network element or server. This serial connection allows administrators to manage and configure the remote network devices and servers, as well as perform software upgrades as if attached locally. The LX Series also provides various port densities of RS-232 DTE RJ45 Serial ports, as well as V.90/K56 flex Internal Modem options. Currently, the LX hardware provides port densities of 8, 16, 32, and 48 ports, plus port 0 for local management. Conventions The following conventions are used throughout this guide: • User prompt – The user prompt is (for example) InReach:0> for Non-superusers or InReach:0>> for superusers. The prompt will change based on a login user profile, as configured by the Superuser. The 0 represents the session number.Overview of the LX Series 14 451-0308 • Configure Mode prompt – A sample configure mode prompt is Async 1-6:0 >>, where Async is a reminder that tells you which part of the configuration you are in, 1-6 is the range of ports any operation will affect, 0 is a session number, and >> indicates superuser mode. To get to the Async 1-6:0 >> prompt, you must first type port async 1 6 at the Config:0 >> prompt. Note that you do not add a dash between the range numbers in port async 1 6. • Command execution – Unless otherwise specified, commands are executed when you press . • Keyboard characters (keys) – Keyboard characters are represented using left and right angle brackets (< and >). For example, the notation refers to the CTRL key; refers to the letter A; and refers to the RETURN key. • Typographical conventions – The following typographical conventions are used: Monospace Typeface – indicates text that can be displayed or typed at a terminal (i.e., displays, user input, messages, prompts, etc.). italics – are used to indicate variables in command syntax descriptions. • Help Key (?) - At any prompt level, you can press ? to display the available commands at that level. The only time this is not true is if you are in the midst of entering a command. If ? is at the end of a partial command, the LX displays a list of valid arguments to assist you in adding to the current command line. • Tab - Press the Tab button to complete a partially entered command. You must enter the first three characters of a command for autocomplete to work. If the command is already complete, the Tab button displays available commands. • Command Recall - The up arrow recalls previously used commands. • Ctrl-F – Moves forward to the next session.451-0308 15 Overview of the LX Series • Ctrl-B – Moves back to the previous session. • Ctrl-L – Returns you to the Local Command Mode. NOTE: You must press the Enter key after you type Ctrl-F, Ctrl-B, or Ctrl-L. System Specifications The following table lists important system specifications: Item Description Interface DTE RS-232 - RJ-45 Serial Line Speed 134 bps to 230 Kbps Ethernet Interface 10/100 Auto Sensing Default Serial Line Speed 9600 bps DIAG Port/local management port (default settings) The DIAG port (port 0) is the console management port. Autobaud is disabled. 9600/8/1/None. Quick Start is enabled. Access is Local. APD is disabled. Flow Control is Xon/Xoff. All Ports Except Management and Modem Ports (default settings) Autobaud is disabled. 9600/8/1/None. Access is Remote. APD is disabled. Flow Control is Xon/Xoff. Modem Port (default settings) Autobaud is disabled. Speed is 57600. Access is Local. APD is enabled. Flow Control is CTS.Overview of the LX Series 16 451-0308451-0308 17 Chapter 2 Installing the LX Series Hardware Installation This section explains how to install an LX Series Communications server and place it into operation. Unpack and Inspect the Unit Place all packing materials back into the shipping carton and save the carton. (If you need to return the unit to MRV Communications or your distributor, you should return it in the original carton.) Package Contents The LX unit shipping carton contains the following items: • One rack mounting kit. MRV provides the following mounting screws: Eight 6-32 x 5/16” flathead screws for attaching the ears to the unit, and four 10-32 screws to attach to the rack. • One power cord appropriate to your particular LX model. • One 8-wire RJ-45 serial crossover cable. • One female DB-9 to RJ-45 adapter. • One software/documentation CD.Installing the LX Series 18 451-0308 LX Indicators and Interfaces This section explains the LX unit’s indicators and interfaces. Front Panel LEDs This section explains the front panel LEDs (see Figures 1 through 4). Figure 1 - LX Series 4008 Front Panel Figure 2 - LX Series 4016 Front Panel Figure 3 - LX Series 4032 Front Panel Figure 4 - LX Series 4048 Front Panel FLT OK 100 Mbps LED DIAG Port (Port 0) FLT OK Modem Port451-0308 19 Installing the LX Series FLT Solid red indicates a fault condition exists or maintenance is required. This LED remains on until the initial Power On Self Test (POST) completes successfully. OK Solid green indicates the system’s voltages are normal and the unit has passed the POST test. Port Status LEDs Each of the eight (or 16, or 32, or 48) green LEDs flash when receive, transmit, or status activity is detected on its corresponding serial port. The port status LEDs are used in several ways. During the initialization process, the LEDs indicate self-tests are being performed, and if any self-test fails, they indicate an error code. After a POST test and a system software boot, the lights indicate when a port is actively being used. Rear Panel LEDs This section explains the rear panel LEDs and shows you a rear view of the various LX models (see Figures 5 through 11). Figure 5 - LX Series 4008 Rear Panel 100-240VAC 1.0A 50/60Hz 1 2 3 4 5 6 7 8 10/100 ETHERNET DIAG RCV LINK 100 RCV 100 Mbps LED LINK DIAG Port (Port 0)Installing the LX Series 20 451-0308 Figure 6 - LX Series 4008M with Modem Rear Panel Figure 7 - LX Series 4016M with Modem Rear Panel 100-240VAC 1.0A 50/60Hz 10/100 ETH DIAG/MGMT 100 RCV 100 Mbps LED LINK RCV LINK TELCO LINE 1 2 3 4 5 6 7 8 10/100 Interface Modem Port DIAG Port (Port 0) 100-240VAC 1.0A 50/60Hz 9 10 11 12 13 14 15 16 DIAG 10/100 ETHNT 100 RCV 100 Mbps LED LINK 1 2 3 4 5 6 7 8 RCV LINK TELCO LINE 10/100 Interface Modem Port DIAG Port (Port 0)451-0308 21 Installing the LX Series Figure 8 - LX Series 4016 DC Version Rear Panel Figure 9 - LX Series 4032M with Modem Rear Panel 9 10 11 12 13 14 15 16 10/100 ETHERNET DIAG 100 RCV 100 Mbps LED LINK 1 2 3 4 5 6 7 8 RCV LINK -24/-48/-60 VDC 1.2 MAX + - A + - B DIAG Port (Port 0) 100-240VAC 1.0A 50/60Hz DIAG 1 0/1 0 0 E THN T 100 RCV 100 Mbps LED LINK RCV LINK TELCO LINE 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 10/100 Interface Modem Port DIAG Port (Port 0) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32Installing the LX Series 22 451-0308 Figure 10 - LX Series 4032M DC Version Rear Panel Figure 11 - LX Series 4048 AC Rear Panel RCV The RCV LED is one of two integral LEDs on the 10/100 jack. This yellow LED flashes to indicate receive activity on the link. LINK This green LED defaults to a link good indicator. If the link is present and operating, the LED comes ON. 100 Mbps This green LED indicates speed. If the link is 100 Mbps, the LED comes ON. On LX-4048 units, this LED is on the front of the unit. 10/100 ETHNT DIAG 100 RCV 100 Mbps LED LINK RCV LINK -24/-48/-60 VDC 1.2 MAX + - A + - B 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 DIAG Port (Port 0) 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 TELCO LINE 100-240VAC 1.0A 50/60Hz 10/100 ETH RCV LINK RCV LINK 10/100 Interface 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48451-0308 23 Installing the LX Series Environmental and Installation Considerations • Unit must be installed in an environment with 20% to 80% humidity, noncondensing, 0° - 40° C (32°-113° F). • Do not choose a location where the unit will be exposed to direct sunlight or subjected to vibration. • Do not place an object on the side(s) of the unit that might block airflow through the unit. • The unit may be front, rear, or center mounted. • There is no mounting difference between the 19” and 23” rack mount ears. Installing the LX Series 24 451-0308 Mounting the Unit into a 19-inch or 23-inch Rack Attach the brackets to the unit, and then mount the unit in the rack. Refer to Figure 12 for further information. Figure 12 - Mounting an LX Series in Rack The three bottom side screws hold the cover on the unit. To front-mount the unit, you must attaching the rack-mount brackets. Then insert the supplied screws through the brackets and into the same holes. remove the front and center top and bottom screws before If you reverse-mount the unit, remove the rear and center top and bottom screws, and insert the supplied screws through the rack-mount ears.451-0308 25 Installing the LX Series Cable Connections This section explains the cable connections for the LX unit. Connect the Power Cable Connect the supplied power cable to the rear of the LX unit and plug the other end into a 3-prong wall outlet. Connecting the Ethernet Interface NOTE: This port is set to auto negotiation by default. You can manually configure the port speed and duplex if you want. Refer to the LXSeries Commands Reference Guide for further details. Connect a cable (category 3 for 10 Mbps operation, category 5 for 10/100 Mbps operation) to the 10/100 connector on the rear of the LX Series (see Figure 5) and the other end to your network. The LINK LED comes on steady green if the cable is properly connected. Connect Serial Device Cables Connect the serial device cables to the 8-pin RJ-45 jacks on the rear of the unit. NOTE: LX Series serial ports provide concurrent support for RTS/CTS flow control and modem control. Refer to Appendix A and Appendix C for further information. Connecting Your Management Station Connect the management station to the DIAG port (port 0) using the connector and cable you received with the LX unit. Refer to “Connecting to the Diagnostic Port (Port 0)” in Appendix C for more information on DIAG port connections. Installing the LX Series 26 451-0308 Connecting DC Power This section describes how to connect power to the DC version of the LX Series 4008, 4016, and 4032. The LX-4048 model is made in an AC version only. Figure 13 - Connecting DC Power After you have installed the LX unit, you can connect the DC power as described in the following procedure (refer to Figure 13): 1. Connect the LX to the facility's bonding network, using the points on the rear panel of the LX. The connection to the facility's bonding network should be made per local practices, using wire with a minimum conductor size of 18 AWG. 2. Using a ¼-inch nut driver, remove the terminal block nuts. 3. Attach the facility’s “A” feed to the terminal block labeled “A”. NOTE: Be sure that the -48VDC is connected to the minus side, and the 48VDC return is connected to the plus side. 4. Attach the facility’s “B” feed to the terminal block labeled “B”. 5. Replace the nuts and tighten them securely. The DC leads should be 22 AWG or larger. They should be terminated with a #5 ring terminal or larger depending on the wire size used. -24/-48/-60 VDC 1.2 MAX + - A + - B451-0308 27 Installing the LX Series NOTE: The LX will run with only one DC power feed connected. The second input is provided for redundant system power, which is used in high reliability installations. 6. Attach the clear plastic safety guard to the terminal blocks. (The clear plastic safety guard is provided with the LX kit.) Modem Port (Optional) The modem port is a V.90/K56flex Kbps optional factory installed modem on the LX Series. The modem port allows you to dial in to or out of the LX. If the modem is present, connect your phone line to the modem’s RJ11 connector. If the modem is not installed, the RJ11 connector will not be present on the rear of the unit. In LX-4048M models, the modem port is on the front of the unit. The Modem port number is as follows for LX models: • LX-4008M - port number 9 • LX-4016M - port number 17 • LX-4032M - port number 33 • LX-4048M - port number 49 At the InReach:0>> prompt, enter the show port async 33 modem command to display a screen containing the LX-4032M modem port fields. Powering On The Power On Self Test (POST) starts when you apply power to the LX Series unit. The port status LEDs flicker and the FLT LED remains on while the test is running (this may take only a few seconds). If the unit passes the POST test, the FLT LED extinguishes, and the OK LED turns green. If there is a failure, the FLT LED stays on, and the port status LEDs begin flashing an error code. Refer to Appendix B for an explanation of the codes.Installing the LX Series 28 451-0308 When the POST test is completed, the Main menu appears. The system loads the IROS operating system from flash and then loads the system configuration file. The Main menu reappears. If you are booting from defaults, the Quick Configuration menu appears. Refer to the “System Maintenance” chapter in the LX-Series Configuration Guide for further information on the Main menu. Refer to “First Time Quick Configuration” on page 30 for further details on the Quick Configuration menu. Once the unit finishes loading the operating system, you can access the unit. At your management station, access the unit with any terminal emulation software. The terminal settings are 9600 baud, eight data bits, no parity, one stop bit, Xon/Xoff flow control, and terminal type ANSI. The Login: screen appears. System Login and Passwords The following username and passwords are the defaults the first time you use the LX Series. • The default login username is InReach (be sure to use a capital I and R). The default login password is access. • To enter the superuser mode at the InReach> prompt, enter enable. The default password is system.451-0308 29 Installing the LX Series These passwords prevent persons who do not know them from accessing the server. Change the default passwords to other values as part of your basic server setup. You can use any character or number in a password. However, backspace, tab, and escape are not supported. Refer to the “Password Enable” section in the Subscriber chapter of the LX-Series Commands Reference Guide for information on changing passwords. Resetting the Unit To reset the LX Series, use a paper clip to momentarily press the reset button, which is behind the small hole labeled R on the front panel. Refer to Figure 14 for the exact location. Figure 14 - LX Series RESET Switch Location When the LX Series enters the RESET state, all front panel LEDs illuminate. When you release the reset button, the unit begins to execute the Power On Self Test (POST). If the LX Series detects an error, the front panel LEDs illuminate to show an error code. This error sequence is repeated continually until the error is corrected or you power off the unit. During this time, no data is exchanged over the Ethernet cable or serial ports. IMPORTANT If you change the default password for the superuser, make sure that the new password is written down in a safe location. If you forget the password, the server will need to be reset to factory default settings. See “ppciboot Factory Default Settings” on page 43. Reset SwitchInstalling the LX Series 30 451-0308 If the LX Series does not detect an error, the unit begins loading software from the internal flash. Once loaded, the LX Series resumes normal operations. Configuring the LX Unit for the First Time You can choose from four options to configure the unit for the first time: • First Time Configuration Utility - The first time an LX unit boots up at default parameters, you are presented with the option to run the Initial Connectivity setup. Enter y and press . Refer to “First Time Quick Configuration” on page 30 for further details. • Assign the IP Address via the Network - Refer to “Assigning an IP Address via the Network” on page 33 for further details. Use this option if your network is using DHCP, BOOTP, or RARP. • Creating and Loading a Default Configuration File - Refer to “Applying Default Configurations to Other Units” in the LX-Series Configuration Guide. • Configuring the LX Manually via the CLI - Refer to “Upgrading Software with the ppciboot Main Menu” in the LX-Series Configuration Guide. First Time Quick Configuration NOTE: The first time quick configuration runs only on the DIAG port (port 0) on all models when booting from default parameters. The DIAG port (port 0) of the LX-4008, LX-4016, and LX-4032 is on the rear of the unit. The LX-4048 DIAG port (port 0) is on the front of the unit. NOTE: Display problems may occur during bootup when you attach a VT420 terminal to the DIAG port (port 0) and the VT420 display setup is configured to Smooth-2 Scroll. To avoid this, change the VT420 scroll setting to Jump Scroll.451-0308 31 Installing the LX Series Use the following procedure to configure your LX unit for the first time. 1. Plug in the terminal at the DIAG port (port 0 - port values are 9600 bps, eight data bits, one stop bit, no parity, and Xon/Xoff flow control). The Main Menu appears. 2. Press b to boot the LX unit. The setup takes a minute or two. The The unit has loaded to factory defaults, would you like to run Initial Connectivity Setup? y/n message appears. 3. Press y (yes) and press . The Superuser Password prompt appears. 4. Enter password system. The Quick Configuration menu appears: 5. Press the number corresponding to the parameter you want to set. 6. Enter the appropriate information and press to return to the Quick Configuration menu. Once you enter a parameter value, a data entry line specific to that parameter appears on the Quick Configuration menu. 7. Continue in this way through the menu, configuring as many parameters as you want. You are not required to configure all parameters. Quick Configuration menu 1 Unit IP address 2 Subnet mask 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password 7 Exit and Save Enter your choice: Installing the LX Series 32 451-0308 NOTE: You should change the Superuser Password, since this is the first time you are configuring the LX unit (the default password is system). 8. Press 7 (Exit and Save) to save your changes. The Is this information correct? message appears. 9. Press y (yes) and press . The Save this information to flash? message appears. 10. Press y (yes) and press . The information is saved to flash. 11. Press several times to display the Login: prompt. 12. Enter your login name. The default is InReach. 13. Enter your password. The default is access. You can now use the LX unit. NOTE: The login username and password are case-sensitive. Completing the First Time Configuration Once configured, the system stores the configuration in a file called Config.prm by default. From here you can continue configuring the unit via the CLI, Telnet, SSH, or by using the web browser. CONFIGURATION SUMMARY 1 Unit IP address 10.80.1.5 2 Subnet mask 255.0.0.0 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password Not Changed 7 Exit and Save Is this information correct? (y/n) : 451-0308 33 Installing the LX Series • To use the CLI, refer to Figure 16 for the CLI tree structure and to the LX-Series Commands Reference Guide for information on specific commands. • To use Telnet, refer to “Connecting to the LX Series via Telnet or SSH” on page 39. • To use the web browser, refer to “Accessing and Configuring the Graphical User Interface (GUI)” on page 33. Assigning an IP Address via the Network The LX is an intelligent unit; if you are running DHCP, BOOTP, or RARP the LX obtains its own IP information automatically while it boots. Once the unit has been assigned an IP address from your network, you can configure the unit. • To use the CLI, refer to Figure 16 for the CLI tree structure and to the LX-Series Commands Reference Guide for information on specific commands. • To use Telnet, refer to “Connecting to the LX Series via Telnet or SSH” on page 39. • To use the web browser, refer to “Accessing and Configuring the Graphical User Interface (GUI)” on page 33. Accessing and Configuring the Graphical User Interface (GUI) This section describes how to access and configure the LX GUI. To perform this procedure, you need a PC with Java Runtime Environment (JRE) 1.4 or later installed. NOTE: For optimum GUI performance, MRV Communications recommends that your PC run at 500 Mhz or better. The minimum requirement for desktop color settings is 256. To access the GUI, do the following:Installing the LX Series 34 451-0308 1. At your browser, type the IP address or hostname of your LX unit. The LX Series Configuration Console page appears. NOTE: Make sure that your PC has access to the World Wide Web. You may need to download the latest release of the Java plug in to your PC. This download is performed automatically if the GUI sees that the plugin version is out of date, or not available at all. If for some reason your PC does not download the Java plug-in automatically, click on the Download JRE 1.4: link and install the software manually from the http://java.sun.com web site.451-0308 35 Installing the LX Series 2. When you select Encrypted Console or Not Encrypted Console at the LX Series Configuration Console page, and the system detects that you do not have the proper version of JRE installed, a Security Warning window appears, asking if you want to install and run JRE plug-in version 1.4 or later. Choosing Encrypted Console means the GUI will run slower, but with security. Encrypted Console also requires Java Runtime Environment 1.4 or later. Choosing Not Encrypted Console means the GUI will run faster, but without security. Not Encrypted Console requires Java Runtime Environment 1.3 or later. 3. Click Yes. The plugin is downloaded and then the installation begins. A Java Runtime Environment window appears after about two minutes. NOTE: It may take longer for your PC to download JRE 1.4 (about 10 MB) depending on the speed of your connection. 4. Follow the defaults to the end of the install. The LX Series Configuration Console page reappears, now with the MRV icon visible.Installing the LX Series 36 451-0308 NOTE: The java cache in JRE 1.4 is set ON by default. There is a known problem within JRE 1.4 regarding cache functionality, which requires you to disable the cache. On your Windows machine, select Start: Programs: Settings: Control Panel, open the Java Plug-in 1.4.0 icon, and click the Cache tab. At the Cache window, click the Clear Cache button and uncheck the Enable Caching checkbox. Click OK. 5. Double-click on the larger MRV icon to open the GUI. A login window appears.451-0308 37 Installing the LX Series 6. Enter your Username and Password, and click Login. NOTE: By default, authentication is done against the LX local user database. To start, use the known username InReach and password access. 7. Click the Admin button on the tool bar and log in with the default Superuser password system. You can now configure the unit via the GUI. 8. Click on the menus on the left side of the window. For example, selecting Ports: Async opens the Async ports window:Installing the LX Series 38 451-0308 Software Upgrades To upgrade software using the ppciboot menu, refer to “Upgrading Software with the ppciboot Main Menu” in the LX-Series Configuration Guide. To upgrade software using the CLI, refer to “Upgrading Software and ppciboot with the Command Line Interface” in the same manual. IP Configuration Menu For details on using the IP Configuration Menu, refer to “Using the IP Configuration Menu” in the LX-Series Configuration Guide. Booting from Defaults For information on how to boot your unit from defaults, refer to “Booting from Defaults” in the LX-Series Configuration Guide.451-0308 39 Installing the LX Series Accessing and Configuring Additional Features The following sections describe additional LX features you can access and configure. Connecting to the LX Series via Telnet or SSH Telnet Directly into the Communication Server NOTE: The default telnet port is 23. The default SSH port is 22. 1. Telnet to the unit from your machine. 2. Enter your subscriber login name, then your password. 3. If you entered the password correctly, the user> prompt is displayed. Connecting to a Serial Port NOTE: For example, devices connected to serial ports 1-32 on the LX-4032 are assigned telnet port numbers 2100-5200 by default. The corresponding SSH port numbers are 2122-5222. You can gain telnet/ssh access to a serial device by using the LX IP address and default port number of that serial port. Changing the Telnet Port To change the interface telnet port number, use the following commands: InReach> enable Password> system InReach>> config Config:0>> interface 1 Intf 1-1:0>> telnet port # NOTE: If you change the port number, be sure not to use a socket number assigned to another application or daemon.Installing the LX Series 40 451-0308 Accessing from a Terminal Attached to an LX Series Serial Port Use the following procedure to access the command line interface port from a dumb terminal attached to an LX Series serial port, which is set for access local, or dynamic: 1. Hit the return key several times to autobaud (if autobaud is enabled) the port and get the Login: prompt. 2. Enter your login name. The default is InReach. 3. Enter your password. The default is access. Additional Considerations Other considerations include the following: • Setting up users • Authentication/Security • Configuring modem settings For further information on these issues, refer to the LX-Series Commands Reference Guide, and to the Support area of the MRV website at www.mrv.com. Sensor (Temperature/Humidity) Ports You can configure ports to act as temperature and humidity monitors when connected to an In-Reach Temperature/Humidity Sensor. The Temperature/ Humidity Sensor provides an accurate measurement of the temperature/ humidity in the area in which your LX Series unit is placed. The following section explains how to connect and install the sensor. Connecting the Temperature/Humidity Sensor A 10’ Male RJ-45 to Male RJ-45 straight-through cable (P/N MX-151-3027) connects the temperature/humidity sensor to an LX async port. The LX unit can be configured to support the sensor on any async port other than the DIAG port (port 0).451-0308 41 Installing the LX Series To connect the sensor: 1. Connect one end of the RJ-45 double-ended straight through cable to the temperature/humidity sensor. The maximum length of this cable is 500 feet. 2. Connect the other end to any port you have configured as a sensor port. Figure 15 - Connecting the Temperature/Humidity Sensor You must change the port’s “access” to “sensor” before performing any monitoring. Use the following command, in the Async Port Configure Mode, to configure asynchronous port 4 as a Sensor Port: Async 4-4:0>>access sensor Once the sensor is enabled, you can check the temperature with the following command: InReach:0>> show port async 4 status 100-240VAC 1.0A 50/60Hz 9 10 11 12 13 14 15 16 DIAG 1 0/1 0 0 E THN T 100 1 2 3 4 5 6 7 8 RCV LINK TELCO LINE 15 33 34 RJ45 Double-Ended Straight-Through CableInstalling the LX Series 42 451-0308 3. You can also monitor the temperature/humidity remotely through the LX CLI. Refer to the LX-Series Commands Reference Guide for a detailed explanation of the commands used to configure and view your temperature/humidity sensor through the CLI interface. Command Line Interface (CLI) Tree Structure The command line interface structure is designed to be as intuitive as possible. Refer to “Navigating the LX Command Line Interface (CLI)” in the LX-Series Commands Reference Guide for detailed information on the menu tree modes. See Figure 16 for the CLI menu structure. Figure 16 - Basic Menu Structure Configuration Notification Interface Broadcast Group Subscriber SNMP Menu User Superuser Enter “enable” command and login to Superuser command mode Cconfiguration Nnotification Mmenu Ssnmp Ssubscriber Iinterface Ibroadcast group PPP Modem Ethernet Async Pppp Mmodem Pport ethernet Pport async Oopen Menu Editing451-0308 43 Installing the LX Series ppciboot Factory Default Settings The following table lists the factory default settings. NOTE: For defaults on specific commands, refer to the LX-Series Commands Reference Guide. Each LX Series unit is configured at the factory to use a default set of initialization parameters that sets all ports to operate with asynchronous ASCII terminal devices. Main Menu Configuration Factory Default Setting Boot from Network yes Save boot image to flash no Boot from flash yes Time Out, in seconds 8 IP Configuration Menu Configuration Factory Default Setting IP Assignment method #1 DHCP IP Assignment method #2 BOOTP IP Assignment method #3 RARP IP Assignment method #4 User DefinedInstalling the LX Series 44 451-0308 Additional Considerations for an Internet Environment If you plan to use the unit in an Internet environment, you must define addressing and identification characteristics to enable Internet hosts to recognize the unit as a member of the network. Using ppciboot, an LX-Series unit can be configured to obtain an IP address and other parameter values from the network when the unit boots. Autobauding Feature Autobaud is disabled on all ports. The administrator can enable autobaud on a per-port basis, except for the DIAG port (port 0). Default settings for the DIAG port (port 0) are 9600/8/N/1. Reinitializing/Powering Off the Unit To reinitialize the unit, enter the following command from the superuser mode: reload To power off the unit, disconnect the power cord.451-0308 45 Appendix A Technical Specifications The following table provides the specifications for the LX Series. Table 1 - LX Series Specifications Item Description Terminal Signals Transmit Data, Receive Data, Signal Ground, Data Set Ready/Data Carrier Detect (DSR/DCD), Data Terminal Ready (DTR), Clear-to-Send (CTS), and Request-to-Send (RTS). Supports concurrent modem control. Terminal Cabling Modular RJ-45 DTE Serial Line Speed LX Series - 134 bps to 230 Kbps Number of Serial Ports LX 4008 - 8 ports LX 4016 - 16 ports LX-4032 - 32 ports LX-4048 - 48 ports Modem (optional) V.90/K56flex 56 Kbps LEDs FLT, OK, Port Status LEDs 1-8 (1-16 on 16 port, 1-32 on 32 port, 1-48 on 48 port), 10/100 Ethernet RCV, 10/100 Ethernet Link, 100Mbps speed Controls Reset push button switchTechnical Specifications 46 451-0308 Dimensions Height Depth Width LX Series 4.1 cm (1.62 in), LX-4048 - 4.34 cm (1.71 in) 21.5 cm (8.5 in) 48.2 cm (19 in) Weight LX 4008 - 2.7 kg (6.0 lbs.) LX-4016 - 3.06 kg (6.75 lbs.) LX-4032 - 3.4 kg (7.5 lbs) LX-4048 - 3.47 kg (7.65 lbs) Processor/Speeds 66 (100 for 32-port) Mhz RISC processor with integral communications co-processor. LX-4008 - 2 RISC asynchronous communication coprocessors @ 60 Mhz. LX-4016 - 4 RISC asynchronous communication coprocessors @ 60 Mhz. LX-4032 - 8 RISC asynchronous communication coprocessors @ 60 Mhz LX-4048 - 12 RISC asynchronous communication coprocessors @ 60 Mhz Memory 8 MB Flash, 64MB SDRAM (128MB for LX-4032 and LX- 4048). Environment 5% to 90% humidity, noncondensing Operating Temperature: 0 - 40°C (32° - 113° F) Storage Temperature: -40 to 85°C (-40 to 185° F) Input Voltage 100 - 240 VAC 50 - 60 Hz (All LX Series)451-0308 47 Technical Specifications Power Requirements LX-4008 AC - 11W, (38BTU/hr) 0.09A at 120V (typ), 11W 0.05A at 220V (typ) LX-4008 DC - -48VDC Nominal, -20VDC to -72VDC Operating Range, 1A @ -48VDC, Dual Feed, 165 BTU/hr LX-4016 AC - 14W, (47.8 BTU/hr) 0.11A at 120V (typ), 14W 0.06A at 220V (typ) LX-4016 DC - -48VDC Nominal, -20VDC to -72VDC Operating Range, 1.2A @ -20VDC, Dual Feed, 165 BTU/ hr LX-4032AC - 23W, (79 BTU/hr) 0.19A @ 120V (typ), 0.105A @ 220V LX-4032DC - -48VDC Nominal, -20VDC to -72VDC Operating Range, 0.6A @ 48VDC, Dual Feed, (99 BTU/hr) LX-4048AC - 41W, (140 BTU/hr) 0.24A @ 120V (typ), 0.13A @ 220V Minimum Software Requirements LX-4008S requires V2.0.0 or greater, LX-4016S requires V2.0.1 or greater, LX-4032 requires V2.2.0 or greater, LX- 4048 requires V3.0.0 or greater. Ethernet Interface 10/100 TX, Auto/10/100 Mbps duplex half full auto Real Time Clock Battery 32.768KHz crystal Lithium coin cell battery CR2032 or equivalent. Capacity is 200mAH. Power down shelf-life 1 year at 20 0 C.Technical Specifications 48 451-0308451-0308 49 Appendix B POST Test Error Codes Error Code Definitions The following table provides the definitions for the LX Series POST test error codes. Table 2 - POST Test Error Codes Error Definition Error Code (in Hexadecimal) Real Time Clock does not work properly 1010 Reading Invalid Default Value from CPLD Diagnostic Register 2010 Reading Invalid Default Value from Expansion CPLD Diagnostic Register 2011 Reading Invalid Pattern Value from CPLD Diagnostic Register 2020 Reading Invalid Pattern Value from Expansion CPLD Diagnostic Register 2021 Reading Invalid Value from CPLD System Fail Status Register 2030 AC FAIL bit is set in the CPLD System Fail Status Register 2031 +12VFAIL bit is set in the CPLD System Fail Status Register 2033 -12VFAIL bit is set in the CPLD System Fail Status Register 2034POST Test Error Codes 50 451-0308 CPLD FAIL bit is set in the CPLD System Fail Status Register 2035 DC_A bit is set in the CPLD System Fail Status Register 2037 DC_B bit is set in the CPLD System Fail Status Register 2038 Watchdog Timer Failed 2040 Invalid HW Type 2050 Fast Ethernet Controller (FEC) Reset Delay Timeout 3010 Fast Ethernet Controller (FEC) Transmission Failed Timeout 3020 Fast Ethernet Controller (FEC) Reception Failed Timeout 3030 Fast Ethernet Controller (FEC) Invalid Data Received 3040 CD1400 Reset delay timeout for Quadart 1 4110 CD1400 Reset delay timeout for Quadart 2 4120 CD1400 Reset delay timeout for Quadart 3 4130 CD1400 Reset delay timeout for Quadart 4 4140 CD1400 Reset delay timeout for Quadart 5 4150 CD1400 Reset delay timeout for Quadart 6 4160 CD1400 Reset delay timeout for Quadart 7 4170 CD1400 Reset delay timeout for Quadart 8 4180 CD1400 Loopback operation timeout for Quadart 1 4210 CD1400 Loopback operation timeout for Quadart 2 4220 CD1400 Loopback operation timeout for Quadart 3 4230451-0308 51 POST Test Error Codes POST Test Error Code Sample NOTE: This example applies to 8, 16, 32, and 48 port LX units. The 16, 32, and 48 port LX units use only the first eight LEDs when generating error codes. The following sample illustrates the Port Status LED sequence for Error 2030 (Reading Invalid Value from PLD System Fail Status Register) on the LX-4008. In this example: CD1400 Loopback operation timeout for Quadart 4 4240 CD1400 Loopback operation timeout for Quadart 5 4250 CD1400 Loopback operation timeout for Quadart 6 4260 CD1400 Loopback operation timeout for Quadart 7 4270 CD1400 Loopback operation timeout for Quadart 8 4280 CD1400 Invalid Data Received for Quadart 1 4310 CD1400 Invalid Data Received for Quadart 2 4320 CD1400 Invalid Data Received for Quadart 3 4330 CD1400 Invalid Data Received for Quadart 4 4340 CD1400 Invalid Data Received for Quadart 5 4350 CD1400 Invalid Data Received for Quadart 6 4360 CD1400 Invalid Data Received for Quadart 7 4370 CD1400 Invalid Data Received for Quadart 8 4380 Memory Error at (printing address) 5010 Memory Data Bus Failed 5020 Memory Address Bus Failed High 5030 Memory Address Bus Failed Low 5040POST Test Error Codes 52 451-0308 1. A POST test failure occurs on an 8-port unit. All LEDs flash eight times, very quickly, then the error code is displayed. 2. You record that LED 3 turns on. Again, all LEDs flash eight times very quickly, then the rest of the error code is displayed. 3. You record that LEDs 3 and 4 turn on. Figure 17 explains how to interpret the sample error code. NOTE: In hexadecimal, 0 indicates the LED is OFF. 1 indicates the LED is ON. Each group of four LEDs is converted to a hexadecimal value as follows: • 0 = 0000 • 1 = 0001 • 2 = 0010 • 3 = 0011 • 4 = 0100 • 5 = 0101 • 6 = 0110 • 7 = 0111 • 8 = 1000 • 9 = 1001 • A = 1010 • B = 1011 • C = 1100 • D = 1101 • E = 1110 • F = 1111451-0308 53 POST Test Error Codes Figure 17 - POST Test Error Code Sample 1 - All flash for 2 seconds 2 - High error code (20 Hex) 3 - Cycle 1 through 8 4 - Low error code (30 Hex) 5 - All extinguished 1 2 3 4 5 6 7 8POST Test Error Codes 54 451-0308451-0308 55 Appendix C Cabling the LX Series Cabling Considerations Standard cabling items available from MRV Communications allow you to connect to any serial device that uses male or female DB-25 or DB-9 connectors. All you need is the appropriate modular cable (crossover cable for connecting to a DTE device, straight-through cable for connecting to a DCE device), and the correct modular adapter (male or female DB-25 connector), which is essentially an RJ-45-to-DB25 adapter. Serial Device Connectors The signal assignments of the 8-pin jacks are shown in Figure 18. Figure 18 - Serial Device Connector (RJ-45) Signal Assignments Diagnostic Port Connector (Port 0) The pinout for the Diagnostic Port connector is the same as that of the serial connector. 1 2 3 4 5 6 7 8 8 7 6 5 4 3 2 1 Rj-45 Jack (Female) Rj-45 Plug (Male) Pin Signal 1 CTS 2 DTR 3 TXD 4 SGND 5 SGND 6 RXD 7 DSR 8 RTSCabling the LX Series 56 451-0308 10/100 Connector Figure 19 shows the standard 10/100 (RJ-45 jack) connector signal assignments. Figure 19 - 10/100 Connector Assignments Ordering Cables MRV Communications also supplies crossover cables and modular adapters for use with all LX Series units. To order cables, adapters or other cabling accessories from MRV Communications, contact your Sales representative or distributor. Modular Adapters MRV Communications provides the following modular adapters for use with LX-series units: • Female DB-9 (PN MX-350-0308) • Female DB-25 (PN MX-350-0181) • Male DB-25 (PN MX-350-0179) – supports RING • Male DB-25 (PN MX-350-0180) – supports RTS/CTS This section describes the pinouts and wiring of the MRV-supplied DB-25 adapter. 8 7 6 5 4 3 2 1 Pin Signal 1 TX+ 2 TX- 3 RX+ 4 No Connect 5 No Connect 6 RX- 7 No Connect 8 No Connect451-0308 57 Cabling the LX Series Pin Assignments The following table shows the pinouts for the DB-25 cable. Pin Signal 1 Cable Shield 2 Transmit Data 3 Receive Data to DCE 4 RTS (Request to Send) 5 CTS (Clear to Send) 6 DSR (Data Set Ready) 7 Signal Ground 8 Data Carrier Detect 9 Unused 10 Unused 11 Unused 12 Unused 13 Unused 14 Unused 15 Unused 16 Unused 17 Unused 18 Unused 19 Unused 20 Data Terminal Ready 21 UnusedCabling the LX Series 58 451-0308 Figure 20 shows serial DB-25 pin assignments. Figure 20 - DB-25 Pins 22 Ring Indicate 23 Unused 24 Unused 25 Unused 14 DB-25 (Male) DB-25 (Female) 25 1 13 25 14 13 1451-0308 59 Cabling the LX Series Ordering and Installing the Inlet Connector Lock You can use an inlet connector lock to lock the AC power cord to the LX Series unit. MRV Communications does not supply this lock. You can order the connector lock (part number 85910020) from Panel Components Corporation. The web address at which you can order the connector lock is: www.panelcomponents.com/first.html. See Figure 21 for installation instructions. Figure 21 - Installing the Inlet Connector Lock Connecting to the Diagnostic Port (Port 0) NOTE: Display problems may occur during bootup when you attach a VT420 terminal to the DIAG port (port 0) and the VT420 display setup is configured to Smooth-2 Scroll. To avoid this, change the VT420 scroll setting to Jump Scroll. Connect the provided serial port cable to the DIAG connector (port 0), and the other end to your terminal. You can use this direct connect serial link to send commands to the boot loader and diagnostics. This port is used to log system messages during bootup. You can also use port 0 to manage and configure the LX once the unit completes the bootstrap process. 90-250VAC 1.0A 50/60Hz Insert two 4-40 x 1/4” Philips screws here. Do not tighten. 1 Slide the connector lock ears under the screw heads. Tighten the screws. 2 Plug in the power cord (not shown). 3 Tighten the screw beneath the connector lock. 4Cabling the LX Series 60 451-0308 Modem Control/Hardware Flow Control LX Series serial ports can be set up to support RTS/CTS flow control. The adapters shown in Figure 22 and Figure 23 illustrate RTS/CTS flow control for DTE devices using DB25 and DB9 connectors. Figure 24 illustrates RTS/CTS flow control for a DB-25 connector on a DCE device like a modem. LX Series serial ports can also be set up to support modem control (except for the DIAG port (port 0)). Figures 22, 23, and 24 support modem control as needed. Only Figures 23 and 24 support concurrent modem control and RTS/CTS flow control between the LX Serial Port and the attached device. The adapter shown in Figure 24 supports modem control. NOTE: You would use a "null-modem" cable when making a direct connection between the serial ports of two communication servers (i.e., no modems involved) or other DTE device. For that application, use a DTE-to-DTE cable. RJ-45 Wiring Considerations You should give special consideration to the wiring scheme when connecting a device such as a terminal to a LX Series serial port. The LX Series is considered a DTE device. To connect to another DTE device such as a terminal, you will need crossover wiring, as shown in Figure 22 and Figure 23. When a DCE device is connected to an LX Series serial port, straight-through wiring is required, as shown in Figure 24. NOTE: In general, an ethernet CAT3/CAT5 may introduce noise due to the crossing of pins 3 and 6 (transmit and receive). Flat eight wire cables are recommended. 451-0308 61 Cabling the LX Series Modular Adapters (RJ-45 to DB-25) You can obtain adapters with male and female DB-25 connectors from MRV Communications. These adapters direct signals from the RJ-45 connector on the cable to the correct pin on the DB-25 connector. Figure 22, Figure 23, and Figure 24 show how devices are cabled when you use these adapters. Figure 22 - Adapter Wiring, LX Series to DTE CTS DTR XMT GND RCV DCD DSR RTS Female RJ-45 Connector Female DB-25 Connector DTE Device Pin Signal Adaptor Wiring - MX-350-0181 (Female RJ-45 to female DB-25) Male RJ-45 Connector Male RJ-45 Connector Crossover Cable MAXserver Connector 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 5 20 2 7 3 8 6 4 CTS/RING DTR XMT XMTGND RCVGND RCV DSR * RTS Male RJ-45 Male RJ-45 Female RJ-45 Female RJ-45 Female DB-25 Crossover Cable MAXserver Connector Modular Adaptor To DTE DTE Cable * (See Note, Page 5.) LX Series LX Series MX-151-3028 CTSCabling the LX Series 62 451-0308 Figure 23 - Adapter Wiring, RJ-45 to DB-9, LX Series to DTE CTS DTR XMT G ND RCV DCD DSR RTS Female RJ-45 Connector Female DB-25 Connector DTE Device Pin Signal Adaptor Wiring - MX-350-0181 (Female RJ-45 to female DB-25) M ale RJ-45 Connector M ale RJ-45 Connector Crossover Cable M AXse rve r Connector 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 5 20 2 7 3 8 6 4 CTS/RING DTR XMT XMTGND RCVGND RCV DSR * RTS Male RJ -45 Male RJ -45 Female RJ -45 Female RJ -45 Female DB-25 Crossover Cable M AXse rve r Connector M odula r Adap tor To DTE DTE Cable * (See Note, Page 5.) LX Series LX Series DB-9 DB-9 Cable DCD 0308 Male DB-9) 8 7 1 2 5 3 4 RTS 8 6 DSR451-0308 63 Cabling the LX Series Figure 24 - Adapter Wiring, LX Series to DCE LX Series Connector Female RJ-45 Male RJ-45 Male RJ-45 Straight Through Cable Female RJ-45 Modular Adaptor Modem Cable Male DB-25 To Modem 1 2 3 4 5 6 7 8 5 20 2 7 3 8 4 Female RJ-45 Connector Male DB-25 Connector DCE Device Pin Signal CTS DTR XMT GND RCV DCD RTS Adaptor Wiring MX-350-0180 (Female RJ-45 to male DB-25) 1 2 3 4 5 6 7 8 Male RJ-45 Connector CTS DTR XMT GND GND RCV DCD RTS Straight Through Cable 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 Male RJ-45 Connector LX Series Connector Supports RTS/CTS MX-151-3027Cabling the LX Series 64 451-0308 NOTE: In order to expand the functionality of the serial interface, the LX Series modular cabling allows you to connect different signals to pin 7 of the LX Series. (This pin is an input to the LX Series.) When a DCE device is connected to an LX Series serial port, the device's DCD output is connected to pin 7. In this case, the signal at pin 7 is referred to as DCD. DCD is used here for session control only, not for flow control. When a DTE device is connected to an LX Series serial port, the device's DTR output is connected to pin 7 of the LX Series. In this case, the signal at pin 7 is referred to as DSR. (This cabling scheme also provides DECconnect compatibility, since DECconnect does not support the DCD signal.) MRV Communications 8-Wire Cabling This cabling scheme provides XMT, RCV, DCD/DSR, DTR, RTS, CTS, and two signal ground wires. This cabling is provided through RJ-45 connectors. Using this cabling scheme you can concurrently use modem control and RTS/CTS hardware flow control, since there are four control signals. This scheme is useful with relatively high speed devices, complex modem control applications. In Figure 25, one signal is referred to as CTS. The CTS signal designation refers to the signal observed at pin 1 of each serial port. Pin 1 is multiplexed to these signals. This scheme is useful with the following applications: • Terminal emulation and file transfer applications, such as Kermit, Xmodem, Microphone, etc. • Applications such as PPP using low speed modems. • Applications such as PPP using high speed modems. • Applications using CCITT V.42-compliant modems, or other devices operating at high port speeds.451-0308 65 Cabling the LX Series Figure 25 - Modular Cables for RTS/CTS Flow Control (Eight-Wire), Concurrent with Modem Control Signalling Communication Ser ver Connec tor Modular Adapt or To Modem St raight T hrough Cable Female RJ-45 Connector Male DB-25 Connector CTS DTR XMT G ND RCV DCD RTS Male RJ-45 Connector Male RJ-45 Connector St raight T hrough Cable Adaptor Wiring - MX-350- 0180 ( F emale RJ -45 t o male DB-25) CTS/RING DTR XMT XMTGND RCVGND RCV DCD RTS Modem connec tor Pin Signal 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 5 20 2 7 3 8 4 Female RJ-45 Connector RTS/CTS Modem Connection Communication Ser ver Connec tor Modular Adapt or To Modem St raight T hrough Cable Female RJ-45 Connector Male DB-25 Connector CTS DTR XMT G ND RCV DCD RTS Male RJ-45 Connector Male RJ-45 Connector St raight T hrough Cable Adaptor Wiring - MX-350- 0180 ( F emale RJ -45 t o male DB-25) CTS/RING DTR XMT XMTGND RCVGND RCV DCD RTS Modem connec tor Pin Signal 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 5 20 2 7 3 8 4 Female RJ-45 Connector RTS/CTS Modem Connection LX Series Connector CTSCabling the LX Series 66 451-0308451-0308 67 INDEX Numerics 10/100 connectors 56 8-wire cabling 64 A adapter wiring 61 adapters 61 autobauding feature 44 C cables ordering 56 cabling 25, 45 signals 64 command recall 14 configured 43 configuring the LX unit for the first time 30 connecting DC power 26 connecting the power cable 25 connecting to a serial port 39 controls 45 conventions 13 crossover cables 55 D DB-25 connectors 61 DB-25 pin assignments 64 DC power connecting 26 diagnostic port connector 55 dimensions 46 DTE devices connecting to LX Series 64 DTE wiring 61 E environment 23, 46 environmental considerations 23 error code definitions 49 ethernet connection 25, 47 F first time quick configuration 31 flow control 60 FLT - fault LED 19 front panel LEDs 18 G Graphic User Interface (GUI) accessing 33 H hardware installation 17 help key 14 I iBoot factory default settings 43 inlet connector lock installing 59 ordering 59 installation hardware 17 installing Java Runtime Environment (JRE) 34 Installing the LX Series site requirements 45 internet access IP addresses 44 internet environment 44 IP address assigning via the network 33 IP information obtaining 33 J Java installing 34 java cache turning off 36 L LED fault 19INDEX 68 451-0308 link 22 OK 19 receive 22 speed 22 LEDs 19, 29, 45 port status 19 LINK LED 22 login username 28 default 28 LX Indicators 18 LX series 4008 rear panel 19 4008 w/modem rear panel 20 4016 DC rear panel 21 4016 w/modem rear panel 20 4032 DC rear panel 22 4032 w/modem rear panel 21 4048 AC rear panel 22 about 13 LX Series ports accessing from a terminal 40 LX Unit configuring for the first time 30 LX-4008S front panel 18 LX-4016 front panel 18 LX-4032 front panel 18 LX-4048 front panel 18 M management station connecting to 25 memory 46 menu tree structure 42 minimum software requirements 47 modem 45 modem port 27 modular adapters 56 O OK LED 19 organization of user guide 11 P package contents 17 Passwords 28 passwords 28 defaults 28 pinouts DB-25 57, 64 RJ-45 64 RJ-45 jacks 55 port status LEDs 19 ports 40 POST test error code sample 51 power cable 25 power on self test (POST) 27 power requirements 47 powering on 27 ppciboot factory default settings 43 processor 46 prompts 13 Q quick configuration first time 31 R rack-mounting the unit 24 RCV LED 22 real time clock 47 clock battery 47 rear panel connections 19 LEDs 19 reinitializing/powering off the unit 44 RESET switch 29 resetting the unit 29 RJ-45 jacks 25 wiring 60451-0308 69 INDEX S sensor ports 40 serial device cables connecting to RJ-45 jacks 25 serial ports number of 45 signals 45 speed LED 22 speeds 45 system login 28 system specifications 15 T tab button 14 technical specifications 45 telnet directly to the communication server 39 telnet port changing 39 temperature/humidity sensor connecting the 40 turning off java cache 36 typographical conventions 14 U Unpacking and inspecting the unit 17 V voltage 46 W weight 46 wiring schemes for RJ-45 60 LX-Series Commands Reference Guide 451-0310E Corporate Headquarters MRV Communications, Inc. Corporate Center 20415 Nordhoff Street Chatsworth, CA 91311 Tel: 818-773-0900 Fax: 818-773-0906 www.mrv.com (Internet) Sales and Customer Support MRV Americas 295 Foster Street Littleton, MA 01460 Tel: 800-338-5316 (U.S.) Tel: +011 978-952-4888 (Outside U.S.) sales@mrv.com (email) www.mrv.com (Internet) MRV International Industrial Zone P.O. Box 614 Yokneam, Israel 20682 Tel: 972-4-993-6200 sales@mrv.com (email) www.mrv.com (Internet)2 451-0310E All rights reserved. No part of this publication may be reproduced without the prior written consent of MRV Communications, Inc. The information in this document is subject to change without notice and should not be construed as a commitment by MRV Communications, Inc. MRV Communications, Inc. reserves the right to revise this publication and to make changes in content from time to time, without obligation to provide notification of such revision or changes. MRV Communications, Inc. assumes no responsibility for errors that may appear in this document. Copyright © 2003 by MRV Communications, Inc. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/). This product includes cryptographic software written by Eric Young (eay@cryptosoft.com). This product includes software written by Tim Hudson (tjh@cryptosoft.com). Service Information Should you experience trouble with this equipment, please contact one of the following support locations: • If you purchased your equipment in the Americas, contact MRV Americas Service and Support in the U.S. at 978-952-4888. (If you are calling from outside the U.S., call +011 978-952-4888.) • If you purchased your equipment outside the Americas (Europe, EU, Middle-East, Africa, Asia), contact MRV International Service and Support at 972-4-993-6200.451-0310E 3 Secure Shell Disclaimer THE SECURE SHELL SOFTWARE IS PROVIDED BY ERIC YOUNG "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OR SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.451-0310E 5 Table of Contents Preface ................................................................................................................ 21 Conventions ................................................................................................................................. 22 Using the Function Keys ............................................................................................................. 22 Navigating the LX Command Line Interface (CLI) .................................................................... 23 User Command Mode ............................................................................................................ 24 Superuser Command Mode ...................................................................................................25 Configuration Command Mode .............................................................................................25 Asynchronous Command Mode ............................................................................................ 26 Ethernet Command Mode ...................................................................................................... 26 PPP Command Mode ............................................................................................................. 27 Modem Command Mode ....................................................................................................... 27 Subscriber Command Mode .................................................................................................. 27 SNMP Command Mode ........................................................................................................ 28 Interface Command Mode ..................................................................................................... 28 Menu Command Mode .......................................................................................................... 28 Menu Editing Command Mode .............................................................................................29 Notification Command Mode ................................................................................................ 29 Broadcast Group Command Mode ........................................................................................29 Online Help ................................................................................................................................. 30 Related Documents ..................................................................................................................... 31 Chapter 1 - User Commands ............................................................................ 33 clear ........................................................................................................................................ 34 disconnect .............................................................................................................................. 35 enable ..................................................................................................................................... 36 exit .........................................................................................................................................37 no ........................................................................................................................................... 38 pause enable ........................................................................................................................... 39 ping ........................................................................................................................................ 40 show clock ............................................................................................................................. 41 show port ................................................................................................................................ 42 show service ........................................................................................................................... 53 show session .......................................................................................................................... 54 show subscriber ...................................................................................................................... 55 show version .......................................................................................................................... 61 ssh .......................................................................................................................................... 62 telnet ....................................................................................................................................... 63 terminal .................................................................................................................................. 646 451-0310E Chapter 2 - Superuser Commands .................................................................. 65 clear ........................................................................................................................................ 66 configuration .......................................................................................................................... 67 debug port async ppp ............................................................................................................. 68 debug snmp ............................................................................................................................ 69 debug subscriber ....................................................................................................................70 disconnect .............................................................................................................................. 71 exit .........................................................................................................................................72 logout ..................................................................................................................................... 73 no ........................................................................................................................................... 74 outlet ...................................................................................................................................... 75 outlet group ............................................................................................................................ 76 pause enable ........................................................................................................................... 77 ping ........................................................................................................................................ 78 reload ..................................................................................................................................... 79 save configuration .................................................................................................................. 80 setup ....................................................................................................................................... 81 shell ........................................................................................................................................ 82 show audit log ........................................................................................................................ 83 show broadcast group characteristics .................................................................................... 84 show broadcast group summary ............................................................................................ 85 show clock ............................................................................................................................. 86 show command log ................................................................................................................ 87 show configuration ................................................................................................................ 88 show configuration log .......................................................................................................... 89 show debug port async ppp .................................................................................................... 90 show debug subscriber ........................................................................................................... 91 show device status ................................................................................................................. 92 show device summary ............................................................................................................ 94 show interface characteristics ................................................................................................ 95 show interface port mapping .................................................................................................. 97 show interface rotary ............................................................................................................. 99 show interface status ............................................................................................................100 show interface summary ...................................................................................................... 101 show kernel log .................................................................................................................... 102 show log ............................................................................................................................... 103 show notification message ................................................................................................... 104 show notification serviceprofile ...........................................................................................105 show notification userprofile ............................................................................................... 106 show outlet group status ...................................................................................................... 107451-0310E 7 show port async apd ............................................................................................................. 108 show port async characteristics ............................................................................................ 109 show port async modem ...................................................................................................... 110 show port async pattern match characteristics .....................................................................111 show port async ppp ............................................................................................................ 112 show port async ppp status .................................................................................................. 113 show port async status ......................................................................................................... 114 show port async summary .................................................................................................... 115 show port ethernet characteristics ........................................................................................ 116 show port ethernet status ...................................................................................................... 117 show port ethernet summary ................................................................................................ 119 show radius characteristics .................................................................................................. 120 show radius status ................................................................................................................ 122 show radius summary .......................................................................................................... 124 show route ............................................................................................................................ 125 show securid characteristics .................................................................................................126 show securid status .............................................................................................................. 128 show securid summary ......................................................................................................... 129 show service ......................................................................................................................... 130 show session ........................................................................................................................ 131 show snmp characteristics ................................................................................................... 132 show snmp client ................................................................................................................. 133 show snmp v3 ...................................................................................................................... 134 show subscriber .................................................................................................................... 137 show subscriber summary .................................................................................................... 138 show system characteristics .................................................................................................139 show system ppciboot .......................................................................................................... 141 show system status ............................................................................................................... 142 show tacacs+ characteristics ................................................................................................ 144 show tacacs+ status .............................................................................................................. 146 show tacacs+ summary ........................................................................................................ 148 show users ............................................................................................................................ 149 show version ........................................................................................................................ 150 ssh ........................................................................................................................................ 151 telnet ..................................................................................................................................... 152 terminal ................................................................................................................................ 153 update ................................................................................................................................... 154 zero all .................................................................................................................................. 155 zero log ................................................................................................................................ 156 zero securid secret ................................................................................................................ 1578 451-0310E Chapter 3 - Configuration Commands ........................................................... 159 boot configuration from flash .............................................................................................. 160 boot configuration from name ............................................................................................. 161 boot configuration from network ......................................................................................... 162 broadcast group .................................................................................................................... 163 broadcast group enable ........................................................................................................ 164 clock ..................................................................................................................................... 165 copy port .............................................................................................................................. 166 copy subscriber .................................................................................................................... 167 date .......................................................................................................................................168 default boot .......................................................................................................................... 169 default configuration ............................................................................................................170 default log size ..................................................................................................................... 171 default outlet group off time ................................................................................................ 172 default tftp ............................................................................................................................ 173 domain name ........................................................................................................................ 174 end ........................................................................................................................................ 175 exit .......................................................................................................................................176 fingerd enable ...................................................................................................................... 177 gateway ................................................................................................................................ 178 hostname .............................................................................................................................. 179 interface ............................................................................................................................... 180 iptables .................................................................................................................................181 location .................................................................................................................................182 log size .................................................................................................................................183 menu ..................................................................................................................................... 184 no ......................................................................................................................................... 185 notification ........................................................................................................................... 186 ntp enable .............................................................................................................................187 ntp server address ................................................................................................................. 188 outlet group .......................................................................................................................... 189 outlet group name ................................................................................................................ 190 outlet group off time ............................................................................................................191 password .............................................................................................................................. 192 password enable ................................................................................................................... 193 port async .............................................................................................................................194 port ethernet ......................................................................................................................... 195 ppciboot address ..................................................................................................................196 ppciboot address assignment option .................................................................................... 197 ppciboot ethernet network link ............................................................................................ 198451-0310E 9 ppciboot gateway ................................................................................................................. 199 ppciboot image filename ...................................................................................................... 200 ppciboot image load from .................................................................................................... 201 ppciboot mask ...................................................................................................................... 202 ppciboot tftp server .............................................................................................................. 203 primary dns .......................................................................................................................... 204 radius period ........................................................................................................................ 205 radius primary accounting server address ............................................................................ 206 radius primary accounting server port ................................................................................. 207 radius primary accounting server retransmit ....................................................................... 208 radius primary accounting server secret .............................................................................. 209 radius primary accounting server timeout ........................................................................... 210 radius primary authentication server address ....................................................................... 211 radius primary authentication server port ............................................................................ 212 radius primary authentication server retransmit .................................................................. 213 radius primary authentication server secret ......................................................................... 214 radius primary authentication server timeout ...................................................................... 215 radius secondary accounting server address ........................................................................ 216 radius secondary accounting server port .............................................................................. 217 radius secondary accounting server retransmit .................................................................... 218 radius secondary accounting server secret ........................................................................... 219 radius secondary accounting server timeout ........................................................................ 220 radius secondary authentication server address ................................................................... 221 radius secondary authentication server port ......................................................................... 222 radius secondary authentication server retransmit ...............................................................223 radius secondary authentication server secret ...................................................................... 224 radius secondary authentication server timeout ................................................................... 225 route address ........................................................................................................................ 226 route gateway ....................................................................................................................... 227 route mask ............................................................................................................................ 228 secondary dns ....................................................................................................................... 229 securid authentication encryption ........................................................................................ 230 securid authentication port ................................................................................................... 231 securid authentication retransmit ......................................................................................... 232 securid authentication timeout ............................................................................................. 233 securid authentication version ............................................................................................. 234 securid master authentication server address ....................................................................... 235 securid master authentication server name .......................................................................... 236 securid primary authentication server address .....................................................................237 securid primary authentication server name ........................................................................ 23810 451-0310E securid slave authentication server address ......................................................................... 239 securid slave authentication server name ............................................................................. 240 service .................................................................................................................................. 241 snmp ..................................................................................................................................... 242 snmp enable ......................................................................................................................... 243 ssh enable .............................................................................................................................244 ssh v1 ................................................................................................................................... 245 ssh v2 ................................................................................................................................... 246 subscriber .............................................................................................................................247 tacacs+ period ...................................................................................................................... 248 tacacs+ primary accounting server address ......................................................................... 249 tacacs+ primary accounting server port ............................................................................... 250 tacacs+ primary accounting server retransmit .....................................................................251 tacacs+ primary accounting server secret ............................................................................ 252 tacacs+ primary accounting server timeout ......................................................................... 253 tacacs+ primary authentication server address .................................................................... 254 tacacs+ primary authentication server port .......................................................................... 255 tacacs+ primary authentication server retransmit ................................................................ 256 tacacs+ primary authentication server secret ....................................................................... 257 tacacs+ primary authentication server timeout .................................................................... 258 tacacs+ secondary accounting server address ...................................................................... 259 tacacs+ secondary accounting server port ........................................................................... 260 tacacs+ secondary accounting server retransmit .................................................................. 261 tacacs+ secondary accounting server secret ........................................................................ 262 tacacs+ secondary accounting server timeout ...................................................................... 263 tacacs+ secondary authentication server address ................................................................. 264 tacacs+ secondary authentication server port ...................................................................... 265 tacacs+ secondary authentication server retransmit ............................................................ 266 tacacs+ secondary authentication server secret ................................................................... 267 tacacs+ secondary authentication server timeout ................................................................ 268 tacacs+ superuser password request enable ......................................................................... 269 telnet enable ......................................................................................................................... 270 tftp ........................................................................................................................................ 271 timed enable ......................................................................................................................... 272 timezone ............................................................................................................................... 273 web_server enable ................................................................................................................ 274 Chapter 4 - Interface Commands ................................................................... 275 address .................................................................................................................................276 authentication fallback enable ............................................................................................. 277451-0310E 11 authentication local enable ................................................................................................... 278 authentication none .............................................................................................................. 279 authentication radius enable .................................................................................................280 authentication securid enable ............................................................................................... 281 authentication tacacs+ enable ............................................................................................. 282 broadcast .............................................................................................................................. 283 default mtu ........................................................................................................................... 284 default rotary ........................................................................................................................ 285 default ssh keepalive ............................................................................................................286 default ssh port ..................................................................................................................... 287 default telnet port ................................................................................................................. 288 end ........................................................................................................................................ 289 exit .......................................................................................................................................290 mask ..................................................................................................................................... 291 mtu .......................................................................................................................................292 no ......................................................................................................................................... 293 radius accounting enable ...................................................................................................... 294 rotary enable ........................................................................................................................ 295 rotary port ............................................................................................................................ 296 rotary ssh port ...................................................................................................................... 297 rotary tcp port ....................................................................................................................... 298 rotary type ............................................................................................................................ 299 serial ..................................................................................................................................... 300 ssh keepalive count .............................................................................................................. 301 ssh keepalive interval ........................................................................................................... 302 ssh port .................................................................................................................................303 tacacs+ accounting enable ................................................................................................... 304 telnet port .............................................................................................................................305 Chapter 5 - Asynchronous Commands ......................................................... 307 access ................................................................................................................................... 308 access power model ............................................................................................................. 309 apd enable ............................................................................................................................ 310 apd retry ............................................................................................................................... 311 apd signature ........................................................................................................................ 312 apd timeout .......................................................................................................................... 313 authentication enable ........................................................................................................... 314 authentication fallback enable ............................................................................................. 316 autobaud enable ................................................................................................................... 317 autobaud retry ...................................................................................................................... 31812 451-0310E autodial enable ..................................................................................................................... 319 autohangup enable ............................................................................................................... 320 banner ................................................................................................................................... 321 bits ........................................................................................................................................ 322 break enable ......................................................................................................................... 323 break special ........................................................................................................................ 324 connect command ................................................................................................................ 325 databuffer display ................................................................................................................ 326 databuffer size ...................................................................................................................... 327 databuffer syslog enable ...................................................................................................... 328 databuffer timestamp enable ................................................................................................ 329 default apd ............................................................................................................................ 330 default databuffer size .......................................................................................................... 331 default port ........................................................................................................................... 332 default power off time .......................................................................................................... 333 default speed ........................................................................................................................ 334 end ........................................................................................................................................ 335 exit .......................................................................................................................................336 flowcontrol ........................................................................................................................... 337 modem .................................................................................................................................338 modem enable ...................................................................................................................... 339 name ..................................................................................................................................... 340 no ......................................................................................................................................... 341 outlet name ........................................................................................................................... 342 parity .................................................................................................................................... 343 pattern match enable ............................................................................................................ 344 pattern string ........................................................................................................................ 345 power off time ...................................................................................................................... 347 ppp .......................................................................................................................................348 ppp enable ............................................................................................................................ 349 prompt .................................................................................................................................. 350 radius accounting enable ...................................................................................................... 351 signals syslog enable ............................................................................................................352 special break enable ............................................................................................................. 353 special break string .............................................................................................................. 354 speed .................................................................................................................................... 355 stopbits .................................................................................................................................356 tacacs+ accounting enable ................................................................................................... 357 telnet break string ................................................................................................................. 358 telnet negotiation enable ...................................................................................................... 359451-0310E 13 transparency enable .............................................................................................................. 360 Chapter 6 - Ethernet Commands .................................................................... 361 description ............................................................................................................................ 362 end ........................................................................................................................................ 363 exit .......................................................................................................................................364 no description ....................................................................................................................... 365 speed .................................................................................................................................... 366 Chapter 7 - Subscriber Commands ............................................................... 367 access console enable ........................................................................................................... 368 access port ............................................................................................................................ 369 access ssh enable ..................................................................................................................370 access telnet enable .............................................................................................................. 371 access web enable ................................................................................................................ 372 audit log enable .................................................................................................................... 373 backward_switch ................................................................................................................. 374 command log enable ............................................................................................................375 dedicated service ..................................................................................................................376 default access port ................................................................................................................ 377 default access remote ........................................................................................................... 378 default backward_switch ..................................................................................................... 379 default dialback retry ........................................................................................................... 380 default forward_switch ........................................................................................................ 381 default idletime .................................................................................................................... 382 default local_switch ............................................................................................................. 383 default ssh log level ............................................................................................................. 384 dialback enable .................................................................................................................... 385 dialback number ................................................................................................................... 386 dialback retry ....................................................................................................................... 387 end ........................................................................................................................................ 388 exit .......................................................................................................................................389 forward_switch .................................................................................................................... 390 idletime ................................................................................................................................ 391 local_switch ......................................................................................................................... 392 maxsubscriber ...................................................................................................................... 393 menu enable ......................................................................................................................... 394 no ......................................................................................................................................... 395 password .............................................................................................................................. 396 password enable ................................................................................................................... 39714 451-0310E pause enable ......................................................................................................................... 398 preferred service ..................................................................................................................399 prompt .................................................................................................................................. 400 security level superuser ........................................................................................................ 401 session .................................................................................................................................. 402 shell enable .......................................................................................................................... 403 ssh cipher .............................................................................................................................404 ssh key .................................................................................................................................. 405 ssh log level ......................................................................................................................... 406 telnet mode ........................................................................................................................... 407 terminal ................................................................................................................................ 408 Chapter 8 - SNMP Commands ........................................................................ 409 contact .................................................................................................................................. 410 default v3 client ................................................................................................................... 411 end ........................................................................................................................................ 412 exit .......................................................................................................................................413 get client ............................................................................................................................... 414 get client community ........................................................................................................... 415 get client version ..................................................................................................................416 location .................................................................................................................................417 log enable .............................................................................................................................418 no ......................................................................................................................................... 419 set client ............................................................................................................................... 420 set client community ............................................................................................................ 421 set client version ..................................................................................................................422 trap client .............................................................................................................................423 trap client community .......................................................................................................... 424 trap client version ................................................................................................................. 425 v3 client access context match ............................................................................................. 426 v3 client access context prefix ............................................................................................. 427 v3 client access read view .................................................................................................... 428 v3 client access security ....................................................................................................... 429 v3 client access write view .................................................................................................. 430 v3 client group security model ............................................................................................. 431 v3 client name ...................................................................................................................... 432 v3 client security community ............................................................................................... 433 v3 client security source ...................................................................................................... 434 v3 client view ....................................................................................................................... 435 v3 engine .............................................................................................................................. 436451-0310E 15 Chapter 9 - Modem Commands ...................................................................... 437 default initstring ................................................................................................................... 438 dialout number ..................................................................................................................... 439 end ........................................................................................................................................ 440 exit .......................................................................................................................................441 initstring ............................................................................................................................... 442 no ......................................................................................................................................... 443 retry ...................................................................................................................................... 444 timeout .................................................................................................................................445 type .......................................................................................................................................446 Chapter 10 - PPP Commands ......................................................................... 447 accounting enable ................................................................................................................ 448 authentication ....................................................................................................................... 449 ccp enable ............................................................................................................................ 450 default authentication ........................................................................................................... 451 default ipcp .......................................................................................................................... 452 default lcp compression .......................................................................................................453 default lcp echo failure ........................................................................................................ 454 default lcp failure limit ........................................................................................................ 455 default lcp timeout ............................................................................................................... 456 default mode client username .............................................................................................. 457 default mtu ........................................................................................................................... 458 default remote address ......................................................................................................... 459 end ........................................................................................................................................ 460 exit .......................................................................................................................................461 ipcp accept address enable ................................................................................................... 462 ipcp compression enable ...................................................................................................... 463 ipcp failure limit ................................................................................................................... 464 ipcp timeout ......................................................................................................................... 465 lcp compression enable ........................................................................................................ 466 lcp echo failure ..................................................................................................................... 467 lcp echo interval ................................................................................................................... 468 lcp failure limit ..................................................................................................................... 469 lcp timeout ........................................................................................................................... 470 local address ......................................................................................................................... 471 mode client ........................................................................................................................... 472 mode client username .......................................................................................................... 473 mode server .......................................................................................................................... 474 mtu .......................................................................................................................................47516 451-0310E no ......................................................................................................................................... 476 remote address ..................................................................................................................... 477 Chapter 11 - Menu Commands ....................................................................... 479 delete .................................................................................................................................... 480 end ........................................................................................................................................ 481 exit .......................................................................................................................................482 import ................................................................................................................................... 483 list ......................................................................................................................................... 484 no ......................................................................................................................................... 485 open ...................................................................................................................................... 486 Chapter 12 - Menu Editing Commands .......................................................... 487 control key ........................................................................................................................... 488 display .................................................................................................................................. 489 end ........................................................................................................................................ 490 entry ..................................................................................................................................... 491 entry command .................................................................................................................... 492 entry label ............................................................................................................................ 493 entry menu ........................................................................................................................... 494 exit .......................................................................................................................................495 header ................................................................................................................................... 496 list ......................................................................................................................................... 497 menu ..................................................................................................................................... 498 menu continue string ............................................................................................................ 499 menu prompt ........................................................................................................................ 500 no control key ...................................................................................................................... 501 no entry ................................................................................................................................ 502 no header .............................................................................................................................. 503 no menu continue string .......................................................................................................504 no menu prompt ................................................................................................................... 505 open ...................................................................................................................................... 506 save ...................................................................................................................................... 507 Chapter 13 - Notification Commands ............................................................ 509 end ........................................................................................................................................ 510 exit .......................................................................................................................................511 message facility .................................................................................................................... 512 message priority ................................................................................................................... 513 message string ...................................................................................................................... 514451-0310E 17 no ......................................................................................................................................... 515 serviceprofile async port ...................................................................................................... 516 serviceprofile bits ................................................................................................................. 517 serviceprofile driver ............................................................................................................. 518 serviceprofile file ................................................................................................................. 519 serviceprofile host ................................................................................................................ 520 serviceprofile modem port ................................................................................................... 521 serviceprofile parity ............................................................................................................. 522 serviceprofile port ................................................................................................................ 523 serviceprofile protocol ......................................................................................................... 524 serviceprofile server ............................................................................................................. 527 serviceprofile smsc .............................................................................................................. 528 serviceprofile stopbits .......................................................................................................... 530 userprofile contact ................................................................................................................ 531 userprofile facility ................................................................................................................ 532 userprofile priority ............................................................................................................... 533 userprofile serviceprofile ..................................................................................................... 534 Chapter 14 - Broadcast Group Commands ................................................... 535 end ........................................................................................................................................ 536 exit .......................................................................................................................................537 master port ........................................................................................................................... 538 mode ..................................................................................................................................... 539 no master port ...................................................................................................................... 540 no slave port ......................................................................................................................... 541 no slave port discard ............................................................................................................542 no slave port localecho ........................................................................................................ 543 slave port .............................................................................................................................. 544 Index ................................................................................................................. 547451-0310E 19 Figures Figure 1 - LX Command Modes ........................................................................23 Figure 2 - Clock Display ...................................................................................41 Figure 3 - Port Characteristics Screen .............................................................43 Figure 4 - Port APD Settings Screen ...............................................................46 Figure 5 - Port Modem Settings .......................................................................47 Figure 6 - Port PPP Settings Screen ................................................................48 Figure 7 - Port Status Screen (non-outlet) .......................................................50 Figure 8 - Port Status Screen (Outlet) .............................................................52 Figure 9 - Service Screen ..................................................................................53 Figure 10 - Session Screen ................................................................................54 Figure 11 - Subscriber Characteristics Screen ................................................56 Figure 12 - Subscriber Status Screen ..............................................................59 Figure 13 - TCP Settings Screen ......................................................................60 Figure 14 - Version Screen ...............................................................................61 Figure 15 - Audit Log Display ..........................................................................83 Figure 16 - Broadcast Group Characteristics Display ....................................84 Figure 17 - Broadcast Group Summary Display .............................................85 Figure 18 - Clock Display .................................................................................86 Figure 19 - Command Log Display ...................................................................87 Figure 20 - Configuration Data Display ..........................................................88 Figure 21 - Configuration Log Display ............................................................89 Figure 22 - Subscriber Debug Data ..................................................................91 Figure 23 - Device Display for An OUTLET Port ............................................92 Figure 24 - Device Display for A SENSOR Port ..............................................93 Figure 25 - Device Summary Display ..............................................................94 Figure 26 - Interface Characteristics Display .................................................95 Figure 27 - Port Mapping Display ....................................................................98 Figure 28 - Rotary Characteristics Display .....................................................99 Figure 29 - Interface Status Display ..............................................................100 Figure 30 - Interfaces Summary Display .......................................................101 Figure 31 - Kernel Log Display ......................................................................102 Figure 32 - Log Display ...................................................................................103 Figure 33 - Message Display ..........................................................................104 Figure 34 - Service Profile Display .................................................................105 Figure 35 - User Profile Display .....................................................................106 Figure 36 - Outlet Group Status Display .......................................................107 Figure 37 - Pattern Match Characteristics Display ......................................111 Figure 38 - PPP Status Display ......................................................................113 Figure 39 - Asynchronous Port Summary Data ............................................115 Figure 40 - Ethernet Port Characteristics .....................................................116 Figure 41 - Ethernet Port Statistical Information ........................................117 Figure 42 - Ethernet Summary Information .................................................119 Figure 43 - RADIUS Display ..........................................................................120 Figure 44 - RADIUS Status Display ..............................................................122 Figure 45 - RADIUS Summary Display .........................................................12420 451-0310E Figure 46 - Route Display ...............................................................................125 Figure 47 - SecurID Characteristics Display .................................................126 Figure 48 - SecurID Status Display ...............................................................128 Figure 49 - SecurID Summary Display ..........................................................129 Figure 50 - Service Screen ..............................................................................130 Figure 51 - SNMP Characteristics Display ...................................................132 Figure 52 - SNMP Client Display ..................................................................133 Figure 53 - V3 Display ....................................................................................134 Figure 54 - Subscriber Summary Display .....................................................138 Figure 55 - System Display ............................................................................139 Figure 56 - ppciboot Configured Load Settings Display ...............................141 Figure 57 - System Status Display .................................................................142 Figure 58 - TACACS+ Display .......................................................................144 Figure 59 - TACACS+ Status Display ............................................................146 Figure 60 - TACACS+ Summary Display ......................................................148 Figure 61 - Users Screen .................................................................................149 Figure 62 - Version Screen .............................................................................150451-0310E 21 Preface This guide describes the purpose, syntax, and options of each of the LX commands. This guide is organized as follows: • Chapter 1 – Describes the User commands. • Chapter 2 – Describes the Superuser commands. • Chapter 3 – Describes the Configuration commands. • Chapter 4 – Describes the Interface commands. • Chapter 5 – Describes the Asynchronous commands. • Chapter 6 – Describes the Ethernet commands. • Chapter 7 – Describes the Subscriber commands. • Chapter 8 – Describes the SNMP commands. • Chapter 9 – Describes the Modem commands. • Chapter 10 – Describes the PPP commands. • Chapter 11 – Describes the Menu commands. • Chapter 12 – Describes the Menu Editing commands. • Chapter 13 – Describes the Notification commands. • Chapter 14 – Describes the Broadcast Group commands.Preface 22 451-0310E Conventions The following conventions are used throughout this guide: • Command execution – Unless otherwise specified, commands are executed when you press . • Command syntax – Where command options or command syntax are shown, keywords and commands are shown in lowercase letters. • Keyboard characters (keys) – Keyboard characters are represented using left and right angle brackets (< and >). For example, the notation refers to the CTRL key; refers to the letter A; and refers to the RETURN key. • Typographical conventions – The following typographical conventions are used: Monospace Typeface – indicates text that can be displayed or typed at a terminal (i.e., displays, user input, messages, prompts, etc.). italics – are used to indicate variables in command syntax descriptions. Using the Function Keys The LX Command Line Interface (CLI) supports the following function keys: • Tab key – Completes a partially typed command. For example, if you type the tab key after you type show ve at the Superuser command prompt, the show version command will be executed. • Up arrow – Recalls the last command. • Ctrl-F – Moves forward to the next session. • Ctrl-B – Moves back to the previous session. • Ctrl-L – Returns you to the Local Command Mode. NOTE: You must press the Enter key after you type Ctrl-F, Ctrl-B, or Ctrl-L.451-0310E 23 Preface Navigating the LX Command Line Interface (CLI) The LX CLI is structured as a set of nested command modes. Each command mode is used to implement a group of related features or functions. Figure 1 (below) lists the command modes in the LX CLI. Figure 1 - LX Command Modes Each command mode has its own command prompt (e.g., Config:0 >>) and its own set of commands. Type a question mark (?) (or press the Tab key) at any of the LX CLI command prompts to display the commands that can be executed in the current command mode. For example, type a question mark at the Menu :0 >> prompt to display the commands that can be executed in the Menu command mode. Configuration Notification Interface Broadcast Group Subscriber SNMP Menu User Superuser Enter “enable” command and login to Superuser command mode Cconfiguration Nnotification Mmenu Ssnmp Ssubscriber Iinterface Ibroadcast group PPP Modem Ethernet Asynchronous Pppp Mmodem Pport ethernet Pport async Oopen Menu EditingPreface 24 451-0310E Except for the User command mode, each command mode is nested in a previous command mode. (The User command mode is the basic command mode of the LX CLI; you are in the User command mode when you log in to the LX unit.) For example, the Superuser command mode is nested in User command mode; the Configuration command mode is nested in the Superuser command mode, and so on. To enter a nested command mode, you must enter the appropriate command from the previous command mode. For example, to enter the Configuration command mode you must enter the configuration command from the Superuser command mode. You can use the exit command to return to the previous command mode. For example, you would enter the exit command in the Configuration command mode to return to the Superuser command mode. The rest of this section describes the LX command modes and the commands that are used to access each of them. User Command Mode When you log on to the LX unit, you are in the User command mode. This is indicated by the User command prompt (e.g., InReach:0 >). The User command mode includes commands for doing the following: • Managing your LX session and terminal. • Pinging remote hosts. • Connecting to remote hosts via SSH and Telnet. • Displaying your subscriber-specific information. • Accessing the Superuser command mode. Refer to “User Commands” on page 33 for detailed information on the commands that you can execute in the User Command Mode.451-0310E 25 Preface Superuser Command Mode The Superuser command prompt (e.g., InReach:0 >>) is displayed when you are in the Superuser command mode. You can access the Superuser command mode by executing the enable command in the User command mode (see “enable” on page 36). In the Superuser command mode, you can perform all of the tasks that you can perform in User command mode, as well as the following: • Manage the LX unit. • Display global information for the LX unit. • Access the Linux shell. • Access the Configuration command mode. Refer to “Superuser Commands” on page 65 for detailed information on the commands that you can execute in the Superuser Command Mode. Configuration Command Mode The Configuration command prompt (e.g., Config:0 >>) is displayed when you are in the Configuration command mode. You can access the Configuration command mode by executing the configuration command in the Superuser command mode (see “configuration” on page 67). In the Configuration command mode, you can perform such tasks as the following: • Specify the server-level configuration of the LX unit. The server-level configuration includes the Superuser password and settings for ppciboot, RADIUS, the Network Time Protocol (NTP), and all other server-level features. • Access the Asynchronous command mode. • Access the Ethernet command mode. • Access the Interface command mode.Preface 26 451-0310E • Access the Menu command mode. • Access the Notification command mode. • Access the SNMP command mode. • Access the Subscriber command mode. Refer to “Configuration Commands” on page 159 for detailed information on the commands that you can execute in the Configuration Command Mode. Asynchronous Command Mode The Asynchronous command prompt (e.g., Async 4-4:0 >>) is displayed when you are in the Asynchronous command mode. You can access the Asynchronous command mode by executing the port async command in the Configuration command mode (see “port async” on page 194). In the Asynchronous command mode, you can do the following: • Configure asynchronous port settings such as access methods, APD settings, autobaud, autodial, flow control, and inbound and outbound authentication. • Access the PPP command mode. • Access the Modem command mode. Refer to “Asynchronous Commands” on page 307 for detailed information on the commands that you can execute in the Asynchronous Command Mode. Ethernet Command Mode The Ethernet command prompt (e.g., Ether 1-1:0 >>) is displayed when you are in the Ethernet command mode. You can access the Ethernet command mode by executing the port ethernet command in the Configuration command mode (see “port ethernet” on page 195). In the Ethernet command mode, you can configure Ethernet port descriptions and the duplex mode and speed of Ethernet ports. Refer to “Ethernet Commands” on page 361 for detailed information on the commands that you can execute in the Ethernet Command Mode.451-0310E 27 Preface PPP Command Mode The PPP command prompt (e.g., PPP 4-4:0 >>) is displayed when you are in the PPP command mode. You can access the PPP command mode by executing the ppp command in the Asynchronous command mode (see “ppp” on page 348). In the PPP command mode, you can configure the Point-to-Point Protocol (PPP) for asynchronous ports. Some of the settings that you can configure include accounting, authentication, IPCP parameters, and LCP parameters. Refer to “PPP Commands” on page 447 for detailed information on the commands that you can execute in the PPP Command Mode. Modem Command Mode The Modem command prompt (e.g., Modem 4-4:0 >>) is displayed when you are in the Modem command mode. You can access the Modem command mode by executing the modem command in the Asynchronous command mode (see “modem” on page 338). In the Modem command mode, you can configure external modems for asynchronous ports. Some of the settings that you can configure include DTRWAIT, dialout, and the modem initialization string. Refer to “Modem Commands” on page 437 for detailed information on the commands that you can execute in the Modem Command Mode. Subscriber Command Mode The Subscriber command prompt (e.g., Subs_mark >>) is displayed when you are in the Subscriber command mode. You can access the Subscriber command mode by executing the subscriber command in the Configuration command mode (see “subscriber” on page 247). In the Subscriber command mode, you can provision subscribers of the LX unit. Some of the subscriber settings include function keys, Telnet settings, and security settings. Refer to “Subscriber Commands” on page 367 for detailed information on the commands that you can execute in the Subscriber Command Mode.Preface 28 451-0310E SNMP Command Mode The SNMP command prompt (e.g., Snmp:0 >>) is displayed when you are in the SNMP command mode. You can access the SNMP command mode by executing the snmp command in the Configuration command mode (see “snmp” on page 242). In the SNMP command mode, you can configure the SNMP settings for an LX unit. Refer to “SNMP Commands” on page 409 for detailed information on the commands that you can execute in the SNMP Command Mode. Interface Command Mode The Interface command prompt (e.g., Intf 1-1:0 >>) is displayed when you are in the Interface command mode. You can access the Interface command mode by executing the interface command in the Configuration command mode (see “interface” on page 180). In the Interface command mode, you can configure interfaces for the LX unit. Some of the settings that you can configure include the IP settings, MTU, and IP Rotaries for the interface, as well as SSH and Telnet settings. Refer to “Interface Commands” on page 275 for detailed information on the commands that you can execute in the Interface Command Mode. Menu Command Mode The Menu command prompt (e.g., Menu :0 >>) is displayed when you are in the Menu command mode. You can access the Menu command mode by executing the menu command in the Configuration command mode (see “menu” on page 184). In the Menu command mode, you can delete, import, and display menus and access the Menu Editing command mode. Refer to “Menu Commands” on page 479 for detailed information on the commands that you can execute in the Menu Command Mode.451-0310E 29 Preface Menu Editing Command Mode The Menu Editing command prompt (e.g., mark-1:0 >>) is displayed when you are in the Menu Editing command mode. You can access the Menu Editing command mode by executing the open command in the Menu command mode (see “open” on page 486). In the Menu Editing command mode, you can create and modify menus. Refer to “Menu Editing Commands” on page 487 for detailed information on the commands that you can execute in the Menu Editing Command Mode. Notification Command Mode The Notification command prompt (e.g., Notification:0 >>) is displayed when you are in the Notification command mode. You can access the Notification command mode by executing the notification command in the Configuration command mode (see “notification” on page 186). In the Notification command mode, you can configure the sending of accounting log messages to pagers, email addresses, SNMP trap clients, local files, remote hosts, syslogd, and asynchronous ports. Refer to “Notification Commands” on page 509 for detailed information on the commands that you can execute in the Notification Command Mode. Broadcast Group Command Mode The Broadcast Group command prompt (e.g., BrGroups 6:0 >>) is displayed when you are in the Broadcast Group command mode. You can access the Broadcast Group command mode by executing the broadcast group command in the Configuration command mode (see “broadcast group” on page 163). In the Broadcast Group command mode, you can configure a Broadcast Group. A Broadcast Group consists of Slave Ports and Master Ports. The Slave Ports receive data broadcasts from the Master Ports, or vice versa. Refer to “Broadcast Group Commands” on page 535 for detailed information on the commands that you can execute in the Broadcast Group Command Mode.Preface 30 451-0310E Online Help The question mark character (?), and the Tab key, are used to display online help in the LX Command Line Interface (CLI). The following guidelines will help you to navigate the online help system: • Type the ? character (or press the Tab key) at the command prompt in any command mode to display the first keyword of each command that can be executed in that command mode. For example, the following is displayed when you type the ? character at the User mode command prompt: User Commands: clear Clear screen and reset terminal line disconnect Disconnect session enable Turn on privileged commands exit Exits and disconnects user no Negate pause Pause enable ping Send echo messages show Show running system information ssh Secured Shell (Triple-DES/Blowfish) telnet Open a telnet connection terminal Set the terminal type • Type the ? character (or press the Tab key) after the displayed keyword to list the options for that keyword. For example, type show? to list the options of the show keyword. You could then type show port? to list the next item in the syntax of the show port command.451-0310E 31 Preface Related Documents For detailed information on the LX commands, refer to the LX-Series Configuration Guide (P/N 451-0311B). For more information on the LX hardware, refer to Getting Started with the LX Series (P/N 451-0308E). The LX Quick Start Instructions (P/N 451-0312F) describes how to get the LX unit up and running.Preface 32 451-0310E451-0310E 33 Chapter 1 User Commands The User commands are executed in the User command mode. The User command mode is in effect immediately upon logging in to the LX unit. The User Command prompt indicates that the LX unit is in the User command mode. The format of the User command prompt is as follows: : > where is the username that was entered at the Login: prompt. is the session number of the current connection. For example, in the InReach:0 > prompt, the username is InReach and the session number is 0. The rest of this chapter describes the commands that you can enter in the User command mode.34 451-0310E Clear the screen and removes any user input from the command buffer. Syntax clear Example clear clear451-0310E 35 Disconnects a session to the LX unit. NOTE: You can not use this command to disconnect the current session. For example, you can not use this command to disconnect session 0 when you are logged in to session 0. Syntax disconnect NUMBER|all Where Means Examples disconnect 3 disconnect all disconnect NUMBER The session number of the session that is to be disconnected. all Disconnect all sessions other than the session from which this command is executed.36 451-0310E Displays a password prompt for logging into Superuser mode. When you are logged into Superuser mode, you can execute the Superuser commands. Refer to “Superuser Commands” on page 65 for more information on the Superuser commands. Syntax enable Usage Guidelines When you execute the enable command, the Password: prompt is displayed: To enter Superuser mode, you must enter a Superuser password at the Password: prompt. The default Superuser password is system. The Superuser prompt is displayed when you are in Superuser mode. The Superuser prompt is in the following format: : >> where is the username that was entered at the Login: prompt. is the session number of the current connection. For example, in the InReach:0 >> prompt, the username is InReach and the session number is 0. Example enable enable451-0310E 37 When the exit command is executed in User Mode, it exits the LX CLI and closes the connection to the LX unit. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in User Mode exits the LX CLI and closes the connection to the LX unit. Issuing the exit command in any mode other than User returns the user to the previous command mode. For example, issuing the exit command in Superuser Mode returns the user to User Mode; issuing the exit command in Configuration Mode returns the user to Superuser Mode, and so on. Example exit exit38 451-0310E Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the User mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the User command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no pause no feature_name The name of the feature or boolean parameter that is to be disabled.451-0310E 39 Configures the screen to pause after displaying the number of lines specified in the “lines/screen” value for the terminal. Syntax pause enable Example pause enable pause enable40 451-0310E Sends a series of 4 echo messages to a destination host. Syntax ping [A.B.C.D|NAME] Where Means Usage Guidelines If a destination host is not specified, the echo message is sent to the default destination host which is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the ping command is executed without a destination host, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples ping 119.20.112.3 ping ping FinanceServer ping A.B.C.D The IP Address of the destination host. (See “Usage Guidelines” (below) for the default value of this field.) NAME The domain name of the destination host. (See “Usage Guidelines” (below) for the default value of this field.)451-0310E 41 Displays the day, date, time, and timezone for the LX unit. Syntax show clock Example show clock Figure 2 shows an example of the clock display. Figure 2 - Clock Display show clock Mon, 24 Mar 2003 14:39:16 UTC42 451-0310E Displays the user-level port information for the LX port where you are connected. NOTE: You cannot execute this command on a virtual port or on the DIAG port (port 0). NOTE: You must be in Superuser Mode to display port information for ports other than the one where you are connected. Refer to Chapter 2 for more information on the Superuser show port commands. Syntax show port characteristics|apd|modem|ppp|status Where Means Examples show port characteristics show port apd show port modem show port ppp show port status show port characteristics Displays general port characteristics. Refer to “Port Characteristics” on page 43 for descriptions of the general port characteristics. apd Displays the port APD settings. Refer to “Port APD Settings” on page 46 for descriptions of the port APD settings. modem Displays the port Modem settings. Refer to “Port Modem Settings” on page 47 for descriptions of the port Modem settings. ppp Displays the port PPP settings. Refer to “Port PPP Settings” on page 48 for descriptions of the port PPP settings. status Displays the port status information. Refer to “Port Status Display” on page 50 for descriptions of the port status information.451-0310E 43 Port Characteristics Figure 3 shows an example of the Port Characteristics screen. Figure 3 - Port Characteristics Screen show port (continued) Time: Mon 24 Mar 2003 19:10:43 Banner: Welcome to MRV Communications, In-Reach Product Division. Port Number: 5 Transparent Mode: Enabled Access: Databuffer Flow Control: Xon Port Name: N/A Stop Bits: 1 Port Type: Physical Parity: None Device Name: /dev/pts/4 Bits per Character: 8 Port Prompt String: login Autobaud: Disabled Break: Enabled Auto Dial: Disabled Special Break String: 1234 Autobaud Retry: 5 Telnet Negotiations: Disabled Autohangup: Disabled Telnet Cr filter: N/A Radius Accounting: Disabled Inbound Authentication: Disabled Tacacs+ Accounting: Disabled Outbound Authentication: Disabled Data Buffer Size: 1024 Authentication FallBack: Disabled Data Buffer Display: Disabled Data Buffer Time Stamp: Enabled Data Buffer Syslog: Enabled Connect Command: export MYPALMDIR=/root/palm Field Description Time The date and time that the show port characteristics command was executed. Banner The version of LX software that is running on the LX unit. Port Number The port at which you are logged in. Access The type of access the port can have to a service node, and/or the type of access other interactive users and service nodes can have to the port. The possible values are: Dynamic, Local, Remote, Databuffer, Power, or Sensor. Port Name An ASCII string that is typically used to identify the port that is displayed in this screen. Port Type The port Type. The possible values are Serial, Ethernet, and Virtual. Device Name The device name of the port. Port Prompt String The prompt that is displayed when a user logs in to this port. If this is a custom prompt, this field will contain the custom prompt. If this is the default login prompt, this field will contain “login”. Break The action the port will take when the user presses the BREAK key. The possible values are Enabled or Disabled. Special Break String The unique break string for the port.44 451-0310E show port (continued) Telnet Negotiations Indicates whether Telnet Negotiations are Enabled or Disabled. Telnet CR Filter Indicates the filtering for carriage returns in Telnet sessions. Inbound Authentication Indicates whether inbound authentication is Enabled or Disabled on the port. Outbound Authentication Indicates whether outbound authentication is Enabled or Disabled on the port. Authentication Fallback Indicates whether users can log in by Fallback if the authentication server (RADIUS or TACACS+) is unreachable. The possible settings of this field are Enabled and Disabled. Data Buffer Time Stamp Indicates whether the Data Buffer Timestamp feature is Enabled or Disabled. Connect Command The command, or commands, that are executed when a connection to the port is made. Transparent Mode Indicates whether Transparent Mode is Enabled or Disabled on the port. Flow Control The flow control ("handshaking") method used by the serial interface to control data transfer between the LX port and the device connected to the port. The possible values are XON, CTS, and NONE (disabled). The default value is XON. Stop Bits The number of stop bits used to maintain synchronization of data. The possible values are 1 or 2. Parity The method by which the LX unit and the device connected to the port check for single-bit errors in characters transmitted or received by the port. (This is called a parity check because the device provides an extra bit, called a parity bit, for error checking.) The possible values are EVEN, NONE, and ODD, and the default value is NONE. Bits per Character The number of bits per character for data characters that are transmitted or received over the serial connection between the LX port and the device connected to the port. The possible values are 7 or 8 bits. The default value is 8. Autobaud Indicates whether Autobaud is enabled or disabled on the port. If Autobaud is enabled, the port will attempt to determine the speed of incoming connections. Auto Dial Indicates whether Auto Dial is Enabled or Disabled for the port. Auto Dial consists of the Dialback and Dialout features. Autobaud Retry The number of times that the LX port will attempt to determine the speed of an incoming connection.451-0310E 45 show port (continued) Autohangup Indicates whether the port will log out when the last session is terminated. The allowable values are Enabled and Disabled. RADIUS Accounting Shows the current status of RADIUS accounting. The valid values are Enabled or Disabled. TACACS+ Accounting Shows the current status of TACACS+ accounting. The valid values are Enabled or Disabled. Data Buffer Size The size, in bytes, of the port data buffer. Data Buffer Display Indicates whether the contents of the databuffer will be displayed when the user logs into the port. The allowable values are Enabled and Disabled. Data Buffer Syslog Indicates whether the Data Buffer syslog feature is Enabled or Disabled.46 451-0310E Port APD Settings Figure 4 shows an example of the Port APD Settings screen. Figure 4 - Port APD Settings Screen show port (continued) Time: Mon 24 Mar 2003 12:50:42 UTC Banner: MRV Communication Linux 2.4.9.8 Rel 0.0.34 Device Name: /dev/pts/0 Port Number: 5 Apd Feature: Enabled Apd Timeout: 0 Apd Signature: 414141 Port Name: Port_1 Apd Retry: 0 Port Type: Physical Field Description Time The date and time that the show port characteristics command was executed. Banner The field identifies the release of Linux and the version of the LX software that is running on the LX unit. Device Name The port name. Apd Feature Shows whether Automatic Protocol Detection (APD) is Enabled or Disabled on this port. Apd Signature The signature of the expected protocol. Apd Retry The number of retries that remote hosts can have after they fail to make an APD connection on the first try. Apd Timeout The length of time, in seconds, that the port can spend in an attempt to determine which protocol is being used to make a connection. Port Type The port Type. The possible values are Serial, Ethernet, and Virtual. Port Number The port at which you are logged in. Port Name The name of the LX port.451-0310E 47 Port Modem Settings Figure 5 shows an example of the Port Modem Settings screen. Figure 5 - Port Modem Settings show port (continued) Time: Mon 24 Mar 2003 12:50:42 UTC Banner: MRV Communication Linux 2.4.9.8 Rel 0.0.34 Device Name: /dev/pts/0 Port Number: 7 Port Type: Virtual Port Name: N/A Modem Control: Disabled Modem Timeout: 40 Modem Retry: 6 Modem Dial Type: N/A Modem Dialout Num.: 19785558371 Modem Init String: AT S7=45 S0=1 L1 V1 X4 &C1 &1 Q0 &S1 Field Description Time The date and time that the show port characteristics command was executed. Banner The field identifies the release of Linux and the version of the LX software that is running on the LX unit. Device Name The port name. Port Type The port Type. The possible values are Serial, Ethernet, and Virtual. Modem Control Shows whether the PPP modem feature is Enabled or Disabled on this port. Modem Retry The number of times the LX unit attempts to connect to the remote modem. Modem Dialout Num. The telephone number that the modem will dial for a dialout connection. Modem Init String A configuration string that is sent to the remote modem. Port Number The Port Number. Port Name A text string that typically identifies the modem port. Modem Timeout The length of time that the remote modem has to respond to the LX unit. Modem Dial Type Indicates whether the Modem Type for the port is Dial In or Dial Out.48 451-0310E Port PPP Settings Figure 6 shows an example of the PPP Settings screen. Figure 6 - Port PPP Settings Screen show port (continued) Time: Mon 24 Mar 2003 19:08:19 UTC Port Device: /dev/pts/2 Port Number: N/A PPP Feature: Disabled PPP Debug: Disabled PPP Mode: Server Passive PPP MTU: 1400 PPP Authent: None PPP Authent. Retry: 3 PPP Port Type: Physical PPP Authent. Timeout: 60 PPP Local IP Address: 0.0.0.0 PPP Remote IP Address: 0.0.0.0 PPP LCP Compress.: Enabled PPP IPCP Compress.(VJ): Enabled PPP LCP Failure Limit: 10 PPP IPCP Failure Limit: 10 PPP LCP Echo Failure Limit: 0 PPP IPCP Timeout: 4 PPP LCP Echo Interval: 0 PPP IPCP Accept Remote: Disabled PPP LCP Timeout: 4 PPP IPCP Accept Local: Disabled PPP CCP: Enabled PPP Accounting: Disabled Port Name: N/A Client Mode Username: N/A Client Mode PAP Secret: N/A Client Mode CHAP Secret: N/A Field Description Port Device The port name. PPP Feature Indicates whether the Point-to-Point Protocol (PPP) is Enabled or Disabled on the port. PPP Mode Indicates the PPP Mode for the port. The possible values are Client, Server Active, or Server Passive. PPP Authent The PPP Authentication method for the port. The allowable values are PAP, CHAP, and None. PPP Port Type The PPP port type. PPP Local IP Address The IP Address assigned to the port. PPP Remote IP Address The IP address of the remote device that the port will attempt to negotiate when the remote device does not specify an Internet address on its own. PPP LCP Compress Indicates whether the use of LCP compression is Enabled or Disabled over the PPP link. PPP LCP Failure Limit The number of attempts at LCP option negotiation that can be made by the port.451-0310E 49 show port (continued) PPP LCP Echo Failure Limit The interval between the sending of LCP echo requests. PPP LCP Timeout The length of time that the port has for LCP option negotiation. PPP CCP Indicates whether the PPP Compression Control Protocol (CCP) is Enabled or Disabled for the port. Port Name The name of the PPP port. Client Mode Username The username for the PAP client. Client Mode PAP Secret The PAP authentication secret for the PPP client. Client Mode CHAP Secret The CHAP authentication secret for the PPP client. Port Number The port at which you are currently logged in. PPP Debug Indicates whether PPP debugging is Enabled or Disabled on the port. PPP MTU The Maximum Transmission Unit (MTU) for PPP links on the port. PPP Authent. Retry The number of times that the port can attempt to authenticate a PPP link. PPP Authent. Timeout The length of time that the port has to authenticate a PPP link. PPP IPCP Compress. Indicates whether the use of Van Jacobson (VJ) compression is Enabled or Disabled over the PPP link. PPP IPCP Failure Limit The number of attempts at IPCP option negotiation that can be made by the port. PPP IPCP Timeout The length of time that the port has for IPCP option negotiation. PPP IPCP Accept Remote Indicates whether the port is configured to accept or reject the negotiation of remote addresses. If the value is Enabled, the port is configured to accept the negotiation of remote addresses. If the value is Disabled, the port is configured to reject the negotiation of remote addresses. PPP IPCP Accept Local Indicates whether the port is configured to accept or reject the negotiation of local addresses. If the value is Enabled, the port is configured to accept the negotiation of local addresses. If the value is Disabled, the port is configured to reject the negotiation of local addresses. PPP Accounting Indicates whether PPP accounting is Enabled or Disabled on the port.50 451-0310E Port Status Display Figure 7 shows an example of the port status screen for non-outlet ports. Figure 7 - Port Status Screen (non-outlet) show port (continued) Time: Mon 24 Mar 2003 13:19:01 UTC Port Device: /dev/ttyGN8 Port Number: 8 Remote Partner Host IP Address: 0.0.0.0 Locally Connected by IP Address: 0.0.0.0 Autobaud: Enabled Speed: 9600 Port Lock Status: In Use Port Name: Port_8 Transmit Bytes: 137260 Receive Bytes: 8728 Frame Errors: 0 Overrun Errors: 0 Parity Errors: 0 Break Signals: 2 Buffer Overruns: 0 IRQ Number: 4 Last Transmit Char: 0x0 Last Receive Char: 0x0 Input Signals: Output Signals: CTS= Up RTS= Up DSR= Up DTR= Up Field Description Port Device The name of the port. Remote Partner Host IP Address If the port is connected to a remote host, the IP Address of the remote host appears in this field. Locally Connected by IP Address If the port is locally connected to a host, the IP Address of the LX unit, or the rotary address for the port, appears in this field. Autobaud Indicates whether Autobaud is enabled or disabled on the port. If Autobaud is enabled, the port will attempt to determine the speed of incoming connections. Port Lock Status Indicates whether or not the port is locked. Transmit Bytes The number of bytes transmitted on the port since the counters were last reset to zero. Frame Errors The number of bytes received at the port with illegally formatted frames, since the counter was reset to zero. Frequent framing errors (more than 20 per day for a terminal; 200 per day for a modem) may indicate a problem with the port or the device attached to the port, or mismatched settings between the port and the data received from the attached serial device.451-0310E 51 show port (continued) Parity Errors The number of bytes received at the port with parity errors, since the counters were reset to zero. Frequent parity errors (more than 20 per day for a terminal; 200 per day for a modem, due to line noise) may indicate a problem with the port or the device attached to the port, or mismatched settings between the port and the device connected to the port. Buffer Overruns The number of times characters were lost because the LX unit input buffers were full, since the counters were reset to zero. Buffer overruns indicate that there may be a flow control problem, such as mismatched flow control methods, between the port and the device connected to the port. Last Transmit Char The last character transmitted on the port. Input Signals The status of the port CTS and DSR signals. Port Number The port number of the asynchronous port. Time The day, date, and time of the LX system clock. Speed The port speed. Port Name The name of the asynchronous port. Receive Bytes The number of bytes received on the port since the counters were last reset to zero. Overrun Errors The number of port overrun errors since the counters were last reset to zero. Break Signals The number of break signals since the counters were last reset to zero. IRQ Number The IRQ Number for the port. Last Receive Char The last character received on the port. Output Signals The status of the port RTS and DTR signals.52 451-0310E Figure 8 shows an example of the port status screen for outlet ports. Figure 8 - Port Status Screen (Outlet) show port (continued) Time: Mon 24 Mar 2003 20:05:47 Device Number: 4 Device Type: IR5150 Model Name: N/A Total Outlet Strip Load: 0.25 Outlet Minimum Off Time: 15 Outlet Name State Load Assigned Groups 1 plug1 On N/A 1 4 13 2 plug2 On N/A 1 6 10 3 plug3 On N/A 1 7 4 plug4 On N/A 1 5 plug5 On N/A 2 4 6 plug6 On N/A 2 7 plug7 On N/A 2 8 plug8 On N/A 2 9 plug9 On N/A 3 4 10 plug10 On N/A 3 11 plug11 On N/A 3 12 plug12 On N/A 3 13 plug13 On N/A 4 5 14 plug14 On N/A 4 5 15 plug15 On N/A 4 5 16 plug16 On N/A 5 Field Description Device Identifies the type of Power Control unit. Model Name The Model Name of the Power Control unit. Total Outlet Strip Load The total load for the Power Control unit. Outlet Minimum Off Time The minimum time that outlets in this Power Control unit must remain off after they are turned off with the outlet or outlet group command. Outlet The Outlet Number of an outlet. Name The descriptive name of an outlet. State The ON or OFF state of the outlet. Load The load on the outlet. Assigned Groups The outlet groups to which the outlet is assigned.451-0310E 53 Displays the names and addresses of the available services. Syntax show service Example show service Figure 9 shows an example of the Service screen. Figure 9 - Service Screen show service Mon, 08 Apr 2002 13:14:40 UTC Service Name IP Address dewey 123.123.1.1 huey 123.123.1.2 Field Description Service The name of an available service or server/host. IP Address The IP Address of the available service54 451-0310E Displays information about your opened connections, including opened sessions to services or hosts on the network, as well as CLI sessions opened on the port. Syntax show session Where Means Example show session 3 Figure 10 shows an example of the Session screen. Figure 10 - Session Screen show session session_number The session number of an opened connection. Number Device Program Pid Time Status 3 /dev/pts/1 cli 8384 2589 * Field Description Number The Session Number. The possible values are 1, 2, 3, or 4. Device The Linux port name. Program The program running on the LX unit. Pid The Process ID for the session. Time The time elapsed since the start of the session. Status Indicates whether the displayed session is the active session. An asterisk (*) means that the displayed session is the active session. An hyphen (-) means that the displayed session is not the active session.451-0310E 55 Displays your subscriber information. Syntax show subscriber characteristics|status|tcp Where Means Examples show subscriber characteristics show subscriber status show subscriber tcp show subscriber characteristics Displays your subscriber characteristics. Refer to “Subscriber Characteristics” on page 56 for descriptions of the subscriber characteristics. status Displays your subscriber status information. Refer to “Subscriber Status” on page 59 for descriptions of the status information for subscribers. tcp Displays your subscriber TCP settings. Refer to “Subscriber TCP Settings” on page 60 for descriptions of your subscriber TCP settings.56 451-0310E Subscriber Characteristics Figure 11 shows an example of the Subscriber Characteristics screen. Figure 11 - Subscriber Characteristics Screen show subscriber (continued) Subscriber Name: demo Security: Superuser User Prompt: Demo Preferred Service: Dedicated Service: Command Logging: Disabled User Password: Disabled Maximum Connections: 50 Maximum Sessions: 4 Shell : Disabled Screen Pause: Enabled Debug Feature: Disabled Debug File: /tmp/D_demo Idle Timeout: 0 Session Timeout: 0 Menu Feature: Disabled Menu Name: /config/M_demo Forward Switch: ^F Local Switch: ^L Backward Switch: ^B Dialback Feature: Disabled Dialback Retry: 4 Dialback Number: Dialback Timeout: 45 Audit Feature: Disabled Port Access list: 1-8 Remote Access list: Telnet Ssh Web_Server Field Description Subscriber Name The name under which the subscriber is logged in. Security The level of security that the subscriber has. The possible values are None and Superuser. Preferred Service The service to which the subscriber will be connected when the subscriber makes a connect request without specifying a service. Command Logging Indicates whether the Command Logging Feature is Enabled or Disabled for the subscriber. Maximum Connections The maximum number of concurrent connections that the subscriber can have to the LX unit. Shell Indicates whether the Shell mode is Enabled or Disabled for this subscriber. Debug Feature Shows whether the Debug feature is enabled for this user. The allowable values are Enabled and Disabled. Idle Timeout The length of time that the subscriber can go without entering keyboard data before she is logged out. Menu Feature Indicates whether a menu will be displayed when the subscriber successfully logs in to the LX unit. The allowable values are Enabled and Disabled. Note: If this feature is Enabled, a Menu Name must be specified for the user. For more information, refer to the Menu Name field (below).451-0310E 57 show subscriber (continued) Forward Switch The keyboard character that the subscriber types to switch to the next session. Backward Switch The keyboard character that the subscriber types to switch to the previous session. Dialback Retry The number of times that the modem on the LX unit can attempt to answer a dialback call. Dialback Timeout The length of time that the modem can spend attempting to make a modem connection. Port Access List The LX ports that the user can access. Remote Access List The methods that the user can use to make remote connections. User Prompt The subscriber-specific field of the subscriber User prompt. For example, for a subscriber prompt of InReach:0 >, the subscriberspecific field is InReach. Dedicated Service The service to which the subscriber is permanently assigned. User Password Indicates whether or not the subscriber must enter a password when he logs in to the account. If the value of this field is Enabled, the subscriber must enter a password when logging in to this account. If the value of this field is Disabled, the subscriber does not enter a password when logging in to this account. Maximum Sessions The maximum number of concurrent sessions allowed for the subscriber. Screen Pause Indicates whether or not the screen is enabled to pause after 26 lines of output are displayed. Debug File Shows the location and filename of the Debug file for this subscriber on the LX unit. Session Timeout Indicates the maximum length of time for a subscriber session. The allowable values are 0 through 65535. A value of 0 means that there is no limit to the length of a subscriber session. Menu Name Shows the location and filename of the subscriber menu on the LX unit. Local Switch The keyboard character that the subscriber types to return to the local command mode. Audit Feature Indicates whether the Audit feature is Enabled or Disabled.58 451-0310E show subscriber (continued) Dialback Feature Indicates whether or not the subscriber requires a dialback script in order to be logged in. (The dialback script contains commands that cause a modem to dial a designated telephone number.) The allowable values are Enabled and Disabled. Dialback Number The telephone number that the LX modem will dial when the subscriber makes a Dialback call to the LX unit.451-0310E 59 Subscriber Status Figure 12 shows an example of the Subscriber Status screen. Figure 12 - Subscriber Status Screen show subscriber (continued) Time: Mon, 08 Apr 2002 14:39:16 UTC Subs. Name: InReach Number of Connections: 1 Configured TermType: ANSI Session Mode: Normal Field Description Subs. Name The name under which the subscriber is logged in. Configured TermType The terminal type that is configured for the subscriber. Session Mode The Telnet binary option for the subscriber session. Number of Connections The number of connections that the subscriber currently has to the LX unit.60 451-0310E Subscriber TCP Settings Figure 13 shows an example of the TCP Settings screen. Figure 13 - TCP Settings Screen show subscriber (continued) Time: Mon, 08 Apr 2002 14:39:16 UTC Subscriber Name: InReach Telnet Line Mode: Character Mode SSH Name: InReach SSH Encryption: Triple-DES SSH Port: 22 SSH Log Level: 23 Field Description Subscriber Name The name under which the subscriber is logged in. Telnet Line Mode Indicates the Telnet Line Mode. The possible values are Character and Block. SSH Name The SSH Name for the subscriber. SSH Port The ports that are enabled as SSH ports for this subscriber. SSH Encryption The form of SSH encryption used by the subscriber. SSH Log Level The Revision Level of the SSH Log for this subscriber.451-0310E 61 Displays the Linux OS version, Linux In-Reach version, LX software version, and ppciboot version for the LX unit. Syntax show version Example show version Figure 14 shows an example of the Version screen. Figure 14 - Version Screen show version Linux Kernel Version: 2.4.9 Linux In-Reach Version: 15 Software Version: 2.2.0 Ppciboot Version: 0.9.3.26 Field Description Linux Kernel Ve rsi on The version of the Linux Operating System that is running on the LX unit. Linux In-Reach Ve rsi on The version of the In-Reach implementation of Linux. Software Version The version of the LX software that is running on the LX unit. Ppciboot Version The version of ppciboot that the LX unit is using.62 451-0310E Opens a Secure Shell (Triple-DES/BLOWFISH) connection. Syntax ssh [A.B.C.D [NUMBER]]|[NAME [NUMBER]] [LOGIN NAME] Where Means Usage Guidelines The default SSH server is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the ssh command is executed without an SSH server, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples ssh 102.19.240.14 ssh 102.19.240.14 2322 ssh ssh 102.19.240.14 2322 henryh ssh A.B.C.D The IP Address of the SSH server to which the connection is being made. (See “Usage Guidelines” (below) for the default value of this field.) NAME The Domain Name of the SSH server to which the connection is being made. (See “Usage Guidelines” (below) for the default value of this field.) NUMBER The socket number to which the connection is being made. LOGIN NAME The name that you are using to log in to the SSH server.451-0310E 63 Opens a Telnet connection to a host. Syntax telnet [A.B.C.D [NUMBER]]|[NAME [NUMBER]] Where Means Usage Guidelines The default Telnet host is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the telnet command is executed without a Telnet host, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples telnet 102.19.240.14 telnet 102.19.240.14 2500 telnet telnet A.B.C.D The IP Address of the Telnet host. (See “Usage Guidelines” (below) for the default value of this field.) NAME The Domain Name of the Telnet host. (See “Usage Guidelines” (below) for the default value of this field.) NUMBER The socket number to which the connection is being made. 64 451-0310E Sets the terminal type for the LX user. Syntax terminal Where Means Example terminal vt100 terminal ansi terminal terminal_type The terminal type for the LX user. The allowable terminal types are VT100 and ANSI. 451-0310E 65 Chapter 2 Superuser Commands The Superuser commands are executed in the Superuser command mode. When the LX unit is in the Superuser command mode, the Superuser command prompt (e.g., InReach:0 >>) is displayed on the terminal screen. The format of the Superuser command prompt is as follows: : >> where is the username that was entered at the Login: prompt. is the session number of the current connection. For example, in the InReach:0 >> prompt, the username is InReach and the session number is 0. To enter the Superuser command mode, do one of the following: • If you are in the User command mode, execute the enable command. This displays the Password: prompt. Enter a Superuser password at the Password: prompt. Refer to page 36 for more information on the enable command. • If you are in a command mode other than User, execute the end command or the exit command until the Superuser command prompt is displayed.66 451-0310E Clear the screen and removes any user input from the command buffer. Syntax clear Example clear clear451-0310E 67 Enters the Configuration command mode. When this command is executed, the configuration prompt (e.g., Config >>) is displayed. Only the Configuration commands can be executed from the configuration prompt. For more information on the Configuration commands, refer to “Configuration Commands” on page 159. Syntax configuration Example configuration configuration68 451-0310E Generates debug information for PPP sessions on an asynchronous port. The debug information can be displayed by executing the show debug port async ppp command (see page 90). Syntax debug port async NUMBER ppp Where Means Example debug port async 5 ppp debug port async ppp NUMBER An asynchronous port number.451-0310E 69 Generates debug information for SNMP. Syntax debug snmp Example debug snmp debug snmp70 451-0310E Generates debug information for a subscriber. The debug information can be displayed by executing the show debug subscriber command (see page 91). Syntax debug subscriber Where Means Example debug subscriber bill debug subscriber subscriber_name The subscriber for which debug information is to be generated.451-0310E 71 Disconnects a session to the LX unit. NOTE: You can not use this command to disconnect the current session. For example, you can not use this command to disconnect session 0 when you are logged in to session 0. Syntax disconnect NUMBER|all Where Means Examples disconnect 3 disconnect all disconnect NUMBER The session number of the session that is to be disconnected. all Disconnect all sessions other than the session from which this command is executed.72 451-0310E Returns you to the previous command mode. For example, if the current command mode is Superuser, issuing this command will return you to the User command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. As noted above, issuing the exit command in the Superuser command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than the User command mode. For example, issuing the exit command in the Configuration command mode returns the user to the Superuser command mode; issuing the exit command in the Subscriber command mode returns the user to the Configuration command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 73 Logs out a device, an LX port, or an LX subscriber. Syntax logout |port | Where Means Syntax logout /dev/ttyGN3 logout port 3 logout mark logout device_name The name of the device that is to be logged out. For example, the command logout /dev/ttyGN3 logs out the Linux device /dev/ttyGN3 (port 4). port_number The LX port that is to be logged out. For example, the command logout port 3 logs out port 3. subscriber_name The name of the subscriber to be logged out. For example, the command logout mark logs out the subscriber mark.74 451-0310E Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Superuser command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Superuser command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no pause no feature_name The name of the feature or boolean parameter that is to be disabled.451-0310E 75 Reboots a Power Control Relay or turns a Power Control Relay on or off. Syntax outlet : on|off|reboot Where Means Examples outlet 3:5 on outlet 5:2 off outlet 6:1 reboot outlet power_master Specifies the Power Master from which the Power Control Relay is managed. Note: Refer to “access power model” on page 309 for information on configuring a port as a Power Master. control_relay Specifies a Power Control Relay on the IR-5100 or IR-5150 that is managed from the Power Master. The Power Master number, combined with the Power Control Relay number, uniquely identifies each Power Control Relay. For example, 2:5 identifies Power Control Relay 5 on the device that is managed from port 2. on Turn the Power Control Relay on. off Turn the Power Control Relay off. reboot Reboot the Power Control Relay.76 451-0310E Reboots, or turns on or off, all of the outlets in an outlet group. Syntax outlet group | on|off|reboot Where Means Examples outlet group 5 reboot outlet group Laboutlets off outlet group 6 on outlet group group_number An integer number that specifies an existing outlet group. group_name The descriptive name of an existing outlet group. on Turn the outlets in the group on. off Turn the outlets in the group off. reboot Reboot the outlets in the group.451-0310E 77 Configures the screen to pause after displaying the number of lines specified in the “lines/screen” value for the terminal. Syntax pause enable Example pause enable pause enable78 451-0310E Sends a series of 4 echo messages to a destination host. Syntax ping [A.B.C.D|NAME] Where Means Usage Guidelines If a destination host is not specified, the echo message is sent to the default destination host which is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the ping command is executed without a destination host, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples ping 119.20.112.3 ping ping FinanceServer ping A.B.C.D The IP Address of the destination host. (See “Usage Guidelines” (below) for the default value of this field.) NAME The domain name of the destination host. (See “Usage Guidelines” (below) for the default value of this field.)451-0310E 79 Re-starts the LX unit. Syntax reload Usage Guidelines If the LX parameter set has been saved since the last time the LX unit was re-started, or since the last configuration change was made, the LX unit will be re-started immediately. If the LX parameters have not been saved, you will be prompted to save them before the LX is re-started. Configuration is not saved!!! Proceed anyway? (y/n) : Enter y to re-start the LX unit without saving the changes. Enter n to abort the command. Refer to “save configuration” on page 80 for more information on saving the LX parameters. Example reload reload80 451-0310E Saves the configuration of the LX unit to the local flash or to a network parameter server. Syntax save configuration flash|[network |] Where Means Examples save configuration flash save config network unit1 119.25.42.37 save configuration flash Save the LX-unit configuration to the local flash. network Save the LX-unit configuration to a network parameter server. filename Identifies the network file to which the LX-unit configuration is to be saved. The filename must not include a .zip suffix. For example, unit1 is a valid filename, but unit1.zip is not a valid filename. domain_name Specifies the domain name of the TFTP server to which the LX-unit configuration is to be saved. ip_address Specifies the IP Address of the TFTP server to which the LX-unit configuration is to be saved.451-0310E 81 Runs the setup utility (Quick Start Configurator). For more information on the Quick Start Configurator, refer to the LX Quick Start Instructions. Syntax setup Example setup setup82 451-0310E Enters the Built-in Linux shell on the LX unit. Syntax shell Usage Guidelines When this command is executed, the following is displayed on the Linux monitor: BusyBox v0.60.1 (2002.04.16-12:27+0000) Built-in shell (ash) Enter ‘help’ for a list of built-in commands InReach:/# You can enter any command in the Built-in Linux shell from the command prompt (InReach:/# in the above example). Enter help at the command prompt for a list of the built-in commands. The format of the command prompt is :/#, where is the username of the subscriber. Enter exit at the command prompt to return to Superuser Mode. Example shell shell451-0310E 83 Displays the audit log for a port or a subscriber. Syntax show audit log []|[] Where Means Usage Guidelines If you execute show audit log for a subscriber, the display will only contain audit log data for the subscriber in question. If you execute show audit log for a port, the display will contain audit log data for all of the subscribers that are logged in at the port. Example show audit show audit log 5 show audit log mark Figure 15 shows an example of the audit log display. Figure 15 - Audit Log Display show audit log port_number Specifies an asynchronous port number on the LX unit. subscriber_name Specifies an LX subscriber name. Nov 18 16:08:32 yves ttyGN0 0 Subs_yves >>end Nov 18 16:08:50 yves ttyGN0 1 Yves:0 >> Nov 18 16:08:50 yves ttyGN0 2 Yves:1 > Nov 18 16:08:50 yves ttyGN0 3 Yves:2 > Nov 18 16:08:55 yves ttyGN0 3 Yves:3 >sho session Nov 18 16:08:55 yves ttyGN0 3 Number Device Program Pid Time Status Nov 18 16:08:55 yves ttyGN0 3 0 /dev/pts/0 Superuser 477 98 - Nov 18 16:08:55 yves ttyGN0 3 1 /dev/pts/3 User 481 5 - Nov 18 16:08:55 yves ttyGN0 3 2 /dev/pts/4 User 482 5 - Nov 18 16:08:55 yves ttyGN0 3 3 /dev/pts/5 User 483 5 *84 451-0310E Displays the characteristics of Broadcast Groups. Syntax show broadcast group all| characteristics Where Means Example show broadcast group 1 characteristics show broadcast group all characteristics Figure 16 shows an example of the Broadcast Group Characteristics Display. Figure 16 - Broadcast Group Characteristics Display show broadcast group characteristics all Display information for all Broadcast Groups. group_number The group number of a Broadcast Group. Time: 08 Nov 2002 16:29:26 US/EASTERN Broadcast Group Number: 1 Mode: Line Mode State: Disabled Async Master port(s) with Timestamp: Async Master port(s) without Timestamp: 1,4 TCP Master port(s) with Timestamp: TCP Master port(s) without Timestamp: Async Slave port(s) with Discard: Async Slave port(s) without Discard: 2-3,5-7 Async Slave port(s) with Local Echo: Async Slave port(s) without Local Echo: 2-3,5-7 TCP Slave port(s) with Discard: TCP Slave port(s) without Discard: TCP Slave port(s) with Local Echo: TCP Slave port(s) without Local Echo:451-0310E 85 Displays summary information on all of the Broadcast Groups that are configured on the LX unit. Syntax show broadcast group summary Example show broadcast group summary Figure 17 shows an example of the Broadcast Group summary display. Figure 17 - Broadcast Group Summary Display show broadcast group summary Broadcast group number: State: 1 Enabled 2 Disabled 3 Disabled 4 Disabled 5 Disabled86 451-0310E Displays the day, date, time, and timezone for the LX unit. Syntax show clock Example show clock Figure 18 shows an example of the clock display. Figure 18 - Clock Display show clock Mon, 08 Apr 2002 14:39:16 UTC451-0310E 87 Displays the command log for a port or for a subscriber. Syntax show command log []|[] Examples show command log show command log 4 show command log mark Figure 19 shows an example of the command log display. Figure 19 - Command Log Display show command log Nov 11 12:47:30 demo 0 end Nov 11 12:47:33 demo 0 sho command log Nov 11 12:49:21 demo 23 modem Nov 11 12:49:29 demo 23 end Nov 11 12:49:39 demo 23 show command log demo88 451-0310E Displays the contents of the LX System configuration table or the configuration data from the Non-Volatile memory of the LX unit. Syntax show configuration Example show configuration Figure 20 shows an example of the Configuration Data display. Figure 20 - Configuration Data Display show configuration Signature is :a1326c7cf50dd779086e0a90843fdke94398kj9 In-Reach Configuration version 0.0.34, Linux kernel version 2.4.10 System.SystemName.0 TYPE STRING VALUE "InReach LX-1" System.SystemLocation.0 TYPE STRING VALUE "Middle of NoWhere" System.TimeZone.0 TYPE STRING VALUE "UTC" System.UseNtp.0 TYPE BOOL VALUE "Disabled" System.UseLpd.0 TYPE BOOL VALUE "Disabled" System.SnmpLocation.0 TYPE STRING VALUE "" System.SnmpPort.0 TYPE SHORT VALUE "161" System.SnmpLog.0 TYPE BOOL VALUE "Disabled" System.SnmpTransport.0 TYPE OCTET VALUE "0" System.SysLogAddr.0 TYPE IPADDR VALUE "0.0.0.0" System.UseSsh.0 TYPE BOOL VALUE "Disabled" System.UseRad.0 TYPE BOOL VALUE "Disabled" System.UseRadAcct.0 TYPE BOOL VALUE "Disabled" System.RadPort.0 TYPE SHORT VALUE "1812" System.RadAcctPort.0 TYPE SHORT VALUE "1813" System.RadPrimAuth.0 TYPE IPADDR VALUE "1.1.1.1" System.RadPrimSecret.0 TYPE STRING VALUE "" System.RadSecAuth.0 TYPE IPADDR VALUE "1.1.1.2" System.RadSecSecret.0 TYPE STRING VALUE "" System.RadPrimAcct.0 TYPE IPADDR VALUE "1.1.1.1" Type a key to continue, q to quit451-0310E 89 Displays the commands that have been executed in the Configuration Command Mode and in any of the Command Modes nested in the Configuration Command Mode. (The Command Modes nested in the Configuration Command Mode include Broadcast Group, Interface, Menu, Menu Editing, Subscriber, Asynchronous, PPP, Modem, Ethernet, SNMP, and Notification.) Syntax show configuration log Example show configuration log Figure 21 shows an example of the configuration log display. Figure 21 - Configuration Log Display show configuration log Nov 20 20:59:03 InReach /ttyGN0 0 save config to flash Nov 20 20:59:12 InReach /ttyGN0 0 boot config file from flash Nov 20 20:59:46 InReach /ttyGN0 0 subscriber 4 no password Nov 20 21:00:17 InReach /ttyGN0 0 subscriber 4 access telnet enable Nov 20 21:00:24 InReach /ttyGN0 0 subscriber 4 access ssh enable Nov 20 21:00:29 InReach /ttyGN0 0 subscriber 4 access guiserver enable Nov 20 21:00:34 InReach /ttyGN0 0 subscriber 4 access console enable Nov 20 21:00:47 InReach /ttyGN0 0 subscriber 4 security level super Nov 20 21:01:01 InReach /ttyGN0 0 save config to flash90 451-0310E Displays the debug data for PPP sessions on an asynchronous port of the LX unit. Syntax show debug port async NUMBER ppp Where Means Example show debug port async 5 ppp show debug port async ppp NUMBER The number of the port for which debug data is to be displayed.451-0310E 91 Displays the subscriber debug data for the LX unit. Syntax show debug subscriber NAME Where Means Example show debug subscribers bill Figure 22 shows an example of the Subscriber Debug data display. Figure 22 - Subscriber Debug Data show debug subscriber NAME The name of the subscriber for which debug data is to be displayed. Bill_M:0 >>show debug subscriber billStamp : 1020858407 To Line 1b 5b 3f 32 35 6c .[?25l Stamp : 1020858407 To Line 1b 5b 39 30 30 3b 39 30 30 48 .[900;900H Stamp : 1020858407 To Line 1b 5b 36 6e .[6n Stamp : 1020858407 From Line 1b 5b 32 34 3b 38 30 52 6e e6 .[24;80Rn. Stamp : 1020858407 From Line 75 81 1b 5b 32 34 3b 38 30 52 u..[24;80R Stamp : 1020858407 To Line 1b 5b 3f 32 35 68 .[?25h Stamp : 1020858407 To Line 1b 5b 48 1b 5b 4a .[H.[J Stamp : 1020858407 To Line 1b 5b 30 3b 30 48 .[0;0H Stamp : 1020858407 To Line 42 69 6c 6c 5f 4d 3a 30 20 3e Bill_M:0.> Stamp : 1020858407 To Line 1b 5b 36 6e .[6n92 451-0310E Displays information on devices connected to asynchronous ports configured as OUTLET or SENSOR on the LX unit. Syntax show device all| status Where Means Example show device 5 status Figure 23 shows an example of the Device Display for an OUTLET port. Figure 23 - Device Display for An OUTLET Port show device status all Display information for all asynchronous ports configured as OUTLET or SENSOR. port_number The port number of an asynchronous port that is configured as OUTLET or SENSOR. Time: Tue, 17 Sep 2002 20:05:47 Device Number: 4 Device Type: IR5100 Model Name: IR-5100-126 Total Outlet Strip Load: 0.0 Outlet Minimum Off Time: 15 Outlet Name State Load Assigned Groups 1 plug1 Off 0.0 1 4 13 2 plug2 Off 0.0 1 6 10 3 plug3 Off 0.0 1 7 4 plug4 Off 0.0 1 5 plug5 Off 0.0 2 4 6 plug6 Off 0.0 2 7 plug7 Off 0.0 2 8 plug8 Off 0.0 2 9 plug9 Off 0.0 3 4 10 plug10 Off 0.0 3 11 plug11 Off 0.0 3 12 plug12 Off 0.0 3 13 plug13 Off 0.0 4 5 14 plug14 Off 0.0 4 5 15 plug15 Off 0.0 4 5 16 plug16 Off 0.0 5451-0310E 93 Figure 24 shows an example of the Device Display for a SENSOR port. Figure 24 - Device Display for A SENSOR Port show device status (continued) Time: 29 Aug 2002 17:35:17 US/EASTERN Device Number: 4 Device Type: Sensor Humidity Level(%): 39.00 Temperature (Celsius): 26.00 Temperature (Fahrenheit): 78.8094 451-0310E Displays summary information on the sensors, and power management devices, that are attached to asynchronous ports of the LX unit. Syntax show device summary Example show device summary Figure 25 shows an example of the Device summary display. Figure 25 - Device Summary Display show device summary Device Number Device Type Model Name 4 IR5100 IR-5100-126 5 IR5100 IR-5100-255451-0310E 95 Displays the characteristics of an IP interface. Syntax show interface NUMBER|all characteristics Where Means Examples show interface 1 characteristics show interface all characteristics Figure 26 shows an example of the Interface Characteristics display. Figure 26 - Interface Characteristics Display show interface characteristics NUMBER Specifies the IP interface for which information is to be displayed. all Display information for all the IP interfaces on the LX unit. Time: Mon, 24 Feb 2003 16:14:27 Interface Name: Interface_1 Bound to : eth0 IP MTU Size: 1500 IP Address : 0.0.0.0 Learned IP Address : 102.19.169.191 IP Mask : 0.0.0.0 Learned IP Mask : 255.255.255.0 IP Broadcast : 0.0.0.0 Learned IP Broadcast: 102.19.169.255 Interface Status: In Use Learned IP Gateway : 102.19.169.1 Rotary Feature: Disabled Learned IP DNS : 0.0.0.0 Authentication: Local Radius Accounting: Disabled Authentication FallBack: Disabled Tacacs+ Accounting: Disabled SSH port: 22 Telnet port: 23 SSH Keepalive Interval: 0 SSH Keepalive Count: 3 Field Description Time The date and time that the show interface characteristics command was executed. Interface Name The name of the IP interface for which data is being displayed. IP MTU Size The Maximum Transmission Unit (MTU) size for an IP interface. The MTU size is the largest-size frame that can be transmitted on the IP interface. IP Address The IP Address of the IP interface. IP Mask The subnet mask of the IP interface. IP Broadcast The IP Broadcast Address of the IP interface.96 451-0310E show interface characteristics (continued) Interface Status The status of the IP interface. The possible values are In Use and N/A. Rotary Feature Indicates whether IP Rotary is Enabled or Disabled on this IP interface. If it is Enabled, you will be able to configure the rotary settings on this IP interface. If it is Disabled, you will not be able to configure the rotary settings on this IP interface. Authentication Indicates the type of authentication that is in effect for the IP interface. Authentication Fallback Indicates whether the Fallback Login Feature is Enabled or Disabled for the IP interface. SSH port The SSH port for the IP interface. SSH Keepalive Interval The length of time, in seconds, between attempts at making an SSH connection to the IP interface. Bound to The Ethernet port to which the interface is bound. Learned IP Address The IP Address learned from ppciboot. Learned IP Mask The subnet mask learned from ppciboot. Learned IP Broadcast The IP Broadcast Address learned from ppciboot. Learned IP Gateway The IP Gateway learned from ppciboot. Learned IP DNS The Domain Name Server (DNS) learned from ppciboot. RADIUS Accounting Indicates whether RADIUS Accounting is enabled or disabled for the IP interface. Tacacs+ Accounting Indicates whether Tacacs+ Accounting is enabled or disabled for the IP interface. Telnet port The Telnet port for the IP interface. SSH Keepalive Count The number of times that an SSH client will attempt to make an SSH connection to the IP interface.451-0310E 97 Displays the Telnet port number, and the SSH port number, associated with each serial port on an IP interface. Syntax show interface NUMBER|all port mapping Where Means Example show interface all port mapping show interface port mapping NUMBER Specifies the IP interface for which information is to be displayed. all Display information for all the IP interfaces on the LX unit.98 451-0310E Figure 27 on page 98 shows an example of the port mapping display. Figure 27 - Port Mapping Display show interface port mapping (continued) Serial Port Telnet Port SSH Port 0 0 0 1 2100 2122 2 2200 2222 3 2300 2322 4 2400 2422 5 2500 2522 6 2600 2622 7 2700 2722 8 2800 2822 9 2900 2922 10 3000 3022 11 3100 3122 12 3200 3222 13 3300 3322 14 3400 3422 15 3500 3522 16 3600 3622 17 3700 3722 18 3800 3822 19 3900 3922 20 4000 4022 21 4100 4122 22 4200 4222 23 4300 4322 24 4400 4422 25 4500 4522 26 4600 4622 27 4700 4722 28 4800 4822 29 4900 4922 30 5000 5022 31 5100 5122 32 5200 5222 33 5300 5322451-0310E 99 Displays the characteristics of a rotary. Syntax show interface NUMBER|all rotary Where Means Examples show interface 3 rotary show interface all rotary Figure 28 shows an example of the Rotary Characteristics display. Figure 28 - Rotary Characteristics Display show interface rotary NUMBER Specifies the rotary for which information is to be displayed. The allowable rotary numbers are 1 through 5. all Display information for all the rotaries on the LX unit. Rotary IP Address TCP SSH Rotary Type Rotary State Serial Ports 147.132.145.16 1500 1522 First Available Disabled Field Description Rotary IP Address The IP Address of the rotary. (This is also the IP Address of the interface.) TCP The TCP socket number assigned to the rotary. SSH The SSH socket number assigned to the rotary. Rotary Type The rotary type (First Available or Round Robin). Rotary State Indicates whether the rotary is Enabled or Disabled. Serial Ports The serial ports included in the rotary.100 451-0310E Displays status information for an IP interface. Syntax show interface NUMBER|all status Where Means Examples show interface 1 status show interface all status Figure 29 shows an example of the Interface status display. Figure 29 - Interface Status Display show interface status NUMBER Specifies the IP interface for which information is to be displayed. The allowable IP interface numbers are 1 through 5. all Display information for all the IP interfaces on the LX unit. Time: Mon 24 Apr 2003 16:19:34 Interface Name: Interface_1 Bound to : eth0 IP Address: 102.19.169.191 IP Mask: 255.255.255.0 IP Broadcast Addr: 102.19.169.255 Field Description Time The date and time that the show interface status command was executed. Interface Name The name of the IP interface. IP Address The IP Address of the IP interface. IP Broadcast Addr The IP Broadcast Address of the IP interface. Bound to The Ethernet port to which the IP interface is bound. IP Mask The Subnet Mask of the IP interface.451-0310E 101 Displays summary information on all of the IP interfaces that are configured on the LX unit. Syntax show interface summary Example show interface summary Figure 30 shows an example of the Interfaces summary display. NOTE: Interface addresses that are learned are not displayed on the following screen. Figure 30 - Interfaces Summary Display show interface summary Name Address Broadcast Addr. Mask Bound to Interface_1 0.0.0.0 0.0.0.0 0.0.0.0 eth0 Interface_2 0.0.0.0 0.0.0.0 0.0.0.0 eth0:1 Interface_3 0.0.0.0 0.0.0.0 0.0.0.0 eth0:2 Interface_4 0.0.0.0 0.0.0.0 0.0.0.0 eth0:3 Interface_5 0.0.0.0 0.0.0.0 0.0.0.0 eth0:4 Field Description Name The name of the IP interface. Address The IP Address configured for the IP interface. Broadcast The Broadcast Address configured for the IP interface. Addr. Mask The subnet mask configured for the IP interface. Bound to The Ethernet port to which the IP interface is bound.102 451-0310E Displays a log of Linux kernel activity for the LX unit. Syntax show kernel log Example show kernel log Figure 31 shows an example of the Kernel Log display. Figure 31 - Kernel Log Display show kernel log Jan 3 15:42:50 In-Reach kernel: klogd 1.4.1, log source = /proc/kmsg started. Jan 3 15:42:50 In-Reach kernel: Cannot find map file. Jan 3 15:42:50 In-Reach kernel: No module symbols loaded - kernel modules not enabled. Jan 3 15:42:50 In-Reach kernel: Linux version 2.4.19 (build@GenBuild) (gcc version 2.95.3 20010315 (release)) #1 Wed Feb 26 08:16:45 EST 2003 Jan 3 15:42:50 In-Reach kernel: On node 0 totalpages: 16384 Jan 3 15:42:50 In-Reach kernel: zone(0): 16384 pages. Jan 3 15:42:50 In-Reach kernel: zone(1): 0 pages. Jan 3 15:42:50 In-Reach kernel: zone(2): 0 pages. Jan 3 15:42:50 In-Reach kernel: Kernel command line: root=/dev/ram CONSOLE=/dev /console Jan 3 15:42:50 In-Reach kernel: Decrementer Frequency = 247500000/60 Jan 3 15:42:50 In-Reach kernel: Calibrating delay loop... 65.53 BogoMIPS Jan 3 15:42:50 In-Reach kernel: Memory: 57500k available (1440k kernel code, 49 2k data, 56k init, 0k highmem) Jan 3 15:42:50 In-Reach kernel: Dentry cache hash table entries: 8192 (order: 4 , 65536 bytes) Jan 3 15:42:50 In-Reach kernel: Inode cache hash table entries: 4096 (order: 3, 32768 bytes) Jan 3 15:42:50 In-Reach kernel: Mount-cache hash table entries: 1024 (order: 1, 8192 bytes) Jan 3 15:42:50 In-Reach kernel: Buffer-cache hash table entries: 4096 (order: 2 , 16384 bytes) Jan 3 15:42:50 In-Reach kernel: Page-cache hash table entries: 16384 (order: 4, 65536 bytes) Jan 3 15:42:50 In-Reach kernel: POSIX conformance testing by UNIFIX Jan 3 15:42:50 In-Reach kernel: Linux NET4.0 for Linux 2.4 Jan 3 15:42:50 In-Reach kernel: Based upon Swansea University Computer Society NET3.039 Jan 3 15:42:50 In-Reach kernel: Initializing RT netlink socket Jan 3 15:42:50 In-Reach kernel: Starting kswapd Jan 3 15:42:50 In-Reach kernel: i2c-core.o: i2c core module version 2.6.1 (2001 0830) Type a key to continue, q to quit451-0310E 103 Displays the contents of syslogd for the LX unit. Syntax show log Example show log Figure 32 shows an example of the Log display. Figure 32 - Log Display show log Dec 31 21:10:20 In-Reach syslogd 1.4.1: restart. Dec 31 21:10:20 In-Reach kernel: klogd 1.4.1, log source = /proc/kmsg started. Dec 31 21:10:21 In-Reach kernel: Cannot find map file. Dec 31 21:10:21 In-Reach kernel: No module symbols loaded - kernel modules not enabled. Dec 31 21:10:21 In-Reach kernel: Linux version 2.4.19 (build@GenBuild) (gcc vers ion 2.95.3 20010315 (release)) #1 Mon Feb 3 07:52:36 EST 2003 Dec 31 21:10:21 In-Reach kernel: On node 0 totalpages: 16384 Dec 31 21:10:21 In-Reach kernel: zone(0): 16384 pages. Dec 31 21:10:21 In-Reach kernel: zone(1): 0 pages. Dec 31 21:10:21 In-Reach kernel: zone(2): 0 pages. Dec 31 21:10:21 In-Reach kernel: Kernel command line: root=/dev/ram CONSOLE=/dev /console Dec 31 21:10:21 In-Reach kernel: Decrementer Frequency = 247500000/60 Dec 31 21:10:21 In-Reach kernel: Calibrating delay loop... 65.53 BogoMIPS Dec 31 21:10:21 In-Reach kernel: Memory: 58432k available (1292k kernel code, 43 2k data, 52k init, 0k highmem) Dec 31 21:10:21 In-Reach kernel: Dentry cache hash table entries: 8192 (order: 4 , 65536 bytes) Dec 31 21:10:21 In-Reach kernel: Inode cache hash table entries: 4096 (order: 3, 32768 bytes) Dec 31 21:10:21 In-Reach kernel: Mount-cache hash table entries: 1024 (order: 1, 8192 bytes) Dec 31 21:10:21 In-Reach kernel: Buffer-cache hash table entries: 4096 (order: 2 , 16384 bytes) Dec 31 21:10:21 In-Reach kernel: Page-cache hash table entries: 16384 (order: 4, 65536 bytes) Dec 31 21:10:21 In-Reach kernel: POSIX conformance testing by UNIFIX Dec 31 21:10:21 In-Reach kernel: Linux NET4.0 for Linux 2.4 Dec 31 21:10:21 In-Reach kernel: Based upon Swansea University Computer Society NET3.039 Dec 31 21:10:21 In-Reach kernel: Initializing RT netlink socket Dec 31 21:10:21 In-Reach kernel: Starting kswapd Type a key to continue, q to quit 104 451-0310E Displays the ID number, string portion (message), facility, and priority of configurable syslogd messages. Syntax show notification message NUMBER|all Where Means Example show notification message 4 Figure 33 shows an example of the Message display. Figure 33 - Message Display show notification message NUMBER The ID number of a configurable syslogd message. all Display all of the configurable syslogd messages on the LX unit. Message record 4: Message: The Shell has been exited by Facility: user Priority: notice 451-0310E 105 Displays information on Service Profiles configured for the Notification Feature. Syntax show notification serviceprofile |all Where Means Example show notification serviceprofile all Figure 34 shows an example of the Service Profile display. Figure 34 - Service Profile Display show notification serviceprofile name The Service Profile for which data is to be displayed. all Display the specified data for all Service Profiles on the LX unit. ServiceProfile: syslog Protocol: localsyslog File: syslog ServiceProfile: messages Protocol: localsyslog File: messages ServiceProfile: debug Protocol: localsyslog File: debug ServiceProfile: mark1 Protocol: localsyslog File: ServiceProfile: jacklocal Protocol: localsyslog File: jacksyslog ServiceProfile: jackremote Protocol: remotesyslog Remote Host: ServiceProfile: jackasync Protocol: async Async Port: 5 ServiceProfile: jack Protocol: tap SMSC: 18668230501 Bits/Parity/StopBits:8N1 Modem Port(s): 33 ServiceProfile: webjack Protocol: web Driver: verizon_web106 451-0310E Displays information on User Profiles of the Notification Feature. Syntax show notification userprofile |all Where Means Example show notification userprofile all Figure 35 shows an example of the User Profile display. Figure 35 - User Profile Display show notification userprofile name The User Profile for which data is to be displayed. all Display the specified data for all User Profiles on the LX unit. UserProfile: syslog ServiceProfile: syslog Contact: Facility: all Priority: err UserProfile: messages ServiceProfile: messages Contact: Facility: all Priority: notice UserProfile: debug ServiceProfile: debug Contact: Facility: all Priority: debug UserProfile: grogers@mrv ServiceProfile: N/A Contact: Facility: kern Priority: emerg UserProfile: mark ServiceProfile: N/A Contact: Facility: kern Priority: emerg UserProfile: jacklocal ServiceProfile: jacklocal Contact: Facility: user Priority: warning 451-0310E 107 Displays status information for outlet groups. Syntax show outlet group ||all status Where Means Example show outlet group all status Figure 36 shows an example of the Outlet Group Status display. Figure 36 - Outlet Group Status Display show outlet group status group_number An integer number that specifies an existing outlet group. group_name The descriptive name of an existing outlet group. all Display the specified data for all outlet groups on the LX unit. Time: Mon, 16 Sep 2002 17:55:19 Group Number: 2 Group Name: mypc Group Off Time: 4 Port Outlet State 2 1 Not configured 2 2 Not configured Field Description Time The date and time that the show outlet group status command was executed. Group Name The descriptive name of the outlet group. Port The LX Port from which the outlet is managed. Outlet The outlet number. State The state of the individual outlet. Group Number The group number of the outlet group. Group Off Time The length of time that outlets in the group must remain off after they have been turned off.108 451-0310E Displays the APD settings of an asynchronous port. Syntax show port async all| apd Where Means Example show port async 5 apd show port async all apd The port APD Settings screen contains the same fields as the port APD Settings screen that can be displayed in the User command mode. For more information refer to Figure 4 on page 46. show port async apd all Display information for all asynchronous ports. port_number The port number of an asynchronous port.451-0310E 109 Displays the characteristics of an asynchronous port. Syntax show port async all| characteristics Where Means Example show port async 5 characteristics show port async all characteristics The display contains the same fields as the port characteristics screen that can be displayed in the User command mode. For more information refer to Figure 3 on page 43. show port async characteristics all Display information for all asynchronous ports. port_number The port number of an asynchronous port.110 451-0310E Displays the modem settings for an asynchronous port. Syntax show port async all| modem Where Means Example show port async 5 modem show port async all modem The display contains the same fields as the port modem screen that can be displayed in the User command mode. For more information refer to Figure 5 on page 47. show port async modem all Display information for all asynchronous ports. port_number The port number of an asynchronous port.451-0310E 111 Displays the match patterns and pattern-matching characteristics for an asynchronous port. Syntax show port async |all pattern match characteristics Where Means Example show port async 5 pattern match characteristics Figure 37 shows an example of the Pattern Match Characteristics display. Figure 37 - Pattern Match Characteristics Display show port async pattern match characteristics port_number The port number of an asynchronous port. Note: The port must be configured for databuffer access. all Display the pattern-matching characteristics for all asynchronous ports on the LX unit. Time: Wed, 05 Feb 2003 07:05:52 Banner: Welcome to MRV Communications, In-Reach Product Division. Port Number: 5 Pattern Match: Enabled Pattern 1: SuperUser Pattern 2: tes.t Pattern 3: Unix Reboot Pattern 8: abc* 112 451-0310E Displays the Point-to-Point Protocol (PPP) settings of an asynchronous port. Syntax show port async all| ppp Where Means Example show port async 5 ppp show port async all ppp The display contains the same fields as the port PPP screen that can be displayed in the User command mode. For more information refer to Figure 6 on page 48. show port async ppp all Display information for all asynchronous ports. port_number The port number of an asynchronous port.451-0310E 113 Displays the Point-to-Point Protocol (PPP) status of an asynchronous port. Syntax show port async all| ppp status Where Means Example show port async 4 ppp status Figure 38 shows an example of the PPP status display. Figure 38 - PPP Status Display show port async ppp status all Display information for all asynchronous ports. port_number The port number of an asynchronous port. Time: Tue, 18 Mar 2003 20:21:58 UTC Port Device: /dev/ttyGN4 Port Number: 4 Learned Remote Addr.: 0.0.0.0 Lcp Link Status: Closed Ipcp Link Status: Closed PPP Transmit Bytes: N/A PPP Recieve Bytes: N/A PPP Transmit Frames: N/A PPP Recieve Frames: N/A PPP Transmit Errors: N/A PPP Recieve Errors: N/A114 451-0310E Displays status information for asynchronous ports. Syntax show port async all| status Where Means Example show port async 5 status show port async all status This display contains the same fields as the port Status screen that can be displayed in the User command mode. For more information refer to Figure 7 on page 50. show port async status all Display information for all asynchronous ports. port_number The port number of an asynchronous port.451-0310E 115 Displays summary information for all of the asynchronous ports on the LX unit. Syntax show port async summary Example show port async summary Figure 39 shows an example of the summary information for LX asynchronous ports. Figure 39 - Asynchronous Port Summary Data show port async summary Port Port Name Access Speed TCP Port SSH port Device 0 Port_0 Local 9600 0 0 /dev/ttyGN0 1 Port_1 Remote 9600 2100 2122 /dev/ttyGN1 2 Port_2 Remote 9600 2200 2222 /dev/ttyGN2 3 Port_3 Local 9600 2300 2322 /dev/ttyGN3 4 Port_4 Dynamic 9600 2400 2422 /dev/ttyGN4 5 Port_5 Sensor 9600 2500 2522 /dev/ttyGN5 6 Port_6 Databuffer 9600 2600 2622 /dev/ttyGN6 7 Port_7 IR5100 9600 2700 2722 /dev/ttyGN7 8 Port_8 IR5150 9600 2800 2822 /dev/ttyGN8 Field Description Port The Port Number Port Name The Port Name Access The access method for the port Speed The port speed TCP Port The Telnet port number for the port SSH Port The SSH port number for the port Device The Linux Device Name for the port116 451-0310E Displays the characteristics of an Ethernet port. Syntax show port ethernet all| characteristics Where Means Example show port ethernet 1 characteristics Figure 40 shows an example of Ethernet Port Characteristics. Figure 40 - Ethernet Port Characteristics show port ethernet characteristics all Display information for all Ethernet ports. port_number The port number of an Ethernet port. Time: Mon, 24 Mar 2003 22:30:19 Name: eth0 MAC Address: 00:a0:87:9c:00:50:e3 Link Speed: Auto Duplex Mode: Auto Description: Field Description Name The name of the port. Description The description of the Ethernet port. MAC Address The Ethernet MAC Address for the port. Link Speed The Ethernet port speed. The possible values are auto, 10mb and 100mb. Duplex Mode The duplex mode of the Ethernet port. The possible values are auto, full, and half.451-0310E 117 Displays the statistical information for an ethernet port. Syntax show port ethernet all| status Where Means Example show port ethernet 1 status Figure 41 shows an example of the statistical information for an Ethernet port. Figure 41 - Ethernet Port Statistical Information show port ethernet status all Display information for all ethernet ports. port_number The port number of an ethernet port. Name: eth0 MAC Address: 00:a0:87:9c:00:50:e3 Link State: Up Duplex Mode: Half Link Speed: 100 Auto Negotiation: Auto Receive Bytes: 240061 Transmit Bytes: 40115 Receive Packets: 2890 Transmit Packets: 659 Receive Errors: 0 Transmit Errors: 0 Receive Drop Packet: 0 Transmit Drop Packet: 0 Receive Overruns: 0 Transmit Overruns: 0 Receive Compressed: 0 Transmit Compressed: 0 Receive Frame Error: 0 Transmit Collisions: 0 Receive Multicast: 0 Transmit Carrier: 0 Field Description Name The Ethernet port name. Link State The state (Up or Down) of the Ethernet link. Link Speed The speed of the Ethernet link (in Megabytes per second). Receive Bytes The number of Bytes Received on the Ethernet port since the counters were last reset to zero. Receive Packets The number of Packets Received on the Ethernet port since the counters were last reset to zero. Receive Errors The number of Receive Errors on the Ethernet port since the counters were last reset to zero. Receive Drop Packet The number of Receive Packets that have been dropped by the Ethernet port since the counters were last reset to zero. 118 451-0310E show port ethernet status (continued) Receive Overruns The number of Receive Overruns on the Ethernet port since the counters were last reset to zero. Receive Compressed The number of compressed packets received since the counters were last reset to zero. Receive Frame Error The number of Receive Frame Errors on the Ethernet port since the counters were last reset to zero. Receive Multicast The number of Multicasts received on the Ethernet port since the counters were last reset to zero. MAC Address The MAC Address of the LX unit. Duplex Mode The duplex mode (half or full) of the Ethernet link. Auto Negotiation Indicates whether or not auto negotiation is in effect on the Ethernet link. Transmit Bytes The number of bytes transmitted on the Ethernet port since the counters were last reset to zero. Transmit Packets The number of packets transmitted on the Ethernet port since the counters were last reset to zero. Transmit Errors The number of Transmit Errors on the Ethernet port since the counters were last reset to zero. Transmit Drop Packet The number of Transmit Packets dropped on the Ethernet port since the counters were last reset to zero. Transmit Overruns The number of Transmit Overruns on the Ethernet port since the counters were last reset to zero. Transmit Compressed The number of compressed packets transmitted since the counters were last reset to zero. Transmit Collisions The number of Transmit Collisions on the Ethernet port since the counters were last reset to zero. Transmit Carrier451-0310E 119 Displays summary information for the Ethernet ports on the LX unit. Syntax show port ethernet summary Example show port ethernet summary Figure 42 shows an example of the summary information for the LX Ethernet port. Figure 42 - Ethernet Summary Information show port ethernet summary Name MAC-Address eth0 00:a0:87:9c:00:50:e3 Field Description Name The name of the Ethernet port. MAC Address The MAC (physical) Address of the Ethernet port.120 451-0310E Displays information about the RADIUS authentication and accounting servers for the LX unit. Syntax show radius characteristics Example show radius characteristics Figure 43 shows an example of the RADIUS Display. Figure 43 - RADIUS Display show radius characteristics Time: Wed, 10 Apr 2002 00:44:48 UTC Primary RADIUS Authentication Server: IP Address: 0.0.0.0 RADIUS Auth. UDP Port: 1812 Secret: Not Configured Timeout: 4 Retry: 4 Secondary RADIUS Authentication Server: IP Address: 0.0.0.0 RADIUS Auth. UDP Port: 1812 Secret: Not Configured Timeout: 4 Retry: 4 Primary RADIUS Accounting Server: IP Address: 0.0.0.0 RADIUS Acct. UDP Port: 1813 Secret: Not Configured Timeout: 4 Retry: 4 Secondary RADIUS Accounting Server: IP Address: 0.0.0.0 RADIUS Acct. UDP Port: 1813 Secret: Not Configured Timeout: 4 Retry: 4 RADIUS Accounting Server Period: 5 Inbound RADIUS Enabled Serial Ports: Outbound RADIUS Enabled Serial Ports: RADIUS Enabled Interfaces: Field Description IP Address The IP Address for the applicable Authentication or Accounting Server. Secret The Radius secret shared between the LX unit and the Radius server used for encrypting communications between them. Retry The number of times the LX unit will attempt to connect to the Radius server.451-0310E 121 show radius characteristics (continued) RADIUS Auth. UDP Port The UDP port that the LX unit and the applicable RADIUS authentication server will use for communication. RADIUS Acct. UDP Port The UDP port that the LX unit and the applicable RADIUS accounting server will use for communication. Timeout The time to wait for a RADIUS server to respond before retransmitting packets to the server. RADIUS Accounting Server Period The length of time, in seconds, that the RADIUS server waits for a reply from the RADIUS Accounting server. Inbound RADIUS Enabled Serial Ports The Inbound serial ports that are enabled for RADIUS. Outbound RADIUS Enabled Serial Ports The Outbound serial ports that are enabled for RADIUS. RADIUS Enabled Interfaces The LX interfaces that are enabled for RADIUS.122 451-0310E Displays statistical information on RADIUS authentication attempts. Syntax show radius status Example show radius status Figure 44 shows an example of the RADIUS Status Display. Figure 44 - RADIUS Status Display show radius status Time: Wed, 08 May 2002 13:32:34 UTC Total RADIUS Authentication Message Exchange: Primary Secondary Successful attempts: 2 0 Failed attempts: 0 0 Total RADIUS Accounting Message Exchange: Primary Secondary Successful attempts: 0 0 Failed attempts: 6 6 RADIUS Authentication Counter Summary: Primary Secondary Successful Logins: 2 0 Authentication Failures: 0 0 Configuration Failures: 0 0 Policy Failures: 0 0 RADIUS Accounting Counter Summary: Primary Secondary Successful Acct Entries: 0 0 Failed Acct Entries: 0 0 Requests Waiting: 0 0 RADIUS Fallback Counter Summary: Total Fallback Logins: 0 Field Description Tot al RADIUS Authentication Message Exchange Successful Attempts The number of times the primary and secondary RADIUS authentication servers successfully exchanged messages with the LX unit. Failed attempts The number of times the primary and secondary RADIUS authentication servers failed to exchange messages with the LX unit.451-0310E 123 show radius status (continued) Tot al RADIUS Accounting Message Exchange Successful Attempts The number of times the primary and secondary RADIUS accounting servers successfully exchanged messages with the LX unit. Failed attempts The number of times the primary and secondary RADIUS accounting servers failed to exchange messages with the LX unit. RADIUS Authentication Counter Summary Successful Logins The number of successful logins using RADIUS. Authentication Failures The number of unsuccessful logins using RADIUS. Configuration Failures The number of login failures that occurred due to configuration failures. Policy Failures The number of login failures that occurred due to policy failures. RADIUS Accounting Counter Summary Successful Acct Entries The number of successful RADIUS accounting entries. Failed Acct Entries The number of failed RADIUS accounting entries. Requests Waiting The number of RADIUS Accounting requests that have not been processed yet. RADIUS Fallback Counter Summary Total Fallback Logins The number of logins that have been done through the RADIUS Fallback Login feature.124 451-0310E Displays summary data for the RADIUS authentication and accounting servers. Syntax show radius summary Example show radius summary Figure 45 shows an example of the RADIUS Summary Display. Figure 45 - RADIUS Summary Display show radius summary Radius Server Summary Thu, 12 Sep 2002 20:47:18 Primary Auth. Server: 0.0.0.0 Primary Auth. UDP Port: 1812 Secondary Auth. Server: 0.0.0.0 Secondary Auth. UDP Port: 1812 Primary Acct. Server: 0.0.0.0 Primary Acct. UDP Port: 1813 Secondary Acct. Server: 0.0.0.0 Secondary Acct. UDP Port: 1813 Field Description Primary Auth. Server The IP Address of the Primary RADIUS Authentication server. Secondary Auth. Server The IP Address of the Secondary RADIUS Authentication server. Primary Acct. Server The IP Address of the Primary RADIUS Accounting server. Secondary Acct. Server The IP Address of the Secondary RADIUS Accounting server. Primary Auth. UDP Port The UDP port for the Primary RADIUS Authentication server. Secondary Auth. UDP Port The UDP port for the Secondary RADIUS Authentication server. Primary Acct. UDP Port The UDP port for the Primary RADIUS Accounting server. Secondary Acct. UDP Port The UDP port for the Secondary RADIUS Accounting server.451-0310E 125 Displays the IP addresses of the default route, subnet mask, and gateway of the LX unit. Syntax show route Example show route Figure 46 shows an example of the Route Display. Figure 46 - Route Display show route Route Mask Gateway 192.168.10.0 255.255.255.0 10.50.100.1 192.168.11.0 255.255.255.0 10.50.100.10 192.168.12.0 255.255.255.0 10.50.100.20 192.168.13.0 255.255.255.0 10.50.100.30 192.168.14.0 255.255.255.0 10.50.100.40 192.168.15.0 255.255.255.0 10.50.100.50 192.168.16.0 255.255.255.0 10.50.100.60126 451-0310E Displays information about the SecurID authentication server for the LX unit. Syntax show securid characteristics Example show securid characteristics Figure 43 shows an example of the SecurID Characteristics Display. Figure 47 - SecurID Characteristics Display show securid characteristics Time: Mon, 17 Mar 2003 18:09:34 UTC SecurID Configuration Settings Authentication Version: Version_5 Authentication Encryption: DES Authentication Timeout: 5 Authentication Retransmit: 3 Authentication Port: 5500 V5 Primary Server: 0.0.0.0 Primary Name: Legacy Master Server: 0.0.0.0 Master Name: Legacy Slave Server: 0.0.0.0 Slave Name: Inbound SecurID Enabled Serial Ports: Outbound SecurID Enabled Serial Ports: SecurID Enabled Interfaces: Field Description Time The date and time that the show securid characteristics command was executed. Authentication Ve rsi on The version of SecurID that is running on the SecurID authentication server. The possible values are Legacy and Version_5. Authentication Timeout The time to wait for the SecurID authentication server to respond before retransmitting packets to the server. Authentication Port The UDP port that the LX unit and the SecurID authentication server will use for communication. V5 Primary Server The IP Address of the authentication server used for Version 5 of SecurID. Legacy Master Server The IP address of the Master server for the Legacy version of SecurID. Legacy Slave Server The IP address of the Slave server for the Legacy version of SecurID. Inbound SecurID Enabled Serial Ports The Inbound serial ports that use SecurID authentication.451-0310E 127 show securid characteristics (continued) Outbound SecurID Enabled Serial Ports The Outbound serial ports that use SecurID authentication. SecurID Enabled Interfaces The IP interfaces that use SecurID authentication. Authentication Encryption The encryption method used by SecurID. The possible values are DES and SDI. Authentication Retransmit The maximum number of times the LX unit will retransmit packets to the SecurID authentication server after the expiration of an Authentication Timeout. Primary Name The name of the Version 5 authentication server. Master Name The name of the Master server for the Legacy version of SecurID. Slave Name The name of the Slave server for the Legacy version of SecurID.128 451-0310E Displays statistical information on SecurID authentication attempts. Syntax show securid status Example show securid status Figure 44 shows an example of the SecurID Status Display. Figure 48 - SecurID Status Display show securid status Time: Mon, 24 Feb 2003 16:55:59 SecurID Status & Counters: Successful Logins: 0 Failed Logins: 0 Fallback Logins: 0 Learned SecurID Node Secret: False Learned SecurID Servers: Field Description Time The date and time that the show securid status command was executed. Successful Logins The number of successful logins using SecurID. Failed Logins The number of unsuccessful logins using SecurID. Fallback Logins The number of logins that have been accomplished using SecurID Fallback. Learned SecurID Node Secret Indicates whether or not the LX unit has received the SecurID Secret from the SecurID Server. The possible values are True and False. A value of True means that the LX unit has received the SecurID Secret from the SecurID Server. A value of True means that the LX unit has not received the SecurID Secret from the SecurID Server. Learned SecurID Servers The IP addresses, or host names, of the Primary and Replica SecurID servers that the LX unit can use for authentication.451-0310E 129 Displays summary data for the SecurID authentication and accounting servers. Syntax show securid summary Example show securid summary Figure 45 shows an example of the SecurID Summary Display. Figure 49 - SecurID Summary Display show securid summary Time: Mon, 17 Mar 2003 18:17:27 UTC V5 Primary Server: 0.0.0.0 Primary Name: Legacy Master Server: 0.0.0.0 Master Name: Authentication Version: Version_5 Authentication Port: 5500 Field Description Time The date and time that the show securid summary command was executed. V5 Primary Server The IP Address of the authentication server used for Version 5 of SecurID. Legacy Master Server The IP address of the Master server for the Legacy version of SecurID. Authentication Ve rsi on The version of SecurID that is running on the SecurID authentication server. The possible values are Legacy and Version_5. Primary Name The name of the Version 5 Primary authentication server. Master Name The name of the Master server for the Legacy version of SecurID. Authentication Port The UDP port that the LX unit and the SecurID authentication server will use for communication.130 451-0310E Displays the name and IP Address of every service that is configured for the LX unit. Syntax show service Example show service Figure 50 shows an example of the Service screen. Figure 50 - Service Screen show service Wed, 10 Apr 2002 10:45:08 UTC Service Name IP Address dewey 123.123.1.1 huey 123.123.1.2 451-0310E 131 Displays information about opened sessions on the LX unit. Syntax show session [] Where Means Usage Guidelines If this command is executed without the argument (i.e., show session), it displays information for all opened sessions on the LX unit. Example show session 3 This display contains the same fields as the Session screen that can be displayed in the User command mode. For more information refer to Figure 10 on page 54. show session session_number The session number of an opened connection.132 451-0310E Displays the system-level SNMP characteristics for the LX unit. Syntax show snmp characteristics Example show snmp characteristics Figure 52 shows an example of SNMP characteristics Display. Figure 51 - SNMP Characteristics Display show snmp characteristics Time: Wed, 10 Apr 2002 10:45:08 UTC Name: InReach Logging: Disabled Port: 161 Contact: Henry Smith Location: Upstairs Lab V3 Engine Boots: 14 V3 Engine ID: 6537303330336565616365323932336100000000 Field Description Time The date and time that the show snmp characteristics command was executed. Logging Indicates whether the SNMP Logging feature is Enabled or Disabled on the LX unit. Contact The contact for the LX unit. V3 Engine Boots The number of times the V3 engine has been rebooted. V3 Engine ID The V3 Engine ID for the LX unit. Name The system name for the LX unit. Port The SNMP UDP port for the LX unit. Location The location of the LX unit.451-0310E 133 Displays information on SNMP clients. Syntax show snmp client all| Where Means Example show snmp client 1 Figure 52 shows an example of SNMP Client Display. Figure 52 - SNMP Client Display show snmp client all Display information for all SNMP clients on this LX unit. client_number The client number for an SNMP client Get Client: 1 Address: 145.134.118.12 Community: public Version: 1 Set Client: 1 Address: 145.134.118.16 Community: public Version: 1 Trap Client: 1 Address: 145.134.118.18 Community: private Version: 1 Field Description Get Client The SNMP client (e.g., a Network Operations Center, or NOC) which is permitted to perform an SNMP get on the LX unit. Set Client The SNMP client (e.g., a Network Operations Center, or NOC) which is permitted to perform an SNMP set on the LX unit. Trap Client The SNMP client (e.g., a Network Operations Center, or NOC) which is permitted to trap SNMP characteristics from the LX unit. Community The name of the applicable SNMP Community to which the LX unit belongs. When an SNMP Community Name has been specified for the unit, only SNMP clients which belong to the same community are permitted to perform the applicable SNMP operation (Get, Set, or Trap) on the unit. Address The IP Address of the SNMP Get, Set, or Trap client. Version The SNMP Get, Set, or Trap Version for the client. The possible values are 1, 2, or 3.134 451-0310E Displays V3 information for SNMP clients. Syntax show snmp v3 all| Where Means Example show snmp v3 3 Figure 53 shows an example of the V3 display for an SNMP client. Figure 53 - V3 Display show snmp v3 all Display information for all SNMP clients on this LX unit. client_number The client number for an SNMP client Client: 4 Engine Boots: 8 Engine ID: e70303eeace2923a000000000000000000000000 V3 View OID Subtree: 0 V3 View OID Subtree Mask: 8000000000000000000000000000000000000000 V3 View Name: V3 View Type: Allow V3 Access Group Name: V3 Access Context Prefix: V3 Access Security Model: 3 V3 Access Security Level: 1 V3 Access Read View: view V3 Access Write View: view V3 Access Notify View: view V3 Access Cont. Match: none V3 Security Name: V3 Source IP: 0.0.0.0 V3 Secur. Community: public V3 Source Mask: 0.0.0.0 V3 Group Secur. Model: V3 Group Secur. Name: V3 Group Name: Field Description Client The SNMP client number. Engine Boots The number of times the SNMP v3 daemon has booted (i.e., used its shared secret). Engine ID The ID of the SNMP v3 daemon. V3 View OID Subtree The OID range that is accessible by this view. V3 View OID Subtree Mask The valid numbers in the subtree, specified as the individual bits of the digits.451-0310E 135 show snmp v3 (continued) V3 View Name The name of the view entry. V3 View Type Indicates whether the v3 view type is allowed or denied. If the value of this field is Enabled, the view type is allowed. If the value of this field is Disabled, the view type is denied. V3 Access Group Name The name of a group to map to a view. V3 Access Security Model The version number of the group entry. V3 Access Read View The view to use for read requests. V3 Access Notify View The view to use for Notify requests. V3 Access Cont. Match Indicates whether the context prefix is a prefix of an exact value. V3 Security Name The user name to be used for the IP Address specified by the Source IP, Source Mask, and Community. V3 Secur. Community The Community Name used in a request to map to a Security Name. V3 Group Secur. Model The Version Number of a request to map to a Group Name. V3 Group Name The Name of the v3 Group. V3 Access Context Prefix The Access Context Prefix. V3 Access Security Level Indicates the v3 Access Security Level for the LX unit. The possible values are as follows: 1 - No authorization 2 - Authorization with no privileges 3 - Authorization with privileges 4 - The LX unit is non-v3 V3 Access Write View The view to use with write requests. V3 Source IP The IP range that is mapped to the Security Name for non-v3 requests. V3 Source Mask The incoming IP Address is ANDed with this mask before it is compared with the Source IP Address.136 451-0310E show snmp v3 (continued) V3 Group Secur. Name The name of the user to map to a group.451-0310E 137 Displays the status or characteristics for selected subscribers. Syntax show subscriber |all characteristics|status|tcp Where Means Examples show subscriber tim characteristics show subscriber tim status show subscriber all tcp show subscriber subscriber_name The subscriber for which data is to be displayed. all Display the specified data for all subscribers on the LX unit. characteristics Displays the characteristics for the specified subscribers. This option displays a screen that contains the same fields as the subscriber characteristics that are displayed in User Mode. For more information, refer to Figure 11 on page 56. status Displays the status information for the specified subscribers. This option displays a screen that contains the same fields as the subscriber status screen that is displayed in User Mode. For more information, refer to Figure 12 on page 59. tcp Displays the TCP information for the selected subscribers. This option displays a screen that contains the same fields as the subscriber TCP screen that is displayed in User Mode. For more information, refer to Figure 13 on page 60.138 451-0310E Displays summary information for all of the subscribers configured on the LX unit. Syntax show subscriber summary Examples show subscriber summary Figure 54 shows an example of the Subscriber Summary Display. Figure 54 - Subscriber Summary Display show subscriber summary Name Connections Terminal Type InReach 0 Ansi demo 1 Ansi jack 0 Ansi451-0310E 139 Displays the global system configuration for the LX unit. Syntax show system characteristics Example show system characteristics Figure 55 shows an example of the system display for an LX unit. Figure 55 - System Display show system characteristics Name: InReach Time: Wed, 10 Apr 2002 02:13:18 UTC Serial Number: 00:a0:9c:00:01:43 Location: UpstairsLab Domain Name suffix: yourcompany.com Maximum Number of Async Ports: 8 Internal Modem on Port: 0 Maximum Number of Subscribers: 16 Maximum Number of Virtual Ports: 32 Maximum Number of Interfaces: 4 Maximum Number of Ethernet Ports: 1 Primary Domain : 102.19.176.254 Secondary Domain : 102.19.128.17 Gateway : 102.19.169.1 Default TFTP Server : 102.19.169.182 Timed Daemon: Disabled TFTP Retries: 3 NTP Daemon: Disabled TFTP Timeout: 3 NTP Server: 0.0.0.0 SNMP Feature: Disabled Finger Daemon: Disabled Logging Size : 64000 Telnet Daemon: Enabled SSH Daemon: Enabled Web Server: Enabled Field Description Name The host name of the LX unit. Location A text string that specifies the physical location of the LX unit. Serial Number The Serial Number of the LX unit. Domain Name Suffix The suffix for the LX-unit Domain Name. Maximum Number of Async Ports The maximum allowable number of asynchronous ports on the LX unit. Maximum Number of Subscribers The maximum number of subscribers on the LX unit. Maximum Number of Interfaces The maximum allowable number of IP interfaces on the LX unit. Primary Domain The IP Address of the Primary Domain Name Server (DNS) for the LX unit.140 451-0310E show system characteristics (continued) Gateway The IP Address for the gateway (default route) of the LX unit. Timed Daemon Indicates whether the Timed Daemon is Enabled or Disabled. NTP Daemon Indicates whether the Network Time Protocol (NTP) Daemon is Enabled or Disabled on the LX unit. NTP Server The IP Address of the NTP server for the LX unit. Finger Daemon Indicates whether the Finger Daemon (fingerd) is Enabled or Disabled on the LX unit. Telnet Daemon Indicates whether the Telnet Daemon is Enabled or Disabled on the LX unit. Web Server Indicates whether the WebServer feature (Browser Management) is Enabled or Disabled on the LX unit. Time The date and time that the show system characteristics command was executed. Internal Modem on Port Indicates whether or not the LX port has an internal modem. Maximum Number of Virtual Ports The maximum allowable number of virtual ports on the LX unit. Maximum Number of Ethernet Ports The maximum allowable number of Ethernet ports on the LX unit. Secondary Domain The IP Address of the Secondary Domain Name Server (DNS) for the LX unit. Default TFTP server The default network server for updating the software image, the iBoot file, and parameter files. TFTP Retries The number of times the TFTP server will attempt to communicate with the LX unit. TFTP Timeout If the LX unit can not load from the TFTP Server before the expiration of this timeout, the TFTP Server is considered dead. SNMP Feature Indicates whether SNMP is Enabled or Disabled for the LX unit. Logging Size Indicates the size of logging files on the unit. SSH Daemon Indicates whether the SSH Daemon is Enabled or Disabled on the LX unit.451-0310E 141 Displays the ppciboot configured load settings for the LX unit. Syntax show system ppciboot Example show system ppciboot Figure 56 shows an example of the ppciboot Configured Load Settings Display for an LX unit. Figure 56 - ppciboot Configured Load Settings Display show system ppciboot Ppciboot Configured Load Settings Ppciboot Software Version : 0.9.3.26 Ppciboot Ethernet Network Link : auto Software Load From Flash : no Software Load From Network : yes Software Filename : linuxito.img Configured IP Address : 145.189.121.19 Configured Network Mask : 255.255.255.0 Configured Gateway Address : 145.177.123.1 Configured TFTP Server Address : 145.177.169.208 IP Assignment Method #1 : User Defined IP Assignment Method #2 : BOOTP IP Assignment Method #3 : RARP IP Assignment Method #4 : DHCP142 451-0310E Displays system status information for the LX unit. Syntax show system status Example show system status Figure 57 shows an example of the System Status Display for an LX unit. Figure 57 - System Status Display show system status Time: Mon, 24 Feb 2003 20:17:20 UTC System Uptime: 0 8:7:50 Software Load From : Local Flash Memory Active System Gateway : 102.19.169.1 Configuration Load From : Local Flash Memory Network file Name : Configuration File to Boot From : /config/Config.prm Configuration Settings to Boot From : Flash Configuration Status : Configuration Saved Configuration Version : 4 CPU usage (0.10 = 10%): Memory usage (in KB): 1 min. Avg usage : 0.00 Total Memory : 62760 5 min. Avg usage : 0.00 Cached Memory : 6320 15 min. Avg usage : 0.00 Free Memory : 28488 Temperature Status (degrees Celsius): Critical Temp. : 60.0 Hysteresis Temp. : 5.0 Low Temperature : 0.0 Threshold Temp. : 55.0 Current Temp. : 38.5 PowerFail Log: Feb 24 21:54:33 2003 Field Description Software Load From The IP Address of the Load Server for the LX software image. Active System Gateway The IP Address of the gateway that is currently being used by the LX unit. Configuration Load From The parameter server for the LX unit. Network File Name The filename of the network file from which the LX configuration is loaded. Configuration File to Boot From The filename of the file from which the LX unit is booted.451-0310E 143 show system status (continued) Configuration Settings to Boot From Indicates whether the configuration of the LX unit is booted from the local flash or from the network. Configuration Status Indicates whether the current configuration of the LX unit has been saved with the save configuration command. Configuration Version The version number of the LX configuration. This number is incremented by 1 each time a modified version of the LX configuration is saved. CPU usage (0.10 = 10%) 1 min. Avg usage Average CPU usage over the last minute. 5 min. Avg usage Average CPU usage over the last 5 minutes. 15 min. Avg usage Average CPU usage over the last 15 minutes. Memory usage (in KB) Total Memory The total memory on the LX unit (in KB). Cached Memory The total cached memory in use (in KB). Free Memory The total free memory (in KB). Temperature Status (degrees Celsius) Critical Temp. The temperature level (in Celsius degrees) that is considered critical for the LX unit. Low Temperature The lowest supported operating temperature for the LX unit. Current Temp. The current temperature of the LX unit. Hysteresis Temp. The Hysteresis for temperature measurements on the LX unit. Threshold Temp. The highest supported operating temperature for the LX unit. PowerFail Log The dates and times when power failures have occurred on the LX unit. Note: This field also displays the date and time when the LX unit is unplugged.144 451-0310E Displays information about the TACACS+ authentication and accounting servers for the LX unit. Syntax show tacacs+ characteristics Example show tacacs+ characteristics Figure 58 shows an example of the TACACS+ Display. Figure 58 - TACACS+ Display show tacacs+ characteristics Time: Wed, 10 Apr 2002 00:44:48 UTC Primary TACACS+ Authentication Server: IP Address: 0.0.0.0 TACACS+ Auth. TCP Port: 49 Secret: Not Configured Timeout: 4 Retry: 4 Secondary TACACS+ Authentication Server: IP Address: 0.0.0.0 TACACS+ Auth. TCP Port: 49 Secret: Not Configured Timeout: 4 Retry: 4 Primary TACACS+ Accounting Server: IP Address: 0.0.0.0 TACACS+ Acct. TCP Port: 49 Secret: Not Configured Timeout: 4 Retry: 4 Secondary TACACS+ Accounting Server: IP Address: 0.0.0.0 TACACS+ Acct. TCP Port: 49 Secret: Not Configured Timeout: 4 Retry: 4 TACACS+ Superuser Request: Disabled TACACS+ Accounting Server Period: 5 Inbound TACACS+ Enabled Serial Ports: Outbound TACACS+ Enabled Serial Ports: TACACS+ Enabled Interfaces: Field Description IP Address The IP Address for the applicable Authentication or Accounting Server. Secret The TACACS+ secret shared between the LX unit and the TACACS+ server used for encrypting communications between them. Retry The number of times the LX unit will attempt to connect to the TACACS+ server.451-0310E 145 show tacacs+ characteristics (continued) TACACS+ Auth. TCP Port The TCP port that the LX unit and the applicable TACACS+ authentication server will use for communication. TACACS+ Acct. TCP Port The TCP port that the LX unit and the applicable TACACS+ accounting server will use for communication. Timeout The time to wait for a TACACS+ server to respond before retransmitting packets to the server. TACACS+ Superuser Request Indicates whether or not the TACACS+ Superuser password is used to enter the Superuser Command Mode. The possible values of this field are Enabled and Disabled. If this field is Enabled, the TACACS+ Superuser password will be used to enter the Superuser Command Mode. If this field is Disabled, the Local Password will be used to enter the Superuser Command Mode. Note: Even if this field is Disabled, the logon authentication to the LX unit will be through TACACS+. Inbound TACACS+ Enabled Serial Ports The Inbound serial ports that are enabled for TACACS+. Outbound TACACS+ Enabled Serial Ports The Outbound serial ports that are enabled for TACACS+. TACACS+ Enabled Interfaces The LX IP interfaces that are enabled for TACACS+. TACACS+ Accounting Server Period The length of time, in seconds, that the TACACS+ server waits for a reply from the TACACS+ Accounting server.146 451-0310E Displays statistical information on TACACS+ authentication attempts. Syntax show tacacs+ status Example show tacacs+ status Figure 59 shows an example of the TACACS+ Status Display. Figure 59 - TACACS+ Status Display show tacacs+ status Time: Wed, 08 May 2002 13:32:34 UTC Total TACACS+ Authentication Message Exchange: Primary Secondary Successful attempts: 2 0 Failed attempts: 0 0 Total TACACS+ Accounting Message Exchange: Primary Secondary Successful attempts: 0 0 Failed attempts: 6 6 TACACS+ Authentication Counter Summary: Primary Secondary Successful Logins: 2 0 Authentication Failures: 0 0 TACACS+ Accounting Counter Summary: Primary Secondary Successful Acct Entries: 0 0 Failed Acct Entries: 0 0 TACACS+ Superuser Enable Summary: Primary Secondary Successful Enable Requests: 0 0 Failed Enable Requests: 0 0 TACACS+ Fallback Counter Summary: Total Fallback Logins: 0 Field Description Total TACACS+ Authentication Message Exchange Successful Attempts The number of times the primary and secondary TACACS+ authentication servers successfully exchanged messages with the LX unit. Failed attempts The number of times the primary and secondary TACACS+ authentication servers failed to exchange messages with the LX unit.451-0310E 147 show tacacs+ status (continued) Total TACACS+ Accounting Message Exchange Successful Attempts The number of times the primary and secondary TACACS+ accounting servers successfully exchanged messages with the LX unit. Failed attempts The number of times the primary and secondary TACACS+ accounting servers failed to exchange messages with the LX unit. TACACS+ Authentication Counter Summary Successful Logins The number of successful logins using TACACS+. Authentication Failures The number of unsuccessful logins using TACACS+. TACACS+ Accounting Counter Summary Successful Acct Entries The number of successful TACACS+ accounting entries. Failed Acct Entries The number of failed TACACS+ accounting entries. TACACS+ Superuser Enable Summary Successful Enable Requests This field only contains a value if TACACS+ Superuser Request is enabled. If TACACS+ Superuser Request is enabled, this field indicates the number of successful logins to Superuser Mode. Failed Enable Requests This field only contains a value if TACACS+ Superuser Request is enabled. If TACACS+ Superuser Request is enabled, this field indicates the number of unsuccessful attempts at logging in to Superuser Mode. TACACS+ Fallback Counter Summary Total Fallback Logins The number of logins that have been done through the TACACS+ Fallback Login feature.148 451-0310E Displays summary data for the TACACS+ authentication and accounting servers. Syntax show tacacs+ summary Example show tacacs+ summary Figure 60 shows an example of the TACACS+ Summary Display. Figure 60 - TACACS+ Summary Display show tacacs+ summary TACACS+ Server Summary Thu, 12 Sep 2002 20:47:18 Primary Auth. Server: 0.0.0.0 Primary Auth. TCP Port: 49 Secondary Auth. Server: 0.0.0.0 Secondary Auth. TCP Port: 49 Primary Acct. Server: 0.0.0.0 Primary Acct. TCP Port: 49 Secondary Acct. Server: 0.0.0.0 Secondary Acct. TCP Port: 49 Field Description Primary Auth. Server The IP Address of the Primary TACACS+ Authentication server. Secondary Auth. Server The IP Address of the Secondary TACACS+ Authentication server. Primary Acct. Server The IP Address of the Primary TACACS+ Accounting server. Secondary Acct. Server The IP Address of the Secondary TACACS+ Accounting server. Primary Auth. TCP Port The TCP port for the Primary TACACS+ Authentication server. Secondary Auth. TCP Port The TCP port for the Secondary TACACS+ Authentication server. Primary Acct. TCP Port The TCP port for the Primary TACACS+ Accounting server. Secondary Acct. TCP Port The TCP port for the Secondary TACACS+ Accounting server.451-0310E 149 Displays information about each user that is currently logged in to the LX unit. Syntax show users Example show users Figure 61 shows an example of the Users screen. Figure 61 - Users Screen show users Name Remote IP Address Local Port Protocol Device InReach 0.0.0.0 0 0 /dev/pts/3 demo 0.0.0.0 0 0 /dev/ttyGN1 demo 0.0.0.0 0 0 /dev/pts/1 Field Description Name The user name Remote IP Address If the user is logged in from a remote IP Address, the address is displayed in this field. Local Port If the user is logged on to a local port of the LX unit, the port number is displayed in this field. Protocol The protocol under which the user is connected to the LX unit. Device The Linux Device Number under which the user is logged in.150 451-0310E Displays the Linux OS version, Linux In-Reach version, LX software version, and ppciboot version for the LX unit. Syntax show version Example show version Figure 62 shows an example of the Version screen. Figure 62 - Version Screen show version Linux Kernel Version: 2.4.9 Linux In-Reach Version: 15 Software Version: 2.2.0 Ppciboot Version: 0.9.3.26 Field Description Linux Kernel Ve rsi on The version of the Linux Operating System that is running on the LX unit. Linux In-Reach Ve rsi on The version of the In-Reach implementation of Linux. Software Version The version of the LX software that is running on the LX unit. Ppciboot Version The version of ppciboot that the LX unit is using.451-0310E 151 Opens a Secure Shell (Triple-DES/BLOWFISH) connection. Syntax ssh [A.B.C.D [NUMBER]]|[NAME [NUMBER]] [LOGIN NAME] Where Means Usage Guidelines The default SSH server is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the ssh command is executed without an SSH server, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples ssh 102.19.240.14 ssh 102.19.240.14 2322 ssh ssh 102.19.240.14 2322 henryh ssh A.B.C.D The IP Address of the SSH server to which the connection is being made. (See “Usage Guidelines” (below) for the default value of this field.) NAME The Domain Name of the SSH server to which the connection is being made. (See “Usage Guidelines” (below) for the default value of this field.) NUMBER The socket number to which the connection is being made. LOGIN NAME The name that you are using to log in to the SSH server.152 451-0310E Opens a Telnet connection to a host. Syntax telnet [A.B.C.D [NUMBER]]|[NAME [NUMBER]] Where Means Usage Guidelines The default Telnet host is your Preferred Service. Refer to the preferred service command on page 399 for information on configuring a Preferred Service. If the telnet command is executed without a Telnet host, and you do not have a Preferred Service configured, the following error message is displayed: No Preferred Service Configured Examples telnet 102.19.240.14 telnet 102.19.240.14 2500 telnet telnet A.B.C.D The IP Address of the Telnet host. (See “Usage Guidelines” (below) for the default value of this field.) NAME The Domain Name of the Telnet host. (See “Usage Guidelines” (below) for the default value of this field.) NUMBER The socket number to which the connection is being made.451-0310E 153 Sets the terminal type for the LX user. Syntax terminal Where Means Example terminal vt100 terminal ansi terminal terminal_type The terminal type for the LX unit. The allowable terminal types are VT100 and ANSI. 154 451-0310E Updates the LX software or ppciboot file from a TFTP server on the network. Syntax update software|ppciboot [] Where Means Usage Guidelines In order for this command to take effect, you must restart the LX unit by executing the reload command. The reload command is described on page 79. If this command is executed without a TFTP server specified, and there is no default TFTP server configured, the following error message is displayed: No TFTP Host Download Failed Examples update ppciboot 102.19.169.141 update software 102.19.169.141 update ppciboot update software update software Update the LX software from the specified TFTP server. ppciboot Update the LX ppciboot file from the specified TFTP server. tftp_server The IP Address or the Domain Name of the TFTP server from which the LX software or ppciboot file is to be copied. If this field is not specified, the default TFTP server is used. To display the default TFTP server, refer to “show system characteristics” on page 139.451-0310E 155 Erases the statistics data for the LX unit. Syntax zero all Example zero all zero all156 451-0310E Resets the log files for the LX unit. Syntax zero log Example zero log zero log451-0310E 157 Deletes from the LX unit the SecurID Secret that was sent from the SecurID server. Syntax zero securid secret Example zero securid secret zero securid secret451-0310E 159 Chapter 3 Configuration Commands The Configuration commands are executed in the Configuration command mode. When the LX unit is in the Configuration command mode, the Configuration command prompt (i.e., Config:0 >>) is displayed on the terminal screen. The format of the Configuration command prompt is as follows: Config: >> where is the session number of the current connection. To enter the Configuration command mode, do one of the following: • If you are in the Superuser command mode, execute the configuration command. This displays the configuration prompt. Refer to page 67 for more information on the configuration command. • If you are in the Interface, Ethernet, Subscriber, Asynchronous, Menu, Menu Editing, Notification, or Broadcast Groups command mode, execute the exit command until the Configuration command prompt is displayed.160 451-0310E Configures the LX unit to boot the configuration from the local flash. Syntax boot configuration from flash Example boot configuration from flash boot configuration from flash451-0310E 161 Configures the LX unit to boot from a local file on the LX unit. Syntax boot configuration from name Where Means NOTE: You can use the show system status command to display the name of the boot file. The show system status command is described on page 142. Example boot configuration from name local.prm boot configuration from name filename The name of the local (LX-based) from which the LX unit will be booted. The filename may include a suffix. For example, the default filename is config.prm.162 451-0310E Configures the LX unit to boot from a TFTP server. Syntax boot configuration from network Where Means Example boot configuration from network 119.25.42.37 new_image boot configuration from network ip_address Specifies the IP Address of the TFTP server from which the LX unit is to be booted. filename The file on the LX unit, or on the TFTP server, from which the LX unit will be booted. The filename must not include a suffix. For example, local is a valid filename, but local.img is not a valid filename.451-0310E 163 Creates a Broadcast Group or accesses a Broadcast Group that already exists. Syntax broadcast group Where Means Usage Guidelines A Broadcast Group consists of Slave Ports and Master Ports. The Slave Ports receive data broadcasts from the Master Ports. The Slave Ports can be asynchronous ports or a TCP port. Users can receive data broadcasts by Telneting to a port that is configured as a Slave Port. A Master Port and its Slave Ports constitute a Broadcast Group, and a Slave Port can only receive data from its Master Port. Any console port or virtual port can be configured as a Master Port. Example broadcast group 4 broadcast group group_number The group number of the Broadcast Group. This can be any integer number between 1 and 5.164 451-0310E Enables a Broadcast Group. NOTE: In order to enable a Broadcast Group, the Broadcast Group must contain at least one Master Port and one Slave Port. Syntax broadcast group enable Where Means Example broadcast group 4 enable broadcast group enable group_number The group number of the Broadcast Group. 451-0310E 165 Sets the time for the LX system clock. NOTE: Use the date command to set the date for the system calendar. For more information, refer to “date” on page 168. Syntax clock HH:MM[:SS] Where Means Examples clock 14:47 clock 04:29:11 clock HH The hour in 24-hour format; for example, 23. MM The minute; for example, 09. SS The second; for example, 02.166 451-0310E Copies the configuration of one LX port to another LX port, or to a range of LX ports. Syntax copy port to [] Where Means Examples copy port 3 to 6 copy port 2 to 5 7 copy port origin_port The LX port from which the configuration is to be copied. destination_port1 The first port in a range of LX ports to which the configuration is to be copied. (Note: If destination_portn is not specified, the configuration is copied only to destination_port1.) destination_portn The last port in a range of LX ports to which the configuration is to be copied.451-0310E 167 Copies the configuration of one LX subscriber to one, or several, LX subscribers. If the destination subscriber is not in the database, a new subscriber is created. Syntax copy subscriber to * Where Means Usage Guidelines The maximum number of subscribers on an LX unit is equal to double the number of ports on the unit. For example, the maximum number of subscribers is 16 on an 8-port unit, 32 on a 16- port unit, 64 on a 32-port unit, and 96 on a 48-port unit. Examples copy subscriber benw to jimk billj edw susano emilyc copy subscriber mark to bill copy subscriber origin_subscriber The LX subscriber from which the configuration is to be copied. destination_subscriber The subscribers to which the configuration of origin_subscriber is to be copied. Note: If you specify an existing subscriber in this field, the origin_subscriber configuration overwrites the destination_subscriber. 168 451-0310E Sets the date for the LX system calendar. NOTE: Use the clock command to set the system clock for the LX unit. For more information, refer to “clock” on page 165. Syntax date MM/DD[/YYYY] Where Means Example date 03/17/2002 NOTE: In the above example, the date is set to March 17, 2002. date MM/DD[/YYYY] The date for the LX system calendar, where MM = The month; for example, 03 for March. DD = The date; for example, 17 for the 17 th . YYYY = The 4-digit year; for example, 2002. 451-0310E 169 Resets the boot file for the LX unit to the default boot file. When this command is entered the following message is displayed: File Saved Syntax default boot Example default boot default boot170 451-0310E Resets the configuration of the LX unit to default values and then shuts down and re-starts the LX unit. Syntax default configuration Usage Guidelines When this command is entered, the following confirmation prompt is displayed: Do You Really want to default the unit? [y|n] : Entering "y" will reset the configuration. Entering "n" will abort the command. If you enter “y” to default the configuration, you must re-start the LX unit with the reload command to make the default configuration take effect. The reload command is described on page 79. Example default configuration default configuration451-0310E 171 Resets the sizes of log files on the LX unit to the default value. Syntax default log size Example default log size default log size172 451-0310E Resets the off time for an outlet group to the default value of 10 seconds. Syntax default outlet group | off time Where Means Examples default outlet group 2 off time default outlet group rmlights off time default outlet group off time group_number An integer number that identifies the group whose off time is being reset to the default value. group_name The name assigned to the outlet group.451-0310E 173 Resets the timeout or retry value for the TFTP server to its default value. Syntax default tftp timeout|retry Where Means Examples default tftp timeout default tftp retry default tftp timeout Reset the TFTP server timeout to its default value. retry Reset the TFTP server retries to its default value.174 451-0310E Specifies the domain name of the LX unit. Syntax domain name NAME Where Means Usage Guidelines The portion of the domain name that follows the period is the domain name suffix. For example, com is the suffix in the domain name boston_office.com. Example domain name boston_office.com domain name NAME The domain name for the LX unit. The domain name should include a period (.) and a suffix.451-0310E 175 When the end command is issued in the Configuration Command Mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end176 451-0310E Returns the user to the previous command mode. For example, if the current command mode is Configuration, issuing this command will return the user to the Superuser command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. As noted above, issuing the exit command in the Configuration command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than User. For example, issuing the exit command in the Interface command mode returns the user to the Configuration command mode; issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 177 Enables the finger daemon (fingerd) for exchanging information between hosts about users who are logged on to the LX unit. Syntax fingerd enable Example fingerd enable fingerd enable178 451-0310E Configures the network gateway IP address for the LX unit. Syntax gateway A.B.C.D Where Means Example gateway 119.20.112.47 gateway A.B.C.D The IP Address of the router/gateway that is to be used as the default route for the LX unit.451-0310E 179 Configures a network name for the LX unit. Syntax hostname NAME Where Means Examples hostname boston_office hostname a123456 hostname NAME A text string of up to 15 alphanumeric characters that specifies the network name for the LX unit.180 451-0310E Enters the Interface command mode. In the Interface command mode, the user can create or change an interface record. For more information on the Interface command mode, refer to “Interface Commands” on page 275. Syntax interface NUMBER Where Means Example interface 1 interface NUMBER Specifies an interface number. In the Interface command mode, you can configure the characteristics of the IP interface that is associated with this interface number. The maximum number of IP interfaces is 4. If the IP interface does not exist, it is created when this command is executed.451-0310E 181 Displays information that describes how to set up IP filtering with the iptables command. Syntax iptables Usage Guidelines When you execute this command, the following text is displayed: You must navigate to the Linux shell and use the iptables commands that are available in the kernel. You can run a shell from the Superuser Command Mode by launching the command "shell". For further details, please refer to the LX-Series Commands Reference Guide. Iptables are used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Iptables help manage IP traffic by creating filters known as chains. Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packet that matches. The options are ACCEPT, DENY, or DROP. The INPUT chain filters packets coming from the LAN to the LX-Series and the OUTPUT chain filters packets leaving the LX-Series destined for the LAN. After making any changes, you should always run the command "/sbin/iptables-save -f /config/iptables.conf" to save the changes. To make the change permanent through reboots you must save the configuration change by running the command "save configuration" from the superuser command mode. Example iptables iptables182 451-0310E Specifies the physical location of the LX unit. NOTE: To display this information, execute the show system characteristics command in the Superuser Command Mode. For more information, refer to “show system characteristics” on page 139. Syntax location STRING Where Means Example location UpstairsLab location STRING A text string that describes the physical location of the LX unit.451-0310E 183 Specifies the size of log files on the LX unit. Syntax log size NUMBER Where Means Example log size 100000 log size NUMBER A whole number that specifies the size, in bytes, for the LX-unit log files. The number must be greater than 1023 and less than 128001.184 451-0310E Enters the Menu command mode. In the Menu command mode, you can create, delete, or merge menus and enter the Menu Editing command mode. For more information on the Menu command mode, refer to “Menu Commands” on page 479. Syntax menu Example menu menu451-0310E 185 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Configuration command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Configuration command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no location no feature_name The name of the feature or boolean parameter that is to be disabled.186 451-0310E Enters the Notification command mode. In the Notification command mode, you can configure the sending of log messages to email addresses, pagers, remote syslogd, asynchronous ports, or local files. For more information on the Notification command mode, refer to “Notification Commands” on page 509. Syntax notification Example notification notification451-0310E 187 Enables the Network Time Protocol (NTP). Syntax ntp enable Usage Guidelines Before you can enable NTP, you must specify the IP Address of the NTP server. Refer to “ntp server address” on page 188 for more information on specifying the IP Address of the NTP server. Example ntp enable ntp enable188 451-0310E Specifies the IP address of the Network Time Protocol (NTP) server for the LX unit. Syntax ntp server address Where Means Usage Guidelines After you have specified the NTP server, you can enable NTP. Refer to “ntp enable” on page 187 for more information on enabling NTP. Example ntp server address 119.20.110.87 ntp server address ip_address Specifies the IP Address of the NTP server on the network.451-0310E 189 Assigns outlets to an outlet group. Syntax outlet group | Where Means Usage Guidelines When outlets are assigned to an outlet group, they can be configured and managed as a group. This can be more efficient than configuring and managing outlet individually. Refer to the following commands for more information about configuring and managing outlet groups: • “outlet group name” on page 190 • “outlet group off time” on page 191 • “show outlet group status” on page 107 Examples outlet group 2 2:5 3:7 4:2 4:3 4:5 outlet group Testoutlets 3:4 5:1 5:2 5:3 5:4 5:5 5:6 6:2 6:3 outlet group group_number An integer number that identifies the group to which outlets are being assigned. The allowable values are 1 - 16. group_name The descriptive name of the group to which outlets are being assigned. (Refer to “outlet group name” on page 190 for information on assigning a descriptive name to an outlet group.) outlet_list Specifies the outlets that are being added to the outlet group. The Power Master number, combined with the outlet number, identifies each outlet. For example, 2:5 identifies outlet 5 on the device that is managed from port 2. If you specify more than one outlet in the outlet_list, the outlets must be separated by blank spaces; for example, 2:5 3:7 4:2 4:3 4:5. Up to 16 outlets can be included in an outlet group.190 451-0310E Specifies a descriptive name for an outlet group. NOTE: Before you can specify a descriptive name for an outlet group, you must create the outlet group with the outlet group command (see page 189). Syntax outlet group name Where Means Example outlet group 5 name Testoutlets outlet group name group_number An integer number that specifies an existing outlet group. group_name Specifies a descriptive name for the outlet group. This can be a text string of up to 15 characters.451-0310E 191 Specifies the length of time, in seconds, that outlets must remain off before they can be turned back on. Syntax outlet group | off time NUMBER Where Means Example outlet group Testoutlets off time 10 outlet group 14 off time 20 outlet group off time group_number An integer number that specifies an existing outlet group. group_name The descriptive name of an existing outlet group. NUMBER An integer number that specifies the off time, in seconds, for the outlet group. After the outlets in the group have been turned off with the outlet command (see page 75), they must remain off for at least this length of time. The allowable values are 0 - 255. The default value is 10.192 451-0310E Allows you to set, or change, the Superuser password for the LX unit. (The default Superuser password for the LX unit is system.) Syntax password Usage Guidelines When you execute the password command, the following prompt is displayed: Enter your NEW password : Type the new Superuser password at the above prompt and press the Enter key. After you press the Enter key, the following prompt is displayed: Re-Enter your NEW password: Re-type the new Superuser password at the above prompt and press the Enter key. The Superuser password for the LX unit is now changed. Example password password451-0310E 193 Sets the Superuser password for the LX unit to the default value. (The default Superuser password for the LX unit is system.) Syntax password enable Usage Guidelines When you execute the password enable command, the following informational message is displayed: Password was set to its default value Example password enable password enable194 451-0310E Configures an LX asynchronous port, or a range of LX asynchronous ports. When this command is executed in the Configuration Command Mode, the LX CLI goes into the Asynchronous command mode for the port number, or range of ports. The Asynchronous command mode includes commands for configuring asynchronous ports. Refer to “Asynchronous Commands” on page 307 for more information on the Asynchronous command mode. Syntax port async [] Where Means Example port async 2 port async 3 7 port async first_port The first port in a range of ports that are to be configured as asynchronous. last_port The last port in a range of ports that are to be configured as asynchronous. Note: If this argument is left out of the command, only the port specified in is configured as asynchronous.451-0310E 195 Enters the Ethernet Command Mode for an Ethernet port. Refer to “Ethernet Commands” on page 361 for more information on the Ethernet Command Mode. Syntax port ethernet NUMBER Where Means Example port ethernet 1 port ethernet NUMBER Specifies the Ethernet port to be configured. The only port that can be configured as an Ethernet port is port 1. 196 451-0310E Specifies the ppciboot address for the LX unit. The ppciboot address is used as the IP Address of the LX unit when any of the ppciboot assignment options is selected as “User Defined”. Refer to “ppciboot address assignment option” on page 197 for more information on the ppciboot assignment options. Syntax ppciboot address Where Means Example ppciboot address 117.23.79.81 ppciboot address ip_address The ppciboot address451-0310E 197 Specifies the ppciboot assignment option for the LX unit. The ppciboot assignment option defines how the LX unit will obtain its IP information. Syntax ppciboot address assignment NUMBER option user|dhcp|rarp|bootp|none Where Means Usage Guidelines You can use this command to specify up to 4 ppciboot assignment options for the LX unit. You must specify a priority for each ppciboot assignment option that you specify with this command. The allowable values are 1, 2, 3, and 4. For example, if 1 is specified as the priority for DHCP, it means that the first attempt at loading an IP Address will be via DHCP; if 2 is specified as the priority for RARP, it means that the second attempt at loading an IP Address will be via RARP, and so on. Examples ppciboot address assignment 1 option dhcp ppciboot address assignment 2 option rarp ppciboot address assignment 3 option bootp ppciboot address assignment 4 option user ppciboot address assignment 3 option none ppciboot address assignment option NUMBER The priority for the ppciboot assignment options. The allowable values are 1, 2, 3, and 4. For more information, refer to “Usage Guidelines” (below). user Specifies that the ppciboot assignment option is user-defined. This means that the user must manually assign all of the IP information. dhcp The IP information will be assigned via a DHCP server. rarp The IP information will be assigned via a RARP server. bootp The IP information will be assigned via a BOOTP server. none Disables the ppciboot assignment option associated with the specified priority. For example, the command ppciboot ip assignment 2 option none disables the ppciboot assignment option associated with priority 2.198 451-0310E Specifies the speed and duplex mode of the ppciboot Ethernet network link. Syntax ppciboot ethernet network link auto|10half|100half|10full|100full Where Means Examples ppciboot ethernet network link auto ppciboot ethernet network link 10half ppciboot ethernet network link 100half ppciboot ethernet network link 10full ppciboot ethernet network link 100full ppciboot ethernet network link auto The ppciboot Ethernet network link will auto-negotiate its port speed and duplex mode. This is the default setting. 10half Sets a speed of 10 Megabytes per second, and a duplex mode of half duplex, for the Ethernet network link. 100half Sets a speed of 100 Megabytes per second, and a duplex mode of half duplex, for the Ethernet network link. 10full Sets a speed of 10 Megabytes per second, and a duplex mode of full duplex, for the Ethernet network link. 100full Sets a speed of 100 Megabytes per second, and a duplex mode of full duplex, for the Ethernet network link.451-0310E 199 Specifies the ppciboot gateway. This gateway is used when any of the ppciboot assignment options is selected as “User Defined”. Refer to “ppciboot address assignment option” on page 197 for more information on ppciboot assignment options. Syntax ppciboot gateway Where Means Example ppciboot gateway 119.20.110.7 ppciboot gateway ip_address The IP address of the ppciboot gateway.200 451-0310E Specifies the filename of the LX software image. Syntax ppciboot image filename Where Means Example ppciboot image filename new_linuxito.img ppciboot image filename filename The filename of the LX software image.451-0310E 201 Specifies the source from which the LX software image will be loaded. NOTE: The ppciboot image file is specified using the ppciboot image filename command (see page 200). Syntax ppciboot image load from flash|network Where Means Examples ppciboot image load from flash ppciboot image load from network ppciboot image load from flash Load the LX software image from the local flash. network Load the LX software image from the network TFTP server. (The TFTP server for loading the LX software image is defined using the ppciboot tftp command (see page 203).)202 451-0310E Specifies the ppciboot subnet mask for the LX unit. This is used as the subnet mask for the LX unit when any of the ppciboot assignment options is selected as “User Defined”. Refer to “ppciboot address assignment option” on page 197 for more information on ppciboot assignment options. Syntax ppciboot mask Where Means Example ppciboot mask 255.255.255.0 ppciboot mask subnet_mask The IP address that will be used as the ppciboot subnet mask.451-0310E 203 Specifies the TFTP server for the LX unit. This TFTP server is used when any of the ppciboot assignment options is selected as “User Defined”. Refer to “ppciboot address assignment option” on page 197 for more information on ppciboot assignment options. Syntax ppciboot tftp server Where Means Example ppciboot tftp server 118.23.109.18 ppciboot tftp server ip_address The IP address of the TFTP server from which the LX software image will be loaded.204 451-0310E Specifies the Primary Domain Name Server (DNS) for the LX unit. Syntax primary dns A.B.C.D Where Means Example primary dns 119.20.112.3 primary dns A.B.C.D The Primary DNS for the LX unit.451-0310E 205 Specifies the interval at which the LX unit will update the RADIUS accounting server with the status of each RADIUS user. Syntax radius period NUMBER Where Means Example radius period 10 radius period NUMBER The interval, in minutes, at which the LX unit will update the RADIUS accounting server with the status of each RADIUS user. The default value is 5. The allowable values are 0 - 255. 206 451-0310E Specifies the IP Address of the RADIUS primary accounting server for the LX unit. Syntax radius primary accounting server address A.B.C.D Where Means Example radius primary accounting server address 152.34.65.33 radius primary accounting server address A.B.C.D The IP Address of the RADIUS primary accounting server for the LX unit.451-0310E 207 Specifies the RADIUS primary accounting server UDP port for the LX unit. (This is the UDP port to which the LX unit performs RADIUS accounting.) Syntax radius primary accounting server port NUMBER Where Means Example radius primary accounting server port 1646 radius primary accounting server port NUMBER The UDP port, on the RADIUS primary accounting server, to which the LX unit performs RADIUS accounting. The allowable values are 0 - 65535. Note: If you do not specify a RADIUS primary accounting port with this command, the LX unit will use the default RADIUS primary accounting port of 1813.208 451-0310E Specifies the maximum number of retries that the LX unit will have for transmitting an Accounting Request to the RADIUS primary accounting server when the LX unit receives no Accounting Response from the RADIUS primary accounting server. Syntax radius primary accounting server retransmit NUMBER Where Means Example radius primary accounting server retransmit 3 radius primary accounting server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the RADIUS primary accounting server. The allowable values are 0 - 255. The default value is 3.451-0310E 209 Specifies the RADIUS secret shared between the LX unit and the RADIUS primary accounting server used for encrypting communications between them. Syntax radius primary accounting server secret WORD Where Means Example radius primary accounting server secret AaBbCc radius primary accounting server secret WORD A text string of up to 16 characters. The string is case sensitive.210 451-0310E Specifies the length of time that the LX unit will wait for the RADIUS primary accounting server to respond before retransmitting packets to the RADIUS primary accounting server. Syntax radius primary accounting server timeout NUMBER Where Means Example radius primary accounting server timeout 3 radius primary accounting server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a RADIUS primary accounting server to respond before retransmitting Accounting Requests to the RADIUS primary accounting server. The default value is 5. The allowable values are 1 - 255.451-0310E 211 Specifies the RADIUS primary authentication server address for the LX unit. Syntax radius primary authentication server address A.B.C.D Where Means Example radius primary authentication server address 152.34.65.37 radius primary authentication server address A.B.C.D The IP Address of the RADIUS primary authentication server for the LX unit.212 451-0310E Specifies UDP port for the RADIUS primary authentication server. Syntax radius primary authentication server port NUMBER Where Means Example radius primary authentication server port 1645 radius primary authentication server port NUMBER The RADIUS primary authentication server UDP port for the LX unit. This value must match the primary accounting UDP port that is being used on the RADIUS primary authentication server. The allowable values are 0 - 65535. Note: If you do not specify a RADIUS primary authentication port with this command, the LX unit will use the default RADIUS primary authentication port of 1812.451-0310E 213 Specifies the maximum number of retries that the LX unit will have for transmitting an Access Request to the RADIUS primary authentication server when the LX unit receives no Access Accept or Reject messages from the RADIUS primary authentication server. Syntax radius primary authentication server retransmit NUMBER Where Means Example radius primary authentication server retransmit 3 radius primary authentication server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the RADIUS primary authentication server. The allowable values are 0 - 255. The default value is 3.214 451-0310E Specifies the RADIUS secret shared between the LX unit and the RADIUS primary authentication server used for encrypting communications between them. Syntax radius primary authentication server secret WORD Where Means Example radius primary authentication server secret AaBbCc radius primary authentication server secret WORD A text string of up to 16 characters. The string is case sensitive.451-0310E 215 Specifies the length of time that the LX unit will wait for the RADIUS primary authentication server to respond before retransmitting packets to the RADIUS primary authentication server. Syntax radius primary authentication server timeout NUMBER Where Means Example radius primary authentication server timeout 3 radius primary authentication server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a RADIUS primary authentication server to respond before retransmitting Access-Request messages to the RADIUS primary authentication server. The default value is 5. The allowable values are 1 - 255.216 451-0310E Specifies the IP Address of the RADIUS secondary accounting server for the LX unit. Syntax radius secondary accounting server address A.B.C.D Where Means Example radius secondary accounting server address 152.34.65.33 radius secondary accounting server address A.B.C.D The IP Address of the RADIUS secondary accounting server for the LX unit.451-0310E 217 Specifies the RADIUS secondary accounting server UDP port for the LX unit. (This is the UDP port to which the LX unit performs RADIUS accounting.) Syntax radius secondary accounting server port NUMBER Where Means Example radius secondary accounting server port 1813 radius secondary accounting server port NUMBER The UDP port, on the RADIUS secondary accounting server, to which the LX unit performs RADIUS accounting. The allowable values are 0 - 65535. Note: If you do not specify a RADIUS secondary accounting port with this command, the LX unit will use the default RADIUS secondary accounting port of 1813.218 451-0310E Specifies the maximum number of retries that the LX unit will have for transmitting an Accounting Request to the RADIUS secondary accounting server when the LX unit receives no Accounting Response from the RADIUS secondary accounting server. Syntax radius secondary accounting server retransmit NUMBER Where Means Example radius secondary accounting server retransmit 3 radius secondary accounting server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the RADIUS secondary accounting server. The allowable values are 0 - 255. The default value is 3.451-0310E 219 Specifies the RADIUS secret shared between the LX unit and the RADIUS secondary accounting server used for encrypting communications between them. Syntax radius secondary accounting server secret WORD Where Means Example radius secondary accounting server secret AaBbCc radius secondary accounting server secret WORD A text string of up to 16 characters. The string is case sensitive.220 451-0310E Specifies the length of time that the LX unit will wait for the RADIUS secondary accounting server to respond before retransmitting packets to the RADIUS secondary accounting server. Syntax radius secondary accounting server timeout NUMBER Where Means Example radius secondary accounting server timeout 3 radius secondary accounting server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a RADIUS secondary accounting server to respond before retransmitting Accounting Requests to the RADIUS secondary accounting server. The default value is 5. The allowable values are 1 - 255.451-0310E 221 Specifies the RADIUS secondary authentication server address for the LX unit. Syntax radius secondary authentication server address A.B.C.D Where Means Example radius secondary authentication server address 152.34.65.37 radius secondary authentication server address A.B.C.D The IP Address of the RADIUS secondary authentication server for the LX unit.222 451-0310E Specifies the UDP port for the RADIUS secondary authentication server. Syntax radius secondary authentication server port NUMBER Where Means Example radius secondary authentication server port 1812 radius secondary authentication server port NUMBER The RADIUS secondary authentication server UDP port for the LX unit. This value must match the secondary accounting UDP port that is being used on the RADIUS secondary authentication server. The allowable values are 0 - 65535. Note: If you do not specify a RADIUS secondary authentication port with this command, the LX unit will use the default RADIUS secondary authentication port of 1812.451-0310E 223 Specifies the maximum number of retries that the LX unit will have for transmitting an Access Request to the RADIUS secondary authentication server when the LX unit does not receive Access Accept or Reject messages from the RADIUS secondary authentication server. Syntax radius secondary authentication server retransmit NUMBER Where Means Example radius secondary authentication server retransmit 3 radius secondary authentication server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the RADIUS secondary authentication server. The allowable values are 0 - 255. The default value is 3.224 451-0310E Specifies the RADIUS secret shared between the LX unit and the RADIUS secondary authentication server used for encrypting communications between them. Syntax radius secondary authentication server secret WORD Where Means Example radius secondary authentication server secret AaBbCc radius secondary authentication server secret WORD A text string of up to 16 characters. The string is case sensitive.451-0310E 225 Specifies the length of time that the LX unit will wait for the RADIUS secondary authentication server to respond before retransmitting packets to the RADIUS secondary authentication server. Syntax radius secondary authentication server timeout NUMBER Where Means Example radius secondary authentication server timeout 3 radius secondary authentication server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a RADIUS secondary authentication server to respond before retransmitting Access-Request messages to the RADIUS secondary authentication server. The default value is 5. The allowable values are 1 - 255.226 451-0310E Creates a static route for the LX unit. Syntax route address Where Means Usage Guidelines To delete a route, use the no route command. For example, the command no route 3 deletes Route 3. Example route 3 address 119.20.112.39 route address route_number Specifies a route number for the static route. destination_ip Specifies the destination IP Address of the route.451-0310E 227 Creates a gateway that a static route will use to reach its destination. Syntax route gateway Where Means Example route 3 gateway 119.20.112.47 route gateway route_number Specifies the route number of a static route. gateway_ip Specifies the IP Address of the gateway by which the destination will be reached.228 451-0310E Creates a subnet mask for a static route. Syntax route mask Where Means Example route 3 mask 255.255.255.0 route mask route_number Specifies the route number of a static route. subnet_mask Specifies the subnet mask that will be used by the static route.451-0310E 229 Specifies the Secondary Domain Name Server (DNS) for the LX unit. Syntax secondary dns A.B.C.D Where Means Example secondary dns 119.20.112.3 secondary dns A.B.C.D The Secondary DNS for the LX unit.230 451-0310E Specifies the encryption method for SecurID authentication on the LX unit. Syntax securid authentication encryption des|sdi Where Means Example securid authentication encryption des securid authentication encryption sdi securid authentication encryption des Specifies DES as the SecurID encryption method. sdi Specifies SDI as the SecurID encryption method.451-0310E 231 Specifies the LX UDP port that the that the LX unit and the SecurID authentication server will use for communication. Syntax securid authentication port Where Means Example securid authentication port 5500 securid authentication port port_number The port number of a UDP port on the LX unit. This can be any UDP port number that is not currently in use. The allowable values are 0 - 65535.232 451-0310E Specifies the maximum number of retries that the LX unit will have for transmitting an Access Request to the SecurID authentication server when the LX unit receives no Access Accept or Reject messages from the SecurID primary authentication server. Syntax securid authentication retransmit NUMBER Where Means Example securid authentication retransmit 7 securid authentication retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the SecurID authentication server. This can be any integer number from 0 through 255. The default value is 3.451-0310E 233 Specifies the length of time that the LX unit will wait for the SecurID authentication server to respond before retransmitting packets to the SecurID authentication server. Syntax securid authentication timeout NUMBER Where Means Example securid authentication timeout 3 securid authentication timeout NUMBER The length of time, in seconds, that the LX unit will wait for the SecurID authentication server to respond before retransmitting Access-Request messages to the SecurID authentication server. This can be any integer number from 0 through 255. The default value is 3.234 451-0310E Specifies the SecurID authentication version that will be used on the LX unit. Syntax securid authentication version legacy|version_5 Where Means Example securid authentication version legacy securid authentication version version_5 securid authentication version legacy The version of SecurID that will be used is older than Version 5. version_5 Version 5 SecurID authentication will be used.451-0310E 235 Specifies the SecurID master authentication server address for the LX unit. NOTE: You can not specify a SecurID master authentication server for Version 5, or higher, or SecurID. Syntax securid master authentication server address A.B.C.D Where Means Example securid master authentication server address 192.16.65.38 securid master authentication server address A.B.C.D The IP Address of the SecurID master authentication server for the LX unit.236 451-0310E Specifies the host name of the SecurID master authentication server for the LX unit. Syntax securid master authentication server name HOSTNAME Where Means Example securid master authentication server name bigsky22 securid master authentication server name HOSTNAME The host name of the SecurID master authentication server for the LX unit.451-0310E 237 Specifies the SecurID primary authentication server address for the LX unit. Syntax securid primary authentication server address A.B.C.D Where Means Example securid primary authentication server address 138.30.65.34 securid primary authentication server address A.B.C.D The IP Address of the SecurID primary authentication server for the LX unit.238 451-0310E Specifies the host name of the SecurID primary authentication server for the LX unit. Syntax securid primary authentication server name HOSTNAME Where Means Example securid primary authentication server name bigsky1 securid primary authentication server name HOSTNAME The host name of the SecurID primary authentication server for the LX unit.451-0310E 239 Specifies the SecurID slave authentication server address for the LX unit. NOTE: You can not specify a SecurID slave authentication server for Version 5, or higher, or SecurID. Syntax securid slave authentication server address A.B.C.D Where Means Example securid slave authentication server address 192.16.23.115 securid slave authentication server address A.B.C.D The IP Address of the SecurID slave authentication server for the LX unit.240 451-0310E Specifies the host name of the SecurID slave authentication server for the LX unit. Syntax securid slave authentication server name HOSTNAME Where Means Example securid slave authentication server name bigsky37 securid slave authentication server name HOSTNAME The host name of the SecurID slave authentication server for the LX unit.451-0310E 241 Adds a host name and its address to a Service Table to provide the CLI user with a means for address resolution. Syntax service NAME A.B.C.D Where Means Example service Finance_Server 119.20.112.3 service NAME A text string that specifies the name of the IP device. A.B.C.D The address of the IP device.242 451-0310E Enters the SNMP command mode. The SNMP command prompt (e.g., Snmp:0 >>) is displayed while you are in the SNMP command mode. For more information, refer to “SNMP Commands” on page 409. Syntax snmp Example snmp snmp451-0310E 243 Enables the Simple Network Management Protocol (SNMP) for use in managing the LX unit. Syntax snmp enable Example snmp enable snmp enable244 451-0310E Enables the LX unit to function as an SSH server. This makes it possible for SSH clients to make connections to the LX unit. Syntax ssh enable Example ssh enable ssh enable451-0310E 245 Specifies that the LX unit will use Version 1 (V1) of SSH. Syntax ssh v1 Example ssh v1 ssh v1246 451-0310E Specifies that the LX unit will use Version 2 (V2) of SSH. Syntax ssh v2 Example ssh v2 ssh v2451-0310E 247 Enters the Subscriber Command Mode. For more information on the Subscriber Command Mode, refer to “Subscriber Commands” on page 367. Syntax subscriber NAME Where Means Usage Guidelines The maximum number of subscribers on an LX unit is equal to double the number of ports on the unit. For example, the maximum number of subscribers is 16 on an 8-port unit, 32 on a 16- port unit, 64 on a 32-port unit, and 96 on a 48-port unit. Example subscriber mark subscriber NAME The name of the subscriber that is to be configured. If the subscriber does not exist, a new subscriber record is created.248 451-0310E Specifies the interval at which the LX unit will update the TACACS+ accounting server with the status of each TACACS+ user. Syntax tacacs+ period NUMBER Where Means Example tacacs+ period 10 tacacs+ period NUMBER The interval, in minutes, at which the LX unit will update the TACACS+ accounting server with the status of each TACACS+ user. The default value is 5. The allowable values are 0 - 255. 451-0310E 249 Specifies the IP Address of the TACACS+ primary accounting server for the LX unit. Syntax tacacs+ primary accounting server address A.B.C.D Where Means Example tacacs+ primary accounting server address 152.34.65.33 tacacs+ primary accounting server address A.B.C.D The IP Address of the TACACS+ primary accounting server for the LX unit.250 451-0310E Specifies the TACACS+ primary accounting server UDP port for the LX unit. (This is the UDP port to which the LX unit performs TACACS+ accounting.) Syntax tacacs+ primary accounting server port NUMBER Where Means Example tacacs+ primary accounting server port 1646 tacacs+ primary accounting server port NUMBER The UDP port, on the TACACS+ primary accounting server, to which the LX unit performs TACACS+ accounting. The allowable values are 0 - 65535. Note: If you do not specify a TACACS+ primary accounting port with this command, the LX unit will use the default TACACS+ primary accounting port of 1813.451-0310E 251 Specifies the maximum number of retries that the LX unit will have for transmitting an Accounting Request to the TACACS+ primary accounting server when the LX unit does not receive an Accounting Response from the TACACS+ primary accounting server. Syntax tacacs+ primary accounting server retransmit NUMBER Where Means Example tacacs+ primary accounting server retransmit 3 tacacs+ primary accounting server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the TACACS+ primary accounting server. The allowable values are 0 - 255. The default value is 3.252 451-0310E Specifies the TACACS+ secret shared between the LX unit and the TACACS+ primary accounting server used for encrypting communications between them. Syntax tacacs+ primary accounting server secret WORD Where Means Example tacacs+ primary accounting server secret AaBbCc tacacs+ primary accounting server secret WORD A text string of up to 16 characters. The string is case sensitive.451-0310E 253 Specifies the length of time that the LX unit will wait for the TACACS+ primary accounting server to respond before retransmitting packets to the TACACS+ primary accounting server. Syntax tacacs+ primary accounting server timeout NUMBER Where Means Example tacacs+ primary accounting server timeout 3 tacacs+ primary accounting server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a TACACS+ primary accounting server to respond before retransmitting Accounting Requests to the TACACS+ primary accounting server. The default value is 5. The allowable values are 1 - 255.254 451-0310E Specifies the TACACS+ primary authentication server address for the LX unit. Syntax tacacs+ primary authentication server address A.B.C.D Where Means Example tacacs+ primary authentication server address 152.34.65.37 tacacs+ primary authentication server address A.B.C.D The IP Address of the TACACS+ primary authentication server for the LX unit.451-0310E 255 Specifies UDP port for the TACACS+ primary authentication server. Syntax tacacs+ primary authentication server port NUMBER Where Means Example tacacs+ primary authentication server port 1645 tacacs+ primary authentication server port NUMBER The TACACS+ primary authentication server UDP port for the LX unit. This value must match the primary accounting UDP port that is being used on the TACACS+ primary authentication server. The allowable values are 0 - 65535. Note: If you do not specify a TACACS+ primary authentication port with this command, the LX unit will use the default TACACS+ primary authentication port of 1812.256 451-0310E Specifies the maximum number of retries that the LX unit will have for transmitting an Access Request to the TACACS+ primary authentication server when the LX unit does not receive an Access Accept or Reject messages from the TACACS+ primary authentication server. Syntax tacacs+ primary authentication server retransmit NUMBER Where Means Example tacacs+ primary authentication server retransmit 3 tacacs+ primary authentication server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the TACACS+ primary authentication server. The allowable values are 0 - 255. The default value is 3.451-0310E 257 Specifies the TACACS+ secret shared between the LX unit and the TACACS+ primary authentication server used for encrypting communications between them. Syntax tacacs+ primary authentication server secret WORD Where Means Example tacacs+ primary authentication server secret AaBbCc tacacs+ primary authentication server secret WORD A text string of up to 16 characters. The string is case sensitive.258 451-0310E Specifies the length of time that the LX unit will wait for the TACACS+ primary authentication server to respond before retransmitting packets to the TACACS+ primary authentication server. Syntax tacacs+ primary authentication server timeout NUMBER Where Means Example tacacs+ primary authentication server timeout 3 tacacs+ primary authentication server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a TACACS+ primary authentication server to respond before retransmitting Access-Request messages to the TACACS+ primary authentication server. The allowable values are 0 - 255. The default value is 5. 451-0310E 259 Specifies the IP Address of the TACACS+ secondary accounting server for the LX unit. Syntax tacacs+ secondary accounting server address A.B.C.D Where Means Example tacacs+ secondary accounting server address 152.34.65.33 tacacs+ secondary accounting server address A.B.C.D The IP Address of the TACACS+ secondary accounting server for the LX unit.260 451-0310E Specifies the TACACS+ secondary accounting server UDP port for the LX unit. (This is the UDP port to which the LX unit performs TACACS+ accounting.) Syntax tacacs+ secondary accounting server port NUMBER Where Means Example tacacs+ secondary accounting server port 1646 tacacs+ secondary accounting server port NUMBER The UDP port, on the TACACS+ secondary accounting server, to which the LX unit performs TACACS+ accounting. The allowable values are 0 - 65535. Note: If you do not specify a TACACS+ secondary accounting port with this command, the LX unit will use the default TACACS+ secondary accounting port of 1813.451-0310E 261 Specifies the maximum number of retries that the LX unit will have for transmitting an Accounting Request to the TACACS+ secondary accounting server when the LX unit does not receive an Accounting Response from the TACACS+ secondary accounting server. Syntax tacacs+ secondary accounting server retransmit NUMBER Where Means Example tacacs+ secondary accounting server retransmit 3 tacacs+ secondary accounting server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the TACACS+ secondary accounting server. The allowable values are 0 - 255. The default value is 3.262 451-0310E Specifies the TACACS+ secret shared between the LX unit and the TACACS+ secondary accounting server used for encrypting communications between them. Syntax tacacs+ secondary accounting server secret WORD Where Means Example tacacs+ secondary accounting server secret AaBbCc tacacs+ secondary accounting server secret WORD A text string of up to 16 characters. The string is case sensitive.451-0310E 263 Specifies the length of time that the LX unit will wait for the TACACS+ secondary accounting server to respond before retransmitting packets to the TACACS+ secondary accounting server. Syntax tacacs+ secondary accounting server timeout NUMBER Where Means Example tacacs+ secondary accounting server timeout 3 tacacs+ secondary accounting server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a TACACS+ secondary accounting server to respond before retransmitting Accounting Requests to the TACACS+ secondary accounting server. The allowable values are 0 - 255. The default value is 5. 264 451-0310E Specifies the TACACS+ secondary authentication server address for the LX unit. Syntax tacacs+ secondary authentication server address A.B.C.D Where Means Example tacacs+ secondary authentication server address 152.34.65.37 tacacs+ secondary authentication server address A.B.C.D The IP Address of the TACACS+ secondary authentication server for the LX unit.451-0310E 265 Specifies the UDP port for the TACACS+ secondary authentication server. Syntax tacacs+ secondary authentication server port NUMBER Where Means Example tacacs+ secondary authentication server port 1645 tacacs+ secondary authentication server port NUMBER The TACACS+ secondary authentication server UDP port for the LX unit. This value must match the secondary accounting UDP port that is being used on the TACACS+ secondary authentication server. The allowable values are 0 - 65535. Note: If you do not specify a TACACS+ secondary authentication port with this command, the LX unit will use the default TACACS+ secondary authentication port of 1812.266 451-0310E Specifies the maximum number of retries that the LX unit will have for transmitting an Access Request to the TACACS+ secondary authentication server when the LX unit does not receive an Access Accept or Reject message from the TACACS+ secondary authentication server. Syntax tacacs+ secondary authentication server retransmit NUMBER Where Means Example tacacs+ secondary authentication server retransmit 3 tacacs+ secondary authentication server retransmit NUMBER The maximum number of times that the LX unit will attempt to contact the TACACS+ secondary authentication server. The allowable values are 0 - 255. The default value is 3.451-0310E 267 Specifies the TACACS+ secret shared between the LX unit and the TACACS+ secondary authentication server used for encrypting communications between them. Syntax tacacs+ secondary authentication server secret WORD Where Means Example tacacs+ secondary authentication server secret AaBbCc tacacs+ secondary authentication server secret WORD A text string of up to 16 characters. The string is case sensitive.268 451-0310E Specifies the length of time that the LX unit will wait for the TACACS+ secondary authentication server to respond before retransmitting packets to the TACACS+ secondary authentication server. Syntax tacacs+ secondary authentication server timeout NUMBER Where Means Example tacacs+ secondary authentication server timeout 3 tacacs+ secondary authentication server timeout NUMBER The length of time, in seconds, that the LX unit will wait for a TACACS+ secondary authentication server to respond before retransmitting Access-Request messages to the TACACS+ secondary authentication server. The allowable values are 0 - 255. The default value is 5. 451-0310E 269 Specifies that a Superuser password request will be sent to TACACS+. Syntax tacacs+ superuser password request enable Usage Guidelines When this setting is disabled, the local Superuser password (system) will be used to enter the Superuser Command Mode. Use the no tacacs+ superuser password request command to disable this setting. When this setting is enabled, the superuser password that resides on the TACACS+ authentication server will be used to enter the Superuser Command Mode. Example tacacs+ superuser password request enable tacacs+ superuser password request enable270 451-0310E Configures the LX unit to support inbound Telnet connections from remote clients. Syntax telnet enable Example telnet enable telnet enable451-0310E 271 Specifies the timeout and retries for the TFTP server. Syntax tftp timeout |retry Where Means Examples tftp timeout 60 tftp retry 6 tftp timeout Set the TFTP server timeout value. retry Set the TFTP server retries value. timeout_num The TFTP server timeout value. retries_num The TFTP server retries value.272 451-0310E Configures the LX unit to use the Time Daemon (timed). Syntax timed enable Example timed enable timed enable451-0310E 273 Sets the timezone for the LX system clock. Syntax timezone GMT + |GMT - |UTC|US Where Means Example timezone GMT + 3 timezone GMT - 7 timezone UTC timezone US Alaska timezone US East-Indiana timezone US Samoa timezone US Mountain timezone GMT + Greenwich Mean Time, plus n hours. The value of n can be any integer from 1 to 12, inclusive. For example, the timezone for Paris is Greenwich Mean time, plus 1 hour (GMT+1). The default value of n is 0. GMT+0 is Greenwich Mean Time itself. GMT - Greenwich Mean Time, minus n hours. The value of n can be any integer from 1 to 12, inclusive. For example, the timezone for New York is Greenwich Mean time, minus 6 hours (GMT-6). The default value of n is 0. GMT-0 is Greenwich Mean Time itself. UTC Specifies that the LX unit will use Coordinated Universal Time. US Specifies that the LX unit will use the United States (US) timezone that is specified in the us_timezone field. us_timezone A US timezone. The allowable values are Alaska, Aleutian, Arizona, Central, Eastern, East-Indiana, Hawaii, Indiana-Starke, Michigan, Mountain, Pacific, and Samoa 274 451-0310E Configures the LX unit to support Web Browser connections from remote clients. Syntax web_server enable Example web_server enable web_server enable451-0310E 275 Chapter 4 Interface Commands The Interface commands are executed in the Interface command mode. When the LX unit is in the Interface command mode, the Interface command prompt (e.g., Intf 1-1:0 >>) is displayed on the terminal screen. The format of the Interface command prompt is as follows: Intf <1st_interface_num>-: >> where <1st_interface_num> identifies the first IP interface in the range of interfaces under configuration. identifies the last IP interface in the range of interfaces under configuration. identifies the current session number. For example, in the Interface command prompt Intf 1-1:0 >> the first IP interface is the IP interface under configuration, and the session number is 0. To enter the Interface command mode, execute the interface command in the Configuration command mode. The interface command is described on page 180.276 451-0310E Specifies the IP Address and subnet mask for the IP interface. Syntax address [mask ] Where Means Examples address 119.20.112.3 address 119.20.112.3 mask 255.0.0.0 address ip_address The IP Address for the IP interface. subnet_mask The subnet mask for the IP interface.451-0310E 277 Enables the Local Authentication feature on the IP interface under configuration. Syntax authentication fallback enable Usage Guidelines Fallback Login is a mechanism for logging in users when RADIUS authentication, or TACACS+ authentication, fails because the authentication server is unreachable. When you log in via Fallback, you are logged in to the IP interface as a nonprivileged user. The authentication challenge will be against the local subscriber database. When both RADIUS and TACACS+ are disabled on the IP interface, Fallback is also disabled. Example authentication fallback enable authentication fallback enable278 451-0310E Enables the Local Authentication feature on the IP interface under configuration. Syntax authentication local enable Example authentication local enable authentication local enable451-0310E 279 Disables the Authentication feature on the IP interface under configuration. Syntax authentication none Example authentication none authentication none280 451-0310E Enables the RADIUS authentication feature on the IP interface under configuration. Syntax authentication radius enable Example authentication radius enable authentication radius enable451-0310E 281 Enables the SecurID authentication feature on the IP interface under configuration. Syntax authentication securid enable Example authentication securid enable authentication securid enable282 451-0310E Enables the TACACS+ authentication feature on the IP interface under configuration. Syntax authentication tacacs+ enable Example authentication tacacs+ enable authentication tacacs+ enable451-0310E 283 Sets the Broadcast Address for the IP interface. Syntax broadcast A.B.C.D Where Means Example broadcast 119.255.255.255 broadcast A.B.C.D The Broadcast Address for the IP interface.284 451-0310E Resets the Maximum Transmission Unit (MTU) size for the IP interface to the factory default (1500). Frames that are larger than the designated MTU size are fragmented before transmission. (Note that the software fragments frames on the transmit side only.) Syntax default mtu Example default mtu default mtu451-0310E 285 Resets any of three rotary parameters to their default values. Syntax default rotary [ssh port|tcp port|type] Where Means Usage Guidelines The modifiers (i.e., ssh port, tcp port, and type) are optional in this command. If this command is executed without a modifier (i.e., default rotary), it will reset the three rotary parameters (SSH port, TCP port, and type) to their default values. Example default rotary ssh port default rotary tcp port default rotary type default rotary default rotary ssh port Resets the SSH UDP port for the rotary to its default value. The default SSH UDP port for a rotary is 1522. tcp port Resets the TCP UDP port for the rotary to its default value. The default SSH TCP port for a rotary is 1500. type Resets the rotary type to the default value of First Available. 286 451-0310E Resets the SSH Keepalive Count, or the SSH Keepalive Interval, to its default value. Syntax default ssh keepalive count|interval Where Means Example default ssh keepalive count default ssh keepalive interval default ssh keepalive count Reset the SSH Keepalive Count to its default value. interval Reset the SSH Keepalive Interval to its default value.451-0310E 287 Resets the SSH UDP port for the IP interface to its default value of 22. Syntax default ssh port Example default ssh port default ssh port288 451-0310E Resets the Telnet UDP port for the IP interface to its default value of 23. Syntax default telnet port Example default telnet port default telnet port451-0310E 289 When the end command is issued in Interface command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command codes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end290 451-0310E Returns the user to the previous command mode. For example, if the current command mode is Interface, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the Interface command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than the User command mode. For example, issuing the exit command in the Menu command mode returns the user to the Configuration command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 291 Sets the subnet mask for the IP interface. Syntax mask Where Means Example mask 255.0.0.0 mask subnet_mask The subnet mask for the IP interface.292 451-0310E Sets the Maximum Transmission Unit (MTU) size for an interface. Frames that are larger than the designated MTU size are fragmented before transmission. (Note that the software fragments frames on the transmit side only.) Syntax mtu NUMBER Where Means Examples mtu 1000 mtu 1200 mtu 1500 mtu NUMBER The MTU size for the interface. This can be any numerical value between 1000 and 1500. (It is recommended that you use a value of 1500 for Ethernet connections.) The default MTU size is 1500.451-0310E 293 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Interface command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Interface command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no ssh keepalive interval no feature_name The name of the feature or boolean parameter that is to be disabled.294 451-0310E Enables the RADIUS accounting feature on the IP interface under configuration. Syntax radius accounting enable Example radius accounting enable radius accounting enable451-0310E 295 Enables you to create rotaries on the IP interface. The term "rotary" refers to the ability to assign the same Internet address or domain name to multiple ports that offer the same type of service. Syntax rotary enable Usage Guidelines In order for this command to take effect, the Telnet protocol must be enabled. Example rotary enable rotary enable296 451-0310E Assigns ports on the LX unit to a rotary. The term "rotary" refers to the ability to assign the same Internet address or domain name to multiple ports that offer the same type of service. Syntax rotary port NUMBER|PORT LIST|all Where Means Usage Guidelines When this command is used to assign ports to a rotary, the IP Address of the IP interface serves as the IP Address of the rotary. To create a rotary, do the following: 1. Create an IP interface (see the “interface” command on page 180). 2. Assign ports to the rotary using the “rotary port” command. 3. Configure the IP Address for the IP interface (see the “address” command on page 276). 4. Configure the Rotary SSH port for the IP interface (see the “rotary ssh port” command on page 297). 5. Configure the Rotary TCP port for the IP interface (see the “rotary tcp port” command on page 298). For example, you could create a rotary on interface 1 with a TCP port of 3500 and an SSH port of 3522. Then you could assign ports 2, 3, and 4 to it. You could connect (assuming all ports have dynamic or remote access) to ports 2, 3, or 4 via TCP port 3500 for telnet, and 3522 for SSH. You could connect to port 2 via TCP port 2200 for telnet or 2222 for SSH, or port 5 via TCP port 2500 for telnet or 2522 for SSH. A telnet connection to the IP address of the LX on TCP port 23 would get you to a virtual port, and an SSH connection to port 22 would also get you to a virtual port via SSH. NOTE: You cannot add the DIAG port (port 0) to a rotary. Examples rotary port 4 rotary port 2 3 5 8 rotary port all rotary port NUMBER The port number of an LX port that is to be assigned to the rotary. PORT LIST A list of ports on the LX unit that are to be assigned to the rotary. The port numbers must be separated by blank spaces (e.g., 2 3 5 8). all Assigns all ports on the LX unit to the rotary.451-0310E 297 Assigns an SSH socket number to the rotary that was created with the rotary port command. (The rotary port command is described on page 296.) Syntax rotary ssh port NUMBER Where Means Examples rotary ssh port 988 rotary ssh port NUMBER The SSH socket number that will be used to make SSH connections to the rotary that was created with the rotary port command. SSH will attempt to connect to the ports in the rotary on a First Available basis. The default SSH socket number is 1522.298 451-0310E Assigns a TCP socket number to the rotary that was created with the rotary port command. (The rotary port command is described on page 296.) Syntax rotary tcp port NUMBER Where Means Examples rotary tcp port 1497 rotary tcp port NUMBER The TCP socket number that will be used to make TCP connections to the rotary that was created with the rotary port command. The default TCP socket number is 1500.451-0310E 299 Specifies the rotary type according to the port search method (Round Robin or First Available). Syntax rotary type round robin|first available Where Means Examples rotary type round robin rotary type first available rotary type round robin The LX unit will search the rotary for an available port, starting with the lowest-numbered port in the rotary. Unlike “First Available”, Round Robin will always go the next available port. For example, if all ports on the rotary are available and a connection to port 3 goes away, the next connection is to port 4. first available An incoming call is connected to the First Available (non-busy) port in the rotary. For example, if ports 1 - 5 are connected in a rotary of ports 1 - 7, and the connection to port 3 went away (so that port 3 was now available), the next connection would be to port 3.300 451-0310E Assigns user-defined Telnet, or SSH, socket numbers to an LX serial port. This is typically done to prevent hackers from accessing LX serial ports via default SSH socket numbers, or default Telnet socket numbers. Syntax serial ssh|telnet Where Means Example serial 4 ssh 983 serial 6 telnet 1297 serial serial_port The port number of an LX serial port. The valid values are 1 through 8. ssh Set the SSH socket number for the LX serial port specified in serial_port. telnet Set the Telnet socket number for the LX serial port specified in serial_port. ssh/telnet_port Specifies the Telnet socket number, or the SSH socket number, for the LX port specified in serial_port. Note: The default SSH and Telnet port numbers are as follows: LX Serial Port Default Telnet Port Default SSH Port 0 0 0 1 2100 2122 2 2200 2222 3 2300 2322 4 2400 2422 5 2500 2522 6 2600 2622 7 2700 2722 8 2800 2822451-0310E 301 Specifies the SSH Keepalive Count for the IP interface. The SSH Keepalive Count is the number of times that an SSH client will attempt to make an SSH connection to the IP interface. Syntax ssh keepalive count NUMBER Where Means Example ssh keepalive count 8 ssh keepalive count NUMBER The SSH Keepalive Count for the IP interface. This can be any integer value.302 451-0310E Specifies the SSH Keepalive Interval for the IP interface. The SSH Keepalive Interval is the length of time, in seconds, between attempts at making an SSH connection to the IP interface. Syntax ssh keepalive interval NUMBER Where Means Example ssh keepalive interval 30 ssh keepalive interval NUMBER The SSH Keepalive Interval for the IP interface. This can be any integer value.451-0310E 303 Specifies the Virtual Port socket number for making an SSH connection to the IP interface. Syntax ssh port NUMBER Where Means Example ssh port 988 ssh port NUMBER The SSH Virtual Port socket number for the IP interface. The default value is 22. 304 451-0310E Enables the TACACS+ accounting feature on the IP interface under configuration. Syntax tacacs+ accounting enable Example tacacs+ accounting enable tacacs+ accounting enable451-0310E 305 Specifies the Virtual Port socket number for making a Telnet connection to the IP interface. Syntax telnet port NUMBER Where Means Example telnet port 1743 telnet port NUMBER The Telnet Virtual Port socket number for the IP interface. The default value is 23. 451-0310E 307 Chapter 5 Asynchronous Commands The Asynchronous port commands are executed in the Asynchronous command mode. When the LX unit is in the Asynchronous command mode, the Asynchronous command prompt (e.g., Async 4-4:0 >>) is displayed on the terminal screen. The format of the Asynchronous command prompt is as follows: Async <1st_port_number>-: >> where <1st_port_number> identifies the first port in the range of ports under configuration. identifies the last port in the range of ports under configuration. identifies the current session number. To enter the Asynchronous command mode, execute the port async command in the Configuration command mode. The port async command is described on page 194. 308 451-0310E Specifies any access method, other than power management, for the asynchronous port(s) under configuration. (Refer to “access power model” on page 309 for information on specifying port(s) for power management.) The default access method is LOCAL on modem ports and on port 0. On all other non-modem ports, the default access method is REMOTE. Syntax access local|dynamic|remote|sensor|databuffer Where Means Usage Guidelines PPP can not be enabled on a port that has autobaud enabled. Examples access local access dynamic access remote access local Specifies that the port(s) under configuration will use the LOCAL access method. The LOCAL access method is used to support inbound connections (i.e., when the user logs in to the port via a terminal or via a dialin connection). dynamic Specifies that the port(s) under configuration will use the DYNAMIC access method. Note: You cannot specify DYNAMIC as the access method for port 0. remote Specifies that the port(s) under configuration will use the REMOTE access method. The REMOTE access method is used to support outbound connections (i.e., connections from the LAN). Note: You cannot specify REMOTE as the access method for port 0. sensor Specifies that the port(s) under configuration will be used as a Temperature/ Humidity Sensor port(s). Refer to Getting Started with the LX Series for information on connecting a Temperature/Humidity Sensor to an LX port. Refer to “show device status” on page 92 to display the temperature and humidity recorded on a Temperature/Humidity Sensor attached to a SENSOR port. Note: You cannot configure port 0 as a SENSOR port. databuffer Specifies that the port(s) under configuration will be used for data buffering. Note: You cannot configure port 0 as a DATABUFFER port.451-0310E 309 Specifies that the asynchronous port(s) under configuration will be used as Power Master(s) for an IR-5100 or IR-5150. Syntax access power model ir5100|ir5150 Where Means Usage Guidelines Refer to the applicable Getting Started Guide for information on connecting an IR-5100 or an IR-5150 unit to an LX asynchronous port. NOTE: You cannot configure port 0 as a Power Master port. Examples access power model ir5100 access power model ir5150 access power model ir5100 Specifies that the asynchronous port(s) under configuration will be Power Master(s) for an IR-5100. ir5150 Specifies that the asynchronous port(s) under configuration will be Power Master(s) for an IR-5150.310 451-0310E Enables Automatic Protocol Detection (APD) on the port(s) under configuration. When APD is enabled, the port will automatically determine the protocol being used to make a connection and adjust port settings appropriately. On all ports except modem ports, APD is disabled by default. Syntax apd enable Usage Guidelines To use APD, the LX port must be configured with PORT ACCESS set to LOCAL or DYNAMIC. Refer to “access” on page 308 for information on setting PORT ACCESS to LOCAL or DYNAMIC. If you do not enable APD, ports can be dedicated for use by a single access serving protocol. An individual port can be configured to accept any connections made via PPP, SLIP (which includes CSLIP), and interactive protocols, as well as both, or neither of these. You cannot enable APD on port 0. If you execute the apd enable command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example apd enable apd enable451-0310E 311 Specifies the number of times an APD-enabled port will attempt to determine the protocol of an incoming connection. NOTE: You cannot execute this command on port 0. Syntax apd retry NUMBER Where Means Example apd retry 6 apd retry NUMBER The number of times that the port will attempt to determine the protocol of an incoming connection. The allowable values are 0 - 255.312 451-0310E Specifies the APD signature for the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax apd signature WORD Where Means Example apd signature FinancePort apd signature WORD A text string.451-0310E 313 Specifies the APD timeout for the port(s) under configuration. The APD timeout is the length of time an APD port can spend attempting to determine which protocol is being used to make a connection. NOTE: You cannot execute this command on port 0. Syntax apd timeout NUMBER Where Means Example apd timeout 30 apd timeout NUMBER Specifies how much time the port can spend in an attempt to determine which protocol is being used to make a connection. Valid timeout values are from 1 to 255 seconds.314 451-0310E Enables an authentication method (Local, RADIUS, SecurID, or TACACS+) as the inbound, or outbound, authentication method for the asynchronous port(s) under configuration. Syntax authentication inbound|outbound local|radius|securid|tacacs+ enable Where Means Examples authentication inbound radius enable authentication outbound radius enable authentication inbound local enable authentication outbound local enable authentication inbound securid enable authentication enable inbound The specified authentication method (Local, RADIUS, SecurID, or TACACS+) will be enabled as the method of inbound authentication for the asynchronous port(s) under configuration. (Inbound authentication is used on ports that have an access method of LOCAL. For more information on LOCAL access, refer to “access” on page 308.) outbound The specified authentication method (Local, RADIUS, SecurID, or TACACS+) will be enabled as the method of outbound authentication for the asynchronous port(s) under configuration. (Outbound authentication is used on ports that have an access method of REMOTE. For more information on REMOTE access, refer to “access” on page 308.) Note: You cannot configure outbound authentication for the DIAG port (port 0). local Enables Local authentication for inbound (or outbound) connections on the asynchronous port(s) under configuration. Under local authentication, the subscriber’s username and password are checked against the subscriber database that resides on the LX. radius Enables RADIUS authentication for inbound (or outbound) connections on the asynchronous port(s) under configuration. Under RADIUS authentication, the authentication is validated by a network-based RADIUS server. securid Enables SecurID authentication for inbound (or outbound) connections on the asynchronous port(s) under configuration. Under SecurID authentication, the authentication is validated by a network-based SecurID server. tacacs+ Enables TACACS+ authentication for inbound (or outbound) connections on the asynchronous port(s) under configuration. Under TACACS+ authentication, the authentication is validated by a network-based TACACS+ server.451-0310E 315 authentication outbound securid enable authentication inbound tacacs+ enable authentication outbound tacacs+ enable authentication enable (continued)316 451-0310E Enables the Fallback Login feature on the asynchronous port(s) under configuration. Syntax authentication fallback enable Usage Guidelines Fallback Login is a mechanism for logging in users when RADIUS, SecurID, or TACACS+, fails because the authentication server is unreachable. When you log in via Fallback, you are logged in to the asynchronous port as a nonprivileged user. The authentication challenge will be against the local subscriber database. When RADIUS, SecurID, and TACACS+ are disabled on the asynchronous port, Fallback is effectively disabled on the port. Example authentication fallback enable authentication fallback enable451-0310E 317 Specifies that the port(s) under configuration will determine the input port speed, parity, and character size for the device connected to the port, and automatically set the matching LX port settings. Autobaud is disabled by default, except on the last physical port. Syntax autobaud enable Usage Guidelines The LX unit uses the ASCII RETURN character to determine the port speed, parity, and character size. Normally, the user must press the RETURN key a few times until the LX unit determines the port speed, parity, and character size, and begins a logon sequence. When APD is enabled, the port will automatically determine the protocol being used to make a connection and adjust port settings appropriately. You can only enable AUTOBAUD where the attached device is configured with the following settings at a port set to LOCAL ACCESS and: • CHARACTER SIZE 8, (7 if EVEN parity) • PARITY NONE (EVEN if character size is set to 7) • SPEED is set to 1200, 2400, 4800, 9600, 19200, or 38400. PPP can not be enabled on a port that uses Remote for an access method. Example autobaud enable autobaud enable318 451-0310E Specifies the number of times an autobaud-enabled port will attempt to determine the input port speed, parity, and character size for the device connected to the port. Syntax autobaud retry NUMBER Where Means Usage Guidelines You cannot enable the Autobaud feature on port 0. If you execute the autobaud enable command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example autobaud retry 6 autobaud retry NUMBER The number of times that the port will attempt to determine the input port speed, parity, and character size for the device connected to the port.451-0310E 319 Specifies that the port(s) under configuration will be automatically dialed. Syntax autodial enable Usage Guidelines You cannot enable the Autodial feature on port 0. If you execute the autodial enable command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example autodial enable autodial enable320 451-0310E Specifies that the port(s) under configuration will automatically log out when the last connection closes. NOTE: The port will also be logged out when the attached equipment drops its signaling. NOTE: Autohangup cannot be enabled on port 0. Syntax autohangup enable Example autohangup enable autohangup enable451-0310E 321 Specifies the banner that is displayed when the user logs in to the port. Syntax banner STRING Where Means Example banner Welcome to Finance banner STRING A text string.322 451-0310E Specifies the number of data bits per character for the port(s) under configuration. Syntax bits NUMBER Where Means Example bits 6 bits NUMBER The number of data bits per character for the port(s) under configuration. The allowable values are 5, 6, 7, or 8.451-0310E 323 Specifies that the port(s) under configuration will send a break signal to the serial line when a break or a Telnet break signal is received, via Telnet or SSH, from a remote host. Syntax break enable Example break enable break enable324 451-0310E Defines a unique break sequence for the port(s) under configuration. When a unique break sequence is defined, it is sent in an out-of-band mode in place of the standard break sequence when the user presses the Break key. Syntax break special Where Means Example break special 1234 break special break_sequence Specifies the break sequence. This can be any combination of up to six characters.451-0310E 325 Specifies the connect command(s) for the asynchronous port(s) under configuration. The connect command(s) are executed when a connection to the port is made, or when the port detects assertion of DSR. This feature is also known as the “Dedicated Async Port Service”. Syntax connect command Where Means Examples connect command telnet 10.1.2.3 connect command mew_startup.exe connect command ssh 10.1.2.3 -p 2022 connect command command_sequence Specifies the connect command(s) for the port. The connect command(s) can be any of the Built-in Linux shell commands. If you specify more than one command, you must separate the commands with semi-colons (;). You can also specify an executable file or a batch file in this field.326 451-0310E Specifies the display option for a databuffer port. Syntax databuffer display enable|prompt Where Means Usage Guidelines You can disable the databuffer display by executing the following command in the Asynchronous command mode: no databuffer display When you execute the no databuffer display command, the contents of the databuffer will not be displayed when you log in to the port. Example databuffer display enable databuffer display prompt databuffer display enable The contents of the data buffer will be displayed for the user as soon as the user logs in to the port; the user will not be prompted for whether or not he wants to display the contents of the data buffer. prompt When the user logs in to the port, he will be prompted for whether or not he wants to display the contents of the data buffer. If the user enters a y response, the contents of the data buffer will be displayed at the user’s terminal. If the user enters an n response, the contents of the data buffer will not be displayed at the user’s terminal.451-0310E 327 Specifies the size, in bytes, of the data buffer on the port(s) under configuration. Syntax databuffer size NUMBER Where Means Example databuffer size 62000 databuffer size NUMBER A whole number that specifies the size, in bytes, for the data buffer on the port(s) under configuration. This can be any number from 28 to 65535. The default databuffer size is 1024 bytes.328 451-0310E Specifies that the data received on the port(s) under configuration will be logged to the local syslogd. NOTE: This feature can only be enabled on asynchronous ports that are configured for data buffering. Refer to the access command on page 308 for information on configuring ports for data buffering. Syntax databuffer syslog enable Example databuffer syslog enable databuffer syslog enable451-0310E 329 Specifies that there will be a timestamp added to every entry of the data buffer for the port(s) under configuration. Syntax databuffer timestamp enable Example databuffer timestamp enable databuffer timestamp enable330 451-0310E Resets the APD retries, APD signature, or APD timeout to the default value. Syntax default apd retry|signature|timeout Where Means Example default apd retry default apd signature default apd timeout default apd retry Resets the apd retry value of the port(s) under configuration to the factory default. signature Resets the apd signature of the port(s) under configuration to the factory default. timeout Resets the apd timeout value of the port(s) under configuration to the factory default.451-0310E 331 Resets the data buffer size on the port(s) under configuration to the factory-default value of 1024 bytes. Syntax default databuffer size Example default databuffer size default databuffer size332 451-0310E Resets all of the parameters of the port(s) under configuration to their factory-default values. Syntax default port Example default port default port451-0310E 333 Resets the off time for the power outlets on the asynchronous port(s) to the default value of 10 seconds. Syntax default power off time Example default power off time default power off time334 451-0310E Resets the speed of the port(s) under configuration to their factory-default values. The default port speed is 9600. Syntax default speed Example default speed default speed451-0310E 335 When the end command is issued in the Asynchronous command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end336 451-0310E Returns the user to the previous command mode. For example, if the current command mode is the Asynchronous command mode, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the Asynchronous command mode returns the user to the previous command mode. The same goes for issuing the exit command in any mode other than the User command mode. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 337 Specifies the type of flow control ("handshaking") that is used by the serial interface(s) of the port(s) under configuration. On all ports except modem ports, the default flow control is XON/XOFF; on modem ports, the default flow control is CTS. Syntax flowcontrol cts|xon Where Means Example flowcontrol cts flowcontrol xon flowcontrol cts The LX unit will use CTS flow control for the specified port(s). xon The LX unit will use XON/XOFF flow control for the specified port(s).338 451-0310E Enters the Modem command mode. For more information on the Modem command mode, refer to “Modem Commands” on page 437. Syntax modem Example modem modem 451-0310E 339 Specifies that the port(s) under configuration will have Modem Control enabled. Syntax modem enable Usage Guidelines You cannot enable Modem Control on port 0. If you execute the modem enable command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example modem enable modem enable340 451-0310E Specifies a description of the port(s) under configuration. Syntax name STRING Where Means Example name FieldOffice3 name STRING A text string that describes the port(s) under configuration. The text string can contain up to 60 characters.451-0310E 341 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Asynchronous command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Asynchronous command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no modem no feature_name The name of the feature or boolean parameter that is to be disabled.342 451-0310E Specifies a descriptive name for a Power Outlet that is connected to a Power Master port on the LX unit. Refer to “access power model” on page 309 for information on configuring an LX port as a Power Master. Syntax outlet name Where Means Example outlet 2 name Build5NTserver outlet name outlet_number An integer number that specifies an outlet on the Power Control unit that is being managed via the asynchronous port under configuration. Note: This number consists of the Power Control Relay Number without the Power Master port number. outlet_name Specifies a descriptive name for the Power Control Relay. This can be a text string of up to 15 characters.451-0310E 343 Specifies whether or not the port(s) under configuration will provide a bit (parity bit) with each character for error checking. The value you set for this characteristic must match the value set at the device attached to the port. Syntax parity even|odd|none Where Means Examples parity even parity odd parity none parity even The port will ensure that each byte (character) that is transmitted or received contains an even number of 1's, including the parity bit. If the port receives a byte that contains an odd number of 1 bits, it indicates to the LX unit that an error occurred. odd The port will ensure that each byte (character) that is transmitted or received contains an odd number of 1's, including the parity bit. If the port receives a byte that contains an even number of 1 bits, it indicates to the LX unit that an error occurred. none A parity bit will not be provided. This is the default setting.344 451-0310E Specifies that the ports under configuration will use the Pattern Matching feature. Syntax pattern match enable Usage Guidelines The Pattern Matching feature can only be used on ports that are configured for databuffer access. Refer to the “access” command on page 308 to configure a port for databuffer access. You must create a match pattern before you can execute this command. To create a match pattern, refer to “pattern string” on page 345. Example pattern match enable pattern match enable451-0310E 345 Specifies a match pattern for the databuffer port(s) under configuration. When data matching this pattern is received at the port, the data is put into a syslogd message. The syslogd message that contains the matching data can be forwarded to users of the Notification feature. Refer to “Usage Guidelines” (below) for more information. NOTE: Pattern matching must be disabled on the port(s) where this command is executed. To disable pattern matching, execute the no pattern match command in the Asynchronous command mode: Syntax pattern string Where Means Usage Guidelines When incoming data matching a specified pattern is received at the port, a syslogd message is generated at the facility LOG_USER, with the priority LOG_NOTICE: Pattern match found::Msg39 where is the incoming data that matches the specified pattern. For example, the following syslogd messages could be generated for incoming data that matched the pattern no *: Pattern match found:no broadcast group 4:Msg39 NOTE: The text Pattern match found is the default content of Message 39. This text can be changed. If it is changed, the text that precedes the colon (:) will be different from Pattern match found. Refer to “message string” on page 514 to change the text content of a configurable message. pattern string pattern_number A number that identifies the match pattern. This can be any integer number from 1 through 8. match_pattern A case-sensitive text string that is used as a match pattern for incoming data. This string can contain up to 15 characters, including wildcards. The allowable wildcards are the period (“.”) and the asterisk (“*”). The period represents a single character. For example, the pattern a.c.ef matches the strings abc3ef, azcxef, and a2cgef. The asterisk represents up to 16 iterations of the last character before the asterisk. For example, the pattern abc* matches the strings abccccccc and abccc. Note: The asterisk cannot be specified as the first character in a match pattern. Note: The string help is reserved and can not be specified in a match pattern.346 451-0310E The messages will be forwarded to Notification clients that have a facility of user and a priority of notice configured in their User Profiles. Refer to the LX-Series Configuration Guide for information on configuring User Profiles for the Notification feature. Examples pattern string 1 no * pattern string 2 number . pattern string 3 OK> pattern string 4 stuck* pattern string 5 1234B pattern string (continued)451-0310E 347 Specifies the length of time, in seconds, that outlets must remain off before they can be turned back on. Syntax power off time NUMBER Where Means Example power off time 15 power off time NUMBER An integer number that specifies the length of time, in seconds, that the outlets must remain off before they can be turned back on. After the outlets in the group have been turned off with the outlet command (see page 75), they must remain off for at least this length of time. The allowable values are 0 - 255. The default value is 10.348 451-0310E Enters the PPP command mode. For more information on the PPP command mode, refer to “PPP Commands” on page 447. Syntax ppp Example ppp ppp451-0310E 349 Specifies that the ports under configuration can be used for PPP links. Syntax ppp enable Usage Guidelines You cannot use port 0 for PPP links. If you execute the ppp enable command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example ppp enable ppp enable350 451-0310E Specifies the port prompt for remote connections. Syntax prompt Where Means Example prompt Finance-Group prompt prompt_string The text string that will be used as the port prompt. The text string can contain up to 60 characters.451-0310E 351 Enables the RADIUS accounting feature on the port(s) under configuration. Syntax radius accounting enable Example radius accounting enable radius accounting enable352 451-0310E Specifies that a syslogd message will be sent when there is a state transition of the serial input signals CTS and DCD/DSR. Syntax signals syslog enable Example signals syslog enable signals syslog enable451-0310E 353 Specifies that the port(s) under configuration will send the special break string out the serial line of the port(s) when a break (or Telnet break string) is received, via Telnet or SSH, from a remote host. Refer to “special break string” on page 354 to specify the special break string. Syntax special break enable Example special break enable special break enable354 451-0310E Specifies a unique break sequence that is sent out the serial line of the ports under configuration when a break is received, via Telnet or SSH, from a remote host. Syntax special break string Where Means Example special break string gfeij special break string break_sequence Specifies the unique break sequence. This can be any string of up to six characters.451-0310E 355 Specifies the speed of the port(s) under configuration. Syntax speed NUMBER Where Means Example speed 57600 speed NUMBER The port speed, in bits per second, to which the port(s) under configuration will be set. The valid speeds are 134, 200, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 or 230400. The default port speed is 9600.356 451-0310E Specifies the number of stop bits to be used to maintain synchronization of data on the port(s) under configuration. Syntax stopbits NUMBER Where Means Example stopbits 1 stopbits 2 stopbits NUMBER A whole number that maps to the number of stop bits to be used to maintain synchronization of data. The allowable values are 1 or 2.451-0310E 357 Enables the TACACS+ accounting feature on the port(s) under configuration. Syntax tacacs+ accounting enable Example tacacs+ accounting enable tacacs+ accounting enable358 451-0310E Specifies the Telnet break string for the ports under configuration. When it is received from a remote host in a Telnet or SSH session, the LX unit will send the enabled break feature (break signal or special break string) out the serial line. Refer to “break enable” on page 323 to enable the break signal. Refer to “special break enable” on page 353 to enable the special break string. Syntax telnet break string Where Means Example telnet break string sfg telnet break string break_sequence Specifies the Telnet break sequence. This can be any string of up to four characters.451-0310E 359 Enables Telnet negotiation on the port(s) under configuration. When Telnet negotiation is enabled, the LX unit will begin negotiating Telnet parameters as soon as the session is started. NOTE: Telnet negotiation is enabled by default. This command is typically used to re-enable Telnet negotiation after it has been disabled. (To disable Telnet negotiation, execute the no telnet negotiation command in the Asynchronous Command Mode.) Syntax telnet negotiation enable Usage Guidelines Telnet Negotiation is used with transparency enabled when full transparency is needed within the telnet connection. Refer to the transparency enable command on page 360 to enable transparency. You can disable Telnet Negotiation on the LX to ensure operation with NT servers. Disabling Telnet negotiation on the LX effectively disables the negotiation of all telnet options in the TCP three-way handshaking process. Example telnet negotiation enable telnet negotiation enable360 451-0310E Sets the port(s) under configuration to transparent mode. Syntax transparency enable Usage Guidelines The use of transparent mode ensures that the LX can support applications that were designed for a point-to-point serial connection over an IP network. Examples of such applications include (but are not limited to) legacy serial applications and the downloading of an operating system to a switch or router via the serial port. Transparent mode is applicable to the serial-port side only. When transparent mode is enabled, common control characters are not interpreted. For example, some characters that would not be interpreted (and their Hex equivalents) are ^Q (11), ^S (13), and NULL (00). To disable transparent mode, execute the following command in the Asynchronous Command Mode: no transparency Example transparency enable transparency enable451-0310E 361 Chapter 6 Ethernet Commands The Ethernet commands are executed in the Ethernet command mode. When the LX unit is in the Ethernet command mode, the Ethernet command prompt (e.g., Ether 1-1:0 >>) is displayed on the terminal screen. The format of the Ethernet command prompt is as follows: Ether <1st_port_number>-: >> where <1st_port_number> identifies the first port in the range of ports under configuration. identifies the last port in the range of ports under configuration. identifies the current session number. To enter the Ethernet command mode, execute the port ethernet command in the Configuration command mode. The port ethernet command is described on page 195. 362 451-0310E Specifies the description for the Ethernet port. Syntax description STRING Where Means Example description Port 0 on the Lab Unit description STRING A text string that describes the Ethernet port. The text string can contain up to 60 characters.451-0310E 363 When the end command is issued in Ethernet Command Mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end364 451-0310E Returns the user to the previous command mode. For example, if the current command mode is the Ethernet command mode, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the Ethernet command mode returns the user to the previous command mode. The same goes for issuing the exit command in any mode other than the User command mode. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 365 Removes (deletes) the description field for the Ethernet port(s) under configuration. Refer to “description” on page 362 for more information on the description field. Syntax no description Example no description no description366 451-0310E Specifies the speed and duplex mode of the Ethernet port under configuration. Syntax speed auto|10mb|100mb duplex full|half Where Means Examples speed auto speed 10mb duplex full speed 100mb duplex full speed 10mb duplex half speed 100mb duplex half speed auto The Ethernet port under configuration will auto-negotiate its port speed and duplex mode. This is the default setting. Note: If the auto option is specified, you will not be able to specify full or half as the duplex mode for the port; the duplex mode will be auto-negotiated. 10mb Sets a speed of 10 Megabytes per second for the Ethernet port under configuration. 100mb Sets a speed of 100 Megabytes per second for the Ethernet port under configuration. full The Ethernet port under configuration will use full duplex. half The Ethernet port under configuration will use half duplex.451-0310E 367 Chapter 7 Subscriber Commands The Subscriber commands are executed in the Subscriber command mode. When the LX unit is in the Subscriber command mode, the Subscriber command prompt (e.g., Subs_mark >>) is displayed on the terminal screen. The format of the Subscriber command prompt is as follows: Subs_ >> where is the name of the subscriber under configuration. To enter the Subscriber command mode, execute the subscriber command in the Configuration command mode. The subscriber command is described on page 247.368 451-0310E Enables the subscriber to access the LX unit via a direct connection to the LX console port. Syntax access console enable Example access console enable access console enable451-0310E 369 Specifies the LX asynchronous ports that the subscriber can access. Syntax access port Where Means Example access port 2 access port 0 2 3 5 6 access port 3-7 access port port_list Specifies the asynchronous port(s) that the user can access on the LX unit. If more than one asynchronous port is specified, they should be separated by blank spaces; for example, 2 3 5 6. In order to specify a range of ports, put a hyphen between the first port and the last port; for example: 3-7.370 451-0310E Enables the subscriber to access the LX unit by an SSH connection. Syntax access ssh enable Example access ssh enable access ssh enable451-0310E 371 Enables the subscriber to access the LX unit by a Telnet connection. Syntax access telnet enable Example access telnet enable access telnet enable372 451-0310E Enables the subscriber to access the LX unit from a web browser via an Internet connection. Syntax access web enable Example access web enable access web enable451-0310E 373 Enables the auditing of port activity for the subscriber. The auditing begins as soon as this command is executed. Syntax audit log enable Example audit log enable audit log enable374 451-0310E Specifies the Backward Switch character for the subscriber; when the subscriber enters the Backward Switch character, he is returned to the previous (lower-numbered) session without returning to the local command mode. Syntax backward_switch CHARACTER Where Means Usage Guidelines To specify that the Backward Switch character is a CTRL character, the character must be preceded by the caret symbol (^) in the backward_switch command. For example, the following command specifies that the Backward Switch character is CTRL/I: backward_switch ^I Be sure that there are no conflicting uses for the character you select (particularly with control characters that are used by applications programs, or with the character you set for the FORWARD SWITCH, the LOCAL SWITCH, or any Telnet command characters). If you specify a CTRL character, when the user types the character, it will be displayed as ^ (i.e., if the user types CTRL/I, the terminal will echo the characters: ^I). Example backward_switch ^I backward_switch CHARACTER A capital letter (A - Z) that the user will type to return to the previous session. It is recommended that you specify an unused CTRL character. 451-0310E 375 Enables command logging for the subscriber. Syntax command log enable Usage Guidelines Command logging creates an audit trail of subscriber input in a subscriber session. The audit trail is sent to the accounting log and to syslogd. Use the show command log command to display the command log. The show command log command is described on page 87. Example command log enable command log enable376 451-0310E Permanently assigns the subscriber to a dedicated service; whenever the subscriber logs into the LX unit, he will begin running the service that is specified in this command. Syntax dedicated service NAME Where Means Usage Guidelines In order to use this command, the Telnet protocol must be enabled. Example dedicated service finance_server dedicated service NAME The name of the service to which the subscriber is permanently assigned.451-0310E 377 Resets the access ports for the subscriber to the factory default of all physical ports on the LX unit, including port 0. Syntax default access port Example default access port default access port378 451-0310E Resets the subscriber’s remote access to the default value, which is no remote access. Syntax default access remote Example default access remote default access remote451-0310E 379 Resets the Backward Switch character for the subscriber back to the factory default. NOTE: The factory-default Backward Switch character is Control-B (^B). Syntax default backward_switch Example default backward_switch default backward_switch380 451-0310E Resets the Dialback retries for the subscriber back to the factory default of 4. Syntax default dialback retry Example default dialback retry default dialback retry451-0310E 381 Resets the Forward Switch character for the subscriber back to the factory default. NOTE: The factory-default Forward Switch character is Control-F (^F). Syntax default forward_switch Example default forward_switch default forward_switch382 451-0310E Resets the Inactivity timeout for the subscriber to the factory default of 0. A value of 0 means that the Inactivity Timer is effectively disabled. Syntax default idletime Example default idletime default idletime451-0310E 383 Resets the Local Switch character for the subscriber back to the factory default. NOTE: The factory-default Forward Switch character is Control-L (^L). Syntax default local_switch Example default local_switch default local_switch384 451-0310E Resets the SSH log level to the factory-default level, which is INFO. Syntax default ssh log level Example default ssh log level default ssh log level451-0310E 385 Enables the Dialback feature for the subscriber. Syntax dialback enable Example dialback enable dialback enable386 451-0310E Specifies the telephone number that the LX modem will dial when the subscriber makes a Dialback call to the LX unit. Syntax dialback number Where Means Example dialback number 19785551978 dialback number telephone_number The telephone number that the LX modem will dial when the subscriber makes a Dialback call to the LX unit. 451-0310E 387 Specifies the number of times that the modem on the LX unit can attempt to answer a dialback call. Syntax dialback retry NUMBER Where Means Example dialback retry 7 dialback retry NUMBER The number of times that the modem on the LX unit can attempt to answer a dialback call. The default value is 3. The allowable values are 1 through 255.388 451-0310E When the end command is issued in the Subscriber command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 389 Returns the user to the previous command mode. For example, if the current command mode is the Subscriber command mode, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the Subscriber command mode returns the user to the previous command mode. The same goes for issuing the exit command in any mode other than the User command mode. For example, issuing the exit command in the Menu command mode returns the user to the Configuration command mode; issuing the exit command in the Configuration command mode returns the user to Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit390 451-0310E Specifies the Forward Switch character for the subscriber; when the subscriber enters the Forward Switch character, he is switched to the next (higher-numbered) session without returning to the local command mode. Syntax forward_switch CHARACTER Where Means Usage Guidelines To specify that the Forward Switch character is a CTRL character, the character must be preceded by the caret symbol (^) in the forward_switch command. For example, the following command specifies that the Forward Switch character is CTRL/M: forward_switch ^M Be sure that there are no conflicting uses for the character you select (particularly with control characters that are used by applications programs, or with the character you set for the BACKWARD SWITCH, the LOCAL SWITCH, or any Telnet command characters). If you do specify a CTRL character, when the user types the character, it will be displayed as ^ (i.e., if the user types CTRL/M, the terminal will echo the characters: ^M). Example forward_switch ^M forward_switch CHARACTER A capital letter (A - Z) that the user will type to switch to the next session. It is recommended that you specify an unused CTRL character.451-0310E 391 Sets the Inactivity Timeout for the subscriber. The subscriber is logged out if he does not enter keyboard data before the expiration of the Inactivity Timeout. Syntax idletime Where Means Syntax idletime 1200 idletime timeout_value The length of the Inactivity Timeout, in seconds. The allowable values are 0 through 65535. The default value is 0. A value of 0 means that the Inactivity Timer is effectively disabled. 392 451-0310E Specifies the Local Switch character for the subscriber; when the subscriber enters the Local Switch character, he is returned to the local command mode. Syntax local_switch CHARACTER Where Means Usage Guidelines To specify that the Local Switch character is a CTRL character, the character must be preceded by the caret symbol (^) in the local_switch command. For example, the following command specifies that the Local Switch character is CTRL/K: local_switch ^K Be sure that there are no conflicting uses for the character you select (particularly with control characters that are used by applications programs, or with the character you set for the BACKWARD SWITCH, the FORWARD SWITCH, or any Telnet command characters). If you do specify a CTRL character, when the user types the character, it will be displayed as ^ (i.e., if the user types CTRL/K, the terminal will echo the characters: ^K). Example local_switch ^K local_switch CHARACTER A capital letter (A - Z) that the user will type to return to the local command mode. It is recommended that you specify an unused CTRL character. 451-0310E 393 Sets the maximum simultaneous connections for the subscriber. Syntax maxsubscriber NUMBER Where Means Syntax maxsubscriber 10 maxsubscriber NUMBER The maximum simultaneous connections for the subscriber. The allowable values are 1 through 255. The default value is 5.394 451-0310E Assigns a log-in menu to the subscriber and enables the Menu feature for the subscriber. If the Menu feature is enabled, and a menu exists for the subscriber, a menu is displayed when the subscriber logs in to the LX unit. Refer to “Menu Commands” on page 479 for more information on creating menus. Syntax menu NAME enable Where Means Example menu tom enable menu enable NAME The name of the menu that is to be displayed when the subscriber logs in to the LX unit. Refer to “Menu Commands” on page 479 for more information on creating menus.451-0310E 395 Disables (negates) specific features and boolean parameters for the subscriber under configuration. Refer to “Usage Guidelines” (below) for more information about using the no command in the Subscriber mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Subscriber command mode and are currently enabled for this subscriber. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no pause no feature_name The name of the feature or boolean parameter that is to be disabled.396 451-0310E Assigns a new login password to the subscriber’s account. Syntax password Usage Guidelines When this command is executed, the following prompts are displayed: Enter your NEW password : Re-enter your NEW password: Enter the new password at the Enter prompt, and re-enter it at the Re-enter prompt. The password string can be up to 16 characters in length, and it will be masked when you enter it at the above prompts. Example password password451-0310E 397 Enables password login protection on the subscriber account and enables the subscriber to reset his password the next time he logs in. (The subscriber will be prompted to enter, and confirm, his new password the next time he logs in.) Syntax password enable Example password enable password enable398 451-0310E Configures the screen pause feature for this subscriber. When this feature is enabled, the screen will pause after displaying the number of lines specified in the “lines/screen” value for the terminal. Syntax pause enable Example pause enable pause enable451-0310E 399 Assigns a service to which the port will connect whenever a user makes a connect request without specifying a service. Syntax preferred service NAME Where Means Usage Guidelines After assigning a Preferred Service to a subscriber, you must log out the subscriber in order for the Preferred Service to take effect. Example preferred service finance_server preferred service NAME The name of the preferred service.400 451-0310E Sets the portion of the subscriber’s user prompt. Refer to page 33 for more information on the format of the user prompt. Syntax prompt STRING Where Means Example prompt BILL prompt STRING A text string of up to 8 ASCII characters. 451-0310E 401 Allows the subscriber to log into the Superuser command mode with the Superuser password. The subscriber logs in to the Superuser command mode by executing the enable command (see page page 36). Syntax security level superuser Example security level superuser security level superuser402 451-0310E Sets the maximum number of sessions for a subscriber. Syntax session NUMBER Where Means Examples session 3 session NUMBER The maximum number of sessions for the subscriber. The allowable values are 0 through 4, where a value of 0 disables the subscriber’s access to the LX unit. 451-0310E 403 Configures the Subscriber Session Mode as Shell. When the Subscriber Session Mode is Shell, the subscriber is logged into the Linux shell when he accesses the LX unit. Syntax shell enable Usage Guidelines You can reset the Subscriber Session Mode to CLI by executing the no shell command in the Subscriber Command Mode. When the Subscriber Session Mode is CLI, the subscriber will be logged into the LX CLI (or his specified Login Menu) when he accesses the LX unit. Example shell enable shell enable404 451-0310E Specifies the SSH encryption type(s) that are supported for this subscriber. Syntax ssh cipher triple-des|any|blowfish Where Means Usage Guidelines Blowfish is a variable-length key block cipher. It is only suitable for applications where the key does not change often, like a communications link or an automatic file encryptor. It is significantly faster than DES when implemented on 32-bit microprocessors with large data caches, such as the Pentium and the PowerPC. It takes a variable-length key, from 32 bits to 448 bits, making it ideal for both domestic and exportable use. Blowfish is unpatented and license-free, and is available free for all uses at the following website: http://www.counterpane.com/blowfish-download.html Examples ssh cipher triple-des ssh cipher any ssh cipher blowfish ssh cipher triple-des Specifies that the Triple Data Encryption Standard (Triple-DES) is the only SSH encryption type supported for this subscriber. any Specifies that any SSH encryption type is supported for this subscriber. blowfish Specifies that BLOWFISH is the only SSH encryption type supported for this subscriber. See “Usage Guidelines” (below) for more information on the BLOWFISH encryption type.451-0310E 405 Specifies a unique SSH key for this subscriber. When a subscriber has a unique SSH key, he can log on to the LX unit via SSH without entering a password. (The only requirement is that the user must log on from the host on which his SSH key was generated.) Syntax ssh key Usage Guidelines When this command is executed, the following prompt is displayed: Please enter your key: Type an SSH key at the above prompt. The SSH key can be any random string of characters. As an alternative to typing the SSH key, you can paste a generated SSH key at the above prompt. (The SSH key must be generated on the host from which the subscriber will make SSH connections to the LX unit. Refer to your Linux documentation for more information on generating an SSH key.) Example ssh key ssh key406 451-0310E Specifies the class of SSH messages that will be logged to syslogd. Syntax ssh log level debug|error|fatal|info|quiet|verbose Where Means Examples ssh log level debug ssh log level error ssh log level fatal ssh log level info ssh log level quiet ssh log level verbose ssh log level debug Only debug messages will be sent to the SSH log. error Only error messages will be sent to the SSH log. fatal Only fatal error messages will be sent to the SSH log. info Only informational messages will be sent to the SSH log. This is the default. quiet Default account log information will be logged for SSH. verbose Verbose account log information will be logged for SSH.451-0310E 407 Specifies the Telnet mode for the subscriber. Syntax telnet mode line|character Where Means Examples telnet mode line telnet mode character telnet mode line The subscriber will use Telnet line mode. character The subscriber will use Telnet character mode.408 451-0310E Sets the terminal type for the subscriber. Syntax terminal Where Means Example terminal vt100 terminal ansi terminal terminal_type The terminal type for the subscriber. The allowable terminal types are VT100 and ANSI. 451-0310E 409 Chapter 8 SNMP Commands The SNMP commands are executed in the SNMP command mode. When the LX unit is in the SNMP command mode, the SNMP command prompt (e.g., Snmp:0 >>) is displayed on the terminal screen. The format of the SNMP command prompt is as follows: Snmp: >> where is the session number of the current connection. To enter the SNMP command mode, execute the snmp command in the Configuration command mode. The snmp command is described on page 242.410 451-0310E Specifies the name of a system contact for the LX unit. Syntax contact STRING Where Means Example contact Henry Smith contact STRING The name of a system contact for the LX unit. This information is available via an SNMP query (get) but is provided for administrative or informational purposes only. The MIB object is sysContact. The text string can contain up to 60 characters.451-0310E 411 Specify the default SNMP V3 client for the LX unit Syntax default v3 client NUMBER Where Means Example default v3 client 5 default v3 client NUMBER The number of the default SNMP V3 client. Valid values are 3 - 7. 412 451-0310E When the end command is issued in SNMP Mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 413 Returns the user to the previous command mode. For example, if the current command mode is the SNMP command mode, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the SNMP command mode returns the user to the previous command mode. The same goes for issuing the exit command in any mode other than the User command mode. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit414 451-0310E Add, or change, an SNMP client (e.g., a Network Operations Center, or NOC) that has permission to view information about the LX unit (i.e., perform an SNMP get). Syntax get client NUMBER A.B.C.D Where Means Example get client 4 119.20.112.3 get client NUMBER The number of the SNMP client that has permission to perform an SNMP get on the LX unit. Valid values are 0 - 16. A.B.C.D The Internet address of an SNMP client that has permission to perform an SNMP get on the LX unit. The default value is 0.0.0.0. Specify the default value (0.0.0.0) to remove a client.451-0310E 415 Specifies an SNMP Get client community for an SNMP get client of the LX unit. When an SNMP Get community has been specified with this command, any SNMP get clients must belong to the same SNMP Get community in order to perform an SNMP get on the unit. Syntax get client NUMBER community Where Means Example get client 3 community labunits get client community NUMBER The number of the SNMP client that has permission to perform an SNMP get on the LX unit. community_name The name of the SNMP Get community. The name can be up to 32 characters long.416 451-0310E Specifies the SNMP get client version for an SNMP get client of the LX unit. Syntax get client NUMBER version Where Means Example get client 3 version 2 get client version NUMBER The number of the SNMP get client for which the SNMP get client version is to be set. version_number An SNMP get client version number. The allowable values are 1, 2, or 3. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients.451-0310E 417 Specifies the physical location of the LX unit. Syntax location STRING Where Means Example location Engineering Lab location STRING The physical location of the LX unit. This information is available via an SNMP query (get) but is provided for administrative or informational purposes only. The MIB object is sysLocation. The text string can contain up to 60 characters.418 451-0310E Enables the logging of all incoming SNMP packets to syslogd. Syntax log enable Example log enable log enable451-0310E 419 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the SNMP mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the SNMP command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no pause no feature_name The name of the feature or boolean parameter that is to be disabled.420 451-0310E Add, or change, an SNMP client (e.g., a Network Operations Center, or NOC) that has permission to set characteristics (i.e., perform an SNMP set) on the LX unit. Syntax set client NUMBER A.B.C.D Where Means Example set client 4 119.20.112.3 set client NUMBER The number of the SNMP client that has permission to perform an SNMP set on the LX unit. Valid values are 0 - 16. A.B.C.D The Internet address of an SNMP client that has permission to perform an SNMP set on the LX unit. The default value is 0.0.0.0. Specify the default (0.0.0.0) value to remove a client.451-0310E 421 Specifies an SNMP Set client community for an SNMP set client of the LX unit. When an SNMP Set community has been specified with this command, any SNMP set clients must belong to the same SNMP Set community in order to perform an SNMP set on the unit. Syntax set client NUMBER community Where Means Example set client 3 community labunits set client community NUMBER The number of the SNMP client that has permission to perform an SNMP set on the LX unit. community_name The name of the SNMP Set community. The name can be up to 32 characters long.422 451-0310E Specifies the SNMP set client version for an SNMP set client of the LX unit. Syntax set client NUMBER version Where Means Example set client 3 version 2 set client version NUMBER The number of the SNMP set client for which the SNMP set client version is to be set. version_number An SNMP set client version number. The allowable values are 1, 2, or 3. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients.451-0310E 423 Add, or change, an SNMP client (e.g., a Network Operations Center, or NOC) that will receive SNMP traps generated by the LX unit. The LX unit sends an Enterprise-specific SNMP trap before a reboot and a Cold Start SNMP trap when the LX unit has rebooted. During normal operation of the LX unit, SNMP traps can be sent to trap clients via the Notification feature. Syntax trap client NUMBER A.B.C.D Where Means Example trap client 4 119.20.112.3 trap client NUMBER The number of the SNMP client that has permission to receive SNMP traps generated by the LX unit. Valid values are 0 - 16. A.B.C.D The Internet address of an SNMP client that has permission to receive SNMP traps from the LX unit. The default value is 0.0.0.0. Specify the default value (0.0.0.0) to remove a client.424 451-0310E Specifies an SNMP Trap community for an SNMP trap client of the LX unit. When an SNMP Trap community has been specified with this command, any SNMP trap clients must belong to the same SNMP Trap community in order to receive SNMP traps that are generated by the unit. The LX unit sends an Enterprise-specific SNMP trap before a reboot and a Cold Start SNMP trap when the LX unit has rebooted. During normal operation of the LX unit, SNMP traps can be sent to trap clients via the Notification feature. Syntax trap client NUMBER community Where Means Example trap client 3 community labunits trap client community NUMBER The number of the SNMP client that has permission to receive SNMP traps that are generated by the LX unit. community_name The name of the SNMP Trap community. The name can be up to 32 characters long.451-0310E 425 Specifies the SNMP trap client version for an SNMP set client of the LX unit. The LX unit sends an Enterprise-specific SNMP trap before a reboot and a Cold Start SNMP trap when the LX unit has rebooted. During normal operation of the LX unit, SNMP traps can be sent to trap clients via the Notification feature. Syntax trap client NUMBER version Where Means Example trap client 5 version 2 trap client version NUMBER The number of the SNMP trap client for which the SNMP trap client version is to be set. version_number An SNMP trap client version number. The allowable values are 1, 2 or 3. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients.426 451-0310E Specifies the access context match criteria for an SNMP V3 client. Syntax v3 client access context match exact|prefix Where Means Examples v3 client 3 access context match exact v3 client 3 access context match prefix v3 client access context match client_number The number of the SNMP V3 client for which the access context match criteria are being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. exact The access context field of an incoming SNMP packet must be an exact match for the access context field that is specified for the group on the LX unit. prefix The prefix of an access context field of an incoming SNMP packet must match the prefix of the access context field that is specified for the group on the LX unit.451-0310E 427 Specifies the access context prefix for an SNMP V3 client. Syntax v3 client access context prefix Where Means Examples v3 client 3 access context prefix lab v3 client access context prefix client_number The number of the SNMP V3 client for which the access context prefix is being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. string The access context prefix for the SNMP V3 client.428 451-0310E Specifies the access read view for an SNMP V3 client. Syntax v3 client access read view Where Means Example v3 client 3 access read view second_view v3 client access read view client_number The number of the SNMP V3 client for which the access read view is being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. word The view that will be used as the read view for the SNMP V3 client. The read view is used for incoming SNMP Get Requests.451-0310E 429 Specifies the access security settings for an SNMP V3 client. Syntax v3 client access security level model Where Means Examples v3 client 3 access security level 1 v3 client 3 access security level 2 v3 client 3 access security level 3 v3 client 3 access security model 1 v3 client 3 access security model 2 v3 client access security client_number The number of the SNMP V3 client for which the access context settings are being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. level Specify the access security level. security_level The access security level in an incoming SNMP packet must match this value in order for the packet to be allowed. The allowable values are 1, 2, or 3. model Specify the access security model. model_number The access security model in an incoming SNMP packet must match this value in order for the packet to be allowed. The allowable values are 1, 2, or 3.430 451-0310E Specifies the access write view for an SNMP V3 client. Syntax v3 client access write view Where Means Example v3 client 3 access write view third_view v3 client access write view client_number The number of the SNMP V3 client for which the access write view is being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. word The view that will be used as the write view for the SNMP V3 client. The write view is used for incoming SNMP Set Requests.451-0310E 431 Specifies the group security model for an SNMP V3 client. Syntax v3 client group security model Where Means Examples v3 client 3 group security model 1 v3 client 3 group security model 2 v3 client group security model client_number The number of the SNMP V3 client for which the security community setting is being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. model_number The group security model in an incoming SNMP packet must match this value in order for the packet to be allowed. The allowable values are 1 or 2.432 451-0310E Specifies the name for an SNMP V3 client. Syntax v3 client name Where Means Examples v3 client 3 name lab_unit v3 client name client_number The number of the SNMP V3 client for which the client engine settings are being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. string The name of the SNMP V3 client. This can be any text string.451-0310E 433 Specifies the security community for an SNMP V3 client. Syntax v3 client security community Where Means Example v3 client 3 security community lab_group v3 client security community client_number The number of the SNMP V3 client for which the security community setting is being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. word The security community name for the SNMP V3 client. The LX unit will only accept SNMP Requests from this SNMP V3 client if the Request packet includes this community name. This is a text string of up to 60 characters.434 451-0310E Specifies the security source settings for an SNMP V3 client. Syntax v3 client security source mask Where Means Examples v3 client 4 security source 143.32.87.23 v3 client 4 security source mask 255.255.255.0 v3 client security source client_number The number of the SNMP V3 client for which the security source settings are being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. ip_address The IP Address that will be used as the security source for the SNMP V3 client. The LX unit will only accept SNMP Requests from this SNMP V3 client if they have this IP Address specified as the security source. mask Requires both the IP Address, and subnet mask, of the security source to match. subnet_mask The subnet mask that will be used as the security source mask for the SNMP V3 client. If this mask is specified, both IP address and the subnet mask for the security source must match for the LX unit to accept SNMP Requests from the V3 client.451-0310E 435 Specifies the view settings for an SNMP V3 client. Syntax v3 client view subtree mask type Where Means Examples v3 client 4 view subtree 1.3.6.1.2.1.1.2 v3 client 4 view mask F v3 client 4 view type allow v3 client 4 view type deny v3 client view client_number The number of the SNMP V3 client for which the view settings are being configured. Note: Clients 0-2 are reserved for SNMP V1 clients and SNMP V2 clients. You cannot specify clients 0-2 as SNMP V3 clients. subtree Specify the subtree for the V3 client. object_id An Object ID that will be used as a filter for incoming SNMP packets, as specified by the mask for the V3 client. mask Specify the view mask for the V3 client. octet_string A hexadecimal number that specifies the octets that must match those in the subtree. For example, hexadecimal F (which has a binary value of 1111) indicates that the first four octets in an incoming Object ID must match the first four octets in the subtree. If the subtree is 1.3.6.1.2.1.1.2, the Object IDs of incoming SNMP packets must have 1.3.6.1 as their first four octets. type Specify the type for the V3 view. word The type of the V3 view. The allowable values are: allow – Packets that match the mask and subtree in this view will be allowed to make requests on the LX unit. deny – Packets that match the mask and subtree in this view will not be allowed to make requests on the LX unit.436 451-0310E Specifies the engine settings for an SNMP V3 client. Syntax v3 engine id boots NUMBER Where Means Examples v3 engine id 346248687 v3 engine boots 11 v3 engine id Specify the Engine ID for the LX unit. octet_string An hexadecimal value that uniquely identifies the LX unit. boots Specify the Engine boots for the LX unit. NUMBER An integer number that represents the number of times that the SNMP daemon running on the LX unit has rebooted. You can set this to any integer value. This is a counter that will be incremented each time the SNMP daemon is rebooted. This value is also a shared secret between the LX unit and the SNMP V3 client.451-0310E 437 Chapter 9 Modem Commands The Modem commands, which are used to configure modems for asynchronous ports, are executed in the Modem command mode. When the LX unit is in the Modem command mode, the Modem command prompt (e.g., Modem 4-4:0 >>) is displayed on the terminal screen. The format of the Modem command prompt is as follows: Modem <1st_port_number>-: >> where <1st_port_number> identifies the first port in the range of ports under configuration. (This value is inherited from the Asynchronous command mode.) identifies the last port in the range of ports under configuration. (This value is inherited from the Asynchronous command mode.) identifies the current session number. To enter the Modem command mode, execute the modem command in the Asynchronous command mode. The modem command is described on page 338.438 451-0310E Resets the modem initialization string to its default value. Syntax default initstring Example default initstring default initstring451-0310E 439 Specifies the telephone number that the LX modem will dial for a dialout connection. Syntax dialout number Where Means Usage Guidelines You cannot specify a dialout number for port 0. If you execute the dialout number command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example dialout number 19785558371 dialout number telephone_number The telephone number that the LX modem will dial for a dialout connection. 440 451-0310E When the end command is issued in the Modem command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 441 Returns the user to the previous command mode. For example, if the current command mode is the Modem command mode, issuing this command will return the user to the Asynchronous command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. As noted above, issuing the exit command in the Modem command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than the User command mode. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit442 451-0310E Specifies the Modem Initialization string that the port(s) under configuration will pass to the modem. Syntax initstring STRING Where Means Usage Guidelines You cannot specify a Modem Initialization string for port 0. If you execute the initstring command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example initstring AT S7=45 S0=1 L1 V1 X4 &C1 &1 Q0 &S1 initstring STRING The Modem Initialization string451-0310E 443 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Modem command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Modem command mode and are currently enabled. To vi ew the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no dialout number no feature_name The name of the feature or boolean parameter that is to be disabled.444 451-0310E Specifies the number of times that the port(s) under configuration will attempt to make a dialout connection via a modem, after the initial attempt. Syntax retry NUMBER Where Means Usage Guidelines You cannot specify a retry value for port 0. If you execute the retry command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example retry 6 retry NUMBER The number of times that the port(s) under configuration will attempt to make a dialout connection via a modem. The valid values are 0 - 255.451-0310E 445 Specifies the length of time that the port(s) under configuration can spend attempting to make a modem connection. Syntax timeout NUMBER Where Means Usage Guidelines You cannot specify a modem timeout for port 0. If you execute the timeout command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Example timeout 30 timeout NUMBER Specifies how much time the port(s) under configuration can spend attempting to make a modem connection. Valid timeout values are from 1 to 255 seconds.446 451-0310E Specifies the Modem type. Syntax type dialin|dialout Where Means Usage Guidelines You cannot specify a modem type for port 0. If you execute the type command on port 0, the following message will be displayed: Operation not permitted on diagnostic/management port Examples type dialin type dialout type dialin The modem on the asynchronous port(s) under configuration can only be used for dialin connections. dialout The modem on the asynchronous port(s) under configuration can only be used for dialout connections.451-0310E 447 Chapter 10 PPP Commands The PPP commands, which are used to configure the Point-to-Point Protocol (PPP) for asynchronous ports, are executed in the PPP command mode. When the LX unit is in the PPP command mode, the PPP command prompt (e.g., PPP 4-4:0 >>) is displayed on the terminal screen. The format of the PPP command prompt is as follows: PPP <1st_port_number>-: >> where <1st_port_number> identifies the first port in the range of ports under configuration. (This value is inherited from the Asynchronous command mode.) identifies the last port in the range of ports under configuration. (This value is inherited from the Asynchronous command mode.) identifies the current session number. To enter the PPP command mode, execute the PPP command in the Asynchronous command mode. The PPP command is described on page 348.448 451-0310E Enables the logging of PPP data for the asynchronous port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax accounting enable Example accounting enable accounting enable451-0310E 449 Sets the PPP link authentication parameters for the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax authentication chap|pap|retry |timeout Where Means Examples authentication chap authentication pap authentication retry 5 authentication timeout 30 authentication chap Enables CHAP authentication on the PPP link. pap Enables PAP authentication on the PPP link. retry Set the retry value for CHAP or PAP authentication. retry_limit The number of times that the LX unit will attempt to authenticate a PPP link. timeout Set the timeout value for CHAP or PAP authentication. timeout_limit The length of time that the LX unit has to perform CHAP or PAP authentication for a PPP link. If the link can not be authenticated within this time, the link is refused.450 451-0310E Enables PPP Compression Control Protocol (CCP) negotiation on the asynchronous port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax ccp enable Example ccp enable ccp enable451-0310E 451 Resets the retry and timeout values for PPP authentication to the factory-default settings. NOTE: You cannot execute this command on port 0. Syntax default authentication retry|timeout Where Means Example default authentication retry default authentication timeout default authentication retry Resets the retry value for PPP authentication to the factory-default setting. Refer to “authentication” on page 449 for more information on the retry value for PPP authentication. timeout Resets the timeout value for PPP authentication to the factory-default setting. Refer to “authentication” on page 449 for more information on the timeout value for PPP authentication.452 451-0310E Resets the negotiation options for the Internet Protocol Control Protocol (IPCP) to their factorydefault values. NOTE: You cannot execute this command on port 0. Syntax default ipcp compression|failure|timeout Where Means Example default ipcp compression default ipcp failure default ipcp timeout default ipcp compression Resets the compression option for IPCP to the factory-default value. Refer to “ipcp accept address enable” on page 462 for more information on the compression option for IPCP. failure Resets the failure option for IPCP to the factory-default value. Refer to “ipcp accept address enable” on page 462 for more information on the failure option for IPCP. timeout Resets the timeout option for IPCP to the factory-default value. Refer to “ipcp accept address enable” on page 462 for more information on the timeout option for IPCP.451-0310E 453 Resets the compression option for the Link Control Protocol (LCP) to the factory-default value. NOTE: You cannot execute this command on port 0. Refer to “lcp compression enable” on page 466 for more information on the compression option for LCP. Syntax default lcp compression Example default lcp compression default lcp compression454 451-0310E Resets the echo failure parameter for the Link Control Protocol (LCP) to the factory-default value. NOTE: You cannot execute this command on port 0. Refer to “lcp echo failure” on page 467 for more information on the echo failure parameter for LCP. Syntax default lcp echo failure Example default lcp echo failure default lcp echo failure451-0310E 455 Resets the failure limit parameter for the Link Control Protocol (LCP) to the factory-default value. NOTE: You cannot execute this command on port 0. Refer to “lcp failure limit” on page 469 for more information on the failure limit parameter for LCP. Syntax default lcp failure limit Example default lcp failure limit default lcp failure limit456 451-0310E Resets the Link Control Protocol (LCP) timeout for the port(s) under configuration to the factory-default value. NOTE: You cannot execute this command on port 0. Refer to “lcp timeout” on page 470 for more information on the LCP timeout. Syntax default lcp timeout Example default lcp timeout default lcp timeout451-0310E 457 Resets the client-mode username to the factory-default value, which is InReach. NOTE: You cannot execute this command on port 0. Syntax default mode client username Example default mode client username default mode client username458 451-0310E Resets the Maximum Transmission Unit (MTU) for the PPP link to the factory-default setting. The MTU is the maximum-sized packet that can be transmitted on the PPP link. NOTE: You cannot execute this command on port 0. Syntax default mtu Example default mtu default mtu451-0310E 459 Resets the IP address of the remote system in the PPP link to the default value. NOTE: You cannot execute this command on port 0. Syntax default remote address Example default remote address default remote address460 451-0310E When the end command is issued in the PPP command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 461 Returns the user to the previous command mode. For example, if the current command mode is the PPP command mode, issuing this command will return the user to the Asynchronous command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the PPP command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than User. For example, issuing the exit command in the Menu Editing command mode command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit462 451-0310E Configures the PPP link to accept negotiation of local addresses or remote addresses. NOTE: You cannot execute this command on port 0. Syntax ipcp accept local|remote address enable Where Means Examples ipcp accept local address enable ipcp accept remote address enable ipcp accept address enable local Specifies that the PPP link will only accept negotiation of local addresses. remote Specifies that the PPP link will only accept negotiation of remote addresses.451-0310E 463 Specifies that the port(s) under configuration will try to negotiate the use of Van Jacobson (VJ) compression over a PPP link. NOTE: You cannot execute this command on port 0. Syntax ipcp compression enable Usage Guidelines Data compression allows more data to be transferred over the link. The use of the VJ compression method can result in significant bandwidth savings, which can be important when PPP connections are made over telephone lines or when a PPP link is very heavily used. VJ compression is very memory intensive, however. The use of VJ compression is negotiated during PPP options negotiation. Compression can be used in one direction only. Example ipcp compression enable ipcp compression enable464 451-0310E Specifies the number of attempts at IPCP option negotiation that can be made by the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax ipcp failure limit NUMBER Where Means Example ipcp failure limit 6 ipcp failure limit NUMBER A whole number that specifies the number of attempts at IPCP option negotiation that can be made by the port(s) under configuration. The attempt at making a PPP link will be aborted if the options are not successfully negotiated within this number of tries.451-0310E 465 Specifies the length of time that the port(s) under configuration have for ipcp option negotiation. NOTE: You cannot execute this command on port 0. Syntax ipcp timeout NUMBER Where Means Example ipcp timeout 30 ipcp timeout NUMBER The length of time, in seconds, that the port(s) under configuration have for IPCP option negotiation. The attempt at making a PPP link will be aborted if the options are not successfully negotiated within this time limit.466 451-0310E Specifies that the port(s) under configuration will try to negotiate the use of LCP compression over a PPP link. NOTE: You cannot execute this command on port 0. Syntax lcp compression enable Example lcp compression enable lcp compression enable451-0310E 467 Specifies the number of times that the port(s) under configuration can send an LCP echo request. NOTE: You cannot execute this command on port 0. Syntax lcp echo failure NUMBER Where Means Example lcp echo failure 6 lcp echo failure NUMBER A whole number that specifies the number of times that the port(s) under configuration can send an LCP echo request. The attempt at making a PPP link will be aborted if the port does not receive an LCP echo after the last echo request is sent.468 451-0310E Specifies the interval between the sending of LCP echo requests. NOTE: You cannot execute this command on port 0. Syntax lcp echo interval NUMBER Where Means Example lcp echo interval 10 lcp echo interval NUMBER A whole number that specifies the interval, in seconds, between the sending of LCP echo requests.451-0310E 469 Specifies the number of attempts at LCP option negotiation that can be made by the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax lcp failure limit NUMBER Where Means Example lcp failure limit 6 lcp failure limit NUMBER A whole number that specifies the number of attempts at LCP option negotiation that can be made by the port(s) under configuration. The attempt at making a PPP link will be aborted if the options are not successfully negotiated within this number of tries.470 451-0310E Specifies the length of time that the port(s) under configuration have for LCP option negotiation. NOTE: You cannot execute this command on port 0. Syntax lcp timeout NUMBER Where Means Example lcp timeout 30 lcp timeout NUMBER The length of time, in seconds, that the port(s) under configuration have for LCP option negotiation. The attempt at making a PPP link will be aborted if the options are not successfully negotiated within this time limit.451-0310E 471 Specifies the PPP IP Local Address for the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax local address A.B.C.D Where Means Example local address 119.20.112.3 local address A.B.C.D The PPP IP Local Address for the port(s) under configuration.472 451-0310E Specifies “client” as the PPP mode, and optionally specifies the CHAP or PAP secret, for the port(s) under configuration. NOTE: You cannot execute this command on port 0. Syntax mode client [chap|pap ] Where Means Examples mode client mode client pap wtrrrgbbba mode client pap irtntobaalmwmtg mode client chap Specify the CHAP secret for the port(s) under configuration. pap Specify the PAP secret for the port(s) under configuration. secret The CHAP or PAP secret for the port(s) under configuration. 451-0310E 473 Specifies the username for the PPP client. NOTE: You cannot execute this command on port 0. Syntax mode client username Where Means Examples mode client username jackc mode client username name The username for the PPP client. This can be any text string.474 451-0310E Specifies the PPP mode for the port(s) under configuration as Server Active or Server Passive. NOTE: You cannot execute this command on port 0. Syntax mode server active|passive Where Means Examples mode server active mode server passive mode server active Specifies that the port(s) under configuration will use PPP server active mode. passive Specifies that the port(s) under configuration will use PPP server passive mode.451-0310E 475 Sets the Maximum Transmission Unit (MTU) size for the PPP link. Frames that are larger than the designated MTU size are fragmented before transmission. (Note that the software fragments frames on the transmit side only.) NOTE: You cannot execute this command on port 0. Syntax mtu NUMBER Where Means Example mtu 1300 mtu NUMBER The MTU size for the PPP link. The allowable values are 1000 - 1500. The default value is 1400.476 451-0310E Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the PPP command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the PPP command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no authentication no feature_name The name of the feature or boolean parameter that is to be disabled.451-0310E 477 Identifies the remote system in the PPP link. NOTE: You cannot execute this command on port 0. Syntax remote address A.B.C.D Where Means Example remote address 129.27.172.19 remote address A.B.C.D The IP Address of the remote unit in the PPP link.451-0310E 479 Chapter 11 Menu Commands The Menu commands are executed in the Menu command mode. When the LX unit is in the Menu command mode, the Menu command prompt (e.g., Menu :0 >>) is displayed on the terminal screen. The format of the Menu command prompt is as follows: Menu : >> where identifies the current session number. To enter the Menu command mode, execute the menu command in the Configuration command mode, or execute the exit command in the Menu Editing command mode. The menu command is described on page 184.480 451-0310E Deletes a menu from the LX unit. Syntax delete NAME Where Means Example delete finance_menu delete NAME The name of the menu that is to be deleted from the database of menus on the LX unit.451-0310E 481 When the end command is issued in the Menu command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end482 451-0310E Returns the user to the previous command mode. For example, if the current command mode is Menu, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. For example, issuing the exit command in the Menu command mode returns the user to the Configuration command mode; issuing the exit command in Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit451-0310E 483 Merges existing menus into one menu. Syntax import to Where Means Usage Guidelines If the destination menu already exists, the following prompt will be displayed when you execute the import command: The destination file already exists. Do you want to overwrite it? (yes/no) Answering “yes” will overwrite the destination file. Answering “no” will abort the command. Examples import menu_1 menu_2 menu_3 menu_4 menu_5 to finance_menu import susans_menu jacks_menu henrys_menu_3 to group_menu import menu_list Specifies the menu files that are to be merged into the destination menu. Each menu filename must be separated by a blank space. The menu files in the menu_list are appended to the destination menu. Note: A maximum of 16 menu pages can be merged into a destination menu. Each menu or submenu counts as a separate menu page. destination_menu Specifies the filename of the menu to which the files in menu_list are to be merged.484 451-0310E Displays a list of the menus on the LX unit. NOTE: If this command is executed while a menu file is open, a list of the submenus in the menu will be displayed. Syntax list Example list list451-0310E 485 Disables (negates) specific features and boolean parameters on the LX unit. Refer to “Usage Guidelines” (below) for more information about using the no command in the Menu command mode. Syntax no Where Means Usage Guidelines The allowable arguments for this command consist of only those features and boolean parameters that can be set in the Menu Editing command mode and are currently enabled. To view the features and boolean parameters that are currently enabled, type the no command followed by a question mark (?). Example no entry 2 no feature_name The name of the feature or boolean parameter that is to be disabled.486 451-0310E Opens a new or existing menu in the Menu Editing command mode. For more information on the Menu Editing command mode, refer to “Menu Editing Commands” on page 487. Syntax open NAME Where Means Example open finance_menu open NAME The name of the menu that is to be opened for editing.451-0310E 487 Chapter 12 Menu Editing Commands The Menu Editing commands are executed in the Menu Editing command mode. When the LX unit is in the Menu Editing command mode, the Menu Editing command prompt (e.g., mark-1:0 >>) is displayed on the terminal screen. The format of the Menu Editing command prompt is as follows: -: >> where identifies the Menu name. identifies the submenu number of the menu. The top-level menu always has a submenu number of 1. identifies the current session number. To enter the Menu Editing command mode, execute the open command in the Menu command mode. The open command is described on page 486.488 451-0310E Assigns control keys for the menu. Syntax control key logout|repaint|top|up Where Means Examples control key logout W Log out of LX control key repaint Z Refresh screen control key top H Go to top level control key up G Go back menu level control key logout Assigns a function key that will log out the subscriber account. repaint Assigns a function key that will redisplay the menu. top Assigns a function key that will move to the top-level menu for the subscriber. up Assigns a function key that will move up to the next-higher menu level. character The keyboard character that performs the assigned function. text Message text that is displayed at the bottom of the menu. This text typically describes what happens when the specified control key is pressed. This message has a limit of 18 characters.451-0310E 489 Displays the current menu, or a submenu associated with the current menu. The menu is displayed in the same form as it would be seen by an end user. Syntax display [menu ] Where Means Usage Guidelines When this command is executed without a submenu number, the current menu or submenu is displayed. Example display display menu 11 display menu_number An integer number, from 1 through 16, that identifies an existing menu. Menu 1 is the top-level menu. The default value is the current menu. 490 451-0310E When the end command is issued in the Menu Editing command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 491 Display a menu entry as it appears in the menu file. NOTE: This command displays an entry as it appears in the menu file rather than as the end user will see it. The label and the associated command are listed. Syntax entry Where Means Example entry 12 entry entry_number An integer number, from 1 through 40, that identifies the menu entry that is to be displayed.492 451-0310E Creates or modifies a command entry. A Command entry executes a Linux command when the user selects it from the menu. Syntax entry command Where Means Example entry 3 command telnet 1.2.3.5.1 entry command entry_number An integer number, from 1 through 40, that identifies the menu entry that is to be created or modified. command_text The shell-level command that is to be executed when this menu entry is selected by the user. This field can contain any syntactically correct Linux command.451-0310E 493 Creates or modifies a label for a command entry or a menu entry. The label is displayed to the user in the menu. Syntax entry label Where Means Example entry 3 label List the log entries entry label entry_number An integer number, from 1 through 40, that identifies the menu entry for which the label is to be created or modified. label_text A text string that describes the entry. The text string can contain any text characters, including spaces. If the menu or submenu has less than 21 entries, the text string can contain up to 52 characters. If the menu or submenu has 21 or more entries, the text string is limited to 36 characters.494 451-0310E Creates or modifies a menu entry. When a menu entry is selected from a menu, it switches to a submenu. NOTE: This command will create an entry with a label. The default label is the same as the command string itself. You can change the label with the entry label command. The entry label command is described on page 493. Syntax entry menu Where Means Example entry 11 menu 6 entry menu entry_number An integer number, from 1 through 40, that identifies the menu entry that is to be created or modified. menu_number An integer number, from 1 through 16, that identifies the submenu that is to be displayed when the user selects this menu entry.451-0310E 495 Returns the user to the previous command mode. For example, if the current command mode is Menu Editing, issuing this command will return the user to the Menu command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Menu command mode returns the user to the Configuration command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit496 451-0310E Creates a header for the current submenu. NOTE: The list command is used to display the headers for all submenus. The list command is described on page 497. Syntax header [] Where Means Examples header header Finance Department header header_text The text string that will be used as the Menu header. The text string can contain up to 60 characters, including spaces.451-0310E 497 Displays all of the configured submenus for the current menu, and their configured headers. An asterisk (*) indicates the menu that is currently under configuration. Syntax list Example list list498 451-0310E Opens a new or existing submenu for editing. Syntax menu Where Means Usage Guidelines After this command is executed, the field of the Menu Editing prompt changes to the Submenu number that is being edited. For example, the prompt mark-12:0 >> indicates that Submenu 12 is currently being edited. Example menu 12 menu submenu_number The menu number of the submenu that is to be opened for editing. This can be any integer number from 1 through 16.451-0310E 499 Specifies the continue string for the current menu. If a continue string is specified, the screen will pause after a command entry is executed; the user must press the ENTER key to re-display the menu from which the command entry was selected. If a continue string is not specified, the screen will pause after a command entry is executed, but no prompt string will be displayed. The continue string typically describes how to re-display the menu (e.g., Press ENTER to return). The continue string appears at the bottom of the screen when you display the menu using the display command. The display command is described on page 489. Syntax menu continue string Where Means Examples menu continue string Press ENTER to return menu continue string continue_string The continue string for the current menu or submenu. This is a text string of up to 60 characters.500 451-0310E Specifies the prompt string for the current menu. The prompt string is displayed at the bottom of the menu, and it typically describes how to select a menu option. The prompt string appears at the bottom of the screen when you display the menu using the display command. The display command is described on page 489. Syntax menu prompt Where Means Examples menu prompt Highlight options with Arrow Keys and press RETURN menu prompt prompt_string The prompt string for the current menu or submenu. This is limited to 53 characters.451-0310E 501 Removes control keys from the current menu. Syntax no control key logout|repaint|top|up Where Means Examples no control key logout no control key repaint no control key top no control key up no control key logout Removes the logout control key from the current menu. repaint Removes the repaint control key from the current menu. top Removes the top control key from the current menu. up Removes the up control key from the current menu.502 451-0310E Resets (negates) an entry in the current menu. When this command is executed, the menu entry no longer has a command, or a menu entry, associated with it. Syntax no entry Where Means Example no entry 11 no entry entry_number An integer number, from 1 through 40, that identifies the menu entry that is to reset.451-0310E 503 Removes the configured header from the current menu or submenu. (The configured header is specified with the header command, which is described on page 496.) Syntax no header Usage Guidelines After the no header command is executed, the default menu header will be used in the menu. The format of the default menu header is as follows: Menu LX Menu where identifies the submenu number of the menu. The top-level menu always has a submenu number of 1. For example, the default menu header for the top-level menu is Menu 1 LX Menu. Example no header no header504 451-0310E Removes (deletes) the continue string from the current menu or submenu. Syntax no menu continue string Example no menu continue string no menu continue string451-0310E 505 Removes (deletes) the prompt from the current menu or submenu. Syntax no menu prompt Example no menu prompt no menu prompt506 451-0310E Opens a new or existing menu file, and closes the current menu file. Syntax open NAME Where Means Usage Guidelines If you have made any changes to the current menu, the following prompt will be displayed when you execute the open command: The Menu has been modified. Do you want to save your changes? (y/n) : Enter y to save your changes to the current menu. Enter n to abandon your changes to the current menu. Example open finance_menu open NAME The name of the menu that is to be opened for editing.451-0310E 507 Saves the current menu file. Syntax save [] Where Means Example save save finance_menu save filename The filename under which the current menu file is to be saved. If no filename is specified, it will be saved to the filename of the current menu file.451-0310E 509 Chapter 13 Notification Commands The Notification commands are executed in the Notification command mode. When the LX unit is in the Notification command mode, the Notification command prompt (e.g., Notification:0 >>) is displayed on the terminal screen. The format of the Notification command prompt is as follows: Notification: >> where identifies the current session number. To enter the Notification command mode, execute the notification command in the Configuration command mode. The notification command is described on page 186.510 451-0310E When the end command is issued in the Notification command mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX command modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 511 Returns the user to the previous command mode. For example, if the current command mode is Notification, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX command modes. However, the effect of the exit command varies, depending on the command mode from which it is issued. For example, issuing the exit command in the Notification command mode returns the user to the Configuration command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit512 451-0310E Specifies the facility of a configurable syslogd messages. To display the configurable messages, refer to “show notification message” on page 104. Syntax message NUMBER facility user|syslog|kern|daemon|authpriv Where Means Examples message 1 facility user message 2 facility syslog message 3 facility kern message 4 facility daemon message 5 facility authpriv message facility NUMBER The ID number of a configurable syslogd message. This can be any integer number from 1 through 40. user The message applies to the User processes. syslog The message applies to the syslog daemon (syslogd). kern The message applies to the Linux kernel. daemon The message applies to a system daemon, such as in.ftpd. authpriv The message applies to the Superuser authentication process.451-0310E 513 Specifies the priority of a configurable syslogd messages. To display the configurable messages, refer to “show notification message” on page 104. Syntax message NUMBER priority emerg|alert|critical|error|notice|sigsnotice|info Where Means Examples message 1 priority emerg message 2 priority alert message 3 priority critical message 4 priority error message 5 priority notice message 6 priority info message priority NUMBER The ID number of a configurable syslogd message. This can be any integer number from 1 through 40. emerg The message indicates a severe condition. This is the kind of condition that can immediately affect the users’ ability to work on the LX. alert The message indicates a condition that the system administrator needs to correct immediately, such as a corrupted system database. critical The message indicates a critical condition, such as a hard device error. error The message indicates a software error condition. notice The message indicates a condition which is not an error, but which might require specific procedures to adjust it. warning This message indicates a warning condition. info The message is a normal, informational message.514 451-0310E Specifies the string portion of a configurable syslogd messages. To display the configurable messages, refer to “show notification message” on page 104. Syntax message NUMBER string Where Means Example message 1 string New CLI mode entered by message string NUMBER The ID number of a configurable syslogd message. This can be any integer number from 1 through 40. text The string portion of the configurable syslogd message. This string can contain up to 48 characters. 451-0310E 515 Deletes Service Profiles and User Profiles. (Service Profiles and User Profiles are used in the Notification Feature.) Syntax no serviceprofile|userprofile |all Where Means Examples no serviceprofile FinanceServerprof2 no serviceprofile all no userprofile Philpager no userprofile all no serviceprofile Delete the Service Profile specified in this command. userprofile Delete the User Profile specified in this command. name The name of the Service Profile, or User Profile, that is to be deleted. all Delete all Service Profiles, or all User Profiles.516 451-0310E Specifies the asynchronous port(s) for a Service Profile of the ASYNC type. Syntax serviceprofile async port |all|none Where Means Examples serviceprofile Lab3port2 async port 2 serviceprofile Lab3port2-5 async port 2 3 4 5 serviceprofile Lab3port2 async port all serviceprofile Lab3port2 async port none serviceprofile async port name The name of a Service Profile of the ASYNC type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as ASYNC. async_list Specifies the LX asynchronous port(s) to which syslogd will send the log messages. In order to specify asynchronous port(s) in this field, the Service Profile in the name field must be configured as ASYNC. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as ASYNC. If more than one asynchronous port is specified, they should be separated by blank spaces; for example, 2 3 5 6. Note: You cannot specify port 0 in this command. all Log messages will be sent to all asynchronous ports on the LX unit. none Log messages will not be sent to any asynchronous ports on the LX unit.451-0310E 517 Specifies the bits-per-byte setting for a Service Profile of the TAP type. Syntax serviceprofile bits NUMBER Where Means Example serviceprofile Center10 bits 6 serviceprofile bits name A Service Profile of the TAP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as TAP. NUMBER Specifies the number of bits per byte that must be supported on any modem port that is included in this Service Profile. The allowable values are 5 - 8. The default value is 8.518 451-0310E Specifies the web driver for a Service Profile of the WEB type. Syntax serviceprofile driver Where Means Usage Guidelines The date and time should be set for the LX unit. (If the date and the time are not set, some wireless providers will reject the message.) The date and time are set with the date and clock commands in the Configuration Command Mode. For more information, see the date command on page 168 and the clock command on page 165. Examples serviceprofile InternetATT driver ATT_WEB serviceprofile InternetORANGE driver ORANGE_WEB serviceprofile driver name A Service Profile of the WEB type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile of the WEB type. drivername Specifies the web driver that will be used to send a log message through a web interface. The allowable values are ATT_WEB, CELLNET_WEB, CINGULAR_WEB, ORANGE_WEB, PAGENET_WEB, PROXIMUS_WEB, and VERIZON_WEB.451-0310E 519 Specifies the file to which log messages are to be sent for a Service Profile of the Localsyslog type. Syntax serviceprofile file Where Means Example serviceprofile LabUnit3 file ricklog.txt serviceprofile file name A Service Profile of the Localsyslog type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as Localsyslog. filename Specifies the name of the file to which the log messages are to be sent. This file resides in the /var/log directory of the LX unit. 520 451-0310E Specifies the destination host for a Service Protocol of the Remotesyslog type. Syntax serviceprofile host Where Means Usage Guidelines After you have specified the remote host with the serviceprofile host command, you must configure the remote host to serve as a destination host for log messages. Do the following: 1. Add the following entry to the /etc/syslog.conf file on the remote host: user.warning /tftpboot/test/user.warning.log 2. Create an empty log file on the remote host: #touch /tftpboot/test/user.warning.log #chmod 777 /tftpboot/test/user.warning.log 3. Restart the syslog daemon on the remote host: # ps –ef|grep syslog # kill –HUP pid# Example serviceprofile Mapleprof host 140.76.45.123 serviceprofile host name A Service Profile of the Remotesyslog type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as Remotesyslog. hostname Specifies the host to which the log messages are to be forwarded. The host can be specified as an IP Address or as any symbolic name that can be resolved by DNS. 451-0310E 521 Specifies the modem ports for a Service Profile of the TAP type. Syntax serviceprofile modem port |all|none Where Means Examples serviceprofile Center10 modem port 4 serviceprofile Centers11and12 modem port 2 3 5 6 serviceprofile modem port name A Service Profile of the TAP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as TAP. port_list Specifies the modem port(s) that syslogd can dial out to send a log message via TAP. If more than one asynchronous port is specified, they should be separated by blank spaces; for example, 2 3 5 6. The modem ports that are specified in this field must support the bits-per-byte setting of the Service Profile. Refer to serviceprofile bits on page 517 for information on specifying the bits-per-byte setting for a Service Profile. Refer to the serviceprofile bits command on page 517 for information on setting the bits-per-byte setting for a modem port. all All modem ports on the LX unit can be dialed to send a message via TAP. none None of the modem ports on the LX unit can be dialed to send a message via TAP.522 451-0310E Specifies the bit parity characteristic for a Service Profile of the TAP type. Syntax serviceprofile parity Where Means Examples serviceprofile Center10 parity odd serviceprofile Center11 parity even serviceprofile Center12 parity none serviceprofile parity name A Service Profile of the TAP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as TAP. priority_setting Specifies the bit parity that must be used by a modem port in order to send log messages with the TAP protocol. The allowable values are odd, even, and none. The default value is none. Refer to the parity command on page 343 for information on specifying the bit parity of a port.451-0310E 523 Specifies an optional TCP port for a Service Profile of the SNPP type. Syntax serviceprofile port Where Means Examples serviceprofile FinanceServerprof2 port 7777 serviceprofile port name A Service Profile of the SNPP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as SNPP. tcp_port Specifies a TCP port on the provider’s SNPP server. The LX syslogd will send log messages to this TCP port. The Service Profile in the name field must be configured as SNPP. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as SNPP.524 451-0310E Creates a new Service Profile. A Service Profile specifies the method and means for sending log messages to a destination. Syntax serviceprofile protocol snpp|web|tap|snmp|localsyslog|remotesyslog |async|smtp Where Means Usage Guidelines This command defines a method (i.e., SNPP, Web protocol, TAP etc.) that will be used to send messages. However, a Service Profile is not fully defined until its means for sending messages have been specified. After you have created a Service Profile with the serviceprofile protocol command, do the following to specify the means that it will use to send the messages: • For Service Profiles of the SNPP type: 1. Execute the serviceprofile server command (see page 527) to specify the SNPP server that will be used to send messages to the destination. 2. Execute the serviceprofile port command (see page 523) to specify the LX TCP port that will be used to send messages to the SNPP server. serviceprofile protocol name Specifies the name of the Service Profile. The name can be any text string of up to 20 characters. snpp Specifies that the Service Profile will use the Simple Network Pager Protocol (SNPP) as the method for sending log messages. web Specifies that the Service Profile will use the Web protocol as the method for sending log messages. tap Specifies that the Service Profile will use the Telocator Alphanumeric Protocol (TAP) as the method for sending log messages. snmp Specifies that the Service Profile will use the Simple Network Management Protocol (SNMP) as the method for sending log messages. localsyslog Specifies that the Service Profile will send log messages to a local file on the LX unit. remotesyslog Specifies that the Service Profile will send log messages to syslogd on a remote host. async Specifies that the Service Profile will send log messages to an outbound asynchronous ports on the LX unit. smtp Specifies that the Service Profile will use the Simple Mail Transfer Protocol (SMTP) to send log messages to an email address.451-0310E 525 • For Service Profiles of the Web type, execute the serviceprofile driver command (see page 518) to specify the web driver that is used to send the message through a web interface. • For Service Profiles of the TAP type: 1. Execute the serviceprofile smsc command (see page 528) to specify the Short Message Service Center (SMSC) that will be used to send the log messages to the user. 2. Execute the serviceprofile bits command (see page 517) to specify the bits per byte that must be supported by the provider’s application that is specified in a User Profile based on this Service Profile. 3. Execute the serviceprofile stopbits command (see page 530) to specify the stopbits that must be supported by the provider’s application that is specified in a User Profile based on this Service Profile. 4. Execute the serviceprofile parity command (see page 522) to specify the bit parity that must be used by the provider’s application that is specified in a User Profile based on this Service Profile. • For Service Profiles of the SMTP type, execute the serviceprofile server command (see page 527) to specify the SMTP server that will be used to send messages to the destination. • For Service Profiles of the SNMP type, create an SNMP trap client for the LX unit. The log messages will be sent to all of the SNMP trap clients of the LX unit. To create an SNMP trap client, execute the following commands in the SNMP Command Mode: • trap client (see page 423) • trap client community (see page 424) • trap client version (see page 425) • For Service Profiles of the Localsyslog type, execute the serviceprofile file command (see page 519) to specify the local file to which messages will be sent. • For Service Profiles of the Async type, execute the serviceprofile async port command (see page 516) to specify the outbound asynchronous port to which messages will be sent. • For Service Profiles of the Remotesyslog type, execute the serviceprofile host command (see page 520) to specify the remote host to which the log messages are sent. serviceprofile protocol (continued)526 451-0310E Examples serviceprofile skytel protocol snpp serviceprofile labunit protocol local serviceprofile port4 protocol async serviceprofile internetATT protocol web serviceprofile Center10 protocol tap serviceprofile Lab3snmp protocol snmp serviceprofile Lab3billtxt protocol localsyslog serviceprofile Mapleprof protocol remotesyslog serviceprofile emailprof protocol smtp serviceprofile protocol (continued)451-0310E 527 Specifies the server for a Service Profile of the SMTP or SNPP type. NOTE: In order to execute this command, you must have already configured the Domain Name suffix, Local DNS Address, and IP parameters for the LX unit. Syntax serviceprofile server Where Means Examples serviceprofile emailprof server 118.28.118.34 serviceprofile newsnpp1 server snpp.skytel.com serviceprofile server name A Service Profile of the SMTP or SNPP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as SMTP or SNPP. server_name Specifies the server to which syslogd will send the log messages. The messages will be forwarded from the server to the user. The server can be specified as an IP Address or as any symbolic name that can be resolved by DNS.528 451-0310E Specifies the Short Message Service Center (SMSC) for a Service Profile of the TAP type. Syntax serviceprofile smsc Where Means Usage Guidelines Now configure the LX modem port that will be used for sending messages. In the following example, the required settings are specified on port 17: Config>>port async 17 Async 17>>no apd Async 17>>access remote Async 17>>modem Modem>>modem enable Modem>>type dialout A list of wireless SMSC phone numbers is provided here for your convenience: NOTE: MRV Communications is not responsible for these SMSC phone numbers and cannot guarantee their service. Please contact your provider for a number near you. serviceprofile smsc name A Service Profile of the TAP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as TAP. tel_num Specifies the telephone number of the SMSC to which the notification is to be sent. The telephone number must contain at least 10 digits. The maximum length of the telephone number is 20 digits. Note: Your modem settings for bits-per-second, stopbits, and parity are not required to match those of your SMSC provider. Carrier SMSC Number Email Address SMSC Phone#@ AT&T 7, 1, e 800-841-8837 @mobile.att.net Cingular 7, 1, e 800-909-4602 @Cingular.com Nextel 7, 1, e 801-301-6683 @messaging.nextel.com Sprint 7, 1, e 888-656-1727 @sprintpcs.com Verizon 7, 1, e, 8, 1, n 866-823-0501 @vtext.com Skytel 8, 1, n 800-679-2778 pin@skytel.com451-0310E 529 Example userprofile servicecenter3 smsc 3776809977 serviceprofile smsc (continued)530 451-0310E Specifies the stop bits characteristic for a Service Profile of the TAP type. Syntax serviceprofile stopbits NUMBER Where Means Example serviceprofile Center10 stopbits 2 serviceprofile stopbits name A Service Profile of the TAP type. Refer to the serviceprofile protocol command on page 524 for more information on configuring a Service Profile as TAP. NUMBER Specifies the number of stop bits for the Service Profile. The allowable values are 1 or 2. The default value is 1. Refer to the stopbits on page 356 for information on setting the stop bits for a port.451-0310E 531 Specifies the contact information for a User Profile. Contact information must be specified for any User Profile that is associated with a Service Profile of the Web, SNPP, SMTP, or TAP type. Syntax userprofile contact Where Means Examples userprofile PhilWilliams contact 167451 userprofile JohnSmith contact 3995987642 userprofile JaneWalton contact 3996541276 userprofile NormanWillis contact nwillis@yourcompany.com userprofile contact name Specifies the name of a User Profile. (The User Profile must be one that is associated with a Service Profile of the Web, SNPP, or TAP type.) contact_name Specifies the contact information for the User Profile. (The contact information is the telephone number, pager ID, or email address to which the log messages will be sent.) The content of this field depends on the type of the Service Profile that is associated with the User Profile. If the associated Service Profile is of the SMTP type, this field must contain an email address. If the associated Service Profile is of the Web, SNPP, or TAP type, this field can contain a pager ID or a telephone number. The pager ID must consist of between 1 and 35 digits.532 451-0310E Specifies the facility characteristic for a User Profile. Only those log messages that originate from a Linux facility that matches this characteristic will be sent to the user. Syntax userprofile facility Where Means Examples userprofile PhilWilliams facility all userprofile JohnSmith facility authpriv userprofile JaneWalton facility daemon userprofile NormanWillis facility kern userprofile facility name Specifies the name of a User Profile. facility_char Specifies the facility characteristic for the User Profile. The allowable values are authpriv, daemon, kern, syslog, user, and all.451-0310E 533 Specifies the priority characteristic for a User Profile. Only those log messages that match this priority level will be sent to the user. Syntax userprofile priority emerg|alert|critical|error|notice|info |warning|sigsnotice Where Means Examples userprofile JohnSmith priority info userprofile JaneWalton priority notice userprofile NormanWillis priority warning userprofile priority name Specifies the name of a User Profile. emerg Only messages with a priority of emerg will be sent to the user. Messages with this priority indicate a condition that can immediately affect the users’ ability to work on the LX. alert Only messages with a priority of alert will be sent to the user. Messages with this priority indicate a condition that the system administrator needs to correct immediately, such as a corrupted system database. critical Only messages with a priority of critical will be sent to the user. Messages with this priority indicate a critical condition, such as a hard device error. error Only messages with a priority of error will be sent to the user. Messages with this priority indicate a software error condition. notice Only messages with a priority of notice will be sent to the user. Messages with this priority indicate a condition which is not an error, but which might require specific procedures to adjust it. info Only messages with a priority of info will be sent to the user. These are normal, informational messages. warning Only messages with a priority of warning will be sent to the user. sigsnotice Only messages with a priority of sigsnotice will be sent to the user. Messages with this priority indicate a state transition of the serial input signals CTS or DCD/DSR. Note: When this priority is specified, the facility for the User Profile must be set to kern. Refer to “userprofile facility” on page 532 to set the facility for a User Profile to kern.534 451-0310E Creates a new User Profile or changes the Service Profile associated with an existing User Profile. Syntax userprofile serviceprofile Where Means Usage Guidelines After a User Profile has been created, a facility characteristic and a priority characteristic can be specified for it. For more information, refer to userprofile facility on page 532 and userprofile priority on page 533. You must define a contact field for a User Profile that is based on a Service Profile of the SNPP, SMTP, TAP, or WEB type. For more information, refer to the userprofile contact command on page 531. Examples userprofile PhilWilliams serviceprofile internetATT userprofile JohnSmith serviceprofile Center10 userprofile JaneWalton serviceprofile emailprof userprofile serviceprofile name Specifies the name of a new or existing User Profile. The name can be any text string of up to 20 characters. Note: The LX unit supports a maximum of 20 User Profiles. service_profile_name Specifies the name of a fully defined Service Profile. For information on creating a fully defined Service Profile, refer to the “Usage Guidelines” for the userprofile contact command (see page 531).451-0310E 535 Chapter 14 Broadcast Group Commands The Broadcast Group commands are executed in the Broadcast Group command mode. When the LX unit is in the Broadcast Group command mode, the Broadcast Group command prompt (e.g., BrGroups 6:0 >>) is displayed on the terminal screen. The format of the Broadcast Group command prompt is as follows: BrGroups : >> where identifies the Broadcast Group under configuration. identifies the current session number. To enter the Broadcast Group command mode, execute the broadcast group command in the Configuration command mode. The broadcast group command is described on page 163.536 451-0310E When the end command is issued in Broadcast Group Mode, it returns the user to the Superuser command mode. Syntax end Usage Guidelines The end command can be issued in all of the LX Command Modes except for User and Superuser. Executing the end command always returns the user to the Superuser command mode. Example end end451-0310E 537 Returns the user to the previous command mode. For example, if the current command mode is the Broadcast Group Command Mode, issuing this command will return the user to the Configuration command mode. Syntax exit Usage Guidelines The exit command can be issued in all of the LX Command Modes. However, the effect of the exit command varies, depending on the mode from which it is issued. As noted above, issuing the exit command in the Broadcast Group command mode returns the user to the previous command mode. The same goes for issuing the exit command in any command mode other than User. For example, issuing the exit command in the Menu Editing command mode returns the user to the Menu command mode; issuing the exit command in the Configuration command mode returns the user to the Superuser command mode, and so on. Issuing the exit command in the User command mode exits the LX CLI and closes the connection to the LX unit. Example exit exit538 451-0310E Specifies the asynchronous port(s), or TCP port(s), that are to be used as Master Port(s) for the Broadcast Group under configuration. The Master Port is the port from which all input for a Broadcast Group is sent to the Slave Ports. NOTE: To prevent data overruns, it is recommended that the Master Port(s) and Slave Port(s) in a Broadcast Group be set to the same port speed. Syntax master port async|tcp [timestamp] Where Means Usage Guidelines The following cannot be specified as Master Ports: • Any port that belongs to another Broadcast Group • A TCP port that is already in use • A port that is configured as a Slave Port in any Broadcast Group At most, one TCP socket may be open on a single TCP port. Examples master port async 5 6 8 master port tcp 1500 master port async An asynchronous port, or asynchronous ports, will be specified as the Master Port(s) for the Broadcast Group under configuration. tcp A TCP port, or TCP port(s), will be specified as the Master Port(s) of the Broadcast Group under configuration. The allowable values are 1024 - 65535. port_list Specifies the asynchronous port(s), or TCP port(s), that will be used as the Master Port(s) for the Broadcast Group under configuration. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. Note: You cannot specify the DIAG port (port 0) as a Master Port. A maximum of 20 ports, including Masters and Slaves, can be configured for a Broadcast Group. A maximum of two TCP ports can be configured for a Broadcast Group. timestamp Specifies that a timestamp will be appended at the beginning of each new line of data. This option can only be applied after the Master Port has been created.451-0310E 539 Specifies the Telnet mode for the Broadcast Group under configuration. Syntax mode line|character Where Means Examples mode line mode character mode line The Broadcast Group will use Telnet line mode. character The Broadcast Group will use Telnet character mode.540 451-0310E Removes a Master Port, or Master Ports, from the Broadcast Group under configuration. Syntax no master port async|tcp Where Means Examples no master port async 5 no master port async 5 6 8 no master port tcp 1500 2500 no master port tcp 1500 2500 no master port async Remove asynchronous Master Port(s) from the Broadcast Group under configuration. tcp Remove TCP Master Port(s) from the Broadcast Group under configuration. The allowable values are 1024 - 65535. port_list Specifies the asynchronous port(s), or TCP port(s), that are being removed from the Broadcast Group under configuration. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. 451-0310E 541 Removes a Slave Port, or Slave Ports, from the Broadcast Group under configuration. Syntax no slave port async|tcp Where Means Examples no slave port async 5 no slave port async 2 5 6 7 no slave port tcp 1500 no slave port tcp 1500 2500 no slave port async Remove asynchronous Slave Port(s) from the Broadcast Group under configuration. tcp Remove TCP Slave Port(s) from the Broadcast Group under configuration. port_list Specifies the asynchronous port(s), or TCP port(s), that are being removed from the Broadcast Group under configuration. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. 542 451-0310E Removes the discard setting from a Slave Port, or Slave Ports, in the Broadcast Group under configuration. Syntax no slave port async|tcp discard Where Means Examples no slave port async 5 discard no slave port async 2 5 6 7 discard no slave port tcp 1500 discard no slave port tcp 1500 2500 discard no slave port discard async Remove the discard setting from asynchronous Slave Ports. tcp Remove the discard setting from TCP Slave Ports. port_list Specifies the asynchronous port(s), or TCP port(s), for which the discard setting is being removed. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. 451-0310E 543 Removes the localecho setting from a Slave Port, or Slave Ports, in the Broadcast Group under configuration. Syntax no slave port async|tcp localecho Where Means Examples no slave port async 5 localecho no slave port async 2 5 6 7 localecho no slave port tcp 1500 localecho no slave port tcp 1500 2500 localecho no slave port localecho async Remove the localecho setting from asynchronous Slave Ports. tcp Remove the localecho setting from TCP Slave Ports. port_list Specifies the asynchronous port(s), or TCP port(s), for which the localecho setting is being removed. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. 544 451-0310E Specifies the asynchronous port(s), or TCP port(s), that are to be used as Slave Port(s) for the Broadcast Group under configuration. The Slave Ports receive data from the Master Port and send all of their data to the Master Port. NOTE: To prevent data overruns, it is recommended that the Slave Port(s) and Master Port(s) in a Broadcast Group be set to the same port speed. Syntax slave port async|tcp discard|localecho Where Means Usage Guidelines The following cannot be specified as Slave Ports: • Any port that belongs to another Broadcast Group • A TCP port that is already in use • A port that is configured as a Master Port in any Broadcast Group At most, one TCP socket may be open on a single TCP port. Examples slave port async 5 discard slave port async An asynchronous port, or asynchronous ports, will be specified as the Slave Port(s) for the Broadcast Group under configuration. tcp A TCP port, or TCP port(s), will be specified as the Slave Port(s) of the Broadcast Group under configuration. The allowable values are 1024 - 65535. port_list Specifies the asynchronous port(s), or TCP port(s), that will be used as the Slave Port(s) for the Broadcast Group under configuration. If more than one port is specified, they should be separated by blank spaces; for example, 2 3 5 6. Note: You cannot specify the DIAG port (port 0) as a Slave Port. A maximum of 20 ports, including Masters and Slaves, can be configured for a Broadcast Group. A maximum of two TCP ports can be configured for a Broadcast Group. discard The port(s) specified in this command will discard any data that comes into them. localecho The port(s) specified in this command will echo any data that comes into them. 451-0310E 545 slave port async 2 5 6 7 discard slave port async 5 localecho slave port async 2 5 6 7 localecho slave port tcp 1500 discard slave port tcp 1500 2500 discard slave port tcp 1500 localecho slave port tcp 1500 2500 localecho slave port (continued)451-0310E 547 INDEX A access command 308 access console enable command 368 access port command 369 access power model command 309 access ssh enable command 370 access telnet enable command 371 access web enable command 372 accounting enable command 448 address command 276 apd enable command 310 apd retry command 311 apd signature command 312 apd timeout command 313 Async command mode 307 Async command prompt 307 Async mode exiting from Async mode 335, 336 asynchronous ports APD settings, defaulting 330 Asynchronous Protocol Detection (APD), enabling 310 autobaud, enabling 317 autodial, enabling 319 autohangup, enabling 320 bits per character, configuring 322 break enabling 323 break sequence, defining 324 configuring APD retries 311 configuring authentication 314 configuring autobaud retries 318 configuring the access method 308, 309 configuring the APD signature 312 configuring the APD timeout 313 connect commands, specifying 325 data buffer display options 326 data buffer size, configuring 327 data buffer size, defaulting 331 databuffer syslog, enabling 328 databuffer timestamp, enabling 329 description, specifying 340 flow control, specifying 337 login banners, creating 321 Modem Control, enabling 339 parity bit, specifying 343 port prompt, specifying 350 port speed, defaulting 334 port speed, specifying 355 settings, defaulting 332 stop bits, specifying 356 audit log enable command 373 authentication command 314, 449 authentication fallback enable command 277, 316 authentication local enable command 278 authentication none command 279 authentication radius enable command 280 authentication securid enable command 281 authentication tacacs+ enable command 282 Authentication, disabling 279 autobaud enable command 317 autobaud retry command 318 autodial enable command 319 autohangup enable command 320 B backward_switch command 374 banner command 321 bits command 322 boot configuration from flash command 160 boot configuration from name command 161 boot configuration from network command 162 break enable command 323 break special command 324 broadcast command 283 broadcast group command 163 Broadcast Group command mode 535 Broadcast Group command prompt 535 broadcast group enable command 164 Broadcast Group mode, exiting from Broadcast Group mode 536, 537 Broadcast Group settings Telnet mode, specifying 539 Broadcast Groups548 451-0310E discard setting, removing from a slave port 542 localecho setting, removing from a slave port 543 master port, removing 540 master port, specifying 538 slave port, removing 541 slave ports, specifying 544 C ccp enable command 450 clear command 34, 66 clock command 165 Clock. See System clock. Command Editing mode exiting from Command Editing mode 495 command log enable command 375 command syntax 22 configuration command 67 Configuration command mode 159 Configuration command mode, entering 67 Configuration command prompt 159 Configuration mode exiting from Configuration mode 175, 176 configuration, saving the 80 connect command command 325 contact command 410 control key command 488 copy port command 166 copy subscriber command 167 D databuffer display command 326 databuffer size command 327 databuffer syslog enable command 328 databuffer timestamp enable command 329 date command 168 Debug information displaying for ports 83, 90 displaying for subscribers 91 generating for asynchronous ports 68 generating for SNMP 69 generating for subscribers 70 debug port async ppp command 68 debug snmp command 69 debug subscriber command 70 dedicated service command 376 default access port command 377 default access remote command 378 default apd command 330 default authentication command 451 default backward_switch command 379 default boot command 169 default configuration command 170 default databuffer size command 331 default dialback retry command 380 default forward_switch command 381 default idletime command 382 default initstring command 438 default ipcp command 452 default lcp compression command 453 default lcp echo failure command 454 default lcp failure limit command 455 default lcp timeout command 456 default local_switch command 383 default log size command 171 default mode client username command 457 default mtu command 284, 458 default outlet group off time command 172 default port command 332 default power off time command 333 default remote address command 459 default rotary command 285 default speed command 334 default ssh keepalive command 286 default ssh log level command 384 default ssh port command 287 default telnet port command 288 default tftp command 173 default v3 client command 411 Defaulting the LX unit 170 delete command 480 description command 362 Device information displaying 92 dialback enable command 385 Dialback feature. See Subscriber settings, dialback. dialback number command 386 dialback retry command 387 dialout number command 439 disconnect command 35, 71 display command 489 Displays broadcast group information 85 command log 87451-0310E 549 configuration log 89 date and time 41, 86 device 92 device information 94 global system configuration 139 interface information 95, 97, 99, 100, 101 IP information 125 logged-in users 149 pattern-matching characteristics 111 port debug 90 ppciboot configured load settings 141 Radius information 120, 122, 124 SecurID information 126, 128, 129 SNMP information 132, 133 subscriber debug 91 Superuser-mode broadcast groups 84 Superuser-mode port 108, 109, 110, 112, 113, 114, 115, 116, 117, 119 Superuser-mode services display 130 Superuser-mode session display 131 Superuser-mode subscriber displays 137, 138 System configuration table 88 system status 142 User-mode port displays 42, 55, 137, 138 User-mode services display 53 User-mode session display 54 User-mode subscriber displays 55 User-mode versions display 61, 150 domain name command 174 domain name, specifying the 174 E enable command 36 end command 175, 289, 335, 363, 388, 412, 440, 460, 481, 490, 510, 536 entry command 491 entry command command 492 entry label command 493 entry menu command 494 Ethernet command mode 361 Ethernet command mode, entering 195 Ethernet command prompt 361 Ethernet mode, exiting from Ethernet mode 363, 364 Ethernet port description, removing 365 Ethernet ports duplex mode, specifying 366 port description, specifying 362 speed, specifying 366 exit command 37, 72, 176, 290, 336, 364, 389, 413, 441, 461, 482, 495, 511, 537 F Fallback feature, enabling 277, 316 Features, disabling Async Port command mode 341 in Superuser mode 74 Menu command mode 485 Modem command mode 443 PPP command mode 476, 515 Subscriber command mode 395 features, disabling Configuration command mode 185 Interface command mode 293 SNMP command mode 419 User-mode features 38 finger daemon. See fingerd. fingerd enable command 177 fingerd, enabling 177 flowcontrol command 337 forward_switch command 390 G gateway command 178 get client command 414 get client community command 415 get client version command 416 H header command 496 Help. See Online help. host name, configuring the 179 hostname command 179 how port async ppp command 112 I iboot file changing 160, 161, 162 resetting to default 169 idletime command 391 import command 483 initstring command 442 interface command 180 Interface command mode 275 Interface command prompt 275550 451-0310E Interface mode entering 180 exiting from Interface mode 289, 290 Interface parameters, setting Broadcast Address 283 Maximum Transmission Unit (MTU) size 292 MTU size 284 rotary parameters 285 SSH UDP port 287 subnet mask 291 Telnet UDP port 288 Interface parameters, setting IP Address 276 Interface parameters, SSH keepalive count, specifying 301 Interface parameters, SSH keepalive interval, specifying 302 Interface parameters, SSH keepalive settings, defaulting 286 IP parameters, setting gateway 227 gateway (default route) 178 Primary Domain Name Server (DNS) 204 Secondary DNS 229 static route 226 subnet mask 228 ipcp accept address enable command 462 ipcp compression enable command 463 ipcp failure limit command 464 ipcp timeout command 465 iptables command 181 L lcp compression enable command 466 lcp echo failure command 467 lcp echo interval command 468 lcp failure limit command 469 lcp timeout command 470 Linux shell, entering the 82 list command 484, 497 local address command 471 Local authentication, enabling 278 local_switch command 392 location command 182, 417 log enable command 418 log file sizes resetting to default 171 specifying 183 log size command 183 Logging out a device 73 Logging out a subscriber 73 Logging out an LX port 73 logout command 73 logs, resetting the 156 LX CLI, exiting the 37 LX software, updating 154 M mask command 291 master port command 538 maxsubscriber command 393 menu command 184, 498 Menu command mode 479 Menu command prompt 479 menu continue string command 499 Menu Editing command prompt 487 Menu Editing mode 487 exiting from Menu Editing mode 490 menu enable command 394 Menu mode exiting from Menu mode 481, 482 Menu mode, entering 184 menu prompt command 500 Menus accessing submenus 498 control keys, assigning 488 control keys, removing 501 creating a Menu header 496 creating entries 492, 493, 494 deleting 480 displaying 489 displaying an entry 491 listing the menus 484 listing the submenus 497 merging menus 483 modifying entries 491, 492, 493, 494 opening a menu 486, 506 removing continue strings 504 removing headers 503 removing prompts 505 resetting entries 502 saving menus 507 message facility command 512 message priority command 513 message string command 514 mode client command 472451-0310E 551 mode client username command 473 mode command 539 mode server command 474 modem command 338 Modem command mode 437 Modem command prompt 437 modem enable command 339 Modem mode exiting from Modem mode 440, 441 Modem mode, entering 338 Modem settings, configuring dialout retries, specifying 444 initialization string, specifying 442 timeout, specifying 445 type, specifying 446 mtu command 292, 475 N name command 340 Network Time Protocol (NTP) enabling 187 NTP server specifying 188 no command 38, 74, 185, 293, 341, 395, 419, 443, 476, 485, 515 no control key command 501 no description command 365 no entry command 502 no header command 503 no master port command 540 no menu continue string command 504 no menu prompt command 505 no slave port command 541 no slave port discard command 542 no slave port localecho command 543 notification command 186 Notification command mode 509 Notification command mode, entering 186 Notification command prompt 509 Notification mode exiting from Notification mode 510, 511 ntp enable command 187 ntp server address command 188 O off time resetting to default 172, 333 Online help, displaying 30 open command 486, 506 outlet command 75 outlet group command 76, 189 outlet group name command 190 outlet group off time command 191 outlet name command 342 P parity command 343 password command 192, 396 password enable command 193, 397 pattern match enable command 344 Pattern matching enabling 344 pattern string command 345 pause enable command 39, 77, 398 ping command 40, 78 pinging a host in Superuser mode 78 in User mode 40 Point-to-Point Protocol (PPP), configuring accounting, enabling 448 authentication retries, defaulting 451 authentication timeout, defaulting 451 authentication, enabling 449 CCP negotiation, enabling 450 CHAP secret, specifying 472 client mode 472 client mode username 473 IPCP address negotiation 462 IPCP compression, enabling 463 IPCP failure limit, specifying 464 IPCP options, defaulting 452 IPCP timeout, specifying 465 LCP compression, enabling 466 LCP echo failure, specifying 467 LCP echo interval, specifying 468 LCP failure limit, specifying 469 LCP options, defaulting 453, 454, 455, 456 LCP timeout, specifying 470 Local Address, specifying 471 Maximum Transmission Unit (MTU), defaulting 458 MTU size, specifying 475 PAP secret, specifying 472 PPP mode, specifying 474 remote address, specifying 477 port async command 194 Port Async mode, entering 194552 451-0310E port configuration, copying the 166 port ethernet command 195 power off time command 347 ppciboot address assignment option command 197 ppciboot address command 196 ppciboot Ethernet network link duplex mode, specifying 198 speed, specifying 198 ppciboot ethernet network link command 198 ppciboot file, updating 154 ppciboot gateway command 199 ppciboot image filename command 200 ppciboot image load from command 201 ppciboot mask command 202 ppciboot tftp server command 203 ppp command 348 PPP command mode 447 PPP command prompt 447 ppp enable command 349 PPP mode enabling 349 entering 348 exiting from PPP mode 460, 461 preferred service command 399 primary dns command 204 prompt command 350, 400 Q Quick Start Configurator. Se setup utility. R Radius Radius accounting, enabling 294, 351 Radius authentication, enabling 280 radius accounting enable command 294, 351 Radius parameters, setting primary accounting server parameters 206, 207, 208, 209, 210 primary authentication server parameters 211, 212, 213, 214, 215 secondary accounting server parameters 216, 217, 218, 219, 220 secondary authentication server parameters 221, 222, 223, 224, 225 Radius parameters, setting the Radius period 205 radius period command 205 radius primary accounting address command 206 radius primary accounting port command 207 radius primary accounting retransmit command 208 radius primary accounting secret command 209 radius primary accounting timeout command 210 radius primary server address command 211 radius primary server port command 212 radius primary server retransmit command 213 radius primary server secret command 214 radius primary server timeout command 215 radius secondary accounting address command 216 radius secondary accounting port command 217 radius secondary accounting retransmit command 218 radius secondary accounting secret command 219 radius secondary accounting timeout command 220 radius secondary server address command 221 radius secondary server port command 222 radius secondary server retransmit command 223 radius secondary server secret command 224 radius secondary server timeout command 225 Rebooting the LX. See Re-starting the LX. Related documents 31 reload command 79 remote address command 477 Restarting the LX 79 retry command 444 Rotaries assigning rotary ports 296 assigning SSH sockets 297 assigning TCP sockets 298 enabling 295 port-search method 299 rotary enable command 295 rotary port command 296 rotary ssh port command 297 rotary tcp port command 298 rotary type command 299 route address command 226 route gateway command 227 route mask command 228 S save command 507 save configuration command 80451-0310E 553 screen pause enabling in Superuser mode 77 enabling in User mode 39 screen, clearing the in Superuser mode 66 in User mode 34 secondary dns command 229 SecurID SecurID authentication, enabling 281 securid authentication encryption command 230 securid authentication port command 231 securid authentication retransmit command 232 securid authentication timeout command 233 securid authentication version command 234 securid master authentication server address command 235 securid master authentication server name command 236 SecurID parameters, setting authentication port 231 authentication version 234 encryption method 230 master authentication server parameters 235, 236 primary authentication server parameters 237, 238 retries 232 slave authentication server parameters 239, 240 timeout 233 securid primary authentication server address command 237 securid primary authentication server name command 238 securid slave authentication server address command 239 securid slave authentication server name command 240 security level superuser command 401 serial command 300 service command 241 serviceprofile async port command 516 serviceprofile bits command 517 serviceprofile driver command 518 serviceprofile file command 519 serviceprofile host command 520 serviceprofile modem port command 521 serviceprofile parity command 522 serviceprofile port command 523 serviceprofile protocol command 524, 527 serviceprofile smsc command 528 serviceprofile stopbits command 530 session disconnecting in Superuser mode 71 disconnecting in User mode 35 session command 402 set client command 420 set client community command 421 set client version command 422 setup command 81 Setup utility, entering the 81 shell command 82 shell enable command 403 show audit log command 83 show broadcast group characteristics command 84 show broadcast group summary command 85 show clock command 41, 86 show command log command 87 show config command 88 show configuration log command 89 show debug port async ppp command 90 show debug subscriber command 91 show device command 92 show device summary command 94 show interface characteristics command 95 show interface port mapping command 97 show interface rotary command 99 show interface status command 100 show interface summary command 101 show kernel log command 102 show log command 103 show notification message command 104 show notification serviceprofile command 105 show notification userprofile command 106 show outlet group status command 107 show port async apd command 108 show port async characteristics command 109 show port async modem command 110 show port async pattern match characteristics command 111 show port async ppp status command 113 show port async status command 114 show port async summary command 115 show port command 42 show port ethernet characteristics command 116554 451-0310E show port ethernet status command 117 show port ethernet summary command 119 show radius characteristics command 120 show radius status command 122 show radius summary command 124 show route command 125 show securid characteristics command 126 show securid status command 128 show securid summary command 129 show service command 53, 130 show session command 54, 131 show snmp characteristics command 132 show snmp client command 133 show snmp v3 command 134 show subscriber command 55, 137 show subscriber summary command 138 show system characteristics command 139 show system ppciboot command 141 show system status command 142 show users command 149 show version command 61, 150 signals syslog enable command 352 slave port command 544 snmp command 242 SNMP command mode 409 SNMP command prompt 409 snmp enable command 243 SNMP mode exiting from SNMP mode 412, 413 SNMP parameters, setting default v3 client 411 SNMP contact 410 SNMP get client 414 SNMP get client community 415 SNMP get client version 416 SNMP location 417 SNMP set client 420 SNMP set client community 421 SNMP set client version 422 SNMP trap client 423 SNMP trap client community 424 SNMP trap client version 425 special break enable command 353 special break string command 354 speed command 355, 366 ssh cipher command 404 ssh command 62, 151 SSH connection from Superuser Mode 151 from User Mode 62 ssh enable command 244 ssh keepalive count command 301 ssh keepalive interval command 302 ssh key command 405 ssh log level command 406 ssh port command 303 SSH sockets assigning to an interface 303 ssh v1 command 245 ssh v2 command 246 statistics data, zeroing the 155 stopbits command 356 subscriber command 247 Subscriber command mode 367 Subscriber command prompt 367 subscriber configuration, copying the 167 Subscriber mode entering 247 exiting from Subscriber mode 388, 389 Subscriber settings access method, specifying a 368, 369, 370, 371, 372 access port, defaulting 377 Backward Switch character, defaulting 379 Backward Switch character, specifying 374 command log, enabling 375 dedicated service, assigning a 376 Dialback retries, defaulting 380 dialback retries, specifying 387 dialback telephone number, specifying 386 dialback, enabling 385 dialout telephone number, specifying 439 Forward Switch character, defaulting 381 Forward Switch character, specifying 390 Inactivity Timeout, defaulting 382 Inactivity timeout, specifying 391 Local Switch character, defaulting 383 Local Switch character, specifying 392 maximum sessions, specifying 402 maximum simultaneous connections, specifying 393 Menu feature, enabling 394 password protection, enabling 397 password, specifying 396 port auditing, enabling 373 preferred service, specifying 399451-0310E 555 prompt, specifying 400 screen pause, enabling 398 shell mode, enabling 403 ssh encryption type, specifying 404 ssh key, specifying 405 SSH log level, defaulting 384 ssh log level, specifying 406 Superuser privileges, configuring 401 Telnet mode, specifying 407 terminal type, specifying 408 Superuser command mode 65 Superuser command prompt 65 Superuser mode entering 36 Superuser Mode, exiting 72 Superuser password, specifying 192, 193 System calendar setting the date 168 System clock setting the date and time 273 setting the time 165 T TACACS+ TACACS+ accounting, enabling 304, 357 TACACS+ authentication, enabling 282 tacacs+ accounting enable command 304, 357 TACACS+ parameters, setting primary accounting server parameters 249, 250, 251, 252, 253 primary authentication server parameters 254, 255, 256, 257, 258 secondary accounting server parameters 259, 260, 261, 262, 263 secondary authentication server parameters 264, 265, 266, 267, 268 superuser password request enable 269 TACACS+ parameters, setting the TACACS+ period 248 tacacs+ period command 248 tacacs+ primary accounting address command 249 tacacs+ primary accounting port command 250 tacacs+ primary accounting retransmit command 251 tacacs+ primary accounting secret command 252 tacacs+ primary accounting timeout command 253 tacacs+ primary server address command 254 tacacs+ primary server port command 255 tacacs+ primary server retransmit command 256 tacacs+ primary server secret command 257 tacacs+ primary server timeout command 258 tacacs+ secondary accounting address command 259 tacacs+ secondary accounting port command 260 tacacs+ secondary accounting retransmit command 261 tacacs+ secondary accounting secret command 262 tacacs+ secondary accounting timeout command 263 tacacs+ secondary server address command 264 tacacs+ secondary server port command 265 tacacs+ secondary server retransmit command 266 tacacs+ secondary server secret command 267 tacacs+ secondary server timeout command 268 tacacs+ superuser password request enable command 269 telnet break string command 358 telnet command 63, 152 Telnet connection from Superuser Mode 152 from User Mode 63 telnet enable command 270 telnet mode command 407 telnet negotiation enable command 359 telnet port command 305 Telnet sockets assigning to an interface 305 terminal command 64, 153, 408 Terminal type setting in Superuser mode 153 setting in User mode 64 tftp command 271 tftp retry resetting to default 173 tftp timeout resetting to default 173 Time Daemon. See timed timed enable command 272 timed, enabling 272 timeout command 445 timezone command 273 transparency enable command 360556 451-0310E trap client command 423 trap client community command 424 trap client version command 425 type command 446 typographical conventions 22 U update command 154 User command mode 33 User command prompt 33 userprofile contact command 531 userprofile facility command 532 userprofile priority command 533 userprofile serviceprofile command 534 V v3 client access context match command 426 v3 client access context prefix command 427 v3 client access read view command 428 v3 client access security command 429 v3 client access write view command 430 v3 client group security model command 431 v3 client name command 432 v3 client security community command 433 v3 client security source command 434 v3 client view command 435 v3 engine command 436 W web_server enable command 274 Z zero all command 155 zero log command 156 zero securid secret command 157 LX-Series Configuration Guide 451-0311B Corporate Headquarters MRV Communications, Inc. Corporate Center 20415 Nordhoff Street Chatsworth, CA 91311 Tel: 818-773-0900 Fax: 818-773-0906 www.mrv.com (Internet) Sales and Customer Support MRV Americas 295 Foster Street Littleton, MA 01460 Tel: 800-338-5316 (U.S.) Tel: +011 978-952-4888 (Outside U.S.) sales@mrv.com (email) www.mrv.com (Internet) MRV International Industrial Zone P.O. Box 614 Yokneam, Israel 20682 Tel: 972-4-993-6200 sales@mrv.com (email) www.mrv.com (Internet)2 451-0311B All rights reserved. No part of this publication may be reproduced without the prior written consent of MRV Communications, Inc. The information in this document is subject to change without notice and should not be construed as a commitment by MRV Communications, Inc. MRV Communications, Inc. reserves the right to revise this publication and to make changes in content from time to time, without obligation to provide notification of such revision or changes. MRV Communications, Inc. assumes no responsibility for errors that may appear in this document. Copyright © 2003 by MRV Communications, Inc. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/). This product includes cryptographic software written by Eric Young (eay@cryptosoft.com). This product includes software written by Tim Hudson (tjh@cryptosoft.com). Service Information Should you experience trouble with this equipment, please contact one of the following support locations: • If you purchased your equipment in the Americas, contact MRV Americas Service and Support in the U.S. at 978-952-4888. (If you are calling from outside the U.S., call +011 978-952-4888.) • If you purchased your equipment outside the Americas (Europe, EU, Middle-East, Africa, Asia), contact MRV International Service and Support at 972-4-993-6200.451-0311B 3 Secure Shell Disclaimer THE SECURE SHELL SOFTWARE IS PROVIDED BY ERIC YOUNG "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OR SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.451-0311B 5 Table of Contents Preface ................................................................................................................ 13 How This Book is Organized ...................................................................................................... 13 Conventions ................................................................................................................................. 14 Using the Function Keys ............................................................................................................. 14 Online Help ................................................................................................................................. 15 Navigating the LX Command Line Interface (CLI) .................................................................... 16 User Command Mode ............................................................................................................ 17 Superuser Command Mode ...................................................................................................18 Configuration Command Mode .............................................................................................18 Asynchronous Command Mode ............................................................................................ 19 PPP Command Mode ............................................................................................................. 20 Modem Command Mode ....................................................................................................... 20 Ethernet Command Mode ...................................................................................................... 21 Subscriber Command Mode .................................................................................................. 21 SNMP Command Mode ........................................................................................................ 21 Interface Command Mode ..................................................................................................... 22 Menu Command Mode .......................................................................................................... 22 Menu Editing Command Mode .............................................................................................22 Notification Command Mode ................................................................................................ 23 Broadcast Group Command Mode ........................................................................................23 Disabling (Negating) Features and Settings ................................................................................ 24 Related Documents ..................................................................................................................... 25 Chapter 1 - Initial Setup of the LX Unit ............................................................ 27 Configuring TCP/IP ....................................................................................................................27 Obtaining TCP/IP Parameters from the Network .................................................................. 27 Configuring TCP/IP Parameters with the Quick Start Configurator .....................................27 Setting the TCP/IP Parameters in the IP Configuration Menu .............................................. 29 Creating and Loading a Default Configuration File .............................................................. 29 Setting Up Local (Onboard) Security for the LX Unit ................................................................ 31 Changing the Password Defaults ........................................................................................... 31 Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit ................................................33 Setting Up RADIUS .............................................................................................................. 33 Setting Up TACACS+ ........................................................................................................... 38 Setting Up SecurID ................................................................................................................ 436 451-0311B Chapter 2 - Setting Up Remote Console Management .................................. 49 Connecting the Console Port to the Network Element ............................................................... 49 Making Straight-through Cables ........................................................................................... 50 Recommendations for Making Cables ..................................................................................50 Modular Adapters (RJ-45 to DB-25 and RJ-45 to DB-9) ..................................................... 51 Configuring Ports for Remote Console Management .................................................................51 Configuring Asynchronous Ports for Direct Serial Connections .......................................... 51 Setting Up Modem Ports for Remote Console Management ................................................53 Setting Up Security for a Console Port ................................................................................. 54 Creating Subscribers for Remote Console Management ............................................................ 58 Specifying Access Methods ...................................................................................................59 Chapter 3 - System Administration .................................................................. 61 Backup and Recovery .................................................................................................................. 61 Saving the Configuration File ................................................................................................ 61 Where the Configuration is Stored ........................................................................................61 Saving the Configuration Into the Flash ................................................................................ 62 Saving the Configuration to the Network .............................................................................. 62 Editing the Files on a Unix Host ........................................................................................... 62 Editing the Files in Windows ................................................................................................ 63 Recreating the Zip File in Order to Upload It Onto the LX .................................................. 64 Loading the Configuration ..................................................................................................... 64 Applying Default Configurations to Other Units ........................................................................ 65 Creating a Default Configuration File ................................................................................... 65 Restoring the Default Configuration File to a New Unit ....................................................... 65 Scripting On External Units ........................................................................................................ 66 How to Upgrade the Software ..................................................................................................... 66 Upgrading Software and ppciboot with the Command Line Interface ....................................... 66 ppciboot Factory Default Settings ............................................................................................... 68 Upgrading Software with the ppciboot Main Menu .................................................................... 69 Booting from the Network ..................................................................................................... 70 Saving the Boot Image to Flash .............................................................................................70 Booting from Flash ................................................................................................................ 70 Setting the Timeout in Seconds .............................................................................................71 IP Configuration Menu .......................................................................................................... 71 Updating the ppciboot Firmware ........................................................................................... 71 Setting the Speed and Duplex Mode of the Ethernet Network Link .....................................72 Resetting to System Defaults ................................................................................................. 72 Saving the Configuration ....................................................................................................... 73 Booting the System ................................................................................................................ 73451-0311B 7 Using the IP Configuration Menu ............................................................................................... 73 Choosing an IP Assignment Method ..................................................................................... 74 Changing the Unit IP Address ............................................................................................... 74 Changing the Network Mask ................................................................................................. 75 Changing the Gateway Address ............................................................................................ 75 Changing the TFTP Server IP Address ................................................................................. 75 Saving the Configuration ....................................................................................................... 76 Booting from Defaults ................................................................................................................. 76 Defaulting from CLI ..............................................................................................................76 Defaulting from the Main Menu ............................................................................................ 76 Acquiring the IP Configuration ...................................................................................................77 Chapter 4 - Setting Up the Notification Feature .............................................. 79 Overview of the Notification Feature .......................................................................................... 79 Configuring the Notification Feature .......................................................................................... 81 Service Profiles ...................................................................................................................... 81 Overview of User Profiles ..................................................................................................... 88 Displaying Information on the Notification Feature ................................................................... 89 Displaying Characteristics of Service Profiles ...................................................................... 89 Displaying Characteristics of User Profiles ........................................................................... 90 Configuration Examples ..............................................................................................................91 Localsyslog Example ............................................................................................................. 91 Outbound Asynchronous Port Example ................................................................................ 92 Remotesyslog Example .........................................................................................................92 SNPP Example ...................................................................................................................... 93 TAP Example ........................................................................................................................ 93 SNMP Example ..................................................................................................................... 94 Email Example ...................................................................................................................... 95 Web Example ........................................................................................................................ 95 Chapter 5 - Configuring the Data Broadcast Feature ..................................... 97 Setting Up Broadcast Groups ...................................................................................................... 97 Usage Guidelines ................................................................................................................... 99 Specifying Port Options .........................................................................................................99 Removing Ports from Broadcast Groups ............................................................................. 100 Disabling Broadcast Groups ...................................................................................................... 101 Displaying Broadcast Group Characteristics ............................................................................ 101 Displaying Broadcast Group Characteristics ....................................................................... 101 Displaying Broadcast Group Summaries ............................................................................ 1038 451-0311B Chapter 6 - Configuring IP Interfaces ............................................................ 105 Setting Up IP Interfaces ............................................................................................................106 Specifying SSH Keepalive Parameters ................................................................................107 Specifying Socket Numbers ................................................................................................ 108 Specifying Maximum Transmission Units (MTU) ............................................................. 109 Configuring Local Authentication on an IP Interface ......................................................... 110 Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface ............110 Configuring Rotaries ................................................................................................................. 113 Disabling Rotaries ............................................................................................................... 115 Removing Ports from a Rotary ............................................................................................ 115 Displaying Interface Information .............................................................................................. 116 Displaying Interface Characteristics .................................................................................... 116 Displaying Interface Port Mapping ..................................................................................... 117 Displaying Interface Statuses .............................................................................................. 117 Displaying Interface Summaries ......................................................................................... 118 Displaying Rotary Information ............................................................................................ 118 Chapter 7 - Configuring Subscriber Accounts for the LX Unit ................... 121 Creating Subscriber Accounts and Entering Subscriber Command Mode ............................... 121 Creating Subscriber Accounts by Copying ............................................................................... 122 Deleting Subscriber Accounts ................................................................................................... 122 The User Profile ........................................................................................................................ 123 Specifying the Subscriber Access Methods ......................................................................... 123 Setting Up the Session and Terminal Parameters ................................................................ 128 Configuring the Subscriber Password ................................................................................. 132 Adding Superuser Privileges to a Subscriber Account ........................................................ 133 Specifying a Dedicated Service ...........................................................................................133 Specifying a Preferred Service ............................................................................................ 133 Enabling Audit Logging ...................................................................................................... 134 Enabling Login Menus ........................................................................................................ 134 Enabling Command Logging ............................................................................................... 134 Displaying Subscriber Information ...........................................................................................135 Displaying Subscriber Characteristics ................................................................................. 135 Displaying the Subscriber Status ......................................................................................... 136 Displaying the Subscriber TCP Information ....................................................................... 137 Displaying the Subscriber Summary Information ...............................................................138 Displaying the Audit Log for a Subscriber .......................................................................... 138 Displaying the Command Log for a Subscriber .................................................................. 139451-0311B 9 Chapter 8 - Configuring Ports for Temperature/Humidity Sensors ............ 141 Configuring Sensor Access for an LX Port ............................................................................... 141 Displaying the Temperature and Humidity ............................................................................... 141 Displaying Sensor Summaries .................................................................................................. 142 Chapter 9 - Configuring Power Control Units ............................................... 143 Configuring an LX Asynchronous Port as a Power Master ...................................................... 143 Default Name for a Power Control Relay ................................................................................. 144 Configuring Power Control Units ............................................................................................. 145 Assigning Power Control Relays to a Group ....................................................................... 145 Specifying the Off Time ...................................................................................................... 145 Naming a Power Control Relay ...........................................................................................146 Naming a Group of Power Control Relays .......................................................................... 147 Displaying Information on Power Control Units ...................................................................... 147 Displaying Status Information for Power Control Units ..................................................... 147 Displaying Status Information for Groups of Power Control Relays .................................. 148 Displaying Summary Information for Power Control Units ............................................... 149 Chapter 10 - Configuring Packet Filters with the iptables Command ........ 151 Adding a Rule to a Chain .......................................................................................................... 151 Example: Dropping Packets Based on the Source IP Address ............................................ 152 Example: Accepting Packets Based on the Destination IP Address ...................................153 Example: Ignoring Telnet Requests from a Specific IP Address ........................................ 153 Notes on the iptables Command Options ............................................................................ 154 Saving Changes in Rules ........................................................................................................... 155 Appendix A - Overview of RADIUS Authentication ...................................... 157 RADIUS Authentication Attributes .......................................................................................... 159 Appendix B - Overview of RADIUS and TACACS+ Accounting .................. 161 RADIUS Accounting Client Operation ..................................................................................... 161 RADIUS Accounting Attributes ............................................................................................... 162 TACACS+ Accounting Client Operation ................................................................................. 163 TACACS+ Accounting Attributes ............................................................................................ 164 Appendix C - Overview of TACACS+ Authentication ................................... 167 Example of TACACS+ Authentication ..................................................................................... 168 TACACS+ Authentication Attributes ....................................................................................... 16810 451-0311B Appendix D - Details of the iptables Command ............................................ 171 iptables man Pages .................................................................................................................... 171 Appendix 3 .......................................................................................................................... 190 Appendix 4 .......................................................................................................................... 191 Index ................................................................................................................. 193451-0311B 11 Figures Figure 1 - LX Command Modes ........................................................................16 Figure 2 - Straight-through Wiring Scheme ....................................................50 Figure 3 - Service Profile Display .....................................................................90 Figure 4 - User Profile Display .........................................................................91 Figure 5 - Broadcast Group Characteristics Display ....................................102 Figure 6 - Broadcast Group Summary Display .............................................103 Figure 7 - Rotary Connections on an IP Interface .........................................113 Figure 8 - Interface Characteristics Display .................................................116 Figure 9 - Interface Port Mapping Display ....................................................117 Figure 10 - Interface Status Display ..............................................................118 Figure 11 - Interface Summary Display ........................................................118 Figure 12 - Rotary Display .............................................................................119 Figure 13 - Subscriber Characteristics Display ............................................135 Figure 14 - Subscriber Status Display ...........................................................136 Figure 15 - Subscriber TCP Display ..............................................................137 Figure 16 - Subscriber Summary Display .....................................................138 Figure 17 - Audit Log Display ........................................................................139 Figure 18 - Command Log Display .................................................................139 Figure 19 - Device Status Display for a Sensor Port .....................................142 Figure 20 - Device Summary Display for Sensors .........................................142 Figure 21 - Device Status Display for an Alarm Master Port ......................148 Figure 22 - Device Status Display for a Power Control Relay Group ..........149 Figure 23 - Device Summary Display ............................................................149 Figure 24 - RADIUS Authentication Process ................................................158 Figure 25 - TACACS+ Authentication Process ..............................................169451-0311B 13 Preface This guide describes how to manage and configure the LX unit and provides background information on all of the configurable features of the LX unit. How This Book is Organized This guide is organized as follows: • Chapter 1 – Describes how to do the initial setup of the LX unit. • Chapter 2 – Describes how to set up remote console management on the LX unit. • Chapter 3 – Describes how to perform system administration on the LX unit. • Chapter 4 – Describes how to set up the Notification Feature. • Chapter 5 – Describes how to set up the Data Broadcast Feature. • Chapter 6 – Describes how to configure IP interfaces. • Chapter 7 – Describes how to configure subscriber accounts. • Chapter 8 – Describes how to configure ports for Temperature/Humidity sensors. • Chapter 9 – Describes how to configure ports for power management. • Chapter 10 – Describes how to use the iptables command to configure packet filters for the LX unit. • Appendix A – Provides an overview of the RADIUS authentication feature and describes the RADIUS authentication attributes. • Appendix B – Provides an overview of the RADIUS accounting feature and the TACACS+ accounting feature and describes the RADIUS and TACACS+ accounting attributes.Preface 14 451-0311B • Appendix C – Provides an overview of the TACACS+ authentication feature and describes the TACACS+ authentication attributes. • Appendix D – Lists the Linux man pages for the iptables command. Conventions The following conventions are used throughout this guide: • Command execution – Unless otherwise specified, commands are executed when you press . • Keyboard characters (keys) – Keyboard characters are represented using left and right angle brackets (< and >). For example, the notation refers to the CTRL key; refers to the letter A; and refers to the RETURN key. • Command syntax – Where command options or command syntax are shown, keywords and commands are shown in lowercase letters. • Typographical conventions – The following typographical conventions are used: Monospace Typeface – indicates text that can be displayed or typed at a terminal (i.e., displays, user input, messages, prompts, etc.). italics – are used to indicate variables in command syntax descriptions. Using the Function Keys The LX Command Line Interface (CLI) supports the following function keys: • Ctrl-F – Moves forward to the next session. • Ctrl-B – Moves back to the previous session. • Ctrl-L – Returns you to the Local Command Mode. NOTE: You must press the Enter key after you type Ctrl-F, Ctrl-B, or Ctrl-L. • Up arrow – Recalls the last command.451-0311B 15 Preface • Tab key – Autocompletes a partially typed command. For example, if you type the tab key after you type show ver at the Superuser command prompt, the show version command will be autocompleted. (Note: You must type the first three characters in a command keyword before you can autocomplete it with the Tab key.) Online Help The question mark character (?), and the Tab key, are used to display online help in the LX Command Line Interface (CLI). The following guidelines will help you to navigate the online help system: • Type the ? character (or press the Tab key) at the command prompt in any command mode, to display the first keyword of each command that can be executed in that command mode. For example, the following is displayed when you type the ? character at the User command prompt: InReach:0 > User Commands: clear Clear screen and reset terminal line disconnect Disconnect session enable Turn on privileged commands exit Exits and disconnects user no Negate a command pause Pause enable ping Send echo messages show Show running system information ssh Secure Shell (Triple-DES/Blowfish) telnet Open a telnet connection terminal Set the terminal type • Type the ? character (or press the Tab key) after the displayed keyword to list the options for that keyword. For example, type show? to list the options of the show keyword. You could then type show port? to list the next item in the syntax of the show port command.Preface 16 451-0311B Navigating the LX Command Line Interface (CLI) The LX CLI is structured as a set of nested command modes. Each command mode is used to implement a group of related features or functions. Figure 1 lists the command modes in the LX CLI. Figure 1 - LX Command Modes Each command mode has its own command prompt (e.g., Config:0 >>) and its own set of commands. Type a question mark (?) (or press the Tab key) at any of the LX CLI command prompts to display the commands that can be executed in the current command mode. For example, type a question mark at the Menu :0 >> prompt to display the commands that can be executed in the Menu command mode. Configuration Notification Interface Broadcast Group Subscriber SNMP Menu User Superuser Enter “enable” command and login to Superuser command mode Cconfiguration Nnotification Mmenu Ssnmp Ssubscriber Iinterface Ibroadcast group PPP Modem Ethernet Asynchronous Pppp Mmodem Pport ethernet Pport async Oopen Menu Editing451-0311B 17 Preface Except for the User command mode, each command mode is nested in a previous command mode. (The User command mode is the basic command mode of the LX CLI; you are in the User command mode when you log in to the LX unit.) For example, the Superuser command mode is nested in User command mode; the Configuration command mode is nested in the Superuser command mode, and so on. To enter a nested command mode, you must enter the appropriate command from the previous command mode. For example, to enter the Configuration command mode you must enter the configuration command from the Superuser command mode. You can use the exit command to return to the previous command mode. For example, you would enter the exit command in the Asynchronous command mode to return to the Configuration command mode. You can use the end command to return to the Superuser Command Mode from the Configuration Command Mode or from any command mode that is nested in the Configuration Command Mode. The rest of this section describes the LX command modes and the commands that are used to access each of them. User Command Mode When you log on to the LX unit, you are in the User command mode. This is indicated by the User command prompt (e.g., InReach:0 >). The User command mode includes commands for doing the following: • Managing your LX session and terminal. • Pinging remote hosts. • Connecting to remote hosts via SSH and Telnet. • Displaying your subscriber-specific information. • Displaying information about the LX port to which you are connected. • Accessing the Superuser command mode.Preface 18 451-0311B Refer to the “User Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the User Command Mode. Superuser Command Mode The Superuser command prompt (e.g., InReach:0 >>) is displayed when you are in the Superuser command mode. You can access the Superuser command mode by executing the enable command in the User command mode. When you execute the enable command, the Password: prompt is displayed. To enter Superuser mode, you must enter a Superuser password at the Password: prompt. In the Superuser command mode, you can perform all of the tasks that you can perform in User command mode, as well as the following: • Manage the LX unit. • Display global information for the LX unit. • Access the Linux shell. • Access the Configuration command mode. Refer to the “Superuser Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Superuser Command Mode. Configuration Command Mode The Configuration command prompt (e.g., Config:0 >>) is displayed when you are in the Configuration command mode. You can access the Configuration command mode by executing the configuration command in the Superuser command mode. In the Configuration command mode, you can perform such tasks as the following: • Specify the server-level configuration of the LX unit. The server-level configuration includes the Superuser password and settings for ppciboot, RADIUS, TACACS+, SecurID, and all other server-level features.451-0311B 19 Preface • Access the Asynchronous command mode. • Access the Ethernet command mode. • Access the Interface command mode. • Access the Menu command mode. • Access the Notification command mode. • Access the SNMP command mode. • Access the Subscriber command mode. • Access the Broadcast Group command mode. Refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Configuration Command Mode. Asynchronous Command Mode The Asynchronous command prompt (e.g., Async 4-4:0 >>) is displayed when you are in the Asynchronous command mode. For example, the prompt Async 4-4:0 >> indicates that you are in the Asynchronous command mode for port 4. You can access the Asynchronous command mode by executing the port async command in the Configuration command mode with an LX port number as the command argument; for example: Config:0 >>port async 4 In the Asynchronous command mode, you can do the followng: • Configure asynchronous port settings such as access methods, APD settings, autobaud, autodial, flow control, and inbound and outbound authentication. • Access the PPP command mode. • Access the Modem command mode. Refer to the “Asynchronous Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Asynchronous Command Mode.Preface 20 451-0311B PPP Command Mode The PPP command prompt (e.g., PPP 4-4:0 >>) is displayed when you are in the PPP command mode. You can access the PPP command mode by executing the ppp command in the Asynchronous command mode. In the PPP command mode, you can configure the Point-to-Point Protocol (PPP) for asynchronous ports. Some of the settings that you can configure include accounting, authentication, IPCP parameters, and LCP parameters. Refer to the “PPP Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the PPP Command Mode. Modem Command Mode The Modem command prompt (e.g., Modem 4-4:0 >>) is displayed when you are in the Modem command mode. You can access the Modem command mode by executing the modem command in the Asynchronous command mode. In the Modem command mode, you can configure external modems for asynchronous ports. Some of the settings that you can configure include type, dialout number, modem retries, and the modem initialization string. Refer to the “Modem Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Modem Command Mode.451-0311B 21 Preface Ethernet Command Mode The Ethernet command prompt (e.g., Ether 1-1:0 >>) is displayed when you are in the Ethernet command mode. You can access the Ethernet command mode by executing the port ethernet command in the Configuration command mode with an LX port number as the command argument; for example: Config:0 >>port ethernet 1 In the Ethernet command mode, you can configure Ethernet port descriptions and the duplex mode and speed of Ethernet ports. Refer to the “Ethernet Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Ethernet Command Mode. Subscriber Command Mode The Subscriber command prompt (e.g., Subs_mark >>) is displayed when you are in the Subscriber command mode. You can access the Subscriber command mode by executing the subscriber command in the Configuration command mode. In the Subscriber command mode, you can provision subscribers of the LX unit. Some of the subscriber settings include function keys, Telnet settings, and security settings. Refer to the “Subscriber Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Subscriber Command Mode. SNMP Command Mode The SNMP command prompt (e.g., Snmp:0 >>) is displayed when you are in the SNMP command mode. You can access the SNMP command mode by executing the snmp command in the Configuration command mode. In the SNMP command mode, you can configure the SNMP settings for an LX unit.Preface 22 451-0311B Refer to the “SNMP Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the SNMP Command Mode. Interface Command Mode The Interface command prompt (e.g., Intf 1-1:0 >>) is displayed when you are in the Interface command mode. You can access the Interface command mode by executing the interface command in the Configuration command mode. In the Interface command mode, you can configure interfaces for the LX unit. Some of the settings that you can configure include the IP settings, MTU, and IP Rotaries for the interface, as well as SSH and Telnet settings. Refer to the “Interface Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Interface Command Mode. Menu Command Mode The Menu command prompt (e.g., Menu :0 >>) is displayed when you are in the Menu command mode. You can access the Menu command mode by executing the menu command in the Configuration command mode. In the Menu command mode, you can create, delete, import, and display menus and access the Menu Editing command mode by executing the open command. Refer to the “Menu Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Menu Command Mode. Menu Editing Command Mode The Menu Editing command prompt (e.g., mark-1:0 >>) is displayed when you are in the Menu Editing command mode. For example, the prompt mark-1:0 >> indicates that the menu mark is open in the Menu Editing command mode. You can access the Menu Editing command mode by executing the open command in the Menu command mode.451-0311B 23 Preface In the Menu Editing command mode, you can create and modify menus. Refer to the “Menu Editing Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Menu Editing Command Mode. Notification Command Mode The Notification command prompt (e.g., Notification:0 >>) is displayed when you are in the Notification command mode. You can access the Notification command mode by executing the notification command in the Configuration command mode. In the Notification command mode, you can configure the sending of accounting log messages to pagers, email addresses, SNMP trap clients, local files, remote hosts, syslogd, and asynchronous ports. Refer to the “Notification Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Notification Command Mode. Broadcast Group Command Mode The Broadcast Group command prompt (e.g., BrGroups 6:0 >>) is displayed when you are in the Broadcast Group command mode. You can access the Broadcast Group command mode by executing the broadcast group command in the Configuration command mode. In the Broadcast Group command mode, you can configure a Broadcast Group. A Broadcast Group consists of Slave Ports and Master Ports. The Slave Ports receive data broadcasts from the Master Ports. Refer to the “Broadcast Group Commands” chapter of the LX-Series Commands Reference Guide for detailed information on the commands that you can execute in the Broadcast Group Command Mode.Preface 24 451-0311B Disabling (Negating) Features and Settings In order to disable a feature or setting, you must execute the no command with one or more modifiers. The no command must be executed in the same Command Mode in which the feature or setting was specified. For example, you can disable Autobaud by executing the no command with the autobaud modifier in the Asynchronous command mode. The full command syntax would look like this: Async 6-6:0 >>no autobaud To display the features and settings that can be disabled or negated in any command mode, enter no?; for example: Async 6-6:0 >>no? apd authentication autobaud autodial The above example shows that you can disable the Autodial feature by executing the no autodial command in the Asynchronous command mode. In some instances, the no command may require more than one modifier. For example, to reset the dialout number in the Modem command mode, you need to execute the no command with the dialout modifier and the number modifier. Type the question mark (?) after the first modifier to determine if the no command requires additional modifiers to disable a feature or negate a setting; for example: Modem 6-6:0 >>no dialout? number Modem 6-6:0 >>no dialout number? 451-0311B 25 Preface Related Documents For detailed information on the LX commands, refer to the LX-Series Commands Reference Guide (P/N 451-0310E). For more information on the LX hardware, refer to Getting Started with the LX Series (P/N 451-0308E). The LX Quick Start Instructions (P/N 451-0312F) describes how to get the LX unit up and running.451-0311B 27 Chapter 1 Initial Setup of the LX Unit This section describes how to do the initial setup of the LX unit. Before you use the LX unit for network management, you must perform the tasks described in this chapter. You can do the tasks described in this chapter after you have installed and powered on the LX unit as described in Chapter 1 of Getting Started with the LX Series. Configuring TCP/IP You can allow the LX unit to obtain its TCP/IP parameters from the network, or you can explicitly configure TCP/IP parameters for the LX unit with the Quick Start Configurator or the IP Configuration Menu. (You can access the IP Configuration Menu from the ppciboot Main Menu.) Obtaining TCP/IP Parameters from the Network If the TCP/IP parameters for the LX unit have not been explicitly configured, the LX unit will attempt to load its TCP/IP parameters from the network when the LX unit boots. The LX unit can load its TCP/IP parameters from any LAN that runs DHCP, BOOTP, or RARP. Configuring TCP/IP Parameters with the Quick Start Configurator Do the following to configure TCP/IP parameters with the Quick Start Configurator: 1. Plug in the terminal at the DIAG port (port 0) on the LX unit. (The port values are 9600 bps, eight bits, one stop bit, no parity, and Xon/Xoff flow control.) The Run Initial Connectivity Setup? y/n message appears (when the LX first boots up on default parameters). 2. Press y (yes) and press . The Superuser Password prompt appears.Initial Setup of the LX Unit 28 451-0311B 3. Enter the password system. The Quick Configuration menu appears: 4. Press the number corresponding to the parameter you want to set. 5. Enter the appropriate information and press to return to the Quick Configuration menu. Once you enter a parameter value, a data entry line specific to that parameter appears on the Quick Configuration menu. 6. Continue in this way through the menu, configuring as many parameters as you want. You are not required to configure all parameters. NOTE: You should change the Superuser Password, since this is the first time you are configuring the LX unit (the default password is system). 7. Press 7 (Exit and Save) to save your changes. The Is this information correct? message appears. Quick Configuration menu 1 Unit IP address 2 Subnet mask 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password 7 Exit and Save Enter your choice: CONFIGURATION SUMMARY 1 Unit IP address 10.80.1.5 2 Subnet mask 255.0.0.0 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password Changed 7 Exit and Save Is this information correct? (y/n) : 451-0311B 29 Initial Setup of the LX Unit 8. Press y (yes) and press . The Save this information to flash? message appears. 9. Press y (yes) and press . The information is saved to flash. 10. Press several times to display the Login: prompt. 11. Enter your login name. The default is InReach. 12. Enter your password. The default is access. You can now use the LX unit. NOTE: The login username and password are case-sensitive. Setting the TCP/IP Parameters in the IP Configuration Menu You can use the IP Configuration Menu to set the TCP/IP parameters for the LX unit. For more information, refer to “Using the IP Configuration Menu” in Getting Started with the LX Series. Creating and Loading a Default Configuration File This section explains how to create a default configuration file with which you can load multiple units. Creating a Default Configuration File After your first LX unit is up and running, you can save the unit configuration to the network. For further information, refer to “Saving the Configuration to the Network” on page 30. You must rename this .zip file to lx last six digits of the mac address.prm (e.g. lx12ab9f.prm). Once this is complete, you can use this .prm file as a template to configure multiple units at one time by changing the last six digits of the mac address to reflect that of the specific unit.Initial Setup of the LX Unit 30 451-0311B Loading a Default Configuration File If loading via BOOTP and DHCP, you can load a default configuration file from a TFTP server that is located on the same server from which you obtained your IP address. If you are not loading via one of these, the unit looks on the TFTP server specified in ppciboot. If the configuration is defaulted, it is detected at startup and the unit checks that a TFTP server was passed by ppciboot. If a TFTP server is accessible, the LX unit connects to it and tries to download a default file named lx last six digits of the mac address.prm (e.g., lx12ab9f.prm). If this file exists, the LX unit loads it into its configuration table. If the default file does not exist, the Quick Start menu is displayed. You can use the .prm file as a template to configure multiple units at one time. After copying the .prm file, you would rename it to lx last six digits of the mac address.prm (e.g., lx12ab9f.prm). For more information, refer to “Saving the Configuration to the Network” on page 62. Saving the Configuration to the Network The TFTP protocol is used to perform the operation of saving the LX configuration to a network host. If the network host is a UNIX host, a configuration file must already exist on the TFTP server. The configuration file is a .zip file that contains everything previously described except for the SSH keys, since they belong to the unit itself and cannot be used on a different unit. Since the format is a .zip file, it is usable by WinZip or UNIX Unzip. To save the configuration to the network, execute the following command in the Superuser Command Mode: save configuration network filename tftp_server_address NOTE: The filename that you specify in the save configuration network command must not include the .zip extension.451-0311B 31 Initial Setup of the LX Unit Setting Up Local (Onboard) Security for the LX Unit Local security is the default security method for the LX unit. Under Local security, the user is authenticated against a username/password file that resides on the LX unit. NOTE: The LX unit also supports RADIUS, TACACS+, and SecurID security. Under RADIUS, TACACS+, and SecurID, the user is authenticated against a username/password file that resides on the authentication server. For more information, refer to “Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit” on page 33. Changing the Password Defaults It is widely known that the default password for the InReach user is access. If an unauthorized user knew this username/password combination, he/she could log on to your LX unit. For this reason, you should change the InReach user’s password to something other than access. It is also widely known that the default Superuser password is system. To reduce the risk of an unauthorized user gaining access to the Superuser Command Mode, MRV recommends that you change this password to something other than system. Changing the Default Password for the InReach User Do the following to change the User-level password of the InReach User: 1. Access the Configuration Command Mode. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) IMPORTANT! MRV Communications recommends that you change the default password for the user InReach before you put the LX unit on a network. For more information, refer to “Changing the Password Defaults” (below).Initial Setup of the LX Unit 32 451-0311B 2. Access the Subscriber Command Mode for the InReach subscriber. You do this by entering the subscriber command with InReach as the command argument; for example: Config:0 >>subscriber InReach 3. Enter the password command at the Subs_InReach >> prompt; for example: Subs_InReach >>password 4. Enter a new User password at the Enter your NEW password: prompt. The password will be displayed as asterisks, as in the following example: Enter your NEW password : *************** 5. Re-enter the new User password at the Re-Enter your NEW password: prompt. The password will be displayed as asterisks, as in the following example: Re-Enter your NEW password: *************** Changing the Default Superuser Password To change the Superuser password for the LX unit, do the following: 1. Access the Configuration Command Mode. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 2. Enter the password command at the Config:0 >> prompt; for example: Config:0 >>password 3. Enter a new Superuser password at the Enter your NEW password: prompt. The password will be displayed as asterisks, as in the following example: Enter your NEW password : ***************451-0311B 33 Initial Setup of the LX Unit 4. Re-enter the new Superuser password at the Re-Enter your NEW password: prompt. The password will be displayed as asterisks, as in the following example: Re-Enter your NEW password: *************** Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit You can implement SecurID, RADIUS, or TACACS+ authentication on the LX unit. For more information, refer to the following: • “Setting Up RADIUS” (below) • “Setting Up TACACS+” on page 38 • “Setting Up SecurID” on page 43 Setting Up RADIUS The LX can implement RADIUS authentication and RADIUS accounting at the server level and for specific interfaces and asynchronous ports. You must configure RADIUS accounting and/or authentication at the server level before you can implement it on specific interfaces and asynchronous ports on the LX unit. The basic steps for configuring RADIUS authentication on the LX unit are: 1. Installing and configuring the RADIUS server on a Network-based Host (see page 34). 2. Specifying the RADIUS server settings on the LX (see page 34). 3. Specifying the RADIUS period on the LX (see page 38). For more information on RADIUS authentication, refer to “Overview of RADIUS Authentication” on page 157. For more information on RADIUS accounting, refer to “Overview of RADIUS and TACACS+ Accounting” on page 161.Initial Setup of the LX Unit 34 451-0311B Installing and Configuring the RADIUS Server on a Network-based Host Before you can authenticate with RADIUS on your LX unit, you must configure a RADIUS server on your network. In general, RADIUS server implementations are available on the Internet. These implementations generally use a daemon process that interacts with RADIUS clients (located on LX units and on other remote access devices). The daemon uses a list of clients and associated secrets that it shares with these clients. The per-client secret is used to encrypt and validate communications between the RADIUS server and the client. The file used to keep the client list and secrets is the “clients” file. Another file used by the daemon to store the users that are authenticated is the “users” file. The “users” file contains the RADIUS attributes associated with a particular user. As a minimum, this file must contain the user’s username, password (depending on the RADIUS server used), and Service-type. To configure the RADIUS server, refer to your RADIUS host documentation. MRV recommends that you use the Merit RADIUS server implementation. Information for the Merit RADIUS server can be found at http://www.merit.edu. Refer to the GOPHER SERVER and the MERIT Network Information Center for new releases. Specifying the RADIUS Server Settings on the LX Do the following to specify the RADIUS server settings on the LX unit: 1. Check the primary RADIUS Server host to ensure that the RADIUS server client database has been configured. 2. Access the Configuration Command Mode on the LX. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.)451-0311B 35 Initial Setup of the LX Unit 3. Use the radius primary authentication server address command to specify the IP address of the RADIUS primary authentication server; for example: Config:0 >>radius primary authentication server address 146.32.87.93 4. Use the radius primary authentication server secret command to specify the secret that will be shared between LX unit and the RADIUS primary authentication server; for example: Config:0 >>radius primary authentication server secret BfrureG 5. Use the radius primary authentication server port command to specify the socket your RADIUS server is listening to; for example: Config:0 >>radius primary authentication server port 1645 NOTE: The LX listens to port 1812 by default. 6. To verify the LX RADIUS configuration, exit from the Configuration command mode and execute the show radius characteristics command at the Superuser command prompt; for example: InReach:0 >>show radius characteristics Refer to Table 1 on page 36 for descriptions of all of the settings that you can specify for a RADIUS server. In order to use a RADIUS primary accounting server, or a RADIUS secondary server, you must specify an IP address and a secret for the respective RADIUS server. For examples of the commands that you would use, refer to the following sections: • “RADIUS Primary Accounting Server Commands” on page 37 • “RADIUS Secondary Authentication Server Commands” on page 37Initial Setup of the LX Unit 36 451-0311B • “RADIUS Secondary Accounting Server Commands” on page 37 NOTE: The use of a RADIUS primary accounting server, and the use of RADIUS secondary servers, is optional. After you have specified the RADIUS settings for the RADIUS primary authentication server, you can configure the RADIUS primary accounting server and the RADIUS secondary authentication and accounting servers. Table 1 - RADIUS Settings RADIUS Command Examples This section provides examples of all of the commands that are used to specify settings for the RADIUS servers. Refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide for detailed descriptions of the commands in this chapter. RADIUS Primary Authentication Server Commands Config:0 >>radius primary authentication server address 152.34.65.33 RADIUS Settings Description address IP address of the RADIUS server 1 port 1. If you do not specify a UDP port, retransmit value, or timeout value for the RADIUS server, the LX unit will use the default values for these settings. For more information, refer to the applicable commands in the “Configuration Commands” chapter of the LX-Series Commands Reference Guide. UDP port of the RADIUS server 1 retransmit The maximum number of times that the LX unit will attempt to retransmit a message to the RADIUS server secret The RADIUS secret shared between the LX unit and the RADIUS server 1 timeout The length of time that the LX unit will wait for the RADIUS server to respond before retransmitting packets to it451-0311B 37 Initial Setup of the LX Unit Config:0 >>radius primary authentication server port 1645 Config:0 >>radius primary authentication server retransmit 3 Config:0 >>radius primary authentication server secret AaBbCc Config:0 >>radius primary authentication server timeout 7 RADIUS Primary Accounting Server Commands Config:0 >>radius primary accounting server address 181.28.68.56 Config:0 >>radius primary accounting server port 1646 Config:0 >>radius primary accounting server retransmit 3 Config:0 >>radius primary accounting server secret reuyyurew Config:0 >>radius primary accounting server timeout 7 RADIUS Secondary Authentication Server Commands Config:0 >>radius secondary authentication server address 178.67.82.78 Config:0 >>radius secondary authentication server port 1812 Config:0 >>radius secondary authentication server retransmit 3 Config:0 >>radius secondary authentication server secret AsJkirbg Config:0 >>radius secondary authentication server timeout 7 RADIUS Secondary Accounting Server Commands Config:0 >>radius secondary accounting server address 198.20.84.77 Config:0 >>radius secondary accounting server port 1813 Config:0 >>radius secondary accounting server retransmit 3 Config:0 >>radius secondary accounting server secret GgJjoreou Config:0 >>radius secondary accounting server timeout 7Initial Setup of the LX Unit 38 451-0311B Specifying the RADIUS Period on the LX The RADIUS period is the interval at which the LX unit will update the RADIUS accounting server with the status of each RADIUS user. The RADIUS period is specified in minutes. Do the following to specify the RADIUS period: 1. Access the Configuration Command Mode. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 2. Use the radius period command to specify the RADIUS period; for example: Config:0 >>radius period 10 Setting Up TACACS+ You can implement TACACS+ authentication and TACACS+ accounting at the server level and for specific interfaces and asynchronous ports on the LX unit. You must implement TACACS+ accounting and/or authentication at the server level before you can implement it on specific interfaces and asynchronous ports on the LX unit. The basic steps for configuring TACACS+ authentication on the LX unit are: 1. Installing and configuring the TACACS+ server on a Network-based Host (see page 38). 2. Specifying the TACACS+ server settings on the LX (see page 39). 3. Specifying the TACACS+ period on the LX (see page 42). For more information on TACACS+ authentication, refer to “Overview of TACACS+ Authentication” on page 167. For more information on TACACS+ accounting, refer to “Overview of RADIUS and TACACS+ Accounting” on page 161. Installing and Configuring the TACACS+ Server on a Network-based Host Before you can configure TACACS+ on your LX unit, you must configure a TACACS+ server on your network.451-0311B 39 Initial Setup of the LX Unit In general, TACACS+ server implementations are available on the Internet. These implementations generally use a daemon process that interacts with TACACS+ clients (located on LX units and on other remote access devices). The daemon uses a list of clients and associated secrets that it shares with these clients. The per-client secret is used to encrypt and validate communications between the TACACS+ server and the client. The file used to keep the client list and secrets is the “clients” file. Another file used by the daemon to store the users that are authenticated is the “users” file. The “users” file contains the TACACS+ attributes associated with a particular user. As a minimum, this file must contain the user’s username, password (depending on the TACACS+ server used), and Service-type. To configure the TACACS+ server, refer to your TACACS+ host documentation. Specifying the TACACS+ Server Settings on the LX Do the following to specify the TACACS+ server settings on the LX unit: 1. Check the primary TACACS+ Server host to ensure that the TACACS+ server client database has been configured. 2. Access the Configuration Command Mode on the LX. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 3. Use the tacacs+ primary authentication server address command to specify the IP address of the TACACS+ primary authentication server; for example: Config:0 >>tacacs+ primary authentication server address 149.19.87.89 4. Use the tacacs+ primary authentication server secret command to specify the secret that will be shared between LX unit and the TACACS+ primary authentication server; for example:Initial Setup of the LX Unit 40 451-0311B Config:0 >>tacacs+ primary authentication server secret Goitji 5. Use the tacacs+ primary authentication server port command to specify the socket your TACACS+ server is listening to; for example: Config:0 >>tacacs+ primary authentication server port 1687 NOTE: The LX listens to port 1812 by default. 6. To verify the LX TACACS+ configuration, exit from the Configuration command mode and execute the show tacacs+ characteristics command at the Superuser command prompt; for example: InReach:0 >>show tacacs+ characteristics Refer to Table 1 on page 36 for descriptions of all of the settings that you can specify for a TACACS+ server. In order to use a TACACS+ primary accounting server, or a TACACS+ secondary server, you must specify an IP address and a secret for the respective TACACS+ server. For examples of the commands that you would use, refer to the following sections: • “TACACS+ Primary Authentication Server Commands” on page 41 • “TACACS+ Secondary Authentication Server Commands” on page 42 • “TACACS+ Secondary Accounting Server Commands” on page 42 NOTE: The use of a TACACS+ primary accounting server, and the use of TACACS+ secondary servers, is optional. After you have specified the TACACS+ settings for the TACACS+ primary authentication server, you can configure the TACACS+ primary accounting server and the TACACS+ secondary authentication and accounting servers.451-0311B 41 Initial Setup of the LX Unit Table 2 - TACACS+ Settings TACACS+ Command Examples This section provides examples of all of the commands that are used to specify settings for the TACACS+ servers. Refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide for detailed descriptions of the commands in this chapter. TACACS+ Primary Authentication Server Commands Config:0 >>tacacs+ primary authentication server address 182.36.98.33 Config:0 >>tacacs+ primary authentication server port 1687 Config:0 >>tacacs+ primary authentication server retransmit 3 Config:0 >>tacacs+ primary authentication server secret Gfsufsa Config:0 >>tacacs+ primary authentication server timeout 7 TACACS+ Settings Description address IP address of the TACACS+ server 1 port 1. If you do not specify a UDP port, retransmit value, or timeout value for the TACACS+ server, the LX unit will use the default values for these settings. For more information, refer to the applicable commands in the “Configuration Commands” chapter of the LX-Series Commands Reference Guide. UDP port of the TACACS+ server 1 retransmit The maximum number of times that the LX unit will attempt to retransmit a message to the TACACS+ server secret The TACACS+ secret shared between the LX unit and the TACACS+ server 1 timeout The length of time that the LX unit will wait for the TACACS+ server to respond before retransmitting packets to itInitial Setup of the LX Unit 42 451-0311B TACACS+ Primary Accounting Server Commands Config:0 >>tacacs+ primary accounting server address 182.28.86.56 Config:0 >>tacacs+ primary accounting server port 1664 Config:0 >>tacacs+ primary accounting server retransmit 3 Config:0 >>tacacs+ primary accounting server secret iuhgeuer Config:0 >>tacacs+ primary accounting server timeout 7 TACACS+ Secondary Authentication Server Commands Config:0 >>tacacs+ secondary authentication server address 182.57.32.58 Config:0 >>tacacs+ secondary authentication server port 1842 Config:0 >>tacacs+ secondary authentication server retransmit 3 Config:0 >>tacacs+ secondary authentication server secret L3498reiu Config:0 >>tacacs+ secondary authentication server timeout 7 TACACS+ Secondary Accounting Server Commands Config:0 >>tacacs+ secondary accounting server address 182.20.56.18 Config:0 >>tacacs+ secondary accounting server port 1819 Config:0 >>tacacs+ secondary accounting server retransmit 3 Config:0 >>tacacs+ secondary accounting server secret Geihuige2 Config:0 >>tacacs+ secondary accounting server timeout 7 Specifying the TACACS+ Period on the LX The TACACS+ period is the interval at which the LX unit will update the TACACS+ accounting server with the status of each TACACS+ user. This value is specified in minutes. Do the following to specify the TACACS+ period:451-0311B 43 Initial Setup of the LX Unit 1. Access the Configuration Command Mode. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 2. Use the tacacs+ period command to specify the TACACS+ period; for example: Config:0 >>tacacs+ period 10 Setting Up SecurID You can implement SecurID authentication at the server level and for specific interfaces and asynchronous ports on the LX unit. You must implement SecurID authentication at the server level before you can implement it on specific interfaces and asynchronous ports on the LX unit. Under SecurID authentication, the user is required to enter a user name and a PIN number plus the current token code from his or her SecurID server. The LX unit transmits the information to the RSA ACE/Server, which approves access when the information is validated. SecurID supports both DES and SDI encryption.Initial Setup of the LX Unit 44 451-0311B The basic steps for configuring SecurID authentication on the LX unit are: 1. Installing and configuring the SecurID server on a Network-based Host (see page 38). 2. Specifying the SecurID server settings on the LX (see page 39). For more information on SecurID authentication, go to the RSA SecurID website (http://www.rsasecurity.com/products/securid/index.html). Installing and Configuring the SecurID Server on a Network-based Host Before you can configure SecurID on your LX unit, you must configure a SecurID server on your network. To configure the SecurID server, refer to your SecurID host documentation. Specifying the SecurID Server Settings on the LX Do the following to specify the SecurID server settings on the LX unit: 1. Check the primary SecurID Server host to ensure that the SecurID application is running. 2. Access the Configuration Command Mode on the LX. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 3. Use the securid authentication version command to specify the SecurID authentication version for the LX unit. You can specify the authentication version as Version 5, or pre-Version 5 (legacy); for example: Config:0 >>securid authentication version version_5 Config:0 >>securid authentication version legacy 4. Use the securid authentication port command to specify the socket your SecurID server is listening to; for example: Config:0 >>securid authentication port 1687 NOTE: The LX listens to port 1812 by default.451-0311B 45 Initial Setup of the LX Unit 5. Use the securid primary authentication server address command to specify the IP address of the SecurID primary authentication server; for example: Config:0 >>securid primary authentication server address 149.19.87.89 NOTE: If the SecurID authentication version is “legacy”, you must specify a Master authentication server instead of a Primary authentication server. For more information, refer to the securid master authentication server address command in the LX-Series Commands Reference Guide. 6. Use the securid authentication encryption command to specify the SecurID encryption method for the LX unit. You can specify DES or SDI as the encryption method; for example: Config:0 >>securid authentication encryption des Config:0 >>securid authentication encryption sdi 7. To verify the LX SecurID configuration, exit from the Configuration command mode and execute the show securid characteristics command at the Superuser command prompt; for example: InReach:0 >>show securid characteristics SecurID Command Examples This section provides examples of all of the commands that are used to specify settings for the SecurID servers. Refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide for detailed descriptions of the commands in this chapter. Config:0 >>securid primary authentication server address 138.30.65.34 Config:0 >>securid authentication port 4500 Config:0 >>securid primary authentication server name bigsky1.com Config:0 >>securid authentication encryption desInitial Setup of the LX Unit 46 451-0311B Config:0 >>securid authentication retransmit 7 Config:0 >>securid authentication timeout 3 Config:0 >>securid authentication version version_5 Refer to Table 3 (below) for descriptions of all of the settings that you can specify for a SecurID server. Table 3 - SecurID Settings NOTE: If the SecurID secret on the LX unit does not match the SecurID secret on the SecurID server, you will need to clear the secret from the LX unit. To clear the SecurID secret from the LX unit, refer to the zero securid secret command in the LX-Series Commands Reference Guide. SecurID Settings Description address IP address of the SecurID server 1 port 1. If you do not specify a UDP port, retransmit value, timeout, version, encryption, or name for the SecurID server, the LX unit will use the default values for these settings. For more information, refer to the applicable commands in the “Configuration Commands” chapter of the LX-Series Commands Reference Guide. UDP port of the SecurID server 1 retransmit The maximum number of times that the LX unit will attempt to retransmit a message to the SecurID server 1 encryption The encryption method for SecurID authentication on the LX unit 1 version The SecurID authentication version that will be used on the LX unit 1 name The host name of the SecurID authentication server for the LX unit 1 timeout The length of time that the LX unit will wait for the SecurID server to respond before retransmitting packets to it451-0311B 47 Initial Setup of the LX Unit Resetting the Unit to Factory Defaults If you believe you have misconfigured the unit, or you believe the configuration is somehow corrupt, you may wish to reset the unit to it’s factory defaults. This may be done in one of several ways: From an LX asynchronous port: 1. Access the Configuration Command Mode. (Refer to “Configuration Command Mode” on page 18 for information on accessing the Configuration Command Mode.) 2. Enter the default Configuration command to reset the LX unit to the factory defaults; for example: Config:0 >>default configuration NOTE: After you enter the above command, the LX will display a confirmation prompt warning you that the unit will be rebooted. The LX unit will be defaulted, and rebooted, if you answer “yes” to the confirmation prompt. From a web browser: 1. Browse to the LX unit’s IP address, log in to the LX unit, and bring up the console. 2. Click on the ‘Admin’ button on the menu bar of the client and entering the Superuser password. This activates a ‘Default’ button on the menu bar. 3. Click on the ‘Default’ button to display the options to default the unit or certain other parameters. 4. Select the option to default the unit. NOTE: After you select a default option, the LX will display a confirmation prompt warning you that the unit will be rebooted. The LX unit will be defaulted, and rebooted, if you answer “yes” to the confirmation prompt. Initial Setup of the LX Unit 48 451-0311B From the LX DIAG port: NOTE: This method is recommended if you no longer have network access, or if you are unable to make a serial connection to an LX asynchronous port. 1. Connect a terminal to the DIAG port of the LX unit. 2. Power-cycle the LX unit. When the unit is powered on, the ppciboot Main Menu is displayed. 3. Select the asterisk (*) from the menu to display the following options: [1] Reset ppciboot Configuration [2] Reset Linux System Configuration 4. Select [1] to reset the ppciboot configuration to system defaults. (Note: Although the ppciboot configuration will be reset to defaults, it will not be saved to flash. To save the configuration to flash, execute the save configuration flash command in the Superuser command mode.) 5. Select [2] to reset the Linux system configuration. You are prompted for the password, which is access. If you enter the password, the command erases all of the configurations you have saved, except for the ppciboot configuration. 6. Press B to Boot the system. Do this only after you have configured the ppciboot options and saved the configuration. Refer to “Booting from Defaults” on page 76 for further information on defaulting from ppciboot and defaulting from the CLI.451-0311B 49 Chapter 2 Setting Up Remote Console Management Network Elements can be managed via Telnet connections, or via SSH connections, to the LX asynchronous ports on which the network elements are attached. This method of managing network elements is known as remote console management. This chapter describes how to set up remote console management on an LX unit. Setting up remote console management involves doing the following: • Connecting the LX asynchronous port to the Network Element (see below). • Configuring the LX asynchronous port for the remote management of the connected Network Element (see page 51). • Setting up security for the LX asynchronous port to which the network element is connected (see page 54). • Creating the subscriber(s) that have remote access to the asynchronous port where the Network Element is connected (see page 58). Connecting the Console Port to the Network Element Network elements can be connected to LX asynchronous ports by a modem or by a direct serial line. The LX asynchronous-port connectors are female RJ-45 connectors. Use a crossover cable to connect a direct serial line from an LX console port to the serial management port on a network element. Use a straight-through cable to connect a console port to a modem. MRV Communications provides RJ-45 crossover cables. You can make the MRV-supplied RJ-45 crossover cables into straight-through cables. For more information, refer to “Making Straight-through Cables” on page 50.Setting Up Remote Console Management 50 451-0311B Making Straight-through Cables To make an MRV-supplied crossover cable into a straight-through cable, do the following: • Lay the modular cable on a table or on some other flat surface. (The modular cable should lie flat with no rolls or twists in it.) • Crimp the RJ-45 connector in opposite directions at both ends (see Figure 2). Figure 2 - Straight-through Wiring Scheme Recommendations for Making Cables Keep the following in mind when you make your own cables: • Before crimping the cables, make sure that the RJ-45 connector is fully inserted into the die-set cavity and that the wire is fully inserted into the RJ-45 connector. (The die set might be fragile, and it could break if the RJ-45 connector is not properly seated before you squeeze the handle.) • In order to keep track of the cable type, you should use different colored wires for straight-through and crossover cable. For example, MRV Communications recommends silver wire for making crossover cables and black wire for making straight-through cables. NOTE: MRV Communications recommends that you not use Ethernet Xbase-T crossover or straight-through cable for serial communications. RJ-4 Connectors RJ-45 Connectors Straight Through Cable451-0311B 51 Setting Up Remote Console Management Modular Adapters (RJ-45 to DB-25 and RJ-45 to DB-9) You can obtain adapters with male and female DB-25 and female connectors from MRV Communications. These adapters direct signals from the RJ-45 connectors on the cable to the correct pin on the DB-25, or DB-9, connector. For more information, refer to Getting Started with the LX Series. Configuring Ports for Remote Console Management This section describes how to configure LX asynchronous ports for remote console management. Configuring Asynchronous Ports for Direct Serial Connections The default settings for LX asynchronous ports will support direct serial connections to most Network Elements. However, when conditions warrant, you can explicitly set an asynchronous port to non-default values. NOTE: Autobaud must be disabled on ports that are used for remote console management. To disable autobaud on a port, execute the no autobaud command in the Asynchronous command mode. Explicitly Setting LX Asynchronous Port Characteristics It is recommended that you explicitly set the characteristics of an LX asynchronous port to match those of a directly connected Network Element. To explicitly set the characteristics of an LX asynchronous port, do the following: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to configure. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Use the access remote command in to set the access for the asynchronous port to Remote; for example: Async 6-6:0 >>access remoteSetting Up Remote Console Management 52 451-0311B 3. In the Asynchronous Command Mode, enter the appropriate command to set the speed, parity, data bits, stop bits, flow control, or autohangup setting for the asynchronous port. Table 4 lists the commands that you can use to set the port characteristics that pertain to remote console management of directly connected Network Elements. For the full syntax of each command listed in Table 4, refer to the LX-Series Commands Reference Guide. Table 4 - Commands for Setting Asynchronous Port Characteristics NOTE: MRV Communications recommends that you enable Autohangup on an LX asynchronous port that will be used to do remote console management. This ensures that the port will drop the connection, when the network element resets DTR at subscriber logout. Port Characteristics Allowable Values Command Examples autohangup enabled or disabled autohangup enable no autohangup data bits 5, 6, 7, or 8 bits 6 flow control xon or cts flowcontrol cts flowcontrol xon parity even, odd, or none parity even parity odd parity none speed 134, 200, 300, 600, 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200, or 230400 speed 115200 stop bits 1 or 2 stop bits 1 stop bits 2451-0311B 53 Setting Up Remote Console Management Setting Up Modem Ports for Remote Console Management Do the following to set up a Modem Port for remote console management: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to set up for remote console management. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Execute the access remote command to set the port access to REMOTE; for example: Async 5-5:0 >>access remote 3. Execute the modem enable command to enable modem control on the port; for example: Async 5-5:0 >>modem enable 4. Execute the flow control command to set the port flow control to CTS; for example: Async 5-5:0 >>flowcontrol cts 5. Ensure that the port is set to the same speed as the modem to which the port is attached. To set the port speed, use the speed command; for example: Async 5-5:0 >>speed 57600 6. Execute the modem command to access the Modem Command Mode for the port under configuration; for example: Async 5-5:0 >>modem 7. In the Modem Command Mode, execute the type command to set the Modem Type to DIALOUT; for example: Modem 5-5:0 >>type dialoutSetting Up Remote Console Management 54 451-0311B 8. In the Modem Command Mode, execute the dialout number command to specify the number that the modem will dial to connect with the Network Element on the Public Network; for example: Modem 5-5:0 >>dialout number 19785558371 9. In the Modem Command Mode, execute the initstring command to specify the initialization string for the modem; for example: Modem 5-5:0 >>initstring AT S7=45 S0=1 L1 V1 X4 &C1 &1 Q0 &S1 NOTE: The initialization string may vary between modem types. 10. In the Modem Command Mode, execute the retry command to specify the Retry value for the modem; for example: Modem 5-5:0 >>retry 6 11. In the Modem Command Mode, execute the timeout command to specify the Timeout value for the modem; for example: Modem 5-5:0 >>timeout 30 Setting Up Security for a Console Port You can use LOCAL authentication, RADIUS authentication, SecurID authentication, or TACACS+ authentication to protect a console port from unauthorized access. These methods of authentication require a user to enter a valid username/password combination to access the console port. Setting Up Local Authentication Under LOCAL authentication, a username/password combination is validated against the local security database. LOCAL authentication is enabled by default on console ports. (Other authentication options on console ports are NONE, RADIUS, TACACS+, and SecurID.) You can enable LOCAL authentication on a console port by doing the following: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to configure. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.)451-0311B 55 Setting Up Remote Console Management 2. Execute the following command to enable LOCAL authentication on the port: Async 5-5:0 >>authentication outbound local enable Setting Up RADIUS Authentication Under RADIUS authentication, a username/password combination is validated against the RADIUS user and client database. The RADIUS security database is stored on the RADIUS server for the LX unit. In order to use RADIUS authentication on a port, you must have RADIUS set up for the LX unit. Refer to “Setting Up RADIUS” on page 33 for information on setting up RADIUS for the LX unit. RADIUS authentication is disabled by default on console ports. You can enable RADIUS authentication on a console port by doing the following: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to configure. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Execute the following command to enable RADIUS authentication on the port: Async 5-5:0 >>authentication outbound radius enable NOTE: If RADIUS authentication is enabled, you may want to implement a backup method (Fallback), which will be used if the RADIUS server is unreachable. Fallback switches to Local Authentication when there is no reply from the RADIUS server(s) after 3 attempts. For more information, refer to “Setting Up Fallback” on page 57.Setting Up Remote Console Management 56 451-0311B Setting Up TACACS+ Authentication Under TACACS+ authentication, a username/password combination is validated against the TACACS+ user and client database. The TACACS+ security database is stored on the TACACS+ server for the LX unit. In order to use TACACS+ authentication on a port, you must have TACACS+ set up for the LX unit. Refer to “Setting Up TACACS+” on page 38 for information on setting up TACACS+ on the LX unit. TACACS+ authentication is disabled by default on console ports. You can enable TACACS+ authentication on a console port by doing the following: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to configure. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Execute the following command to enable TACACS+ authentication on the port: Async 5-5:0 >>authentication outbound tacacs+ enable NOTE: If TACACS+ authentication is enabled, you may want to implement a backup method (Fallback), which will be used if the TACACS+ server is unreachable. Fallback switches to Local Authentication when there is no reply from the TACACS+ server(s) after 3 attempts. For more information, refer to “Setting Up Fallback” (below). Setting Up SecurID Authentication Under SecurID authentication, a username/password combination is validated against the SecurID user and client database. The SecurID security database is stored on the SecurID server for the LX unit. In order to use SecurID authentication on a port, you must have SecurID set up for the LX unit. Refer to “Setting Up SecurID” on page 43 for information on setting up SecurID on the LX unit.451-0311B 57 Setting Up Remote Console Management SecurID authentication is disabled by default on console ports. You can enable SecurID authentication on a console port by doing the following: 1. Access the Asynchronous Command Mode for the asynchronous port that you want to configure. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Execute the following command to enable SecurID authentication on the port: Async 5-5:0 >>authentication outbound securid enable NOTE: If SecurID authentication is enabled, you may want to implement a backup method (Fallback), which will be used if the SecurID server is unreachable. Fallback switches to Local Authentication when there is no reply from the SecurID server(s) after 3 attempts. For more information, refer to “Setting Up Fallback” (below). Setting Up Fallback Fallback Authentication can be used as a mechanism for authenticating users when the configured authentication method (i.e., RADIUS, TACACS+, or SecurID) fails because the authentication server is unreachable. When a user logs in via Fallback, his or her username/password combination is validated against the LOCAL security database for the LX unit. The LX unit will make three attempts to log in the user via RADIUS, TACACS+, or SecurID before it implements Fallback. After the third attempt at logging in via the configured authentication method (RADIUS, TACACS+, or SecurID), the username/password combination will be validated against the LOCAL security database for the LX unit. RADIUS, TACACS+, or SecurID must be enabled on a port in order for Fallback to function on the port. When all three methods (i.e., RADIUS, TACACS+, or SecurID) are disabled on the port, Fallback is ignored by the port.Setting Up Remote Console Management 58 451-0311B Do the following to enable Fallback on a port: 1. Access the Asynchronous Command Mode for the asynchronous port on which you want to enable Fallback. (Refer to “Asynchronous Command Mode” on page 19 for information on accessing the Asynchronous Command Mode.) 2. Execute the following command to enable Fallback authentication on the port: Async 5-5:0 >>authentication fallback enable Creating Subscribers for Remote Console Management In order for a subscriber to do remote console management, he/she must have specific access rights. If RADIUS is the outbound authentication method, configure a Service-type of Outbound-User for the subscriber on the RADIUS server. If local authentication is used, do the following to set up the neccessary access rights for the subscriber: 1. Create, or access, the subscriber record of the subscriber that you want to configure for console-port access. (Refer to “Subscriber Command Mode” on page 21 for information on creating or accessing a subscriber record.) 2. In the Subscriber Command Mode, specify one or more access methods for the subscriber to use in connecting to the LX unit. For more information, refer to “Specifying Access Methods” on page 59. 3. Execute the access console enable command to specify that the subscriber will have console access to the LX unit; for example: Subs_mark >>access console enable 4. Execute the access port command to specify the console ports that the subscriber can access. In the following example, the access port command specifies that the subscriber mark can log on to ports 2, 3, 5, and 6: Subs_mark >>access port 2 3 5 6 451-0311B 59 Setting Up Remote Console Management 5. If you want the subscriber to create his or her own login password, execute the password enable command; for example: Subs_mark >>password enable When the subscriber logs in to the LX unit for the first time, he/she will be asked to enter, and confirm, his or her new password. 6. If you want to create a login password the subscriber, execute the password command; for example: Subs_mark >>password The following prompts are displayed: Enter your NEW password : Re-enter your NEW password: 7. Enter the new password at the Enter prompt, and re-enter it at the Re-enter prompt. (This is the password that the subscriber will be required to enter when he/she logs on to a console port.) Specifying Access Methods You can specify SSH, Telnet, or the Web (or any combination of SSH, Telnet, and the Web) as the method(s) that the subscriber can use to access LX asynchronous ports for remote console management. Because SSH includes data encryption capabilities, it is recommended as the access method for subscribers who will be sending sensitive data to the LX asynchronous ports. Specifying Telnet As an Access Method 1. Execute the access telnet enable command; for example: Subs_mark >>access telnet enable 2. Execute the telnet mode command to set the Telnet Mode. In the following example, the Telnet Mode is set to character: Subs_mark >>telnet mode character Setting Up Remote Console Management 60 451-0311B In the following example, the Telnet Mode is set to line: Subs_mark >>telnet mode line Specifying SSH As an Access Method 1. Execute the access ssh enable command; for example: Subs_mark >>access ssh enable 2. Execute the ssh cipher command to specify the SSH encryption type for the subscriber. In the following examples, the SSH encryption type is set to Triple-DES, ANY, and BLOWFISH respectively: Subs_mark >>ssh cipher triple-des Subs_mark >>ssh cipher any Subs_mark >>ssh cipher blowfish Refer to the ssh cipher command in the LX-Series Commands Reference Guide for more information on the Triple-DES, ANY, and BLOWFISH encryption types. Specifying the Web As an Access Method Execute the access web enable command; for example: Subs_mark >>access web enable 451-0311B 61 Chapter 3 System Administration This chapter explains how to upgrade the software, as well as some basic maintenance functions. Backup and Recovery This section explains how to save, edit, and load the configuration file. Saving the Configuration File The configuration file (Config.prm) is saved in a format that is readable in WordPad and the vi editor in UNIX. Because anyone can easily modify it, the file is signed with a digest using the SHA encryption algorithm. The SHA encryption lets the administrator know if a modified file is being loaded by issuing an alert message when a file not matching the original algorithm is being loaded. This way the administrator knows the file was modified and can take the appropriate action. The Config.prm file is created when you configure the LX unit. After the Config.prm file has been created on one unit, it can be copied to other units. When the Config.prm file resides on a new unit, you can copy its contents as appropriate for the new unit. For example, you can change the IP settings (i.e., IP Address, Subnet Mask, etc.) to the IP settings of the new unit. All other settings will be imported when the LX unit is rebooted. Where the Configuration is Stored All files related to the unit configuration are located in the directory /config. This directory contains the SSH keys, Menus, Configuration, a file to tell from where the configuration is to be taken (the ConfToBootFrom file), and the zone information directory (time and date).System Administration 62 451-0311B Saving the Configuration Into the Flash To save the configuration into the flash, execute the save configuration flash command in the Superuser command mode; for example: InReach:0 >>save configuration flash Saving the Configuration to the Network The TFTP protocol is used to save the LX configuration to a network host. Consequently, if you are saving to a UNIX host, a configuration file must already exist on the TFTP server. Use the touch command to create the configuration file as a .zip file. Windows-based workstations will automatically create the .zip file once the LX unit attempts the TFTP put process. The configuration format differs slightly from that described in “How the Configuration is Organized.” The .zip file contains everything previously described except for the SSH keys, since they belong to the unit itself and cannot be used on a different unit. Since the format is a .zip file, it is usable by WinZip or UNIX Unzip. Use the following command to save the configuration to the network: save configuration network filename tftp_server_address NOTE: The filename that you specify in the save configuration network command must not include a .zip extension. Editing the Files on a Unix Host You can edit the Config.prm file so that you can bring multiple units online at one time. To edit the files: 1. Open the .zip file into the directory by entering the following command: unzip filename.zip The Config.prm file appears. If you have configured menus, the Menu file also appears. 451-0311B 63 System Administration 2. Open the Config.prm file with any text editor (e.g., vi or emacs). 3. Select and copy the section of the Config.prm file that you want to modify: • Users that have access to all new LX units • PPP configurations • Broadcast Groups • Interface configurations • RADIUS, SecurID, or TACACS+ configurations • Specific Async Port configurations 4. If you are adding a new user to the Config.prm file, copy an existing user, paste it into the section directly below the last user, and make the necessary modifications to the copy. 5. Follow the same steps for any other changes you make to the Config.prm file. Editing the Files in Windows You can edit the Config.prm file so that you can bring multiple units online at one time. To edit the files: 1. Open the .zip file into the directory using winzip. The Config.prm file appears. If you have configured menus, the Menu file also appears. 2. Open the Config.prm file with the WordPad editor. 3. Select and copy the section of the Config.prm file that you want to modify: • Users that have access to all new LX units • PPP configurationsSystem Administration 64 451-0311B • Broadcast Groups • Interface configurations • RADIUS, SecurID, or TACACS+ configurations • Specific Async Port configurations 4. If you are adding a new user to the Config.prm file, copy an existing user, paste it into the section directly below the last user, and make the necessary modifications to the copy. 5. Follow the same steps for any other changes you make to the Config.prm file. Recreating the Zip File in Order to Upload It Onto the LX NOTE: To perform this procedure, you must be in the directory in which the files to be zipped reside. 1. To recreate the zip file, type the following command in UNIX: zip -o filename.zip file1 file2 file3 where filename.zip (you can name this whatever you want) is the archive you are writing the files to, and file1, file2, and file3 are the files you are adding to the archive. 2. In Windows, select the files you want to add to the zip file by clicking on them while holding down the Ctrl key. 3. Right click on the selected files and select Add to Zip. Loading the Configuration At the Config prompt, load the configuration as follows: Config:0:>>boot configuration from network tftp_server_address filename Config:0:>>end InReach:0:>>save configuration flash InReach:0:>>reload451-0311B 65 System Administration After the LX has reloaded, check the system status screen to make sure that the LX loaded from the proper place. Enter the following command: InReach:0:>>show system status Applying Default Configurations to Other Units This section explains how to create a default configuration file with which you can load multiple units. Creating a Default Configuration File After your first LX unit is up and running, you can save the unit configuration to the network. For further information, refer to “Saving the Configuration to the Network” on page 62. You must rename this .zip file to lx last six digits of the mac address.prm (e.g. lx12ab9f.prm). Once this is complete, you can use this .prm file as a template to configure multiple units at one time by changing the last six digits of the mac address to reflect that of the specific unit. Restoring the Default Configuration File to a New Unit The unit looks on the TFTP server specified in ppciboot. If the configuration is defaulted, it is detected at startup and the unit checks that a TFTP server was passed by ppciboot. If a TFTP server is accessible, the LX unit connects to it and tries to download a default file named lx last six digits of the mac address.prm (e.g., lx12ab9f.prm). If this file exists, the LX unit loads it into its configuration table. If the default file does not exist, the Quick Start menu is displayed.System Administration 66 451-0311B Scripting On External Units The LX unit supports Expect scripting. Expect is a common, simple, command line scripting language. You can use it to write simple scripts to automate interactive applications. For example, you can write an Expect script that can automatically log you in, modify the IP configuration, set up the configuration for any port, make the LX unit dial out, and establish a PPP configuration to a remote site, etc. For information on the LX commands, refer to the LX-Series Commands Reference Guide. How to Upgrade the Software You can upgrade the software and enter the IP information on your LX unit via two methods, depending upon your specific needs: • To upgrade software via the Command Line Interface, refer to “Upgrading Software with the Command Line Interface” for further instructions. • To upgrade software via the ppciboot Menu, refer to “Upgrading Software with the ppciboot Main Menu” and “Using the IP Configuration Menu” for further instructions. Upgrading Software and ppciboot with the Command Line Interface NOTE: The default filename for the software is linuxito.img. The ppciboot filename is ppciboot.img. NOTE: In superuser mode a check is performed to determine how much space is available before updating the software or ppciboot. Eight MB must be available to update software. One MB must be available to update ppciboot. Make sure you have a TFTP server up and running, containing the software image and the ppciboot image.451-0311B 67 System Administration To download the ppciboot from the command line interface (you must be in superuser mode), do the following: 1. Type the following and press : InReach:0>>update ppciboot tftp_server_ip_address/name NOTE: If the LX unit has a TFTP server address configured, you do not need to include the TFTP server IP Address or the TFTP server name in the update ppciboot command. By default, the software stores in memory the IP address of the TFTP server from which it has booted. If this occurs, this argument becomes optional. The “TFTP Download complete, verifying file integrity” message appears. The loaded file is checked for integrity. If the check is successful, the “File OK, copying boot image to flash” message appears (if the check finds a problem, the “Verify failed, Bad ppciboot file” message appears). You have upgraded ppciboot. You must reboot the unit for the new ppciboot to take effect. Now you must upgrade the software. 2. Type the following and press : InReach:0>>update software tftp_server_ip_address/name 3. Type the following and press to save your configuration locally: InReach:0>>save config flash This stores the parameters. 4. Type the following and press to save your configuration locally: InReach:0>>reload When the reload is complete, log in again. The new software is activated. NOTE: You can load a default configuration file from a TFTP server while the unit is at its default setting.System Administration 68 451-0311B ppciboot Factory Default Settings The following table lists the factory default settings. NOTE: For defaults on specific commands, refer to the LX-Series Commands Reference Guide. Each LX Series unit is configured at the factory to use a default set of initialization parameters that sets all ports to operate with asynchronous ASCII terminal devices. Main Menu Configuration Factory Default Setting Boot from Network yes Save boot image to flash no Boot from flash yes Time Out, in seconds 8 IP Configuration Menu Configuration Factory Default Setting IP Assignment method #1 DHCP IP Assignment method #2 BOOTP IP Assignment method #3 RARP IP Assignment method #4 User Defined451-0311B 69 System Administration Upgrading Software with the ppciboot Main Menu NOTE: At boot, the DIAG port (port 0) is used to configure the loading method (network or flash) of the Software image, ppciboot image, and the IP address assignment preferences. This section explains how to use the ppciboot Main menu to set up the boot configuration. Use it as a reference for how to use specific menu entries. You can access the ppciboot commands through the DIAG port (port 0), the graphic user interface (GUI), or in the Configuration Command Mode of the CLI. When you set ppciboot parameters, the software is not loaded on the unit yet. Use the ppciboot menu to set load parameters that allow you to get up and running. To access the menu, you need only connect a terminal using a console port cable to the DIAG port (port 0) and press one or two times. The Main Menu appears: If you want to accept the defaults, press B or wait eight seconds. Welcome to In-Reach ppciboot Version x.x Main Menu [1] Boot from network: yes [2] Save software image to flash: no [3] Boot from flash: yes [4] Time Out, in seconds (0=disabled): 8 [5] IP Configuration Menu [6] Update ppciboot Firmware [7] Ethernet Network Link [*] Reset to System Defaults [S] Save Configuration [B] Boot System Make a choice: __System Administration 70 451-0311B At the "Make a choice" prompt of the Main Menu, type the number corresponding to the configuration action you want to perform. The sections that follow describe each option in detail. Booting from the Network The Boot from network option lets you boot your software image file from the network. To boot from the network: 1. Press 1 to toggle between yes and no. To boot from the network, choose yes. 2. Press B to Boot the system. Do this only after you have made all configuration changes to the LX and saved the configuration. NOTE: MRV recommends that you leave Boot from flash on if you are booting from the network. By doing so, you provide a fallback method of booting in the event the network becomes unreachable. Saving the Boot Image to Flash The Saving the software image to Flash option lets you save the software image from the network to flash. To save the software image to flash: 1. Press 2 to toggle between yes and no. To save the software image to flash, choose yes. 2. Press B to Boot the system. Do this only after you have configured the ppciboot options and saved the configuration. Booting the system can take five or more minutes. Booting from Flash The Booting from Flash option lets you boot your software image from the flash. To boot from the flash: 1. Press 3 to toggle between yes and no. To boot from flash, choose yes. 2. Press B to Boot the system. Do this only after you have configured the LX and saved the configuration.451-0311B 71 System Administration Setting the Timeout in Seconds The Time Out, in seconds option lets you set the amount of time the system waits for you to press Boot before booting automatically. To set the timeout (the default is eight seconds): 1. Press the number 4 (Time Out, in seconds). 2. An Enter Time Out prompt appears. 3. Add a time in seconds and press . (Note: Entering 0 will disable the timeout. You should not enter 0, and thus disable the timeout, for remotely located units.) 4. Press S to save the configuration. IP Configuration Menu The IP Configuration Menu option lets you change addresses and settings if you do not want to accept the defaults. Refer to the “Using the IP Configuration Menu” section for details. Updating the ppciboot Firmware NOTE: Updating ppciboot firmware from the Main menu works only if you have already set up an ip address, ip mask, and TFTP server. The Update ppciboot Firmware option lets you update the firmware via the Main Menu. To update ppciboot firmware: 1. Press the number 6 (Update ppciboot Firmware). The ppciboot firmware begins loading from the TFTP server. 2. If the firmware loads successfully (taking only a few seconds), the Main menu reappears. A verification check of the firmware is performed. If an error message appears, the ppciboot image may be corrupt. 3. Press S to save the configuration. 4. Press B to boot the system.System Administration 72 451-0311B Setting the Speed and Duplex Mode of the Ethernet Network Link The Ethernet Network Link option lets you set the speed and duplex mode of the Ethernet Network Link. To set the speed or duplex mode of your Ethernet Network Link: 1. Press the number 7 (Ethernet Network Link). The following speed/duplex options are displayed: Auto, 100 half -for 100TX half duplex 100 full -for 100TX full duplex 10 half -for 10TX half duplex 10 full -for 10TX full duplex 2. Select one of the speed/duplex options from the above display. 3. Press S to save the configuration. Resetting to System Defaults The Reset to System Defaults option lets you reset the unit to system defaults. To reset to the system defaults: 1. Press the asterisk (*) (Reset to System Defaults). The following options appear: [1] Reset ppciboot Configuration [2] Reset Linux System Configuration 2. Select 1 or 2. If you select [1] Reset ppciboot Configuration, the command sets the ppciboot configuration to system defaults, but it does not save the configuration to flash. If you select [2] Reset Linux System Configuration, you are prompted for the password, which is access. If you enter the password, the command erases all of the configurations you have saved, except for the ppciboot configuration. 3. Press B to Boot the system. Do this only after you have configured the ppciboot options and saved the configuration. Refer to “Booting from Defaults” on page 76 for further information on defaulting from ppciboot and defaulting from the CLI.451-0311B 73 System Administration Saving the Configuration The Saving Configuration option lets you save the ppciboot configuration. When you are finished configuring the Main menu, press S to save the configuration. Booting the System The Boot System option lets you boot the system. Be sure to save the configuration and choose a boot method before you boot the system. Press B to boot the system. Do this only after you have configured all necessary ppciboot options and saved the configuration. Using the IP Configuration Menu The IP Configuration Menu option lets you change addresses and settings if you do not want to accept the defaults. To configure the IP settings: 1. At the Main menu, enter 5 to open the IP Configuration menu. 2. Choose the number of the field you want to change. See the following sections for specific details. Welcome to In-Reach ppciboot Version x.x IP Configuration Menu [1] IP Assignment method #1: DHCP [2] IP Assignment method #2: BOOTP [3] IP Assignment method #3: RARP [4] IP Assignment method #4: User Defined [5] Unit IP Address: [6] Network mask: [7] Gateway: [8] TFTP Server IP Address: [S] Save Configuration [R] Return to Main menu Make a choice:System Administration 74 451-0311B Choosing an IP Assignment Method The IP Assignment Method option lets you set the method by which you want to assign IPs. To configure an IP Assignment method: 1. Press 1, 2, 3, or 4 to see the options for IP Assignment method #1-4:. Select the IP Assignment method you want to change, and toggle the options (DHCP, BOOTP, RARP, User Defined, and None) by repeatedly pressing the option number. 2. When you reach the option you want, stop toggling the options for that IP Assignment method and go on to press the numbers corresponding (2 for IP Assignment method #2:, etc) to the other IP Assignment methods and make the changes you want in the same way. 3. If you are finished configuring the IP settings, press S to save the configuration. The IP Configuration menu reappears. Press R to return to the Main Menu. NOTE: If any of the four IP Assignment methods are set to “User Defined”, you will need to complete additional configuration. Changing the Unit IP Address The Unit IP Address option lets you change the unit IP address (this applies only to the user-defined IP method). To change an IP Address: 1. Press the number 5 (Unit IP Address). A Unit IP Address prompt appears. 2. Type the new address and press . 3. If you are finished configuring the IP settings, press S to save the configuration. The IP Configuration menu reappears. Press R to return to the Main Menu.451-0311B 75 System Administration Changing the Network Mask The Network Mask option lets you change the Network Mask (this applies only to the user-defined IP method). To change a Network Mask: 1. Press the number 6 (Network Mask). A Network Mask prompt appears. 2. Type the new network mask and press . 3. If you are finished configuring the IP settings, press S to save the configuration. The IP Configuration menu reappears. Press R to return to the Main Menu. Changing the Gateway Address The Gateway option lets you change the Gateway address (this applies only to the user-defined IP method). To change a Gateway address: 1. Press the number 7 (Gateway). A Gateway prompt appears. 2. Type the new Gateway address and press . 3. If you are finished configuring the IP settings, press S to save the configuration. The IP Configuration menu reappears. Press R to return to the Main Menu. Changing the TFTP Server IP Address The TFTP Server IP Address option lets you change the TFTP Server IP address (the address from where you load the boot image). This applies only to the user-defined IP method. To change the TFTP Server IP address: 1. Press the number 8 (TFTP Server IP address). A TFTP Server IP address prompt appears. 2. Type the new TFTP Server IP address and press . 3. If you are finished configuring the IP settings, press S to save the configuration. The IP Configuration menu reappears. Press R to return to the Main Menu.System Administration 76 451-0311B Saving the Configuration The Saving Configuration option lets you save the ppciboot configuration. To save the configuration: 1. When you are finished configuring using the IP Configuration menu, press S to save the configuration. 2. Press R to return to the Main Menu. NOTE: The IP Assignment method #1-4 has precedence over user defined assignment, but the user defined settings are used as soon as the User Defined method comes up. Booting from Defaults The first time you boot a unit takes longer because the system computes the SSH keys server and client. The process takes a few minutes. The keys are saved into the flash. You can default the configuration in two ways: • From the Main Menu. • From the Command Line Interface. Depending on where you default the configuration from, the effect is not the same. Defaulting from CLI When you default from the CLI, only the configuration (Config.prm) is erased. The SSH keys are preserved. To default from the CLI, enter the default configuration command in the Configuration command mode. Defaulting from the Main Menu When you default from the Main Menu the entire configuration, including the SSH keys, is erased. The next reboot must take the extra time needed to recompute the SSH keys.451-0311B 77 System Administration 1. Choose the (*) Reset to System Defaults option from the ppciboot menu. 2. Choose [2] Reset Linux System Configuration. The following display appears: 3. Enter the password, which is access. The Main Menu appears. 4. Press B to boot the unit. Various lines of data are displayed on the screen while the default ppciboot loads. This may take a few minutes. NOTE: This display is generated by the operational software. The system must be booted before this occurs. The default from ppciboot completes. Acquiring the IP Configuration The LX software gets its IP configuration from ppciboot or from the configuration. If the configuration is not loaded yet, the LX unit uses the IP configuration from ppciboot. Once the configuration file is found and loaded, the IP is modified according to the configuration. Therefore, if the configuration is already set, it always overrules the ppciboot configuration. You can use two commands to display interface information. The show interface 1 status command displays the actual setting of the interface. The show interface 1 characteristics command displays the configuration for the interface. Refer to the LX-Series Commands Reference Guide for details on how to use these commands. [2] Reset Linux system configuration WARNING: This will erase all configuration data in the system. Do not use unless the configuration is unusable.451-0311B 79 Chapter 4 Setting Up the Notification Feature The Notification Feature is used to send syslog messages of LX system events to pagers, email addresses, cell phones, SNMP trap clients, outbound asynchronous ports, and local or remote syslogd files. Overview of the Notification Feature The Notification Feature uses the syslog daemon (syslogd) to generate event messages. Event Messages can be generated for events that occur in any of the Linux facilities listed in Table 5. Table 5 - Sources of Event Messages The event messages that are sent to any given destination can be filtered according to the facility and priority (severity level) of the message. For example, a destination could be configured to receive only those messages that originate in a daemon and have a priority of crit. Facility Description all Generate messages for all system events. authpriv The Superuser authentication process. daemon A system daemon, such as in.ftpd. kern The Linux kernel. syslog The syslog daemon (syslogd). user User processes; This is the default facility.Setting Up the Notification Feature 80 451-0311B Table 6 lists the priorities that can be specified as filters for the Notification Feature. Table 6 - Supported Priorities Priority Description none No messages will be logged. This setting effectively disables syslog for this User Profile. info Normal, informational messages notice Conditions that are not errors, but which might require specific procedures to adjust them warning A warning message err A software error condition. This is the default priority. crit A critical condition, such as a hard device error alert A condition that the system administrator needs to correct immediately, such as a corrupted system database. emerg A severe condition. This is the kind of condition that can immediately affect the users’ ability to work on the LX. sigsnotice Indicates a state transition of the serial input signals CTS or DCD/DSR. Note: When this priority is specified, the facility for the User Profile must be set to kern. To set the facility for a User Profile to kern, refer to the userprofile facility command in the LX-Series Commands Reference Guide. 451-0311B 81 Setting Up the Notification Feature Configuring the Notification Feature In order to use the Notification Feature, you must do the following: • Create a Service Profile. A Service Profile defines a method for sending event messages to a destination. This method is typically a protocol (e.g., SMTP) or an on-board feature (e.g., outbound asynchronous ports). For most event notification processes, the Service Profile also defines the destination to which event messages will be sent. For more information, refer to “Creating Service Profiles” on page 82. • Create a User Profile. A User Profile specifies a facility/priority filter for a destination. A User Profile also specifies the destinations (i.e., addresses and telephone numbers) for event notification processes that send event messages by email, cell phones, and pagers. For more information on User Profiles, refer to “Overview of User Profiles” on page 88. Service Profiles A Service Profile must be created for each desired method of sending event messages to a destination. For example, to send event messages to pagers via the Telocator Alphanumeric Protocol (TAP), a Service Profile of the TAP type must first be created. A Service Profile must be fully configured, as described in “Creating Service Profiles” on page 82, before a User Profile can be associated with it. You can create more than one Service Profile for each method of sending event messages. For example, you can create several Service Profiles of the TAP type, with each Service Profile specifying a different Short Message Service Center (SMSC) for sending messages. In the Notification Command Mode, you can create Service Profiles of the following types: • SNPP – Used to send event messages to pagers with the Simple Network Pager Protocol (SNPP) (see “Configuring SNPP Service Profiles” on page 84).Setting Up the Notification Feature 82 451-0311B • WEB – Used to send event messages to pagers or cell phones via a Web Driver (see “Configuring WEB Service Profiles” on page 86). • TAP – Used to send event messages to pagers via TAP (see “Configuring TAP Service Profiles” on page 84). • SNMP – Used to send event messages to SNMP trap clients (see “Creating Service Profiles” on page 82). • LOCALSYSLOG – Used to send event messages to a local file on the LX unit (see “Configuring LOCALSYSLOG Service Profiles” on page 83). • REMOTESYSLOG – Used to send event messages to syslogd on a remote host (see “Configuring REMOTESYSLOG Service Profiles” on page 86). • ASYNC – Used to send event messages to outbound asynchronous ports on the LX unit (see “Configuring ASYNC Service Profiles” on page 85). Users can receive the event messages by logging in to the outbound asynchronous port. Under this method, syslog messages will be sent out the specified asynchronous port(s) as they occur. • SMTP – Used to send event messages to email addresses (see “Configuring SMTP Service Profiles” on page 87). Creating Service Profiles To create a Service Profile, do the following: 1. Access the Notification Command Mode. (Refer to “Notification Command Mode” on page 23 for information on accessing the Notification Command Mode.) 2. Use the serviceprofile protocol command to create a Service Profile. For example, the following command creates a Service Profile called Skytel, using the SNPP protocol: Notification:0 >>serviceprofile Skytel protocol snpp You can use the serviceprofile protocol command to create a Service Profile of any of the following types: SNPP, WEB, TAP, SNMP, LOCALSYSLOG, REMOTESYSLOG, ASYNC, or SMTP.451-0311B 83 Setting Up the Notification Feature 3. Configure the Service Profile. This step will vary, depending on the type of the Service Profile. For more information, refer to the following sections: • “Configuring LOCALSYSLOG Service Profiles” on page 83 • “Configuring SNPP Service Profiles” on page 84 • “Configuring TAP Service Profiles” on page 84 • “Configuring ASYNC Service Profiles” on page 85 • “Configuring REMOTESYSLOG Service Profiles” on page 86 • “Configuring WEB Service Profiles” on page 86 • “Configuring SMTP Service Profiles” on page 87 NOTE: SNMP Service Profiles do not require any configuration after they are created with the serviceprofile protocol command. However, in order for an SNMP trap client to receive event messages from an LX unit, it must be a Version 1 trap client with a community name of public. For more information, refer to the trap client version command, and the trap client community command, in the LX-Series Commands Reference Guide. Configuring LOCALSYSLOG Service Profiles After you have created a LOCALSYSLOG Service Profile, you can use the serviceprofile file command to specify the local file to which the event messages will be sent; for example: Notification:0 >>serviceprofile local file Build5 The local syslog writes event messages to the default directory /var/log. To read the contents of the file, go to /var/log/ in the shell. For example, you would go to /var/log/Build5 to read the contents of the local file specified in the above serviceprofile file command. You can create User Profiles to filter, by facility and priority, the event messages that will be sent to the local file. For more information, refer to “Creating a User Profile” on page 88.Setting Up the Notification Feature 84 451-0311B Configuring SNPP Service Profiles After you have created an SNPP Service Profile, you can configure it by doing the following: 1. Use the serviceprofile server command to specify the SNPP server to which syslogd will send the log messages. (The pager messages will be forwarded to the user by the service provider’s server.) The service provider’s server can be specified as an IP Address or as any symbolic name that can be resolved by DNS; for example: Notification:0 >>serviceprofile Skytel server snpp.Skytel.com NOTE: If you specify a symbolic name (e.g., snpp.Skytel.com) as the SNPP server, you must have a primary DNS server, and a domain name suffix, configured for the LX unit. For more information, refer to the primary dns command, and the domain name command, in the LX-Series Commands Reference Guide. 2. Use the serviceprofile port command to specify the LX TCP port that will be used to send messages to the SNPP server; for example: Notification:0 >>serviceprofile Skytel port 7777 In order to send messages to a pager, you must create a User Profile that specifies the pager pin number as its contact field. For more information, refer to “Creating a User Profile” on page 88. Configuring TAP Service Profiles After you have created a TAP Service Profile, you can configure it by doing the following: 1. Use the serviceprofile smsc command to specify the SMSC that will be used to send the event messages to the pager; for example: Notification:0 >>serviceprofile verizon smsc 18668230501 2. Use the serviceprofile parity command to specify the bit parity setting for the Service Profile; for example: Notification:0 >>serviceprofile verizon parity even451-0311B 85 Setting Up the Notification Feature 3. Use the serviceprofile bits command to specify the bits-per-byte setting for the Service Profile; for example: Notification:0 >>serviceprofile verizon bits 7 4. Use the serviceprofile stopbits command to specify the stop bits setting for the Service Profile; for example: Notification:0 >>serviceprofile verizon stopbits 2 NOTE: The bits-per-byte setting, and the stop bits setting, that you specify for a Service Profile, must match the bits-per-byte setting of any modem port specified in a User Profile based on this Service Profile. Refer to “Creating a User Profile” on page 88 for more information on specifying a modem port for a User Profile. In order to send event messages to a pager or cell phone via TAP, you must create a User Profile that specifies the cell phone number to which event messages will be sent, as well as the LX modem port that will be used to send the event messages to the SMSC. For more information, refer to “Creating a User Profile” on page 88. Configuring ASYNC Service Profiles After you have created an ASYNC Service Profile, you can use the serviceprofile async port command to specify the outbound asynchronous ports to which event messages will be sent; for example: Notification:0 >>serviceprofile serialport async port 5 7 You can create User Profiles to filter, by facility and priority, the event messages that will be sent to the outbound asynchronous ports. For more information, refer to “Creating a User Profile” on page 88.Setting Up the Notification Feature 86 451-0311B Configuring REMOTESYSLOG Service Profiles After you have created a REMOTESYSLOG Service Profile, you can use the serviceprofile host command to specify the remote UNIX host to which the event messages will be sent; for example: Notification:0 >>serviceprofile syslogvenus host 10.179.170.253 Do the following on the UNIX host that you specify in the serviceprofile host command: 1. Edit the file /etc/syslog.conf and add the following entry for user.warning: user.warning /tftpboot/test/user.warning.log 2. Create an empty log file as follows: #touch /tftpboot/test/user.warning.log #chmod 777 /tftpboot/test/user.warning.log 3. Restart the syslog daemon to make changes to the syslog.conf file take effect: # ps –ef|grep syslog # kill –HUP pid# You can create User Profiles to filter, by facility and priority, the event messages that will be sent to the remote host. For more information, refer to “Creating a User Profile” on page 88. Configuring WEB Service Profiles After you have created a WEB Service Profile, you can use the serviceprofile driver command to specify the web driver that will be used to send the event messages to the pager or cell phone; for example: Notification:0 >>serviceprofile freds driver VERIZON_WEB The supported web drivers are ATT_WEB, CELLNET_WEB, CINGULAR_WEB, ORANGE_WEB, PAGENET_WEB, PROXIMUS_WEB, and VERIZON_WEB.451-0311B 87 Setting Up the Notification Feature NOTE: You must set the date and time for the LX unit, or some wireless providers will reject event messages that are sent from it. To set the date and time for the LX unit, refer to the date command and the clock command in the LX-Series Commands Reference Guide. In order to send event messages to a pager or cell phone via a Web Driver, you must create a User Profile that specifies the pager number or cell phone number as its contact field. For more information, refer to “Creating a User Profile” on page 88. Configuring SMTP Service Profiles After you have created an SMTP Service Profile, you can use the serviceprofile server command to specify the SMTP server to which syslogd will send the log messages. (The messages will be forwarded by the server to a specific email address.) The server can be specified as an IP Address or as any symbolic name that can be resolved by DNS; for example: Notification:0 >>serviceprofile mrvemail server 10.179.176.21 NOTE: If you specify a symbolic name (e.g., mrv.com) as the SMTP server, you must have a DNS server configured for the LX unit. Refer to the primary dns command in the LX-Series Commands Reference Guide for more information on configuring a DNS server for the LX unit. (In addition, the LX unit will need to have a fully qualified domain name suffix.) In order to send messages to an email address, you must create a User Profile that specifies the email address as its contact field. For more information, refer to “Creating a User Profile” on page 88.Setting Up the Notification Feature 88 451-0311B Overview of User Profiles A User Profile filters event messages by the type (facility) and severity level (priority) of the event message. A User Profile also specifies the destinations (i.e., addresses and telephone numbers) for event notification processes that send event messages by email, cell phones, and pagers. The LX unit supports a maximum of 20 User Profiles. Creating a User Profile Do the following to create a User Profile: 1. Access the Notification Command Mode. (Refer to “Notification Command Mode” on page 23 for information on accessing the Notification Command Mode.) 2. Use the userprofile serviceprofile command to create a User Profile; for example: Notification:0 >>userprofile adminscell serviceprofile verizon NOTE: You must create, and link, a User Profile to an existing Service Profile. In the above example, the User Profile adminscell is created, and linked to, the Service Profile verizon. 3. If the User Profile is for a Service Profile of the SNPP, SMTP, TAP, or WEB type, you must use the userprofile contact command to specify the contact field for the User Profile; for example: Notification:0 >>userprofile adminscell contact 9785552222 The contact field specifies the destination (e.g., pager, cell phone, etc.) for User Profiles that are created for Service Profiles of the SNPP, SMTP, TAP, or WEB type. The allowable values for this field are the following: • Pager Pin Number (e.g., 8875551212) for User Profiles that are based on Service Profiles of the SNPP type. • Email Address (e.g., jstraw@mrv.com) for User Profiles that are based on Service Profiles of the SMTP type.451-0311B 89 Setting Up the Notification Feature • Pager Number or Telephone Number (e.g., 9785552222) for User Profiles that are based on Service Profiles of the TAP or WEB type. 4. Use the userprofile priority command to specify a priority characteristic for the User Profile; for example: Notification:0 >>userprofile adminscell priority warning The allowable values for the priority characteristic are info, notice, warning, err, crit, alert, emerg, and none. 5. Use the userprofile facility command to specify a facility characteristic for the User Profile; for example: Notification:0 >>userprofile adminscell facility user Event messages that originate from the specified facility, and have the specified priority (see step 4), will be sent to the destination. The allowable values for the facility characteristic are authpriv, daemon, kern, syslog, user, and all. 6. If the User Profile is for a Service Profile of the TAP type, you must use the userprofile modem port command to specify the modem port that the LX unit will use to send event messages to the SMSC; for example: Notification:0 >>userprofile adminscell modem port 17 Displaying Information on the Notification Feature This section describes how to display information about the Notification feature. The information that can be displayed includes the characteristics of Service Profiles and the characteristics of User Profiles. Displaying Characteristics of Service Profiles Use the show notification serviceprofile command, in the Superuser Command Mode, to display the characteristics of Service Profiles; for example: InReach:0 >>show notification serviceprofile jacklocalSetting Up the Notification Feature 90 451-0311B In the above example, the characteristics are displayed for the Service Profile jacklocal. Use the following syntax to display the characteristics of all Service Profiles on the LX unit: InReach:0 >>show notification serviceprofile all Figure 3 shows an example of the Service Profile display. Figure 3 - Service Profile Display Displaying Characteristics of User Profiles Use the show notification userprofile command, in the Superuser Command Mode, to display the characteristics of User Profiles; for example: InReach:0 >>show notification userprofile grogers In the above example, the characteristics are displayed for the User Profile grogers@mrv. Use the following syntax to display the characteristics of all User Profiles on the LX unit: InReach:0 >>show notification userprofile all ServiceProfile: syslog Protocol: localsyslog File: syslog ServiceProfile: messages Protocol: localsyslog File: messages ServiceProfile: jackremote Protocol: remotesyslog Remote Host: ServiceProfile: jackasync Protocol: async Async Port: 5 ServiceProfile: jack Protocol: tap SMSC: 18668230501 Bits/Parity/StopBits:8N1 Modem Port(s): 33 ServiceProfile: webjack Protocol: web Driver: verizon_web451-0311B 91 Setting Up the Notification Feature Figure 4 shows an example of the User Profile display. Figure 4 - User Profile Display Configuration Examples This section contains examples of each type of Service Profile. Each example includes the commands for creating the Service Profile, along with the commands for creating a User Profile based on the Service Profile. Localsyslog Example The following commands configure the logging of events to the local syslogd: Notification:0 >>serviceprofile local protocol localsyslog Notification:0 >>serviceprofile local file Build5 Notification:0 >>userprofile locallog service local Notification:0 >>userprofile locallog facility user Notification:0 >>userprofile locallog priority warning NOTE: In the above example, the locallog home directory is /var/log/Build5. UserProfile: messages ServiceProfile: messages Contact: Facility: all Priority: notice UserProfile: debug ServiceProfile: debug Contact: Facility: all Priority: debug UserProfile: grogers@mrv ServiceProfile: N/A Contact: Facility: kern Priority: emerg UserProfile: mark ServiceProfile: N/A Contact: Facility: kern Priority: emergSetting Up the Notification Feature 92 451-0311B Outbound Asynchronous Port Example The following commands forwards the logging of events to ports 5, 6, and 7: Notification:0 >>serviceprofile 3serialport protocol async Notification:0 >>serviceprofile 3serialport async port 5 6 7 Notification:0 >>userprofile serialport service 3serialport Notification:0 >>userprofile serialport facility user Notification:0 >>userprofile serialport priority warning Remotesyslog Example The following commands configure the logging of events to syslogd on a remote host: Notification:0 >>serviceprofile Rlogvenus protocol remotesyslog Notification:0 >>serviceprofile Rlogvenus host 10.179.170.253 Notification:0 >>userprofile venus service Rlogvenus Notification:0 >>userprofile venus facility user Notification:0 >>userprofile venus priority warning After you executed the above commands, you would do the following on the remote host: 1. Add the following entry to the /etc/syslog.conf file: user.warning /tftpboot/log/user.warning.log 2. Create an empty log file as follows: #touch /tftpboot/log/user.warning.log #chmod 777 /tftpboot/log/user.warning.log 3. Restart the syslog daemon, using the following commands, to make changes to the syslog.conf take effect. # ps –ef|grep syslog # kill –HUP pid#451-0311B 93 Setting Up the Notification Feature SNPP Example The following commands configure the logging of events to a text pager: Notification:0 >>serviceprofile Skytel protocol snpp Notification:0 >>serviceprofile Skytel server snpp.Skytel.com Notification:0 >>serviceprofile Skytel port 7777 Notification:0 >>userprofile johnpager service Skytel Notification:0 >>userprofile johnpager contact 8875551212 Notification:0 >>userprofile johnpager facility user Notification:0 >>userprofile johnpager priority warning NOTE: In order to resolve the provider’s address, DNS must be configured on the LX unit. TAP Example The following sequence of commands could be used to configure the logging of events via a wireless provider such as Verizon, Sprint, or AT&T: Notification:0 >>serviceprofile verizon protocol tap Notification:0 >>serviceprofile verizon SMSC 18668230501 (provider’s service phone #) Notification:0 >>serviceprofile verizon bits 7 Notification:0 >>serviceprofile verizon stopbit 1 Notification:0 >>serviceprofile verizon parity even Notification:0 >>userprofile gina’scell service verizon Notification:0 >>userprofile gina’scell contact 785551212 Notification:0 >>userprofile gina’scell facility user Notification:0 >>userprofile gina’scell priority warning Notification:0 >>userprofile gina’scell modem port 17 Notification:0 >>exit Now configure the modem port that will be used for sending messages: Config>>port async 17 Async 17-17:0 >>no apdSetting Up the Notification Feature 94 451-0311B Async 17-17:0 >>access remote Async 17-17:0 >>modem Modem>>modem enable Modem>>type dialout A list of wireless SMSC phone numbers is provided here for your convenience: NOTE: MRV Communications is not responsible for these SMSC phone numbers and cannot guarantee their service. Please contact your provider for a number near you. SNMP Example The following commands configure the logging of events to an SNMP trap client (the LX unit must first have a trap client configured): Snmp:0 >>trap client 0 10.179.170.57 Snmp:0 >>trap client 0 community public Snmp:0 >>trap client 0 version 1 The Service Profile and the User Profile can then be created in the Notification Command Mode: Notification:0 >>serviceprofile ricksnmp protocol snmp Notification:0 >>userprofile ricksnmp service ricksnmp Carrier SMSC Number Email Address SMSC Phone#@ AT&T 7, 1, e 800-841-8837 @mobile.att.net Cingular 7, 1, e 800-909-4602 @Cingular.com Nextel 7, 1, e 801-301-6683 @messaging.nextel.com Sprint 7, 1, e 888-656-1727 @sprintpcs.com Verizon 7, 1, e, 8, 1, n 866-823-0501 @vtext.com Skytel 8, 1, n 800-679-2778 pin@skytel.com451-0311B 95 Setting Up the Notification Feature Notification:0 >>userprofile ricksnmp facility user Notification:0 >>userprofile ricksnmp priority warning Email Example The following commands configure the logging of events to an email address: Notification:0 >>serviceprofile youremail protocol smtp Notification:0 >>serviceprofile youremail server 10.10.10.21 Notification:0 >>userprofile jsmith service youremail Notification:0 >>userprofile jsmith contact 785551111@vtext.com (verizon text phone) Notification:0 >>userprofile jsmith facility user Notification:0 >>userprofile jsmith priority warning NOTE: You may need to configure the LX with a Domain suffix, a DNS server address, and a primary gateway address. Web Example The following commands configure the logging of events to a web driver: Notification:0 >>serviceprofile cingular protocol web Notification:0 >>serviceprofile cingular driver cingular_web Notification:0 >>userprofile kevin service cingular Notification:0 >>userprofile kevin contact 9785551313 Notification:0 >>userprofile kevin facility user Notification:0 >>userprofile kevin priority warning NOTE: The date and time must be set for the LX unit. (If the date and the time are not set, some wireless providers will reject the message.) The date and time are set with the date and clock commands in the Configuration Command Mode. The supported web drivers can be retrieved from the CLI help.451-0311B 97 Chapter 5 Configuring the Data Broadcast Feature The Data Broadcast Feature allows you to specify ports as Slave Ports that receive data broadcasts from, and send data broadcasts to, Master Ports on the same LX unit. Any asynchronous port, or TCP port, on the LX unit can be configured as a Slave Port or a Master Port. The source of the data broadcast can be a direct serial connection, or a Telnet connection, to a Master Port. Users can receive data broadcasts by Telneting to a TCP port that is configured as a Slave Port. All Slave Ports and Master Ports belong to a Broadcast Group. The Slave Ports in a Broadcast Group can only receive data broadcasts from a Master Port in the same Broadcast Group. When a port is configured as a Slave Port, it can still receive data from sources other than the Master Ports in its Broadcast Group. By default, any data that a Slave Port receives is forwarded to the Master Ports in the Broadcast Group. The Master Ports then broadcast the data to the Slave Ports in the Broadcast Group. Setting Up Broadcast Groups Do the following to set up a Broadcast Group: 1. Access the Configuration Command Mode in the LX CLI. (For more information, refer to “Configuration Command Mode” on page 18.) 2. Use the broadcast group command to create a Broadcast Group; for example: Config:0 >>broadcast group 4 BrGroups 4:0 >>Configuring the Data Broadcast Feature 98 451-0311B This enters the Broadcast Group Command Mode. In the above example, the Broadcast Group Command prompt (BrGroups 4:0 >>) indicates that you are in the Broadcast Group Command Mode for Broadcast Group 4. 3. Use the master port command to specify the Master Ports for the Broadcast Group; for example: BrGroups 4:0 >>master port async 5 BrGroups 4:0 >>master port tcp 1500 In the above example, asynchronous port 5, and TCP port 1500, are specified as Master Ports for Broadcast Group 4. 4. Use the slave port command to specify the Slave Ports for the Broadcast Group; for example: BrGroups 4:0 >>slave port async 4 6 7 BrGroups 4:0 >>slave port tcp 2500 In the above example, asynchronous port 4, 6, and 7, and TCP port 2500, are specified as Slave Ports for Broadcast Group 4. 5. Use the mode command to specify the Telnet mode for the Broadcast Group; for example: BrGroups 4:0 >>mode line In the above example, the Telnet mode is specified as line; the Telnet mode can also be specified as character. 6. Use the exit command to return to the Configuration Command Mode; for example: BrGroups 4:0 >>exit Config:0 >> 7. Use the broadcast group enable command to enable the Broadcast Group that you just created; for example: Config:0 >>broadcast group 4 enable NOTE: In order to enable a Broadcast Group, the Broadcast Group must contain at least one Master Port and one Slave Port.451-0311B 99 Configuring the Data Broadcast Feature Usage Guidelines Keep the following in mind as you add Slave Ports and Master Ports to a Broadcast Group: • You cannot specify a the DIAG port (port 0) as a Slave Port or a Master Port. • A maximum of 20 ports, including Masters and Slaves, can be configured for a Broadcast Group. • You cannot add a port to a Broadcast Group if it is already a member of another Broadcast Group. • A TCP port that is already in use cannot be added to a Broadcast Group. • No more than one TCP socket may be open on a single TCP port. • A maximum of 16 TCP ports can be configured for a Broadcast Group. • To prevent data overruns, it is recommended that the Master Port(s) and Slave Port(s) in a Broadcast Group be set to the same port speed. Specifying Port Options You can specify that a timestamp will be appended to each line of data that is broadcast from a Master Port. You can also specify that non-broadcast data will be discarded by Slave Ports and that Slave Ports will echo any data that comes into them. This section describes how to configure these features. Appending a Timestamp Use the timestamp option of the master port command to specify that a timestamp will be appended to each line of data that is broadcast from a Master Port; for example: BrGroups 4:0 >>master port async 4 6 7 timestampConfiguring the Data Broadcast Feature 100 451-0311B Discarding Non-Broadcast Data By default, any data that a Slave Port receives is forwarded to the Master Port(s) in the Broadcast Group. This data is then broadcast to all of the Slave Ports in the Broadcast Group. However, you can configure Slave Port(s) to discard data without forwarding it to the Master Port(s). To do this, specify the discard option in the slave port command; for example: BrGroups 4:0 >>slave port async 5 7 discard BrGroups 4:0 >>slave port tcp 2500 discard In the above example, the discard option is specified for the asynchronous ports 5 and 7 and the TCP port 2500, in the Broadcast Group 4. Echoing Incoming Data at Slave Ports Use the localecho option in the slave port command to specify that Slave Ports will echo any data that comes into them; for example: BrGroups 4:0 >>slave port async 5 7 localecho Removing Ports from Broadcast Groups To remove Master Ports from a Broadcast Group, execute the no master port command in the Broadcast Group Command Mode; for example: BrGroups 4:0 >>no master port async 5 BrGroups 4:0 >>no master port tcp 1500 In the above examples, asynchronous port 5 and TCP port 1500 are removed from Broadcast Group 4. To remove Slave Ports from a Broadcast Group, execute the no slave port command in the Broadcast Group Command Mode; for example: BrGroups 4:0 >>no slave port async 7 BrGroups 4:0 >>no slave port tcp 2500 In the above examples, asynchronous port 7 and TCP port 2500 are removed from Broadcast Group 4.451-0311B 101 Configuring the Data Broadcast Feature To verify that Master Ports or Slave Ports have been deleted from a Broadcast Group, execute the show broadcast group characteristics command. (The deleted ports will not be listed in the Broadcast Group Characteristics Display.) For more information on the show broadcast group characteristics command, refer to “Displaying Broadcast Group Characteristics” on page 101. NOTE: You can not delete a Broadcast Group. In lieu of deleting a Broadcast Group, you can remove all of the ports from the Broadcast Group and then disable the broadcast Group. Disabling Broadcast Groups To disable a Broadcast Group, execute the no broadcast group command in the Configuration Command Mode; for example: Config:0 >>no broadcast group 4 In the above example, Broadcast Group 4 is disabled. Displaying Broadcast Group Characteristics This section describes how to display information about Broadcast Groups. The information includes Broadcast Group characteristics and Broadcast Group Summaries. Displaying Broadcast Group Characteristics Use the show broadcast group characteristics command to display the characteristics of Broadcast Groups; for example: InReach:0 >>show broadcast group 1 characteristics In the above example, the Broadcast Group characteristics are displayed for Broadcast Group 1. Use the following syntax to display the Broadcast Group characteristics of all Broadcast Groups on the LX unit: InReach:0 >>show broadcast group all characteristicsConfiguring the Data Broadcast Feature 102 451-0311B Figure 5 shows an example of the Broadcast Group Characteristics Display. Figure 5 - Broadcast Group Characteristics Display Time: 08 Nov 2002 16:29:26 US/EASTERN Broadcast Group Number: 1 Mode: Line Mode State: Disabled Async Master port(s) with Timestamp: Async Master port(s) without Timestamp: 1,4 TCP Master port(s) with Timestamp: TCP Master port(s) without Timestamp: Async Slave port(s) with Discard: Async Slave port(s) without Discard: 2-3,5-7 Async Slave port(s) with Local Echo: Async Slave port(s) without Local Echo: 2-3,5-7 TCP Slave port(s) with Discard: TCP Slave port(s) without Discard: TCP Slave port(s) with Local Echo: TCP Slave port(s) without Local Echo:451-0311B 103 Configuring the Data Broadcast Feature Displaying Broadcast Group Summaries Use the show broadcast group summary command, in the Superuser Command Mode, to display summary information for all Broadcast Groups on the LX unit; for example: InReach:0 >>show broadcast group summary Figure 6 shows an example of the Broadcast Group Summary Display. Figure 6 - Broadcast Group Summary Display Broadcast group number: State: 1 Enabled 2 Disabled 3 Disabled 4 Disabled 5 Disabled451-0311B 105 Chapter 6 Configuring IP Interfaces An IP interface is a logical interface for accessing the LX unit from a network. You can configure up to 4 IP interfaces on an LX unit. Each IP interface has its own IP characteristics. You can access an LX unit via the Address of the IP interface, or by the ppciboot (server) Address of the LX unit. The network treats an IP interface as a network element that is no different from an actual server. For example, you could have an LX unit with an IP address of 117.19.23.5, a Broadcast address of 117.255.255.255, and the subnet mask of 255.0.0.0 in ppciboot. You could then create the IP interfaces shown in Table 7 for the LX unit. Table 7 - IP Interface Examples This would enable you to include the LX unit in three different networks (i.e., 119.20.112.0, 124.45.65.0, and 178.123.87.0). IP interfaces can be configured as rotaries. For more information, refer to “Configuring Rotaries” on page 113. Interface Number IP Address Broadcast Address Subnet Mask 1 119.20.112.3 119.255.255.255 255.0.0.0 2 124.45.65.23 119.255.255.255 255.0.0.0 3 178.123.87.123 119.255.255.255 255.0.0.0Configuring IP Interfaces 106 451-0311B An IP interface has the same subscriber database as the LX unit on which it was created. A subscriber can connect to asynchronous ports, or virtual ports, on the LX unit via an IP interface. IP interfaces support SSH and Telnet as methods for connecting subscribers to the LX unit. Refer to “Specifying the Subscriber Access Methods” on page 123 for more information. You can authenticate connections via IP interfaces with the same authentication methods that are configured for the LX unit (LOCAL, RADIUS, TACACS+, or SecurID). However, you must enable the authentication method on the IP interface before you can use it on the IP interface. (For more information, refer to “Configuring Local Authentication on an IP Interface” on page 110 and “Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface” on page 110.) Setting Up IP Interfaces IP interfaces are created and configured in the Interface Command Mode. You can enter the Interface Command Mode by executing the interface command in the Configuration Command Mode. When you are in the Interface Command Mode, the Interface Command prompt (e.g., Intf 1-1:0 >>) is displayed. To configure an IP interface, do the following: 1. Execute the interface command in the Configuration Command Mode; for example: Config:0 >>interface 1 This enters the Interface command mode for the specified IP interface (IP interface 1 in the above example). 2. Use the address command to specify an IP Address, and Subnet Mask, for the interface; for example: Intf 1-1:0 >>address 119.20.112.3 mask 255.0.0.0 In the above example, the IP Address is specified as 119.20.112.3 and the subnet Mask is specified as 255.0.0.0.451-0311B 107 Configuring IP Interfaces 3. Use the broadcast command to specify the Broadcast Address for the IP interface; for example: Intf 1-1:0 >>broadcast 119.255.255.255 4. Configure an authentication method (LOCAL, RADIUS, TACACS+, or SecurID) for the IP interface. For more information, refer to the following sections: • “Configuring Local Authentication on an IP Interface” on page 110 • “Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface” on page 110 Refer to the following sections to configure optional parameters for an IP interface: • “Specifying SSH Keepalive Parameters” on page 107 • “Specifying Socket Numbers” on page 108 • “Specifying Maximum Transmission Units (MTU)” on page 109 Specifying SSH Keepalive Parameters The SSH Keepalive Count is the number of times that an SSH client will attempt to make an SSH connection to an IP interface. The SSH Keepalive Interval is the length of time, in seconds, between attempts at making an SSH connection to the IP interface. Specifying the SSH Keepalive Count To specify the SSH Keepalive Count, execute the ssh keepalive count command; for example: Intf 1-1:0 >>ssh keepalive count 8 Specifying the SSH Keepalive Interval To specify the SSH Keepalive Count, execute the ssh keepalive interval command; for example: Intf 1-1:0 >>ssh keepalive interval 30Configuring IP Interfaces 108 451-0311B Specifying Socket Numbers IP interfaces have a default SSH Socket Number of 22 and a default Telnet Socket Number of 23. Table 8 lists the default SSH and Telnet Socket Numbers for LX serial ports. Table 8 - Default Socket Numbers for Serial Ports This section describes how to specify SSH Socket Numbers and Telnet socket Numbers for IP interfaces and LX (asynchronous) ports. This is typically done to prevent hackers from accessing LX ports via default SSH Socket Numbers or default Telnet Socket Numbers. Specifying a Telnet Socket Number for a Serial Port To specify a Telnet Socket Number for a serial port, execute the serial command with the telnet modifier; for example: Intf 1-1:0 >>serial 6 ssh 1297 In the above example, the Telnet Socket Number for serial port 6 is set to 1297. LX Serial Port Default Telnet Port Default SSH Port 0 0 0 1 2100 2122 2 2200 2222 3 2300 2322 4 2400 2422 5 2500 2522 6 2600 2622 7 2700 2722 8 2800 2822451-0311B 109 Configuring IP Interfaces Specifying an SSH Socket Number for a Serial Port To specify an SSH Socket Number for a serial port, execute the serial command with the ssh modifier; for example: Intf 1-1:0 >>serial 4 ssh 983 In the above example, the SSH Socket Number for serial port 4 is set to 983. Specifying a Virtual Port Socket Number for SSH To specify the Virtual Port Socket Number for making an SSH connection to the IP interface, execute the ssh port command; for example: Intf 1-1:0 >>ssh port 988 In the above example, the Virtual Port Socket Number for making an SSH connection to the IP interface is set to 988. Specifying a Virtual Port Socket Number for Telnet To specify the Virtual Port Socket Number for making a Telnet connection to the IP interface, execute the telnet port command; for example: Intf 1-1:0 >>telnet port 1743 In the above example, the Virtual Port Socket Number for making a Telnet connection to the IP interface is set to 1743. Specifying Maximum Transmission Units (MTU) The Maximum Transmission Units (MTU) is the maximum size (in bytes) of frames that can be transmitted on the IP interface. Frames that are larger than the designated MTU size are fragmented before transmission. (Note that the software fragments frames on the transmit side only.) Use the mtu command to specify the MTU for an IP interface; for example: Intf 1-1:0 >>mtu 1200 You can specify any number from 1000 through 1500 as the MTU size. The default MTU size is 1500.Configuring IP Interfaces 110 451-0311B Configuring Local Authentication on an IP Interface Local authentication can be used when a subscriber logs in to a specific asynchronous port via an IP interface. In order to use local authentication, it must be enabled as the method of inbound authentication for the asynchronous port. Then it must be enabled for the IP interface. Execute the authentication enable command, with the inbound and local modifiers, to enable local authentication for inbound asynchronous ports. The authentication enable command is executed in the Asynchronous Command Mode; for example: Async 4-4:0 >>authentication inbound local enable In the above example, local authentication is enabled as the method of inbound authentication for asynchronous port 4. Execute the authentication local enable command, in the Interface Command Mode, to enable local authentication on the IP interface; for example: Intf 1-1:0 >>authentication local enable Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface Server-based authentication methods (i.e., RADIUS, TACACS+, or SecurID) can be used when a subscriber logs in to an asynchronous port via an IP interface. In order to enable server-based authentication for an IP interface, the authentication method must be configured for the LX unit and enabled as the method of inbound authentication for the asynchronous port. For more information, refer to “Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit” on page 33 and the authentication enable command in the LX-Series Commands Reference Guide. To enable RADIUS authentication on the IP interface, execute the authentication radius enable command, in the Interface Command Mode; for example: Intf 1-1:0 >>authentication radius enable451-0311B 111 Configuring IP Interfaces To enable SecurID authentication on the IP interface, execute the authentication securid enable command, in the Interface Command Mode; for example: Intf 1-1:0 >>authentication securid enable To enable TACACS+ authentication on the IP interface, execute the authentication tacacs+ enable command, in the Interface Command Mode; for example: Intf 1-1:0 >>authentication tacacs+ enable Configuring RADIUS Accounting on an Interface RADIUS Accounting allows you to log user account information to a remote server in a per-client file. The file or record can contain information such as the user who logged in, the duration of the session, port number, Client IP address, and the number of bytes/packets that were processed by the LX unit. For more information on RADIUS accounting, refer to “Overview of RADIUS and TACACS+ Accounting” on page 161. RADIUS accounting can be used when a subscriber logs in to an asynchronous port via an IP interface. In order to enable RADIUS accounting for an IP interface, RADIUS accounting must be configured for the LX unit. For more information, refer to “Setting Up RADIUS” on page 33. Execute the radius accounting enable command, in the Interface Command Mode, to enable RADIUS accounting on the IP interface; for example: Intf 1-1:0 >>radius accounting enable Configuring TACACS+ Accounting on an Interface TACACS+ Accounting allows you to log user account information to a remote server in a per-client file. For more information on TACACS+ accounting, refer to “Overview of RADIUS and TACACS+ Accounting” on page 161.Configuring IP Interfaces 112 451-0311B Execute the tacacs+ accounting enable command, in the Interface Command Mode, to enable TACACS+ accounting on the IP interface; for example: Intf 1-1:0 >>tacacs+ accounting enable Configuring Fallback on an IP Interface Fallback Authentication can be used as a mechanism for authenticating users when the configured authentication method (i.e., RADIUS, TACACS+, or SecurID) fails because the authentication server is unreachable. When a user logs in via Fallback, his or her username/password combination is validated against the LOCAL security database for the LX unit. The LX unit will make three attempts to log in the user via RADIUS, TACACS+, or SecurID before it implements Fallback. After the third login attempt, the username/password combination will be validated against the LOCAL security database for the LX unit. RADIUS, TACACS+, or SecurID must be enabled on an IP interface in order for Fallback to function on the interface. (Refer to “Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface” on page 110 for information on enabling RADIUS, TACACS+, or SecurID.) When all three methods (i.e., RADIUS, TACACS+, or SecurID) are disabled on the interface, Fallback is ignored by the interface. Execute the authentication fallback enable command, in the Interface Command Mode, to enable Fallback on the IP interface; for example: Intf 1-1:0 >>authentication fallback enable451-0311B 113 Configuring IP Interfaces Configuring Rotaries The term “rotary” refers to the assignment of an IP address to multiple destinations that offer the same type of service. On an LX unit, an IP interface can be configured as a rotary, with LX asynchronous ports as the multiple destinations of the rotary. A user can attempt to connect to an IP interface that is configured as a rotary. When a user attempts such a connection, he/she is connected to an available port that has been configured as one of the destinations of the rotary. Figure 7 illustrates a rotary on an LX unit. Figure 7 - Rotary Connections on an IP Interface The rotary is transparent to users. A user simply requests a connection to an IP address, and the LX unit sets up the connection with one of the available ports in the rotary group. Do the following to configure an IP interface as a rotary: 1. Create a new IP interface, or access an existing one, by executing the interface command in the Configuration Command Mode; for example: Config:0 >>interface 1 This enters the Interface Command Mode for the specified interface (i.e., Interface 1). The Interface Command prompt (e.g., Intf 1-1:0 >>) is displayed. The user initiates a Telnet connection, or an SSH connection, to the IP address of an IP interface that has been configured as a rotary. The user is connected to an available port in the rotary port list. LX UnitConfiguring IP Interfaces 114 451-0311B 2. Use the address command to configure a server IP address for the IP interface; for example: Intf 1-1:0 >>address 10.240.10.100 3. Use the rotary type command to specify the rotary type (Round Robin or First Available); for example: Intf 1-1:0 >>rotary type round robin The rotary type is identifies the port search method for the rotary. The allowable values are: first available An incoming call is connected to the First Available (non-busy) port in the rotary. round robin The LX unit will search the rotary for an available port, starting with the lowest-numbered port in the rotary. 4. Use the rotary port command to configure the IP interface as a rotary, and to assign LX asynchronous ports to the rotary; for example: Intf 1-1:0 >>rotary port 1 2 3 In the above example, the LX asynchronous ports 1, 2, and 3 are assigned to the rotary. 5. Use the rotary tcp port command to assign a TCP socket number to the rotary; for example: Intf 1-1:0 >>rotary tcp port 3000 In the above example, the TCP socket number for the rotary is specified as 3000. This identifies the socket that will be used to make Telnet connections to the rotary. NOTE: The default TCP socket is 1500.451-0311B 115 Configuring IP Interfaces 6. Use the rotary ssh port command to assign an SSH socket number to the rotary; for example: Intf 1-1:0 >>rotary ssh port 3022 In the above example, the SSH socket number for the rotary is specified as 3022. This identifies the socket that will be used to make SSH connections to the rotary. NOTE: The default SSH socket is 1522. 7. Use the rotary enable command to enable the rotary; for example: Intf 1-1:0 >>rotary enable Disabling Rotaries Execute the no rotary command in the Interface Command Mode to disable a rotary; for example: Intf 1-1:0 >>no rotary When a rotary is disabled, it no longer functions as a rotary. NOTE: Disabling a rotary does not delete the rotary; the configuration of the rotary still exists, and you can re-enable it by executing the rotary enable command in the Interface Command Mode. To verify that a rotary has been disabled, execute the show interface rotary command. If the rotary is in fact disabled, it will say “Disabled” in the “Rotary State” column of the display. For more information on the show interface rotary command, refer to “Displaying Rotary Information” on page 118. Removing Ports from a Rotary To remove asynchronous ports from a rotary, execute the no rotary port command in the Interface Command Mode; for example: Intf 1-1:0 >>no rotary port In the above example, the asynchronous ports are removed from the rotary on Interface 1.Configuring IP Interfaces 116 451-0311B To verify that asynchronous ports have been removed from a rotary, execute the show interface rotary command. If the asynchronous ports have in fact been removed, they will not appear in the “Serial Ports” column of the display. For more information on the show interface rotary command, refer to “Displaying Rotary Information” on page 118. Displaying Interface Information This section describes how to display information about IP interfaces and rotaries. The IP interface information includes characteristics, port mapping, statuses, and summaries. The rotary information includes the Rotary IP Address, the Rotary ports, the Rotary type, and the Rotary State. Displaying Interface Characteristics Use the show interface characteristics command, in the Superuser Command Mode, to display the characteristics of an IP interface; for example: InReach:0 >>show interface 1 characteristics In the above example, the interface characteristics are displayed for IP interface 1. Use the following syntax to display the interface characteristics of all IP interfaces on the LX unit: InReach:0 >>show interface all characteristics Figure 8 shows an example of the Interface Characteristics display. Figure 8 - Interface Characteristics Display Time: Mon, 22 Dec 1969 16:14:27 Interface Name: Interface_1 Bound to : eth0 IP MTU Size: 1500 IP Address : 0.0.0.0 Learned IP Address : 102.19.169.191 IP Mask : 0.0.0.0 Learned IP Mask : 255.255.255.0 IP Broadcast : 0.0.0.0 Learned IP Broadcast: 102.19.169.255 Interface Status: In Use Learned IP Gateway : 102.19.169.1 Rotary Feature: Disabled Learned IP DNS : 0.0.0.0 Authentication: Local Radius Accounting: Disabled Authentication FallBack: Disabled Tacacs+ Accounting: Disabled SSH port: 22 Telnet port: 23 SSH Keepalive Interval: 0 SSH Keepalive Count: 3451-0311B 117 Configuring IP Interfaces Displaying Interface Port Mapping Use the show interface characteristics command, in the Superuser Command Mode, to display the Telnet Socket Number, and the SSH Socket Number, associated with each serial port on the LX unit; for example: InReach:0 >>show interface 1 port mapping In the above example, the port mapping for IP interface 1 is displayed. Use the following syntax to display the port mapping for all IP interfaces on the LX unit: InReach:0 >>show interface all port mapping Figure 9 shows an example of the Interface Port Mapping display. Figure 9 - Interface Port Mapping Display Displaying Interface Statuses Use the show interface characteristics command, in the Superuser Command Mode, to display the status information for IP interfaces; for example: InReach:0 >>show interface 1 status In the above example, the status information for IP interface 1 is displayed. Use the following syntax to display the status information for all IP interfaces on the LX unit: InReach:0 >>show interface all status Serial Port Telnet Port SSH Port 0 0 0 1 2100 2122 2 2200 2222 3 2300 2322 4 2400 2422 5 2500 2522 6 2600 2622 7 2700 2722 8 2800 2822Configuring IP Interfaces 118 451-0311B Figure 10 shows an example of the Interface Status display. Figure 10 - Interface Status Display Displaying Interface Summaries Use the show interface summary command, in the Superuser Command Mode, to display summary information for all of the IP interfaces on the LX unit; for example: InReach:0 >>show interface summary Figure 11 shows an example of the Interface Summary display. Figure 11 - Interface Summary Display Displaying Rotary Information Use the show interface rotary command, in the Superuser Command Mode, to display information on rotaries; for example: InReach:0 >>show interface 1 rotary In the above example, the rotary information for IP interface 1 is displayed. Use the following syntax to display the rotary information for all IP interfaces on the LX unit: InReach:0 >>show interface all rotary Time: Mon, 22 Dec 1969 16:19:34 Interface Name: Interface_1 Bound to : eth0 IP Address: 102.19.169.191 IP Mask: 255.255.255.0 IP Broadcast Addr: 102.19.169.255 Name Address Broadcast Addr. Mask Bound to Interface_1 0.0.0.0 0.0.0.0 0.0.0.0 eth0 Interface_2 0.0.0.0 0.0.0.0 0.0.0.0 eth0:1451-0311B 119 Configuring IP Interfaces Figure 12 shows an example of the Rotary display. Figure 12 - Rotary Display Rotary Ip Address TCP/SSH Port Rotary Type Rotary State Serial Ports 147.132.145.16 1500/1522 First Available Disabled 2,3,4,7451-0311B 121 Chapter 7 Configuring Subscriber Accounts for the LX Unit In order for a user (subscriber) to use the LX unit, he/she must log in to the unit under a subscriber account. The subscriber account defines a User Profile that includes the subscriber’s username and password. The User Profile also defines the subscriber’s Security Level (User or Superuser) and contains all of the settings that affect the subscriber’s use of the LX unit. This chapter describes how to create and delete subscriber accounts, how to modify subscriber accounts, and how to display information on subscriber accounts. The LX-Series Commands Reference Guide provides a detailed syntax, and description, for each command mentioned in this chapter. Creating Subscriber Accounts and Entering Subscriber Command Mode To create a subscriber account, or to access an existing subscriber account, use the subscriber command in the Configuration Command Mode; for example: Config:0 >>subscriber jack where jack is an example of a subscriber name (user name). The subscriber name must contain at least 2 characters, and no more than 15 characters. The reserved words super and subscriber, and any variation of super and subscriber, cannot be used as subscriber names. (Variations of super and subscriber include su, sup, sub, subs, etc.)Configuring Subscriber Accounts for the LX Unit 122 451-0311B The maximum number of subscribers on an LX unit is equal to double the number of ports on the unit. For example, the maximum number of subscribers is 16 on an 8-port unit, 32 on a 16-port unit, 64 on a 32-port unit, and 96 on a 48-port unit. Executing the subscriber command puts you into the Subscriber Command Mode for the subscriber. The Subscriber Command prompt (e.g., Subs_jack >>) is displayed. Creating Subscriber Accounts by Copying You can also create subscriber accounts by executing the copy subscriber command in the Configuration Command Mode. The copy subscriber command creates new subscriber accounts by copying the configuration of an existing subscriber account; for example: Config:0 >>copy subscriber benw to jimk billj edw In the above example, the subscriber account configuration of benw is copied to jimk, billj, and edw. Deleting Subscriber Accounts Use the no subscriber command, in the Configuration Command Mode, to delete a subscriber account; for example: Config:0 >>no subscriber jack In the above example, the subscriber account jack is deleted. NOTE: You can not delete the subscriber InReach.451-0311B 123 Configuring Subscriber Accounts for the LX Unit The User Profile When you create a new subscriber account with the subscriber command, its User Profile is based on the default User Profile of the InReach subscriber. (The InReach subscriber is the default subscriber for the LX unit.) Refer to the following sections to specify new settings in a User Profile: • “Specifying the Subscriber Access Methods” on page 123 • “Setting Up the Session and Terminal Parameters” on page 128 • “Configuring the Subscriber Password” on page 132 • “Specifying a Preferred Service” on page 133 • “Specifying a Dedicated Service” on page 133 • “Enabling Login Menus” on page 134 • “Adding Superuser Privileges to a Subscriber Account” on page 133 • “Configuring the Subscriber Password” on page 132 • “Enabling Audit Logging” on page 134 • “Enabling Command Logging” on page 134 Specifying the Subscriber Access Methods You can specify up to four methods for the subscriber to access the LX unit. The methods include Telnet, SSH, Web Browser, and Console. For information on specifying each method, refer to the following: • “Telnet Access” (see below) • “SSH Access” (see page 124) • “Web Browser Access” (see page 126) • “Console Access” (see page 127) You can also provide subscribers with access via Dialback. For more information, refer to “Dialback Access” on page 127.Configuring Subscriber Accounts for the LX Unit 124 451-0311B Telnet Access In order to specify Telnet access for a subscriber, do the following: 1. Set the telnet access parameter to enabled; for example: Subs_jack >>access telnet enable 2. Set the telnet mode parameter to line or character; for example: Subs_jack >>telnet mode line Subs_jack >>telnet mode character After you have executed the above commands, the subscriber will have Telnet access to virtual ports on the LX unit. Refer to “Console Access” on page 127 to give the user access to asynchronous ports on the LX unit. SSH Access In order to specify SSH access for a subscriber, do the following: 1. Set the ssh access parameter to enabled; for example: Subs_jack >>access ssh enable 2. Set the ssh log level parameter to the class of SSH messages that will be logged to syslogd; for example: Subs_jack >>ssh log level debug The above example of the ssh log level command specifies that SSH messages of the debug class will be logged to syslogd for the subscriber. You can also specify SSH log levels of error, fatal, info, quiet, verbose. 3. Set the ssh cipher parameter to triple-des, any, or blowfish; for example: Subs_jack >>ssh cipher triple-des Subs_jack >>ssh cipher any Subs_jack >>ssh cipher blowfish451-0311B 125 Configuring Subscriber Accounts for the LX Unit Description of the Three Encryption Types After you have executed the above commands, the subscriber will have SSH access to virtual ports on the LX unit. Refer to “Console Access” on page 127 to give the subscriber access to asynchronous ports on the LX unit. You can specify a unique SSH key for the subscriber. Refer to “Specifying a Unique SSH Key for the Subscriber” on page 126 for more information. Overview of Triple-DES DES is a block cipher (i.e., it acts on a fixed-length block of plaintext and converts it into a block of ciphertext of the same size by using the secret key). In DES, the block size for plaintext is 64 bits. The length of the key is also 64 bits but 8 bits are used for parity. Hence the effective key length is only 56 bits. In Triple-DES, we apply 3 stages of DES with a separate key for each stage. The key length in Triple-DES is 168 bits. Decryption is done by applying the reverse transformation to the block of ciphertext using the same key. Since the same key is used both in encryption and decryption, DES is a symmetric key cipher. This method differs from algorithms like the RSA encryption which use different keys to encrypt and decrypt a message. triple-des Specifies that the Triple Data Encryption Standard (TripleDES) is the only SSH encryption type supported for this subscriber. any Specifies that any SSH encryption type is supported for this subscriber. blowfish Specifies that BLOWFISH is the only SSH encryption type supported for this subscriber. See “Usage Guidelines” (below) for more information on the BLOWFISH encryption type.Configuring Subscriber Accounts for the LX Unit 126 451-0311B Overview of Blowfish Blowfish is a variable-length key block cipher. It is only suitable for applications where the key does not change often, like a communications link or an automatic file encryptor. It is significantly faster than DES when implemented on 32-bit microprocessors with large data caches, such as the Pentium and the PowerPC. It takes a variable-length key, from 32 bits to 448 bits, making it ideal for both domestic and exportable use. Specifying a Unique SSH Key for the Subscriber You can specify a unique SSH key for the subscriber by executing the ssh key command; for example: Subs_jack >>ssh key When you execute the ssh key command, the following prompt is displayed: Please enter your key: Type an SSH key at the above prompt. The SSH key can be any random string of characters. As an alternative to typing the SSH key, you can paste a generated SSH key at the above prompt. (The SSH key must be generated on the host from which the subscriber will make SSH connections to the LX unit. Refer to your Linux documentation for more information on generating an SSH key.) When a subscriber has a unique SSH key, he/she can log on to the LX unit, via SSH, without entering a password. (The only requirement is that the user must log on from the host on which his or her SSH key was generated.) Web Browser Access In order to specify Web Browser access for the subscriber, set the access web parameter to enabled; for example: Subs_jack >>access web enable451-0311B 127 Configuring Subscriber Accounts for the LX Unit In order for the subscriber to have access to virtual ports on the LX, you must configure Telnet or SSH for the subscriber. For more information, refer to “Telnet Access” on page 124 and “SSH Access” on page 124. Refer to “Console Access” on page 127 to give the user access to asynchronous ports on the LX. Console Access By default, a user can only access virtual ports on the LX when his or her subscriber account has been configured for Telnet, SSH, or Web Browser access. In order for a subscriber to access asynchronous ports, the access to those ports must be configured in the subscriber account. To configure a subscriber account for access to asynchronous ports, do the following: 1. Execute the access console enable command to enable asynchronous port access for the subscriber; for example: Subs_jack >>access console enable 2. Execute the access port enable command to specify the asynchronous ports that the subscriber can access; for example: Subs_jack >>access port 2 4 6 enable In the above example, the subscriber is given access to asynchronous ports 2, 4, and 6. Dialback Access The LX unit supports Dialback as an access method for LX subscribers. Under Dialback, the subscriber dials in to the LX unit and logs in as he/she would if he/she were a dialin subscriber. The LX unit then validates the login and terminates the call. If the subscriber login is valid, the LX unit calls the subscriber back. The subscriber is then logged in to the LX unit. Dialback is used for security (the destination is recorded by the Telco for billing, and calls can be restricted to specific destinations) and to manage connection costs (central site billing).Configuring Subscriber Accounts for the LX Unit 128 451-0311B In order to specify Dialback access for a subscriber, do the following: 1. Set the dialback access parameter to enabled; for example: Subs_jack >>dialback enable 2. Specify a dialback number for the subscriber; for example: Subs_jack >>dialback number 19785551978 The dialback number is the telephone number that the LX modem will dial to call back the subscriber. 3. Specify the dialback retry parameter for the subscriber; for example: Subs_jack >>dialback retry 7 The dialback retry parameter is the number of times that the modem on the LX unit can attempt to answer a dialback call Setting Up the Session and Terminal Parameters The session and terminal parameters include all settings that affect the subscriber session and the operation of the subscriber terminal during a subscriber session. These settings include the session timeouts and limits, screen pause, user prompts, terminal type, Subscriber session mode, and function keys for switching between sessions. For more information, refer to the following: • Function Keys for Switching Between Sessions – Used to switch between subscriber sessions, including the Local Command Mode (see “Setting Up the Session Switch Characters” on page 131). • Terminal Type – Use the terminal command to set the terminal type for the subscriber. You can set the terminal type to ANSI or VT100; for example: Subs_jack >>terminal ansi Subs_jack >>terminal vt100451-0311B 129 Configuring Subscriber Accounts for the LX Unit • Maximum Length of a Subscriber Session – Use the session timeout command to set the maximum length (in seconds) of a subscriber session. The syntax of the session timeout command is as follows: Subs_jack >>session timeout 36000 The allowable values are 0 through 65535. A value of 0 means that there is no limit to the length of a subscriber session. • User Prompts – You can specify a custom user prompt of up to 8 ASCII characters to replace the username field of the default login prompt for a subscriber. To specify a custom user prompt, execute the prompt command; for example: Subs_jack >>prompt mxxxx9 In the above example, the subscriber’s default login prompt (e.g., jack:0 >) is changed to mxxxx9:0 >. • Subscriber Session Mode – When the Subscriber session mode is CLI, the subscriber is logged into the CLI when he/she accesses the LX unit; when the Subscriber session mode is Shell, the subscriber is logged into the Linux shell when he/she accesses the LX unit. Use the shell enable command to change the Subscriber session mode from CLI to Shell; for example: Subs_jack >>shell enable When the shell enable command is executed, the Maximum Subscriber Sessions is automatically set to 1. The Maximum Subscriber Sessions cannot be changed from 1 until the Subscriber Session Mode is disabled with the no shell command (see below). When the Subscriber session mode is Shell, the subscriber can only access the Linux shell and the GUI; the subscriber cannot access the CLI. Use the no shell command to change the Subscriber session mode from Shell to CLI; for example: Subs_jack >>no shellConfiguring Subscriber Accounts for the LX Unit 130 451-0311B When the no shell command is executed, the Maximum Subscriber Sessions is automatically set to 4. • Screen Pause – When this feature is enabled, the screen will pause after displaying the number of lines specified in the “lines/screen” value for the terminal. To enable this feature for a subscriber, use the pause enable command; for example: Subs_jack >>pause enable • Inactivity Timeout – The Inactivity Timeout is the length of time (in seconds) that the subscriber has to enter keyboard data. If the subscriber does not enter keyboard data before the expiration of the Inactivity Timeout, he/she is logged out. You can use the idletime command to set the Inactivity Timeout to any value from 0 through 65535; for example: Subs_jack >>idletime 1200 A value of 0 means that the Inactivity Timer is effectively disabled. • Maximum Simultaneous Connections – You can configure 1 through 255 simultaneous connections for a subscriber. Use the maxsubscriber command to set the maximum simultaneous connections for the subscriber; for example: Subs_jack >>maxsubscriber 10 • Maximum Subscriber Sessions – Use the session command to specify the maximum number of sessions for a subscriber. The allowable values are 0 through 4, where a value of 0 disables the subscriber’s access to the LX unit; for example: Subs_jack >>session 3451-0311B 131 Configuring Subscriber Accounts for the LX Unit Setting Up the Session Switch Characters The LX unit supports up to 4 sessions per subscriber. (Refer to “Setting Up the Session and Terminal Parameters” on page 128 to configure the number of sessions for a subscriber.) You can configure Control characters as function keys for switching to the previous, or next, session. You can also configure a Control character as a function key for switching to the Local Command Mode.) To configure Session Switch characters for a subscriber, use the following commands: • backward_switch – to specify the Function Key for switching (backwards) to the previous session; for example: Subs_jack >>backward_switch ^I • forward_switch – to specify the Forward Switch (i.e., Controlcharacter sequence for switching to the next session); for example: Subs_jack >>forward_switch ^J • local_switch – to specify the Local Switch (i.e., Control-character sequence for switching to the Local Command Mode); for example: Subs_jack >>local_switch ^K The Session Switch character can be specified as an uppercase alphabetical character with, or without, a caret (^) before it. When the Session Switch character is preceded by a caret, the LX command parser interprets it as a Control-character sequence. For example, ^I is interpreted as CTRL/I; ^J as CTRL/J; and ^M as CTRL/M. Be sure that there are no conflicting uses for the character you select (particularly with control characters that are used by applications programs, or with the character you set for the FORWARD SWITCH, the LOCAL SWITCH, or any Telnet command characters). If you specify a CTRL character, when the user types the character, it will be displayed as ^ (e.g., if the user types CTRL/I, the terminal will echo the characters: ^I).Configuring Subscriber Accounts for the LX Unit 132 451-0311B Configuring the Subscriber Password The default password for an LX subscriber account is access. It is recommended that you, or the subscriber, change the password from this default before the subscriber uses it to log in to the LX unit. This prevents unauthorized users (who might know the default password) from logging on to the LX unit. Changing the Subscriber Password To change the subscriber password, execute the password command; for example: Subs_jack >>password When the password command is executed, the following prompts are displayed: Enter your NEW password : Re-enter your NEW password: Enter the new password at the Enter prompt, and re-enter it at the Re-enter prompt. The password string can be up to 16 characters in length, and it will be masked when you enter it at the above prompts. Enabling the Subscriber to Change His or Her Own Password To enable the subscriber to change his or her own password, execute the password enable command; for example: Subs_jack >>password enable The subscriber will be prompted to enter, and verify, his or her new password the next time he/she logs in to the LX unit.451-0311B 133 Configuring Subscriber Accounts for the LX Unit Adding Superuser Privileges to a Subscriber Account By default, a subscriber password has user privileges on the LX unit. A subscriber with user privileges can only access the User Command Mode, or his or her assigned Login menu, when he/she logs in to the LX unit. You can add Superuser privileges to a subscriber account. With Superuser privileges, the subscriber can use the enable command in the User Command Mode to enter the Superuser Command Mode. Use the security level superuser command to add Superuser privileges to the subscriber account; for example: Subs_jack >>security level superuser Specifying a Dedicated Service If a dedicated service is specified for a subscriber, the subscriber will begin running the dedicated service whenever he/she logs in to the LX unit. Telnet must be enabled for the subscriber in order for him to run a dedicated service. Refer to “Specifying the Subscriber Access Methods” on page 123 to enable Telnet for a subscriber. Use the dedicated service command to specify a dedicated service for the subscriber; for example: Subs_jack >>dedicated service 192.173.56.10 Specifying a Preferred Service Use the preferred service command to assign a service to which the subscriber will be connected whenever he/she makes a connect request without specifying a service; for example: Subs_jack >>preferred service 178.87.42.19 Telnet must be enabled for the subscriber in order for him to run a preferred service. Refer to “Specifying the Subscriber Access Methods” on page 123 to enable Telnet for a subscriber.Configuring Subscriber Accounts for the LX Unit 134 451-0311B Enabling Audit Logging An audit log records all of the port activity for a subscriber. This includes the commands that the subscriber enters as well as the data that is output on the port for the subscriber. To enable audit logging for a subscriber, execute the audit log enable command; for example: Subs_jack >>audit log enable To display the contents of the audit log, execute the show audit log command in the Superuser Command Mode. For more information, refer to “Displaying the Audit Log for a Subscriber” on page 138. Enabling Login Menus A Subscriber Menu is a menu that displays for a subscriber when he/she logs in to the LX unit. In order for a menu to display for a subscriber, you must enable the Login Menu feature and specify a menu for the subscriber. Use the menu enable command to enable the Login Menu feature and to specify a menu that will be displayed for a subscriber when he/she logs in to the LX unit; for example: Subs_jack >>menu financegroup enable In the above example, the subscriber jack is enabled for the Login Menu feature, and the menu financegroup is specified for him. The financegroup menu will be displayed for the subscriber jack when he/she logs on to the LX unit. Enabling Command Logging Command logging creates an audit trail of subscriber input in a subscriber session. The audit trail is sent to the accounting log and to syslogd. To enable command logging for a subscriber, execute the command log enable command; for example: Subs_jack >>command log enable451-0311B 135 Configuring Subscriber Accounts for the LX Unit To display the contents of the command log, execute the show command log command in the Superuser Command Mode. For more information, refer to “Displaying the Command Log for a Subscriber” on page 139. Displaying Subscriber Information This section describes how to display subscriber characteristics, subscriber status and TCP information, subscriber summaries, and the audit log and command log for a subscriber. Displaying Subscriber Characteristics Use the show subscriber characteristics command, in the Superuser Command Mode, to display subscriber characteristics; for example: demo:0 >>show subscriber tim characteristics In the above example, the show subscriber characteristics command is used to display the characteristics for the subscriber tim. Use the following syntax to display the characteristics for all of the subscribers on the LX unit: demo:0 >>show subscriber all characteristics Figure 13 shows an example of the Subscriber Characteristics display. Figure 13 - Subscriber Characteristics Display Subscriber Name: tim Security: Super User Prompt: Demo Preferred Service: Dedicated Service: Command Logging: Disabled User Password: Disabled Maximum Connections: 50 Maximum Sessions: 4 Session Mode: Normal Screen Pause: Enabled Debug Feature: Disabled Debug File: /tmp/D_demo Idle Timeout: 0 Session Timeout: 0 Menu Feature: Disabled Menu Name: /config/M_demo Forward Switch: ^F Local Switch: ^L Backward Switch: ^B Dialback Feature: Disabled Dialback Retry: 4 Dialback Number: Dialback Timeout: 45 Audit Feature: Disabled Port Access list: 1-8 Remote Access list: Telnet Ssh Web_ServerConfiguring Subscriber Accounts for the LX Unit 136 451-0311B Refer to the show subscriber command in the LX-Series Commands Reference Guide for detailed descriptions of the fields in the Subscriber Characteristics display. Displaying the Subscriber Status Use the show subscriber status command, in the Superuser Command Mode, to display the status information for a subscriber; for example: demo:0 >>show subscriber tim status In the above command, the show subscriber status command is used to display the status information for the subscriber tim. Use the following syntax to display the status information for all of the subscribers on the LX unit: demo:0 >>show subscriber all status Figure 14 shows an example of the Subscriber Status display. Figure 14 - Subscriber Status Display Refer to the show subscriber command in the LX-Series Commands Reference Guide for detailed descriptions of the fields in the Subscriber Status display. Time: Fri, 03 Jan 2003 17:44:21 Subs. Name: tim Number of Connections: 0 Configured TermType: Ansi Session Mode: Normal451-0311B 137 Configuring Subscriber Accounts for the LX Unit Displaying the Subscriber TCP Information Use the show subscriber tcp command, in the Superuser Command Mode, to display the subscriber TCP information; for example: demo:0 >>show subscriber tim tcp In the above command, the show subscriber tcp command is used to display the TCP information for the subscriber tim. Use the following syntax to display the TCP information for all of the subscribers on the LX unit: demo:0 >>show subscriber all tcp Figure 15 shows an example of the Subscriber TCP display. Figure 15 - Subscriber TCP Display Refer to the show subscriber command in the LX-Series Commands Reference Guide for detailed descriptions of the fields in the Subscriber TCP display. Time: Fri, 03 Jan 2003 17:46:32 Subscriber Name: mark Telnet Line Mode: Character Mode SSH Name: mark SSH Encryption: Any SSH Port: 22 SSH Log Level: INFOConfiguring Subscriber Accounts for the LX Unit 138 451-0311B Displaying the Subscriber Summary Information Use the show subscriber summary command, in the Superuser Command Mode, to display a Subscriber Summary; for example: demo:0 >>show subscriber summary Figure 16 shows an example of the Subscriber Summary display. Figure 16 - Subscriber Summary Display Refer to the show subscriber summary command in the LX-Series Commands Reference Guide for detailed descriptions of the fields in the Subscriber Summary display. Displaying the Audit Log for a Subscriber An audit log records all of the port activity for a subscriber. This includes the commands that the subscriber enters as well as the data that is output on the port for the subscriber. Use the show audit log command, in the Superuser Command Mode, to display the audit log for a subscriber; for example: demo:0 >>show audit log tim In the above command, the show audit log command is used to display the audit log for the subscriber tim. Name Connections Terminal Type In-Reach 0 Ansi demo 1 Ansi jack 0 Ansi451-0311B 139 Configuring Subscriber Accounts for the LX Unit Figure 17 shows an example of the Audit Log. Figure 17 - Audit Log Display Displaying the Command Log for a Subscriber A command log is an audit trail of subscriber input in a subscriber session. Use the show command log command, in the Superuser Command Mode, to display the command log for a subscriber; for example: demo:0 >>show command log tim In the above command, the show command log command is used to display the command log for the subscriber tim. Figure 18 shows an example of the Command Log. Figure 18 - Command Log Display Nov 18 16:08:32 tim ttyGN0 0 Subs_tim >>end Nov 18 16:08:50 tim ttyGN0 1 tim:0 >> Nov 18 16:08:50 tim ttyGN0 2 tim:1 > Nov 18 16:08:50 tim ttyGN0 3 tim:2 > Nov 18 16:08:55 tim ttyGN0 3 tim:3 >sho session Nov 18 16:08:55 tim ttyGN0 3 Number Device Program Pid Time Status Nov 18 16:08:55 tim ttyGN0 3 0 /dev/pts/0 Superuser 477 98 - Nov 18 16:08:55 tim ttyGN0 3 1 /dev/pts/3 User 481 5 - Nov 18 16:08:55 tim ttyGN0 3 2 /dev/pts/4 User 482 5 - Nov 18 16:08:55 tim ttyGN0 3 3 /dev/pts/5 User 483 5 * Nov 11 12:47:30 tim 0 end Nov 11 12:47:33 tim 0 sho command log Nov 11 12:49:21 tim 23 modem Nov 11 12:49:29 tim 23 end Nov 11 12:49:39 tim 23 show command log tim451-0311B 141 Chapter 8 Configuring Ports for Temperature/Humidity Sensors You can configure ports to act as temperature and humidity monitors when connected to an In-Reach Temperature/Humidity Sensor. The Temperature/ Humidity Sensor provides an accurate measurement of the temperature and humidity in the area in which your LX Series unit is placed. Refer to Getting Started with the LX Series to connect a Temperature/ Humidity Sensor to an LX port. Configuring Sensor Access for an LX Port You must configure an LX port’s access as sensor before you can perform any temperature/humidity monitoring on the port. Use the access command, in the Asynchronous Command Mode, to do this; for example: Async 4-4:0>>access sensor NOTE: The DIAG port (port 0) cannot be configured as a Sensor port. Displaying the Temperature and Humidity Use the show device status command, in the Superuser Command Mode, to display the current temperature and humidity readings on a Sensor port; for example: InReach:0 >>show device 4 status In the above example, the temperature and humidity readings of the Sensor attached to port 4 are displayed. Use the following syntax to display the temperature and humidity readings for all Temperature/ Humidity Sensors on the LX unit: InReach:0 >>show device all statusConfiguring Ports for Temperature/Humidity Sensors 142 451-0311B Figure 19 shows an example of the Device Status display for a Sensor port. Figure 19 - Device Status Display for a Sensor Port Displaying Sensor Summaries Use the show device summary command, in the Superuser Command Mode, to display summary information for all of the Temperature/Humidity Sensors that are currently connected to the LX unit; for example: InReach:0 >>show device summary Figure 20 shows an example of the Device Summary display. Figure 20 - Device Summary Display for Sensors NOTE: If any of the ports on the LX unit are configured as Power outlets, the Device Summary Display will display information for the attached Power Management Device (IR-5100 or IR-5150). Time: 29 Aug 2002 17:35:17 US/EASTERN Device Number: 4 Device Type: Sensor Humidity Level(%): 39.00 Temperature (Celsius): 26.00 Temperature (Fahrenheit): 78.80 Device Number Device Type Model Name 1 Sensor N/A451-0311B 143 Chapter 9 Configuring Power Control Units The In-Reach Power Control Units (IR-5100 and IR-5150) can be managed remotely from asynchronous ports on an LX unit. The management tasks that can be performed remotely include rebooting Power Control Relays and turning Power Control Relays on and off. (For information on performing these tasks, refer to the outlet command, and the outlet group command in the “Superuser Commands” chapter of the LX-Series Commands Reference Guide.) NOTE: You can access the on-board CLI of an IR-5150 unit that is connected to a console port. To do this, Telnet to its LX console port, and log on to the IR-5150 unit. Power Control units are remotely managed from LX asynchronous ports that are configured as Power Masters. This chapter describes how to configure ports as Power Masters, how to configure Power Control units via Power Masters, and how to display information on Power Control units. Configuring an LX Asynchronous Port as a Power Master Use the access power model command, in the Asynchronous Command Mode, to configure an LX asynchronous port as a Power Master; for example: Async 5-5:0>>access power model ir5100 In the above example, port 5 is configured as a Power Master for an IR-5100 unit. Use the following syntax to configure an asynchronous port as a Power Master for an IR-5150 unit: Async 5-5:0>>access power model ir5150Configuring Power Control Units 144 451-0311B When a port has been configured as a Power Master, you can connect a Power Control unit to it. The connection to the Power Master port is made using the RJ-45 crossover cable that is supplied with the Power Control unit. You must power on the Power Control unit before you can configure it from the LX unit. For more information, refer to the Getting Started guide for the Power Control unit. Default Name for a Power Control Relay The default name for a Power Control Relay is derived from its Alarm Master and the number of the relay on the Power Control unit. For example, 5:7 is the default name of the 7th Power Control Relay on the Power Control Unit that is managed from Alarm Master port 5. You can specify a descriptive name for a Power Control Relay or a Power Control Relay group. A descriptive name is a unique text name of up to 15 alphanumeric characters. For more information, refer to “Naming a Power Control Relay” on page 146 and “Naming a Group of Power Control Relays” on page 147. You must specify the default name, or the descriptive name, of a Power Control Relay, in the outlet group command in the Configuration Command Mode. However, you only need to specify the number, or descriptive name, of the Power Control Relay in the outlet name command in the Asynchronous Command Mode. This is because the LX software “knows” that the Alarm Master is the current asynchronous port. Refer to the LX-Series Commands Reference Guide for more information on the outlet group command and the outlet name command.451-0311B 145 Configuring Power Control Units Configuring Power Control Units Power Control Relays can be assigned to a group and managed and configured as a group. The Off Time for Power Control Relays can be specified using the LX CLI. This section describes how to assign Power Control Relays to a group and how to specify the Off Time for Power Control Relays. Assigning Power Control Relays to a Group When Power Control Relays are assigned to a group, they can be configured and managed as a group. This can be more efficient than configuring and managing Power Control Relays individually. Use the outlet group command to assign Power Control Relays to a group; for example: Config:0 >>outlet group 2 2:5 3:7 4:2 4:3 4:5 In the above example, the Power Control Relays 2:5 3:7 4:2 4:3 4:5 are assigned to Group 2. Specifying the Off Time The Off Time is the length of time, in seconds, that Power Control Relays must remain off before they can be turned back on. This section describes how to specify the Off Time for a Power Control unit or for a group of Power Control Relays. Specifying the Off Time for a Group of Power Control Relays Use the outlet group off time command, in the Configuration Command Mode, to specify the Off Time for a group of Power Control Relays; for example: Config:0 >>outlet group 14 off time 20 In the above example, the Off Time for Outlet Group 14 is set to 20 seconds.Configuring Power Control Units 146 451-0311B Specifying the Off Time for a Power Control Unit Use the power off time command, in the Asynchronous Command Mode, to specify the Off Time for all of the Power Control Relays that are managed from an Alarm Master port; for example: Async 5-5:0>>power off time 15 In the above example, an Off Time of 15 seconds is specified for all of the Power Control Relays that are managed from asynchronous port 5. NOTE: The power off time command can only be executed on a port that is configured as a Master Alarm port and has a Power Control unit attached to it. Naming a Power Control Relay You can assign a descriptive name of up to 15 alphanumeric characters to a Power Control Relay. Use the outlet name command, in the Asynchronous Command Mode, to specify a descriptive name for a Power Control Relay; for example: Async 5-5:0>>outlet 2 name Build5NTserver In the above example, the descriptive name Build5NTserver is assigned to Power Control Relay 2 on the Power Control unit that is managed from Alarm Master port 5. NOTE: The Alarm Master number is not specified in the outlet name command (e.g., 5:2) because the Alarm Master port is implied to be the current port in the Asynchronous Command Mode. In the above example, the implied Alarm Master is port 5. (The CLI is in the Asynchronous Command Mode for port 5.)451-0311B 147 Configuring Power Control Units Naming a Group of Power Control Relays You can assign a descriptive name of up to 15 alphanumeric characters to a group of Power Control Relays. Use the outlet group name command, in the Configuration Command Mode, to specify a descriptive name for a group of Power Control Relays; for example: Config:0 >>outlet group 14 TestEquipment In the above example, the descriptive name TestEquipment is assigned to Power Control Relay Group 14. Displaying Information on Power Control Units This section describes how to display information on Power Control units and Power Control Relays. The information that can be displayed includes statuses and summaries for Power Control units, and statuses for groups of Power Control Relays. Displaying Status Information for Power Control Units Use the show device status command, in the Superuser Command Mode, to display status information for a particular Power Control unit; for example: InReach:0 >>show device 4 status In the above example, the status for the Power Control unit on port 4 is displayed. Use the following syntax to display the status for all of the Power Control units that are managed from the LX unit: InReach:0 >>show device all status NOTE: The show device status command displays the status of all Power Control units and Temperature/Humidity sensors that are connected to the LX unit. Refer to Figure 19 on page 142 for the status display for a Temperature/Humidity Sensor port.Configuring Power Control Units 148 451-0311B Figure 21 shows an example of the Device Status display for an Alarm Master port. Figure 21 - Device Status Display for an Alarm Master Port Displaying Status Information for Groups of Power Control Relays Use the show device status command, in the Superuser Command Mode, to display status information for groups of Power Control Relays; for example: InReach:0 >>show outlet group TestEquipment status In the above example, the status for the group TestEquipment is displayed. Use the following syntax to display the status for all groups of Power Control Relays that are managed from the LX unit: InReach:0 >>show outlet group all status Time: Tue, 17 Sep 2002 20:05:47 Device Number: 4 Device Type: IR5100 Model Name: IR-5100-126 Total Outlet Strip Load: 0.0 Outlet Minimum Off Time: 15 Outlet Name State Load Assigned Groups 1 plug1 Off 0.0 1 4 13 2 plug2 Off 0.0 1 6 10 3 plug3 Off 0.0 1 7 4 plug4 Off 0.0 1 5 plug5 Off 0.0 2 4 6 plug6 Off 0.0 2 7 plug7 Off 0.0 2 8 plug8 Off 0.0 2 9 plug9 Off 0.0 3 4 10 plug10 Off 0.0 3 11 plug11 Off 0.0 3 12 plug12 Off 0.0 3 13 plug13 Off 0.0 4 5 14 plug14 Off 0.0 4 5 15 plug15 Off 0.0 4 5 16 plug16 Off 0.0 5451-0311B 149 Configuring Power Control Units Figure 22 shows an example of the Device Status display for a Power Control Relay Group. Figure 22 - Device Status Display for a Power Control Relay Group Displaying Summary Information for Power Control Units Use the show device summary command, in the Superuser Command Mode, to display summary information for all of the Power Control units that are currently connected to the LX unit; for example: InReach:0 >>show device summary Figure 23 shows an example of the Device Summary display. Figure 23 - Device Summary Display NOTE: The show device summary command displays summary information for all Power Control units and Temperature/Humidity sensors that are connected to the LX unit. Refer to Figure 20 on page 142 for the Summary Display for a Temperature/Humidity Sensor port. Time: Mon, 16 Sep 2002 17:55:19 Group Number: 2 Group Name: TestEquipment Group Off Time: 4 Port Outlet State 2 1 Not configured 2 2 Not configured Device Number Device Type Model Name 4 IR5100 IR-5100-126 5 IR5100 IR-5100-255451-0311B 151 Chapter 10 Configuring Packet Filters with the iptables Command Packet Filters are used to allow certain IP packets to pass, or not pass, through an LX unit. Packet Filters can be applied to IP packets that originate from the LAN side of the LX, or from the LX unit itself. On the LX unit (as on all Linux-based systems), Packet Filters are known as chains. The INPUT chain filters packets coming from the LAN to the LX; the OUTPUT chain filters packets from the LX destined for the LAN. NOTE: The LX unit also supports the FORWARD chain, which filters packets that are to be forwarded to another network. The FORWARD chain is used primarily in routing environments rather than in console management environments. For this reason, the FORWARD chain is not covered in this chapter. A chain consists of a series of rules that specify the criteria for accepting, denying, or dropping a packet. The criteria for accepting, denying, or dropping a packet can include the source IP Address, the destination IP Address, and other characteristics. Adding a Rule to a Chain Use the iptables command to add a rule to a chain. The iptables command is executed in Linux shell. To access the Linux shell, execute the shell command in the Superuser Command Mode; for example: InReach:0 >>shell When you are in the Linux shell, you can display the chains for the LX unit by executing the iptables command with the -L option; for example: In-Reach:/# iptables -LConfiguring Packet Filters with the iptables Command 152 451-0311B The following sections provide examples of how to create rules using various options of the iptables command. For detailed information on the iptables command, refer to Appendix D (“Details of the iptables Command”) on page 151. Example: Dropping Packets Based on the Source IP Address The following iptables command creates a rule that will drop any packets coming to the LX from source address 10.240.10.240: In-Reach:/# iptables -A INPUT -s 10.240.10.240 -j DROP The options in the above command are the following: -A Specifies that the rule is to be appended to the specified chain (in this case, the INPUT chain). Refer to “Notes on the iptables Command Options” on page 154 for alternatives to the -A option. -s Specifies that the rule applies to the specified source IP Address (in this case, 10.240.10.240). -j Specifies the action that is to be taken when a packet matching this criteria is received. In this case, the packet is to be dropped. Refer to “Notes on the iptables Command Options” on page 154 for a description of all of the allowable values (i.e., ACCEPT, DENY, or DROP) of the -j option.451-0311B 153 Configuring Packet Filters with the iptables Command Example: Accepting Packets Based on the Destination IP Address The following iptables command creates a rule that will allow the LX unit to output packets to the destination IP address 123.146.17.129: In-Reach:/# iptables -A OUTPUT -d 123.146.17.129 -j ACCEPT The options in the above command are the following: Example: Ignoring Telnet Requests from a Specific IP Address The following iptables command creates a rule that ignores Telnet requests from the IP address 143.114.56.104: In-Reach:/# iptables -A INPUT -s 143.114.56.104 -p tcp --destination-port telnet -j DROP The options in the above command are the following: -A Specifies that the rule is to be appended to the specified chain (in this case, the OUTPUT chain). Refer to “Notes on the iptables Command Options” on page 154 for alternatives to the -A option. -d Specifies that the rule applies to the specified destination IP Address (in this case, 123.146.17.129). -j Specifies the action that is to be taken when a packet matching this criteria is received. In this case, the packet is to be accepted. Refer to “Notes on the iptables Command Options” on page 154 for a description of all of the allowable values (i.e., ACCEPT, DENY, or DROP) of the -j option. -A Specifies that the rule is to be appended to the specified chain (in this case, the INPUT chain). Refer to “Notes on the iptables Command Options” on page 154 for alternatives to the -A option.Configuring Packet Filters with the iptables Command 154 451-0311B Notes on the iptables Command Options • Alternatives to the -A Option – You can use the -I option or the -R option, instead of the -A option, to specify how the rule will be added to the chain. The -I option specifies that the rule will be inserted at a specified location before the end of the chain. The -R option specifies that the rule will replace a specific rule in the chain. In the following example, the -I option specifies that the rule is to be inserted as the 11th rule in the INPUT chain: iptables -I INPUT 11 -s 10.240.10.240 -j DROP The rules that follow the new rule will be bumped up by 1. In the following example, the -R option specifies that the rule is to replace the 8th rule in the OUTPUT chain: iptables -R OUTPUT 8 -s 89.247.112.93 -j DROP -s Specifies that the rule applies to the specified destination IP Address (in this case, 143.114.56.104). -p Specifies that the rule applies to a particular protocol (in this case, TCP). Refer to “Notes on the iptables Command Options” on page 154 for a description of the allowable values of the -p option. --destination-port Specifies the TCP destination port to which the rule applies. (In this case, the destination port is the Telnet port.) -j Specifies the action that is to be taken when a packet matching this criteria is received. In this case, the packet is to be dropped. Refer to “Notes on the iptables Command Options” on page 154 for a description of all of the allowable values (i.e., ACCEPT, DENY, or DROP) of the -j option.451-0311B 155 Configuring Packet Filters with the iptables Command • Allowable Values of the -j Option – You can specify the following values for the -j option: ACCEPT – The packet is allowed to pass through the specified chain (i.e., INPUT or OUTPUT). DENY – The packet is not allowed to pass through the specified chain (i.e., INPUT or OUTPUT). A message indicating that the LX is not accepting connections is sent back to the source IP Address. DROP – The packet is not allowed to pass through the specified chain (i.e., INPUT or OUTPUT). A message is not sent back to the source IP Address. • Allowable Values of the -p Option – You can specify TCP, UDP, or ICMP as the value of the -p option. Saving Changes in Rules The configuration is kept in the file /config/iptables.conf. This file is generated by the utility iptables-save upon reading the filter tables located in the Kernel. The configuration is dynamically applied when an iptables command is entered. The command iptables-save creates the new configuration file in /config/iptables.conf. To make this configuration persistent through the reboot, it is necessary to save the configuration to the flash or the network from the Superuser command line. Do the following to save the iptables configuration: 1. Execute the shell command, in the Superuser Command Mode, to access the Linux shell; for example: InReach:0 >>shell 2. Verify the Iptables configuration with the iptables -L command; for example: In-Reach:/# iptables -LConfiguring Packet Filters with the iptables Command 156 451-0311B 3. Save the Iptables changes to the /config/iptables.conf file; for example: In-Reach:/# iptables-save -f /config/iptables.conf 4. Execute the exit command to return to the Superuser Command Mode; for example: In-Reach:/# exit 5. Execute the save configuration command, in the Superuser Command Mode, to save the iptables.conf file to flash or the network; for example: InReach:0 >>save configuration flash NOTE: You can use the network option of the save configuration command to save the configuration to a network server. For more information, refer to the save configuration command in the LX-Series Commands Reference Guide.451-0311B 157 Appendix A Overview of RADIUS Authentication RADIUS authentication occurs through a series of communications between the LX unit and the RADIUS server. Once RADIUS has authenticated a user, the LX unit provides that user with access to the appropriate network services. The RADIUS server maintains a database that contains user authentication and network service access information. The following example describes the steps in the RADIUS authentication process. In this example, the user attempts to gain access to an LX asynchronous port. 1. The LX unit prompts the user for a username and password. 2. The LX unit takes the username and password and creates an accessrequest packet identifying the LX unit making the request, the username and password, and the port being used. The LX unit then sends the access-request packet to the designated RADIUS server for authentication. NOTE: The user password is encrypted to prevent it from being intercepted and reused by an unwanted user. This is done by generating a random vector and placing it in the request header. A copy of the random vector is MD5 encoded using the configured secret. The user’s password is then encrypted by XORing it with the encoded copy of the random vector. 3. The RADIUS server validates the request and then decrypts the password. 4. The username and password are authenticated by the RADIUS server.Overview of RADIUS Authentication 158 451-0311B 5. Upon successful authentication, the RADIUS server sends an accessaccept packet containing any specific configuration information associated with that user. 6. The LX unit then grants the user the services requested. If at any point in the authentication process conditions are not met, the RADIUS server sends an authentication rejection to the LX unit and the user is denied access to the network. Figure 24 shows an example of the RADIUS authentication process. Figure 24 - RADIUS Authentication Process Radius Server Host - authenticates the user. User attempts to gain access. LX unit sends access-request packet for authentication. Access to desired services is granted. Access-accept returned to LX unit.451-0311B 159 Overview of RADIUS Authentication The LX implementation of RADIUS supports the use of RADIUS secondary servers. The RADIUS secondary server is used when the RADIUS primary server cannot be accessed. RADIUS Authentication Attributes Table 9 lists the RADIUS Authentication Attributes that are supported on the LX unit. NOTE: Some attributes appear in start records, but the majority of attributes appear in stop records (a few also appear in acct-on and acct-off records). RADIUS allows most authentication and configuration attributes to be logged. Table 9 - Supported RADIUS Authentication Attributes Attribute Name Description 01 User-Name Name of the user to authenticate. 02 User-Password The password for the user to authenticate. 03 CHAP-Password Indicates the CHAP challenge value found in the CHAP-Challenge attribute. 06 Service-Type Type of service allowed for the connection. The supported types are the following: NAS-Prompt Allows local port access for interactive sessions. The user is prohibited from accessing the Superuser Command Mode. This is true for local port access, Interface virtual port access and access using the GUI. Authenticate-Only Allows local port access for interactive sessions, user is prohibited from accessing the Superuser Command Mode. This Service Type is allowed for local port access, Interface virtual port access and access using the GUI. In each case, the user is prohibited from Superuser access. No-Service-Type Allows local port access for interactive sessions, user is prohibited from accessing the Superuser Command Mode.Overview of RADIUS Authentication 160 451-0311B Administrative-User Allows local port access for interactive sessions. The user is allowed access to Superuser and Configuration Command Modes. This is true for local port access, Interface virtual port access and access using the GUI. Framed Allows local port access for a Dial-in PPP user. Outbound-User Allows only remote port access. If the asynchronous remote-accessed port is configured for outbound RADIUS authentication, the LX requires the user's service-type to be Outbound-User; otherwise the user’s access is rejected. NOTE: All remote access ports on the LX require a Service Type of Outbound-User. 07 Framed-Protocol Used with a framed service type. Indicates the type of framed access (e.g., PPP). 08 Framed-IP-Address The address to be configured for the user. 09 Framed-IP-Netmask The IP Netmask to be configured for the user when the user is a router to the network. 13 Framed-Compression The compression protocol for the circuit. 24 State (challenge/response) Sent by the server to the client in an Access-Challenge, and must be sent unmodified from the client to the server in any Access-Request reply. 60 CHAP-Challenge451-0311B 161 Appendix B Overview of RADIUS and TACACS+ Accounting RADIUS Accounting, and TACACS+ Accounting, are client/server account logging schemes that allow you to log user account information to a remote server in a per-client file. The file or record can contain information such as the user who logged in, the duration of the session, port number, Client IP address, and the number of bytes/packets that were processed by the LX unit. The use of RADIUS Accounting, or TACACS+ Accounting, solves the problems associated with local storage of large numbers of records. It also provides a method for billing customers for account usage. NOTE: RADIUS Accounting is a developing standard that is vendor extensible by design, including a provision for vendor-specific extensions. This allows for greater expandability of accounting information in the future. The following section describes RADIUS Accounting. Refer to “TACACS+ Accounting Client Operation” on page 163 for information about TACACS+ Accounting. RADIUS Accounting Client Operation If a user is validated under RADIUS, an accounting request (a start request) is sent to the RADIUS accounting server. As a result of the start request, a start record containing the following is created for each user session: • User-name • NAS-Identifier • NAS-IP-Address • NAS-PortOverview of RADIUS and TACACS+ Accounting 162 451-0311B • NAS-Port-Type • Acct-Status-Type • Acct-Session-ID • Acct-Input-Octets • Acct-Output-Octets • Acct-Input-Packets (PPP) • Acct-Output-Packets (PPP) The majority of the accounting record information appears in the stop record. The stop record is created when the port is logged out, provided that a matching start record was previously sent. The information in the stop record includes everything in the start record, and additional information, such as session time and bytes/packets transferred. There are two special records that are logged for RADIUS Accounting. • Accounting-on – This record is logged when the LX unit is first booted. • Accounting-off – This record is logged, if possible, when the LX unit is shut down. These records only contain the NAS-IP-Address. Since these accounting requests only relate to the LX unit using the protocol and not to accounting on a specific port, they are only attempted if the RADIUS protocol is enabled. RADIUS Accounting Attributes Table 10 lists the RADIUS Accounting Attributes that are supported on the LX unit. Table 10 - Supported RADIUS Accounting Attributes Attribute Name Description 01 User-Name Name of the user to authenticate. 04 NAS-IP-Address IP address associated with the LX unit.451-0311B 163 Overview of RADIUS and TACACS+ Accounting TACACS+ Accounting Client Operation If a user is validated under TACACS+, an accounting request (a start request) is sent to the TACACS+ accounting server. As a result of the start request, a start record containing the following is created for each user session: • Start-time • Bytes • Bytes-in • Bytes-out • Paks (for PPP connections) • Paks-in (for PPP connections) • Paks-out (for PPP connections) 05 NAS-Port Port or circuit number associated with the request. 32 NAS-Identifier The ID that identifies the LX unit to the RADIUS server. 40 Acct-Status-Type Indicates whether the session has started or stopped. The valid values are: 1 - Start 2 - Stop 42 Acct-Input-Octets A count of the input octets for the session. 43 Acct-Output-Octets A count of the output octets for the session. 44 Acct-Session-ID Session Identifier for the user login. 47 Acct-Input-Packets A count of the input packets for a PPP session. 48 Acct-Output-Packets A count of the output packets for a PPP session. 61 NAS-Port-Type The type of port being used. The valid values are: 0 - AsynchronousOverview of RADIUS and TACACS+ Accounting 164 451-0311B Depending on the Accounting Period Interval, an accounting update request will be sent which will contain the same fields with the newer information. The majority of the accounting record information appears in the stop record. The stop record is created when the port is logged out, provided that a matching start record was previously sent. The information in the stop record includes everything in the start record, and the following: • Stop-time • Elapsed-time TACACS+ Accounting Attributes Table 11 lists the TACACS+ Accounting Attributes that are supported on the LX unit. Table 11 - Supported TACACS+ Accounting Attributes Attribute Name Description Service Either "ppp" for PPP connection, otherwise equals "shell" Protocol Equals "ip" in PPP connections only Task_id Each set of start, update, and stop entries should have unique IDs. Start_time Time (in seconds since epoch) that the accounting started Stop_time Time (in seconds since epoch) that the accounting stopped Elapsed_time The number of seconds the user was logged on for Bytes The total number of bytes transferred Bytes_in The number of bytes received Bytes_out The number of bytes transmitted451-0311B 165 Overview of RADIUS and TACACS+ Accounting Paks The total number of packets transferred (for PPP connections) Paks_in The number of packets received (for PPP connections) Paks_out The number of packets transmitted (for PPP connections)451-0311B 167 Appendix C Overview of TACACS+ Authentication TACACS+ authentication occurs through a series of communications between the LX unit and the TACACS+ server. Once TACACS+ has authenticated a user, the LX unit provides that user with access to the appropriate network services. The TACACS+ server maintains a database that contains user authentication and network service access information. TACACS+ uses the Transport Control Protocol (TCP) on port 49 to ensure reliable transfer. The entire body of the packet is encrypted using a series of 16 byte MD5 hashes. The protocol is split up into 3 distinct categories: Authentication, Authorization, and Accounting. Authentication is the process of determining who the user is. Usually a user is required to enter in a user name and password to be granted access. Authorization is the process of determining what the user is able to do. The profile in the TACACS+ server should have a service of exec and a priv-lvl of 15 in order to access Superuser privileges, otherwise the user will only be able to be in user mode. Accounting records what the user has done and generally occurs after authentication and authorization. The TACACS+ superuser request attribute is independent from the TACACS+ login. The TACACS+ superuser request attribute is used to indicate which database to authenticate the superuser password against after a user is logged in. When a user types the enable command, and the TACACS+ superuser request is enabled, the enable password will be authenticated against the TACACS+ server database; otherwise it is checked against the LX database "system".Overview of TACACS+ Authentication 168 451-0311B Example of TACACS+ Authentication The following example describes the steps in the TACACS+ authentication process. In this example, the user attempts to gain access to an LX asynchronous port. 1. The LX unit prompts the user for a username and password. 2. The username is sent to the TACACS+ authentication start packet. 3. The server responds with an authentication reply packet, which will either allow the user access or require a password. 4. If a password is required, the user is prompted for one and the LX sends it to the server in an authentication continue packet. 5. The server responds with a packet that contains an authentication status pass or an authentication status fail. 6. If the request is successful, the user will be allowed to log in; otherwise the user will have two more chances to receive an authentication status pass back from the server. 7. The LX unit then grants the user the services requested. TACACS+ Authentication Attributes Table 12 lists the TACACS+ Authentication Attributes that are supported on the LX unit. Table 12 - Supported TACACS+ Authentication Attributes Attribute Name Description 01 User-Name Name of the user to authenticate. 02 User-Password The password for the user to authenticate. 451-0311B 169 Overview of TACACS+ Authentication If at any point in the authentication process conditions are not met, the TACACS+ server denies access to the network. Figure 25 shows an example of the TACACS+ authentication process. Figure 25 - TACACS+ Authentication Process The LX implementation of TACACS+ supports the use of TACACS+ secondary servers. The TACACS+ secondary server is used when the TACACS+ primary server cannot be accessed. TACACS+ Server - authenticates the user. User attempts to gain access. LX unit initiates the authentication process. Access to desired services is granted. Authentication server authenticates the user.451-0311B 171 Appendix D Details of the iptables Command This appendix contains the Linux man pages for the iptables command. Refer to the man pages in this appendix for detailed information on the iptables command, which is introduced in “Configuring Packet Filters with the iptables Command” on page 151. iptables man Pages IPTABLES(8) IPTABLES(8) NAME iptables - IP packet filter administration SYNOPSIS iptables -[ADC] chain rule-specification [options] iptables -[RI] chain rulenum rule-specification [options] iptables -D chain rulenum [options] iptables -[LFZ] [chain] [options] iptables -[NX] chain iptables -P chain target [options] iptables -E old-chain-name new-chain-name DESCRIPTION Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table con tains a number of built-in chains and may also contain user-defined chains. Each chain is a list of rules which can match a set of packets. Each rule specifies what to do with a packetDetails of the iptables Command 172 451-0311B that matches. This is called a `target', which may be a jump to a user-defined chain in the same table. TARGETS A firewall rule specifies criteria for a packet, and a target. If the packet does not match, the next rule in the chain is the examined; if it does match, then the next rule is specified by the value of the target, which can be the name of a user-defined chain or one of the special values ACCEPT, DROP, QUEUE, or RETURN. ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to userspace (if supported by the kernel). RETURN means stop traversing this chain and resume at the next rule in the previous (calling) chain. If the end of a built-in chain is reached or a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet. TABLES There are current three independent tables (which tables are present at any time depends on the kernel configura tion options and which modules are present). -t, --table This option specifies the packet matching table which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there. The tables are as follows: filter This is the default table. It contains the built-in chains INPUT (for packets coming into the box itself), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets). nat This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering packets451-0311B 173 Details of the iptables Command as soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). mangle This table is used for special ized packet alteration. It has two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally- generated packets before routing). OPTIONS The options that are recognized by iptables can be divided into several different groups. COMMANDS These options specify the specific action to perform. Only one of them can be specified on the command line unless otherwise specified below. For all the long ver sions of the command and option names, you need to use only enough letters to ensure that iptables can differen tiate it from all other options. -A, --append Append one or more rules to the end of the selected chain. When the source and/or destination names resolve to more than one address, a rule will be added for each possible address combination. -D, --delete Delete one or more rules from the selected chain. There are two versions of this command: the rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match. -R, --replace Replace a rule in the selected chain. If the source and/or destination names resolve to multiple addresses, the command will fail. Rules are num bered starting at 1.Details of the iptables Command 174 451-0311B -I, --insert Insert one or more rules in the selected chain as the given rule number. So, if the rule number is 1, the rule or rules are inserted at the head of the chain. This is also the default if no rule number is specified. -L, --list List all rules in the selected chain. If no chain is selected, all chains are listed. It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atomically listed and zeroed. The exact output is affected by the other arguments given. -F, --flush Flush the selected chain. This is equivalent to deleting all the rules one by one. -Z, --zero Zero the packet and byte counters in all chains. It is legal to specify the -L, --list (list) option as well, to see the counters immediately before they are cleared. (See above.) -N, --new-chain Create a new user-defined chain by the given name. There must be no target of that name already. -X, --delete-chain Delete the specified user-defined chain. There must be no references to the chain. If there are, you must delete or replace the referring rules before the chain can be deleted. If no argument is given, it will attempt to delete every non-builtin chain in the table. -P, --policy Set the policy for the chain to the given target. See the section TARGETS for the legal targets.451-0311B 175 Details of the iptables Command Only non-user-defined chains can have policies, and neither built-in nor user-defined chains can be policy targets. -E, --rename-chain Rename the user specified chain to the user sup plied name. This is cosmetic, and has no effect on the structure of the table. -h Help. Give a (currently very brief) description of the command syntax. PARAMETERS The following parameters make up a rule specification (as used in the add, delete, insert, replace and append com mands). -p, --protocol [!] protocol The protocol of the rule or of the packet to check. The specified protocol can be one of tcp, udp, icmp, or all, or it can be a numeric value, repre senting one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A "!" argument before the protocol inverts the test. The number zero is equivalent to all. Protocol all will match with all protocols and is taken as default when this option is omit ted. -s, --source [!] address[/mask] Source specification. Address can be either a hostname, a network name, or a plain IP address. The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag --src is a convenient alias for this option.Details of the iptables Command 176 451-0311B -d, --destination [!] address[/mask] Destination specification. See the description of the -s (source) flag for a detailed description of the syntax. The flag --dst is an alias for this option. -j, --jump target This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule, then matching the rule will have no effect on the packet's fate, but the coun ters on the rule will be incremented. -i, --in-interface [!] [name] Optional name of an interface via which a packet is received (for packets entering the INPUT, FORWARD and PREROUTING chains). When the "!" argument is used before the interface name, the sense is inverted. If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, the string "+" is assumed, which will match with any interface name. -o, --out-interface [!] [name] Optional name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the "!" argu ment is used before the interface name, the sense is inverted. If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, the string "+" is assumed, which will match with any interface name. [!] -f, --fragment451-0311B 177 Details of the iptables Command This means that the rule only refers to second and further fragments of fragmented packets. Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them. When the "!" argument precedes the "-f" flag, the rule will only match head fragments, or unfrag mented packets. -c, --set-counters PKTS BYTES This enables the administrater to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations) OTHER OPTIONS The following additional options can be specified: -v, --verbose Verbose output. This option makes the list command show the interface address, the rule options (if any), and the TOS masks. The packet and byte coun ters are also listed, with the suffix 'K', 'M' or 'G' for 1000, 1,000,000 and 1,000,000,000 multipli ers respectively (but see the -x flag to change this). For appending, insertion, deletion and replacement, this causes detailed information on the rule or rules to be printed. -n, --numeric Numeric output. IP addresses and port numbers will be printed in numeric format. By default, the pro gram will try to display them as host names, net work names, or services (whenever applicable). -x, --exact Expand numbers. Display the exact value of the packet and byte counters, instead of only the rounded number in K's (multiples of 1000) M's (mul tiples of 1000K) or G's (multiples of 1000M). This option is only relevant for the -L command.Details of the iptables Command 178 451-0311B --line-numbers When listing rules, add line numbers to the begin ning of each rule, corresponding to that rule's position in the chain. --modprobe= When adding or inserting rules into a chain, use command to load any necessary modules (targets, match extensions, etc). MATCH EXTENSIONS iptables can use extended packet matching modules. These are loaded in two ways: implicitly, when -p or --protocol is specified, or with the -m or --match options, followed by the matching module name; after these, various extra command line options become available, depending on the specific module. You can specify multiple extended match modules in one line, and you can use the -h or --help options after the module has been specified to receive help specific to that module. The following are included in the base package, and most of these can be preceded by a ! to invert the sense of the match. tcp These extensions are loaded if `--protocol tcp' is speci fied. It provides the following options: --source-port [!] [port[:port]] Source port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format port:port. If the first port is omitted, "0" is assumed; if the last is omitted, "65535" is assumed. If the second port greater then the first they will be swapped. The flag --sport is an alias for this option.451-0311B 179 Details of the iptables Command --destination-port [!] [port[:port]] Destination port or port range specification. The flag --dport is an alias for this option. --tcp-flags [!] mask comp Match when the TCP flags are as specified. The first argument is the flags which we should exam ine, written as a comma-separated list, and the second argument is a comma-separated list of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the command iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset. [!] --syn Only match TCP packets with the SYN bit set and the ACK and FIN bits cleared. Such packets are used to request TCP connection initiation; for example, blocking such packets coming in an interface will prevent incoming TCP connections, but outgoing TCP connections will be unaffected. It is equivalent to --tcp-flags SYN,RST,ACK SYN. If the "!" flag precedes the "--syn", the sense of the option is inverted. --tcp-option [!] number Match if TCP option set. udp These extensions are loaded if `--protocol udp' is speci fied. It provides the following options: --source-port [!] [port[:port]] Source port or port range specification. See the description of the --source-port option of the TCP extension for details.Details of the iptables Command 180 451-0311B --destination-port [!] [port[:port]] Destination port or port range specification. See the description of the --destination-port option of the TCP extension for details. icmp This extension is loaded if `--protocol icmp' is speci fied. It provides the following option: --icmp-type [!] typename This allows specification of the ICMP type, which can be a numeric ICMP type, or one of the ICMP type names shown by the command iptables -p icmp -h mac --mac-source [!] address Match source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets entering the PREROUTING, FORWARD or INPUT chains for packets coming from an ethernet device. limit This module matches at a limited rate using a token bucket filter: it can be used in combination with the LOG target to give limited logging. A rule using this extension will match until this limit is reached (unless the `!' flag is used). --limit rate Maximum average matching rate: specified as a num ber, with an optional `/second', `/minute', `/hour', or `/day' suffix; the default is 3/hour. --limit-burst number The maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5.451-0311B 181 Details of the iptables Command multiport This module matches a set of source or destination ports. Up to 15 ports can be specified. It can only be used in conjunction with -p tcp or -p udp. --source-port [port[,port]] Match if the source port is one of the given ports. --destination-port [port[,port]] Match if the destination port is one of the given ports. --port [port[,port]] Match if the both the source and destination ports are equal to each other and to one of the given ports. mark This module matches the netfilter mark field associated with a packet (which can be set using the MARK target below). --mark value[/mask] Matches packets with the given unsigned mark value (if a mask is specified, this is logically ANDed with the mark before the comparison). owner This module attempts to match various characteristics of the packet creator, for locally-generated packets. It is only valid in the OUTPUT chain, and even this some packets (such as ICMP ping responses) may have no owner, and hence never match. --uid-owner userid Matches if the packet was created by a process with the given effective user id. --gid-owner groupid Matches if the packet was created by a process withDetails of the iptables Command 182 451-0311B the given effective group id. --pid-owner processid Matches if the packet was created by a process with the given process id. --sid-owner sessionid Matches if the packet was created by a process in the given session group. state This module, when combined with connection tracking, allows access to the connection tracking state for this packet. --state state Where state is a comma separated list of the con nection states to match. Possible states are INVALID meaning that the packet is associated with no known connection, ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions, NEW meaning that the packet has started a new connection, or other wise associated with a connection which has not seen packets in both directions, and RELATED mean ing that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error. unclean This module takes no options, but attempts to match pack ets which seem malformed or unusual. This is regarded as experimental. tos This module matches the 8 bits of Type of Service field in the IP header (ie. including the precedence bits). --tos tos The argument is either a standard name, (use451-0311B 183 Details of the iptables Command iptables -m tos -h to see the list), or a numeric value to match. TARGET EXTENSIONS iptables can use extended target modules: the following are included in the standard distribution. LOG Turn on kernel logging of matching packets. When this option is set for a rule, the Linux kernel will print some information on all matching packets (like most IP header fields) via the kernel log (where it can be read with dmesg or syslogd(8)). --log-level level Level of logging (numeric or see syslog.conf(5)). --log-prefix prefix Prefix log messages with the specified prefix; up to 29 letters long, and useful for distinguishing messages in the logs. --log-tcp-sequence Log TCP sequence numbers. This is a security risk if the log is readable by users. --log-tcp-options Log options from the TCP packet header. --log-ip-options Log options from the IP packet header. MARK This is used to set the netfilter mark value associated with the packet. It is only valid in the mangle table. --set-mark markDetails of the iptables Command 184 451-0311B REJECT This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to DROP. This target is only valid in the INPUT, FORWARD and OUTPUT chains, and user-defined chains which are only called from those chains. Several options control the nature of the error packet returned: --reject-with type The type given can be icmp-net-unreachable, icmp- host-unreachable, icmp-port-unreachable, icmp- proto-unreachable, icmp-net-prohibitedor icmp-host- prohibited, which return the appropriate ICMP error message (port-unreachable is the default). The option echo-reply is also allowed; it can only be used for rules which specify an ICMP ping packet, and generates a ping reply. Finally, the option tcp-reset can be used on rules which only match the TCP protocol: this causes a TCP RST packet to be sent back. This is mainly useful for blocking ident probes which frequently occur when sending mail to broken mail hosts (which won't accept your mail otherwise). TOS This is used to set the 8-bit Type of Service field in the IP header. It is only valid in the mangle table. --set-tos tos You can use a numeric TOS values, or use iptables -j TOS -h to see the list of valid TOS names. MIRROR This is an experimental demonstration target which inverts the source and destination fields in the IP header and retransmits the packet. It is only valid in the INPUT, FORWARD and PREROUTING chains, and user-defined chains which are only called from those chains. Note that the outgoing packets are NOT seen by any packet filtering451-0311B 185 Details of the iptables Command chains, connection tracking or NAT, to avoid loops and other problems. SNAT This target is only valid in the nat table, in the POSTROUTING chain. It specifies that the source address of the packet should be modified (and all future packets in this connection will also be mangled), and rules should cease being examined. It takes one option: --to-source [-][:port-port] which can specify a single new source IP address, an inclusive range of IP addresses, and optionally, a port range (which is only valid if the rule also specifies -p tcp or -p udp). If no port range is specified, then source ports below 512 will be mapped to other ports below 512: those between 512 and 1023 inclusive will be mapped to ports below 1024, and other ports will be mapped to 1024 or above. Where possible, no port alteration will occur. DNAT This target is only valid in the nat table, in the PRE ROUTING and OUTPUT chains, and user-defined chains which are only called from those chains. It specifies that the destination address of the packet should be modified (and all future packets in this connection will also be man gled), and rules should cease being examined. It takes one option: --to-destination [-][:port-port] which can specify a single new destination IP address, an inclusive range of IP addresses, and optionally, a port range (which is only valid if the rule also specifies -p tcp or -p udp). If no port range is specified, then the destination port will never be modified.Details of the iptables Command 186 451-0311B MASQUERADE This target is only valid in the nat table, in the POSTROUTING chain. It should only be used with dynami cally assigned IP (dialup) connections: if you have a static IP address, you should use the SNAT target. Mas querading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down. This is the correct behavior when the next dialup is unlikely to have the same interface address (and hence any established connections are lost anyway). It takes one option: --to-ports [-] This specifies a range of source ports to use, overriding the default SNAT source port-selection heuristics (see above). This is only valid with if the rule also specifies -p tcp or -p udp). REDIRECT This target is only valid in the nat table, in the PRE ROUTING and OUTPUT chains, and user-defined chains which are only called from those chains. It alters the destina tion IP address to send the packet to the machine itself (locally-generated packets are mapped to the 127.0.0.1 address). It takes one option: --to-ports [-] This specifies a destination port or range or ports to use: without this, the destination port is never altered. This is only valid with if the rule also specifies -p tcp or -p udp). EXTRA EXTENSIONS The following extensions are not included by default in the standard distribution. ttl This module matches the time to live field in the IP header.451-0311B 187 Details of the iptables Command --ttl ttl Matches the given TTL value. TTL This target is used to modify the time to live field in the IP header. It is only valid in the mangle table. --ttl-set ttl Set the TTL to the given value. --ttl-dec ttl Decrement the TTL by the given value. --ttl-inc ttl Increment the TTL by the given value. ULOG This target provides userspace logging of matching pack ets. When this target is set for a rule, the Linux kernel will multicast this packet through a netlink socket. One or more userspace processes may then subscribe to various multicast groups and receive the packets. --ulog-nlgroup This specifies the netlink group (1-32) to which the packet is sent. Default value is 1. --ulog-prefix Prefix log messages with the specified prefix; up to 32 characters long, and useful fro distinguish ing messages in the logs. --ulog-cprange Number of bytes to be copied to userspace. A value of 0 always copies the entire packet, regardless of its size. Default is 0 --ulog-qthreshold Number of packet to queue inside kernel. Setting this value to, e.g. 10 accumulates ten packetsDetails of the iptables Command 188 451-0311B inside the kernel and transmits them as one netlink multpart message to userspace. Default is 1 (for backwards compatibility) DIAGNOSTICS Various error messages are printed to standard error. The exit code is 0 for correct functioning. Errors which appear to be caused by invalid or abused command line parameters cause an exit code of 2, and other errors cause an exit code of 1. BUGS Check is not implemented (yet). COMPATIBILITY WITH IPCHAINS This iptables is very similar to ipchains by Rusty Rus sell. The main difference is that the chains INPUT and OUTPUT are only traversed for packets coming into the local host and originating from the local host respec tively. Hence every packet only passes through one of the three chains; previously a forwarded packet would pass through all three. The other main difference is that -i refers to the input interface; -o refers to the output interface, and both are available for packets entering the FORWARD chain. iptables is a pure packet filter when using the default `filter' table, with optional extension modules. This its size. Default is 0 --ulog-qthreshold Number of packet to queue inside kernel. Setting this value to, e.g. 10 accumulates ten packets inside the kernel and transmits them as one netlink multpart message to userspace. Default is 1 (for backwards compatibility)451-0311B 189 Details of the iptables Command DIAGNOSTICS Various error messages are printed to standard error. The exit code is 0 for correct functioning. Errors which appear to be caused by invalid or abused command line parameters cause an exit code of 2, and other errors cause an exit code of 1. BUGS Check is not implemented (yet). COMPATIBILITY WITH IPCHAINS This iptables is very similar to ipchains by Rusty Rus sell. The main difference is that the chains INPUT and OUTPUT are only traversed for packets coming into the local host and originating from the local host respec tively. Hence every packet only passes through one of the three chains; previously a forwarded packet would pass through all three. The other main difference is that -i refers to the input interface; -o refers to the output interface, and both are available for packets entering the FORWARD chain. iptables is a pure packet filter when using the default `filter' table, with optional extension modules. This should simplify much of the previous confusion over the combination of IP masquerading and packet filtering seen previously. So the following options are handled differ ently: -j MASQ -M -S -M -L There are several other changes in iptables. SEE ALSO The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking- HOWTO which details the internals.Details of the iptables Command 190 451-0311B AUTHORS Rusty Russell wrote iptables, in early consultation with Michael Neuling. Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet selection framework in iptables, then wrote the mangle table, the owner match, the mark stuff, and ran around doing cool stuff everywhere. James Morris wrote the TOS target, and tos match. Jozsef Kadlecsik wrote the REJECT target. Harald Welte wrote the ULOG target, TTL match+target and libipulog. The Netfilter Core Team is: Marc Boucher, James Morris, Harald Welte and Rusty Russell. Appendix 3 IPTABLES-SAVE(8) IPTABLES-SAVE(8) NAME iptables-save - Save IP Tables SYNOPSIS iptables-save [-c] [-t table] DESCRIPTION iptables-save is used to dump the contents of an IP Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file. -c, --counters include the current values of all packet and byte counters in the output451-0311B 191 Details of the iptables Command -t, --table tablename restrict output to only one table. If not specified, output includes all available tables. BUGS None known as of iptables-1.2.1 release AUTHOR Harald Welte SEE ALSO iptables-restore(8), iptables(8) The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking- HOWTO which details the internals. Appendix 4 IPTABLES-RESTORE(8) IPTABLES-RESTORE(8) NAME iptables-restore - Restore IP Tables SYNOPSIS iptables-restore [-c] [-n] DESCRIPTION iptables-restore is used to restore IP Tables from data specified on STDIN. Use I/O redirection provided by your shell to read from a file -c, --counters restore the values of all packet and byte counters -n, --noflush don't flush the previous contents of the table. If not specified, iptables-restore flushes (deletes) all previous contents of the respective IP Table.Details of the iptables Command 192 451-0311B BUGS None known as of iptables-1.2.1 release AUTHOR Harald Welte SEE ALSO iptables-restore(8), iptables(8) The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking- HOWTO which details the internals.451-0311B 193 INDEX Symbols . See IP interfaces A Asynchronous command mode, accessing 19 autocompletion 15 B backup 61 Broadcast Group command mode, accessing 23 Broadcast Groups 97 characteristics, displaying 101 summaries, displaying 103 Broadcast Groups. See Also Data Broadcast feature C cables crossover 49 straight-through 49 CLI defaulting from 76 navigating 16 Command Line Interface. See CLI. command syntax 14 configuration saving to flash 62 saving to the network 62 stored in 61 Configuration command mode, accessing 18 configuration file saving 61 creating a default configuration file 29, 65 D Data Broadcast feature 97 broadcast groups 97 broadcast groups, setting up 97 discard parameter 100 master ports 97 master ports. See master ports slave ports 97 slave ports. See slave ports timestamp parameter 99 default configuration file creating 29, 65 loading 30, 65 saving to the network 30 defaulting from CLI 76 defaults booting from 76 defaults, resetting to 47 disabling features and settings 24 E Editing the Files in Windows 63 Editing the Files on a Unix Host 62 Ethernet command mode, accessing 21 external units scripting on 66 F function keys, using in the CLI 14 H Help. See Online help. I Interface command mode, accessing 22 IP configuration acquiring 77 IP Configuration menu changing the gateway address 75 changing the network mask 75 changing the TFTP server IP address 75 changing the unit IP address 74 choosing an IP assignment method 74 IP configuration menu saving the configuration 76 using 73 IP interfaces 105 characteristics, displaying 116194 451-0311B Local authentication, configuring 110 port mapping, displaying 117 RADIUS authentication, configuring 110 Rotaries. See Rotaries setting up 106 SSH Keepalive parameters 107 SSH socket numbers 108 status, displaying 118 summaries, displaying 118 Telnet socket numbers 108 IR-5100 units. See Power control units. IR-5150 units. See Power control units. L loading a default configuration file 30, 65 loading the configuration 64 M Main Menu boot from flash 70 boot from network 70 configuring the IP configuration menu 71 saving the software image to flash 70 setting the timeout 71 updating the ppciboot firmware 71 Main menu booting the system 73 resetting to system defaults 72 saving the configuration 73 setting the duplex mode of the Ethernet link 72 setting the speed of the Ethernet link 72 Master ports 97 configuring 98 removing 100 timestamp option 99 Menu command mode, accessing 22 Menu Editing command mode, accessing 22 Modem command mode, accessing 20 modular adapters 51 N no command 24 Notification command mode, accessing 23 Notification Feature facility 79 priority 80 O Online help, displaying 15 P passwords, changing 31 Power Control Relays 144 grouping 145 naming 144, 146, 147 off time, specifying 145 status information, displaying 148 Power control units 143 off time, specifying 146 Power Master ports, configuring 143 status information, displaying 147 summary information, displaying 149 ppciboot factory default settings 68 ppciboot Main Menu upgrading software with 69 PPP command mode, accessing 20 R RADIUS accounting attributes 162 overview 161 setting up 33 RADIUS Accounting Client Operation 161 RADIUS authentication attributes 159 overview 157 setting up 33 recreating zip files 64 Related documents 25 remote console management security, setting up 54 subscriber creation 58 via direct serial connections 51 via modem ports 53 Rotaries 113 configuring 113 disabling 115 information, displaying 118 rotary ports, removing 115 type, specifying 114 S saving configuration to the network 62 scripting 66 SecurID authentication451-0311B 195 setting up 43 Sensors. See Temperature/Humidity sensors Service Profile types ASYNC 82, 85 LOCALSYSLOG 82, 83 REMOTESYSLOG 82, 86 SMTP 82, 87 SNMP 82 SNPP 81, 84 TAP 82, 84 WEB 82, 86 Service Profiles 81 characteristics, displaying 89 configuring 83 creating 82 Service Profiles. See Service Profiles. Slave ports 97 configuring 98 discard option 100 localecho option 100 removing 100 SNMP command mode, accessing 21 software upgrading 66 Subscriber accounts 121 audit log, displaying 138 characteristics, displaying 135 command log, displaying 139 creating 121 deleting 122 status, displaying 136 summary information, displaying 138 TCP information, displaying 137 Subscriber accounts. See also User Profiles Subscriber command mode, accessing 21 Superuser command mode, accessing 18 T TACACS+ accounting attributes 164 overview 161 setting up 38 TACACS+ accounting attributes 163 TACACS+ authentication attributes 168 overview 167 setting up 38 TCP/IP parameters obtaining from the network 27 setting in Quick Start 27 setting in the LX CLI 29 Temperature/Humidity sensor connecting the 141 Temperature/Humidity sensors 141 configuring 141 humidity, displaying 141 summary information, displaying 142 temperature, displaying 141 typographical conventions 14 U UNIX host editing files on 62 upgrading software upgrading software and ppciboot with the command line interface 67 User command mode, accessing 17 User Profiles 81, 88, 123 access methods 123 audit logging 134 characteristics, displaying 90 command logging 134 contact parameter 88 creating 88 dedicated service 133 facility parameter 89 menus 134 password 132 preferred service 133 priority parameter 89 session and terminal parameters 128 superuser privileges 133 User Profiles. See User Profiles. W Windows editing files in 63 451-0312G 1 LX Quick Start Instructions 451-0312G These instructions are intended to help you get your LX unit up and running quickly. They include basic hardware installation, POST test information, how to obtain IP information, and how to perform a first time quick software installation. If you prefer a more detailed explanation of these procedures, refer to the Getting Started with the LX Series manual. Rack-Mounting the Unit • Do not choose a location where the unit will be exposed to direct sunlight or subjected to vibration. • Unit must be installed in an environment with 20% to 80% humidity, noncondensing, 0° - 40° C (32°-113° F). • Do not place an object on the side(s) of the unit that might block airflow through the unit. • The unit may be front, rear, or center mounted. • There is no mounting difference between the 19” and 23” rack mount ears. • MRV provides the following mounting screws: Eight 6-32 x 5/16” flathead screws for attaching the ears to the unit, and four 10-32 screws to attach to the rack. Figure 1 - Mounting an LX Series in Rack The three bottom side screws hold the cover on the unit. To front-mount the unit, you must attaching the rack-mount brackets. Then insert the supplied screws through the brackets and into the same holes. remove the front and center top and bottom screws before If you reverse-mount the unit, remove the rear and center top and bottom screws, and insert the supplied screws through the rack-mount ears.LX Quick Start Instructions 2 451-0312G Connecting Power A grounded AC power outlet should be located within six feet of the back of the unit. Connect the power cord to rear of the unit (see Figure 2), then to an AC power outlet, and observe the front panel FLT and OK LEDs. You can use a UL-approved, 3-prong extension cord if necessary, provided it has sufficient current and voltage capacity. A line cord is supplied. Figure 2 - Connecting Power and Cabling Cabling the LX Unit Cable the LX unit as follows (see Figure 2): • Connect the 10/100 network cable to the 10/100 port on the rear of the unit. The LINK LED comes on steady if the cable is properly connected. • Connect the provided serial port cable to the DIAG port (port 0), and the other end to your terminal. In LX-4048 units, the DIAG port is on the front (see Figure 3). • Connect your serial network element devices (terminals, routers, etc.) to the async ports on the rear of the LX and power them on. Figure 3 - DIAG Port (Port 0) and Modem Port, LX-4048 Unit Front View 100-240VAC 1.0A 50/60Hz DIAG 1 0/1 0 0 E THNT 100 RCV 100 Mbps LED LINK RCV LINK TELCO LINE 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 10/100 Interface Modem Port DIAG Port (Port 0) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 DIAG Port (Port 0) Modem Port451-0312G 3 LX Quick Start Instructions Post Test The Power On Self Test (POST) runs immediately upon startup. The port status LEDs flicker and the FLT LED remains on while the test is running (this may take only a few seconds). If the unit passes the POST test, the FLT LED extinguishes, and the OK LED turns green. If there is a failure, the FLT LED stays on, and the port status LEDs begin flashing an error code. Refer to Getting Started with the LX Series for an explanation of the codes. Booting From Defaults The first time you boot an LX unit, it takes longer than usual. The system computes the server and client SSH keys. This process takes about two minutes. The keys are saved into the flash, which expedites the boot loading process for all future reboots. Obtaining IP Information The LX is an intelligent unit; by default the LX attempts to obtain IP information via the DHCP, BOOTP, or RARP loading methods. A DHCP, BOOTP, or RARP server must also be configured on the network to support the LX unit, as needed. You must first cable the unit according to the instructions in this document or in Getting Started with the LX Series. First Time Quick Configuration NOTE: Quick configuration runs only at default parameters on the DIAG port (port 0) on all models when booting from default parameters. NOTE: Display problems may occur during bootup when you attach a VT420 terminal to the DIAG port (port 0) and the VT420 display setup is configured to Smooth-2 Scroll. To avoid this, change the VT420 scroll setting to Jump Scroll. Use the following procedure to configure your LX unit for the first time. 1. Plug in the terminal at the DIAG port (port 0 - port values are 9600 bps, eight data bits, one stop bit, no parity, and Xon/Xoff flow control). The Main Menu appears. 2. Press b to boot the LX unit. The setup takes a minute or two. The The unit has loaded to factory defaults, would you like to run Initial Connectivity Setup? y/n message appears. 3. Press y (yes) and press Enter. The Superuser Password prompt appears.LX Quick Start Instructions 4 451-0312G 4. Enter the password system. The Quick Configuration menu appears: 5. Press the number corresponding to the parameter you want to set. 6. Enter the appropriate information and press Enter to return to the Quick Configuration menu. Once you enter a parameter value, a data entry line specific to that parameter appears on the Quick Configuration menu. 7. Continue in this way through the menu, configuring as many parameters as you want. You are not required to configure all parameters. NOTE: You should change the Superuser Password, since this is the first time you are configuring the LX unit (the default password is system). 8. Press 7 (Exit and Save) to save your changes. The Is this information correct? message appears. 9. Press y (yes) and press Enter. The Save this information to flash? message appears. 10. Press y (yes) and press Enter. The information is saved to flash. 11. Press Enter several times to display the Login: prompt. You can now use the LX unit. NOTE: Login username and password are case-sensitive. You can access the LX via the Graphical User Interface (GUI) by typing the unit’s IP address in your browser. Refer to Getting Started with the LX Series for more information on how to access and configure the GUI. Quick Configuration menu 1 Unit IP address 2 Subnet mask 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password 7 Exit and Save Enter your choice: CONFIGURATION SUMMARY 1 Unit IP address 10.80.1.5 2 Subnet mask 255.0.0.0 3 Default Gateway 4 Domain Name Server 5 Domain Name Suffix 6 Superuser Password Not Changed 7 Exit and Save Is this information correct? (y/n) : 451-0312G 5 LX Quick Start Instructions Configuring Server Parameters The ports on the unit are set to factory defaults. For example, all async ports are set to 9600/8/1/None, with access remote, xon flow control, and terminal type ANSI. You can change them from the defaults if you want by connecting to the DIAG port (port 0). This port is set for local access. Changing the Defaults via the CLI To change the defaults via the CLI: 1. Enter the default login username (InReach). 2. Enter the default login password (access). 3. At the In-Reach:0> prompt, enter enable. The Password: prompt appears. 4. Enter system or your new Admin password that was set in the Quick Configuration menu. The Superuser In-Reach:>> prompt appears. 5. Enter config and press Enter. The Configuration prompt Config:0>> appears. 6. Enter port async 1. The Async 1-1:0>> prompt appears, so you can change port 1 parameters. 7. Press ? or . The Port Async Commands list appears. Here you can modify any of the default port parameters you want. 8. When you are finished making changes, enter end until you get to the In-Reach:>> prompt. 9. To save your configuration, enter the command save configuration flash. Changing the Defaults via the Graphical User Interface At the Configuration Console window, select Ports: Async. The Async window appears. Here you can modify any of the port default parameters you want. Refer to Getting Started with the LX Series for more information on the Graphic User Interface (GUI). Getting Started with MRV Communications LX Series MIBs Corporate Headquarters MRV Communications, Inc. Corporate Center 20415 Nordhoff Street Chatsworth, CA 91311 Tel: 818-773-0900 Fax: 818-773-0906 www.mrv.com (Internet) Sales and Customer Support MRV Americas 295 Foster Street Littleton, MA 01460 Tel: 800-338-5316 (U.S.) Tel: +011 978-952-4888 (Outside U.S.) sales@mrv.com (email) www.mrv.com (Internet) MRV International Industrial Zone P.O. Box 614 Yokneam, Israel 20682 Tel: 972-4-993-6200 sales@mrv.com (email) www.mrv.com (Internet) 451-0314CContents Introduction ................................................................................................................................... 1 Network Management System ..................................................................................................... 1 Example of an OID Structure:.......................................................................................... 3 Example of SNMPGet for SysObjectID on LX:................................................................ 6 MRV Communications - MIB Modules ........................................................................................ 6 Security .......................................................................................................................................... 6 Managing SNMP Clients and Communities in the LX CLI ....................................................... 7 Defining a Trap Client............................................................................................................ 7 Defining Get and Set SNMP Clients ..................................................................................... 7 Defining SNMP Communities................................................................................................ 8 Miscellaneous SNMP Settings ............................................................................................... 8 SNMP Contact ................................................................................................................... 8 Displaying the SNMP Characteristics................................................................................... 8 Displaying the SNMP Client.................................................................................................. 9 Displaying the SNMP V3 Settings......................................................................................... 10 Compiling MIBs............................................................................................................................. 10 LX MIBs ......................................................................................................................................... 11 LX Subscriber MIB ................................................................................................................. 11 LX Broadcast Group MIBs ..................................................................................................... 31 LX Series-Supported RFCs ........................................................................................................... 40 Standard MIBs........................................................................................................................ 41Getting Started with MRV Communications LX MIBs 0314 1 Introduction This guide provides end-users of MRV Communications’ LX units with basic information regarding the Network Management System (NMS), and procedures on how to use the Management Information Base (MIB) structure (as pointers to objects in the devices) to manage these units. This guide also provides the location of MRV Communications’ Proprietary and Standard MIBs, how they can be obtained, as well as instructions on downloading and compiling them to wherever their application specifies. Network Management System The following details the Network Management System and how the Management Information Base (MIB) is used with network management protocols in TCP/IP-based Internets. Network Management Systems execute management applications that monitor and control network elements. Network Elements (NE) are devices such as hosts, routers, terminal servers, etc., that are monitored and controlled through access to their management information. The Network Management System can potentially monitor several nodes, each with a processing entity termed an agent. An agent is a network management software module that resides in a managed device. It has local knowledge of management information and can translate that information into a form compatible with SNMP. Agents are entities that interface to the actual device being managed. These managed objects might be hardware, configuration parameters, performance statistics, and so on, directly relating to the current operation of the device in question. The agent has access to at least one management station and a management protocol used to convey management information between the agents and management stations. Operations of the protocol are carried out under an administrative framework that defines both primitive authentication and authorization policies in SNMPv1, SNMPv2C, and SNMPv3. Figure 1 - Typical Network Management System All SNMP managed devices contain a Management Information Base (MIB) database that stores management information for that device pertinent to network management. A MIB is a collection of information organized hierarchically. MANAGEMENT SYSTEM MANAGED ELEMENT MANAGER AGENT Human Network Manager Network Protocol Managers Management Database Management DatabaseGetting Started with MRV Communications LX MIBs 0314 2 The database is organized as a tree; branches of the tree name objects and the leaves of the tree contain the values manipulated to effect management. The values are comprised of managed objects and are identified by object identifiers. Objects in the MIB are defined using Abstract Syntax Notation One (ASN.1). The concepts of this tree are called out in STD 16/RFC 1155, “The Structure of Management Information” or SMI. The SMI defines the trunk of the tree and the types of objects used when defining the leaves. STD 16/RFC 1212, “Towards Concise MIB Definitions”, defines a more concise description mechanism that preserves all the principles of the SMI. A managed object, (sometimes called a MIB object, an object, or a MIB) is one of any number of characteristics of a managed device. Managed objects are comprised of one or more object instances, which are essentially variables. Each managed device has a unique address. Furthermore, each managed object per managed device also has a unique address. These unique addresses are known as Object Identifiers (OID). Each enterprise (company) subscribing to the SNMP System is provided with a unique OID, and the enterprise in turn, will allocate unique OIDs to each of its managed objects. OIDs are contained within SNMPs Management Information Base (MIB), which is a virtual blueprint of OIDs serving as the common dictionary for SNMP communications. Names are used to identify managed objects that use the Object Identifier concept to model this notation. An Object Identifier is a sequence of integers that traverse a global tree. The tree consists of a root connected to a number of labeled nodes via edges. Each node may, in turn, have children of its own which are labeled. In this case, we may term the node a subtree. This process may continue to an arbitrary level of depth. Central to the notion of the Object Identifier is the understanding that administrative control of the meanings assigned to the nodes may be delegated as one traverses the tree. A label is a pairing of a brief textual description and an integer.Getting Started with MRV Communications LX MIBs 0314 3 Example of an OID Structure: Internet OBJECT IDENTIFIER ::= {iso (1) org (3) dod (6) internet (1) 1} Internet=Name 1.3.6.1 (iso.org.dod.internet) =Object Identifier (OID) If read from the hierarchal tree structure, it would appear as follows: Root (unlabeled) CCITT (0) ISO (1) ISO-CCITT (2) org (3) dod (6) internet (1) Figure 2 - Hierarchical Tree Structure Core MIB definitions for the Internet suite of protocols can be found in RFC 1155, Management Information Base for Network Management of TCP/IP-based Internets. STD 17/RFC 1213 defines MIB-II, an evolution of MIB-I with changes to incorporate implementation experience and new operational requirements. STD 15/RFC 1157 defines the SNMP protocol itself. The protocol defines how to manipulate the objects in a remote MIB. NOTES: 1. The Simple Network Management Protocol (SNMP) is an Internet standard defined by the Internet Engineering Task Force (IETF) Request for Comment (RFC) 1157, which specifies how network management information is carried through a network. 2. MRV Communications’ devices support SNMP by implementing an SNMP Agent. The agent stores SNMP Management Information Base data and makes it available when requested via SNMP Get/Set requests. 3. In addition, these devices generate SNMP Trap messages, which are indications that specific events have occurred. The definition of an object in the MIB requires an object name and type. Object names and types are defined using the subset of Abstract Syntax Notation One (ASN.1), as defined in the SMI. Objects are named using object identifiers, administratively assigned names to specify object types. The object name, together with an optional object instance, uniquely identifies a specific instance of an object. A textual convention string, termed the OBJECT DESCRIPTOR, may be used to identify the object.Getting Started with MRV Communications LX MIBs 0314 4 Textual conventions enhance the readability of the specification and can ease comparison with other specifications if appropriate. It should be noted that the introduction of textual conventions has no effect on either the syntax or the semantics of any managed objects. These conventions are merely an artifact of the explanatory method used. Objects defined in terms of one of these methods are always encoded by the rules that define the primitive type. Hence, no changes to the SMI or the SNMP are necessary to accommodate these textual conventions, which are adopted for the convenience of readers and writers in pursuit of the elusive goal of clear, concise and unambiguous MIB documents. For example, an ASCII “DisplayString” is a textual convention defined in RFC 1213, and is built on ASN.1 data type “OctetString”, but with added refinement specific to ASCII display strings. Objects have a syntax that defines the abstract data structure corresponding to the object type. The ASN.1 language provides the primitives used for this purpose. The SMI purposely restricts the ASN.1 constructs, which may be used for simplicity and ease of implementation. The encoding of an object type, simply describes how to represent an object using ASN.1 encoding rules for purposes of dealing with the SNMP protocol. Management information is a collection of managed objects, residing in a virtual information store called the Management Information Base. Collections of related objects are defined in MIB modules and are written using a subset of ASN.1. The subset is defined by the SMI and is divided into three parts: 1. Module definitions are used when describing information modules. An ASN.1 macro MODULE-IDENTITY is used to convey the semantics of an information module. 2. Object definitions are used when describing managed objects. An ASN.1 macro OBJECT-TYPE is used to convey the syntax and semantics of a managed object. 3. Notification definitions are used when describing unsolicited transmissions of management information. An ASN.1 macro TRAP-TYPE is used to convey the syntax and semantics of a trap. MIBs are organized into MIB modules. A MIB module is a file defining all the MIB objects under a subtree. The foundation module is the standards-based MIB-II module defined by RFC 1213. (In addition to the Internet-standard MIB-II objects defined in RFC 1213, hardware vendors, such as MRV Communications, Hewlett-Packard, and Cisco Systems have developed MIB extensions for their own products. A MIB defined by a specific vendor is referred to as an enterprise-specific MIB). See the “MIB Classifications” section for a list of MRV enterprise-specific MIBs.Getting Started with MRV Communications LX MIBs 0314 5 As mentioned earlier, MIB objects are organized in a hierarchical tree structure. The root node itself is unlabeled, but has at least three children directly under it. One node is administered by the International Organization for Standards, with label ISO (1); another is administered by International Telegraph and Telephone Consultative Committee, with label CCITT (0); and the third is jointly administered by ISO and CCITT, Joint – ISO – CCITT (2) (see Figure 2). Each branch in the tree has a unique name and numeric identifier. Intermediate branches of the tree serve as a way to group related MIB objects together. iso (1) org (3) dod (6) internet (1) directory (1) mgmt (2) ! private (4) mib-2 (1) enterprises (1) !!! !!! system (1) interfaces (2) snmp (11) cisco (9) hp (11) mrvInReach (33) ProductDivision sysDescr (1) ! ! ! ! sysObjectID (2) Figure 3. MIB Organization The “leaves” of the tree represent the actual MIB object. A subtree refers to the entire group of branches and leaves under a particular intermediate branch. Figure 1-3 illustrates the tree and subtree structures. A MIB object is uniquely identified by its place in the tree. A full object identifier consists of the identifier of each branch along the path through the tree hierarchy, from the top of the tree “iso”, down to the leaf “sysObjectID” as illustrated in Figure 3. The object identifier is expressed in “dotted notation”, by separating each branch identifier along the path with a period.Getting Started with MRV Communications LX MIBs 0314 6 The “mib-2” subtree is iso.org.dod.internet.mgmt.mib-2 and its numeric identifier is 1.3.6.1.2.1. As another example, the full MIB object identifier for “sysObjectID” is iso.org.dod.internet.mgmt.mib-2.system.sysObjectID and its numeric identifier is 1.3.6.1.2.1.1.2. The instance identifier on a MIB object with only one instance is zero. The instance identifier on a MIB object with more than one instance is one or greater. MIB object notations follow the standard notation defined in ASN.1. The ASN.1 standard notation definition can be considered the ‘template’ for MIBs. To avoid conflicts of object IDs, each branch of the tree must be registered, that is, defined through a designated organization. For example, the Internet Activities Board (IAB), has authority over the internet subtree, which includes the MIB-II Internet standard registered under the “mib-2” subtree. In turn, the IAB gives vendors authority over enterprise-specific subtrees. Enterprise-specific MIB objects are registered under the designated authority for that enterprise. To clarify this point, MRV Communications would register its enterprise-specific MIBs under 1.3.6.1.4.1.33, having authority over the enterprises.mrv subtree. The sysObjectID is an important MIB object to management platforms, such as, HP OpenView. The sysObjectID is registered in the Internet-standard MIB-II module as iso.org.dod.internet.mgmt.mib-2.system.sysObjectID (1.3.6.1.2.1.1.2). The sysObjectID is used for administrative purposes to uniquely identify the type of agent software that is running on a given vendor’s hardware. This object is different from most other MIB objects. When queried, this object sends back an object identifier that describes the product. Example of SNMPGet for SysObjectID on LX: NOTE: The exact syntax of the SNMP Get request depends on the management platform. C:\SNMP>snmpget 140.179.xxx.xxx 1.3.6.1.2.1.1.2.0 SNMP++ GET to 140.179.xxx.xxx SNMPV1 Retries=1 Timeout=100m Community=Public Oid = 1.3.6.1.2.1.1.2.0 Value = 1.3.6.1.4.1.33.8.1.31 MRV Communications - MIB Modules LX units support the lx-subscriber-mib proprietary mib, which is listed in Appendix A. Security By default, MRV Communications’ network devices accept SNMP GET and SET requests from the Network Operations Center (NOC). SNMP access can be restricted to the device by specifying the SNMP Clients and Communities. A Community refers to one or more NOCs that specify the same Community string in their SNMP messages. A Client is a specific NOC, which is identified through an IP or Ethernet Address. This can be accomplished by the Command Line Interface (CLI) or via any SNMP package using the SET command.Getting Started with MRV Communications LX MIBs 0314 7 Managing SNMP Clients and Communities in the LX CLI This section describes how to define SNMP Clients and Communities, set miscellaneous SNMP values, and display SNMP-related information. The tasks in this section are performed in the LX Command Line Interface (CLI). Refer to the LX-Series Commands Reference Guide (451-0310) for more information on the commands that are used in this section. Defining a Trap Client Execute this command at the SNMP command mode. An LX will not generate an SNMP Trap message until a Trap Client is defined. A Trap Client is a specific NOC to which the Element Manager sends Trap messages. One of more Trap Clients can be defined through this command: Snmp:0 >>trap client number ip-address A number value is a number from 0 to 15. The ip-address identifies the NOC that should receive the Trap messages. For example: Snmp:0 >>trap client 1 140.179.12.3 SNMP SET Example If a new trap client is to be defined, add it to the trap client table as follows: 1. Walk the SNMP Trap Client Table looking for a client number with an address of zero. An example is SNMP NEXT ObjectID: 1.3.6.1.4.1.33.10.3.9.1.4. 2. Add the new address using SNMP SET. The exact command syntax will vary depending on the SNMP application in use. An example is SNMP SET objectID: 1.3.6.1.4.1.33.10.3.9.1.4.3 Type: OctetString value: 140.179.1.1. Defining Get and Set SNMP Clients Execute this command at the SNMP command mode. A GET Client is a specific NOC that is allowed to manage the In-Reach Element Manager through GET and GET_Next requests. A SET Client is a NOC that may issue SET Requests to the Element Manager. You can use the following commands to define up to four of each of these client types: Snmp:0 >>get client [number] ip-address Snmp:0 >>set client [number] ip-address A number value is a number from 0 to 15. Define a previously defined Get or Set client to 0.0.0.0 in order to remove it. Example Snmp:0 >>set client 1 123.223.123.1 SNMP SET Example Set client: SET 1.3.6.1.4.1.33.50.1.2.1.6 Integer 6 Get client: GET 1.3.6.1.4.1.33.50.1.2.1.6 Integer 6Getting Started with MRV Communications LX MIBs 0314 8 Defining SNMP Communities Execute the get/set/trap client command at the SNMP command mode. GET and SET Communities provide an additional level of security. If you do not define any GET Clients, the LX unit will accept GET and GET_Next requests from any NOC whose GET Requests include a Community name that matches the LX unit’s GET Community. If you do not define a GET Community, the LX unit will accept GET and GET_Next Requests from any NOC. Similarly, if you do not define any SET Clients, the LX unit will accept SET Requests from any NOC whose requests include a Community name that matches the LX unit’s SET Community. If you do not define a SET Community, the LX unit will accept SET Requests from any NOC. If a Trap Community is defined, the LX unit will include the Trap Community name in the Trap messages that it generates. Use the following commands to define GET, SET, and Trap Community names: Snmp:0 >>get client [number] community word A community can include up to 32 characters. Snmp:0 >>set client [number] community word Snmp:0 >>trap client [number] community word Examples Snmp:0 >>get client 1 community none Snmp:0 >>set client 2 community in-reach Miscellaneous SNMP Settings This section explains how to define SNMP Contact, Name, and Location strings. SNMP Contact Execute this command at the SNMP command mode. An SNMP Contact, or sysContact, identifies a person to contact when the LX unit needs attention. Use this command to define a contact: Snmp:0 >>contact “contact-string” The “contact-string” can include up to 60 characters, e.g., “John Smith, 800-555-1212” Example Snmp:0 >>contact bobby_jones Displaying the SNMP Characteristics Use the following command to display the system-wide SNMP characteristics for the LX unit: In-Reach:0 >>show snmp characteristicsGetting Started with MRV Communications LX MIBs 0314 9 Example In-Reach:0 >>show snmp characteristics Time: Wed, 10 Apr 2002 10:45:08 UTC Name: In-Reach Logging: Disabled Port: 161 Contact: Henry Smith Location: Upstairs Lab V3 Engine Boots: 1 V3 Engine ID: 6537303330653865313136323936336100000000 SNMP CHARACTERISTICS Display Displaying the SNMP Client Use the following command to display the Community status (public or private) and the Get, Set, and Trap versions of an SNMP client: In-Reach:0 >>show snmp client number A number value is any valid client number from 0 to 16. Example In-Reach:0 >>show snmp client 1 Client: 2 Get Client: 0.0.0.0 Get Community: public Get Version: 1 Set Client: 0.0.0.0 Set Community public Set Version: 1 Trap Client: 0.0.0.0 Trap Community private Trap Version: 1 IP SNMP Client DisplayGetting Started with MRV Communications LX MIBs 0314 10 Displaying the SNMP V3 Settings Use the following command to display the V3 settings for a Version-3 SNMP client: In-Reach:0 >>show snmp v3 number A number value is any valid SNMP V3 client number from 0 to 16. Example In-Reach:0 >>show snmp v3 1 Client: 4 Engine Boots: 8 Engine ID: e70303eeace2923a000000000000000000000000 V3 View OID Subtree: 0 V3 View OID Subtree Mask: 8000000000000000000000000000000000000000 V3 View Name: V3 View Type: Allow V3 Access Group Name: V3 Access Context Prefix: V3 Access Security Model: 3 V3 Access Security Level: 1 V3 Access Read View: view V3 Access Write View: view V3 Access Notify View: view V3 Access Cont. Match: none V3 Security Name: V3 Source IP: 0.0.0.0 V3 Secur. Community: public V3 Source Mask: 0.0.0.0 V3 Group Secur. Model: V3 Group Secur. Name: V3 Group Name: Compiling MIBs It may be a good practice to open the MIB prior to compiling it. Use the mib compiler associated with your NMS to compile the MIBs. For HP Openview, as the user clicks on the MIB file to add it to the database, the compiler checks it for errors. When individual MIBs are being added to the database, the order in which the MIBs are added is important, since one MIB often references objects in other MIBs. Some compilation errors can be fixed by commenting out a line or an entire objected with double-hyphens, or “—“ at the beginning of each unwanted line. Remove any (comment indications) “—“ later in that line. The user can do this if not interested in managing that particular object.Getting Started with MRV Communications LX MIBs 0314 11 Appendix A LX MIBs This MIB implements the objects related to the LX subscriber (or user) configuration and status. LX Subscriber MIB -- $Revision: 1.9 $ IN-REACH-Subscriber-mib DEFINITIONS ::= BEGIN -- -- -- Subscriber MIB Text File -- -- Date: Thurs. Feb 4, 2003 user: DA -- File created using EMACS -- By: DA -- -- FILE: lx-subscriber-mib.mib -- -- import modules IMPORTS Counter, Gauge, TimeTicks, IpAddress FROM RFC1155-SMI DisplayString FROM RFC1213-MIB OBJECT-TYPE FROM RFC-1212; -- mrvInReachProductDivision -- FROM MRV-IN-REACH-PRODUCT-DIVISION-MIB; -- -- DisplayString, sysLocation -- FROM RFC1213-MIB -- TRAP-TYPE -- FROM RFC-1215 -- iTouch, DateTime, AddressType -- FROM ITOUCH-MIB -- charPortIndex -- FROM RFC1316-MIB -- rs232InSigState, rs232OutSigState, rs232PortIndex -- FROM RFC1317-MIB; -- -- definition of object typesGetting Started with MRV Communications LX MIBs 0314 12 -- -- OBJECT-TYPE MACRO ::= -- BEGIN -- TYPE NOTATION ::= "SYNTAX" type (TYPE ObjectSyntax) -- "ACCESS" Access -- "STATUS" Status -- VALUE NOTATION ::= value (VALUE ObjectName) -- -- Access ::= "read-only" -- | "read-write" -- | "write-only" -- | "not-accessible" -- Status ::= "mandatory" -- | "optional" -- | "obsolete" -- END -- -- names of objects in the MIB -- -- ObjectName ::= OBJECT IDENTIFIER -- -- syntax of objects in the MIB -- -- ObjectSyntax ::= -- CHOICE { -- simple -- SimpleSyntax, -- -- note that simple SEQUENCEs are not directly -- mentioned here to keep things simple (i.e., -- prevent mis-use). However, application-wide -- types which are IMPLICITly encoded simple -- SEQUENCEs may appear in the following CHOICE -- -- application-wide -- ApplicationSyntax -- } -- -- SimpleSyntax ::= -- CHOICE { -- number INTEGER, -- string STRING, -- object OBJECT IDENTIFIER, -- empty NULL -- } -- -- ApplicationSyntax ::=Getting Started with MRV Communications LX MIBs 0314 13 -- CHOICE { -- address NetworkAddress, -- counter Counter, -- gauge Gauge, -- ticks TimeTicks, -- arbitrary Opaque -- -- other application-wide types, as they are -- defined, will be added here -- -- } -- -- -- application-wide types -- -- Counter ::= -- [APPLICATION 1] -- IMPLICIT INTEGER (0..4294967295) -- -- Gauge ::= -- [APPLICATION 2] -- IMPLICIT INTEGER (0..4294967295) -- -- TimeTicks ::= -- [APPLICATION 3] -- IMPLICIT INTEGER (0..4294967295) -- -- Opaque ::= -- [APPLICATION 4] -- IMPLICIT OCTET STRING -- -- Define OIDs -- ccitt OBJECT IDENTIFIER ::= { 0 } -- null OBJECT IDENTIFIER ::= { ccitt 0 } -- iso OBJECT IDENTIFIER ::= { 1 } -- org OBJECT IDENTIFIER ::= { iso 3 } -- dod OBJECT IDENTIFIER ::= { org 6 } -- internet OBJECT IDENTIFIER ::= { dod 1 } -- directory OBJECT IDENTIFIER ::= { internet 1 } -- mgmt OBJECT IDENTIFIER ::= { internet 2 } -- experimental OBJECT IDENTIFIER ::= { internet 3 } -- private OBJECT IDENTIFIER ::= { internet 4 } -- enterprises OBJECT IDENTIFIER ::= { private 1 }Getting Started with MRV Communications LX MIBs 0314 14 mrvInReachProductDivision OBJECT IDENTIFIER ::= {enterprises 33} lxagent OBJECT IDENTIFIER ::= {mrvInReachProductDivision 50} -- -- In-Reach OBJECT IDENTIFIER ::= { enterprises 33 } -- agent OBJECT IDENTIFIER ::= { In-Reach 8 } -- -- A In-Reach agent identifer has the following fields: -- -- In-Reach.agent.software.variant.version -- -- Where: -- -- In-Reach.agent is an ordinary OID prefix. -- Note that In-Reach's original form for -- such OID's used the value 1 for agent -- and had no variant or version. Later -- forms included variant and version in -- an inconsistent manner. -- -- software a value of the In-Reach SoftwareType -- textual convention. -- -- variant a variant within a software type, -- typically hardware dependent. If the -- software has no variants, it uses the -- value 1. -- -- version a version number within the variant, -- increased by one each time that -- variant's agent changes in a way that -- is significant to its MIB -- capabilities description -- -- Terminal Servers terminalServer OBJECT IDENTIFIER ::= { lxagent 1 } -- This is a MIB module for all IN-REACH LX systems. -- -- This MIB document is supplied "AS IS," and IN-REACH -- makes no warranty, either express orGetting Started with MRV Communications LX MIBs 0314 15 -- implied, as to the use operation, condition, or -- performance of the MIB. -- -- Textual Conventions sizeOfSubscriberTable OBJECT-TYPE SYNTAX INTEGER (1..65534) ACCESS not-accessible STATUS mandatory DESCRIPTION "The size of the subscriberTable." ::= { terminalServer 1 } subscriberTable OBJECT-TYPE SYNTAX SEQUENCE OF SubsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A list (table) of subscriber entries." ::= { terminalServer 2 } subsEntry OBJECT-TYPE SYNTAX SubsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A subscriber entry containing objects for a particular subscriber." INDEX { index } ::= { subscriberTable 1 } SubsEntry ::= SEQUENCE { index INTEGER, name DisplayString, usePassword INTEGER, password DisplayString, securityLevel INTEGER, maxConnections INTEGER, currentConnections Gauge,Getting Started with MRV Communications LX MIBs 0314 16 activeUserIndex INTEGER, portSecurityList DisplayString, telnetAccess INTEGER, sshAccess INTEGER, guiAccess INTEGER, consoleAccess INTEGER, dialback INTEGER, dialbackNumber DisplayString, dialbackRetry INTEGER, useMenu INTEGER, menuName DisplayString, prompt DisplayString, termType DisplayString, -- sessionMode -- INTEGER, idleTimeout INTEGER, sessionTimeout INTEGER, localSwitch DisplayString, forwardSwitch DisplayString, backwardSwitch DisplayString, pause INTEGER, debugging INTEGER, logging INTEGER, preferredService DisplayString, dedicatedServiceGetting Started with MRV Communications LX MIBs 0314 17 DisplayString, telnetLineMode INTEGER, telnetEscapeChar OCTET STRING, telnetSendcrlf INTEGER, telnetReceivecrlf INTEGER, sshCipher INTEGER, remoteSshName DisplayString, sshPort INTEGER, sshLogLevel INTEGER } index OBJECT-TYPE SYNTAX INTEGER (1..65534) ACCESS read-only STATUS mandatory DESCRIPTION "A unique index value for each subscriber." ::= { subsEntry 1 } name OBJECT-TYPE SYNTAX DisplayString (SIZE (0..80)) ACCESS read-only STATUS mandatory DESCRIPTION "The Name of the subscriber entry." ::= { subsEntry 2 } usePassword OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-only STATUS mandatory DESCRIPTION "The subscriber entry requires (enabled) or does not require (disabled) a login password." ::= { subsEntry 3 } password OBJECT-TYPEGetting Started with MRV Communications LX MIBs 0314 18 SYNTAX DisplayString (SIZE (0..80)) ACCESS read-only STATUS mandatory DESCRIPTION "The login password string of the subscriber entry." ::= { subsEntry 4 } securityLevel OBJECT-TYPE SYNTAX INTEGER { user(1), super(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The security level of the subscriber determines what privilaged modes they can use." ::= { subsEntry 5 } maxConnections OBJECT-TYPE SYNTAX INTEGER (1..255) ACCESS read-write STATUS mandatory DESCRIPTION "The maximum number of the subscriber connections allowed for this subscriber entry." ::= { subsEntry 6 } currentConnections OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The number of current connections for the subscriber entry." ::= { subsEntry 7 } activeUserIndex OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-only STATUS mandatory DESCRIPTION "The active index number of the subscriber entry (0 = none)." ::= { subsEntry 8 }Getting Started with MRV Communications LX MIBs 0314 19 portSecurityList OBJECT-TYPE SYNTAX DisplayString (SIZE (0..80)) ACCESS read-write STATUS mandatory DESCRIPTION "The list of port numbers the subscriber entry is allowed access to." ::= { subsEntry 9 } telnetAccess OBJECT-TYPE SYNTAX INTEGER { deny(1), allow(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The access of the subscriber entry via telnet is allowed or denied." ::= { subsEntry 10 } sshAccess OBJECT-TYPE SYNTAX INTEGER { deny(1), allow(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The access of the subscriber entry via SSH is allowed or denied." ::= { subsEntry 11 } guiAccess OBJECT-TYPE SYNTAX INTEGER { deny(1), allow(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The access of the subscriber entry via the GUI is allowed or denied." ::= { subsEntry 12 } consoleAccess OBJECT-TYPE SYNTAX INTEGER { deny(1), allow(2) } ACCESS read-write STATUS mandatoryGetting Started with MRV Communications LX MIBs 0314 20 DESCRIPTION "The access of the subscriber entry to a Console port is allowed or denied." ::= { subsEntry 13 } dialback OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The subscriber entry has the dialback feature enabled or disabled." ::= { subsEntry 14 } dialbackNumber OBJECT-TYPE SYNTAX DisplayString (SIZE (0..15)) ACCESS read-write STATUS mandatory DESCRIPTION "The phone number the subscriber entry will dial back if the dialback feature is enabled." ::= { subsEntry 15 } dialbackRetry OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-write STATUS mandatory DESCRIPTION "The number of times dialback will be tried for the subscriber entry." ::= { subsEntry 16 } useMenu OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The menu feature of the subscriber entry is enabled or disabled." ::= { subsEntry 17 }Getting Started with MRV Communications LX MIBs 0314 21 menuName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..31)) ACCESS read-write STATUS mandatory DESCRIPTION "The menu name for the subscriber entry." ::= { subsEntry 18 } prompt OBJECT-TYPE SYNTAX DisplayString (SIZE (0..15)) ACCESS read-write STATUS mandatory DESCRIPTION "The prompt text of the subscriber entry." ::= { subsEntry 19 } termType OBJECT-TYPE SYNTAX INTEGER {ansi(1), vt100(2)} ACCESS read-write STATUS mandatory DESCRIPTION "The terminal type of the subscriber entry." ::= { subsEntry 20 } -- sessionMode OBJECT-TYPE -- SYNTAX INTEGER {standard(1), vt5xx(2)} -- ACCESS read-write -- STATUS mandatory -- DESCRIPTION -- "The session mode of the subscriber entry." -- -- ::= { subsEntry 21 } idleTimeout OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-write STATUS mandatory DESCRIPTION "The number of minutes the subscriber entry can be idle before it is logged out (0 = no timeout)." ::= { subsEntry 21 }Getting Started with MRV Communications LX MIBs 0314 22 sessionTimeout OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-write STATUS mandatory DESCRIPTION "The number of minutes the subscriber entry session can be up before it is logged out." ::= { subsEntry 22 } localSwitch OBJECT-TYPE SYNTAX DisplayString (SIZE (0..2)) ACCESS read-write STATUS mandatory DESCRIPTION "The subscriber entry switch to return to the first session." ::= { subsEntry 23 } forwardSwitch OBJECT-TYPE SYNTAX DisplayString (SIZE (0..2)) ACCESS read-write STATUS mandatory DESCRIPTION "The subscriber entry switch to move to next session." ::= { subsEntry 24 } backwardSwitch OBJECT-TYPE SYNTAX DisplayString (SIZE (0..2)) ACCESS read-write STATUS mandatory DESCRIPTION "The subscriber entry switch to move to previous session." ::= { subsEntry 25 } pause OBJECT-TYPE SYNTAX INTEGER {disable(1),enable(2)} ACCESS read-write STATUS mandatory DESCRIPTION "The screen pause setting of the subscriber entry."Getting Started with MRV Communications LX MIBs 0314 23 ::= { subsEntry 26 } debugging OBJECT-TYPE SYNTAX INTEGER { disabled(1),enabled(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The subscriber entry debug feature setting." ::= { subsEntry 27 } logging OBJECT-TYPE SYNTAX INTEGER { disabled(1),enabled(2) } ACCESS read-write STATUS mandatory DESCRIPTION "The logging feature setting of the subscriber entry." ::= { subsEntry 28 } preferredService OBJECT-TYPE SYNTAX DisplayString (SIZE (0..15)) ACCESS read-write STATUS mandatory DESCRIPTION "The prefered service of the subscriber entry." ::= { subsEntry 29 } dedicatedService OBJECT-TYPE SYNTAX DisplayString (SIZE (0..15)) ACCESS read-write STATUS mandatory DESCRIPTION "The dedicated service of the subscriber entry." ::= { subsEntry 30 } telnetLineMode OBJECT-TYPE SYNTAX INTEGER {line(1),char(2)} ACCESS read-write STATUS mandatory DESCRIPTION "The telnet line mode setting of the subscriber entry." ::= { subsEntry 31 }Getting Started with MRV Communications LX MIBs 0314 24 telnetEscapeChar OBJECT-TYPE SYNTAX OCTET STRING ACCESS read-write STATUS mandatory DESCRIPTION "The telnet escape character of the subscriber entry." ::= { subsEntry 32 } telnetSendcrlf OBJECT-TYPE SYNTAX INTEGER {cr(1),crlf(2)} ACCESS read-write STATUS mandatory DESCRIPTION "The telnet send newline setting of the subscriber entry." ::= { subsEntry 33 } telnetReceivecrlf OBJECT-TYPE SYNTAX INTEGER {cr(1),crlf(2)} ACCESS read-write STATUS mandatory DESCRIPTION "The telnet receive newline setting of the subscriber entry." ::= { subsEntry 34 } sshCipher OBJECT-TYPE SYNTAX INTEGER {any(1),blowfish(2),tripledes(3)} ACCESS read-write STATUS mandatory DESCRIPTION "The SSH cipher type of the subscriber entry." ::= { subsEntry 35 } remoteSshName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..63)) ACCESS read-write STATUS mandatory DESCRIPTION "The name sent to the remote SSH peer of the subscriber entry."Getting Started with MRV Communications LX MIBs 0314 25 ::= { subsEntry 36 } sshPort OBJECT-TYPE SYNTAX INTEGER (1..65535) ACCESS read-write STATUS mandatory DESCRIPTION "The TCP port number used for SSH connections by the subscriber entry." ::= { subsEntry 37 } sshLogLevel OBJECT-TYPE SYNTAX INTEGER {quiet(1),info(2),fatal(3),error(4),verbose(5),debug(6)} ACCESS read-write STATUS mandatory DESCRIPTION "The SSH logging level of the subscriber entry." ::= { subsEntry 38 } ---- Dynamic Subscriber Table -- sizeOfDynSubscriberTable OBJECT-TYPE SYNTAX INTEGER (0..65534) ACCESS not-accessible STATUS mandatory DESCRIPTION "The size of the dynSubscriberTable." ::= { terminalServer 3 } dynSubscriberTable OBJECT-TYPE SYNTAX SEQUENCE OF DynSubsEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A list of subscriber entries." ::= { terminalServer 4 } dynSubsEntry OBJECT-TYPE SYNTAX DynSubsEntry ACCESS not-accessible STATUS mandatory DESCRIPTIONGetting Started with MRV Communications LX MIBs 0314 26 "A dynamic subscriber entry containing objects for a particular dynamic subscriber." INDEX { dynindex } ::= { dynSubscriberTable 1 } DynSubsEntry ::= SEQUENCE { dynindex INTEGER, subName DisplayString, devName DisplayString, devType INTEGER, dynidleTimeout INTEGER, dynsessionTimeout INTEGER, ipAddr IpAddress, port INTEGER, protocol INTEGER, dynprompt DisplayString, dyntermType DisplayString, usePpp INTEGER, dyndialback INTEGER, remoteLogin INTEGER, sesActive Gauge, dynpause INTEGER, security INTEGER, totalTransmittedBytes Counter, totalReceivedBytes Counter, startTime TimeTicks,Getting Started with MRV Communications LX MIBs 0314 27 kill INTEGER } dynindex OBJECT-TYPE SYNTAX INTEGER (1..65534) ACCESS read-only STATUS mandatory DESCRIPTION "A unique index value for each dynamic subscriber." ::= { dynSubsEntry 1 } subName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..80)) ACCESS read-only STATUS mandatory DESCRIPTION "The name of the dynamic subscriber entry." ::= { dynSubsEntry 2 } devName OBJECT-TYPE SYNTAX DisplayString (SIZE (0..80)) ACCESS read-only STATUS mandatory DESCRIPTION "The device name of the dynamic subscriber entry." ::= { dynSubsEntry 3 } devType OBJECT-TYPE SYNTAX INTEGER {physical(1),virtual(2)} ACCESS read-only STATUS mandatory DESCRIPTION "The device name of the dynamic subscriber entry." ::= { dynSubsEntry 4 } dynidleTimeout OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-only STATUS mandatory DESCRIPTION "The number of minutes the dynamic subscriber entry can be idle before it is logged out (0 = no timeout)."Getting Started with MRV Communications LX MIBs 0314 28 ::= { dynSubsEntry 5 } dynsessionTimeout OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-only STATUS mandatory DESCRIPTION "The number of minutes the dynamic subscriber entry session can be up before it is logged out." ::= { dynSubsEntry 6 } ipAddr OBJECT-TYPE SYNTAX IpAddress ACCESS read-only STATUS mandatory DESCRIPTION "The IP address of the dynamic subscriber entry." ::= { dynSubsEntry 7 } port OBJECT-TYPE SYNTAX INTEGER (0..255) ACCESS read-only STATUS mandatory DESCRIPTION "The prompt text of the dynamic subscriber entry." ::= { dynSubsEntry 8 } protocol OBJECT-TYPE SYNTAX INTEGER {console(1),serial(2),gui(3),udp(4),telnet(5),ssh(6)} ACCESS read-only STATUS mandatory DESCRIPTION "The prompt text of the dynamic subscriber entry." ::= { dynSubsEntry 9 } dynprompt OBJECT-TYPE SYNTAX DisplayString (SIZE (0..15)) ACCESS read-only STATUS mandatory DESCRIPTION "The prompt text of the dynamic subscriber entry."Getting Started with MRV Communications LX MIBs 0314 29 ::= { dynSubsEntry 10 } dyntermType OBJECT-TYPE SYNTAX DisplayString (SIZE (0..80)) ACCESS read-only STATUS mandatory DESCRIPTION "The terminal type of the dynamic subscriber entry." ::= { dynSubsEntry 11 } usePpp OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-only STATUS mandatory DESCRIPTION "The dynamic subscriber entry uses PPP (enabled) or does not use PPP (disabled)." ::= { dynSubsEntry 12 } dyndialback OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-only STATUS mandatory DESCRIPTION "The dynamic subscriber entry has the dialback feature enabled or disabled." ::= { dynSubsEntry 13 } remoteLogin OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-only STATUS mandatory DESCRIPTION "The dynamic subscriber entry is a remote login." ::= { dynSubsEntry 14 } sesActive OBJECT-TYPE SYNTAX Gauge ACCESS read-only STATUS mandatory DESCRIPTION "The dynamic subscriber entry has active sessions."Getting Started with MRV Communications LX MIBs 0314 30 ::= { dynSubsEntry 15 } dynpause OBJECT-TYPE SYNTAX INTEGER {disable(1),enable(2)} ACCESS read-only STATUS mandatory DESCRIPTION "The screen pause setting of the dynamic subscriber entry." ::= { dynSubsEntry 16 } security OBJECT-TYPE SYNTAX INTEGER {user(1),super(2)} ACCESS read-only STATUS mandatory DESCRIPTION "The security setting of the dynamic subscriber entry." ::= { dynSubsEntry 17 } totalTransmittedBytes OBJECT-TYPE SYNTAX Counter ACCESS read-only STATUS mandatory DESCRIPTION "The total transmitted bytes of the dynamic subscriber entry." ::= { dynSubsEntry 18 } totalReceivedBytes OBJECT-TYPE SYNTAX Counter ACCESS read-only STATUS mandatory DESCRIPTION "The total received bytes of the dynamic subscriber entry." ::= { dynSubsEntry 19 } startTime OBJECT-TYPE SYNTAX TimeTicks ACCESS read-only STATUS mandatory DESCRIPTIONGetting Started with MRV Communications LX MIBs 0314 31 "The start time of the dynamic subscriber entry." ::= { dynSubsEntry 20 } kill OBJECT-TYPE SYNTAX INTEGER {kill(1)} ACCESS read-write STATUS mandatory DESCRIPTION "The dynamic subscriber entry is active or killed." ::= { dynSubsEntry 21 } END -- end of IN-REACH-Subscriber LX Broadcast Group MIBs -- $Revision: 1.3 $ MRV-LX-BROADCASTGROUP-MIB DEFINITIONS ::= BEGIN -- -- Broadcast Group MIB Text File -- -- Date: Wed. Feb.12, 2003 user: DA -- File created using EMACS -- By: DA -- -- FILE: LX-BR-GROUP-MIB.txt -- -- -- IMPORTS Counter, Gauge, TimeTicks, IpAddress FROM RFC1155-SMI DisplayString, sysLocation FROM RFC1213-MIB OBJECT-TYPE FROM RFC-1212; -- TRAP-TYPE -- FROM RFC-1215 -- charPortIndex -- FROM RFC1316-MIB -- rs232InSigState, rs232OutSigState, rs232PortIndex -- FROM RFC1317-MIB;Getting Started with MRV Communications LX MIBs 0314 32 -- Define OIDs -- ccitt OBJECT IDENTIFIER ::= { 0 } -- null OBJECT IDENTIFIER ::= { ccitt 0 } iso OBJECT IDENTIFIER ::= { 1 } org OBJECT IDENTIFIER ::= { iso 3 } dod OBJECT IDENTIFIER ::= { org 6 } internet OBJECT IDENTIFIER ::= { dod 1 } directory OBJECT IDENTIFIER ::= { internet 1 } mgmt OBJECT IDENTIFIER ::= { internet 2 } experimental OBJECT IDENTIFIER ::= { internet 3 } private OBJECT IDENTIFIER ::= { internet 4 } enterprises OBJECT IDENTIFIER ::= { private 1 } mrvInReachProductDivision OBJECT IDENTIFIER ::= {enterprises 33} lxagent OBJECT IDENTIFIER ::= {mrvInReachProductDivision 50} terminalServer OBJECT IDENTIFIER ::= { lxagent 1 } -- MRV In-Reach LX Broadcast Groups -- This is a MIB module for all MRV In-Reach LX systems that -- implement broadcast groups. -- -- NOTE: The broadcast groups are actually under the interface -- level, but are currently locked on interface 1. This may -- change at sometime in the future and require corresponding -- changes to this MIB as well. -- -- Copyright 2003 MRV Communications, Inc. All Rights Reserved. -- Reproduction of this document is authorized on -- condition that this copyright notice is included. -- This MIB document embodies MRV Communications, Inc.'s -- proprietary intellectual property. MRV Communications, Inc. -- retains all title and ownership in this MIB, including any -- revisions. -- -- It is MRV Communications, Inc.'s intent to encourage the -- widespread use of this MIB in connection with the management -- of MRV Communications, Inc. products. MRV Communications, -- Inc. grants vendors, end-users, and other interested parties -- a non-exclusive license to use this MIB in connection with -- the management of MRV Communications, Inc. products.Getting Started with MRV Communications LX MIBs 0314 33 -- -- This MIB document is supplied "AS IS," and MRV -- Communications, Inc. makes no warranty, either express -- or implied, as to the use operation, condition, or -- performance of the MIB. -- Implementation of this group is mandatory for all MRV -- In-Reach LX systems that implement broadcast groups. -- the lxBroadcastGroup table sizeOfBroadcastGroupTable OBJECT-TYPE SYNTAX INTEGER (1..65534) ACCESS not-accessible STATUS mandatory DESCRIPTION "The size of the subscriberTable." ::= { terminalServer 6 } lxBroadcastGroupTable OBJECT-TYPE SYNTAX SEQUENCE OF LxBroadcastGroupEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "A list of broadcast group parameters." ::= { terminalServer 7 } lxBroadcastGroupEntry OBJECT-TYPE SYNTAX LxBroadcastGroupEntry ACCESS not-accessible STATUS mandatory DESCRIPTION "Broadcast group information." INDEX { lxBroadcastGroupIndex } ::= { lxBroadcastGroupTable 1 } LxBroadcastGroupEntry ::= SEQUENCE { lxBroadcastGroupIndex INTEGER, lxBroadcastGroupMode INTEGER, lxBroadcastGroupState INTEGER, lxBroadcastGroupAsyncMasterTimestampList DisplayString, lxBroadcastGroupAsyncMasterNoTimestampListGetting Started with MRV Communications LX MIBs 0314 34 DisplayString, lxBroadcastGroupTcpMasterTimestampList DisplayString, lxBroadcastGroupTcpMasterNoTimestampList DisplayString, lxBroadcastGroupAsyncSlaveDiscardList DisplayString, lxBroadcastGroupAsyncSlaveNoDiscardList DisplayString, lxBroadcastGroupAsyncSlaveLocalEchoList DisplayString, lxBroadcastGroupAsyncSlaveNoLocalEchoList DisplayString, lxBroadcastGroupTcpSlaveDiscardList DisplayString, lxBroadcastGroupTcpSlaveNoDiscardList DisplayString, lxBroadcastGroupTcpSlaveLocalEchoList DisplayString, lxBroadcastGroupTcpSlaveNoLocalEchoList DisplayString, lxBroadcastGroupAsyncMasterTimestampPort INTEGER, lxBroadcastGroupAsyncMasterNoTimestampPort INTEGER, lxBroadcastGroupTcpMasterTimestampPort INTEGER, lxBroadcastGroupTcpMasterNoTimestampPort INTEGER, lxBroadcastGroupAsyncSlaveDiscardPort INTEGER, lxBroadcastGroupAsyncSlaveNoDiscardPort INTEGER, lxBroadcastGroupAsyncSlaveLocalEchoPort INTEGER, lxBroadcastGroupAsyncSlaveNoLocalEchoPort INTEGER, lxBroadcastGroupTcpSlaveDiscardPort INTEGER, lxBroadcastGroupTcpSlaveNoDiscardPort INTEGER, lxBroadcastGroupTcpSlaveLocalEchoPort INTEGER, lxBroadcastGroupTcpSlaveNoLocalEchoPort INTEGER }Getting Started with MRV Communications LX MIBs 0314 35 lxBroadcastGroupIndex OBJECT-TYPE SYNTAX INTEGER ACCESS read-only STATUS mandatory DESCRIPTION "An index value that uniquely identifies a broadcast group." ::= { lxBroadcastGroupEntry 1 } lxBroadcastGroupMode OBJECT-TYPE SYNTAX INTEGER { line(1), character(2) } ACCESS read-write STATUS mandatory DESCRIPTION "A mode value for the broadcast group. The value 'line' means that the group is active and broadcasting data in line mode whereas the value 'character' means that the group is active and broadcasting data in character mode." DEFVAL { line } ::= { lxBroadcastGroupEntry 2 } lxBroadcastGroupState OBJECT-TYPE SYNTAX INTEGER { disabled(1), enabled(2) } ACCESS read-write STATUS mandatory DESCRIPTION "A state value for the broadcast group. The value 'enabled' means that the group is active and broadcasting data whereas 'disabled' means that the group is not active." DEFVAL { disabled } ::= { lxBroadcastGroupEntry 3 } -- -- object types to display the master & slave port lists in a -- specific broadcast group. -- lxBroadcastGroupAsyncMasterTimestampList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Async Master Broadcast Ports with timestamp enabled for this group." ::= { lxBroadcastGroupEntry 4 } lxBroadcastGroupAsyncMasterNoTimestampList OBJECT-TYPEGetting Started with MRV Communications LX MIBs 0314 36 SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Async Master Broadcast Ports without timestamp enabled for this group." ::= { lxBroadcastGroupEntry 5 } lxBroadcastGroupTcpMasterTimestampList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Tcp Master Broadcast Ports with timestamp enabled for this group." ::= { lxBroadcastGroupEntry 6 } lxBroadcastGroupTcpMasterNoTimestampList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Tcp Master Broadcast Ports without timestamp enabled for this group." ::= { lxBroadcastGroupEntry 7 } lxBroadcastGroupAsyncSlaveDiscardList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Async Slave Broadcast Ports with discard enabled for this group." ::= { lxBroadcastGroupEntry 8 } lxBroadcastGroupAsyncSlaveNoDiscardList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Async Slave Broadcast Ports without discard enabled for this group." ::= { lxBroadcastGroupEntry 9 } lxBroadcastGroupAsyncSlaveLocalEchoList OBJECT-TYPE SYNTAX DisplayString ACCESS read-onlyGetting Started with MRV Communications LX MIBs 0314 37 STATUS mandatory DESCRIPTION "A list of the Async Slave Broadcast Ports with local echo enabled for this group." ::= { lxBroadcastGroupEntry 10 } lxBroadcastGroupAsyncSlaveNoLocalEchoList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Async Slave Broadcast Ports without local echo enabled for this group." ::= { lxBroadcastGroupEntry 11 } lxBroadcastGroupTcpSlaveDiscardList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Tcp Slave Broadcast Ports with discard enabled for this group." ::= { lxBroadcastGroupEntry 12 } lxBroadcastGroupTcpSlaveNoDiscardList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Tcp Slave Broadcast Ports without discard enabled for this group." ::= { lxBroadcastGroupEntry 13 } lxBroadcastGroupTcpSlaveLocalEchoList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTION "A list of the Tcp Slave Broadcast Ports with local echo enabled for this group." ::= { lxBroadcastGroupEntry 14 } lxBroadcastGroupTcpSlaveNoLocalEchoList OBJECT-TYPE SYNTAX DisplayString ACCESS read-only STATUS mandatory DESCRIPTIONGetting Started with MRV Communications LX MIBs 0314 38 "A list of the Tcp Slave Broadcast Ports without local echo enabled for this group." ::= { lxBroadcastGroupEntry 15 } -- -- object types to configure the master & slave ports in a -- specific broadcast group. -- lxBroadcastGroupAsyncMasterTimestampPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "An Async Master Broadcast Port with timestamp enabled for this group." ::= { lxBroadcastGroupEntry 16 } lxBroadcastGroupAsyncMasterNoTimestampPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "An Async Master Broadcast Port without timestamp enabled for this group." ::= { lxBroadcastGroupEntry 17 } lxBroadcastGroupTcpMasterTimestampPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Master Broadcast Port with timestamp enabled for this group." ::= { lxBroadcastGroupEntry 18 } lxBroadcastGroupTcpMasterNoTimestampPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Master Broadcast Port without timestamp enabled for this group." ::= { lxBroadcastGroupEntry 19 } lxBroadcastGroupAsyncSlaveDiscardPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatoryGetting Started with MRV Communications LX MIBs 0314 39 DESCRIPTION "An Async Slave Broadcast Port with discard enabled for this group." ::= { lxBroadcastGroupEntry 20 } lxBroadcastGroupAsyncSlaveNoDiscardPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "An Async Slave Broadcast Port without discard enabled for this group." ::= { lxBroadcastGroupEntry 21 } lxBroadcastGroupAsyncSlaveLocalEchoPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "An Async Slave Broadcast Port with local echo enabled for this group." ::= { lxBroadcastGroupEntry 22 } lxBroadcastGroupAsyncSlaveNoLocalEchoPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "An Async Slave Broadcast Port without local echo enabled for this group." ::= { lxBroadcastGroupEntry 23 } lxBroadcastGroupTcpSlaveDiscardPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Slave Broadcast Port with discard enabled for this group." ::= { lxBroadcastGroupEntry 24 } lxBroadcastGroupTcpSlaveNoDiscardPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Slave Broadcast Port without discardGetting Started with MRV Communications LX MIBs 0314 40 enabled for this group." ::= { lxBroadcastGroupEntry 25 } lxBroadcastGroupTcpSlaveLocalEchoPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Slave Broadcast Port with local echo enabled for this group." ::= { lxBroadcastGroupEntry 26 } lxBroadcastGroupTcpSlaveNoLocalEchoPort OBJECT-TYPE SYNTAX INTEGER ACCESS write-only STATUS mandatory DESCRIPTION "A Tcp Slave Broadcast Port without local echo enabled for this group." ::= { lxBroadcastGroupEntry 27 } -- -- -- END -- End of MRV-LX-BROADCASTGROUP-MIB LX Series-Supported RFCs The LX also implements the MIBs defined by the following RFCs: • 1213 - MIB2 • 1659 - RS232 • 1907 - SNMPv2 • 1696 - Modem MIB • 1658 - Character Device • 1472 - PPP Security Protocols • 1471 - PPP Link Control Protocol • 1473 - PPP IP Network Control Protocol • 2574 - User Based Security Model for SNMPv3 • 2575 - View-based Access Control Model for SNMPv3Getting Started with MRV Communications LX MIBs 0314 41 Standard MIBs These files are standard RFC documents, as defined by the Internet Engineering Task Force (IETF). They are provided as information only, because they are used by MRV Communications in building Concatenated MIBs. The RFCs listed here are used solely by MRV Communications. Note: This is not to be considered an official repository of Requests for Comments (RFCs). It is considered a living document, whereby it is subject to change at any time. RFC1155.SMI “Structure of Management Information” RFC1212.SMI “Concise MIB Format” RFC1213.MIB “MIB II” RFC1215.SMI “Concise Trap Format” RFC1215.TRP “Trap Definitions” RFC1229.MIB “Extensions to Generic Interface MIB” RFC1284.MIB “MIB for Ethernet-like objects” RFC1317.MIB “MIB for RS-232-like Hardware Devices” RFC1354.MIB “IP Forwarding Table MIB” RFC1398.MIB “Definitions of Managed Objects for Ethernet-like Interface Types” RFC1471.MIB “Link Control Protocol of PPP” RFC1472.MIB “Security Protocols of PPP” RFC1473.MIB “IP Network Control Protocol of PPP” RFC1573A.MIB “V2 evolution of MIB-II, part A” RFC1573B.MIB “V2 evolution of MIB-II, part B” 450-0143 1 Release Notes LX Series Version 3.0.1 April 2003 450-0143J Contents Introduction................................................................................................................................. 3 New Version of ppciboot ............................................................................................................. 3 New Features and Enhancements ............................................................................................. 4 LX-4048S Device Support .................................................................................................... 4 Notification Enhancements.................................................................................................. 4 Reporting State Transitions of DCD/DSR and CTS to syslogd.......................................... 6 Global Feature Control......................................................................................................... 6 Pattern Matching.................................................................................................................. 7 SSH Public Key/Trusted Keys ............................................................................................. 7 SecurID Authentication ....................................................................................................... 8 The iptables Commands..................................................................................................... 10 TACACS+ Authentication and Accounting....................................................................... 11 Telnet Performance ............................................................................................................ 14 Telnet Break String............................................................................................................ 15 Ethernet Port Enhancement.............................................................................................. 15 Broadcast Group Enhancement......................................................................................... 16 Authentication Fallback Enable Command...................................................................... 16 MIB-Related RFCs .................................................................................................................... 16 Upgrading Software and ppciboot with the Command Line Interface.................................. 17 LX Series Notes and Restrictions............................................................................................. 18 SSH Public Key................................................................................................................... 18 CPU Usage Field ................................................................................................................ 18 Global Feature Control....................................................................................................... 18 Rebooting Outlet Groups.................................................................................................... 18 GUI Outlet Wake-Up State for IR-5150............................................................................ 18 no outlet 1 name Command ........................................................................................ 18 Menu Item Label ................................................................................................................ 18 Menu Control Key .............................................................................................................. 18 Changing Notification Message Priority........................................................................... 18 Async Port Pattern Matching ............................................................................................ 18 IP Interfaces........................................................................................................................ 19 PCMCIA Port ...................................................................................................................... 19 Outlet Groups ..................................................................................................................... 19 Known External Limitations.................................................................................................... 19 Java Cache Issue ................................................................................................................ 19 Windows 2000 Server ......................................................................................................... 19 Java Runtime Environment............................................................................................... 19LX Software Release Notes Version 3.0.1 2 450-0143 Notification Web Driver Nextel, Skytel, and Sprint......................................................... 19 Issues Fixed in 3.0.1 .................................................................................................................. 19 Configuring the IP Address................................................................................................ 19 Issues Fixed in 3.0.0 .................................................................................................................. 20 ppciboot Updates................................................................................................................. 20 Menu File Names................................................................................................................ 20 Mail Commands in Multiple Packets................................................................................. 20 Default Modem Command.................................................................................................. 20 Show Interface Port Mapping Screen................................................................................ 20 Modem Init String............................................................................................................... 20 Notification Service Profiles and User Profiles................................................................. 20 3DES.................................................................................................................................... 20 Config IP Network Number ............................................................................................... 21 LX Broadcast Address ........................................................................................................ 21 SNMP Contact and Location.............................................................................................. 21 V3 Client View Mask .......................................................................................................... 21 V3 View Mask Error Message ............................................................................................ 21 10/100 Ethernet Port .......................................................................................................... 21 TFTP Issue .......................................................................................................................... 21LX Software Release Notes Version 3.0.1 450-0143 3 Introduction These release notes provide important information about the LX product line. They cite supported features as well as any notes and restrictions for the following software version: • Software Image Version 3.0.1 Earlier releases are documented in the Archives Directory on the LX Documentation CD. It is also possible to download release notes by doing the following: 1. Point your browser to the MRV Service and Support site (http://service.mrv.com/support/). 2. Select In-Reach (IR and LX) from the Product Type pulldown list. 3. Select any LX product from the Product pulldown list. 4. Select the Software Updates option below the Products pulldown list. 5. Click the Get Information button. This displays the Software Updates page. 6. Select a Release Notes filename from the Software Updates page. NOTE: You must supply a User Name and password to download the Release Notes. New Version of ppciboot IMPORTANT The LX-4048 must run on 3.0.1 or higher software and the latest ppciboot firmware. If you have an LX-4008S-xxx unit running software version V2.0.0 or above, and you are updating to Release V3.0.1, you must also update the ppciboot (V1.0.1) for the software to function properly. If you have a different model LX unit, MRV Communications recommends that you perform the same ppciboot update. Refer to “Upgrading Software and ppciboot with the Command Line Interface” for information on performing the upgrade. When you upgrade the software, use the DIAG port (port 0) as your management port. MRV Communications recommends that you update to the latest software and ppciboot, regardless of which LX model you are upgrading. However, each model will run on a minimum required software and ppciboot version. The minimum requirements for each model are shown in the following table: LX Model LX Software Version ppciboot – Minimum Revision Required to Support Hardware LX-4008 V2.2.0 V1.0.0 LX-4016 V2.2.1 V1.0.0 LX-4032 V2.2.2 V1.0.0 LX-4048 V3.0.1 V1.0.1LX Software Release Notes Version 3.0.1 4 450-0143 New Features and Enhancements The following new features are supported in this release of the LX software: LX-4048S Device Support V3.0.1 and ppciboot V1.0.1 include hardware platform support for the 48 port LX unit. Notification Enhancements The notification messaging feature allows you to redefine 40 predefined syslog messages. Each configurable syslog message has a default message string, facility grouping, and priority level. You can modify these settings to generate a more useful syslog message for its environment. This allows the administrator to eliminate unwanted messages and group messages deemed useful by changing them to the desirable facility and priority levels. The “show notification message all” commands list the 40 predefined syslog messages. An administrator can modify these records with the following commands: InReach:0>> config Config:0>>notification Notification:0>>message # string “text message” Notification:0>>message # facility [authpriv |daemon |user |kern |syslog] Notification:0>>message # priority [emergency|alert|critcal|error|warn|notice|info] Notification:0>>message # default To view the notification message, enter the following command: InReach:0>> show notification message # Message record 1: Message: Configuration mode has been entered by Facility: user Priority: notice Message record 2: Message: Configuration mode has been exited by Facility: user Priority: notice Message record 3: Message: The Shell has been entered by Facility: user Priority: notice Message record 4: Message: The Shell has been exited by Facility: user Priority: notice Notification Message DisplayLX Software Release Notes Version 3.0.1 450-0143 5 Example You may have one administrator interested in receiving messages for all users entering config mode, (MESSAGE #1). You may have another administrator who only wants to be notified if someone attempts to enter the shell mode (MESSAGE #3). To achieve this, set up two notification Service Profiles, one for each administrator. Configure the first administrator to receive messages at priority notice, and the second administrator to receive messages at priority warning. Change message records 1 and 3 as follows: Notification:0>>message 1 priority notice Notification:0>>message 3 priority warning Notification:0>> serviceprofile admin1_email protocol smtp Notification:0>> serviceprofile admin1_email server 10.179.176.21 Notification:0>> userprofile jsmith service admin1_email Notification:0>> userprofile jsmith contact 1112223333@vtext.com Notification:0>> userprofile jsmith facility user Notification:0>> userprofile jsmith priority notice Notification:0>> serviceprofile admin2_email protocol smtp Notification:0>> serviceprofile admin2_email server 10.179.176.21 Notification:0>> userprofile djones service admin2_email Notification:0>> userprofile djones contact 1112223334@vtext.com Notification:0>> userprofile djones facility user Notification:0>> userprofile djones priority warning For more information on the Notification enhancement commands, refer to the LX-Series Commands Reference Guide. Viewing All Notification Messages, Facilities, and Priorities Use this command to show all notification message/facility/priority information. InReach:0 >> show notification messages all/number [1-40] Message record number: 1 Message: Configuration mode has been entered by Facility: user Priority: notice Message record number: 2 Message: Exiting Config mode by Facility: user Priority: notice ~ Notification Message/Facility/Priority All DisplayLX Software Release Notes Version 3.0.1 6 450-0143 Viewing Specific Notification Messages, Facilities, and Priorities Use the following command to show the notification message/facility/priority for a specific record. InReach:0 >> show notification message 3 Message record number: 3 Message: The Shell Level Mode has been entered by Facility: user Priority: notice Specific Notification Message/Facility/Priority Display Reporting State Transitions of DCD/DSR and CTS to syslogd The sigsnotice priority can now be specified for a Notification User Profile. When the sigsnotice priority is in effect, state transitions of serial input signals DCD/DSR and CTS are reported through syslogd to the configured user profile through the linked service profile. Before you can configure a priority of sigsnotice for a User Profile, you must configure the asynchronous port in question to generate a syslog message for a state transition of the serial input signals CTS and DCD/DSR. Use the following command: Async 4-4:0>>signals syslog enable In order for the state transitions of DCD/DSR and CTS to be reported to a user, the applicable User Profile must have a priority of sigsnotice and a facility of kern. Use the userprofile facility command to specify the facility setting of a User Profile. Use the userprofile priority command to specify the priority setting of a User Profile. NOTES: If the port has CTS flow control, DCD/DSR transition will be logged, but the CTS State transition is not. You can enable signals syslogd enable SIGsNotice on a per port basis with this command. Refer to the LX-Series Commands Reference Guide for more information on the commands. Global Feature Control Global Feature Control allows administrators to disable several features and remote access protocols for security and access control. When a protocol is disabled, that protocol cannot establish a connection to the LX console or the virtual ports. Global Feature Control is configured in the Configuration Command mode. Features that you can enable or disable are SNMP, Telnet, GUI/Web, SSH, NTP, timed, and fingerd. SSH versions 1 and 2 are mutually exclusive; you can configure only one version at a time.LX Software Release Notes Version 3.0.1 450-0143 7 For more information on the Global Feature Control commands, refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide. Pattern Matching The Pattern Matching feature is now supported on ports that are configured for databuffer access. Up to 8 pattern strings can be specified for a port. When data that matches a pattern string is received at the port, the data is put into a notification message. The notification message is in the following format: Pattern match found::Msg39 where is the incoming data that matches the specified pattern. For example, the following notification messages could be generated for incoming data that matched the pattern Sun.root>: Pattern match found:Sun root> Panic Dump:Msg39 NOTE: The text Pattern match found is the default content of Message 39. This text can be changed. If it is changed, the text that precedes the colon (:) will be different from Pattern match found. The messages will be forwarded to Notification clients that have a facility of user and a priority of notice configured in their User Profiles. You can create pattern strings with the pattern string command, which is executed in the Asynchronous Command Mode. In order for the Pattern Matching feature to take effect on an asynchronous port, you must execute the pattern match enable command after you have created pattern strings with the pattern string command. To display information on the Pattern Matching feature, execute the show port async number/all pattern match characteristics command. Refer to the LX-Series Commands Reference Guide for more information on the commands. SSH Public Key/Trusted Keys You can create a Trusted Key for a subscriber in the Subscriber command mode. This improves ease of use and helps prevent spoofing issues. You can automate SSH connections between machines without interaction between users. The subscriber only needs to enter his username and password the first time he logs in, after which the LX stores them. On subsequent sessions, the subscriber can log in without specifying a name and password. MRV supports both RSA and DSA keys. Refer to the LX-Series Commands Reference Guide and the LX-Series Configuration Guide for further details.LX Software Release Notes Version 3.0.1 8 450-0143 Specifying a Unique SSH Key for the Subscriber To specify a unique SSH key for the subscriber, execute the ssh key command; for example: Subs_jack >>ssh key When you execute the ssh key command, the following prompt is displayed: Please enter your key: Paste the unique SSH key for the subscriber at the above prompt. (The unique SSH key must be generated on the host from which the subscriber will make SSH connections to the LX unit. Refer to your Linux documentation for more information on generating an SSH key.) When a subscriber has a unique SSH key, he can log on to the LX unit via SSH, without entering a password. (The only requirement is that the user must log on from the host on which his SSH key was generated.) SecurID Authentication This release of the LX software supports SecurID authentication. RSA SecurID® is a twotier authentication method. A two-tier method is based on something you know (PIN), and something you have (token card). SecurID sessions are authenticated by a username and passcode. The passcode is a 4 digit PIN followed by 8 digits generated by the token card. SecurID supports both DES and SDI encryption. The primary SecurID server may have multiple identical servers on the network. These are referred to as replicas. One primary server may have as many as five replicas. You can authenticate from any one of these replicas. 1. Access the Configuration Command Mode on the LX. 2. Use the SecurID primary authentication server address command to specify the IP address of the SecurID primary authentication server: Config:0 >>securid primary authentication server address 149.19.87.89 3. Use the securid authentication encryption command to specify the SecurID encryption method for the LX unit. You can specify DES or SDI as the encryption method: Config:0 >>securid authentication encryption des Config:0 >>securid authentication encryption sdi 4. Use the securid authentication version command to specify the SecurID authentication version for the LX unit. You can specify the authentication version as Version 5, or pre-Version 5 (legacy): Config:0 >>securid authentication version version_5 Config:0 >>securid authentication version legacyLX Software Release Notes Version 3.0.1 450-0143 9 NOTE: When configured for legacy, use the master authentication server address in place of the primary authentication server address attribute. 5. Use the securid authentication port command to specify the socket your SecurID server is listening to: Config:0 >>securid authentication port 1812 6. Enable SecurID on the desired ports. Config:0 >>port async 2 Async 2-2:0 >>access local Async 2-2:0 >>authentication inbound securid enable Async 2-2:0 >>authentication fallback enable Async 2-2:0 >>exit Config:0 >>port async 3 Async 3-3:0 >>access remote Async 3-3:0 >>authentication outbound securid enable Async 3-3:0 >>authentication fallback enable Async 3-3:0 >>end 7. To verify the LX SecurID configuration, exit from the Configuration command mode and execute the show securid characteristics command at the Superuser command prompt; for example: InReach:0 >>show securid characteristics SecurID Configuration Settings Authentication Version: Version_5 Authentication Encryption: DES Authentication Timeout: 5 Authentication Retransmit: 3 Authentication Port: 5500 V5 Primary Server: 0.0.0.0 Primary Name: 149.19.87.89 Legacy Master Server: 0.0.0.0 Master Name: Legacy Slave Server: 0.0.0.0 Slave Name: Inbound SecurID Enabled Serial Ports: 2 Outbound SecurID Enabled Serial Ports: 3 SecurID Enabled Interfaces: SecurID Characteristics Display For more information on the LX implementation of SecurID authentication, refer to the following sections in the LX-Series Configuration Guide: • "Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit" • "Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface" • "Setting Up Security for a Console Port" For more information on the commands (as well as other commands), refer to the LX-Series Commands Reference Guide.LX Software Release Notes Version 3.0.1 10 450-0143 The iptables Commands The iptables commands are used to create IP filters for the LX unit. IP filters are used to allow certain IP packets to pass, or not pass, through an LX unit. The iptables can be applied to IP packets that originate on the network side, or the serial side, of the LX unit. You must navigate to the Linux shell and use the iptables commands that are available in the Kernel. Use iptables to set up, maintain, and inspect the tables of IP packet filter rules in the Linux Kernel. iptables help manage IP traffic by creating filters known as chains. Each chain is a list of rules that can match a set of packets. Each rule specifies what to do with a packet that matches. The options are ACCEPT, DENY, or DROP. The INPUT chain filters packets coming from the LAN to the LX-Series and the OUTPUT chain filters packets leaving the LX-Series destined for the LAN. After making any changes, you should always run the command " iptables-save -f /config/iptables.conf" to save the changes. To make the change permanent through reboots, you must save the configuration change by running the command "save configuration " from the superuser command mode. Configuring INPUT and OUTPUT Chains 1. Enter the shell by typing: InReach:0>>shell # 2. Display the current iptables chains by typing: # iptables –L 3. Add or modify the INPUT or OUTPUT chain. The following INPUT rule drops any packets coming to the LX from source address 10.240.10.240. # iptables –A INPUT –s 10.240.10.240 –j DROP The following OUTPUT rule drops packets originating from the LX destined for IP address 10.128.1.13. #iptables –A OUTPUT –d 10.128.1.13 –j DROP Saving iptables Changes The configuration is kept in the “/config/iptables.conf” file. This file is generated by the iptables-save utility when reading the filter tables located in the Kernel. The configuration is dynamically applied when a command is entered. The iptables-save command creates the new configuration file in /config/iptables.conf.LX Software Release Notes Version 3.0.1 450-0143 11 To make this configuration persistent through the reboot, save the configuration to the flash or the network from the super user command line as follows: 1. Verify the iptables configuration by typing: # iptables –L Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- 10.128.1.11 anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP all -- anywhere 10.128.1.10 Chain tcp_allow (0 references) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp flags:SYN,RST,ACK/SYN ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED DROP tcp -- anywhere anywhere IPTables Configuration Display 2. Save the iptables changes to the /config/iptables.conf file by typing: # iptables-save –f /config/iptables.conf 3. Save the modify iptables.conf file to flash or network by typing: InReach>> save config [flash|network] Now your changes will be maintained through a reload of the LX unit. TACACS+ Authentication and Accounting This release of the LX software supports TACACS+ authentication and accounting. TACACS+ is used to provide access control to devices such as network access server (NAS) or routers via a centralized server. It uses the Transport Control Protocol (TCP) on port 49 to ensure reliable transfer. The entire body of the packet is encrypted using a series of 16-byte MD5 hashes. The protocol is split up into 3 distinct categories; Authentication, Authorization, and Accounting.LX Software Release Notes Version 3.0.1 12 450-0143 Authentication is the process of determining who the user is. Usually, a user is required to enter in a user name and password to be granted access. Authorization is the process of determining what the user is able to do. The profile in the TACACS+ server should have a service of exec and a priv-lvl of 15 in order to access Superuser privileges, otherwise the user will only be allowed in user mode. The Accounting feature records what the user has done and generally occurs after authentication and authorization. There are three different types of accounting records: a start record for when a user logs on, an intermediate record, which is set with a constant interval, and a stop record when the user logs out. The TACACS+ superuser request attribute is independent from the TACACS login. The “TACACS+ superuser request” attribute is used to indicate which database to authenticate the superuser password against after a user is logged in. When you type the "enable" command, the enable password will be authenticated against the TACACS server database when the “TACACS+ superuser request” is enabled. Otherwise, it is checked against the LX database "system". Sample TACACS+ Configuration Login: InReach Password: ****** InReach:0 >enable Password: ****** InReach:0 >>configuration Config:0 >>tacacs+ primary authentication server add 10.242.131.13 Config:0 >>tacacs+ primary authentication server secret jets Config:0 >>tacacs+ primary account server add 10.242.131.13 Config:0 >>tacacs+ primary account server secret jets Config:0 >>tacacs+ superuser password request enable Config:0 >>tacacs+ secondary authentication server add 10.242.131.11 Config:0 >>tacacs+ secondary authentication server secret jets Config:0 >>tacacs+ secondary account server add 10.242.131.11 Config:0 >>tacacs+ secondary account server secret jets Config:0 >>tacacs+ superuser request enable Config:0 >>port async 2 Async 2-2:0 >>access local Async 2-2:0 >>authentication inbound tacacs+ enable Async 2-2:0 >>tacacs+ account enable Async 2-2:0 >>authentication fallback enable Async 2-2:0 >>exit Config:0 >>port async 3 Async 3-3:0 >>access remote Async 3-3:0 >>authentication outbound tacacs+ enable Async 3-3:0 >>tacacs+ account enable Async 3-3:0 >>authentication fallback enable Async 3-3:0 >>endLX Software Release Notes Version 3.0.1 450-0143 13 Viewing TACACS+ Characteristics Use the following command to display the TACACS+ characteristics. InReach:0>> show tacacs+ characteristics Primary TACACS+ Authentication Server: IP Address: 10.242.131.13 TACACS+ Auth. TCP Port: 49 Secret: Configured Timeout: 5 Retry: 3 Secondary TACACS+ Authentication Server: IP Address: 10.242.131.11 TACACS+ Auth. TCP Port: 49 Secret: Configured Timeout: 5 Retry: 3 Primary TACACS+ Accounting Server: IP Address: 10.242.131.13 TACACS+ Acct. TCP Port: 49 Secret: Configured Timeout: 5 Retry: 3 Secondary TACACS+ Accounting Server: IP Address: 10.242.131.11 TACACS+ Acct. TCP Port: 49 Secret: Configured Timeout: 5 Retry: 3 TACACS+ Superuser Request: Disabled TACACS+ Accounting Server Period: 5 Inbound TACACS+ Enabled Serial Ports: 2 Outbound TACACS+ Enabled Serial Ports: 3 TACACS+ Enabled Interfaces: TACACS+ Characteristics DisplayLX Software Release Notes Version 3.0.1 14 450-0143 Viewing TACACS+ Status Use the following command to display the TACACS+ status. InReach:0>> show tacacs+ status Total TACACS+ Authentication Message Exchange: Primary Secondary Successful attempts: 0 0 Failed attempts: 0 0 Total TACACS+ Accounting Message Exchange: Primary Secondary Successful attempts: 0 0 Failed attempts: 0 0 TACACS+ Authentication Counter Summary: Primary Secondary Successful Logins: 0 0 Authentication Failures: 0 0 TACACS+ Accounting Counter Summary: Primary Secondary Successful Acct Entries: 0 0 Failed Acct Entries: 0 0 TACACS+ Superuser Enable Summary: Primary Secondary Successful Enable Requests: 0 0 Failed Enable Requests: 0 0 TACACS+ Fallback Counter Summary: Total Fallback Logins: 0 TACACS+ Status Display For more information on the LX implementation of TACACS+ authentication and accounting, refer to the following sections in the LX-Series Configuration Guide: • "Setting Up RADIUS, SecurID, and TACACS+ for the LX Unit" • "Configuring RADIUS, TACACS+, or SecurID Authentication on an IP Interface" • "Setting Up Security for a Console Port" For more information on the commands, refer to the LX-Series Commands Reference Guide. Telnet Performance Telnet performance has been improved by fine-tuning the buffering to maximize the throughput and lower the latency.LX Software Release Notes Version 3.0.1 450-0143 15 Telnet Break String This LX feature is used when telnet clients cannot send a telnet break to a remote device. The LX administrator can configure an LX console port with a unique “telnet break string” up to four characters long. During a telnet session, when the remote telnet partner includes the LX port’s telnet break string within the data stream, the LX recognizes the character sequence and sends a break signal out of the configured LX console port to the attached device. The telnet break string is configured in the Asynchronous mode. The command is in the following format: Port Async 1:0>> telnet break string “string” where “string” can be up to four characters long. Ethernet Port Enhancement Use this feature to configure the speed and duplex mode for the Ethernet Port. This enhancement is configured in the Ethernet Command mode or in the ppciboot Main menu. Set the Ethernet port to auto if you want the port to automatically adjust to network speed and duplex. You can also set the speed and duplex manually to 10mb with full or half duplex, or to 100mb with full or half duplex. If the LX boots from flash memory, you can auto negotiate or fix the Ethernet port speed and duplex for normal functionality. Refer to the LX-Series Commands Reference Guide for more information on using the following commands in the Ethernet Command mode: • port ethernet 1 • speed auto • speed 10mb duplex full • speed 10mb duplex half • speed 100mb duplex full • speed 100mb duplex half Refer to the “Ethernet Commands” chapter of the LX-Series Commands Reference Guide for more information on using the speed command to set the speed and duplex mode of the Ethernet port. If the LX boots from the network, use the following commands to set the Ethernet port speed and duplex. Refer to the LX-Series Commands Reference Guide for more information on the commands: • ppciboot ethernet link auto • ppciboot ethernet link 10halfLX Software Release Notes Version 3.0.1 16 450-0143 • ppciboot ethernet link 10full • ppciboot ethernet link 100half • ppciboot ethernet link 100full Refer to the “Configuration Commands” chapter of the LX-Series Commands Reference Guide for information on using the ppciboot ethernet network link command to set the port speed and duplex mode of the ppciboot Ethernet link. Broadcast Group Enhancement Broadcast Groups now supports up to 16 TCP sockets as slave ports. Previously, the limit was two. Authentication Fallback Enable Command The port command radius fallback enable has been changed to authentication fallback enable. Refer to the LX-Series Commands Reference Guide for more information. MIB-Related RFCs This release of the LX software supports the following MIB-related RFCs: • RFC 1213 – Defines the second version of the Management Information Base (MIB-II). • RFC 1471 – Defines Managed Objects for the Link Control Protocol of PPP. • RFC 1472 – Defines managed objects for PPP Security protocols. • RFC 1473 – Defines Managed Objects for the IP Network Control Protocol of the Pointto-Point Protocol. • RFC 1658 – Defines objects for the management of character stream devices. • RFC 1659 – Defines objects for the management of RS-232-like devices. • RFC 1696 – Describes managed objects used for managing dial-up modems and similar dial-up devices. • RFC 1907 – Defines managed objects for SNMP V2. • RFC 2574 – Defines the user-based security model for SNMP V3. • RFC 2575 – Defines the view-based Access Control Model for SNMP V3.LX Software Release Notes Version 3.0.1 450-0143 17 Upgrading Software and ppciboot with the Command Line Interface You can upgrade the software and ppciboot using the update command in the superuser command mode. Make sure you have a TFTP server up and running, containing the software image and the ppciboot image. NOTE: You must enter the TFTP server address each time you update software or ppciboot, unless you have already manually entered it in ppciboot. To download the ppciboot from the command line interface (you must be in superuser mode), do the following: 1. Type the following and press : In-Reach:0>>update ppciboot tftp_server_ip_address/name By default the software stores the TFTP server’s IP address it has booted from memory. If this occurs, this argument becomes optional. The “TFTP Download complete, verifying file integrity” message appears. The loaded file is checked for integrity. If the check is successful, the “File OK, copying boot image to flash” message appears (if the check finds a problem, the “Verify failed, Bad ppciboot file” message appears). You have upgraded ppciboot. You must reboot the unit for the new ppciboot to take effect. Now you must upgrade the software. 2. Type the following and press : In-Reach:0>>update software tftp_server_ip_address/name Updating software can take up to five minutes. You are copying from the TFTP server to the flash. 3. Type the following and press : In-Reach:0>>save config flash This stores the parameters. 4. Type the following and press : In-Reach:0>>reload The new software is activated. When the reload is complete, log in again. You can load a default configuration file from a TFTP server while the unit is at its default setting. NOTE: The default filename is linuxito.img for software. The ppciboot filename is ppciboot.img. NOTE: In superuser mode a check is performed to determine how much space is available before updating the software or ppciboot. Eight MB must be available to update software. One MB must be available to update ppciboot.LX Software Release Notes Version 3.0.1 18 450-0143 LX Series Notes and Restrictions SSH Public Key You cannot paste the SSH Public Key into the LX GUI window. Use the CLI to import the SSH Public Key. CPU Usage Field The CPU Usage field in the System Status screen is inaccurate. Global Feature Control When you use global features control via the GUI, the results are unreliable. To avoid this, disable the LX global features through the CLI. Rebooting Outlet Groups If an outlet in a group is not present or reachable when you reboot the outlet group, the reboot fails and the command is not applied. To avoid this, remove the missing outlet from the group name. GUI Outlet Wake-Up State for IR-5150 The Wake-Up State does not exist on the GUI. Use the native CLI on the IR-5150 Power Control Series unit to control the outlet Wake-Up State. no outlet 1 name Command You must add a space after the word “name” in the async command no outlet 1 name for the command to work. Menu Item Label In the Menu Item Label, you cannot enter a standalone letter “t” or the word “to”. Menu Control Key The Menu Control Key fails if the control letter is a lower case t, r, e, l, s, or u. Changing Notification Message Priority When you change a notification message’s priority, sigsnotice is not a valid argument. Async Port Pattern Matching When you configure an async port pattern matching string, the alpha string “help” is not supported. “Help” is a reserved text string.LX Software Release Notes Version 3.0.1 450-0143 19 IP Interfaces Previously, the LX allowed 15 IP interfaces. IP interfaces are now limited to four. PCMCIA Port The PCMCIA port on the front panel of the LX-4048 is inactive in this release. Outlet Groups You can configure a maximum of 16 outlet groups. However, when you attempt to create an outlet group via the CLI, there is not enough room to enter all 16, especially if you use long names or multiple digits. This occurs because the maximum number of characters on a CLI line is limited to 80. However, you can enter all 16 outlet groups via the GUI. At the GUI window, do the following: 1. Select Ports: Async. The Async window opens. 2. Click on the Group button at the bottom of the window. The Group window opens. 3. Select the New Group tab. Configure the groups you want. Known External Limitations Java Cache Issue The Java Cache in JRE 1.4 is set ON by default. There is an anomaly within Java Cache 1.4 regarding cache functionality, which requires you to disable the cache. At Settings: Control Panel, open the Java Plug-in 1.4.0 icon, and click the Cache tab. At the Cache window, click the Clear Cache button and uncheck the Enable Caching checkbox. Click OK. Windows 2000 Server The Windows 2000 server does not support dialback. Java Runtime Environment The JRE used in the LX GUI does not support Macintosh operating systems. Notification Web Driver Nextel, Skytel, and Sprint The Web Drivers Nextel, Skytel, and Sprint are not supported because their sites use SSL. Issues Fixed in 3.0.1 Configuring the IP Address In Release 3.0, defining the IP address through the Quick Configuration menu did not work. You had to configure the IP address via the CLI. Upgrading to Release 3.0.1 resolves this issue.LX Software Release Notes Version 3.0.1 20 450-0143 Issues Fixed in 3.0.0 ppciboot Updates In a previous release, when you ran the ppciboot update (Main Menu entry #6) over a routed network, the update failed. This feature now works properly. Menu File Names Previously, the command line parser had issues with underscores. You can now use underscores in menu file names. Mail Commands in Multiple Packets In a previous release, the LX sent the first character of a word in a packet by itself, then a second packet containing the rest of the word. SMTP mail commands are now sent intact in a single tcp packet. Default Modem Command In a previous release, you had to default the port and the modem if you wanted to default the modem. Now you can default the modem settings without defaulting the port. Show Interface Port Mapping Screen The Show interface X port mapping screen no longer includes port 0, because port 0 cannot be reached via telnet or ssh. Modem Init String Previously, if you set S registers (S0=1), the modem initstring did not accept the equal symbol (=). The equal symbol is now accepted. Notification Service Profiles and User Profiles Previously, if you created a notification serviceprofile or userprofile with a underscore in the name, you could not view the serviceprofile or userprofile by its name, even though it appeared in the all list. This no longer occurs. 3DES Previously, the 3DES command returned an error. Under subscriber/ssh/cipher, you can no longer enter 3DES, but must enter triple-DES instead. The correct value of 3DES is displayed throughout all SHOW screens. LX Software Release Notes Version 3.0.1 450-0143 21 Config IP Network Number Previously, if a unit’s IP address was defined from the ppciboot Main menu, you could not change the network address to interface 1 when the unit was booted. You can now change the address. LX Broadcast Address In the previous release, when the unit was loaded and you changed the network address to the interface, the broadcast address was not adjusted properly. This no longer occurs. SNMP Contact and Location Previously, you could enter up to 256 characters for Contact and Location, but only the last 26 characters were displayed on the screen. The character limit is now 26. V3 Client View Mask Previously, when you tried to set the v3 client view mask by typing the snmp:0>>v3 client 3 view mask 1.2.3.4 command, the following incorrect error message was displayed: Non printable character a Call 7004. Now the correct error message (syntax error) is displayed. V3 View Mask Error Message Previously, no error message was displayed when the snmp>>v3 client 3 view mask jj22 command was executed with a value other than hex. Now, an error message is displayed. 10/100 Ethernet Port Previously, you could not configure the 10/100 Ethernet port speed and duplex, but you can in this release. TFTP Issue Previously, TFTP caused a software update to fail if any timeouts were encountered. This no longer occurs. Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Catalyst 3750 Switch Command Reference Cisco IOS Release 12.1(14)EA1 July 2003 Customer Order Number: DOC-7815165= Text Part Number: 78-15165-02THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R) Catalyst 3750 Switch Command Reference Copyright © 2003, Cisco Systems, Inc. All rights reserved.iii Catalyst 3750 Switch Command Reference 78-15165-02 C O N T E N T S Preface xv Audience xv Purpose xv Conventions xvi Related Publications xvii Obtaining Documentation xvii Cisco.com xvii Documentation CD-ROM xvii Ordering Documentation xviii Documentation Feedback xviii Obtaining Technical Assistance xviii Cisco TAC Website xviii Opening a TAC Case xix TAC Case Priority Definitions xix Obtaining Additional Publications and Information xix C H A P T E R 1 Using the Command-Line Interface 1-1 Accessing the Switch 1-1 CLI Command Modes 1-2 User EXEC Mode 1-3 Privileged EXEC Mode 1-3 Global Configuration Mode 1-4 Interface Configuration Mode 1-4 config-vlan Mode 1-5 VLAN Configuration Mode 1-5 Line Configuration Mode 1-6 C H A P T E R 2 Cisco IOS Commands 2-1 aaa authentication dot1x 2-1 action 2-3 archive copy-sw 2-5 archive download-sw 2-7 archive tar 2-10Contents iv Catalyst 3750 Switch Command Reference 78-15165-02 archive upload-sw 2-13 auto qos voip 2-15 boot auto-copy-sw 2-19 boot boothlpr 2-20 boot config-file 2-21 boot enable-break 2-22 boot helper 2-23 boot helper-config-file 2-24 boot manual 2-25 boot private-config-file 2-26 boot system 2-27 channel-group 2-28 channel-protocol 2-32 class 2-33 class-map 2-35 clear lacp 2-37 clear mac-address-table 2-38 clear pagp 2-39 clear setup express 2-40 clear spanning-tree counters 2-41 clear spanning-tree detected-protocols 2-42 clear vmps statistics 2-43 clear vtp counters 2-44 cluster commander-address 2-45 cluster discovery hop-count 2-47 cluster enable 2-48 cluster holdtime 2-50 cluster member 2-51 cluster outside-interface 2-53 cluster run 2-54 cluster standby-group 2-55 cluster timer 2-57 define interface-range 2-58 delete 2-60 deny 2-62Contents v Catalyst 3750 Switch Command Reference 78-15165-02 dot1x default 2-65 dot1x guest-vlan 2-66 dot1x host-mode 2-67 dot1x initialize 2-69 dot1x max-req 2-70 dot1x multiple-hosts 2-71 dot1x port-control 2-72 dot1x re-authenticate 2-74 dot1x re-authentication 2-75 dot1x reauthentication 2-76 dot1x system-auth-control 2-77 dot1x timeout 2-78 duplex 2-80 errdisable detect cause 2-82 errdisable recovery 2-84 flowcontrol 2-86 interface port-channel 2-88 interface range 2-90 interface vlan 2-93 ip access-group 2-95 ip address 2-98 ip igmp filter 2-100 ip igmp max-groups 2-101 ip igmp profile 2-102 ip igmp snooping 2-104 lacp port-priority 2-107 lacp system-priority 2-109 logging file 2-111 mac access-group 2-113 mac access-list extended 2-115 mac-address-table aging-time 2-117 mac-address-table notification 2-118 mac-address-table static 2-120 match (access-map configuration) 2-121 match (class-map configuration) 2-123Contents vi Catalyst 3750 Switch Command Reference 78-15165-02 mdix auto 2-125 mls qos 2-127 mls qos aggregate-policer 2-129 mls qos cos 2-131 mls qos dscp-mutation 2-133 mls qos map 2-135 mls qos queue-set output buffers 2-138 mls qos queue-set output threshold 2-140 mls qos srr-queue input bandwidth 2-142 mls qos srr-queue input buffers 2-144 mls qos srr-queue input cos-map 2-146 mls qos srr-queue input dscp-map 2-148 mls qos srr-queue input priority-queue 2-150 mls qos srr-queue input threshold 2-152 mls qos srr-queue output cos-map 2-154 mls qos srr-queue output dscp-map 2-156 mls qos trust 2-158 monitor session 2-160 mvr (global configuration) 2-165 mvr (interface configuration) 2-168 pagp learn-method 2-171 pagp port-priority 2-173 permit 2-175 police 2-178 police aggregate 2-180 policy-map 2-182 port-channel load-balance 2-184 queue-set 2-186 rcommand 2-187 reload 2-189 remote command 2-190 remote-span 2-191 rmon collection stats 2-193 sdm prefer 2-194 service password-recovery 2-197Contents vii Catalyst 3750 Switch Command Reference 78-15165-02 service-policy 2-199 session 2-201 set 2-202 setup 2-204 setup express 2-207 show access-lists 2-209 show auto qos 2-212 show boot 2-215 show class-map 2-217 show cluster 2-218 show cluster candidates 2-220 show cluster members 2-222 show controllers cpu-interface 2-224 show controllers ethernet-controller 2-226 show controllers tcam 2-230 show dot1x 2-232 show dtp 2-235 show env 2-237 show errdisable detect 2-239 show errdisable flap-values 2-241 show errdisable recovery 2-243 show etherchannel 2-245 show interfaces 2-248 show interfaces counters 2-254 show ip igmp profile 2-257 show ip igmp snooping 2-258 show ip igmp snooping mrouter 2-260 show ip igmp snooping multicast 2-261 show lacp 2-263 show mac access-group 2-267 show mac-address-table 2-269 show mac-address-table address 2-271 show mac-address-table aging-time 2-273 show mac-address-table count 2-275 show mac-address-table dynamic 2-277Contents viii Catalyst 3750 Switch Command Reference 78-15165-02 show mac-address-table interface 2-279 show mac-address-table multicast 2-281 show mac-address-table notification 2-283 show mac-address-table static 2-285 show mac-address-table vlan 2-287 show mls qos 2-289 show mls qos aggregate-policer 2-290 show mls qos input-queue 2-291 show mls qos interface 2-293 show mls qos maps 2-296 show mls qos queue-set 2-299 show monitor 2-301 show mvr 2-304 show mvr interface 2-306 show mvr members 2-308 show pagp 2-310 show policy-map 2-312 show port-security 2-314 show running-config vlan 2-317 show sdm prefer 2-319 show setup express 2-322 show spanning-tree 2-323 show storm-control 2-329 show switch 2-331 show system mtu 2-334 show udld 2-335 show version 2-338 show vlan 2-340 show vlan access-map 2-344 show vlan filter 2-345 show vmps 2-346 show vtp 2-349 shutdown 2-353 shutdown vlan 2-354 snmp-server enable traps 2-355Contents ix Catalyst 3750 Switch Command Reference 78-15165-02 snmp-server host 2-358 snmp trap mac-notification 2-362 spanning-tree backbonefast 2-364 spanning-tree bpdufilter 2-365 spanning-tree bpduguard 2-367 spanning-tree cost 2-369 spanning-tree extend system-id 2-371 spanning-tree guard 2-373 spanning-tree link-type 2-375 spanning-tree loopguard default 2-377 spanning-tree mode 2-379 spanning-tree mst configuration 2-381 spanning-tree mst cost 2-383 spanning-tree mst forward-time 2-385 spanning-tree mst hello-time 2-386 spanning-tree mst max-age 2-387 spanning-tree mst max-hops 2-389 spanning-tree mst port-priority 2-391 spanning-tree mst priority 2-393 spanning-tree mst root 2-394 spanning-tree port-priority 2-396 spanning-tree portfast (global configuration) 2-398 spanning-tree portfast (interface configuration) 2-400 spanning-tree uplinkfast 2-402 spanning-tree vlan 2-404 speed 2-407 srr-queue bandwidth limit 2-409 srr-queue bandwidth shape 2-411 srr-queue bandwidth share 2-413 storm-control 2-415 switch priority 2-417 switch renumber 2-418 switchport 2-420 switchport access 2-422 switchport block 2-424Contents x Catalyst 3750 Switch Command Reference 78-15165-02 switchport host 2-425 switchport mode 2-426 switchport nonegotiate 2-428 switchport port-security 2-430 switchport port-security aging 2-434 switchport priority extend 2-436 switchport protected 2-438 switchport trunk 2-440 switchport voice vlan 2-443 system mtu 2-445 traceroute mac 2-447 traceroute mac ip 2-450 trust 2-453 udld (global configuration) 2-455 udld (interface configuration) 2-457 udld reset 2-459 vlan (global configuration) 2-460 vlan (VLAN configuration) 2-466 vlan access-map 2-472 vlan database 2-474 vlan filter 2-477 vmps reconfirm (privileged EXEC) 2-479 vmps reconfirm (global configuration) 2-480 vmps retry 2-481 vmps server 2-482 vtp (global configuration) 2-484 vtp (VLAN configuration) 2-488 A P P E N D I X A Boot Loader Commands A-1 boot A-2 cat A-4 copy A-5 delete A-6 dir A-7 flash_init A-9 format A-10Contents xi Catalyst 3750 Switch Command Reference 78-15165-02 fsck A-11 help A-12 load_helper A-13 memory A-14 mkdir A-16 more A-17 rename A-18 reset A-19 rmdir A-20 set A-21 type A-24 unset A-25 version A-27 A P P E N D I X B Debug Commands B-1 debug autoqos B-2 debug cluster B-4 debug dot1x B-6 debug dtp B-7 debug etherchannel B-8 debug interface B-9 debug ip igmp filter B-10 debug ip igmp max-groups B-11 debug ip igmp snooping B-12 debug lacp B-13 debug mac-notification B-14 debug matm B-15 debug monitor B-16 debug mvrdbg B-17 debug nvram B-18 debug pagp B-19 debug platform acl B-20 debug platform cli-redirection main B-21 debug platform configuration B-22 debug platform cpu-queues B-23 debug platform device-manager B-25Contents xii Catalyst 3750 Switch Command Reference 78-15165-02 debug platform dot1x B-26 debug platform etherchannel B-27 debug platform fallback-bridging B-28 debug platform forw-tcam B-29 debug platform ip igmp snooping B-30 debug platform ip multicast B-32 debug platform ip unicast B-34 debug platform ipc B-36 debug platform led B-37 debug platform matm B-38 debug platform messaging application B-39 debug platform phy B-40 debug platform pm B-42 debug platform port-asic B-44 debug platform port-security B-45 debug platform qos-acl-tcam B-46 debug platform remote-commands B-47 debug platform resource-manager B-48 debug platform snmp B-49 debug platform span B-50 debug platform stack-manager B-51 debug platform supervisor-asic B-52 debug platform sw-bridge B-53 debug platform tcam B-54 debug platform udld B-57 debug platform vlan B-58 debug pm B-59 debug port-security B-61 debug qos-manager B-62 debug spanning-tree B-63 debug spanning-tree backbonefast B-65 debug spanning-tree bpdu B-66 debug spanning-tree bpdu-opt B-67 debug spanning-tree mstp B-68 debug spanning-tree switch B-70Contents xiii Catalyst 3750 Switch Command Reference 78-15165-02 debug spanning-tree uplinkfast B-72 debug sw-vlan B-73 debug sw-vlan ifs B-75 debug sw-vlan notification B-76 debug sw-vlan vtp B-78 debug udld B-80 debug vqpc B-82 A P P E N D I X C Show Platform Commands C-1 show platform acl C-2 show platform configuration C-3 show platform etherchannel C-4 show platform forward C-5 show platform ip igmp snooping C-7 show platform ip multicast C-9 show platform ip unicast C-10 show platform ipc trace C-12 show platform layer4op C-13 show platform mac-address-table C-14 show platform messaging C-15 show platform monitor C-16 show platform mvr table C-17 show platform pm C-18 show platform port-asic C-19 show platform port-security C-24 show platform qos C-25 show platform resource-manager C-26 show platform snmp counters C-28 show platform spanning-tree C-29 show platform stp-instance C-30 show platform stack-manager C-31 show platform tb C-33 show platform tcam C-35 show platform vlan C-38 IN D E XContents xiv Catalyst 3750 Switch Command Reference 78-15165-02xv Catalyst 3750 Switch Command Reference 78-15165-02 Preface Audience This guide is for the networking professional using the Cisco IOS command-line interface (CLI) to manage the Catalyst 3750 switch, hereafter referred to as the switch. Before using this guide, you should have experience working with the Cisco IOS commands and the switch software features. Before using this guide, you should have experience working with the concepts and terminology of Ethernet and local area networking. Purpose The Catalyst 3750 switch is supported by either the standard multilayer image (SMI) or the enhanced multilayer image (EMI). The SMI provides Layer 2+ features including access control lists (ACLs), quality of service (QoS), static routing, and the Routing Information Protocol (RIP). The EMI provides a richer set of enterprise-class features. It includes Layer 2+ features and full Layer 3 routing (IP unicast routing, IP multicast routing, and fallback bridging). To distinguish it from the Layer 2+ static routing and RIP, the EMI includes protocols such as the Enhanced Interior Gateway Routing Protocol (EIGRP) and Open Shortest Path First (OSPF) Protocol. This guide provides the information you need about the Layer 2 and Layer 3 commands that have been created or changed for use with the Catalyst 3750 switches. For information about the standard IOS Release 12.1 commands, refer to the IOS documentation set available from the Cisco.com home page by selecting Service and Support > Technical Documents. On the Cisco Product Documentation home page, select Release 12.1 from the Cisco IOS Software drop-down list. This guide does not provide procedures for configuring your switch. For detailed configuration procedures, refer to the software configuration guide for this release. This guide does not describe system messages you might encounter. For more information, refer to the system message guide for this release.xvi Catalyst 3750 Switch Command Reference 78-15165-02 Preface Conventions Conventions This publication uses these conventions to convey instructions and information: Command descriptions use these conventions: • Commands and keywords are in boldface text. • Arguments for which you supply values are in italic. • Square brackets ([ ]) means optional elements. • Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements. • Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional element. Interactive examples use these conventions: • Terminal sessions and system displays are in screen font. • Information you enter is in boldface screen font. • Nonprinting characters, such as passwords or tabs, are in angle brackets (< >). Notes, cautions, and warnings use these conventions and symbols: Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual. Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Timesaver Means the following will help you solve a problem. The tips information might not be troubleshooting or even an action, but could be useful information.xvii Catalyst 3750 Switch Command Reference 78-15165-02 Preface Related Publications Related Publications These documents provide complete information about the switch and are available from this Cisco.com site: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/index.htm You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com site and from the telephone numbers listed in the “Ordering Documentation” section on page xviii. • Release Notes for the Catalyst 3750 Switch (not orderable but available on Cisco.com) • Catalyst 3750 Switch Software Configuration Guide (order number DOC-7815164=) • Catalyst 3750 Switch Command Reference (order number DOC-7815165=) • Catalyst 3750 Switch System Message Guide (order number DOC-7815166=) • Cluster Management Suite (CMS) online help (available only from the switch CMS software) • Catalyst 3750 Switch Hardware Installation Guide (order number DOC-7815136=) • Cisco Small Form-Factor Pluggable Modules Installation Notes (not orderable but available on Cisco.com) Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL: http://www.cisco.com International Cisco websites can be accessed from this URL: http://www.cisco.com/public/countries_languages.shtml Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription. Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html All users can order annual or quarterly subscriptions through the online Subscription Store: http://www.cisco.com/go/subscriptionxviii Catalyst 3750 Switch Command Reference 78-15165-02 Preface Obtaining Technical Assistance Ordering Documentation You can find instructions for ordering documentation at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways: • Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace: http://www.cisco.com/en/US/partner/ordering/index.shtml • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can send your comments in e-mail to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Obtaining Technical Assistance For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. Cisco TAC Website The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year. Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL: http://tools.cisco.com/RPF/register/register.doxix Catalyst 3750 Switch Command Reference 78-15165-02 Preface Obtaining Additional Publications and Information Opening a TAC Case The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer. For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly. To open a case by telephone, use one of the following numbers: Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55 USA: 1 800 553-2447 For a complete listing of Cisco TAC contacts, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml TAC Case Priority Definitions To ensure that all cases are reported in a standard format, Cisco has established case priority definitions. Priority 1 (P1)—Your network is “down” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels. Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. • The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: http://www.cisco.com/en/US/products/products_catalog_links_launch.html • Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: http://www.ciscopress.comxx Catalyst 3750 Switch Command Reference 78-15165-02 Preface Obtaining Additional Publications and Information • Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL: http://www.cisco.com/go/packet • iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL: http://www.cisco.com/go/iqmagazine • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html • Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL: http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.htmlC H A P T E R 1-1 Catalyst 3750 Switch Command Reference 78-15165-02 1 Using the Command-Line Interface The Catalyst 3750 switch is supported by Cisco IOS software. This chapter describes how to use the switch command-line interface (CLI) to configure software features. For a complete description of the commands that support these features, see Chapter 2, “Cisco IOS Commands.” For information on the boot loader commands, see Appendix A, “Boot Loader Commands.” For information on the debug commands, see Appendix B, “Debug Commands.” For information on the show platform commands, see Appendix C, “Show Platform Commands.” For more information on Cisco IOS Release 12.1, refer to the Cisco IOS Release 12.1 Command Summary. For task-oriented configuration steps, refer to the software configuration guide for this release. Accessing the Switch You manage the switch stack and the stack member interfaces through the stack master. You cannot manage stack members on an individual switch basis. You can connect to the stack master through the console port of one or more stack members. Be careful with using multiple CLI sessions to the stack master. Commands you enter in one session are not displayed in the other sessions. Therefore, it is possible to lose track of the session from which you entered commands. Note We recommend using one CLI session when managing the switch stack. If you want to configure a specific stack member port, you must include the stack member number in the CLI command interface notation. For more information about interface notations, refer to the “Configuring Interfaces” chapter in the software configuration guide for this release. To debug a specific stack member, you can access it from the stack master by using the session stack-member-number privileged EXEC command. The stack member number is appended to the system prompt. For example, Switch-2# is the prompt in privileged EXEC mode for stack member 2, and the system prompt for the stack master is Switch. Only the show and debug commands are available in a CLI session to a specific stack member.1-2 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 1 Using the Command-Line Interface CLI Command Modes CLI Command Modes This section describes the CLI command mode structure. Command modes support specific Cisco IOS commands. For example, the interface interface-id command only works when entered in global configuration mode. These are the main command modes for the switch: • User EXEC • Privileged EXEC • Global configuration • Interface configuration • Config-vlan • VLAN configuration • Line configuration Table 1-1 lists the main command modes, how to access each mode, the prompt you see in that mode, and how to exit that mode. The prompts listed use the default name Switch. Table 1-1 Command Modes Summary Command Mode Access Method Prompt Exit or Access Next Mode User EXEC This is the first level of access. (For the switch) Change terminal settings, perform basic tasks, and list system information. Switch> Enter the logout command. To enter privileged EXEC mode, enter the enable command. Privileged EXEC From user EXEC mode, enter the enable command. Switch# To exit to user EXEC mode, enter the disable command. To enter global configuration mode, enter the configure command. Global configuration From privileged EXEC mode, enter the configure command. Switch(config)# To exit to privileged EXEC mode, enter the exit or end command, or press Ctrl-Z. To enter interface configuration mode, enter the interface configuration command. Interface configuration From global configuration mode, specify an interface by entering the interface command followed by an interface identification. Switch(config-if)# To exit to privileged EXEC mode, enter the end command, or press Ctrl-Z. To exit to global configuration mode, enter the exit command. Config-vlan In global configuration mode, enter the vlan vlan-id command. Switch(config-vlan)# To exit to global configuration mode, enter the exit command. To return to privileged EXEC mode, enter the end command, or press Ctrl-Z.1-3 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 1 Using the Command-Line Interface CLI Command Modes User EXEC Mode After you access the device, you are automatically in user EXEC command mode. The EXEC commands available at the user level are a subset of those available at the privileged level. In general, use the user EXEC commands to temporarily change terminal settings, perform basic tests, and list system information. The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch> ? Privileged EXEC Mode Because many of the privileged commands configure operating parameters, privileged access should be password-protected to prevent unauthorized use. The privileged command set includes those commands contained in user EXEC mode, as well as the configure privileged EXEC command through which you access the remaining command modes. If your system administrator has set a password, you are prompted to enter it before being granted access to privileged EXEC mode. The password does not appear on the screen and is case sensitive. The privileged EXEC mode prompt is the device name followed by the pound sign (#). Switch# Enter the enable command to access privileged EXEC mode: Switch> enable Switch# The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch# ? To return to user EXEC mode, enter the disable privileged EXEC command. VLAN configuration From privileged EXEC mode, enter the vlan database command. Switch(vlan)# To exit to privileged EXEC mode, enter the exit command. Line configuration From global configuration mode, specify a line by entering the line command. Switch(config-line)# To exit to global configuration mode, enter the exit command. To return to privileged EXEC mode, enter the end command, or press Ctrl-Z. Table 1-1 Command Modes Summary (continued) Command Mode Access Method Prompt Exit or Access Next Mode1-4 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 1 Using the Command-Line Interface CLI Command Modes Global Configuration Mode Global configuration commands apply to features that affect the device as a whole. Use the configure privileged EXEC command to enter global configuration mode. The default is to enter commands from the management console. When you enter the configure command, a message prompts you for the source of the configuration commands: Switch# configure Configuring from terminal, memory, or network [terminal]? You can specify either the terminal or nonvolatile RAM (NVRAM) as the source of configuration commands. This example shows you how to access global configuration mode: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch(config)# ? To exit global configuration command mode and to return to privileged EXEC mode, enter the end or exit command, or press Ctrl-Z. Interface Configuration Mode Interface configuration commands modify the operation of the interface. Interface configuration commands always follow a global configuration command, which defines the interface type. Use the interface interface-id command to access interface configuration mode. The new prompt means interface configuration mode. Switch(config-if)# The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch(config-if)# ? To exit interface configuration mode and to return to global configuration mode, enter the exit command. To exit interface configuration mode and to return to privileged EXEC mode, enter the end command, or press Ctrl-Z.1-5 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 1 Using the Command-Line Interface CLI Command Modes config-vlan Mode Use this mode to configure normal-range VLANs (VLAN IDs 1 to 1005) or, when VTP mode is transparent, to configure extended-range VLANs (VLAN IDs 1006 to 4094). When VTP mode is transparent, the VLAN and VTP configuration is saved in the running configuration file, and you can save it to the switch startup configuration file by using the copy running-config startup-config privileged EXEC command. The configurations of VLAN IDs 1 to 1005 are saved in the VLAN database if VTP is in transparent or server mode. The extended-range VLAN configurations are not saved in the VLAN database. Enter the vlan vlan-id global configuration command to access config-vlan mode: Switch(config)# vlan 2000 Switch(config-vlan)# The supported keywords can vary but are similar to the commands available in VLAN configuration mode. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch(config-vlan)# ? For extended-range VLANs, all characteristics except the MTU size must remain at the default setting. To return to global configuration mode, enter exit; to return to privileged EXEC mode, enter end. All the commands except shutdown take effect when you exit config-vlan mode. VLAN Configuration Mode You can use the VLAN configuration commands to create or modify VLAN parameters for VLAN IDs 1 to 1005. Enter the vlan database privileged EXEC command to access VLAN configuration mode: Switch# vlan database Switch(vlan)# The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch(vlan)# ? To return to privileged EXEC mode, enter the abort VLAN configuration command to abandon the proposed database. Otherwise, enter exit to implement the proposed new VLAN database and to return to privileged EXEC mode. When you enter exit or apply, the configuration is saved in the VLAN database; configuration from VLAN configuration mode cannot be saved in the switch configuration file.1-6 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 1 Using the Command-Line Interface CLI Command Modes Line Configuration Mode Line configuration commands modify the operation of a terminal line. Line configuration commands always follow a line command, which defines a line number. Use these commands to change terminal parameter settings line-by-line or for a range of lines. Use the line vty line_number [ending_line_number] command to enter line configuration mode. The new prompt means line configuration mode. The following example shows how to enter line configuration mode for virtual terminal line 7: Switch(config)# line vty 0 7 The supported commands can vary depending on the version of software in use. To view a comprehensive list of commands, enter a question mark (?) at the prompt. Switch(config-line)# ? To exit line configuration mode and to return to global configuration mode, use the exit command. To exit line configuration mode and to return to privileged EXEC mode, enter the end command, or press Ctrl-Z. C H A P T E R 2-1 Catalyst 3750 Switch Command Reference 78-15165-02 2 Cisco IOS Commands aaa authentication dot1x Use the aaa authentication dot1x global configuration command on the switch stack or on a standalone switch to specify one or more authentication, authorization, and accounting (AAA) methods for use on interfaces running IEEE 802.1X. Use the no form of this command to disable authentication. aaa authentication dot1x {default} method1 [method2...] no aaa authentication dot1x {default} Syntax Description Note Though visible in the command-line help strings, the group tacacs+ keyword is not supported. Defaults No authentication is performed. Command Modes Global configuration default Use the listed authentication methods that follow this argument as the default list of methods when a user logs in. method1 [method2...] At least one of the these keywords: • enable—Use the enable password for authentication. • group radius—Use the list of all Remote Authentication Dial-In User Service (RADIUS) servers for authentication. • line—Use the line password for authentication. • local—Use the local username database for authentication. • local-case—Use the case-sensitive local username database for authentication. • none—Use no authentication. The client is automatically authenticated by the switch without using the information supplied by the client.2-2 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands aaa authentication dot1x Command History Usage Guidelines The method argument identifies the list of methods that the authentication algorithm tries in the given sequence to validate the password provided by the client. The only method that is truly 802.1X-compliant is the group radius method, in which the client data is validated against a RADIUS authentication server. The remaining methods enable AAA to authenticate the client by using locally configured data. For example, the local and local-case methods use the username and password that are saved in the IOS configuration file. The enable and line methods use the enable and line passwords for authentication. If you specify group radius, you must configure the RADIUS server by entering the radius-server host global configuration command. If you are not using a RADIUS server, you can use the local or local-case methods, which access the local username database to perform authentication. By specifying the enable or line methods, you can supply the clients with a password to provide access to the switch. Use the show running-config privileged EXEC command to display the configured lists of authentication methods. Examples This example shows how to enable AAA and how to create an authentication list for 802.1X. This authentication first tries to contact a RADIUS server. If this action returns an error, the user is allowed access with no authentication. Switch(config)# aaa new-model Switch(config)# aaa authentication dot1x default group radius none You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description aaa new-model Enables the AAA access control model. For syntax information, refer to the Cisco IOS Security Command Reference for Release 12.1 > Authentication, Authorization, and Accounting > Authentication Commands. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-3 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands action action Use the action access map configuration command on the switch stack or on a standalone switch to set the action for the VLAN access map entry. Use the no form of this command to set the action to the default value, which is to forward. action {drop | forward} no action Syntax Description Defaults The default action is to forward packets. Command Modes Access-map configuration Command History Usage Guidelines You enter access-map configuration mode by using the vlan access-map global configuration command. If the action is drop, you should define the access map, including configuring any access control list (ACL) names in match clauses, before applying the map to a VLAN, or all packets could be dropped. In access map configuration mode, use the match access map configuration command to define the match conditions for a VLAN map. Use the action command to set the action that occurs when a packet matches the conditions. The drop and forward parameters are not used in the no form of the command. Examples This example shows how to identify and apply a VLAN access map vmap4 to VLANs 5 and 6 that causes the VLAN to forward an IP packet if the packet matches the conditions defined in access list al2: Switch(config)# vlan access-map vmap4 Switch(config-access-map)# match ip address al2 Switch(config-access-map)# action forward Switch(config-access-map)# exit Switch(config)# vlan filter vmap4 vlan-list 5-6 You can verify your settings by entering the show vlan access-map privileged EXEC command. drop Drop the packet when the specified conditions are matched. forward Forward the packet when the specified conditions are matched. Release Modification 12.1(11)AX This command was first introduced.2-4 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands action Related Commands Command Description access-list {deny | permit} Configures a standard numbered ACL. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. ip access-list Creates a named access list. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. mac access-list extended Creates a named MAC address access list. match (access-map configuration) Defines the match conditions for a VLAN map. show vlan access-map Displays the VLAN access maps created on the switch. vlan access-map Creates a VLAN access map.2-5 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive copy-sw archive copy-sw Use the archive copy-sw privileged EXEC command on the stack master to copy the running image from the Flash memory on one stack member to the Flash memory on one or more other stack members. archive copy-sw source stack-member-number /destination-system {/force-reload | /leave-old-sw | /no-set-boot | overwrite | /reload | /safe} destination-stack-member-number Syntax Description Command Modes Privileged EXEC Command History /destination-system destination-stackmember-number The number of the stack member to which to copy the running image. The range is 1 to 9. /force-reload Unconditionally force a system reload after successfully downloading the software image. /leave-old-sw Keep the old software version after a successful download. /no-set-boot Do not alter the setting of the BOOT environment variable to point to the new software image after it is successfully downloaded. /overwrite Overwrite the software image in Flash memory with the downloaded one. /reload Reload the system after successfully downloading the image unless the configuration has been changed and not been saved. /safe Keep the current software image; do not delete it to make room for the new software image before the new image is downloaded. The current image is deleted after the download. source-stack-membernumber The number of the stack member from which to copy the running image. The range is 1 to 9. Release Modification 12.1(11)AX This command was first introduced.2-6 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive copy-sw Usage Guidelines The current software image is not overwritten with the downloaded image. Both the software image and HTML files are downloaded. The new image is downloaded to the flash: file system. The BOOT environment variable is changed to point to the new software image on the flash: file system. Image names are case sensitive; the image file is provided in tar format. You can copy the image to more than one specific stack member by repeating the /destination-system destination-stack-member-number option in the command for each stack member to be upgraded. If you do not specify the destination-stack-member-number, the default is to copy the running image file to all stack members. Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient Flash memory. If leaving the software in place would prevent the new image from fitting in Flash memory due to space constraints, an error results. If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the “delete” section on page 2-60. Use the /overwrite option to overwrite the image on the Flash device with the downloaded one. If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch Flash device or is not running on any stack members. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded. After downloading a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive download-sw command. Examples This example shows how to copy the running image from stack member 6 to stack member 8: Switch# archive copy-sw 6 /destination-system 8 Related Commands Command Description archive download-sw Downloads a new image to the switch. archive tar Creates a tar file, lists the files in a tar file, or extracts the files from a tar file. archive upload-sw Uploads an existing image on the switch to a server. delete Deletes a file or directory on the Flash memory device.2-7 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive download-sw archive download-sw Use the archive download-sw privileged EXEC command on the switch stack or on a standalone switch to download a new image to the switch or switch stack and to overwrite or keep the existing image. archive download-sw {/force-reload | /imageonly | /leave-old-sw | /no-set-boot | /no-version-check | /destination-system stack-member-number | /only-system-type system-type | /overwrite | /reload | /safe} source-url Syntax Description /force-reload Unconditionally force a system reload after successfully downloading the software image. /imageonly Download only the software image but not the HTML files associated with the Cluster Management Suite (CMS). The HTML files for the existing version are deleted only if the existing version is being overwritten or removed. /leave-old-sw Keep the old software version after a successful download. /no-set-boot Do not alter the setting of the BOOT environment variable to point to the new software image after it is successfully downloaded. /no-version-check Download the software image without checking the compatibility of the stack protocol version on the image and on the switch stack. /destination-system stack-member-number Specify the specific stack member to be upgraded. The range is 1 to 9. /only-system-type system-type Specify the specific system type to be upgraded. The range is 0 to FFFFFFFF. /overwrite Overwrite the software image in Flash memory with the downloaded one. /reload Reload the system after successfully downloading the image unless the configuration has been changed and not been saved. /safe Keep the current software image; do not delete it to make room for the new software image before the new image is downloaded. The current image is deleted after the download. source-url The source URL alias for a local or network file system. These options are supported: • The syntax for the local Flash file system on the standalone switch or the stack master: flash: The syntax for the local Flash file system on a stack member: flash member number: • The syntax for the File Transfer Protocol (FTP): ftp:[[//username[:password]@location]/directory]/image-name.tar • The syntax for the Remote Copy Protocol (RCP): rcp:[[//username@location]/directory]/image-name.tar • The syntax for the Trivial File Transfer Protocol (TFTP): tftp:[[//location]/directory]/image-name.tar The image-name.tar is the software image to download and install on the switch.2-8 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive download-sw Defaults The current software image is not overwritten with the downloaded image. Both the software image and HTML files are downloaded. The new image is downloaded to the flash: file system. The BOOT environment variable is changed to point to the new software image on the flash: file system. Image names are case sensitive; the image file is provided in tar format. Compatibility of the stack protocol version on the image to be downloaded is checked with the version on the switch stack. Command Modes Privileged EXEC Command History Usage Guidelines The /imageonly option removes the HTML files for the existing image if the existing image is being removed or replaced. Only the IOS image (without the HTML files) is downloaded. Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient Flash memory. If leaving the software in place prevents the new image from fitting in Flash memory due to space constraints, an error results. If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the “delete” section on page 2-60. Use the /no-version-check option if you want to download an image that has a different stack protocol version than the one existing on the switch stack. You must use this option with the /destination-system option to specify the specific stack member to be upgraded with the image. Note Use the /no-version-check option with care. All stack members, including the stack master, must have the same stack protocol version to be in the same switch stack. This option allows an image to be downloaded without first confirming the compatibility of its stack protocol version with the version of the switch stack. You can upgrade more than one specific stack member by repeating the /destination-system option in the command for each stack member to be upgraded. Use the /overwrite option to overwrite the image on the Flash device with the downloaded one. If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch Flash device or is not running on any stack members. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded. After downloading a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive download-sw command. Release Modification 12.1(11)AX This command was first introduced.2-9 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive download-sw Examples This example shows how to download a new image from a TFTP server at 172.20.129.10 and overwrite the image on the switch: Switch# archive download-sw /overwrite tftp://172.20.129.10/test-image.tar This example shows how to download only the software image from a TFTP server at 172.20.129.10 to the switch: Switch# archive download-sw /image-only tftp://172.20.129.10/test-image.tar This example shows how to keep the old software version after a successful download: Switch# archive download-sw /leave-old-sw tftp://172.20.129.10/test-image.tar This example shows how to specifically upgrade stack members 6 and 8: Switch# archive download-sw /image-only tftp://172.20.129.10/test-image.tar /destination-system 6 /destination-system 8 Related Commands Command Description archive copy-sw Copies the running image from the Flash memory on one stack member to the Flash memory on one or more other stack members. archive tar Creates a tar file, lists the files in a tar file, or extracts the files from a tar file. archive upload-sw Uploads an existing image on the switch to a server. delete Deletes a file or directory on the Flash memory device.2-10 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive tar archive tar Use the archive tar privileged EXEC command on the switch stack or on a standalone switch to create a tar file, list files in a tar file, or extract the files from a tar file. archive tar {/create destination-url flash:/file-url} | {/table source-url} | {/xtract source-url flash:/file-url} Syntax Description /create destination-url flash:/file-url Create a new tar file on the local or network file system. For destination-url, specify the destination URL alias for the local or network file system and the name of the tar file to create. These options are supported: • The syntax for the local Flash filesystem: flash: • The syntax for the File Transfer Protocol (FTP): ftp:[[//username[:password]@location]/directory]/tar-filename.tar • The syntax for the Remote Copy Protocol (RCP) is: rcp:[[//username@location]/directory]/tar-filename.tar • The syntax for the Trivial File Transfer Protocol (TFTP): tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to be created. For flash:/file-url, specify the location on the local Flash file system from which the new tar file is created. An optional list of files or directories within the source directory can be specified to write to the new tar file. If none are specified, all files and directories at this level are written to the newly created tar file.2-11 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive tar Defaults None Command Modes Privileged EXEC Command History /table source-url Display the contents of an existing tar file to the screen. For source-url, specify the source URL alias for the local or network file system. These options are supported: • The syntax for the local Flash file system: flash: • The syntax for the File Transfer Protocol (FTP) ftp:[[//username[:password]@location]/directory]/tar-filename.tar • The syntax for the Remote Copy Protocol (RCP): rcp:[[//username@location]/directory]/tar-filename.tar • The syntax for the Trivial File Transfer Protocol (TFTP): tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to display. /xtract source-url flash:/file-url Extract files from a tar file to the local or network file system. For source-url, specify the source URL alias for the local or network file system. These options are supported: • The syntax for the local Flash file system: flash: • The syntax for the File Transfer Protocol (FTP): ftp:[[//username[:password]@location]/directory]/tar-filename.tar • The syntax for the Remote Copy Protocol (RCP): rcp:[[//username@location]/directory]/tar-filename.tar • The syntax for the Trivial File Transfer Protocol (TFTP): tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file from which to extract. For flash:/file-url, specify the location on the local Flash file system into which the tar file is extracted. An optional list of files or directories within the tar file can be specified for extraction. If none are specified, all files and directories are extracted. Release Modification 12.1(11)AX This command was first introduced.2-12 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive tar Usage Guidelines Filenames and directory names are case sensitive. Image names are case sensitive. Examples This example shows how to create a tar file. The command writes the contents of the new-configs directory on the local Flash device to a file named saved.tar on the TFTP server at 172.20.10.30: Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs This example shows how to display the contents of the c3750-tv0-m.tar file that is in Flash memory. The contents of the tar file are displayed on the screen: Switch# archive tar /table flash:c3750-tv0-m.tar info (219 bytes) c3750-tv0-mz-121/ (directory) c3750-tv0-mz-121/html/ (directory) c3750-tv0-mz-121/html/foo.html (0 bytes) c3750-tv0-mz-121/vegas-tv0-mz-121.bin (610856 bytes) c3750-tv0-mz-121/info (219 bytes) info.ver (219 bytes) This example shows how to display only the c3750-tv0-mz-121/html directory and its contents: Switch# archive tar /table flash:c3750-tv0-m.tar c3750-tv0-mz-121/html c3750-tv0-mz-121/html/ (directory) c3750-tv0-mz-121/html/foo.html (0 bytes) This example shows how to extract the contents of a tar file on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local Flash file system. The remaining files in the saved.tar file are ignored. Switch# archive tar /xtract tftp:/172.20.10.30/saved.tar flash:/ new-configs Related Commands Command Description archive copy-sw Copies the running image from the Flash memory on one stack member to the Flash memory on one or more other stack members. archive download-sw Downloads a new image to the switch. archive upload-sw Uploads an existing image on the switch to a server.2-13 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive upload-sw archive upload-sw Use the archive upload-sw privileged EXEC command on the switch stack or on a standalone switch to upload an existing switch image to a server. archive upload-sw [/source-system-num stack member number | /version version_string] destination-url Syntax Description Defaults Uploads the currently running image from the flash: file system. Command Modes Privileged EXEC Command History /source-system-num stack member number Specify the specific stack member containing the image that is to be uploaded. /version version_string (Optional) Specify the specific version string of the image to be uploaded. destination-url The destination URL alias for a local or network file system. These options are supported: • The syntax for the local Flash file system on the standalone switch or the stack master: flash: The syntax for the local Flash file system on a stack member: flash member number: • The syntax for the File Transfer Protocol (FTP): ftp:[[//username[:password]@location]/directory]/image-name.tar • The syntax for the Remote Copy Protocol (RCP): rcp:[[//username@location]/directory]/image-name.tar • The syntax for the Trivial File Transfer Protocol (TFTP): tftp:[[//location]/directory]/image-name.tar The image-name.tar is the name of software image to be stored on the server. Release Modification 12.1(11)AX This command was first introduced.2-14 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands archive upload-sw Usage Guidelines You must specify the /source-system-num option to use the /version option. Using these options together uploads the specified image, not the running image, of a specific stack member. The upload feature is available only if the HTML files associated with the Cluster Management Suite (CMS) have been installed with the existing image. The files are uploaded in this sequence: the IOS image, the HTML files, and info. After these files are uploaded, the software creates the tar file. Image names are case sensitive. Examples This example shows how to upload the currently running on stack member 6 image to a TFTP server at 172.20.140.2: Switch# archive upload-sw /source-system-num 6 tftp://172.20.140.2/test-image.tar Related Commands Command Description archive copy-sw Copies the running image from the Flash memory on one stack member to the Flash memory on one or more other stack members. archive download-sw Downloads a new image to the switch. archive tar Creates a tar file, lists the files in a tar file, or extracts the files from a tar file.2-15 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands auto qos voip auto qos voip Use the auto qos voip interface configuration command on the switch stack or on a standalone switch to automatically configure quality of service (QoS) for voice over IP (VoIP) within a QoS domain. Use the no form of this command to return to the default setting. auto qos voip {cisco-phone | trust} no auto qos voip [cisco-phone | trust] Syntax Description Defaults Auto-QoS is disabled on the interface. When auto-QoS is enabled, it uses the ingress packet label to categorize traffic, to assign packet labels, and to configure the ingress and egress queues as shown in Table 2-1. cisco-phone Identify this interface as connected to a Cisco IP phone, and automatically configure QoS for VoIP. The QoS labels of incoming packets are trusted only when the phone is detected. trust Identify this interface as connected to a trusted switch or router, and automatically configure QoS for VoIP. The QoS labels of incoming packets are trusted. For nonrouted interfaces, the CoS value of the incoming packet is trusted. For routed interfaces, the DSCP value of the incoming packet is trusted. Table 2-1 Traffic Types, Ingress Packet Labels, Assigned Packet Labels, and Queues VoIP Data Traffic VoIP Control Traffic Routing Protocol Traffic STP 1 BPDU 2 Traffic 1. STP = Spanning Tree Protocol 2. BPDU = bridge protocol data unit All Other Traffic Ingress DSCP 3 3. DSCP = Differentiated Services Code Point 46 26 – – – Ingress CoS 4 4. CoS = class of service 5 3 6 7 – DiffServ EF AF31 – – – Assigned DSCP 46 26 48 56 0 Assigned CoS 5 3 6 7 0 CoS-to-Ingress Queue Map 2, 3, 4, 5, 6, 7 (queue 2) 0, 1 (queue 1) CoS-to-Egress Queue Map 5 (queue 1) 3, 6, 7 (queue 2) 2, 4 (queue 3) 0, 1 (queue 4)2-16 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands auto qos voip Table 2-2 shows the generated auto-QoS configuration for the ingress queues. Table 2-3 shows the generated auto-QoS configuration for the egress queues. Command Modes Interface configuration Command History Usage Guidelines Use this command to configure the QoS appropriate for VoIP traffic within the QoS domain. The QoS domain includes the switch, the interior of the network, and edge devices that can classify incoming traffic for QoS. To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS commands. You can fine-tune the auto-QoS configuration after you enable auto-QoS. Note The switch applies the auto-QoS-generated commands as if the commands were entered from the command-line interface (CLI). An existing user configuration can cause the application of the generated commands to fail or to be overridden by the generated commands. These actions occur without warning. If all the generated commands are successfully applied, any user-entered configuration that was not overridden remains in the running configuration. Any user-entered configuration that was overridden can be retrieved by reloading the switch without saving the current configuration to memory. If the generated commands fail to be applied, the previous running configuration is restored. Table 2-2 Auto-QoS Configuration for the Ingress Queues Ingress Queue Queue Number CoS-to-Queue Map Queue Weight (Bandwidth) Queue (Buffer) Size SRR 1 shared 1. SRR = shaped round robin. Ingress queues support shared mode only. 1 0, 1 90 percent 90 percent Priority 2 2, 3, 4, 5, 6, 7 10 percent 10 percent Table 2-3 Auto-QoS Configuration for the Egress Queues Egress Queue Queue Number CoS-to-Queue Map Queue Weight (Bandwidth) Queue (Buffer) Size Priority (shaped) 1 5 10 percent 20 percent SRR shared 2 3, 6, 7 10 percent 20 percent SRR shared 3 2, 4 60 percent 20 percent SRR shared 4 0, 1 20 percent 40 percent Release Modification 12.1(14)EA1 This command was first introduced.2-17 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands auto qos voip If this is the first interface on which you have enabled auto-QoS, the auto-QoS-generated global configuration commands are executed followed by the interface configuration commands. If you enable auto-QoS on another interface, only the auto-QoS-generated interface configuration commands for that interface are executed. When you enable the auto-QoS feature on the first interface, these automatic actions occur: • QoS is globally enabled (mls qos global configuration command), and other global configuration commands are added. • When you enter the auto qos voip cisco-phone interface configuration command on a port at the edge of the network that is connected to a Cisco IP phone, the switch enables the trusted boundary feature. The switch uses the Cisco Discovery Protocol (CDP) to detect the presence or absence of a Cisco IP phone. When a Cisco IP phone is detected, the ingress classification on the interface is set to trust the QoS label received in the packet. When a Cisco IP phone is absent, the ingress classification is set to not trust the QoS label in the packet. The switch configures ingress and egress queues on the interface according to the settings in Table 2-2 and Table 2-3. • When you enter the auto qos voip trust interface configuration command on a port connected to the interior of the network, the switch trusts the CoS value for nonrouted interfaces or the DSCP value for routed interfaces in ingress packets (the assumption is that traffic has already been classified by other edge devices). The switch configures the ingress and egress queues on the interface according to the settings in Table 2-2 and Table 2-3. You can enable auto-QoS on static, dynamic-access, and voice VLAN access, and trunk ports. To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug autoqos privileged EXEC command to enable auto-QoS debugging. For more information, see the “debug autoqos” section on page B-2. To disable auto-QoS on an interface, use the no auto qos voip interface configuration command. Only the auto-QoS-generated interface configuration commands for this interface are removed. If this is the last interface on which auto-QoS is enabled and you enter the no auto qos voip command, auto-QoS is considered disabled even though the auto-QoS-generated global configuration commands remain (to avoid disrupting traffic on other interfaces affected by the global configuration). You can use the no mls qos global configuration command to disable the auto-QoS-generated global configuration commands. With QoS disabled, there is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing). Examples This example shows how to enable auto-QoS and to trust the QoS labels received in incoming packets when the switch or router connected to Gigabit Ethernet interface 0/1 on stack member 2 is a trusted device: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# auto qos voip trust You can verify your settings by entering the show auto qos interface interface-id privileged EXEC command.2-18 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands auto qos voip Related Commands Command Description debug autoqos Enables debugging of the auto-QoS feature. mls qos cos Defines the default CoS value of a port or assigns the default CoS to all incoming packets on the port. mls qos map {cos-dscp dscp1 ... dscp8 | dscp-cos dscp-list to cos} Defines the CoS-to-DSCP map or the DSCP-to-CoS map. mls qos queue-set output buffers Allocates buffers to a queue-set. mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps CoS values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps DSCP values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue output cos-map Maps CoS values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps DSCP values to an egress queue or maps DSCP values to a queue and to a threshold ID. mls qos trust Configures the port trust state. queue-set Maps a port to a queue-set. show auto qos Displays the initial configuration that is generated by the auto-QoS feature. show mls qos interface Displays QoS information at the interface level. srr-queue bandwidth shape Assigns the shaped weights and enables bandwidth shaping on the four egress queues mapped to a port. srr-queue bandwidth share Assigns the shared weights and enables bandwidth sharing on the four egress queues mapped to a port.2-19 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot auto-copy-sw boot auto-copy-sw Use the boot auto-copy-sw global configuration command from the stack master to automatically upgrade switches in version-mismatch (VM) mode with the switch stack image. Use the no form of this command to not automatically upgrade switches in VM mode. boot auto-copy-sw no boot auto-copy-sw Syntax Description This command has no arguments or keywords. Defaults Enabled. Command Modes Global configuration Command History Usage Guidelines A switch in version-mismatch (VM) mode is a switch that has a different stack protocol version than the version on the switch stack. Switches in VM mode cannot join the switch stack. If the switch stack has an image that can be copied to a switch in VM mode, this command automatically copies the switch in VM mode with the image from another stack member. The switch then exits VM mode, reboots, and joins the switch stack. This command affects only switches in VM mode. It does not affect existing stack members. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables. show version Displays version information for the hardware and firmware.2-20 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot boothlpr boot boothlpr Use the boot boothlpr global configuration command on the switch stack or on a standalone switch to load a special IOS image, which when loaded into memory, can load a second IOS image into memory and launch it. This variable is used only for internal development and testing. Use the no form of this command to return to the default setting. boot boothlpr filesystem:/file-url no boot boothlpr Syntax Description Defaults No helper image is loaded. Command Modes Global configuration Command History Usage Guidelines Filenames and directory names are case sensitive. This command changes the setting of the BOOTHLPR environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url The path (directory) and name of a bootable helper image. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-21 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot config-file boot config-file Use the boot config-file global configuration command on a standalone switch to specify the filename that IOS uses to read and write a nonvolatile copy of the system configuration. Use the no form of this command to return to the default setting. boot config-file flash:/file-url no boot config-file Syntax Description Defaults The default configuration file is flash:config.text. Command Modes Global configuration Command History Usage Guidelines This command works properly only from a standalone switch. Filenames and directory names are case sensitive. This command changes the setting of the CONFIG_FILE environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands flash:/file-url The path (directory) and name of the configuration file. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-22 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot enable-break boot enable-break Use the boot enable-break global configuration command on a standalone switch to enable interrupting the automatic boot process. Use the no form of this command to return to the default setting. boot enable-break no boot enable-break Syntax Description This command has no arguments or keywords. Defaults Disabled. The automatic boot process cannot be interrupted by pressing the Break key on the console. Command Modes Global configuration Command History Usage Guidelines This command works properly only from a standalone switch. When you enter this command, you can interrupt the automatic boot process by pressing the Break key on the console after the Flash file system is initialized. Note Despite the setting of this command, you can interrupt the automatic boot process at any time by pressing the MODE button on the switch front panel. This command changes the setting of the ENABLE_BREAK environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-23 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot helper boot helper Use the boot helper global configuration command on the switch stack or on a standalone switch to dynamically load files during boot loader initialization to extend or patch the functionality of the boot loader. Use the no form of this command to return to the default. boot helper filesystem:/file-url ... no boot helper Syntax Description Defaults No helper files are loaded. Command Modes Global configuration Command History Usage Guidelines This variable is used only for internal development and testing. Filenames and directory names are case sensitive. This command changes the setting of the HELPER environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url The path (directory) and a list of loadable files to dynamically load during loader initialization. Separate each image name with a semicolon. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-24 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot helper-config-file boot helper-config-file Use the boot helper-config-file global configuration command on the switch stack or on a standalone switch to specify the name of the configuration file to be used by the IOS helper image. If this is not set, the file specified by the CONFIG_FILE environment variable is used by all versions of IOS that are loaded. Use the no form of this command to return to the default setting. boot helper-config-file filesystem:/file-url no boot helper-config file Syntax Description Defaults No helper configuration file is specified. Command Modes Global configuration Command History Usage Guidelines This variable is used only for internal development and testing. Filenames and directory names are case sensitive. This command changes the setting of the HELPER_CONFIG_FILE environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url The path (directory) and helper configuration file to load. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-25 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot manual boot manual Use the boot manual global configuration command on a standalone switch to enable manually booting the switch during the next boot cycle. Use the no form of this command to return to the default setting. boot manual no boot manual Syntax Description This command has no arguments or keywords. Defaults Manual booting is disabled. Command Modes Global configuration Command History Usage Guidelines This command works properly only from a standalone switch. The next time you reboot the system, the switch is in boot loader mode, which is shown by the switch: prompt. To boot the system, use the boot boot loader command, and specify the name of the bootable image. This command changes the setting of the MANUAL_BOOT environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-26 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot private-config-file boot private-config-file Use the boot private-config-file global configuration command on a standalone switch to specify the filename that IOS uses to read and write a nonvolatile copy of the private configuration. Use the no form of this command to return to the default setting. boot private-config-file filename no boot private-config-file Syntax Description Defaults The default configuration file is private-config. Command Modes Global configuration Command History Usage Guidelines This command works properly only from a standalone switch. Filenames are case sensitive. Examples This example shows how to specify the name of the private configuration file to be pconfig: Switch(config)# boot private-config-file pconfig Related Commands filename The name of the private configuration file. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-27 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands boot system boot system Use the boot system global configuration command on a standalone switch to specify the IOS image to load during the next boot cycle. Use the no form of this command to return to the default setting. boot system filesystem:/file-url ... no boot system Syntax Description Defaults The switch attempts to automatically boot the system by using information in the BOOT environment variable. If this variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the Flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. Command Modes Global configuration Command History Usage Guidelines This command works properly only from a standalone switch. Filenames and directory names are case sensitive. If you are using the archive download-sw privileged EXEC command to maintain system images, you never need to use the boot system command. The boot system command is automatically manipulated to load the downloaded image. This command changes the setting of the BOOT environment variable. For more information, see Appendix A, “Boot Loader Commands.” Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url The path (directory) and name of a bootable image. Separate image names with a semicolon. Release Modification 12.1(11)AX This command was first introduced. Command Description show boot Displays the settings of the boot environment variables.2-28 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands channel-group channel-group Use the channel-group interface configuration command on the switch stack or on a standalone switch to assign an Ethernet interface to an EtherChannel group. Use the no form of this command to remove an Ethernet interface from an EtherChannel group. channel-group channel-group-number mode {active | {auto [non-silent] | desirable [non-silent] | on} | passive} no channel-group Syntax Description Defaults No channel groups are assigned. No mode is configured. channel-group-number Specify the channel group number. The range is 1 to 12. mode Specify the EtherChannel mode of the interface. active Unconditionally enable Link Aggregation Protocol (LACP). Active mode places an interface into a negotiating state in which the interface initiates negotiations with other interfaces by sending LACP packets. A channel is formed with another port group in either the active or passive mode. auto Enable the Port Aggregation Protocol (PAgP) only if a PAgP device is detected. Auto mode places an interface into a passive negotiating state in which the interface responds to PAgP packets it receives but does not start PAgP packet negotiation. A channel is formed only with another port group in desirable mode. When auto is enabled, silent operation is the default. desirable Unconditionally enable PAgP. Desirable mode places an interface into an active negotiating state in which the interface starts negotiations with other interfaces by sending PAgP packets. A channel is formed with another port group in either the desirable or auto mode. When desirable is enabled, silent operation is the default. non-silent (Optional) Used with the auto or desirable keyword when traffic is expected from the other device. on Force the interface to channel without PAgP or the LACP. With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode. passive Enable LACP only if a LACP device is detected. Passive mode places an interface into a negotiating state in which the interface responds to LACP packets it receives but does not initiate LACP packet negotiation. A channel is formed only with another port group in active mode. 2-29 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands channel-group Command Modes Interface configuration Command History Usage Guidelines For Layer 2 EtherChannels, you do not have to create a port-channel interface first by using the interface port-channel global configuration command before assigning a physical interface to a channel group. Instead, you can use the channel-group interface configuration command. It automatically creates the port-channel interface when the channel group gets its first physical interface if the logical interface is not already created. If you create the port-channel interface first, the channel-group-number can be the same as the port-channel-number, or you can use a new number. If you use a new number, the channel-group command dynamically creates a new port channel. You do not have to disable the IP address that is assigned to a physical interface that is part of a channel group, but we strongly recommend that you do so. You create Layer 3 port channels by using the interface port-channel command followed by the no switchport interface configuration command. You should manually configure the port-channel logical interface before putting the interface into the channel group. After you configure an EtherChannel, configuration changes that you make on the port-channel interface apply to all the physical interfaces assigned to the port-channel interface. Configuration changes applied to the physical interface affect only the interface where you apply the configuration. To change the parameters of all ports in an EtherChannel, apply configuration commands to the port-channel interface, for example, spanning-tree commands or commands to configure a Layer 2 EtherChannel as a trunk. If you do not specify non-silent with the auto or desirable mode, silent is assumed. The silent mode is used when the switch is connected to a device that is not PAgP-capable and seldom, if ever, sends packets. A example of a silent partner is a file server or a packet analyzer that is not generating traffic. In this case, running PAgP on a physical port prevents that port from ever becoming operational. However, it allows PAgP to operate, to attach the interface to a channel group, and to use the interface for transmission. Both ends of the link cannot be set to silent. With the on mode, a usable EtherChannel exists only when a port group in the on mode is connected to another port group in the on mode. The on keyword is the only setting that is supported when the EtherChannel members are from different switches in the switch stack (cross-stack EtherChannel). Caution You should exercise care when setting the mode to on (manual configuration). All ports configured in the on mode are bundled together in the same group and are forced to have similar characteristics. If the group is misconfigured, packet loss or spanning-tree loops might occur. Do not configure an EtherChannel in both the PAgP and LACP modes. EtherChannel groups running PAgP and LACP can coexist on the same switch or on different switches in the stack (but not in a cross-stack configuration). Individual EtherChannel groups can run either PAgP or LACP, but they cannot interoperate. If you set the protocol by using the channel-protocol interface configuration command, the setting is not overridden by the channel-group interface configuration command Do not configure a port that is an active member of an EtherChannel as an 802.1X port. If 802.1X is enabled on a not-yet active port of an EtherChannel, the port does not join the EtherChannel. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The active and passive keywords were added.2-30 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands channel-group Do not configure a secure port as part of an EtherChannel or an EtherChannel port as a secure port. For a complete list of configuration guidelines, refer to the “Configuring EtherChannels” chapter in the software guide for this release. Caution Do not enable Layer 3 addresses on the physical EtherChannel interfaces. Do not assign bridge groups on the physical EtherChannel interfaces because it creates loops. Examples This example shows how to configure EtherChannel on a single switch in the stack. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 as static-access ports in VLAN 10 to channel 5 with the PAgP mode desirable: Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode desirable Switch(config-if-range)# end This example shows how to configure EtherChannel on a single switch in the stack. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 as static-access ports in VLAN 10 to channel 5 with the LACP mode active: Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode active Switch(config-if-range)# end This example shows how to configure cross-stack EtherChannel. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 and Gigabit Ethernet interface 0/3 on stack member 3 as static-access ports in VLAN 10 to channel 5 with the PAgP and LACP modes disabled (on): Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode on Switch(config-if-range)# exit Switch(config)# interface gigabitethernet3/0/3 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# channel-group 5 mode on Switch(config-if)# exit You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description channel-protocol Restricts the protocol used on an interface to manage channeling. interface port-channel Accesses or creates the port channel. show etherchannel Displays EtherChannel information for a channel. show lacp Displays LACP channel-group information.2-31 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands channel-group show pagp Displays PAgP channel-group information. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. Command Description2-32 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands channel-protocol channel-protocol Use the channel-protocol interface configuration command on the switch stack or on a standalone switch to restrict the protocol used on an interface to manage channeling. Use the no form of this command to return to the default setting. channel-protocol {lacp | pagp} no channel-protocol Syntax Description Defaults No protocol is assigned to the EtherChannel. Command Modes Interface configuration Command History Usage Guidelines Use the channel-protocol command only to restrict a channel to LACP or PAgP. If you set the protocol by using the channel-protocol command, the setting is not overridden by the channel-group interface configuration command. You must use the channel-group interface configuration command to configure the EtherChannel parameters. The channel-group command also can set the mode for the EtherChannel. You cannot enable both the PAgP and LACP modes on an EtherChannel group. PAgP and LACP are not compatible; both ends of a channel must use the same protocol. Examples This example shows how to specify LACP as the protocol that manages the EtherChannel: Switch(config-if)# channel-protocol lacp You can verify your settings by entering the show etherchannel [channel-group-number] protocol privileged EXEC command. Related Commands lacp Configure an EtherChannel with the Link Aggregation Control Protocol (LACP). pagp Configure an EtherChannel with the Port Aggregation Protocol (PAgP). Release Modification 12.1(14)EA1 This command was first introduced. Command Description channel-group Assigns an Ethernet interface to an EtherChannel group. show etherchannel protocol Displays protocol information the EtherChannel.2-33 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands class class Use the class policy-map configuration command on the switch stack or on a standalone switch to define a traffic classification match criteria (through the police, set, and trust policy-map class configuration commands) for the specified class-map name. Use the no form of this command to delete an existing class map. class class-map-name no class class-map-name Syntax Description Defaults No policy map class-maps are defined. Command Modes Policy-map configuration Command History Usage Guidelines Before using the class command, you must use the policy-map global configuration command to identify the policy map and to enter policy-map configuration mode. After specifying a policy map, you can configure a policy for new classes or modify a policy for any existing classes in that policy map. You attach the policy map to an interface by using the service-policy interface configuration command. After entering the class command, you enter policy-map class configuration mode, and these configuration commands are available: • bandwidth: Although this command is displayed, it is not supported on Catalyst 3750 switches. • exit: exits policy-map class configuration mode and returns to policy-map configuration mode. • no: returns a command to its default setting. • police: defines a policer or aggregate policer for the classified traffic. The policer specifies the bandwidth limitations and the action to take when the limits are exceeded. For more information, see the police and police aggregate policy-map class commands. • set: specifies a value to be assigned to the classified traffic. For more information, see the set command. • trust: defines a trust state for traffic classified with the class or the class-map command. For more information, see the trust command. To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. The class command performs the same function as the class-map global configuration command. Use the class command when a new classification, which is not shared with any other ports, is needed. Use the class-map command when the map is shared among many ports. class-map-name Name of the class map. Release Modification 12.1(11)AX This command was first introduced.2-34 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands class Examples This example shows how to create a policy map called policy1. When attached to the ingress direction, it matches all the incoming traffic defined in class1, sets the IP Differentiated Services Code Point (DSCP) to 10, and polices the traffic at an average rate of 1 Mbps and bursts at 20 KB. Traffic exceeding the profile is marked down to a DSCP value obtained from the policed-DSCP map and then sent. Switch(config)# policy-map policy1 Switch(config-pmap)# class class1 Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit You can verify your settings by entering the show policy-map privileged EXEC command. Related Commands Command Description class-map Creates a class map to be used for matching packets to the class whose name you specify. police Defines a policer for classified traffic. policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. set Classifies IP traffic by setting a DSCP or IP-precedence value in the packet. show policy-map Displays quality of service (QoS) policy maps. trust Defines a trust state for the traffic classified through the class policy-map configuration command or the class-map global configuration command.2-35 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands class-map class-map Use the class-map global configuration command on the switch stack or on a standalone switch to create a class map to be used for matching packets to the class whose name you specify and to enter class-map configuration mode. Use the no form of this command to delete an existing class map and to return to global configuration mode. class-map [match-all | match-any] class-map-name no class-map [match-all | match-any] class-map-name Syntax Description Defaults No class maps are defined. If neither the match-all or match-any keyword is specified, the default is match-all. Command Modes Global configuration Command History Usage Guidelines Use this command to specify the name of the class for which you want to create or modify class-map match criteria and to enter class-map configuration mode. The class-map command and its subcommands are used to define packet classification, marking, and aggregate policing as part of a globally named service policy applied on a per-interface basis. After you are in quality of service (QoS) class-map configuration mode, these configuration commands are available: • description: describes the class map (up to 200 characters). The show class-map privileged EXEC command displays the description and the name of the class-map. • exit: exits from QoS class-map configuration mode. • match: configures classification criteria. For more information, see the match (class-map configuration) command. • no: removes a match statement from a class map. • rename: renames the current class map. If you rename a class map with a name that is already used, the message A class-map with this name already exists appears. match-all (Optional) Perform a logical-AND of all matching statements under this class map. All criteria in the class map must be matched. match-any (Optional) Perform a logical-OR of the matching statements under this class map. One or more criteria must be matched. class-map-name Name of the class map. Release Modification 12.1(11)AX This command was first introduced.2-36 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands class-map To define packet classification on a physical-port basis, only one match command per class map is supported. In this situation, the match-all and match-any keywords are equivalent. Only one access control list (ACL) can be configured in a class map. The ACL can have multiple access control entries (ACEs). Examples This example shows how to configure the class map called class1 with one match criterion, which is an access list called 103: Switch(config)# access-list 103 permit any any dscp 10 Switch(config)# class-map class1 Switch(config-cmap)# match access-group 103 Switch(config-cmap)# exit This example shows how to delete the class map class1: Switch(config)# no class-map class1 You can verify your settings by entering the show class-map privileged EXEC command. Related Commands Command Description class Defines a traffic classification match criteria (through the police, set, and trust policy-map class configuration commands) for the specified class-map name. match (class-map configuration) Defines the match criteria to classify traffic. policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. show class-map Displays QoS class maps.2-37 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear lacp clear lacp Use the clear lacp privileged EXEC command on the switch stack or on a standalone switch to clear Link Aggregation Control Protocol (LACP) channel-group counters. clear lacp {channel-group-number counters | counters} Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines You can clear all counters by using the clear lacp counters command, or you can clear only the counters for the specified channel group by using the clear lacp channel-group-number counters command. Examples This example shows how to clear all channel-group information: Switch# clear lacp counters This example shows how to clear LACP traffic counters for group 4: Switch# clear lacp 4 counters You can verify that the information was deleted by entering the show lacp counters or the show lacp 4 counters privileged EXEC command. Related Commands channel-group-number (Optional) Channel group number. The range is 1 to 12. counters Clear traffic counters. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show lacp Displays LACP channel-group information.2-38 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear mac-address-table clear mac-address-table Use the clear mac-address-table privileged EXEC command on the switch stack or on a standalone switch to delete from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, all dynamic addresses on stack members, or all dynamic addresses on a particular VLAN. This command also clears the MAC address notification global counters. clear mac-address-table {dynamic [address mac-addr | interface interface-id | vlan vlan-id] | notification} Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Examples This example shows how to remove a specific MAC address from the dynamic address table: Switch# clear mac-address-table dynamic address 0008.0070.0007 You can verify that the information was deleted by entering the show mac-address-table privileged EXEC command. Related Commands dynamic Delete all dynamic MAC addresses. dynamic address mac-addr (Optional) Delete the specified dynamic MAC address. dynamic interface interface-id (Optional) Delete all dynamic MAC addresses on the specified physical port or port channel. dynamic vlan vlan-id (Optional) Delete all dynamic MAC addresses for the specified VLAN. The range is 1 to 4096. notification Clear the notifications in the history table and reset the counters. Release Modification 12.1(11)AX This command was first introduced. Command Description mac-address-table notification Enables the MAC address notification feature. show mac-address-table Displays the MAC address table static and dynamic entries. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. snmp trap mac-notification Enables the Simple Network Management Protocol (SNMP) MAC address notification trap on a specific interface.2-39 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear pagp clear pagp Use the clear pagp privileged EXEC command on the switch stack or on a standalone switch to clear Port Aggregation Protocol (PAgP) channel-group information. clear pagp {channel-group-number counters | counters} Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines You can clear all counters by using the clear pagp counters command, or you can clear only the counters for the specified channel group by using the clear pagp channel-group-number counters command. Examples This example shows how to clear all channel-group information: Switch# clear pagp counters This example shows how to clear PAgP traffic counters for group 10: Switch# clear pagp 10 counters You can verify that information was deleted by entering the show pagp privileged EXEC command. Related Commands channel-group-number (Optional) Channel group number. The range is 1 to 12. counters Clear traffic counters. Release Modification 12.1(11)AX This command was first introduced. Command Description show pagp Displays PAgP channel-group information.2-40 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear setup express clear setup express Use the clear setup express privileged EXEC command on the switch stack or on a standalone switch to exit Express Setup mode without saving the current configuration. clear setup express Syntax Description This command has no arguments or keywords. Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines You can use the clear setup express command to exit Express Setup mode. For example, if you activate Express Setup and then decide to connect to the switch through the console port instead of through an Ethernet port, enter the clear setup express command. The switch exits Express Setup mode. The IP address 10.0.0.1 is no longer valid on the switch, and your connection using this IP address is ended. This command is available only when the switch is in Express Setup mode. Examples This example shows how to exit Express Setup mode: Switch# clear setup express You can verify that the switch has exited Express Setup mode by entering the show express setup privileged EXEC command. Related Commands Release Modification 12.1(14)EA1 This command was first introduced. Command Description setup express Enables Express Setup mode. show setup express Displays if Express Setup mode is active.2-41 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear spanning-tree counters clear spanning-tree counters Use the clear spanning-tree counters privileged EXEC command on the switch stack or on a standalone switch to clear the spanning-tree counters. clear spanning-tree counters [interface interface-id] Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines If the interface-id is not specified, spanning-tree counters are cleared for all interfaces. Examples This example shows how to clear spanning-tree counters for all interfaces: Switch# clear spanning-tree counters Related Commands interface interface-id (Optional) Clear all spanning-tree counters on the specified interface. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 12. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show spanning-tree Displays spanning-tree state information.2-42 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear spanning-tree detected-protocols clear spanning-tree detected-protocols Use the clear spanning-tree detected-protocols privileged EXEC command on the switch stack or on a standalone switch to restart the protocol migration process (force the renegotiation with neighboring switches) on all interfaces or on the specified interface. clear spanning-tree detected-protocols [interface interface-id] Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines A switch running the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol or the Multiple Spanning Tree Protocol (MSTP) supports a built-in protocol migration mechanism that enables it to interoperate with legacy 802.1D switches. If a rapid-PVST+ switch or an MSTP switch receives a legacy 802.1D configuration bridge protocol data unit (BPDU) with the protocol version set to 0, it sends only 802.1D BPDUs on that port. A multiple spanning-tree (MST) switch can also detect that a port is at the boundary of a region when it receives a legacy BPDU, an MST BPDU (version 3) associated with a different region, or a rapid spanning-tree (RST) BPDU (version 2). However, the switch does not automatically revert to the rapid-PVST+ or the MSTP mode if it no longer receives 802.1D BPDUs because it cannot determine whether the legacy switch has been removed from the link unless the legacy switch is the designated switch. Use the clear spanning-tree detected-protocols command in this situation. Examples This example shows how to restart the protocol migration process on an interface of stack member 2: Switch# clear spanning-tree detected-protocols interface gigabitethernet2/0/1 Related Commands interface interface-id (Optional) Restart the protocol migration process on the specified interface. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 12. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show spanning-tree Displays spanning-tree state information. spanning-tree link-type Overrides the default link-type setting and enables rapid spanning-tree transitions to the forwarding state.2-43 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear vmps statistics clear vmps statistics Use the clear vmps statistics privileged EXEC command on the switch stack or on a standalone switch to clear the statistics maintained by the VLAN Query Protocol (VQP) client. clear vmps statistics Syntax Description This command has no arguments or keywords. Defaults No default is defined. Command Modes Privileged EXEC Command History Examples This example shows how to clear VLAN Membership Policy Server (VMPS) statistics: Switch# clear vmps statistics You can verify that information was deleted by entering the show vmps statistics privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show vmps Displays the VQP version, reconfirmation interval, retry count, VMPS IP addresses, and the current and primary servers.2-44 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands clear vtp counters clear vtp counters Use the clear vtp counters privileged EXEC command on the switch stack or on a standalone switch to clear the VLAN Trunking Protocol (VTP) and pruning counters. clear vtp counters Syntax Description This command has no arguments or keywords. Defaults No default is defined. Command Modes Privileged EXEC Command History Examples This example shows how to clear the VTP counters: Switch# clear vtp counters You can verify that information was deleted by entering the show vtp counters privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show vtp Displays general information about the VTP management domain, status, and counters.2-45 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster commander-address cluster commander-address You do not need to enter this command from the switch stack or from a standalone cluster member switch. The cluster command switch automatically provides its MAC address to cluster member switches when these switches join the cluster. The cluster member switch adds this information and other cluster information to its running configuration file. Use the no form of this global configuration command from the cluster member switch console port to remove the switch from a cluster only during debugging or recovery procedures. cluster commander-address mac-address [member number name name] no cluster commander-address Syntax Description Defaults The switch is not a member of any cluster. Command Modes Global configuration Command History Usage Guidelines This command is available only on the cluster command switch stack or the cluster command switch. A cluster member can have only one cluster command switch. The cluster member switch retains the identity of the cluster command switch during a system reload by using the mac-address parameter. You can enter the no form on a cluster member switch to remove it from the cluster during debugging or recovery procedures. You would normally use this command from the cluster member switch console port only when the member has lost communication with the cluster command switch. With normal switch configuration, we recommend that you remove cluster member switches only by entering the no cluster member n global configuration command on the cluster command switch. When a standby cluster command switch becomes active (becomes the cluster command switch), it removes the cluster commander address line from its configuration. mac-address MAC address of the cluster command switch. member number (Optional) Number of a configured cluster member switch. The range is 0 to 15. name name (Optional) Name of the configured cluster up to 31 characters. Release Modification 12.1(11)AX This command was first introduced.2-46 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster commander-address Examples This is partial sample output from the running configuration of a cluster member. Switch(config)# show running-configuration

cluster commander-address 00e0.9bc0.a500 member 4 name my_cluster

This example shows how to remove a member from the cluster by using the cluster member console. Switch # configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# no cluster commander-address You can verify your settings by entering the show cluster privileged EXEC command. Related Commands Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs.2-47 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster discovery hop-count cluster discovery hop-count Use the cluster discovery hop-count global configuration command on the switch stack or on the a cluster command switch on the cluster command switch to set the hop-count limit for extended discovery of candidate switches. Use the no form of this command to return to the default setting. cluster discovery hop-count number no cluster discovery hop-count Syntax Description Defaults The hop count is set to 3. Command Modes Global configuration Command History Usage Guidelines This command is available only on the cluster command switch stack or cluster command switch. This command does not operate on cluster member switches. If the hop count is set to 1, it disables extended discovery. The cluster command switch discovers only candidates that are one hop from the edge of the cluster. The edge of the cluster is the point between the last discovered cluster member switch and the first discovered candidate switch. Examples This example shows how to set hop count limit to 4. This command is executed on the cluster command switch. Switch(config)# cluster discovery hop-count 4 You can verify your setting by entering the show cluster privileged EXEC command. Related Commands number Number of hops from the cluster edge that the cluster command switch limits the discovery of candidates. The range is 1 to 7. Release Modification 12.1(11)AX This command was first introduced. Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show cluster candidates Displays a list of candidate switches.2-48 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster enable cluster enable Use the cluster enable global configuration command on a command-capable switch or switch stack to enable it as the cluster command switch, assign a cluster name, and to optionally assign a member number to it. Use the no form of the command to remove all members and to make the cluster command switch a candidate switch. cluster enable name [command-switch-member-number] no cluster enable Syntax Description Defaults The switch is not a cluster command switch. No cluster name is defined. The member number is 0 when the switch is the cluster command switch. Command Modes Global configuration Command History Usage Guidelines Enter this command on any command-capable switch that is not part of any cluster. This command fails if a device is already configured as a member of the cluster. You must name the cluster when you enable the cluster command switch. If the switch is already configured as the cluster command switch, this command changes the cluster name if it is different from the previous cluster name. Examples This example shows how to enable the cluster command switch, name the cluster, and set the cluster command switch member number to 4. Switch(config)# cluster enable Engineering-IDF4 4 You can verify your setting by entering the show cluster privileged EXEC command on the cluster command switch. name Name of the cluster up to 31 characters. Valid characters include only alphanumerics, dashes, and underscores. command-switch-member-number (Optional) Assign a member number to the cluster command switch of the cluster. The range is 0 to 15. Release Modification 12.1(11)AX This command was first introduced.2-49 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster enable Related Commands Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs.2-50 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster holdtime cluster holdtime Use the cluster holdtime global configuration command on the switch stack or on the a cluster command switch to set the duration in seconds before a switch (either the command or cluster member switch) declares the other switch down after not receiving heartbeat messages. Use the no form of this command to set the duration to the default value. cluster holdtime holdtime-in-secs no cluster holdtime Syntax Description Defaults The default holdtime is 80 seconds. Command Modes Global configuration Command History Usage Guidelines Enter this command with the cluster timer global configuration command only on the cluster command switch. The cluster command switch propagates the values to all its cluster members so that the setting is consistent among all switches in the cluster. The holdtime is typically set as a multiple of the interval timer (cluster timer). For example, it takes (holdtime-in-secs divided by the interval-in-secs) number of heartbeat messages to be missed in a row to declare a switch down. Examples This example shows how to change the interval timer and the duration on the cluster command switch. Switch(config)# cluster timer 3 Switch(config)# cluster holdtime 30 You can verify your settings by entering the show cluster privileged EXEC command. Related Commands holdtime-in-secs Duration in seconds before a switch (either a command or cluster member switch) declares the other switch down. The range is 1 to 300 seconds. Release Modification 12.1(11)AX This command was first introduced. Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs.2-51 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster member cluster member Use the cluster member global configuration command on the cluster command switch to add candidates to a cluster. Use the no form of the command to remove members from the cluster. cluster member [n] mac-address H.H.H [password enable-password] [vlan vlan-id] no cluster member n Syntax Description Defaults A newly enabled cluster command switch has no associated cluster members. Command Modes Global configuration Command History Usage Guidelines Enter this command only on the cluster command switch to add a candidate to or remove a member from the cluster. If you enter this command on a switch other than the cluster command switch, the switch rejects the command and displays an error message. You must enter a member number to remove a switch from the cluster. However, you do not need to enter a member number to add a switch to the cluster. The cluster command switch selects the next available member number and assigns it to the switch that is joining the cluster. You must enter the enable password of the candidate switch for authentication when it joins the cluster. The password is not saved in the running or startup configuration. After a candidate switch becomes a member of the cluster, its password becomes the same as the cluster command-switch password. If a switch does not have a configured host name, the cluster command switch appends a member number to the cluster command-switch host name and assigns it to the cluster member switch. If you do not specify a VLAN ID, the cluster command switch automatically chooses a VLAN and adds the candidate to the cluster. n The number that identifies a cluster member. The range is 0 to 15. mac-address H.H.H MAC address of the cluster member switch in hexadecimal format. password enable-password Enable password of the candidate switch. The password is not required if there is no password on the candidate switch. vlan vlan-id (Optional) VLAN ID through which the candidate is added to the cluster by the cluster command switch. The range is 1 to 4094. Release Modification 12.1(11)AX This command was first introduced.2-52 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster member Examples This example shows how to add a switch as member 2 with MAC address 00E0.1E00.2222 and the password key to a cluster. The cluster command switch adds the candidate to the cluster through VLAN 3. Switch(config)# cluster member 2 mac-address 00E0.1E00.2222 password key vlan 3 This example shows how to add a switch with MAC address 00E0.1E00.3333 to the cluster. This switch does not have a password. The cluster command switch selects the next available member number and assigns it to the switch that is joining the cluster. Switch(config)# cluster member mac-address 00E0.1E00.3333 You can verify your settings by entering the show cluster members privileged EXEC command on the cluster command switch. Related Commands Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show cluster candidates Displays a list of candidate switches. show cluster members Displays information about the cluster members.2-53 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster outside-interface cluster outside-interface Use the cluster outside-interface global configuration command on the switch stack or on the a cluster command switch to configure the outside interface for cluster Network Address Translation (NAT) so that a member without an IP address can communicate with devices outside the cluster. Use the no form of this command to return to the default setting. cluster outside-interface interface-id no cluster outside-interface Syntax Description Defaults The default outside interface is automatically selected by the cluster command switch. Command Modes Global configuration Command History Usage Guidelines Enter this command only on the cluster command switch. If you enter this command on a cluster member switch, an error message appears. Examples This example shows how to set the outside interface to VLAN 1: Switch(config)# cluster outside-interface vlan 1 You can verify your setting by entering the show running-config privileged EXEC command. Related Commands interface-id Interface to serve as the outside interface. Valid interfaces include physical interfaces, port-channels, or VLANs. The port-channel range is 1 to 12. The VLAN range is 1 to 4094. Release Modification 12.1(11)AX This command was first introduced. Command Description show running-config Displays the current operating configuration. For syntax information, select the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-54 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster run cluster run Use the cluster run global configuration command to enable clustering on a switch. Use the no form of this command to disable clustering on a switch. cluster run no cluster run Syntax Description This command has no arguments or keywords. Defaults Clustering is enabled on all switches. Command Modes Global configuration Command History Usage Guidelines When you enter the no cluster run command on a cluster command switch or cluster command switch stack, the cluster command switch is disabled. Clustering is disabled, and the switch cannot become a candidate switch. When you enter the no cluster run command on a cluster member switch, it is removed from the cluster. Clustering is disabled, and the switch cannot become a candidate switch. When you enter the no cluster run command on a switch that is not part of a cluster, clustering is disabled on this switch. This switch cannot then become a candidate switch. Examples This example shows how to disable clustering on the cluster command switch: Switch(config)# no cluster run You can verify your setting by entering the show cluster privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs.2-55 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster standby-group cluster standby-group Use the cluster standby-group global configuration command to enable cluster command-switch redundancy by binding the cluster to an existing Hot Standby Router Protocol (HSRP). Entering the routing-redundancy keyword enables the same HSRP group to be used for cluster command-switch redundancy and routing redundancy. Use the no form of this command to return to the default setting. cluster standby-group HSRP-group-name [routing-redundancy] no cluster standby-group Syntax Description Defaults The cluster is not bound to any HSRP group. Command Modes Global configuration Command History Usage Guidelines Enter this command only on the cluster command switch. If you enter it on a cluster member switch, an error message appears. The cluster command switch propagates the cluster-HSRP binding information to all cluster-HSRP capable members. Each cluster member switch stores the binding information in its nonvolatile RAM (NVRAM). The HSRP group name must be a valid standby group; otherwise, the command exits with an error. The same group name should be used on all members of the HSRP standby group that is to be bound to the cluster. The same HSRP group name should also be used on all cluster-HSRP capable members for the HSRP group that is to be bound. (When not binding a cluster to an HSRP group, you can use different names on the cluster commander and the members.) HSRP-group-name Name of the HSRP group that is bound to the cluster. The group name is limited to 32 characters. routing-redundancy (Optional) Enable the same HSRP standby group to be used for cluster command-switch redundancy and routing redundancy. Release Modification 12.1(11)AX This command was first introduced.2-56 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster standby-group Examples This example shows how to bind the HSRP group named my_hsrp to the cluster. This command is executed on the cluster command switch. Switch(config)# cluster standby-group my_hsrp This example shows how to use the same HSRP group named my_hsrp for routing redundancy and cluster redundancy. Switch(config)# cluster standby-group my_hsrp routing-redundancy This example shows the error message when this command is executed on a cluster command switch and the specified HSRP standby group does not exist: Switch(config)# cluster standby-group my_hsrp %ERROR: Standby (my_hsrp) group does not exist This example shows the error message when this command is executed on a cluster member switch: Switch(config)# cluster standby-group my_hsrp routing-redundancy %ERROR: This command runs on a cluster command switch You can verify your settings by entering the show cluster privileged EXEC command. The output shows whether redundancy is enabled in the cluster. Related Commands Command Description standby ip Enables HSRP on the interface. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show standby Displays standby group information. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands.2-57 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands cluster timer cluster timer Use the cluster timer global configuration command on the switch stack or on the a cluster command switch to set the interval in seconds between heartbeat messages. Use the no form of this command to set the interval to the default value. cluster timer interval-in-secs no cluster timer Syntax Description Defaults The interval is 8 seconds. Command Modes Global configuration Command History Usage Guidelines Enter this command with the cluster holdtime global configuration command only on the cluster command switch. The cluster command switch propagates the values to all its cluster members so that the setting is consistent among all switches in the cluster. The holdtime is typically set as a multiple of the heartbeat interval timer (cluster timer). For example, it takes (holdtime-in-secs divided by the interval-in-secs) number of heartbeat messages to be missed in a row to declare a switch down. Examples This example shows how to change the heartbeat interval timer and the duration on the cluster command switch: Switch(config)# cluster timer 3 Switch(config)# cluster holdtime 30 You can verify your settings by entering the show cluster privileged EXEC command. Related Commands interval-in-secs Interval in seconds between heartbeat messages. The range is 1 to 300 seconds. Release Modification 12.1(11)AX This command was first introduced. Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs.2-58 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands define interface-range define interface-range Use the define interface-range global configuration command on the switch stack or on a standalone switch to create an interface-range macro. Use the no form of this command to delete the defined macro. define interface-range macro-name interface-range no define interface-range macro-name interface-range Syntax Description Defaults This command has no default setting. Command Modes Global configuration Command History Usage Guidelines The macro name is a 32-character maximum character string. A macro can contain up to five ranges. All interfaces in a range must be the same type; that is, all Fast Ethernet ports, all Gigabit Ethernet ports, all EtherChannel ports, or all VLANs, but you can combine multiple interface types in a macro. When entering the interface-range, use this format: • type {first-interface} - {last-interface} • You must add a space between the first interface number and the hyphen when entering an interface-range. For example, gigabitethernet1/0/1 -5 is a valid range; gigabitethernet1/0/1-5 is not a valid range. Valid values for type and interface: • vlan vlan-id, where vlan-id is from 1 to 4094 VLAN interfaces must have been configured with the interface vlan command (the show running-config privileged EXEC command displays the configured VLAN interfaces). VLAN interfaces not displayed by the show running-config command cannot be used in interface-ranges. • port-channel port-channel-number, where port-channel-number is from 1 to 12 • fastethernet stack member/module/{first port} - {last port} • gigabitethernet stack member/module/{first port} - {last port} macro-name Name of the interface-range macro; up to 32 characters. interface-range Interface range; for valid values for interface ranges, see “Usage Guidelines.” Release Modification 12.1(11)AX This command was first introduced.2-59 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands define interface-range For physical interfaces: • stack member is the number used to identify the switch within the stack. The number ranges from 1 to 9 and is assigned to the switch the first time the stack member initializes. • module is always 0 • the range is type stack member/0/number - number (for example, gigabitethernet 1/0/1 - 2) When you define a range, you must enter a space before the hyphen (-), for example: gigabitethernet1/0/1 - 2 You can also enter multiple ranges. When you define multiple ranges, you must enter a space after the first entry before the comma (,). The space after the comma is optional, for example: fastethernet1/0/3 ,gigabitethernet1/0/1 - 2 fastethernet1/0/3 -4 , gigabitethernet1/0/1 - 2 Examples This example shows how to create a multiple-interface macro: Switch(config)# define interface-range macro1 gigabitethernet1/0/1 -2 , gigabitethernet1/0/5 Related Commands Command Description interface range Executes a command on multiple ports at the same time. show running-config Displays the current operating configuration, including defined macros. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-60 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands delete delete Use the delete privileged EXEC command on the switch stack or on a standalone switch to delete a file or directory on the Flash memory device. delete [/force] [/recursive] filesystem:/file-url Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If you use the /force keyword, you are prompted once at the beginning of the deletion process to confirm the deletion. If you use the /recursive keyword without the /force keyword, you are prompted to confirm the deletion of every file. The prompting behavior depends on the setting of the file prompt global configuration command. By default, the switch prompts for confirmation on destructive file operations. For more information about this command, refer to the Cisco IOS Command Reference for Release 12.1. Examples This example shows how to remove the directory that contains the old software image after a successful download of a new image: Switch# delete /force /recursive flash:/old-image You can verify that the directory was removed by entering the dir filesystem: privileged EXEC command. /force (Optional) Suppress the prompt that confirms the deletion. /recursive (Optional) Delete the named directory and all subdirectories and the files contained in it. filesystem: Alias for a Flash file system. The syntax for the local Flash file system on the stack member or the stack master: flash: From the stack master, the syntax for the local Flash file system on a stack member: flash member number: /file-url The path (directory) and filename to delete. Release Modification 12.1(11)AX This command was first introduced.2-61 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands delete Related Commands Command Description archive download-sw Downloads a new image to the switch and overwrites or keeps the existing image.2-62 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands deny deny Use the deny MAC access list configuration command on the switch stack or on a standalone switch to prevent non-IP traffic from being forwarded if the conditions are matched. Use the no form of this command to remove a deny condition from the named MAC access list. {deny | permit} {any | host src-MAC-addr | src-MAC-addr mask} {any | host dst-MAC-addr | dst-MAC-addr mask} [type mask | aarp | amber | cos cos | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | lsap lsap mask |mop-console | mop-dump | msdos | mumps | netbios | vines-echo | vines-ip | xns-idp] no {deny | permit} {any | host src-MAC-addr | src-MAC-addr mask} {any | host dst-MAC-addr | dst-MAC-addr mask} [type mask | aarp | amber | cos cos | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | lsap lsap mask | mop-console | mop-dump | msdos | mumps | netbios | vines-echo | vines-ip | xns-idp] Syntax Description any Keyword to specify to deny any source or destination MAC address. host src MAC-addr | src-MAC-addr mask Define a host MAC address and optional subnet mask. If the source address for a packet matches the defined address, non-IP traffic from that address is denied. host dst-MAC-addr | dst-MAC-addr mask Define a destination MAC address and optional subnet mask. If the destination address for a packet matches the defined address, non-IP traffic to that address is denied. type mask (Optional) Use the Ethertype number of a packet with Ethernet II or SNAP encapsulation to identify the protocol of the packet. The type is 0 to 65535, specified in hexadecimal. The mask is a mask of don’t care bits applied to the Ethertype before testing for a match. aarp (Optional) Select Ethertype AppleTalk Address Resolution Protocol that maps a data-link address to a network address. amber (Optional) Select EtherType DEC-Amber. cos cos (Optional) Select a class of service (CoS) number from 0 to 7 to set priority. Filtering on CoS can be performed only in hardware. A warning message reminds the user if the cos option is configured. dec-spanning (Optional) Select EtherType Digital Equipment Corporation (DEC) spanning tree. decnet-iv (Optional) Select EtherType DECnet Phase IV protocol. diagnostic (Optional) Select EtherType DEC-Diagnostic. dsm (Optional) Select EtherType DEC-DSM. etype-6000 (Optional) Select EtherType 0x6000. etype-8042 (Optional) Select EtherType 0x8042. lat (Optional) Select EtherType DEC-LAT. lavc-sca (Optional) Select EtherType DEC-LAVC-SCA.2-63 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands deny Note Though visible in the command-line help strings, appletalk is not supported as a matching condition. To filter IPX traffic, you use the type mask or lsap lsap mask keywords, depending on the type of IPX encapsulation being used. Filter criteria for IPX encapsulation types as specified in Novell terminology and Cisco IOS terminology are listed in Table 2-4. Defaults This command has no defaults. However; the default action for a MAC-named ACL is to deny. Command Modes MAC-access list configuration Command History lsap lsap-number mask (Optional) Use the LSAP number (0 to 65535) of a packet with 802.2 encapsulation to identify the protocol of the packet. mask is a mask of don’t care bits applied to the LSAP number before testing for a match. mop-console (Optional) Select EtherType DEC-MOP Remote Console. mop-dump (Optional) Select EtherType DEC-MOP Dump. msdos (Optional) Select EtherType DEC-MSDOS. mumps (Optional) Select EtherType DEC-MUMPS. netbios (Optional) Select EtherType DEC- Network Basic Input/Output System (NETBIOS). vines-echo (Optional) Select EtherType Virtual Integrated Network Service (VINES) Echo from Banyan Systems. vines-ip (Optional) Select EtherType VINES IP. xns-idp (Optional) Select EtherType Xerox Network Systems (XNS) protocol suite (0 to 65535), an arbitrary Ethertype in decimal, hexadecimal, or octal. Table 2-4 IPX Filtering Criteria IPX Encapsulation Type Cisco IOS Name Novel Name Filter Criterion arpa Ethernet II Ethertype 0x8137 snap Ethernet-snap Ethertype 0x8137 sap Ethernet 802.2 LSAP 0xE0E0 novell-ether Ethernet 802.3 LSAP 0xFFFF Release Modification 12.1(11)AX This command was first introduced.2-64 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands deny Usage Guidelines You enter MAC-access list configuration mode by using the mac access-list extended global configuration command. If you use the host keyword, you cannot enter an address mask; if you do not use the host keyword, you must enter an address mask. When an access control entry (ACE) is added to an access control list, an implied deny-any-any condition exists at the end of the list. That is, if there are no matches, the packets are denied. However, before the first ACE is added, the list permits all packets. Note For more information about named MAC extended access lists, refer to the software configuration guide for this release. Examples This example shows how to define the named MAC extended access list to deny NETBIOS traffic from any source to MAC address 00c0.00a0.03fa. Traffic matching this list is denied. Switch(config-ext-macl)# deny any host 00c0.00a0.03fa netbios. This example shows how to remove the deny condition from the named MAC extended access list: Switch(config-ext-macl)# no deny any 00c0.00a0.03fa 0000.0000.0000 netbios. This example denies all packets with Ethertype 0x4321: Switch(config-ext-macl)# deny any any 0x4321 0 You can verify your settings by entering the show access-lists privileged EXEC command. Related Commands Command Description mac access-list extended Creates an access list based on MAC addresses for non-IP traffic. permit Permits non-IP traffic to be forwarded if conditions are matched. show access-lists Displays access control lists configured on a switch.2-65 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x default dot1x default Use the dot1x default interface configuration command on the switch stack or on a standalone switch to reset the configurable 802.1X parameters to their default values. dot1x default Syntax Description This command has no arguments or keywords. Defaults These are the default values: • The per-interface 802.1X protocol enable state is disabled (force-authorized). • The number of seconds between re-authentication attempts is 3600 seconds. • The periodic re-authentication is disabled. • The quiet period is 60 seconds. • The retransmission time is 30 seconds. • The maximum retransmission number is 2 times. • The host mode is single host. • The client timeout period is 30 seconds. • The authentication server timeout period is 30 seconds. Command Modes Interface configuration Command History Examples This example shows how to reset the configurable 802.1X parameters on an interface: Switch(config-if)# dot1x default You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 This command was changed to the interface configuration mode. Command Description show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-66 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x guest-vlan dot1x guest-vlan Use the dot1x guest-vlan interface configuration command on the switch stack or on a standalone switch to specify an active VLAN as an 802.1X guest VLAN. Use the no form of this command to return to the default setting. dot1x guest-vlan vlan-id no dot1x guest-vlan Syntax Description Defaults No guest VLAN is configured. Command Modes Interface configuration Command History Usage Guidelines When you configure a guest VLAN, clients that are not 802.1X-capable are put into the guest VLAN when the server does not receive a response to its Extensible Authentication Protocol over LAN (EAPOL) request/identity frame. Clients that are 802.1X-capable but fail authentication are not granted access to the network. Guest VLANs are supported on 802.1X ports in single-host mode and multiple-hosts mode. You can configure any active VLAN except an RSPAN VLAN or a voice VLAN as an 802.1X guest VLAN. The guest VLAN feature is not supported on internal VLANs (routed ports) or trunk ports; it is supported only on access ports. Examples This example shows how to specify VLAN 5 as an 802.1X guest VLAN: Switch(config-if)# dot1x guest-vlan 5 You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands vlan-id Specify an active VLAN as an 802.1X guest VLAN. The range is 1 to 4094. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-67 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x host-mode dot1x host-mode Use the dot1x host-mode interface configuration command on the switch stack or on a standalone switch to allow a single host (client) or multiple hosts on an 802.1X-authorized port that has the dot1x port-control interface configuration command set to auto. Use the no form of this command to return to the default setting. dot1x host-mode {multi-host | single-host} no dot1x host-mode [multi-host | single-host] Syntax Description Defaults The default is single-host mode. Command Modes Interface configuration Command History Usage Guidelines Use this command to limit an 802.1X-enabled port to a single client or to attach multiple clients to an 802.1X-enabled port. In multiple-hosts mode, only one of the attached hosts must be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (re-authentication fails or an Extensible Authentication Protocol over LAN [EAPOL]-logoff message is received), all attached clients are denied access to the network. Before entering this command, make sure that the dot1x port-control interface configuration command is set to auto for the specified interface. Examples This example shows how to enable 802.1X globally, enable 802.1X on Gigabit Ethernet interface 0/1 on stack member 2, and enable multiple-hosts mode: Switch(config)# dot1x system-auth-control Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# dot1x port-control auto Switch(config-if)# dot1x host-mode multi-host You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. multi-host Enable multiple-hosts mode on the switch. single-host Enable single-host mode on the switch. Release Modification 12.1(14)EA1 This command was first introduced. It replaces the dot1x multiple-hosts interface configuration command.2-68 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x host-mode Related Commands Command Description show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-69 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x initialize dot1x initialize Use the dot1x initialize privileged EXEC command on the switch stack or on a standalone switch to manually return the specified 802.1X-enabled interface to an unauthorized state before initiating a new authentication session on the interface. dot1x initialize interface interface-id Syntax Description Defaults There is no default setting. Command Modes Privileged EXEC Command History Usage Guidelines Use this command to initialize the 802.1X state machines and to set up a fresh environment for authentication. After you enter this command, the port status becomes unauthorized. There is no no form of this command. Examples This example shows how to manually initialize Gigabit Ethernet interface 0/3 on stack member 2: Switch# dot1x initialize interface gigabitethernet2/0/3 You can verify the unauthorized port status by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands interface interface-id Interface to be initialized. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-70 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x max-req dot1x max-req Use the dot1x max-req interface configuration command on the switch stack or on a standalone switch to set the maximum number of times that the switch sends an Extensible Authentication Protocol (EAP)-request/identity frame (assuming that no response is received) to the client before restarting the authentication process. Use the no form of this command to return to the default setting. dot1x max-req count no dot1x max-req Syntax Description Defaults The default is 2 times. Command Modes Interface configuration Command History Usage Guidelines You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers. Examples This example shows how to set 5 as the number of times that the switch sends an EAP-request/identity frame before restarting the authentication process: Switch(config-if)# dot1x max-req 5 You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands count Number of times that the switch sends an EAP-request/identity frame before restarting the authentication process. The range is 1 to 10. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 This command was changed to the interface configuration mode. Command Description dot1x timeout tx-period Sets the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before resending the request. show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-71 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x multiple-hosts dot1x multiple-hosts This is an obsolete command. In past releases, the dot1x multiple-hosts interface configuration command was used on the switch stack or on a standalone switch to allow multiple hosts (clients) on an 802.1X-authorized port. Command History Related Commands Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The dot1x multiple-hosts interface configuration command was replaced by the dot1x host-mode interface configuration command. Command Description dot1x host-mode Sets the 802.1X host mode on an interface. show dot1x Displays 802.1X statistics, administrative status, and operational status for the switch or for the specified interface.2-72 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x port-control dot1x port-control Use the dot1x port-control interface configuration command on the switch stack or on a standalone switch to enable manual control of the authorization state of the port. Use the no form of this command to return to the default setting. dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control Syntax Description Defaults The default is force-authorized. Command Modes Interface configuration Command History Usage Guidelines You must globally enable 802.1X on the switch by using the dot1x system-auth-control global configuration command before enabling 802.1X on a specific interface. The 802.1X protocol is supported on Layer 2 static-access ports, voice VLAN ports, and Layer 3 routed ports. You can use the auto keyword only if the port is not configured as one of these: • Trunk port—If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, an error message appears, and the port mode is not changed. • Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk port. If you try to enable 802.1X on a dynamic port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to dynamic, an error message appears, and the port mode is not changed. auto Enable 802.1X authentication on the interface and cause the port to transition to the authorized or unauthorized state based on the 802.1X authentication exchange between the switch and the client. force-authorized Disable 802.1X authentication on the interface and cause the port to transition to the authorized state without any authentication exchange required. The port sends and receives normal traffic without 802.1X-based authentication of the client. force-unauthorized Deny all access through this interface by forcing the port to transition to the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the interface. Release Modification 12.1(11)AX This command was first introduced.2-73 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x port-control • Dynamic-access ports—If you try to enable 802.1X on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is not changed. • EtherChannel port—Before enabling 802.1X on the port, you must first remove it from the EtherChannel. If you try to enable 802.1X on an EtherChannel or on an active port in an EtherChannel, an error message appears, and 802.1X is not enabled. If you enable 802.1X on a not-yet active port of an EtherChannel, the port does not join the EtherChannel. • Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can enable 802.1X on a port that is a SPAN or RSPAN destination port. However, 802.1X is disabled until the port is removed as a SPAN or RSPAN destination. You can enable 802.1X on a SPAN or RSPAN source port. To globally disable 802.1X on the switch, use the no dot1x system-auth-control global configuration command. To disable 802.1X on a specific interface, use the no dot1x port-control interface configuration command. Examples This example shows how to enable 802.1X on Fast Ethernet interface 0/1 on stack member 2: Switch(config)# interface fastethernet2/0/1 Switch(config-if)# dot1x port-control auto You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands Command Description show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-74 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x re-authenticate dot1x re-authenticate Use the dot1x re-authenticate privileged EXEC command on the switch stack or on a standalone switch to manually initiate a re-authentication of all 802.1X-enabled ports or the specified 802.1X-enabled port. dot1x re-authenticate interface interface-id Syntax Description Defaults There is no default setting. Command Modes Privileged EXEC Command History Usage Guidelines You can use this command to re-authenticate a client without waiting for the configured number of seconds between re-authentication attempts (re-authperiod) and automatic re-authentication. Examples This example shows how to manually re-authenticate the device connected to Fast Ethernet interface 0/1 on stack member 2: Switch# dot1x re-authenticate interface fastethernet2/0/1 interface interface-id Stack switch number, module, and port number of the interface to re-authenticate. Release Modification 12.1(11)AX This command was first introduced.2-75 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x re-authentication dot1x re-authentication This is an obsolete command. In past releases, the dot1x re-authentication global configuration command was used on the switch stack or on a standalone switch to set the amount of time between periodic re-authentication attempts. Command History Related Commands Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The dot1x reauthentication interface configuration command replaced the dot1x re-authentication global configuration command. Command Description dot1x reauthentication Sets the number of seconds between re-authentication attempts. show dot1x Displays 802.1X statistics, administrative status, and operational status for the switch or for the specified interface.2-76 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x reauthentication dot1x reauthentication Use the dot1x reauthentication interface configuration command on the switch stack or on a standalone switch to enable periodic re-authentication of the client. Use the no form of this command to return to the default setting. dot1x reauthentication no dot1x reauthentication Syntax Description This command has no arguments or keywords. Defaults Periodic re-authentication is disabled. Command Modes Interface configuration Command History Usage Guidelines You configure the amount of time between periodic re-authentication attempts by using the dot1x timeout reauth-period interface configuration command. Examples This example shows how to disable periodic re-authentication of the client: Switch(config-if)# no dot1x reauthentication This example shows how to enable periodic re-authentication and to set the number of seconds between re-authentication attempts to 4000 seconds: Switch(config-if)# dot1x reauthentication Switch(config-if)# dot1x timeout reauth-period 4000 You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands Release Modification 12.1(14)EA1 This command was first introduced. It replaces the dot1x re-authentication global configuration command (with the hyphen). Command Description dot1x timeout reauth-period Sets the number of seconds between re-authentication attempts. show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-77 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x system-auth-control dot1x system-auth-control Use the dot1x system-auth-control global configuration command on the switch stack or on a standalone switch to globally enable 802.1X. Use the no form of this command to return to the default setting. dot1x system-auth-control no dot1x system-auth-control Syntax Description This command has no arguments or keywords. Defaults 802.1X is disabled. Command Modes Global configuration Command History Usage Guidelines You must enable authentication, authorization, and accounting (AAA) and specify the authentication method list before globally enabling 802.1X. A method list describes the sequence and authentication methods to be queried to authenticate a user. Examples This example shows how to globally enable 802.1X on a switch: Switch(config)# dot1x system-auth-control You can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command. Related Commands Release Modification 12.1(14)EA1 This command was first introduced. Command Description dot1x port-control Enables manual control of the authorization state of the port. show dot1x [interface interface-id] Displays 802.1X status for the specified interface.2-78 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x timeout dot1x timeout Use the dot1x timeout interface configuration command on the switch stack or on a standalone switch to set 802.1X timers. Use the no form of this command to return to the default setting. dot1x timeout {quiet-period seconds | reauth-period seconds | server-timeout seconds | supp-timeout seconds | tx-period seconds} no dot1x timeout {quiet-period | reauth-period | server-timeout | supp-timeout | tx-period} Syntax Description Defaults These are the default settings: reauth-period is 3600 seconds. quiet-period is 60 seconds. tx-period is 30 seconds. supp-timeout is 30 seconds. server-timeout is 30 seconds. Command Modes Interface configuration Command History quiet-period seconds Number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client. The range is 1 to 65535. reauth-period seconds Number of seconds between re-authentication attempts. The range is 1 to 65535. server-timeout seconds Number of seconds that the switch waits for the retransmission of packets by the switch to the authentication server. The range is 1 to 65535. supp-timeout seconds Number of seconds that the switch waits for the retransmission of packets by the switch to the 802.1X client. The range is 1 to 65535. tx-period seconds Number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before retransmitting the request. The range is 1 to 65535. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The supp-timeout and server-timeout keywords were added, and the command was changed to the interface configuration mode.2-79 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands dot1x timeout Usage Guidelines You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers. The dot1x timeout reauth-period interface configuration command affects the behavior of the switch only if you have enabled periodic re-authentication by using the dot1x reauthentication interface configuration command. During the quiet period, the switch does not accept or initiate any authentication requests. If you want to provide a faster response time to the user, enter a smaller number than the default. Examples This example shows how to enable periodic re-authentication and to set 4000 as the number of seconds between re-authentication attempts: Switch(config-if)# dot1x reauthentication Switch(config-if)# dot1x timeout reauth-period 4000 This example shows how to set 30 seconds as the quiet time on the switch: Switch(config-if)# dot1x timeout quiet-period 30 This example shows how to set 25 seconds as the switch-to-authentication server retransmission time: Switch(config)# dot1x timeout server-timeout 25 This example shows how to set 25 seconds as the switch-to-client retransmission time for the EAP request frame: Switch(config-if)# dot1x timeout supp-timeout 25 This example shows how to set 60 as the number of seconds to wait for a response to an EAP-request/identity frame from the client before re-transmitting the request: Switch(config-if)# dot1x timeout tx-period 60 You can verify your settings by entering the show dot1x privileged EXEC command. Related Commands Command Description dot1x max-req Sets the maximum number of times that the switch sends an EAP-request/identity frame before restarting the authentication process. dot1x reauthentication Enables periodic re-authentication of the client. show dot1x Displays 802.1X status for all interfaces.2-80 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands duplex duplex Use the duplex interface configuration command on the switch stack or on a standalone switch to specify the duplex mode of operation for Fast Ethernet and Gigabit Ethernet ports. Use the no form of this command to return the port to its default value. duplex {auto | full | half} no duplex Syntax Description Defaults The default is auto. Command Modes Interface configuration Command History Usage Guidelines This command is not available on small form-factor pluggable (SFP) module ports unless a 1000BASE-T SFP module is in the port. All other SFP modules operate only in full-duplex mode. Certain ports can be configured to be either full duplex or half duplex. Applicability of this command depends on the device to which the switch is attached. For Fast Ethernet ports, setting the port to auto has the same effect as specifying half if the attached device does not autonegotiate the duplex parameter. For Gigabit Ethernet ports, setting the port to auto has the same effect as specifying full if the attached device does not autonegotiate the duplex parameter. You cannot configure duplex mode on SFP module interfaces. However, when a 1000BASE-T SFP module is in the SFP module port, you can configure duplex mode to auto or full. If both ends of the line support autonegotiation, we highly recommend using the default autonegotiation settings. If one interface supports autonegotiation and the other end does not, configure duplex and speed on both interfaces; do use the auto setting on the supported side. auto Enable automatic duplex configuration; port automatically detects whether it should run in full- or half-duplex mode, depending on the attached device mode. full Enable full-duplex mode. half Enable half-duplex mode (for Fast Ethernet ports only). Release Modification 12.1(11)AX This command was first introduced.2-81 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands duplex If the speed is set to auto, the switch negotiates with the device at the other end of the link for the speed setting and then forces the speed setting to the negotiated value. The duplex setting remains as configured on each end of the link, which could result in a duplex setting mismatch. For 10/100/1000 Mbps ports, if both the speed and duplex are set to specific values, autonegotiation is disabled. For 10/100 Mbps ports, if both speed and duplex are set to specific values, the link operates at the negotiated speed and duplex value. Caution Changing the interface speed and duplex mode configuration might shut down and reenable the interface during the reconfiguration. Note For guidelines on setting the switch speed and duplex parameters, refer to the software configuration guide for this release. Examples This example shows how to configure an interface for full duplex operation: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# duplex full You can verify your setting by entering the show interfaces privileged EXEC command. Related Commands Command Description show interfaces Displays the interface settings on the switch. speed Sets the speed on a 10/100 or 10/100/1000 Mbps interface.2-82 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands errdisable detect cause errdisable detect cause Use the errdisable detect cause global configuration command on the switch stack or on a standalone switch to enable error disable detection for a specific cause or all causes. Use the no form of this command to disable the error disable detection feature. errdisable detect cause {all | dtp-flap | gbic-invalid | link-flap | loopback | pagp-flap} no errdisable detect cause {all | dtp-flap | gbic-invalid | link-flap | pagp-flap} Syntax Description Note Though visible in the command-line help strings, the dhcp-rate-limit keyword is not supported. Defaults Detection is enabled for all causes. Command Modes Global configuration Command History Usage Guidelines A cause (dtp-flap, gbic-invalid, link-flap, loopback, and pagp-flap) is the reason why the error-disabled state occurred. When a cause is detected on an interface, the interface is placed in an error-disabled state, an operational state similar to link-down state. If you set a recovery mechanism for the cause by entering the errdisable recovery global configuration command for the cause, the interface is brought out of the error-disabled state and allowed to retry the operation when all causes have timed out. If you do not set a recovery mechanism, you must enter the shutdown and then the no shutdown commands to manually recover an interface from the error-disabled state. all Enable error detection for all error-disable cases. dtp-flap Enable error detection for the Dynamic Trunking Protocol (DTP) flapping. gbic-invalid Enable error detection for an invalid GBIC. Note On the Catalyst 3750 switch, this error refers to an invalid small form-factor pluggable (SFP) module interface cause. link-flap Enable error detection for link-state flapping. loopback Enable error detection for detected loopbacks. pagp-flap Enable error detection for the Port Aggregation Protocol (PAgP) flap-error disable cause. Release Modification 12.1(11)AX This command was first introduced.2-83 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands errdisable detect cause Examples This example shows how to enable error disable detection for the link-flap error-disable cause: Switch(config)# errdisable detect cause link-flap You can verify your setting by entering the show errdisable detect privileged EXEC command. Related Commands Command Description show errdisable detect Displays errdisable detection information. show interfaces status err-disabled Displays interface status or a list of interfaces in the error-disabled state.2-84 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands errdisable recovery errdisable recovery Use the errdisable recovery global configuration command on the switch stack or on a standalone switch to configure the recover mechanism variables. Use the no form of this command to return to the default setting. errdisable recovery {cause {all | bpduguard | dtp-flap | gbic-invalid | link-flap | loopback | pagp-flap | psecure-violation | security-violation | udld | vmps} | {interval interval} no errdisable recovery {cause {all | bpduguard | dtp-flap | gbic-invalid | link-flap | loopback | pagp-flap | psecure-violation | security-violation | udld | vmps} | {interval interval} Syntax Description Note Though visible in the command-line help strings, the dhcp-rate-limit, unicast-flood, and channel-misconfig keywords are not supported. Defaults Recovery is disabled for all causes. cause Enable error disable to recover from a specific cause. all Enable the timer to recover from all error-disable causes. bpduguard Enable the timer to recover from the bridge protocol data unit (BPDU) guard error-disable state. dtp-flap Enable the timer to recover from the Dynamic Trunking Protocol (DTP) flap error-disable state. gbic-invalid Enable the timer to recover from an invalid GBIC error-disable state. Note On the Catalyst 3750 switch, this error refers to an invalid small form-factor pluggable (SFP) interface state. link-flap Enable the timer to recover from the link-flap error-disable state. loopback Enable the timer to recover from a loopback error-disable state. pagp-flap Enable the timer to recover from the Port Aggregation Protocol (PAgP)-flap error-disable state. psecure-violation Enable the timer to recover from a port security violation disable state. security-violation Enable the timer to recover from an 802.1X violation disable state udld Enable the timer to recover from the UniDirectional Link Detection (UDLD) error-disable state. vmps Enable the timer to recover from the VLAN Membership Policy Server (VMPS) error-disable state. interval interval Specify the time to recover from the specified error-disable state. The range is 30 to 86400 seconds. The same interval is applied to all causes. The default interval is 300 seconds. Note The errdisable recovery timer is initialized at a random differential from the configured interval value. The difference between the actual timeout value and the configured value can be up to 15 percent of the configured interval.2-85 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands errdisable recovery The default recovery interval is 300 seconds. Command Modes Global configuration Command History Usage Guidelines A cause (bpduguard, dtp-flap, gbic-invalid, link-flap, loopback, pagp-flap, psecure-violation, security-violation, udld, vmps) is defined as the reason why the error-disabled state occurred. When a cause is detected on an interface, the interface is placed in error-disabled state, an operational state similar to link-down state. If you do not enable errdisable recovery for the cause, the interface stays in error-disabled state until you enter a shutdown and no shutdown interface configuration command. If you enable the recovery for a cause, the interface is brought out of the error-disabled state and allowed to retry the operation again when all the causes have timed out. Otherwise, you must enter the shutdown then no shutdown commands to manually recover an interface from the error-disabled state. Examples This example shows how to enable the recovery timer for the BPDU guard error-disable cause: Switch(config)# errdisable recovery cause bpduguard This example shows how to set the timer to 500 seconds: Switch(config)# errdisable recovery interval 500 You can verify your settings by entering the show errdisable recovery privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The security-violation keyword was added. Command Description show errdisable recovery Displays errdisable recovery timer information. show interfaces status err-disabled Displays interface status or a list of interfaces in error-disabled state.2-86 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands flowcontrol flowcontrol Use the flowcontrol interface configuration command on the switch stack or on a standalone switch to set the receive flow-control state for an interface. When flow control send is operable and on for a device and it detects any congestion at its end, it notifies the link partner or the remote device of the congestion by sending a pause frame. When flow control receive is on for a device and it receives a pause frame, it stops sending any data packets. This prevents any loss of data packets during the congestion period. Use the receive off keywords to disable flow control. flowcontrol receive {desired | off | on} Note The Catalyst 3750 switch can only receive pause frames. Syntax Description Defaults The default is flowcontrol receive off. Command Modes Interface configuration Command History Usage Guidelines The switch does not support sending flow-control pause frames. Note that the on and desired keywords have the same result. When you use the flowcontrol command to set a port to control traffic rates during congestion, you are setting flow control on a port to one of these conditions: • receive on or desired: The port cannot send out pause frames, but can operate with an attached device that is required to or is able to send pause frames; the port is able to receive pause frames. • receive off: Flow control does not operate in either direction. In case of congestion, no indication is given to the link partner and no pause frames are sent or received by either device. Table 2-5 shows the flow control results on local and remote ports for a combination of settings. The table assumes that receive desired has the same results as using the receive on keywords. receive Sets whether the interface can receive flow-control packets from a remote device. desired Allows an interface to operate with an attached device that is required to send flow-control packets or with an attached device that is not required to but can send flow-control packets. off Turns off an attached device’s ability to send flow-control packets to an interface. on Allows an interface to operate with an attached device that is required to send flow-control packets or with an attached device that is not required to but can send flow-control packets. Release Modification 12.1(11)AX This command was first introduced.2-87 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands flowcontrol Examples This example shows how to configure the local port to not support flow control by the remote port: Switch(config-if)# flowcontrol receive off You can verify your settings by entering the show interfaces privileged EXEC command. Related Commands Table 2-5 Flow Control Settings and Local and Remote Port Flow Control Resolution Flow Control Settings Flow Control Resolution Local Device Remote Device Local Device Remote Device send off/receive on send on/receive on send on/receive off send desired/receive on send desired/receive off send off/receive on send off/receive off Receives only Receives only Receives only Receives only Receives only Does not send or receive Sends and receives Sends only Sends and receives Sends only Receives only Does not send or receive send off/receive off send on/receive on send on/receive off send desired/receive on send desired/receive off send off/receive on send off/receive off Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Does not send or receive Command Description show interfaces Displays the interface settings on the switch, including input and output flow control. 2-88 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface port-channel interface port-channel Use the interface port-channel global configuration command on the switch stack or on a standalone switch to access or create the port-channel logical interface. Use the no form of this command to remove the port-channel. interface port-channel port-channel-number no interface port-channel port-channel-number Syntax Description Defaults No port-channel logical interfaces are defined. Command Modes Global configuration Command History Usage Guidelines For Layer 2 EtherChannels, you do not have to create a port-channel interface first before assigning a physical interface to a channel group. Instead, you can use the channel-group interface configuration command. It automatically creates the port-channel interface when the channel group gets its first physical interface. If you create the port-channel interface first, the channel-group-number can be the same as the port-channel-number, or you can use a new number. If you use a new number, the channel-group command dynamically creates a new port channel. You create Layer 3 port channels by using the interface port-channel command followed by the no switchport interface configuration command. You should manually configure the port-channel logical interface before putting the interface into the channel group. Only one port channel in a channel group is allowed. Caution When using a port-channel interface as a routed interface, do not assign Layer 3 addresses on the physical interfaces that are assigned to the channel group. Caution Do not assign bridge groups on the physical interfaces in a channel group used as a Layer 3 port-channel interface because it creates loops. You must also disable spanning tree. port-channel-number Port-channel number. The range is 1 to12. Release Modification 12.1(11)AX This command was first introduced.2-89 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface port-channel Follow these guidelines when you use the interface port-channel command: • If you want to use the Cisco Discovery Protocol (CDP), you must configure it only on the physical interface and not on the port-channel interface. • Do not configure a port that is an active member of an EtherChannel as an 802.1X port. If 802.1X is enabled on a not-yet active port of an EtherChannel, the port does not join the EtherChannel. For a complete list of configuration guidelines, refer to the “Configuring EtherChannels” chapter in the software guide for this release. Examples This example shows how to create a port-channel interface with a port channel number of 5: Switch(config)# interface port-channel 5 You can verify your setting by entering the show running-config privileged EXEC or show etherchannel channel-group-number detail privileged EXEC command. Related Commands Command Description channel-group Assigns an Ethernet interface to an EtherChannel group. show etherchannel Displays EtherChannel information for a channel. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-90 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface range interface range Use the interface range global configuration command on the switch stack or on a standalone switch to enter interface range configuration mode and to execute a command on multiple ports at the same time. Use the no form of this command to remove an interface range. interface range {port-range | macro name} no interface range {port-range | macro name} Syntax Description Defaults This command has no default setting. Command Modes Global configuration Command History Usage Guidelines When you enter interface range configuration mode, all interface parameters you enter are attributed to all interfaces within the range. For VLANs, you can use the interface range command only on existing VLAN switch virtual interfaces (SVIs). To display VLAN SVIs, enter the show running-config privileged EXEC command. VLANs not displayed cannot be used in the interface range command. The commands entered under interface range command are applied to all existing VLAN SVIs in the range. All configuration changes made to an interface range are saved to nonvolatile RAM (NVRAM), but the interface range itself is not saved to NVRAM. You can enter the interface range in two ways: • Specifying up to five interface ranges • Specifying a previously defined interface-range macro All interfaces in a range must be the same type; that is, all Fast Ethernet ports, all Gigabit Ethernet ports, all EtherChannel ports, or all VLANs. However, you can define up to five interface ranges with a single command, with each range separated by a comma. port-range Port range. For a list of valid values for port-range, see the “Usage Guidelines” section. macro name Specify the name of a macro. Release Modification 12.1(11)AX This command was first introduced.2-91 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface range Valid values for port-range type and interface: • vlan vlan-ID - vlan-ID, where VLAN ID is from 1 to 4094 • fastethernet stack member/module/{first port} - {last port}, where switch is the switch number and module is 0 • gigabitethernet stack member/module/{first port} - {last port}, where switch is the switch number and module is 0 For physical interfaces: – stack member is the number used to identify the switch within the stack. The number ranges from 1 to 9 and is assigned to the switch the first time the stack member initializes. – module is always 0 – the range is type stack member/0/number - number (for example, gigabitethernet1/0/1 - 2) • port-channel port-channel-number - port-channel-number, where port-channel-number is from 1 to 12 Note When you use the interface range command with port channels, the first and last port channel number in the range must be active port channels. When you define a range, you must enter a space between the first entry and the hyphen (-): interface range gigabitethernet1/0/1 -2 When you define multiple ranges, you must still enter a space after the first entry, before the comma (,): interface range fastethernet1/0/3 , gigabitethernet1/0/1 - 2 interface range gigabitethernet1/0/3 -5, gigabitethernet1/0/7 -8 You cannot specify both a macro and an interface range in the same command. A single interface can also be specified in port-range (this would make the command similar to the interface interface-id global configuration command). Note For more information about configuring interface ranges, refer to the software configuration guide for this release. Examples This example shows how to use the interface range command to enter interface range configuration mode to apply commands to two ports: Switch(config)# interface range gigabitethernet1/0/1 - 2 Switch(config-if-range)# This example shows how to use a port-range macro macro1 for the same function. The advantage is that you can reuse macro1 until you delete it. Switch(config)# define interface-range macro1 gigabitethernet1/0/1 - 2 Switch(config)# interface range macro macro1 Switch(config-if-range)#2-92 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface range Related Commands Command Description define interface-range Creates an interface range macro. show running-config Displays the configuration information currently running on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-93 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface vlan interface vlan Use the interface vlan global configuration command on the switch stack or on a standalone switch to create or access a dynamic switch virtual interface (SVI) and to enter interface configuration mode. Use the no form of this command to delete an SVI. interface vlan vlan-id no interface vlan vlan-id Syntax Description Defaults The default VLAN interface is VLAN 1. Command Modes Global configuration Command History Usage Guidelines You cannot delete the VLAN 1 interface. SVIs are created the first time that you enter the interface vlan vlan-id command for a particular vlan. The vlan-id corresponds to the VLAN-tag associated with data frames on an ISL or 802.1Q encapsulated trunk or the VLAN ID configured for an access port. Note When you create an SVI, it does not become active until it is associated with a physical port. If you delete an SVI by entering the no interface vlan vlan-id command, the deleted interface is no longer visible in the output from the show interfaces privileged EXEC command. You can reinstate a deleted SVI by entering the interface vlan vlan-id command for the deleted interface. The interface comes back up, but much of the previous configuration will be gone. The interrelationship between the number of SVIs configured on a switch stack and the number of other features being configured might have an impact on CPU utilization due to hardware limitations. You can use the sdm prefer global configuration command to reallocate system hardware resources based on templates and feature tables. For more information, see the sdm prefer command. vlan-id VLAN number. The range is 1 to 4094. Release Modification 12.1(11)AX This command was first introduced.2-94 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands interface vlan Examples This example shows how to create a new SVI with VLAN ID 23 and enter interface configuration mode: Switch(config)# interface vlan 23 Switch(config-if)# You can verify your setting by entering the show interfaces and show interfaces vlan vlan-id privileged EXEC commands. Related Commands Command Description show interfaces vlan vlan-id Displays the administrative and operational status of all interfaces or the specified VLAN.2-95 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip access-group ip access-group Use the ip access-group interface configuration command on the switch stack or on a standalone switch to control access to a Layer 2 or Layer 3 interface. Use the no form of this command to remove all access groups or the specified access group from the interface. ip access-group {access-list-number | name} {in | out} no ip access-group [access-list-number | name] {in | out} Syntax Description Defaults No access list is applied to the interface. Command Modes Interface configuration Command History Usage Guidelines You can apply named or numbered standard or extended IP access lists to an interface. To define an access list by name, use the ip access-list global configuration command. To define a numbered access list, use the access list global configuration command. You can used numbered standard access lists ranging from 1 to 99 and 1300 to 1999 or extended access lists ranging from 100 to 199 and 2000 to 2699. You can use this command to apply an access list to a Layer 2 or Layer 3 interface. However, note these limitations for Layer 2 interfaces (port ACLs): • You can only apply ACLs in the inbound direction; the out keyword is not supported for Layer 2 interfaces. • You can only apply one IP ACL and one MAC ACL per interface. • Layer 2 interfaces do not support logging; if the log keyword is specified in the IP ACL, it is ignored. • An IP ACL applied to a Layer 2 interface only filters IP packets. To filter non-IP packets, use the mac access-group interface configuration command with MAC extended ACLs. access-list-number The number of the IP access control list (ACL). The range is 1 to 199 or 1300 to 2699. name The name of an IP ACL, specified in the ip access-list global configuration command. in Specify filtering on inbound packets. out Specify filtering on outbound packets. This keyword is valid only on Layer 3 interfaces. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 This command support was extended to Layer 2 interfaces.2-96 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip access-group You can use router ACLs, input port ACLs, and VLAN maps on the same switch. However, a port ACL takes precedence over a router ACL or VLAN map. • When an input port ACL is applied to an interface and a VLAN map is applied to a VLAN that the interface is a member of, incoming packets received on ports with the ACL applied are filtered by the port ACL. Other packets are filtered by the VLAN map. • When an input router ACL and input port ACLs exist in an switch virtual interface (SVI), incoming packets received on ports to which a port ACL is applied are filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by the router ACL. Other packets are not filtered. • When an output router ACL and input port ACLs exist in an SVI, incoming packets received on the ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IP packets are filtered by the router ACL. Other packets are not filtered. • When a VLAN map, input router ACLs, and input port ACLs exist in an SVI, incoming packets received on the ports to which a port ACL is applied are only filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by both the VLAN map and the router ACL. Other packets are filtered only by the VLAN map. • When a VLAN map, output router ACLs, and input port ACLs exist in an SVI, incoming packets received on the ports to which a port ACL is applied are only filtered by the port ACL. Outgoing routed IP packets are filtered by both the VLAN map and the router ACL. Other packets are filtered only by the VLAN map. You can apply IP ACLs to both outbound or inbound Layer 3 interfaces. A Layer 3 interface can have one IP ACL applied in each direction. You can configure only one VLAN map and one router ACL in each direction (input/output) on a VLAN interface. For standard inbound access lists, after the switch receives a packet, it checks the source address of the packet against the access list. IP extended access lists can optionally check other fields in the packet, such as the destination IP address, protocol type, or port numbers. If the access list permits the packet, the switch continues to process the packet. If the access list denies the packet, the switch discards the packet. If the access list has been applied to a Layer 3 interface, discarding a packet (by default) causes the generation of an Internet Control Message Protocol (ICMP) Host Unreachable message. ICMP Host Unreachable messages are not generated for packets discarded on a Layer 2 interface. For standard outbound access lists, after receiving a packet and sending it to a controlled interface, the switch checks the packet against the access list. If the access list permits the packet, the switch sends the packet. If the access list denies the packet, the switch discards the packet and, by default, generates an ICMP Host Unreachable message. If the specified access list does not exist, all packets are passed. Examples This example shows how to apply IP access list 101 to inbound packets on Gigabit Ethernet interface 0/1 on stack member 1: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip access-group 101 in You can verify your settings by entering the show ip interface, show access-lists, or show ip access-lists privileged EXEC command.2-97 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip access-group Related Commands Command Description access list Configures a numbered ACL. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. ip access-list Configures a named ACL. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. show access-lists Displays ACLs configured on the switch. show ip access-lists Displays IP ACLs configured on the switch. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. show ip interface Displays information about interface status and configuration. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Addressing Commands.2-98 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip address ip address Use the ip address interface configuration command on the switch stack or on a standalone switch to set an IP address for the Layer 2 switch or an IP address for each switch virtual interface (SVI) or routed port on the Layer 3 switch. Use the no form of this command to remove an IP address or to disable IP processing. ip address ip-address subnet-mask [secondary] no ip address [ip-address subnet-mask] [secondary] Syntax Description Defaults No IP address is defined. Command Modes Interface configuration Command History Usage Guidelines If you remove the switch IP address through a Telnet session, your connection to the switch will be lost. Hosts can determine subnet masks using the Internet Control Message Protocol (ICMP) Mask Request message. Routers respond to this request with an ICMP Mask Reply message. You can disable IP processing on a particular interface by removing its IP address with the no ip address command. If the switch detects another host using one of its IP addresses, it will send an error message to the console. You can use the optional keyword secondary to specify an unlimited number of secondary addresses. Secondary addresses are treated like primary addresses, except the system never generates datagrams other than routing updates with secondary source addresses. IP broadcasts and ARP requests are handled properly, as are interface routes in the IP routing table. Note If any router on a network segment uses a secondary address, all other devices on that same segment must also use a secondary address from the same network or subnet. Inconsistent use of secondary addresses on a network segment can very quickly cause routing loops. When you are routing Open Shortest Path First (OSPF), ensure that all secondary addresses of an interface fall into the same OSPF area as the primary addresses. ip-address IP address. subnet-mask Mask for the associated IP subnet. secondary (Optional) Specifies that the configured address is a secondary IP address. If this keyword is omitted, the configured address is the primary IP address. Release Modification 12.1(11)AX This command was first introduced.2-99 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip address If your switch receives its IP address from a Bootstrap Protocol (BOOTP) or Dynamic Host Configuration Protocol (DHCP) server and you remove the switch IP address by using the no ip address command, IP processing is disabled, and the BOOTP or DHCP server cannot reassign the address. A Layer 3 switch can have an IP address assigned to each routed port and SVI. The number of routed ports and SVIs that you can configure is not limited by software; however, the interrelationship between this number and the number of other features being configured might have an impact on CPU utilization due to hardware limitations. You can use the sdm prefer global configuration command to reallocate system hardware resources based on templates and feature tables. For more information, see the sdm prefer command. Examples This example shows how to configure the IP address for the Layer 2 switch on a subnetted network: Switch(config)# interface vlan 1 Switch(config-if)# ip address 172.20.128.2 255.255.255.0 This example shows how to configure the IP address for a port on the Layer 3 switch: Switch(config)# ip multicast-routing Switch(config)# interface gigabitethernet6/0/1 Switch(config-if)# no switchport Switch(config-if)# ip address 172.20.128.2 255.255.255.0 You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-100 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp filter ip igmp filter Use the ip igmp filter interface configuration command on the switch stack or on a standalone switch to control whether or not all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an Internet Group Management Protocol (IGMP) profile to the interface. Use the no form of this command to remove the specified profile from the interface. ip igmp filter profile number no ip igmp filter Syntax Description Defaults No IGMP filters are applied. Command Modes Interface configuration Command History Usage Guidelines You can apply IGMP filters only to Layer 2 physical interfaces; you cannot apply IGMP filters to routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group. An IGMP profile can be applied to one or more switch port interfaces, but one port can have only one profile applied to it. Examples This example shows how to apply IGMP profile 22 to an interface. Switch(config)# interface gigabitethernet1/0/12 Switch(config-if)# ip igmp filter 22 You can verify your setting by using the show running-config privileged EXEC command and by specifying an interface. Related Commands profile number The IGMP profile number to be applied. The range is 1 to 4294967295. Release Modification 12.1(11)AX This command was first introduced. Command Description ip igmp profile Configures the specified IGMP profile number. show ip igmp profile Displays the characteristics of the specified IGMP profile. show running-config interface interface-id Displays the running configuration on the switch interface, including the IGMP profile (if any) that is applied to an interface. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-101 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp max-groups ip igmp max-groups Use the ip igmp max-groups interface configuration command on the switch stack or on a standalone switch to set the maximum number of Internet Group Management Protocol (IGMP) groups that a Layer 2 interface can join. Use the no form of this command to set the maximum back to the default, which is to have no maximum limit. ip igmp max-groups number no ip igmp max-groups Syntax Description Defaults No limit. Command Modes Interface configuration Command History Usage Guidelines You can use this command only on Layer 2 physical interfaces; you cannot set IGMP maximum groups for routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group. Examples This example shows how to limit the number of IGMP groups that an interface can join to 25. Switch(config)# interface gigabitethernet1/0/12 Switch(config-if)# ip igmp max-groups 25 You can verify your setting by using the show running-config privileged EXEC command and by specifying an interface. Related Commands number The maximum number of IGMP groups that an interface can join. The range is 0 to 4294967294. The default is no limit. Release Modification 12.1(11)AX This command was first introduced. Command Description show running-config interface interface-id Displays the running configuration on the switch interface, including the maximum number of IGMP groups that an interface can join. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-102 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp profile ip igmp profile Use the ip igmp profile global configuration command on the switch stack or on a standalone switch to create an Internet Group Management Protocol (IGMP) profile and enter IGMP profile configuration mode. From this mode, you can specify the configuration of the IGMP profile to be used for filtering IGMP membership reports from a switchport. Use the no form of this command to delete the IGMP profile. ip igmp profile profile number no ip igmp profile profile number Syntax Description Defaults No IGMP profiles are defined. When configured, the default action for matching an IGMP profile is to deny matching addresses. Command Modes Global configuration Command History Usage Guidelines When you are in IGMP profile configuration mode, you can create the profile by using these commands: • deny: specifies that matching addresses are denied; this is the default condition. • exit: exits from igmp-profile configuration mode. • no: negates a command or resets to its defaults. • permit: specifies that matching addresses are permitted. • range: specifies a range of IP addresses for the profile. This can be a single IP address or a range with a start and an end address. When entering a range, enter the low IP multicast address, a space, and the high IP multicast address. You can apply an IGMP profile to one or more Layer 2 interfaces, but each interface can have only one profile applied to it. Examples This example shows how to configure IGMP profile 40 that permits the specified range of IP multicast addresses. Switch(config)# ip igmp profile 40 Switch(config-igmp-profile)# permit Switch(config-igmp-profile)# range 233.1.1.1 233.255.255.255 You can verify your settings by using the show ip igmp profile privileged EXEC command. profile number The IGMP profile number being configured. The range is 1 to 4294967295. Release Modification 12.1(11)AX This command was first introduced.2-103 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp profile Related Commands Command Description ip igmp filter Applies the IGMP profile to the specified interface. show ip igmp profile Displays the characteristics of all IGMP profiles or the specified IGMP profile number.2-104 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp snooping ip igmp snooping Use the ip igmp snooping global configuration command on the switch stack or on a standalone switch to globally enable Internet Group Management Protocol (IGMP) snooping on the switch or to enable it on a VLAN. Use the command with keywords to enable and configure IGMP snooping on a VLAN interface. Use the no form of this command to disable IGMP snooping or to reset the parameters to the default settings. ip igmp snooping [vlan vlan-id [immediate-leave | mrouter {interface interface-id | learn {cgmp | pim-dvmrp}} | static ip-address interface interface-id]] no ip igmp snooping [vlan vlan-id [immediate-leave | mrouter {interface interface-id | learn {cgmp | pim-dvmrp}} | static ip-address interface interface-id]] Syntax Description Note Though visible in the command-line help string, the report-suppression, source-only-learning, and tcn keywords are not supported. vlan vlan-id (Optional) When used with other keywords, enable IGMP snooping on a VLAN interface. Use the no form of this command to disable IGMP snooping on a VLAN interface. The range is 1 to 4094. immediate-leave (Optional) Enable IGMP immediate-leave processing on a VLAN interface. Use the no form of the command to disable the Immediate Leave feature on the interface. mrouter (Optional) Add a multicast router port or configure the multicast router learning method. The no form of the command removes the configuration. interface interface-id (Optional) With mrouter, specify the next-hop interface to the multicast router. With static, specify the interface of the member port. It can be one of these values: • fastethernet interface number—a Fast Ethernet 802.3 interface. • gigabitethernet interface number—a Gigabit Ethernet 802.3Z interface. • port-channel interface number—a channel interface. The range is 0 to 12. learn (Optional) With mrouter, specify the multicast router learning method. cgmp Set the switch to learn multicast router ports by snooping on Cisco Group Management Protocol (CGMP) packets. pim-dvmrp Set the switch to learn multicast router ports by snooping on IGMP queries and Protocol-Independent Multicast-Distance Vector Multicast Routing Protocol (PIM-DVMRP) packets. static ip-address (Optional) Add a Layer 2 port as a member of a multicast group with the specified group IP address.2-105 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp snooping Defaults IGMP snooping is globally enabled on the switch. IGMP snooping is enabled on VLAN interfaces. IGMP immediate-leave processing is disabled. The default learning method is pim-dvmrp—to snoop IGMP queries and PIM-DVMRP packets. By default, there are no ports specified as members of a static multicast group. By default, there are no multicast router ports. Command Modes Global configuration Command History Usage Guidelines When IGMP snooping is enabled globally, it is enabled in all the existing VLAN interfaces. When IGMP snooping is disabled globally, it is disabled on all the existing VLAN interfaces. You should only configure the Immediate Leave feature when there is a maximum of one receiver on every port in the VLAN. The configuration is saved in nonvolatile RAM (NVRAM). The Immediate Leave feature is supported only with IGMP version 2 hosts. The CGMP learn method is useful for reducing control traffic. The static keyword is used for configuring the IGMP member ports statically. The enabled configuration (globally or per VLAN), the learn method, and the static ports and groups are saved in nonvolatile RAM (NVRAM). Examples This example shows how to globally enable IGMP snooping: Switch(config)# ip igmp snooping This example shows how to globally disable IGMP snooping: Switch(config)# no ip igmp snooping This example shows how to enable IGMP snooping on VLAN 1: Switch(config)# ip igmp snooping vlan 1 This example shows how to disable IGMP snooping on VLAN 1: Switch(config)# no ip igmp snooping vlan 1 This example shows how to enable IGMP immediate-leave processing on VLAN 1: Switch(config)# ip igmp snooping vlan 1 immediate-leave This example shows how to disable IGMP immediate-leave processing on VLAN 1: Switch(config)# no ip igmp snooping vlan 1 immediate-leave Release Modification 12.1(11)AX This command was first introduced.2-106 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands ip igmp snooping This example shows how to configure Gigabit Ethernet interface 2 on stack member 1 as a multicast router port: Switch(config)# ip igmp snooping vlan 1 mrouter interface gigabitethernet1/0/2 This example shows how to specify the multicast router learning method as CGMP: Switch(config)# no ip igmp snooping vlan 1 mrouter learn cgmp You can verify your settings by entering the show ip igmp snooping privileged EXEC command. Related Commands Command Description show ip igmp snooping Displays the snooping configuration. show ip igmp snooping mrouter Displays the IGMP snooping router ports. show ip igmp snooping multicast Displays IGMP snooping multicast information. 2-107 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands lacp port-priority lacp port-priority Use the lacp port-priority interface configuration command on the switch stack or on a standalone switch to configure the port priority for the Link Aggregation Control Protocol (LACP). Use the no form of this command to return to the default setting. lacp port-priority priority no lacp port-priority Syntax Description Defaults The default is 32768. Command Modes Interface configuration Command History Usage Guidelines This command takes effect only on EtherChannel interfaces that are already configured for LACP. The software assigns to every link between systems that operate LACP a unique priority made up of the system priority, system ID, port priority, and the port number. In priority comparisons, numerically lower values have higher priority. The priority determines which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. Ports are considered for active use in aggregation in link-priority order starting with the port attached to the highest priority link. Each port is selected for active use if the preceding higher priority selections can also be maintained. Otherwise, the port is selected for standby mode. Use the show etherchannel summary privileged EXEC command to see which ports are in the hot-standby mode (denoted with an H port-state flag). The lower the priority, the more likely that the interface will be used for LACP transmission. For information about configuring LACP on physical interfaces, refer to the “Configuring EtherChannels” chapter in the software configuration guide for this release. Examples This example shows how to configure the LACP port priority on Gigabit Ethernet interface 0/1 on stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# lacp port-priority 1000 You can verify your settings by entering the show lacp [channel-group-number] internal privileged EXEC command. priority Port priority for LACP. The range is 1 to 65535. Release Modification 12.1(14)EA1 This command was first introduced.2-108 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands lacp port-priority Related Commands Command Description channel-group Assigns an Ethernet interface to an EtherChannel group. lacp system-priority Configures the LACP system priority. show lacp [channel-group-number] internal Displays internal information for all channel groups or for the specified channel group.2-109 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands lacp system-priority lacp system-priority Use the lacp system-priority global configuration command on the switch stack or on a standalone switch to configure the system priority for the Link Aggregation Control Protocol (LACP). Use the no form of this command to return to the default setting. lacp system-priority priority no lacp system-priority Syntax Description Defaults The default is 32768. Command Modes Global configuration Command History Usage Guidelines Although this is a global configuration command, the priority takes effect only on EtherChannels that have physical interfaces that are already configured for LACP. The software assigns to every link between systems that operate LACP a unique priority made up of the system priority, system ID, port priority, and the port number. In priority comparisons, numerically lower values have higher priority. The priority determines which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. Ports are considered for active use in aggregation in link-priority order, starting with the port attached to the highest priority link. Each port is selected for active use if the preceding higher priority selections can also be maintained. Otherwise, the port is selected for standby mode. Use the show etherchannel summary privileged EXEC command to see which ports are in the hot-standby mode (denoted with an H port-state flag). The lower the priority, the more likely that the interface will be used for LACP transmission. For more information about configuring LACP on physical interfaces, refer to the “Configuring EtherChannels” chapter in the software configuration guide for this release. Examples This example shows how to set the LACP system priority: Switch(config)# lacp system-priority 20000 You can verify your settings by entering the show lacp sys-id privileged EXEC command. priority System priority for LACP. The range is 1 to 65535. Release Modification 12.1(14)EA1 This command was first introduced.2-110 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands lacp system-priority Related Commands Command Description channel-group Assigns an Ethernet interface to an EtherChannel group. lacp port-priority Configures the LACP port priority. show lacp sys-id Display the system identifier that is being used by LACP.2-111 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands logging file logging file Use the logging file global configuration command on the switch stack or on a standalone switch to set logging file parameters. Use the no form of this command to return to the default setting. logging file filesystem:filename [max-file-size [min-file-size]] [severity-level-number | type] no logging file filesystem:filename [severity-level-number | type] Syntax Description Defaults The minimum file size is 2048 bytes; the maximum file size is 4096 bytes. The default severity level is 7 (debugging messages and numerically lower levels). Command Modes Global configuration Command History filesystem:filename Alias for a Flash file system. Contains the path and name of the file that contains the log messages. The syntax for the local Flash file system on the stack member or the stack master: flash: From the stack master, the syntax for the local Flash file system on a stack member: flash member number max-file-size (Optional) Specify the maximum logging file size. The range is 4096 to 2147483647. min-file-size (Optional) Specify the minimum logging file size. The range is 1024 to 2147483647. severity-level-number (Optional) Specify the logging severity level. The range is 0 to 7. See the type option for the meaning of each level. type (Optional) Specify the logging type. These keywords are valid: • emergencies—System is unusable (severity 0). • alerts—Immediate action needed (severity 1). • critical—Critical conditions (severity 2). • errors—Error conditions (severity 3). • warnings—Warning conditions (severity 4). • notifications—Normal but significant messages (severity 5). • information—Information messages (severity 6). • debugging—Debugging messages (severity 7). Release Modification 12.1(11)AX This command was first introduced.2-112 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands logging file Usage Guidelines The log file is stored in ASCII text format in an internal buffer on a standalone switch, and in the case of a switch stack, on the stack master. If a standalone switch or the stack master fails, the log is lost unless you had previously saved it to Flash memory by using the logging file flash:filename global configuration command. After saving the log to Flash memory by using the logging file flash:filename global configuration command, you can use the more flash:filename privileged EXEC command to display its contents. The command rejects the minimum file size if it is greater than the maximum file size minus 1024; the minimum file size then becomes the maximum file size minus 1024. Specifying a level causes messages at that level and numerically lower levels to be displayed. Examples This example shows how to save informational log messages to a file in Flash memory: Switch(config)# logging file flash:logfile informational You can verify your setting by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-113 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac access-group mac access-group Use the mac access-group interface configuration command on the switch stack or on a standalone switch to apply a MAC access control list (ACL) to a Layer 2 interface. Use the no form of this command to remove all MAC ACLs or the specified MAC ACL from the interface. You create the MAC ACL by using the mac access-list extended global configuration command. mac access-group {name} in no mac access-group {name} Syntax Description Defaults No MAC ACL is applied to the interface. Command Modes Interface configuration (Layer 2 interfaces only) Command History Usage Guidelines You can apply MAC ACLs only to ingress Layer 2 interfaces. You cannot apply MAC ACLs to Layer 3 interfaces. On Layer 2 interfaces, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC access lists. You can filter both IP and non-IP traffic on the same Layer 2 interface by applying both an IP ACL and a MAC ACL to the interface. You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface. If a MAC ACL is already configured on a Layer 2 interface and you apply a new MAC ACL to the interface, the new ACL replaces the previously configured one. If you apply an ACL to a Layer 2 interface on a switch, and the switch has an input Layer 3 ACL or a VLAN map applied to a VLAN that the interface is a member of, the ACL applied to the Layer 2 interface takes precedence. When an inbound packet is received on an interface with a MAC ACL applied, the switch checks the match conditions in the ACL. If the conditions are matched, the switch forwards or drops the packet, according to the ACL. If the specified ACL does not exist, the switch forwards all packets. Note For more information about configuring MAC extended ACLs, refer to the “Configuring Network Security with ACLs” chapter in the software configuration guide for this release. name Specify a named MAC access list. in Specify that the ACL is applied in the ingress direction. Outbound ACLs are not supported on Layer 2 interfaces. Release Modification 12.1(14)EA1 This command was first introduced.2-114 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac access-group Examples This example shows how to apply a MAC extended ACL named macacl2 to an interface: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# mac access-group macacl2 in You can verify your settings by entering the show mac access-group privileged EXEC command. You can view configured ACLs on the switch by entering the show access-lists privileged EXEC command. Related Commands Command Description show access-lists Displays the ACLs configured on the switch. show mac access-group Displays the MAC ACLs configured on the switch. show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-115 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac access-list extended mac access-list extended Use the mac access-list extended global configuration command on the switch stack or on a standalone switch to create an access list based on MAC addresses for non-IP traffic. Using this command puts you in the extended MAC access list configuration mode. Use the no form of this command to return to the default setting. Note You cannot apply named MAC extended ACLs to Layer 3 interfaces. mac access-list extended name no mac access-list extended name Syntax Description Defaults By default, there are no MAC access lists created. Command Modes Global configuration Command History Usage Guidelines MAC named extended lists are used with VLAN maps and class maps. You can apply named MAC extended ACLs to VLAN maps or to Layer 2 interfaces; you cannot apply named MAC extended ACLs to Layer 3 interfaces. Entering the mac access-list extended command enables the MAC-access list configuration mode. These configuration commands are available: • default: sets a command to its default. • deny: specifies packets to reject. For more information, see the deny MAC-access list configuration command. • exit: exits from MAC-access list configuration mode. • no: negates a command or sets its defaults. • permit: specifies packets to forward. For more information, see the permit command. Note For more information about MAC extended access lists, refer to the software configuration guide for this release. name Assign a name to the MAC extended access list. Release Modification 12.1(11)AX This command was first introduced.2-116 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac access-list extended Examples This example shows how to create a MAC named extended access list named mac1 and to enter extended MAC access list configuration mode: Switch(config)# mac access-list extended mac1 Switch(config-ext-macl)# This example shows how to delete MAC named extended access list mac1: Switch(config)# no mac access-list extended mac1 You can verify your settings by entering the show access-lists privileged EXEC command. Related Commands Command Description deny permit Configures the MAC ACL (in extended MAC-access list configuration mode). show access-lists Displays the access lists configured on the switch. vlan access-map Defines a VLAN map and enters access-map configuration mode where you can specify a MAC ACL to match and the action to be taken.2-117 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac-address-table aging-time mac-address-table aging-time Use the mac-address-table aging-time global configuration command on the switch stack or on a standalone switch to set the length of time that a dynamic entry remains in the MAC address table after the entry is used or updated. Use the no form of this command to return to the default setting. The aging time applies to all VLANs or a specified VLAN. mac-address-table aging-time {0 | 10-1000000} [vlan vlan-id] no mac-address-table aging-time {0 | 10-1000000} [vlan vlan-id] Syntax Description Defaults The default is 300 seconds. Command Modes Global configuration Command History Usage Guidelines If hosts do not send continuously, increase the aging time to record the dynamic entries for a longer time. Increasing the time can reduce the possibility of flooding when the hosts send again. If you do not specify a specific VLAN, this command sets the aging time for all VLANs. Examples This example shows how to set the aging time to 200 seconds for all VLANs: Switch(config)# mac-address-table aging-time 200 You can verify your setting by entering the show mac-address-table aging-time privileged EXEC command. Related Commands 0 This value disables aging. Static address entries are never aged or removed from the table. 10-100000 Aging time in seconds. The range is 10 to 1000000 seconds. vlan vlan-id (Optional) Specify the VLAN ID to which to apply the aging time. The range is 1 to 4094. Release Modification 12.1(11)AX This command was first introduced. Command Description show mac-address-table aging-time Displays the MAC address table aging time for all VLANs or the specified VLAN.2-118 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac-address-table notification mac-address-table notification Use the mac-address-table notification global configuration command on the switch stack or on a standalone switch to enable the MAC address notification feature on the switch stack. Use the no form of this command to return to the default setting. mac-address-table notification [history-size value] | [interval value] no mac-address-table notification [history-size | interval] Syntax Description Defaults By default, the MAC address notification feature is disabled. The default trap interval value is 1 second. The default number of entries in the history table is 1. Command Modes Global configuration Command History Usage Guidelines The MAC address notification feature sends Simple Network Management Protocol (SNMP) traps to the network management system (NMS) whenever a new MAC address is added or an old address is deleted from the forwarding tables. MAC notifications are generated only for dynamic and secure MAC addresses. Events are not generated for self addresses, multicast addresses, or other static addresses. When you configure the history-size option, the existing MAC address history table is deleted, and a new table is created. You enable the MAC address notification feature by using the mac-address-table notification command. You must also enable MAC address notification traps on an interface by using the snmp trap mac-notification interface configuration command and configure the switch to send MAC address traps to the NMS by using the snmp-server enable traps mac-notification global configuration command. history-size value (Optional) Configure the maximum number of entries in the MAC notification history table. The range is 1 to 500 entries. interval value (Optional) Set the notification trap interval. The switch stack sends the notification traps when this amount of time has elapsed. The range is 0 to 2147483647 seconds. Release Modification 12.1(11)AX This command was first introduced.2-119 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac-address-table notification Examples This example shows how to enable the mac-address-table notification feature, set the interval time to 60 seconds, and set the history-size to 100 entries: Switch(config)# mac-address-table notification Switch(config)# mac-address-table notification interval 60 Switch(config)# mac-address-table notification history-size 100 You can verify your settings by entering the show mac-address-table notification privileged EXEC command. Related Commands Command Description clear mac-address-table notification Clears the MAC address notification global counters. show mac-address-table notification Displays the MAC address notification settings on all interfaces or on the specified interface. snmp-server enable traps Sends the SNMP MAC notification traps when the mac-notification keyword is appended. snmp trap mac-notification Enables the SNMP MAC notification trap on a specific interface.2-120 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mac-address-table static mac-address-table static Use the mac-address-table static global configuration command on the switch stack or on a standalone switch to add static addresses to the MAC address table. Use the no form of this command to remove static entries from the table. mac-address-table static mac-addr vlan vlan-id interface interface-id no mac-address-table static mac-addr vlan vlan-id interface interface-id Syntax Description Defaults No static addresses are configured. Command Modes Global configuration Command History Examples This example shows how to add the static address c2f3.220a.12f4 to the MAC address table. When a packet is received in VLAN 4 with this MAC address as its destination, the packet is forwarded to the specified interface: Switch(config)# mac-address-table static c2f3.220a.12f4 vlan 4 interface gigabitethernet6/0/1 You can verify your setting by entering the show mac-address-table privileged EXEC command. Related Commands mac-addr Destination MAC address (unicast or multicast) to add to the address table. Packets with this destination address received in the specified VLAN are forwarded to the specified interface. vlan vlan-id Specify the VLAN for which the packet with the specified MAC address is received. The range is 1 to 4094. interface interface-id Interface to which the received packet is forwarded. Valid interfaces include physical ports and port channels. Release Modification 12.1(11)AX This command was first introduced. Command Description show mac-address-table static Displays static MAC address table entries only.2-121 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands match (access-map configuration) match (access-map configuration) Use the match access-map configuration command on the switch stack or on a standalone switch to set the VLAN map to match packets against one or more access lists. Use the no form of this command to remove the match parameters. match {ip address {name | number} [name | number] [name | number]...} | {mac address {name} [name] [name]...} no match {ip address {name | number} [name | number] [name | number]...} | {mac address {name} [name] [name]...} Syntax Description Defaults The default action is to have no match parameters applied to a VLAN map. Command Modes Access-map configuration Command History Usage Guidelines You enter access-map configuration mode by using the vlan access-map global configuration command. You must enter one access list name or number; others are optional. You can match packets against one or more access lists. Matching any of the lists counts as a match of the entry. In access-map configuration mode, use the match command to define the match conditions for a VLAN map applied to a VLAN. Use the action command to set the action that occurs when the packet matches the conditions. Packets are matched only against access lists of the same protocol type; IP packets are matched against IP access lists, and all other packets are matched against MAC access lists. Both IP and MAC addresses can be specified for the same map entry. ip address Set the access map to match packets against an IP address access list. mac address Set the access map to match packets against a MAC address access list. name Name of the access list to match packets against. number Number of the access list to match packets against. This option is not valid for MAC access lists. Release Modification 12.1(11)AX This command was first introduced.2-122 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands match (access-map configuration) Examples This example shows how to define and apply a VLAN access map vmap4 to VLANs 5 and 6 that will cause the interface to drop an IP packet if the packet matches the conditions defined in access list al2. Switch(config)# vlan access-map vmap4 Switch(config-access-map)# match ip address al2 Switch(config-access-map)# action drop Switch(config-access-map)# exit Switch(config)# vlan filter vmap4 vlan-list 5-6 You can verify your settings by entering the show vlan access-map privileged EXEC command. Related Commands Command Description access-list Configures a standard numbered ACL. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. action Specifies the action to be taken if the packet matches an entry in an access control list (ACL). ip access list Creates a named access list. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. mac access-list extended Creates a named MAC address access list. show vlan access-map Displays the VLAN access maps created on the switch. vlan access-map Creates a VLAN access map.2-123 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands match (class-map configuration) match (class-map configuration) Use the match class-map configuration command on the switch stack or on a standalone switch to define the match criteria to classify traffic. Use the no form of this command to remove the match criteria. match {access-group acl-index-or-name | ip dscp dscp-list | ip precedence ip-precedence-list} no match {access-group acl-index-or-name | ip dscp dscp-list | ip precedence ip-precedence-list} Syntax Description Note Though visible in the command-line help strings, the any, class-map, destination-address, input-interface, mpls, not, protocol, and source-address keywords are not supported. Defaults No match criteria are defined. Command Modes Class-map configuration Command History access-group acl-index-or-name Number or name of an IP standard or extended access control list (ACL) or MAC ACL. For an IP standard ACL, the ACL index range is 1 to 99 and 1300 to 1999. For an IP extended ACL, the ACL index range is 100 to 199 and 2000 to 2699. ip dscp dscp-list List of up to eight IP Differentiated Services Code Point (DSCP) values to match against incoming packets. Separate each value with a space. The range is 0 to 63. You also can enter a mnemonic name for a commonly-used value. ip precedence ip-precedence-list List of up to eight IP-precedence values to match against incoming packets. Separate each value with a space. The range is 0 to 7. You also can enter a mnemonic name for a commonly-used value Release Modification 12.1(11)AX This command was first introduced.2-124 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands match (class-map configuration) Usage Guidelines The match command is used to specify which fields in the incoming packets are examined to classify the packets. Only the IP access group or the MAC access group matching to the Ether Type/Len are supported. To define packet classification on a physical-port basis, only one match command per class map is supported. In this situation, the match-all and match-any keywords are equivalent. For the match ip dscp dscp-list or the match ip precedence ip-precedence-list command, you can enter a mnemonic name for a commonly-used value. For example, you can enter the match ip dscp af11 command, which is the same as entering the match ip dscp 10 command. You can enter the match ip precedence critical command, which is the same as entering the match ip precedence 5 command. For a list of supported mnemonics, enter the match ip dscp ? or the match ip precedence ? command to see the command-line help strings. This example shows how to create a class map called class2, which matches all the incoming traffic with DSCP values of 10, 11, and 12: Switch(config)# class-map class2 Switch(config-cmap)# match ip dscp 10 11 12 Switch(config-cmap)# exit This example shows how to create a class map called class3, which matches all the incoming traffic with IP-precedence values of 5, 6, and 7: Switch(config)# class-map class3 Switch(config-cmap)# match ip precedence 5 6 7 Switch(config-cmap)# exit This example shows how to delete the IP-precedence match criteria and to classify traffic using acl1: Switch(config)# class-map class2 Switch(config-cmap)# match ip precedence 5 6 7 Switch(config-cmap)# no match ip precedence Switch(config-cmap)# match access-group acl1 Switch(config-cmap)# exit You can verify your settings by entering the show class-map privileged EXEC command. Related Commands Command Description class-map Creates a class map to be used for matching packets to the class whose name you specify. show class-map Displays quality of service (QoS) class maps.2-125 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mdix auto mdix auto Use the mdix auto interface configuration command on the switch stack or on a standalone switch to enable the automatic media-dependent-interface crossover (Auto-MDIX) feature on the interface. When Auto-MDIX is enabled, the interface automatically detects the required cable connection type (straight-through or crossover) and configures the connection appropriately. Use the no form of this command to disable Auto-MDIX. mdix auto no mdix auto Syntax Description This command has no arguments or keywords. Defaults The default is Auto-MDIX disabled. Command Modes Interface configuration Command History Usage Guidelines When you enable Auto-MDIX on an interface, you must also set the speed and duplex on the interface to auto so that the feature operates correctly. When Auto-MDIX (along with autonegotiation of speed and duplex) is enabled on one or both of connected interfaces, link up occurs, even if the cable type (straight through or crossover) is incorrect. Auto-MDIX is supported on all 10/100 and 10/100/1000-Mbps interfaces and on 10/100/1000BASE-T/TX small form-factor pluggable (SFP) module interfaces. It is not supported on 1000BASE-SX or -LX SFP module interfaces. Examples This example shows how to enable Auto-MDIX on Gigabit Ethernet interface 0/1 on stack member 1: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# speed auto Switch(config-if)# duplex auto Switch(config-if)# mdix auto Switch(config-if)# end You can verify the operational state of Auto-MDIX on the interface by entering the show controllers ethernet-controller interface-id phy privileged EXEC command. Release Modification 12.1(14)EA1 This command was first introduced.2-126 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mdix auto Related Commands Command Description show controllers ethernet-controller interface-id phy Displays general information about internal registers of an interface, including the operational state of Auto-MDIX.2-127 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos mls qos Use the mls qos global configuration command on the switch stack or on a standalone switch to enable quality of service (QoS) for the entire switch. When the mls qos command is entered, QoS is enabled with the default parameters on all ports in the system. Use the no form of this command to reset all the QoS-related statistics and to disable the QoS features for the entire switch. mls qos no mls qos Syntax Description This command has no arguments or keywords. Defaults QoS is disabled. There is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing). When QoS is enabled with the mls qos global configuration command and all other QoS settings are set to their defaults, traffic is classified as best effort (the DSCP and CoS value is set to 0) without any policing. No policy maps are configured. The default port trust state on all ports is untrusted. The default ingress and egress queue settings are in effect. Command Modes Global configuration Command History Usage Guidelines QoS must be globally enabled to use QoS classification, policing, mark down or drop, queueing, and traffic shaping features. You can create a policy-map and attach it to a port before entering the mls qos command. However, until you enter the mls qos command, QoS processing is disabled. Policy-maps and class-maps used to configure QoS are not deleted from the configuration by the no mls qos command, but entries corresponding to policy maps are removed from the switch hardware to save system resources. To re-enable QoS with the previous configurations, use the mls qos command. Toggling the QoS status of the switch with this command modifies (reallocates) the sizes of the queues. During the queue size modification, the queue is temporarily shut down during the hardware reconfiguration, and the switch drops newly arrived packets for this queue. Release Modification 12.1(11)AX This command was first introduced.2-128 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos Examples This example shows how to enable QoS on the switch: Switch(config)# mls qos You can verify your settings by entering the show mls qos privileged EXEC command. Related Commands Command Description show mls qos Displays QoS information.2-129 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos aggregate-policer mls qos aggregate-policer Use the mls qos aggregate-policer global configuration command on the switch stack or on a standalone switch to define policer parameters, which can be shared by multiple classes within the same policy map. A policer defines a maximum permissible rate of transmission, a maximum burst size for transmissions, and an action to take if either maximum is exceeded. Use the no form of this command to delete an aggregate policer. mls qos aggregate-policer aggregate-policer-name rate-bps burst-byte exceed-action {drop | policed-dscp-transmit} no mls qos aggregate-policer aggregate-policer-name Syntax Description Defaults No aggregate policers are defined. Command Modes Global configuration Command History Usage Guidelines Define an aggregate policer if the policer is shared with multiple classes. Policers for a port cannot be shared with other policers for another port; traffic from two different ports cannot be aggregated for policing purposes. The port ASIC supports 256 policers (255 policers plus 1 no policer). The maximum number of policers supported per port is 64. Policers are allocated on demand by the software and are constrained by the hardware and ASIC boundaries. You cannot reserve policers per port (there is no guarantee that a port will be assigned to any policer). You apply an aggregate policer to multiple classes in the same policy map; you cannot use an aggregate policer across different policy maps. aggregate-policer-name Name of the aggregate policer referenced by the police aggregate policy-map class configuration command. rate-bps Specify the average traffic rate in bits per second (bps). The range is 8000 to 1000000000. burst-byte Specify the normal burst size in bytes. The range is 8000 to 1000000. exceed-action drop When the specified rate is exceeded, specify that the switch drop the packet. exceed-action policed-dscp-transmit When the specified rate is exceeded, specify that the switch change the Differentiated Services Code Point (DSCP) of the packet to that specified in the policed-DSCP map and then send the packet. Release Modification 12.1(11)AX This command was first introduced.2-130 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos aggregate-policer You cannot delete an aggregate policer if it is being used in a policy map. You must first use the no police aggregate aggregate-policer-name policy-map class configuration command to delete the aggregate policer from all policy maps before using the no mls qos aggregate-policer aggregate-policer-name command. Policing uses a token-bucket algorithm. You configure the bucket depth (the maximum burst that is tolerated before the bucket overflows) by using the burst-byte option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. You configure how fast (the average rate) that the tokens are removed from the bucket by using the rate-bps option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. For more information, refer to the software configuration guide for this release. Examples This example shows how to define the aggregate policer parameters and how to apply the policer to multiple classes in a policy map: Switch(config)# mls qos aggregate-policer agg_policer1 10000 1000000 exceed-action drop Switch(config)# policy-map policy2 Switch(config-pmap)# class class1 Switch(config-pmap-c)# police aggregate agg_policer1 Switch(config-pmap-c)# exit Switch(config-pmap)# class class2 Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap-c)# police aggregate agg_policer1 Switch(config-pmap-c)# exit Switch(config-pmap)# class class3 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police aggregate agg_policer2 Switch(config-pmap-c)# exit You can verify your settings by entering the show mls qos aggregate-policer privileged EXEC command. Related Commands Command Description police aggregate Creates a policer that is shared by different classes. show mls qos aggregate-policer Displays the quality of service (QoS) aggregate policer configuration.2-131 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos cos mls qos cos Use the mls qos cos interface configuration command on the switch stack or on a standalone switch to define the default class of service (CoS) value of a port or to assign the default CoS to all incoming packets on the port. Use the no form of this command to return to the default setting. mls qos cos {default-cos | override} no mls qos cos {default-cos | override} Syntax Description Defaults The default CoS value for a port is 0. CoS override is disabled. Command Modes Interface configuration Command History Usage Guidelines You can use the default value to assign a CoS and Differentiated Services Code Point (DSCP) value to all incoming packets that are untagged (if the incoming packet does not have a CoS value). You also can assign a default CoS and DSCP value to all incoming packets by using the override keyword. Use the override keyword when all incoming packets on certain ports deserve higher or lower priority than packets entering from other ports. Even if a port is previously set to trust DSCP, CoS, or IP precedence, this command overrides the previously configured trust state, and all the incoming CoS values are assigned the default CoS value configured with the mls qos cos command. If an incoming packet is tagged, the CoS value of the packet is modified with the default CoS of the port at the ingress port. default-cos Assign a default CoS value to a port. If packets are untagged, the default CoS value becomes the packet CoS value. The CoS range is 0 to 7. override Override the CoS of the incoming packets, and apply the default CoS value on the port to all incoming packets. Release Modification 12.1(11)AX This command was first introduced.2-132 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos cos Examples This example shows how to configure the default port CoS to 4 on Gigabit Ethernet interface 0/1 of stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# mls qos trust cos Switch(config-if)# mls qos cos 4 This example shows how to assign all the packets entering a port to the default port CoS value of 4 on Gigabit Ethernet interface 0/1 of stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# mls qos cos 4 Switch(config-if)# mls qos cos override You can verify your settings by entering the show mls qos interface privileged EXEC command. Related Commands Command Description show mls qos interface Displays quality of service (QoS) information.2-133 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos dscp-mutation mls qos dscp-mutation Use the mls qos dscp-mutation interface configuration command on the switch stack or on a standalone switch to apply a Differentiated Services Code Point (DSCP)-to-DSCP-mutation map to a DSCP-trusted port. Use the no form of this command to return the map to the default settings (no DSCP mutation). mls qos dscp-mutation dscp-mutation-name no mls qos dscp-mutation dscp-mutation-name Syntax Description Defaults The default DSCP-to-DSCP-mutation map is a null map, which maps incoming DSCPs to the same DSCP values. Command Modes Interface configuration Command History Usage Guidelines If two quality of service (QoS) domains have different DSCP definitions, use the DSCP-to-DSCP-mutation map to translate one set of DSCP values to match the definition of another domain. You apply the DSCP-to-DSCP-mutation map to the receiving interface (ingress mutation) at the boundary of a quality of service (QoS) administrative domain. With ingress mutation, the new DSCP value overwrites the one in the packet, and QoS handles the packet with this new value. The switch sends the packet out the interface with the new DSCP value. You can configure multiple DSCP-to-DSCP-mutation maps on ingress ports. You apply the map only to DSCP-trusted ports. If you apply the DSCP mutation map to an untrusted port, to class of service (CoS) or IP-precedence trusted port, the command has no immediate effect until the port becomes DSCP-trusted. Examples This example shows how to define the DSCP-to-DSCP-mutation map named dscpmutation1and to apply the map to a port on stack member 3: Switch(config)# mls qos map dscp-mutation dscpmutation1 10 11 12 13 to 30 Switch(config)# interface gigabitethernet3/0/1 Switch(config-if)# mls qos trust dscp Switch(config-if)# mls qos dscp-mutation dscpmutation1 dscp-mutation-name Name of the DSCP-to-DSCP-mutation map. This map was previously defined with the mls qos map dscp-mutation global configuration command. Release Modification 12.1(11)AX This command was first introduced.2-134 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos dscp-mutation This example show how to remove the DSCP-to-DSCP-mutation map name dscpmutation1 from the port and to reset the map to the default: Switch(config-if)# no mls qos dscp-mutation dscpmutation1 You can verify your settings by entering the show mls qos maps privileged EXEC command. Related Commands Command Description mls qos map dscp-mutation Defines the DSCP-to-DSCP-mutation map. mls qos trust Configures the port trust state. show mls qos maps Displays QoS mapping information.2-135 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos map mls qos map Use the mls qos map global configuration command on the switch stack or on a standalone switch to define the class of service (CoS)-to-Differentiated Services Code Point (DSCP) map, DSCP-to-CoS map, the DSCP-to-DSCP-mutation map, the IP-precedence-to-DSCP map, and the policed-DSCP map. Use the no form of this command to return to the default map. mls qos map {cos-dscp dscp1...dscp8 | dscp-cos dscp-list to cos | dscp-mutation dscp-mutation-name in-dscp to out-dscp | ip-prec-dscp dscp1...dscp8 | policed-dscp dscp-list to mark-down-dscp} no mls qos map {cos-dscp | dscp-cos | dscp-mutation dscp-mutation-name | ip-prec-dscp | policed-dscp} Syntax Description cos-dscp dscp1...dscp8 Define the CoS-to-DSCP map. For dscp1...dscp8, enter eight DSCP values that correspond to CoS values 0 to 7. Separate each DSCP value with a space. The range is 0 to 63. dscp-cos dscp-list to cos Define the DSCP-to-CoS map. For dscp-list, enter up to eight DSCP values, with each value separated by a space. The range is 0 to 63. Then enter the to keyword. For cos, enter a single CoS value to which the DSCP values correspond. The range is 0 to 7. dscp-mutation dscp-mutation-name in-dscp to out-dscp Define the DSCP-to-DSCP-mutation map. For dscp-mutation-name, enter the mutation map name. For in-dscp, enter up to eight DSCP values, with each value separated by a space. Then enter the to keyword. For out-dscp, enter a single DSCP value. The range is 0 to 63. ip-prec-dscp dscp1...dscp8 Define the IP-precedence-to-DSCP map. For dscp1...dscp8, enter eight DSCP values that correspond to the IP precedence values 0 to 7. Separate each DSCP value with a space. The range is 0 to 63. policed-dscp dscp-list to mark-down-dscp Define the policed-DSCP map. For dscp-list, enter up to eight DSCP values, with each value separated by a space. Then enter the to keyword. For mark-down-dscp, enter the corresponding policed (marked down) DSCP value. The range is 0 to 63.2-136 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos map Defaults Table 2-6 shows the default CoS-to-DSCP map: Table 2-7 shows the default DSCP-to-CoS map: Table 2-8 shows the default IP-precedence-to-DSCP map: The default DSCP-to-DSCP-mutation map is a null map, which maps an incoming DSCP value to the same DSCP value. The default policed-DSCP map is a null map, which maps an incoming DSCP value to the same DSCP value. Command Modes Global configuration Command History Usage Guidelines All the maps are globally defined. All the maps, except the DSCP-to-DSCP-mutation map, are applied to all ports. The DSCP-to-DSCP-mutation map is applied to a specific port. Examples This example shows how to define the IP-precedence-to-DSCP map and to map IP-precedence values 0 to 7 to DSCP values of 0, 10, 20, 30, 40, 50, 55, and 60: Switch# configure terminal Switch(config)# mls qos map ip-prec-dscp 0 10 20 30 40 50 55 60 Table 2-6 Default CoS-to-DSCP Map CoS Value 0 1 2 3 4 5 6 7 DSCP Value 0 8 16 24 32 40 48 56 Table 2-7 Default DSCP-to-CoS Map DSCP Value 0–7 8–15 16–23 24–31 32–39 40–47 48–55 56–63 CoS Value 0 1 2 3 4 5 6 7 Table 2-8 Default IP-Precedence-to-DSCP Map IP Precedence Value 0 1 2 3 4 5 6 7 DSCP Value 0 8 16 24 32 40 48 56 Release Modification 12.1(11)AX This command was first introduced.2-137 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos map This example shows how to define the policed-DSCP map. DSCP values 1, 2, 3, 4, 5, and 6 are marked down to DSCP value 0. Marked DSCP values that not explicitly configured are not modified: Switch# configure terminal Switch(config)# mls qos map policed-dscp 1 2 3 4 5 6 to 0 This example shows how to define the DSCP-to-CoS map. DSCP values 20, 21, 22, 23, and 24 are mapped to CoS 1. DSCP values 10, 11, 12, 13, 14, 15, 16, and 17 are mapped to CoS 0: Switch# configure terminal Switch(config)# mls qos map dscp-cos 20 21 22 23 24 to 1 Switch(config)# mls qos map dscp-cos 10 11 12 13 14 15 16 17 to 0 This example shows how to define the CoS-to-DSCP map. CoS values 0 to 7 are mapped to DSCP values 0, 5, 10, 15, 20, 25, 30, and 35: Switch# configure terminal Switch(config)# mls qos map cos-dscp 0 5 10 15 20 25 30 35 This example shows how to define the DSCP-to-DSCP-mutation map. All the entries that are not explicitly configured are not modified (remain as specified in the null map): Switch# configure terminal Switch(config)# mls qos map dscp-mutation mutation1 1 2 3 4 5 6 7 to 10 Switch(config)# mls qos map dscp-mutation mutation1 8 9 10 11 12 13 to 10 Switch(config)# mls qos map dscp-mutation mutation1 20 21 22 to 20 Switch(config)# mls qos map dscp-mutation mutation1 0 31 32 33 34 to 30 You can verify your settings by entering the show mls qos maps privileged EXEC command. Related Commands Command Description mls qos dscp-mutation Applies a DSCP-to-DSCP-mutation map to a DSCP-trusted port. show mls qos maps Displays quality of service (QoS) mapping information.2-138 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos queue-set output buffers mls qos queue-set output buffers Use the mls qos queue-set output buffers global configuration command on the switch stack or on a standalone switch to allocate buffers to a queue-set (four egress queues per port). Use the no form of this command to return to the default setting. mls qos queue-set output qset-id buffers allocation1 ... allocation4 no mls qos queue-set output qset-id buffers Syntax Description Defaults All allocation values are equally mapped among the four queues (25, 25, 25, 25). Each queue has 1/4 of the buffer space. Command Modes Global configuration Command History Usage Guidelines Specify four allocation values, and separate each with a space. Allocate buffers according to the importance of the traffic; for example, give a large percentage of the buffer to the queue with the highest-priority traffic. To configure different classes of traffic with different characteristics, use this command with the mls qos queue-set output qset-id threshold global configuration command. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. qset-id ID of the queue-set. Each port belongs to a queue-set, which defines all the characteristics of the four egress queues per port. The range is 1 to 2. allocation1 ... allocation4 Buffer space allocation (percentage) for each queue (four values for queues 1 to 4). The range is 0 to 100. Separate each value with a space. Release Modification 12.1(11)AX This command was first introduced.2-139 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos queue-set output buffers Examples This example shows how to map Fast Ethernet interface 0/1 on stack member 2 to queue-set 2. It allocates 40 percent of the buffer space to egress queue 1 and 20 percent to egress queues 2, 3, and 4: Switch(config)# mls qos queue-set output 2 buffers 40 20 20 20 Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 2 You can verify your settings by entering the show mls qos interface [interface-id] buffers or the show mls qos queue-set privileged EXEC command. Related Commands Command Description mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface buffers Displays quality of service (QoS) information. show mls qos queue-set Displays egress queue settings for the queue-set.2-140 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos queue-set output threshold mls qos queue-set output threshold Use the mls qos queue-set output threshold global configuration command on the switch stack or on a standalone switch to configure the weighted tail-drop (WTD) thresholds, to guarantee the availability of buffers, and to configure the maximum memory allocation to a queue-set (four egress queues per port). Use the no form of this command to return to the default setting. mls qos queue-set output qset-id threshold queue-id drop-threshold1 drop-threshold2 reserved-threshold maximum-threshold no mls qos queue-set output qset-id threshold [queue-id] Syntax Description Defaults When quality of service (QoS) is enabled, WTD is enabled. Table 2-9 shows the default WTD threshold settings. Command Modes Global configuration Command History qset-id ID of the queue-set. Each port belongs to a queue-set, which defines all the characteristics of the four egress queues per port. The range is 1 to 2. queue-id Specific queue in the queue-set on which the command is performed. The range is 1 to 4. drop-threshold1 drop-threshold2 Two WTD thresholds expressed as a percentage of the queue’s allocated memory. The range is 1 to 400 percent. reserved-threshold Amount of memory to be guaranteed (reserved) for the queue and expressed as a percentage of the allocated memory. The range is 1 to 100 percent. maximum-threshold Enable a queue in the full condition to obtain more buffers than are reserved for it. This is the maximum memory the queue can have before the packets are dropped. The range is 1 to 400 percent. Table 2-9 Default Egress Queue WTD Threshold Settings Feature Queue 1 Queue 2 Queue 3 Queue 4 WTD Drop Threshold 1 100 percent 50 percent 100 percent 100 percent WTD Drop Threshold 2 100 percent 50 percent 100 percent 100 percent Reserved Threshold 50 percent 100 percent 50 percent 50 percent Maximum Threshold 400 percent 400 percent 400 percent 400 percent Release Modification 12.1(11)AX This command was first introduced.2-141 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos queue-set output threshold Usage Guidelines Use the mls qos queue-set output qset-id buffers global configuration command to allocate a fixed number of buffers to the four queues in a queue-set. The drop-threshold percentages can exceed 100 percent and can be up to the maximum (if the maximum threshold exceeds 100 percent). Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. The switch uses a buffer allocation scheme to reserve a minimum amount of buffers for each egress queue, to prevent any queue or port from consuming all the buffers and depriving other queues, and to determine whether to grant buffer space to a requesting queue. The switch determines whether the target queue has not consumed more buffers than its reserved amount (under-limit), whether it has consumed all of its maximum buffers (over-limit), and whether the common pool is empty (no free buffers) or not empty (free buffers). If the queue is not over-limit, the switch can allocate buffer space from the reserved pool or from the common pool (if it is not empty). If there are no free buffers in the common pool or if the queue is over-limit, the switch drops the frame. Examples This example shows how to map Fast Ethernet interface 0/1 on stack member 2 to queue-set 2. It configures the drop thresholds for queue 2 to 40 and 60 percent of the allocated memory, guarantees (reserves) 100 percent of the allocated memory, and configures 200 percent as the maximum memory this queue can have before packets are dropped: Switch(config)# mls qos queue-set output 2 threshold 2 40 60 100 200 Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 2 You can verify your settings by entering the show mls qos interface [interface-id] buffers or the show mls qos queue-set privileged EXEC command. Related Commands Command Description mls qos queue-set output buffers Allocates buffers to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface buffers Displays QoS information. show mls qos queue-set Displays egress queue settings for the queue-set.2-142 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input bandwidth mls qos srr-queue input bandwidth Use the mls qos srr-queue input bandwidth global configuration command on the switch stack or on a standalone switch to assign shaped round robin (SRR) weights to an ingress queue. The ratio of the weights is the ratio of the frequency in which the SRR scheduler dequeues packets from each queue. Use the no form of this command to return to the default setting. mls qos srr-queue input bandwidth weight1 weight2 no mls qos srr-queue input bandwidth Syntax Description Defaults Weight1 and weight2 are 4 (1/2 of the bandwidth is equally shared between the two queues). Command Modes Global configuration Command History Usage Guidelines SRR services the priority queue for its configured weight as specified by the bandwidth keyword in the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. Then SRR shares the remaining bandwidth with both ingress queues and services them as specified by the weights configured with the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. You specify which ingress queue is the priority queue by using the mls qos srr-queue input priority-queue global configuration command. Examples This example shows how to assign the ingress bandwidth for the queues in the stack. Priority queueing is disabled, and the shared bandwidth ratio allocated to queue 1 is 25/(25+75) and to queue 2 is 75/(25+75): Switch(config)# mls qos srr-queue input priority-queue 2 bandwidth 0 Switch(config)# mls qos srr-queue input bandwidth 25 75 In this example, queue 2 has three times the bandwidth of queue 1; queue 2 is serviced three times as often as queue 1. weight1 weight2 Ratio of weight1 and weight2 determines the ratio of the frequency in which the SRR scheduler dequeues packets from ingress queues 1 and 2. The range is 1 to 100. Separate each value with a space. Release Modification 12.1(11)AX This command was first introduced.2-143 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input bandwidth This example shows how to assign the ingress bandwidths for the queues in the stack. Queue 1 is the priority queue with 10 percent of the bandwidth allocated to it. The bandwidth ratio allocated to queues 1 and 2 is 4/(4+4). SRR services queue 1 (the priority queue) first for its configured 10 percent bandwidth. Then SRR equally shares the remaining 90 percent of the bandwidth between queues 1 and 2 by allocating 45 percent to each queue: Switch(config)# mls qos srr-queue input priority-queue 1 bandwidth 10 Switch(config)# mls qos srr-queue input bandwidth 4 4 You can verify your settings by entering the show mls qos interface [interface-id] queueing or the show mls qos input-queue privileged EXEC command. Related Commands Command Description mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps class of service (CoS) values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps Differentiated Services Code Point (DSCP) values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns weighted tail-drop (WTD) threshold percentages to an ingress queue. show mls qos input-queue Displays ingress queue settings. show mls qos interface queueing Displays quality of service (QoS) information.2-144 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input buffers mls qos srr-queue input buffers Use the mls qos srr-queue input buffers global configuration command on the switch stack or on a standalone switch to allocate the buffers between the ingress queues. Use the no form of this command to return to the default setting. mls qos srr-queue input buffers percentage1 percentage2 no mls qos srr-queue input buffers Syntax Description Defaults Ninety percent of the buffers is allocated to queue 1, and 10 percent of the buffers is allocated to queue 2. Command Modes Global configuration Command History Usage Guidelines You should allocate the buffers so that the queues can handle any incoming bursty traffic. Examples This example shows how to allocate 60 percent of the buffer space to ingress queue 1 and 40 percent of the buffer space to ingress queue 2: Switch(config)# mls qos srr-queue input buffers 60 40 You can verify your settings by entering the show mls qos interface [interface-id] buffers or the show mls qos input-queue privileged EXEC command. percentage1 percentage2 Percentage of buffers allocated to ingress queues 1 and 2. The range is 0 to 100. Separate each value with a space. Release Modification 12.1(11)AX This command was first introduced.2-145 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input buffers Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input cos-map Maps class of service (CoS) values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps Differentiated Services Code Point (DSCP) values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns weighted tail-drop (WTD) threshold percentages to an ingress queue. show mls qos input-queue Displays ingress queue settings. show mls qos interface buffers Displays quality of service (QoS) information.2-146 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input cos-map mls qos srr-queue input cos-map Use the mls qos srr-queue input cos-map global configuration command on the switch stack or on a standalone switch to map class of service (CoS) values to an ingress queue or to map CoS values to a queue and to a threshold ID. Use the no form of this command to return to the default setting. mls qos srr-queue input cos-map queue queue-id {cos1...cos8 | threshold threshold-id cos1...cos8} no mls qos srr-queue input cos-map Syntax Description Defaults Table 2-10 shows the default CoS input queue threshold map: Command Modes Global configuration Command History Usage Guidelines The CoS assigned at the ingress port selects an ingress or egress queue and threshold. The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. You can assign two weighted tail-drop (WTD) threshold percentages to an ingress queue by using the mls qos srr-queue input threshold global configuration command. You can map each CoS value to a different queue and threshold combination, allowing the frame to follow different behavior. queue queue-id Specify a queue number. For queue-id, the range is 1 to 2. cos1...cos8 Map CoS values to an ingress queue. For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. threshold threshold-id cos1...cos8 Map CoS values to a queue threshold ID. For threshold-id, the range is 1 to 3. For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. Table 2-10 Default CoS Input Queue Threshold Map CoS Value 0–4 5 6, 7 Queue ID - Threshold ID 1 - 1 2 - 1 1 - 1 Release Modification 12.1(11)AX This command was first introduced.2-147 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input cos-map Examples This example shows how to map CoS values 0 to 3 to ingress queue 1 and to threshold ID 1 with a drop threshold of 50 percent. It maps CoS values 4 and 5 to ingress queue 1 and to threshold ID 2 with a drop threshold of 70 percent: Switch(config)# mls qos srr-queue input cos-map queue 1 threshold 1 0 1 2 3 Switch(config)# mls qos srr-queue input cos-map queue 1 threshold 2 4 5 Switch(config)# mls qos srr-queue input threshold 1 50 70 You can verify your settings by entering the show mls qos maps privileged EXEC command. Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input dscp-map Maps Differentiated Services Code Point (DSCP) values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns WTD threshold percentages to an ingress queue. show mls qos maps Displays QoS mapping information.2-148 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input dscp-map mls qos srr-queue input dscp-map Use the mls qos srr-queue input dscp-map global configuration command on the switch stack or on a standalone switch to map Differentiated Services Code Point (DSCP) values to an ingress queue or to map DSCP values to a queue and to a threshold ID. Use the no form of this command to return to the default setting. mls qos srr-queue input dscp-map queue queue-id {dscp1...dscp8 | threshold threshold-id dscp1...dscp8} no mls qos srr-queue input dscp-map Syntax Description Defaults Table 2-11 shows the default DSCP input queue threshold map: Command Modes Global configuration Command History queue queue-id Specify a queue number. For queue-id, the range is 1 to 2. dscp1...dscp8 Map DSCP values to an ingress queue. For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. threshold threshold-id dscp1...dscp8 Map DSCP values to a queue threshold ID. For threshold-id, the range is 1 to 3. For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. Table 2-11 Default DSCP Input Queue Threshold Map DSCP Value 0–39 40–47 48–63 Queue ID - Threshold ID 1 - 1 2 - 1 1 - 1 Release Modification 12.1(11)AX This command was first introduced.2-149 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input dscp-map Usage Guidelines The DSCP assigned at the ingress port selects an ingress or egress queue and threshold. The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. You can assign two weighted tail-drop (WTD) threshold percentages to an ingress queue by using the mls qos srr-queue input threshold global configuration command. You can map each DSCP value to a different queue and threshold combination, allowing the frame to follow different behavior. You can map up to eight DSCP values per command. Examples This example shows how to map DSCP values 0 to 6 to ingress queue 1 and to threshold 1 with a drop threshold of 50 percent. It maps DSCP values 20 to 26 to ingress queue 1 and to threshold 2 with a drop threshold of 70 percent: Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 1 0 1 2 3 4 5 6 Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 2 20 21 22 23 24 25 26 Switch(config)# mls qos srr-queue input threshold 1 50 70 You can verify your settings by entering the show mls qos maps privileged EXEC command. Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps class of service (CoS) values to an ingress queue or maps CoS values to a queue and to threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns WTD threshold percentages to an ingress queue. show mls qos maps Displays QoS mapping information.2-150 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input priority-queue mls qos srr-queue input priority-queue Use the mls qos srr-queue input priority-queue global configuration command on the switch stack or on a standalone switch to configure the ingress priority queue and to guarantee bandwidth on the stack ring if the ring is congested. Use the no form of this command to return to the default setting. mls qos srr-queue input priority-queue queue-id bandwidth weight no mls qos srr-queue input priority-queue queue-id Syntax Description Defaults The priority queue is queue 2, and 10 percent of the bandwidth is allocated to it. Command Modes Global configuration Command History Usage Guidelines You should use the priority queue only for traffic that needs to be expedited (for example, voice traffic, which needs minimum delay and jitter). The priority queue is guaranteed part of the bandwidth on the stack ring, which reduces the delay and jitter under heavy network traffic on an oversubscribed stack (when there is more traffic than the backplane can carry, and the queues are full and dropping frames). The amount of bandwidth that can be guaranteed is restricted because a large value affects the entire stack and can degrade the stack performance. Shaped round robin (SRR) services the priority queue for its configured weight as specified by the bandwidth keyword in the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. Then SRR shares the remaining bandwidth with both ingress queues and services them as specified by the weights configured with the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. To disable priority queueing, set the bandwidth weigh to 0, for example, mls qos srr-queue input priority-queue queue-id bandwidth 0. queue-id Ingress queue ID. The range is 1 to 2. bandwidth weight Bandwidth percentage of the stack ring. The range is 0 to 40. Release Modification 12.1(11)AX This command was first introduced.2-151 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input priority-queue Examples This example shows how to assign the ingress bandwidths for the queues in the stack. Queue 1 is the priority queue with 10 percent of the bandwidth allocated to it. The bandwidth ratio allocated to queues 1 and 2 is 4/(4+4). SRR services queue 1 (the priority queue) first for its configured 10 percent bandwidth. Then SRR equally shares the remaining 90 percent of the bandwidth between queues 1 and 2 by allocating 45 percent to each queue: Switch(config)# mls qos srr-queue input priority-queue 1 bandwidth 10 Switch(config)# mls qos srr-queue input bandwidth 4 4 You can verify your settings by entering the show mls qos interface [interface-id] queueing or the show mls qos input-queue privileged EXEC command. Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps class of service (CoS) values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps Differentiated Services Code Point (DSCP) values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input threshold Assigns weighted tail-drop (WTD) threshold percentages to an ingress queue. show mls qos input-queue Displays ingress queue settings. show mls qos interface queueing Displays quality of service (QoS) information.2-152 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input threshold mls qos srr-queue input threshold Use the mls qos srr-queue input threshold global configuration command on the switch stack or on a standalone switch to assign weighted tail-drop (WTD) threshold percentages to an ingress queue. Use the no form of this command to return to the default setting. mls qos srr-queue input threshold queue-id threshold-percentage1 threshold-percentage2 no mls qos srr-queue input threshold queue-id Syntax Description Defaults When quality of service (QoS) is enabled, WTD is enabled. The two WTD thresholds are set to 100 percent. Command Modes Global configuration Command History Usage Guidelines QoS uses the CoS-to-threshold map or the DSCP-to-threshold map to determine which class of service (CoS) or Differentiated Services Code Points (DSCPs) values are mapped to threshold 1 and to threshold 2. If threshold 1 is exceeded, packets with CoS or DSCPs assigned to this threshold are dropped until the threshold is no longer exceeded. However, packets assigned to threshold 2 continue to be queued and sent as long as the second threshold is not exceeded. Each queue has two configurable (explicit) drop threshold and one preset (implicit) drop threshold (full). You configure the CoS-to-threshold map by using the mls qos srr-queue input cos-map global configuration command. You configure the DSCP-to-threshold map by using the mls qos srr-queue input dscp-map global configuration command. Examples This example shows how to configure the tail-drop thresholds for the two queues. The queue 1 thresholds are 50 percent and 100 percent, and the queue 2 thresholds are 70 percent and 100 percent: Switch(config)# mls qos srr-queue input threshold 1 50 100 Switch(config)# mls qos srr-queue input threshold 2 70 100 You can verify your settings by entering the show mls qos interface [interface-id] buffers or the show mls qos input-queue privileged EXEC command. queue-id ID of the ingress queue. The range is 1 to 2. threshold-percentage1 threshold-percentage2 Two WTD threshold percentage values. Each threshold value is a percentage of the total number of queue descriptors allocated for the queue. Separate each value with a space. The range is 1 to 100. Release Modification 12.1(11)AX This command was first introduced.2-153 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue input threshold Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps class of service (CoS) values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps Differentiated Services Code Point (DSCP) values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. show mls qos input-queue Displays ingress queue settings. show mls qos interface buffers Displays quality of service (QoS) information.2-154 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue output cos-map mls qos srr-queue output cos-map Use the mls qos srr-queue output cos-map global configuration command on the switch stack or on a standalone switch to map class of service (CoS) values to an egress queue or to map CoS values to a queue and to a threshold ID. Use the no form of this command to return to the default setting. mls qos srr-queue output cos-map queue queue-id {cos1...cos8 | threshold threshold-id cos1...cos8} no mls qos srr-queue output cos-map Syntax Description Defaults Table 2-12 shows the default CoS output queue threshold map: Global configuration Command History queue queue-id Specify a queue number. For queue-id, the range is 1 to 4. cos1...cos8 Map CoS values to an egress queue. For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. threshold threshold-id cos1...cos8 Map CoS values to a queue threshold ID. For threshold-id, the range is 1 to 3. For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. Table 2-12 Default CoS Output Queue Threshold Map CoS Value 0, 1 2, 3 4 5 6, 7 Queue ID - Threshold ID 2 - 1 3 - 1 4 - 1 1 -1 4 - 1 Release Modification 12.1(11)AX This command was first introduced.2-155 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue output cos-map Usage Guidelines The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your quality of service (QoS) solution. You can assign two weighted tail-drop (WTD) threshold percentages to an egress queue by using the mls qos queue-set output qset-id threshold global configuration command. You can map each CoS value to a different queue and threshold combination, allowing the frame to follow different behavior. Examples This example shows how to map Fast Ethernet interface 0/1 on stack member 2 to queue-set 1. It maps CoS values 0 to 3 to egress queue 1 and to threshold ID 1. It configures the drop thresholds for queue 1 to 50 and 70 percent of the allocated memory, guarantees (reserves) 100 percent of the allocated memory, and configures 200 percent as the maximum memory that this queue can have before packets are dropped. Switch(config)# mls qos srr-queue output cos-map queue 1 threshold 1 0 1 2 3 Switch(config)# mls qos queue-set output 1 threshold 1 50 70 100 200 Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 1 You can verify your settings by entering the show mls qos maps, the show mls qos interface [interface-id] buffers, or the show mls qos queue-set privileged EXEC command. Related Commands Command Description mls qos srr-queue output dscp-map Maps Differentiated Services Code Point (DSCP) values to an egress queue or maps DSCP values to a queue and to a threshold ID. mls qos queue-set output threshold Configures the WTD thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface buffers Displays QoS information. show mls qos maps Displays QoS mapping information. show mls qos queue-set Displays egress queue settings for the queue-set.2-156 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue output dscp-map mls qos srr-queue output dscp-map Use the mls qos srr-queue output dscp-map global configuration command on the switch stack or on a standalone switch to map Differentiated Services Code Point (DSCP) values to an egress or to map DSCP values to a queue and to a threshold ID. Use the no form of this command to return to the default setting. mls qos srr-queue output dscp-map queue queue-id {dscp1...dscp8 | threshold threshold-id dscp1...dscp8} no mls qos srr-queue output dscp-map Syntax Description Defaults Table 2-13 shows the default DSCP output queue threshold map: Command Modes Global configuration Command History queue queue-id Specify a queue number. For queue-id, the range is 1 to 4. dscp1...dscp8 Map DSCP values to an egress queue. For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. threshold threshold-id dscp1...dscp8 Map DSCP values to a queue threshold ID. For threshold-id, the range is 1 to 3. For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. Table 2-13 Default DSCP Output Queue Threshold Map DSCP Value 0–15 16–31 32–39 40–47 48–63 Queue ID - Threshold ID 2 - 1 3 - 1 4 - 1 1 - 1 4 - 1 Release Modification 12.1(11)AX This command was first introduced.2-157 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos srr-queue output dscp-map Usage Guidelines The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. You can assign two weighted tail-drop (WTD) threshold percentages to an egress queue by using the mls qos queue-set output qset-id threshold global configuration command. You can map each DSCP value to a different queue and threshold combination, allowing the frame to follow different behavior. You can map up to eight DSCP values per command. Examples This example shows how to map Fast Ethernet interface 0/1 on stack member 2 to queue-set 1. It maps DSCP values 0 to 3 to egress queue 1 and to threshold ID 1. It configures the drop thresholds for queue 1 to 50 and 70 percent of the allocated memory, guarantees (reserves) 100 percent of the allocated memory, and configures 200 percent as the maximum memory that this queue can have before packets are dropped. Switch(config)# mls qos srr-queue output dscp-map queue 1 threshold 1 0 1 2 3 Switch(config)# mls qos queue-set output 1 threshold 1 50 70 100 200 Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 1 You can verify your settings by entering the show mls qos maps, the show mls qos interface [interface-id] buffers, or the show mls qos queue-set privileged EXEC command. Related Commands Command Description mls qos srr-queue output cos-map Maps class of service (CoS) values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos queue-set output threshold Configures the WTD thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface buffers Displays quality of service (QoS) information. show mls qos maps Displays QoS mapping information. show mls qos queue-set Displays egress queue settings for the queue-set.2-158 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos trust mls qos trust Use the mls qos trust interface configuration command on the switch stack or on a standalone switch to configure the port trust state. Ingress traffic can be trusted, and classification is performed by examining the packet Differentiated Services Code Point (DSCP), class of service (CoS), or IP-precedence field. Use the no form of this command to return a port to its untrusted state. mls qos trust [cos | device cisco-phone | dscp | ip-precedence] no mls qos trust [cos | device | dscp | ip-precedence] Syntax Description Defaults The port is not trusted. If no keyword is specified when the command is entered, the default is dscp. Command Modes Interface configuration Command History Usage Guidelines Packets entering a quality of service (QoS) domain are classified at the edge of the domain. When the packets are classified at the edge, the switch port within the QoS domain can be configured to one of the trusted states because there is no need to classify the packets at every switch within the domain. Use this command to specify whether the port is trusted and which fields of the packet to use to classify traffic. When a port is configured with trust DSCP or trust IP precedence and the incoming packet is a non-IP packet, the CoS-to-DSCP map is used to derive the corresponding DSCP value from the CoS value. The CoS can be the packet CoS for trunk ports or the port default CoS for nontrunk ports. If the DSCP is trusted, the DSCP field of the IP packet is not modified. However, it is still possible that the CoS value of the packet is modified (according to DSCP-to-CoS map). cos (Optional) Classify an ingress packet by using the packet CoS value. For an untagged packet, use the port default CoS value. device cisco-phone (Optional) Classify ingress packets by trusting the value sent from the Cisco IP phone (trusted boundary). dscp (Optional) Classify an ingress packet by using the packet DSCP value (most significant 6 bits of 8-bit service-type field). For a non-IP packet, the packet CoS is used if the packet is tagged. For an untagged packet, the default port CoS value is used. ip-precedence (Optional) Classify an ingress packet by using the packet IP-precedence value (most significant 3 bits of 8-bit service-type field). For a non-IP packet, the packet CoS is used if the packet is tagged. For an untagged packet, the port default CoS value is used. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The device cisco-phone keywords were added.2-159 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mls qos trust If the CoS is trusted, the CoS field of the packet is not modified, but the DSCP can be modified (according to CoS-to-DSCP map) if the packet is an IP packet. The trusted boundary feature prevents security problems if users disconnect their PCs from networked Cisco IP phones and connect them to the switch port to take advantage of trusted CoS settings. You must globally enable the Cisco Discovery Protocol (CDP) on the switch and on the interface connected to the IP phone. If the phone is not detected, trusted boundary disables the trusted setting on the switch port and prevents misuse of a high-priority queue. If you configure the trust setting for DSCP or IP precedence, the DSCP or IP precedence values in the incoming packets are trusted. If you configure the mls qos cos override interface configuration command on the switch port connected to the IP phone, the switch overrides the CoS of the incoming voice and data packets and assigns the default CoS value to them. For an inter-QoS domain boundary, you can configure the port to the DSCP-trusted state and apply the DSCP-to-DSCP-mutation map if the DSCP values are different between the QoS domains. Classification using a port trust state (for example, mls qos trust [cos | dscp | ip-precedence] and a policy map (for example, service-policy input policy-map-name) are mutually exclusive. The last one configured overwrites the previous configuration. Examples This example shows how to configure a port on stack member 2 to trust the IP precedence field in the incoming packet: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# mls qos trust ip-precedence This example shows how to specify that the Cisco IP phone connected on a port on stack member 2 is a trusted device: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# mls qos trust device cisco-phone You can verify your settings by entering the show mls qos interface privileged EXEC command. Related Commands Command Description mls qos cos Defines the default CoS value of a port or assigns the default CoS to all incoming packets on the port. mls qos dscp-mutation Applies a DSCP-to DSCP-mutation map to a DSCP-trusted port. mls qos map Defines the CoS-to-DSCP map, DSCP-to-CoS map, the DSCP-to-DSCP-mutation map, the IP-precedence-to-DSCP map, and the policed-DSCP map. show mls qos interface Displays QoS information.2-160 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands monitor session monitor session Use the monitor session global configuration command on the switch stack or on a standalone switch to start a new Switched Port Analyzer (SPAN) session or Remote SPAN (RSPAN) source or destination session, to enable ingress traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance), to add or delete interfaces or VLANs to or from an existing SPAN or RSPAN session, and to limit (filter) SPAN source traffic to specific VLANs. Use the no form of this command to remove the SPAN or RSPAN session or to remove source or destination interfaces or filters from the SPAN or RSPAN session. For destination interfaces, the encapsulation replicate keywords are ignored with the no form of the command. monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate] [ingress {dot1q vlan vlan-id | isl | untagged vlan vlan-id | vlan vlan-id}]} | {remote vlan vlan-id} monitor session session_number filter vlan vlan-id [, | -] monitor session session_number source {interface interface-id [, | -] [both | rx | tx]} | {vlan vlan-id [, | -] [both | rx | tx]}| {remote vlan vlan-id} no monitor session {session_number | all | local | remote} no monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate] [ingress {dot1q vlan vlan-id | isl | untagged vlan vlan-id | vlan vlan-id}]} | {remote vlan vlan-id} no monitor session session_number filter vlan vlan-id [, | -] no monitor session session_number source {interface interface-id [, | -] [both | rx | tx]} | {vlan vlan-id [, | -] [both | rx | tx]} | {remote vlan vlan-id} Syntax Description. session_number Specify the session number identified with the SPAN or RSPAN session. The range is 1 to 66. destination Specify the SPAN or RSPAN destination. A destination must be a physical port. interface interface-id Specify the destination or source interface for a SPAN or RSPAN session. Valid interfaces are physical ports (including type, stack member, module, and port number). For source interface, port channel is also a valid interface type, and the valid range is 1 to 12. encapsulation replicate (Optional) Specify that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged). Note Entering these keywords is valid only for local SPAN; for RSPAN, the RSPAN VLAN ID overwrites the original VLAN ID; therefore packets are always sent untagged. ingress (Optional) Enable ingress traffic forwarding. dot1q vlan vlan-id Specify ingress forwarding using 802.1Q encapsulation with the specified VLAN as the default VLAN for ingress traffic. isl Specify ingress forwarding using ISL encapsulation.2-161 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands monitor session Defaults No monitor sessions are configured. On a source interface, the default is to monitor both received and transmitted traffic. On a trunk interface used as a source port, all VLANs are monitored. If encapsulation replicate is not specified on a local SPAN destination port, packets are sent in native form with no encapsulation tag. Ingress forwarding is disabled on destination ports. Command Modes Global configuration Command History untagged vlan vlan-id Specify ingress forwarding using untagged encapsulation with the specified VLAN as the default VLAN for ingress traffic vlan vlan-id When used with only the ingress keyword, set default VLAN for ingress traffic. remote vlan vlan-id Specify the remote VLAN for an RSPAN source or destination session. The range is 2 to 1001 and 1006 to 4094. Note The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 to 1005 (reserved for Token Ring and FDDI VLANs). , (Optional) Specify a series of interfaces or VLANs, or separate a range of interfaces or VLANs from a previous range. Enter a space before and after the comma. - (Optional) Specify a range of interfaces or VLANs. Enter a space before and after the hyphen. filter vlan vlan-id Specify a list of VLANs as filters on trunk source ports to limit SPAN source traffic to specific VLANs. The vlan-id range is 1 to 4094. source Specify the SPAN or RSPAN source. A source can be a physical port, a port channel, or a VLAN. both, rx, tx (Optional) Specify the traffic direction to monitor. If you do not specify a traffic direction, the source interface sends both transmitted and received traffic. source vlan vlan-id Specify the SPAN source interface as a VLAN ID. The range is 1 to 4094. all, local, remote Specify all, local, or remote with the no monitor session command to clear all SPAN and RSPAN, all local SPAN, or all RSPAN sessions. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The ingress {dot1q vlan vlan-id | isl | untagged vlan vlan-id | vlan vlan-id} keywords were added.2-162 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands monitor session Usage Guidelines Traffic that enters or leaves source ports or source VLANs can be monitored by using SPAN or RSPAN. Traffic routed to source ports or source VLANs cannot be monitored. You can set a combined maximum of two local SPAN sessions and RSPAN source sessions. You can have a total of 66 SPAN and RSPAN sessions on a switch or switch stack. You can have a maximum of 64 destination ports on a switch stack. Each session can include multiple ingress or egress source ports or VLANs, but you cannot combine source ports and source VLANs in a single session. Each session can include multiple destination ports. When you use VLAN-based SPAN (VSPAN) to analyze network traffic in a VLAN or set of VLANs, all active ports in the source VLANs become source ports for the SPAN or RSPAN session. Trunk ports are included as source ports for VSPAN, and only packets with the monitored VLAN ID are sent to the destination port. You can monitor traffic on a single port or VLAN or on a series or range of ports or VLANs. You select a series or range of interfaces or VLANs by using the [, | -] options. If you specify a series of VLANs or interfaces, you must enter a space before and after the comma. If you specify a range of VLANs or interfaces, you must enter a space before and after the hyphen (-). EtherChannel ports cannot be configured as SPAN or RSPAN destination ports. A physical port that is a member of an EtherChannel group can be used as a destination port, but it cannot participate in the EtherChannel group while it is as a SPAN destination. You can monitor individual ports while they participate in an EtherChannel, or you can monitor the entire EtherChannel bundle by specifying the port-channel number as the RSPAN source interface. A port used as a destination port cannot be a SPAN or RSPAN source, nor can a port be a destination port for more than one session at a time. You can enable 802.1X on a port that is a SPAN or RSPAN destination port; however, 802.1X is disabled until the port is removed as a SPAN destination. (If 802.1X is not available on the port, the switch returns an error message.) You can enable 802.1X on a SPAN or RSPAN source port. VLAN filtering refers to analyzing network traffic on a selected set of VLANs on trunk source ports. By default, all VLANs are monitored on trunk source ports. You can use the monitor session session_number filter vlan vlan-id command to limit SPAN traffic on trunk source ports to only the specified VLANs. VLAN monitoring and VLAN filtering are mutually exclusive. If a VLAN is a source, VLAN filtering cannot be enabled. If VLAN filtering is configured, a VLAN cannot become a source. If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at Layer 2. Destination ports can be configured to act in these ways: • When you enter monitor session session_number destination interface interface-id with no other keywords, egress encapsulation is untagged, and ingress forwarding is not enabled. • When you enter monitor session session_number destination interface interface-id encapsulation replicate with no other keywords, egress encapsulation replicates the source interface encapsulation; ingress forwarding is not enabled. (This applies to local SPAN only; RSPAN does not support encapsulation replication.)2-163 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands monitor session • When you enter monitor session session_number destination interface interface-id encapsulation replicate ingress, egress encapsulation replicates the source interface encapsulation; ingress encapsulation depends on the keywords that follow—dot1q, isl, or untagged. (This applies to local SPAN only; RSPAN does not support encapsulation replication.) • When you enter monitor session session_number destination interface interface-id ingress, egress encapsulation is untagged; ingress encapsulation depends on the keywords that follow—dot1q, isl, or untagged. Examples This example shows how to create a local SPAN session 1 to monitor both sent and received traffic on source interface Gigabit Ethernet 1 on stack member 1 to destination interface Gigabit Ethernet 8 on stack member 2: Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 both Switch(config)# monitor session 1 destination interface gigabitethernet2/0/8 This example shows how to delete a destination port from an existing local SPAN session: Switch(config)# no monitor session 2 destination gigabitethernet1/0/4 This example shows how to limit SPAN traffic in an existing session only to specific VLANs: Switch(config)# monitor session 1 filter vlan 100 - 304 This example shows how to configure RSPAN source session 1 to monitor multiple source interfaces and to configure the destination RSPAN VLAN 900. Switch(config)# monitor session 1 source interface gigabitethernet1/0/10 , gigabitethernet1/0/12 Switch(config)# monitor session 1 source interface gigabitethernet2/0/2 rx Switch(config)# monitor session 1 source interface port-channel 2 tx Switch(config)# monitor session 1 destination remote vlan 900 Switch(config)# end This example shows how to configure an RSPAN destination session 10 in the switch receiving the monitored traffic. Switch(config)# monitor session 10 source remote vlan 900 Switch(config)# monitor session 10 destination interface gigabitethernet1/0/10 This example shows how to configure the destination port for ingress traffic on VLAN 5 by using a security device that supports 802.1Q encapsulation. Egress traffic replicates the source; ingress traffic uses 802.1Q encapsulation. Switch(config)# monitor session 2 destination interface gigabitethernet1/0/5 encapsulation replicate ingress dot1q vlan 5 This example shows how to configure the destination port for ingress traffic on VLAN 5 by using a security device that does not support encapsulation. Egress traffic replicates the source encapsulation; ingress traffic is untagged. Switch(config)# monitor session 2 destination interface gigabitethernet1/0/5 encapsulation replicate ingress untagged vlan 5 You can verify your settings by entering the show monitor privileged EXEC command. You can view SPAN and RSPAN configuration on the switch by entering the show running-config privileged EXEC command. SPAN information appears near the end of the output.2-164 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands monitor session Related Commands Command Description remote-span Configures an RSPAN VLAN in vlan configuration mode. show monitor Displays SPAN and RSPAN session information. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-165 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (global configuration) mvr (global configuration) Use the mvr global configuration command without keywords on the switch stack or on a standalone switch to enable the multicast VLAN registration (MVR) feature on the switch. Use the command with keywords to set the MVR mode for a switch, configure the MVR IP multicast address, set the maximum time to wait for a query reply before removing a port from group membership, and to specify the MVR multicast VLAN. Use the no form of this command to return to the default settings. mvr [group ip-address [count] | mode [compatible | dynamic] | querytime value | vlan vlan-id] no mvr [group ip-address | mode [compatible | dynamic] | querytime value | vlan vlan-id] Syntax Description Defaults MVR is disabled by default. The default MVR mode is compatible mode. No IP multicast addresses are configured on the switch by default. The default group ip address count is 0. The default query response time is 5 tenths of or one-half second. The default multicast VLAN for MVR is VLAN 1. group ip-address Statically configure an MVR group IP multicast address on the switch. Use the no form of this command to remove a statically configured IP multicast address or contiguous addresses or, when no IP address is entered, to remove all statically configured MVR IP multicast addresses. count (Optional) Configure multiple contiguous MVR group addresses. The range is 1 to 256; the default is 1. mode (Optional) Specify the MVR mode of operation. The default is compatible mode. compatible Set MVR mode to provide compatibility with Catalyst 2900 XL and 3500 XL switches. This mode does not allow dynamic membership joins on source ports. dynamic Set MVR mode to allow dynamic MVR membership on source ports. querytime value (Optional) Set the maximum time to wait for IGMP report memberships on a receiver port. This time applies only to receiver-port leave processing. When an IGMP query is sent from a receiver port, the switch waits for the default or configured MVR querytime for an IGMP group membership report before removing the port from multicast group membership. The value is the response time in units of tenths of a second. The range is 1 to 100; the default is 5 tenths or one-half second. Use the no form of the command to return to the default setting. vlan vlan-id (Optional) Specify the VLAN on which MVR multicast data is expected to be received. This is also the VLAN to which all the source ports belong. The range is 1 to 4094; the default is VLAN 1.2-166 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (global configuration) Command Modes Global configuration Command History Usage Guidelines A maximum of 256 MVR multicast groups can be configured on a switch. Use the mvr group command to statically set up all the IP multicast addresses that will take part in MVR. Any multicast data sent to a configured multicast address is sent to all the source ports on the switch and to all receiver ports that have registered to receive data on that IP multicast address. MVR supports aliased IP multicast addresses on the switch. However, if the switch is interoperating with Catalyst 3550 or Catalyst 3500 XL switches, you should not configure IP addresses that alias between themselves or with the reserved IP multicast addresses (in the range 224.0.0.xxx). The mvr querytime command applies only to receiver ports. If the switch MVR is interoperating with Catalyst 2900 XL or Catalyst 3500 XL switches, set the multicast mode to compatible. When operating in compatible mode, MVR does not support IGMP dynamic joins on MVR source ports. MVR can coexist with IGMP snooping on a switch. Multicast routing and MVR cannot coexist on a switch. If you enable multicast routing and a multicast routing protocol while MVR is enabled, MVR is disabled and a warning message is displayed. If you try to enable MVR while multicast routing and a multicast routing protocol are enabled, the operation to enable MVR is cancelled with an Error message. Examples This example shows how to enable MVR: Switch(config)# mvr This example shows how to disable MVR: Switch(config)# no mvr Use the show mvr privileged EXEC command to display the current setting for maximum multicast groups. This example shows how to configure 228.1.23.4 as an IP multicast address: Switch(config)# mvr group 228.1.23.4 This example shows how to configure ten contiguous IP multicast groups with multicast addresses from 228.1.23.1 to 228.1.23.10: Switch(config)# mvr group 228.1.23.1 10 This example shows how to delete the previously configured ten IP multicast addresses: Switch(config)# no mvr group 228.1.23.1 10 Release Modification 12.1(11)AX This command was first introduced.2-167 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (global configuration) This example shows how to delete all previously configured IP multicast addresses: Switch(config)# no mvr group Use the show mvr members privileged EXEC command to display the IP multicast group addresses configured on the switch. This example shows how to set the maximum query response time as one second (10 tenths): Switch(config)# mvr querytime 10 This example shows how to return the maximum query response time to the default setting of one-half second: Switch(config)# no mvr querytime This example shows how to set VLAN 2 as the multicast VLAN: Switch(config)# mvr vlan 2 You can verify your settings by entering the show mvr privileged EXEC command. Related Commands Command Description mvr (interface configuration) Configures MVR ports. show mvr Displays MVR global parameters or port parameters. show mvr interface Displays the configured MVR interfaces with their type, status, and Immediate Leave configuration. Also displays all MVR groups of which the interface is a member. show mvr members Displays all ports that are members of an MVR multicast group; if the group has no members, its status is shown as Inactive.2-168 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (interface configuration) mvr (interface configuration) Use the mvr interface configuration command on the switch stack or on a standalone switch to configure a Layer 2 port as a multicast VLAN registration (MVR) receiver or source port and set the immediate leave feature, and statically assign a port to an IP multicast VLAN and IP address. Use the no form of this command to return to the default settings. mvr [immediate | type {receiver | source} | vlan vlan-id group [ip-address]] no mvr [immediate | type {source | receiver}| vlan vlan-id group [ip-address]] Syntax Description Defaults A port is configured as neither receiver nor source by default. The Immediate Leave feature is disabled on all ports by default. No receiver port is a member of any configured multicast group by default. Command Modes Interface configuration Command History immediate (Optional) Enable the Immediate Leave feature of MVR on a port. Use the no mvr immediate command to disable the feature. type (Optional) Configure the port as an MVR receiver port or source port. The default port type is neither an MVR source nor receiver port. The no mvr type command resets the port as neither a source or receiver port. receiver Configure the port as a subscriber port that can only receive multicast data. Receiver ports cannot belong to the multicast VLAN. source Configure the port as an uplink port that can send and receive multicast data for the configured multicast groups. All source ports on a switch belong to a single multicast VLAN. vlan vlan-id group (Optional) Add the port as a static member of the multicast group with the specified VLAN ID. The no mvr vlan vlan-id group command removes a port on a VLAN from membership in an IP multicast address group. ip-address (Optional) Statically configure the specified MVR IP multicast group address for the specified multicast VLAN ID. This is the IP address of the multicast group that the port is joining. Release Modification 12.1(11)AX This command was first introduced.2-169 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (interface configuration) Usage Guidelines Configure a port as a source port if that port should be able to both send and receive multicast data bound for the configured multicast groups. Multicast data is received on all ports configured as source ports. Receiver ports cannot be trunk ports. Receiver ports on a switch can be in different VLANs, but should not belong to the multicast VLAN. A port that is not taking part in MVR should not be configured as an MVR receiver port or source port. A non-MVR port is a normal switch port, able to send and receive multicast data with normal switch behavior. When Immediate Leave is enabled, a receiver port leaves a multicast group more quickly. Without Immediate Leave, when the switch receives an IGMP leave message from a group on a receiver port, it sends out an IGMP MAC-based query on that port and waits for IGMP group membership reports. If no reports are received in a configured time period, the receiver port is removed from multicast group membership. With Immediate Leave, an IGMP MAC-based query is not sent from the receiver port on which the IGMP leave was received. As soon as the leave message is received, the receiver port is removed from multicast group membership, which speeds up leave latency. The Immediate Leave feature should be enabled only on receiver ports to which a single receiver device is connected. The mvr vlan group command statically configures ports to receive multicast traffic sent to the IP multicast address. A port statically configured as a member of group remains a member of the group until statically removed. In compatible mode, this command applies only to receiver ports; in dynamic mode, it can also apply to source ports. Receiver ports can also dynamically join multicast groups by using IGMP join messages. When operating in compatible mode, MVR does not support IGMP dynamic joins on MVR source ports. Examples This example shows how to configure Gigabit Ethernet port 0/1 on stack member 1 as an MVR receiver port: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# mvr type receiver This example shows how to configure Gigabit Ethernet port 0/2 on stack member 1 as an MVR source port: Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# mvr type source This example shows how to remove port 0/1 on stack member 1 as an MVR port: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if))# no mvr This example shows how to display configured receiver ports and source ports. Switch# show mvr interface Port Type Status Immediate Leave ---- ---- ------- --------------- Gi1/0/1 SOURCE ACTIVE/UP DISABLED Gi1/0/2 RECEIVER ACTIVE/DOWN DISABLED Gi1/0/5 RECEIVER ACTIVE/UP ENABLED This example shows how to enable Immediate Leave on Gigabit Ethernet port 1/0/1: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# mvr immediate2-170 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands mvr (interface configuration) This example shows how to disable Immediate Leave on Gigabit Ethernet port 0/1on stack member 1: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no mvr immediate This example shows how to add Gigabit Ethernet port 1/0/2 on VLAN 1 as a static member of IP multicast group 228.1.23.4: Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# mvr vlan1 group 230.1.23.4 This example shows how to remove this port from membership: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no mvr vlan5 group 228.1.23.4 This example shows how to remove this port from all IP multicast groups: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no mvr vlan5 group This example shows the result if Gigabit Ethernet port 0/2 on stack member 1 is not a receiver port: Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# mvr vlan 1 group 230.1.23.4 Interface Gi1/0/2 not configured as a receiver interface You can verify your settings by entering the show mvr members privileged EXEC command. Related Commands Command Description mvr (global configuration) Enables and configures multicast VLAN registration on the switch. show mvr Displays MVR global parameters or port parameters. show mvr interface Displays the configured MVR interfaces or displays the multicast groups to which a receiver port belongs. Also displays all MVR groups of which the interface is a member. show mvr members Displays all receiver ports that are members of an MVR multicast group.2-171 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands pagp learn-method pagp learn-method Use the pagp learn-method interface configuration command on the switch stack or on a standalone switch to learn the source address of incoming packets received from an EtherChannel port. Use the no form of this command to return to the default setting. pagp learn-method {aggregation-port | physical-port} no pagp learn-method Syntax Description Defaults The default is aggregation-port (logical port channel). Command Modes Interface configuration Command History Usage Guidelines The learn method must be configured the same at both ends of the link. Note The Catalyst 3750 switch supports address learning only on aggregate ports even though the physical-port keyword is provided in the command-line interface (CLI). The pagp learn-method and the pagp port-priority interface configuration commands have no effect on the switch hardware, but they are required for PAgP interoperability with devices that only support address learning by physical ports, such as the Catalyst 1900 switch. When the link partner to the Catalyst 3750 switch is a physical learner, we recommend that you configure the switch as a physical-port learner by using the pagp learn-method physical-port interface configuration command and to set the load-distribution method based on the source MAC address by using the port-channel load-balance src-mac global configuration command. Use the pagp learn-method interface configuration command only in this situation. aggregation-port Specify address learning on the logical port-channel. The switch sends packets to the source using any of the interfaces in the EtherChannel. This setting is the default. With aggregate-port learning, it is not important on which physical port the packet arrives. physical-port Specify address learning on the physical port within the EtherChannel. The switch sends packets to the source using the same interface in the EtherChannel from which it learned the source address. The other end of the channel uses the same port in the channel for a particular destination MAC or IP address. Release Modification 12.1(11)AX This command was first introduced.2-172 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands pagp learn-method Examples This example shows how to set the learning method to learn the address on the physical port within the EtherChannel: Switch(config-if)# pagp learn-method physical-port This example shows how to set the learning method to learn the address on the port-channel within the EtherChannel: Switch(config-if)# pagp learn-method aggregation-port You can verify your settings by entering the show running-config privileged EXEC command or the show pagp channel-group-number internal privileged EXEC command. Related Commands Command Description pagp port-priority Selects an interface over which all traffic through the EtherChannel is sent. show pagp Displays PAgP channel-group information. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-173 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands pagp port-priority pagp port-priority Use the pagp port-priority interface configuration command on the switch stack or on a standalone switch to select an interface over which all Port Aggregation Protocol (PAgP) traffic through the EtherChannel is sent. If all unused interfaces in the EtherChannel are in hot-standby mode, they can be placed into operation if the currently selected interface and link fails. Use the no form of this command to return to the default setting. pagp port-priority priority no pagp port-priority Syntax Description Defaults The default is 128. Command Modes Interface configuration Command History Usage Guidelines The physical port with the highest priority that is operational and has membership in the same EtherChannel is the one selected for PAgP transmission. Note The Catalyst 3750 switch supports address learning only on aggregate ports even though the physical-port keyword is provided in the command-line interface (CLI). The pagp learn-method and the pagp port-priority interface configuration commands have no effect on the switch hardware, but they are required for PAgP interoperability with devices that only support address learning by physical ports, such as the Catalyst 1900 switch. When the link partner to the Catalyst 3750 switch is a physical learner, we recommend that you configure the switch as a physical-port learner by using the pagp learn-method physical-port interface configuration command and to set the load-distribution method based on the source MAC address by using the port-channel load-balance src-mac global configuration command. Use the pagp learn-method interface configuration command only in this situation. priority A priority number ranging from 0 to 255. Release Modification 12.1(11)AX This command was first introduced.2-174 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands pagp port-priority Examples This example shows how to set the port priority to 200: Switch(config-if)# pagp port-priority 200 You can verify your setting by entering the show running-config privileged EXEC command or the show pagp channel-group-number internal privileged EXEC command. Related Commands Command Description pagp learn-method Provides the ability to learn the source address of incoming packets. show pagp Displays PAgP channel-group information. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-175 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands permit permit Use the permit MAC-access list configuration command on the switch stack or on a standalone switch to allow non-IP traffic to be forwarded if the conditions are matched. Use the no form of this command to remove a permit condition from the extended MAC access list. {permit | deny} {any | host src-MAC-addr | src-MAC-addr mask} {any | host dst-MAC-addr | dst-MAC-addr mask} [type mask | cos cos | aarp | amber | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | lsap lsap mask | mop-console | mop-dump | msdos | mumps | netbios | vines-echo | vines-ip | xns-idp] no {permit | deny} {any | host src-MAC-addr | src-MAC-addr mask} {any | host dst-MAC-addr | dst-MAC-addr mask} [type mask | cos cos | aarp | amber | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | lsap lsap mask | mop-console | mop-dump | msdos | mumps | netbios | vines-echo |vines-ip | xns-idp] Note Though visible in the command-line help strings, appletalk is not supported as a matching condition. Syntax Description any Keyword to specify to deny any source or destination MAC address. host src-MAC-addr | src-MAC-addr mask Define a host MAC address and optional subnet mask. If the source address for a packet matches the defined address, non-IP traffic from that address is denied. host dst-MAC-addr | dst-MAC-addr mask Define a destination MAC address and optional subnet mask. If the destination address for a packet matches the defined address, non-IP traffic to that address is denied. type mask (Optional) Use the Ethertype number of a packet with Ethernet II or SNAP encapsulation to identify the protocol of the packet. • type is 0 to 65535, specified in hexadecimal. • mask is a mask of don’t care bits applied to the Ethertype before testing for a match. aarp (Optional) Select Ethertype AppleTalk Address Resolution Protocol that maps a data-link address to a network address. amber (Optional) Select EtherType DEC-Amber. cos cos (Optional) Select an arbitrary class of service (CoS) number from 0 to 7 to set priority. Filtering on CoS can be performed only in hardware. A warning message appears if the cos option is configured. dec-spanning (Optional) Select EtherType Digital Equipment Corporation (DEC) spanning tree. decnet-iv (Optional) Select EtherType DECnet Phase IV protocol. diagnostic (Optional) Select EtherType DEC-Diagnostic. dsm (Optional) Select EtherType DEC-DSM. etype-6000 (Optional) Select EtherType 0x6000. etype-8042 (Optional) Select EtherType 0x8042. lat (Optional) Select EtherType DEC-LAT. lavc-sca (Optional) Select EtherType DEC-LAVC-SCA.2-176 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands permit To filter IPX traffic, you use the type mask or lsap lsap mask keywords, depending on the type of IPX encapsulation being used. Filter criteria for IPX encapsulation types as specified in Novell terminology and Cisco IOS terminology are listed in Table 2-14. Defaults This command has no defaults. However; the default action for a MAC-named ACL is to deny. Command Modes MAC-access list configuration Command History lsap lsap-number mask (Optional) Use the LSAP number (0 to 65535) of a packet with 802.2 encapsulation to identify the protocol of the packet. The mask is a mask of don’t care bits applied to the LSAP number before testing for a match. mop-console (Optional) Select EtherType DEC-MOP Remote Console. mop-dump (Optional) Select EtherType DEC-MOP Dump. msdos (Optional) Select EtherType DEC-MSDOS. mumps (Optional) Select EtherType DEC-MUMPS. netbios (Optional) Select EtherType DEC- Network Basic Input/Output System (NETBIOS). vines-echo (Optional) Select EtherType Virtual Integrated Network Service (VINES) Echo from Banyan Systems. vines-ip (Optional) Select EtherType VINES IP. xns-idp (Optional) Select EtherType Xerox Network Systems (XNS) protocol suite. Table 2-14 IPX Filtering Criteria IPX Encapsulation Type Cisco IOS Name Novell Name Filter Criterion arpa Ethernet II Ethertype 0x8137 snap Ethernet-snap Ethertype 0x8137 sap Ethernet 802.2 LSAP 0xE0E0 novell-ether Ethernet 802.3 LSAP 0xFFFF Release Modification 12.1(11)AX This command was first introduced.2-177 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands permit Usage Guidelines You enter MAC-access list configuration mode by using the mac access-list extended global configuration command. If you use the host keyword, you cannot enter an address mask; if you do not use the any or host keywords, you must enter an address mask. After an access control entry (ACE) is added to an access control list, an implied deny-any-any condition exists at the end of the list. That is, if there are no matches, the packets are denied. However, before the first ACE is added, the list permits all packets. Note For more information about MAC named extended access lists, refer to the software configuration guide for this release. Examples This example shows how to define the MAC name extended access list to allow NETBIOS traffic from any source to MAC address 00c0.00a0.03fa. Traffic matching this list is allowed. Switch(config-ext-macl)# permit any host 00c0.00a0.03fa netbios This example shows how to remove the permit condition from the MAC name extended access list: Switch(config-ext-macl)# no permit any 00c0.00a0.03fa 0000.0000.0000 netbios This example permits all packets with Ethertype 0x4321: Switch(config-ext-macl)# permit any any 0x4321 0 You can verify your settings by entering the show access-lists privileged EXEC command. Related Commands Command Description deny Denies non-IP traffic to be forwarded if conditions are matched. mac access-list extended Creates an access list based on MAC addresses for non-IP traffic. show access-lists Displays access control lists configured on a switch.2-178 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands police police Use the police policy-map class configuration command on the switch stack or on a standalone switch to define a policer for classified traffic. A policer defines a maximum permissible rate of transmission, a maximum burst size for transmissions, and an action to take if either maximum is exceeded. Use the no form of this command to remove an existing policer. police rate-bps burst-byte [exceed-action {drop | policed-dscp-transmit}] no police rate-bps burst-byte [exceed-action {drop | policed-dscp-transmit}] Syntax Description Defaults No policers are defined. Command Modes Policy-map class configuration Command History Usage Guidelines The port ASIC supports 256 policers (255 policers plus 1 no policer). The maximum number of policers supported per port is 64. Policers are allocated on demand by the software and are constrained by the hardware and ASIC boundaries. You cannot reserve policers per port. There is no guarantee that a port will be assigned to any policer. To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. Policing uses a token-bucket algorithm. You configure the bucket depth (the maximum burst that is tolerated before the bucket overflows) by using the burst-byte option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. You configure how quickly (the average rate) the tokens are removed from the bucket by using the rate-bps option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. For more information, refer to the software configuration guide for this release. rate-bps Specify the average traffic rate in bits per second (bps). The range is 8000 to 1000000000. burst-byte Specify the normal burst size in bytes. The range is 8000 to 1000000. exceed-action drop (Optional) When the specified rate is exceeded, specify that the switch drop the packet. exceed-action policed-dscp-transmit (Optional) When the specified rate is exceeded, specify that the switch change the Differentiated Services Code Point (DSCP) of the packet to that specified in the policed-DSCP map and then send the packet. Release Modification 12.1(11)AX This command was first introduced.2-179 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands police Examples This example shows how to configure a policer that drops packets if traffic exceeds 1 Mbps average rate with a burst size of 20 KB. The DSCPs of incoming packets are trusted, and there is no packet modification. Switch(config)# policy-map policy1 Switch(config-pmap)# class class1 Switch(config-pmap-c)# set ip dscp 45 Switch(config-pmap-c)# police 1000000 20000 exceed-action drop Switch(config-pmap-c)# exit This example shows how to configure a policer, which marks down the DSCPs with the values defined in policed-DSCP map and sends the packet: Switch(config)# policy-map policy2 Switch(config-pmap)# class class2 Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit You can verify your settings by entering the show policy-map privileged EXEC command. Related Commands Command Description class Defines a traffic classification match criteria (through the police, set, and trust policy-map class configuration commands) for the specified class-map name. mls qos map policed-dscp Applies a policed-DSCP map to a DSCP-trusted port. policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. set Classifies IP traffic by setting a DSCP or IP-precedence value in the packet. show policy-map Displays quality of service (QoS) policy maps. trust Defines a trust state for traffic classified through the class policy-map configuration or the class-map global configuration command.2-180 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands police aggregate police aggregate Use the police aggregate policy-map class configuration command on the switch stack or on a standalone switch to apply an aggregate policer to multiple classes in the same policy map. A policer defines a maximum permissible rate of transmission, a maximum burst size for transmissions, and an action to take if either maximum is exceeded. Use the no form of this command to remove the specified policer. police aggregate aggregate-policer-name no police aggregate aggregate-policer-name Syntax Description Defaults No aggregate policers are defined. Command Modes Policy-map class configuration Command History Usage Guidelines The port ASIC supports 256 policers (255 policers plus 1 no policer). The maximum number of policers supported per port is 64. Policers are allocated on demand by the software and are constrained by the hardware and ASIC boundaries. You cannot reserve policers per port. There is no guarantee that a port will be assigned to any policer. You set aggregate policer parameters by using the mls qos aggregate-policer global configuration command. You apply an aggregate policer to multiple classes in the same policy map; you cannot use an aggregate policer across different policy maps. To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. aggregate-policer-name Name of the aggregate policer. Release Modification 12.1(11)AX This command was first introduced.2-181 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands police aggregate Examples This example shows how to define the aggregate policer parameters and to apply the policer to multiple classes in a policy map: Switch(config)# mls qos aggregate-policer agg_policer1 10000 1000000 exceed-action drop Switch(config)# policy-map policy2 Switch(config-pmap)# class class1 Switch(config-pmap-c)# police aggregate agg_policer1 Switch(config-pmap-c)# exit Switch(config-pmap)# class class2 Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap-c)# police aggregate agg_policer1 Switch(config-pmap-c)# exit Switch(config-pmap)# class class3 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police aggregate agg_policer2 Switch(config-pmap-c)# exit You can verify your settings by entering the show mls qos aggregate-policer privileged EXEC command. Related Commands Command Description mls qos aggregate-policer Defines policer parameters, which can be shared by multiple classes within a policy map. show mls qos aggregate-policer Displays the quality of service (QoS) aggregate policer configuration.2-182 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands policy-map policy-map Use the policy-map global configuration command on the switch stack or on a standalone switch to create or modify a policy map that can be attached to multiple interfaces and to enter policy-map configuration mode. Use the no form of this command to delete an existing policy map and to return to global configuration mode. policy-map policy-map-name no policy-map policy-map-name Syntax Description Defaults No policy maps are defined. The default behavior is to set the Differentiated Services Code Point (DSCP) to 0 if the packet is an IP packet and to set the class of service (CoS) to 0 if the packet is tagged. No policing is performed. Command Modes Global configuration Command History Usage Guidelines After entering the policy-map command, you enter policy-map configuration mode, and these configuration commands are available: • class: defines the classification match criteria for the specified class map. For more information, see the “class” section on page 2-33. • description: describes the policy map (up to 200 characters). • exit: exits policy-map configuration mode and returns you to global configuration mode. • no: removes a previously defined policy map. • rename: renames the current policy map. To return to global configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. Before configuring policies for classes whose match criteria are defined in a class map, use the policy-map command to specify the name of the policy map to be created, added to, or modified. Entering the policy-map command also enables the policy-map configuration mode in which you can configure or modify the class policies for that policy map. policy-map-name Name of the policy map. Release Modification 12.1(11)AX This command was first introduced.2-183 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands policy-map You can configure class policies in a policy map only if the classes have match criteria defined for them. To configure the match criteria for a class, use the class-map global configuration and match class-map configuration commands. You define packet classification on a physical-port basis. Only one policy map per ingress interface is supported. You can apply the same policy map to multiple interfaces. Examples This example shows how to create a policy map called policy1. When attached to the ingress direction, it matches all the incoming traffic defined in class1, sets the IP DSCP to 10, and polices the traffic at an average rate of 1 Mbps and bursts at 20 KB. Traffic exceeding the profile is marked down to a DSCP value obtained from the policed-DSCP map and then sent. Switch(config)# policy-map policy1 Switch(config-pmap)# class class1 Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit This example shows how to configure multiple classes in a policy map called policymap2: Switch(config)# policy-map policymap2 Switch(config-pmap)# class class1 Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap-c)# police 100000 20000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit Switch(config-pmap)# class class2 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police 100000 20000 exceed-action drop Switch(config-pmap-c)# exit Switch(config-pmap)# class class3 Switch(config-pmap-c)# set ip dscp 0 (no policer) Switch(config-pmap-c)# exit This example shows how to delete policymap2: Switch(config)# no policy-map policymap2 You can verify your settings by entering the show policy-map privileged EXEC command. Related Commands Command Description class Defines a traffic classification match criteria (through the police, set, and trust policy-map class configuration command) for the specified class-map name. class-map Creates a class map to be used for matching packets to the class whose name you specify. service-policy Applies a policy map to an interface show policy-map Displays quality of service (QoS) policy maps.2-184 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands port-channel load-balance port-channel load-balance Use the port-channel load-balance global configuration command on the switch stack or on a standalone switch to set the load-distribution method among the ports in the EtherChannel. Use the no form of this command to return to the default setting. port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac} no port-channel load-balance Syntax Description Defaults The default is src-mac. Command Modes Global configuration Command History Usage Guidelines For information about when to use these forwarding methods, refer to the “Configuring EtherChannels” chapter in the software guide for this release. Examples This example shows how to set the load-distribution method to dst-mac: Switch(config)# port-channel load-balance dst-mac You can verify your setting by entering the show running-config privileged EXEC command or the show etherchannel load-balance privileged EXEC command. dst-ip Load distribution is based on the destination host IP address. dst-mac Load distribution is based on the destination host MAC address. Packets to the same destination are sent on the same port, but packets to different destinations are sent on different ports in the channel. src-dst-ip Load distribution is based on the source and destination host IP address. src-dst-mac Load distribution is based on the source and destination host MAC address. src-ip Load distribution is based on the source host IP address. src-mac Load distribution is based on the source MAC address. Packets from different hosts use different ports in the channel, but packets from the same host use the same port. Release Modification 12.1(11)AX This command was first introduced.2-185 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands port-channel load-balance Related Commands Command Description interface port-channel Accesses or creates the port channel. show etherchannel Displays EtherChannel information for a channel. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-186 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands queue-set queue-set Use the queue-set interface configuration command on the switch stack or on a standalone switch to map a port to a queue-set. Use the no form of this command to return to the default setting. queue-set qset-id no queue-set qset-id Syntax Description Defaults The queue-set ID is 1. Command Modes Interface configuration Command History Examples This example shows how to map Fast Ethernet port 0/1 on stack member 2 to queue-set 2: Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 2 You can verify your settings by entering the show mls qos interface [interface-id] buffers privileged EXEC command. Related Commands qset-id ID of the queue-set. Each port belongs to a queue-set, which defines all the characteristics of the four egress queues per port. The range is 1 to 2. Release Modification 12.1(11)AX This command was first introduced. Command Description mls qos queue-set output buffers Allocates buffers to a queue-set. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. show mls qos interface buffers Displays quality of service (QoS) information.2-187 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands rcommand rcommand Use the rcommand user EXEC command on the switch stack or on the cluster command switch to start a Telnet session and to execute commands on a cluster member switch from the cluster command switch or the switch stack. To end the session, enter the exit command. rcommand {n | commander | mac-address hw-addr} Syntax Description Command Modes User EXEC Command History Usage Guidelines This command is available only on the cluster command switch stack or cluster command switch. If the switch is the cluster command switch but the cluster member switch n does not exist, an error message appears. To obtain the switch number, enter the show cluster members privileged EXEC command on the cluster command switch. You can use this command to access a cluster member switch from the cluster command-switch prompt or to access a cluster command switch from the member-switch prompt. For Catalyst 2900 XL, 3500 XL, 2950, 2970, 3550, and 3750 switches, the Telnet session accesses the member-switch command-line interface (CLI) at the same privilege level as on the cluster command switch. For example, if you execute this command at user level on the cluster command switch, the cluster member switch is accessed at user level. If you use this command on the cluster command switch at privileged level, the command accesses the remote device at privileged level. If you use an intermediate enable-level lower than privileged, access to the cluster member switch is at user level. For Catalyst 1900 and 2820 switches running standard edition software, the Telnet session accesses the menu console (the menu-driven interface) if the cluster command switch is at privilege level 15. If the cluster command switch is at privilege level 1, you are prompted for the password before being able to access the menu console. Cluster command switch privilege levels map to the cluster member switches running standard edition software as follows: • If the cluster command switch privilege level is from 1 to 14, the cluster member switch is accessed at privilege level 1. • If the cluster command switch privilege level is 15, the cluster member switch is accessed at privilege level 15. The Catalyst 1900 and 2820 CLI is available only on switches running Enterprise Edition Software. n Provide the number that identifies a cluster member. The range is 0 to 15. commander Provide access to the cluster command switch from a cluster member switch. mac-address hw-addr MAC address of the cluster member switch. Release Modification 12.1(11)AX This command was first introduced.2-188 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands rcommand This command will not work if the vty lines of the cluster command switch have access-class configurations. You are not prompted for a password because the cluster member switches inherited the password of the cluster command switch when they joined the cluster. Examples This example shows how to start a session with member 3. All subsequent commands are directed to member 3 until you enter the exit command or close the session. Switch# rcommand 3 Switch-3# show version Cisco Internet Operating System Software ... ... Switch-3# exit Switch# Related Commands Command Description show cluster members Displays information about the cluster members.2-189 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands reload reload Use the reload privileged EXEC command to reset the stack member and applies a configuration change into effect. reload [LINE | at | cancel | in | slot stack-member-number | standby-cpu] Syntax Description Defaults Immediately resets the stack member and puts a configuration change into effect. Command Modes Privilege EXEC Command History Examples This example shows how to reload the switch stack: Switch(config)# reload System configuration has been modified. Save? [yes/no]: y Proceed to reload the whole Stack? [confirm] y This example shows how to reload a specific stack member: Switch(config)# reload slot 6 Proceed with reload? [confirm]y Related Commands LINE Specify the reason for the reload. at Specify the time in hh:mm for the reload to occur. cancel Cancel the pending reload. in Specify a time interval in mmm or hhh:mm for reloads to occur. slot stack-member-number Save the changes on the specified stack member and restart it. standby-cpu Reload the standby route processor (RP). Release Modification 12.1(11)AX This command was first introduced. Command Description reload Accesses a specific stack member. switch priority Changes the stack member priority value. switch renumber Changes the stack member number. show switch Displays information about the switch stack and its stack members.2-190 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands remote command remote command Use the remote command privileged EXEC command to monitor all or specified stack members. remote command [all | stack-member-number] LINE Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines The commands (such as debug, show, or clear) you use in the LINE command-to-execute string apply to a specific stack member or to the switch stack. Examples This example shows how to execute the undebug command on the switch stack: Switch(config)# remote command all undebug all Switch :1 : ------------ All possible debugging has been turned off Switch :5 : ------------ All possible debugging has been turned off Switch :9 : ------------ All possible debugging has been turned off This example shows how to execute the debug udld event command on stack member 5: Switch(config)# remote command 5 undebug all Switch :5 : ------------ UDLD events debugging is on Related Commands stack-member-number Specify the stack member. The range is 1 to 9. all Apply to all stack members. LINE Specify the command to execute. Release Modification 12.1(11)AX This command was first introduced. Command Description reload Accesses a specific stack member. switch priority Changes the stack member priority value. switch renumber Changes the stack member number. show switch Displays information about the switch stack and its stack members.2-191 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands remote-span remote-span Use the remote-span VLAN configuration command on the switch stack or on a standalone switch to configure a VLAN as a Remote Switched Port Analyzer (RSPAN) VLAN. Use the no form of this command to remove the RSPAN designation from the VLAN. remote-span no remote-span Syntax Description This command has no arguments or keywords. Defaults No RSPAN VLANs are defined. Command Modes VLAN configuration (config-VLAN) Command History Usage Guidelines You can configure RSPAN VLANs only in config-VLAN mode (entered by using the vlan global configuration command), not the VLAN configuration mode entered by using the vlan database privileged EXEC command. If VTP is enabled, the RSPAN feature is propagated by VLAN Trunking Protocol (VTP) for VLAN-IDs that are lower than 1005. If the RSPAN VLAN ID is in the extended range, you must manually configure intermediate switches (those in the RSPAN VLAN between the source switch and the destination switch). Before you configure the RSPAN remote-span command, use the vlan (global configuration) command to create the VLAN. The RSPAN VLAN has these characteristics: • No MAC address learning occurs on it. • RSPAN VLAN traffic flows only on trunk ports. • Spanning Tree Protocol (STP) can run in the RSPAN VLAN, but it does not run on RSPAN destination ports. When an existing VLAN is configured as an RSPAN VLAN, the VLAN is first deleted and then recreated as an RSPAN VLAN. Any access ports are made inactive until the RSPAN feature is disabled. Release Modification 12.1(11)AX This command was first introduced.2-192 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands remote-span Examples This example shows how to configure a VLAN as an RSPAN VLAN. Switch(config)# vlan 901 Switch(config-vlan)# remote-span This example shows how to remove the RSPAN feature from a VLAN. Switch(config)# vlan 901 Switch(config-vlan)# no remote-span You can verify your settings by entering the show vlan remote-span user EXEC command. Related Commands Command Description monitor session Enables Switched Port Analyzer (SPAN) and RSPAN monitoring on a port and configures a port as a source or destination port. vlan (global configuration) Changes to config-vlan mode where you can configure VLANs 1 to 4094.Chapter 2 Cisco IOS Commands rmon collection stats 2-193 Catalyst 3750 Switch Command Reference 78-15165-02 2 rmon collection stats Use the rmon collection stats interface configuration command on the switch stack or on a standalone switch to collect Ethernet group statistics, which include utilization statistics about broadcast and multicast packets, and error statistics about Cyclic Redundancy Check (CRC) alignment errors and collisions. Use the no form of this command to return to the default setting. rmon collection stats index [owner name] no rmon collection stats index [owner name] Syntax Description Defaults The RMON statistics collection is disabled. Command Modes Interface configuration Command History Usage Guidelines The RMON statistics collection command is based on hardware counters. Examples This example shows how to collect RMON statistics for the owner root on Gigabit Ethernet interface 0/1 of stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# rmon collection stats 2 owner root You can verify your setting by entering the show rmon statistics privileged EXEC command. Related Commands index Remote Network Monitoring (RMON) collection control index. The range is 1 to 65535. owner name (Optional) Owner of the RMON collection. Release Modification 12.1(11)AX This command was first introduced. Command Description show rmon statistics Displays RMON statistics. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS System Management Commands > RMON Commands.2-194 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands sdm prefer sdm prefer Use the sdm prefer global configuration command on the switch stack or on a standalone switch to configure the template used in Switch Database Management (SDM) resource allocation. You can use a template to allocate system resources to best support the features being used in your application. Use a template to provide maximum system utilization for unicast routing or for VLAN configuration or to change an aggregator template (Catalyst 3750-12S only) to a desktop template. Use the no form of this command to return to the default template. sdm prefer {default | routing | vlan} [desktop] no sdm prefer Syntax Description Defaults The default template provides a balance to all features. Command Modes Global configuration Command History Usage Guidelines You must reload the switch for the configuration to take effect. If you enter the show sdm prefer command before you enter the reload privileged EXEC command, the show sdm prefer command shows the template currently in use and the template that will become active after a reload. Desktop switches support only desktop templates; an aggregator switch (Catalyst 3750-12S) supports both desktop and aggregator templates. On an aggregator switch, if you do not enter the desktop keyword, the aggregator templates are selected. All stack members use the same SDM desktop or aggregator template, stored on the stack master. When a new switch member is added to a stack, as with the switch configuration file and VLAN database file, the SDM configuration that is stored on the stack master overrides the template configured on an individual switch. default Set the switch to use the default template (Catalyst 3750-12S only). This keyword is not available on switches that do not allow the aggregator template (desktop switches). On these switches, enter the no sdm prefer command to set the default template. routing Provide maximum system utilization for unicast routing. You would typically use this template for a router or aggregator in the middle of a network. vlan Provide maximum system utilization for VLANs. This template maximizes system resources for use as a Layer 2 switch with no routing. desktop Use only on a Catalyst 3750-12S switch (where aggregator templates are the default), to select the default, routing, or VLAN desktop template. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The aggregator templates were added.2-195 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands sdm prefer If a stack member cannot support the template that is running on the master switch, the switch goes into SDM mismatch mode, the master switch does not attempt to change the SDM template, and the switch cannot be a functioning member of the stack. • If the master switch is a Catalyst 3750-12S, and you change the template from an aggregator template to a desktop template and reload the switch, the entire stack operates with the selected desktop template. This could cause configuration losses if the number of ternary content addressable memory (TCAM) entries exceeds the desktop template sizes. • If you change the template on a Catalyst 3750-12S master from a desktop template to an aggregator template and reload the switch, any desktop switches that were part of the stack go into SDM mismatch mode. • If you add a Catalyst 3750-12S switch that is running the aggregator template to a stack that has a desktop switch as the stack master, the stack operates with the desktop template selected on the stack master. This could cause configuration losses on the Catalyst 3750-12S stack member if the number of TCAM entries on it exceeds desktop template sizes. Note For more information about stacking, refer to the “Managing Switch Stacks” chapter in the software configuration guide. Use the sdm prefer vlan [desktop] global configuration command only on switches intended for Layer 2 switching with no routing. When you use the VLAN template, no system resources are reserved for routing entries and any routing is done through software. This overloads the central processing unit (CPU) and severely degrades routing performance. Do not use the routing template if you do not have routing enabled on your switch. Entering the sdm prefer routing [desktop] global configuration command prevents other features from using the memory allocated to unicast routing in the routing template. Table 2-15 lists the approximate number of each resource supported in each of the three templates for a desktop or aggregator switch. The first eight rows in the tables (unicast MAC addresses through security ACEs) represent approximate hardware boundaries set when a template is selected. If a section of a hardware resource is full, all processing overflow is sent to the CPU, seriously impacting switch performance. The last row is a guideline used to calculate hardware resource consumption related to the number of Layer 3 VLANs configured. . Table 2-15 Approximate Number of Feature Resources Allowed by Each Template Resource Desktop Templates Aggregator Templates Default Routing VLAN Default Routing VLAN Unicast MAC addresses 6 K 3 K 12 K 6 K 6 K 12 K Internet Group Management Protocol (IGMP) groups and multicast routes 1 K 1 K 1 K 1 K 1 K 1 K Unicast routes 8 K 11 K 0 12 K 20 K 0 • Directly connected hosts 6 K 3 K 0 6 K 6 K 0 • Indirect routes 2 K 8 K 0 6 K 14 K 0 Policy-based routing access control entries (ACEs) 0 512 0 0 512 0 QoS classification ACEs 512 512 512 896 512 8962-196 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands sdm prefer Examples This example shows how to configure the routing template on a desktop switch: Switch(config)# sdm prefer routing Switch(config)# exit Switch# reload This example shows how to configure the desktop routing template on an aggregator switch: Switch(config)# sdm prefer routing desktop Switch(config)# exit Switch# reload This example shows how to change a switch template to the default template. On an aggregator switch, this is the default aggregator template; on a desktop switch, this is the default desktop template. Switch(config)# no sdm prefer Switch(config)# exit Switch# reload This example shows how to configure the desktop default template on an aggregator switch: Switch(config)# sdm prefer default desktop Switch(config)# exit Switch# reload You can verify your settings by entering the show sdm prefer privileged EXEC command. Related Commands Security ACEs 1 K 1 K 1 K 1 K 1 K 1 K Layer 2 VLANs 1 K 1 K 1 K 1 K 1 K 1 K Table 2-15 Approximate Number of Feature Resources Allowed by Each Template (continued) Resource Desktop Templates Aggregator Templates Default Routing VLAN Default Routing VLAN Command Description show sdm prefer Displays the current SDM template in use or displays the templates that can be used, with approximate resource allocation per feature.2-197 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands service password-recovery service password-recovery Use the service password-recovery global configuration command on the switch stack or on a standalone switch to enable the password-recovery mechanism (the default). This mechanism allows a user with physical access to the switch to hold down the Mode button and interrupt the boot process while the switch is powering up and to assign a new password. Use the no form of this command to disable part of the password-recovery functionality. When the password-recovery mechanism is disabled, interrupting the boot process is allowed only if the user agrees to set the system back to the default configuration. service password-recovery no service password-recovery Syntax Description This command has no arguments or keywords. Defaults The default action is for the password-recovery mechanism to be enabled. Command Modes Global configuration Command History Usage Guidelines As a system administrator, you can use the no service password-recovery command to disable some of the functionality of the password recovery feature by allowing an end user to reset a password only by agreeing to return to the default configuration. To use the password-recovery procedure, a user with physical access to the switch holds down the Mode button while the unit powers up and for a second or two after the LED above port 1X goes off. When the button is released, the system continues with initialization. If the password-recovery mechanism is disabled, this message is displayed: The password-recovery mechanism has been triggered, but is currently disabled. Access to the boot loader prompt through the password-recovery mechanism is disallowed at this point. However, if you agree to let the system be reset back to the default system configuration, access to the boot loader prompt can still be allowed. Would you like to reset the system back to the default configuration (y/n)? If the user chooses not to reset the system back to the default configuration, the normal boot process continues, as if the Mode button had not been pressed. If you choose to reset the system back to the default configuration, the configuration file in flash memory is deleted and the VLAN database file, flash:vlan.dat (if present) is deleted. Release Modification 12.1(11)AX This command was first introduced.2-198 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands service password-recovery Note If you use the no service password-recovery command to control end user access to passwords, we recommend that you save a copy of the config file in a location away from the switch in case the end user uses the password recovery procedure and sets the system back to defaults. Do not keep a backup copy of the config file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also save a copy of the vlan.dat file in a location away from the switch. When you enter the service password-recovery or no service password-recovery command on the stack master, it is propagated throughout the stack and applied to all switches in the stack. You can verify if password recovery is enabled or disabled by entering the show version privileged EXEC command. Examples This example shows how to disable password recovery on a switch or switch stack so that a user can only reset a password by agreeing to return to the default configuration. Switch(config)# no service-password recovery Switch(config)# exit Related Commands Command Description show version Displays version information for the hardware and firmware.2-199 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands service-policy service-policy Use the service-policy interface configuration command on the switch stack or on a standalone switch to apply a policy map defined by the policy-map command to the input of a particular interface. Use the no form of this command to remove the policy map and interface association. service-policy input policy-map-name no service-policy input policy-map-name Syntax Description Note Though visible in the command-line help strings, the history keyword is not supported, and you should ignore the statistics it gathers. The output keyword is also not supported. Defaults No policy maps are attached to the interface. Command Modes Interface configuration Command History Usage Guidelines Only one policy map per ingress interface is supported. Classification using a port trust state (for example, mls qos trust [cos | dscp | ip-precedence] and a policy map (for example, service-policy input policy-map-name) are mutually exclusive. The last one configured overwrites the previous configuration. Examples This example shows how to apply plcmap1 to an ingress interface on stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# service-policy input plcmap1 This example shows how to detach plcmap2 from an interface on stack member 2: Switch(config)# interface gigabitethernet2/0/2 Switch(config-if)# no service-policy input plcmap2 You can verify your settings by entering the show running-config privileged EXEC command. input policy-map-name Apply the specified policy-map to the input of an interface. Release Modification 12.1(11)AX This command was first introduced.2-200 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands service-policy Related Commands Command Description policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. show policy-map Displays quality of service (QoS) policy maps.2-201 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands session session Use the session privileged EXEC command on the stack master to access a specific stack member. session stack-member-number Syntax Description Defaults No default is defined. Command Modes Global configuration Command History Usage Guidelines When you access the stack member, its stack member number is appended to the system prompt. Examples This example shows how to access stack member 6: Switch(config)# session 6 Switch-6# Related Commands stack-member-number Specify the current stack member number. The stack member number is in the range from 1 through 9. Release Modification 12.1(11)AX This command was first introduced. Command Description reload Saves the configuration change and restarts the stack member. switch priority Changes the stack member priority value. switch renumber Changes the stack member number. show switch Displays information about the switch stack and its stack members.2-202 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands set set Use the set policy-map class configuration command on the switch stack or on a standalone switch to classify IP traffic by setting a Differentiated Services Code Point (DSCP) or IP-precedence value in the packet. Use the no form of this command to remove traffic classification. set {ip dscp new-dscp | ip precedence new-precedence} no set {ip dscp new-dscp | ip precedence new-precedence} Syntax Description Note Though visible in the command-line help strings, the mpls keyword is not supported. Defaults No traffic classification is defined. Command Modes Policy-map class configuration Command History Usage Guidelines The set command is mutually exclusive with the trust policy-map class configuration command within the same policy map. For the set ip dscp new-dscp or the set ip precedence new-precedence command, you can enter a mnemonic name for a commonly-used value. For example, you can enter the set ip dscp af11 command, which is the as same entering the set ip dscp 10 command. You can enter the set ip precedence critical command, which is the same as entering the set ip precedence 5 command. For a list of supported mnemonics, enter the set ip dscp ? or the set ip precedence ? command to see the command-line help strings. To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. ip dscp new-dscp New DSCP value assigned to the classified traffic. The range is 0 to 63. You also can enter a mnemonic name for a commonly-used value. ip precedence new-precedence New IP-precedence value assigned to the classified traffic. The range is 0 to 7. You also can enter a mnemonic name for a commonly-used value. Release Modification 12.1(11)AX This command was first introduced.2-203 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands set Examples This example shows how to assign DSCP 10 to all FTP traffic without any policers: Switch(config)# policy-map policy_ftp Switch(config-pmap)# class ftp_class Switch(config-pmap-c)# set ip dscp 10 Switch(config-pmap)# exit You can verify your settings by entering the show policy-map privileged EXEC command. Related Commands Command Description class Defines a traffic classification match criteria (through the police, set, and trust policy-map class configuration commands) for the specified class-map name. police Defines a policer for classified traffic. policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. show policy-map Displays quality of service (QoS) policy maps. trust Defines a trust state for traffic classified through the class policy-map configuration command or the class-map global configuration command.2-204 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands setup setup Use the setup privileged EXEC command to configure the switch with its initial configuration. setup Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines When you use the setup command, make sure that you have this information: • IP address and network mask • Password strategy for your environment • Whether the switch will be used as the cluster command switch and the cluster name When you enter the setup command, an interactive dialog, called the System Configuration Dialog, appears. It guides you through the configuration process and prompts you for information. The values shown in brackets next to each prompt are the default values last set by using either the setup command facility or the configure privileged EXEC command. Help text is provided for each prompt. To access help text, press the question mark (?) key at a prompt. To return to the privileged EXEC prompt without making changes and without running through the entire System Configuration Dialog, press Ctrl-C. When you complete your changes, the setup program shows you the configuration command script that was created during the setup session. You can save the configuration in nonvolatile RAM (NVRAM), return to the setup program without saving, or return to the command-line prompt without saving the configuration. Release Modification 12.1(11)AX This command was first introduced.2-205 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands setup Examples This is an example of output from the setup command: Switch# setup --- System Configuration Dialog --- Continue with configuration dialog? [yes/no]: yes At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system. Would you like to enter basic management setup? [yes/no]: yes Configuring global parameters: Enter host name [Switch]:host-name The enable secret is a password used to protect access to privileged EXEC and configuration modes. This password, after entered, becomes encrypted in the configuration. Enter enable secret: enable-secret-password The enable password is used when you do not specify an enable secret password, with some older software versions, and some boot images. Enter enable password: enable-password The virtual terminal password is used to protect access to the router over a network interface. Enter virtual terminal password: terminal-password Configure SNMP Network Management? [no]: yes Community string [public]: Current interface summary Any interface listed with OK? value "NO" does not have a valid configuration Interface IP-Address OK? Method Status Protocol Vlan1 172.20.135.202 YES NVRAM up up GigabitEthernet6/0/1 unassigned YES unset up up GigabitEthernet6/0/2 unassigned YES unset up down GigabitEthernet6/0/3 unassigned YES unset administratively down down GigabitEthernet6/0/4 unassigned YES unset up down GigabitEthernet6/0/5 unassigned YES NVRAM up down GigabitEthernet6/0/6 unassigned YES NVRAM up down GigabitEthernet6/0/7 unassigned YES unset up down GigabitEthernet6/0/8 unassigned YES unset up down GigabitEthernet6/0/9 unassigned YES unset administratively down down GigabitEthernet6/0/10 10.1.2.3 YES NVRAM up down2-206 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands setup GigabitEthernet6/0/11 unassigned YES unset up down GigabitEthernet6/0/12 unassigned YES unset up down Port-channel1 unassigned YES unset up down Enter interface name used to connect to the management network from the above interface summary: vlan1 Configuring interface vlan1: Configure IP on this interface? [yes]: yes IP address for this interface: ip_address Subnet mask for this interface [255.0.0.0]: subnet_mask Would you like to enable as a cluster command switch? [yes/no]: yes Enter cluster name: cluster-name The following configuration command script was created: hostname host-name enable secret 5 $1$LiBw$0Xc1wyT.PXPkuhFwqyhVi0 enable password enable-password line vty 0 15 password terminal-password snmp-server community public ! no ip routing ! interface GigabitEthernet6/0/1 no ip address ! interface GigabitEthernet6/0/2 no ip address ! ... interface GigabitEthernet6/0/12 no ip address cluster enable cluster-name ! end Use this configuration? [yes/no]: yes ! [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. Enter your selection [2]: Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. show version Displays version information for the hardware and firmware.2-207 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands setup express setup express Use the setup express global configuration command to enable Express Setup mode on the switch stack or on a standalone switch. Use the no form of this command to disable Express Setup mode. setup express no setup express Syntax Description This command has no arguments or keywords. Defaults Express Setup is enabled. Command Modes Global configuration Command History Usage Guidelines When Express Setup is enabled on a new (unconfigured) switch, pressing the Mode button for 2 seconds activates Express Setup. You can access the switch through an Ethernet port by using the IP address 10.0.0.1 and then can configure the switch with the web-based Express Setup program or the command-line interface (CLI)-based setup program. When you press the Mode button for 2 seconds on a configured switch, the mode LEDs start flashing. If you press the Mode button for a total of 10 seconds, the switch configuration is deleted, and the switch reboots. The switch can then be configured like a new switch, either through the web-based Express Setup program or the CLI-based setup program. Note As soon as you make any change to the switch configuration (including entering no at the beginning of the CLI-based setup program), configuration by Express Setup is no longer available. You can only run Express Setup again by pressing the Mode button for 10 seconds. This deletes the switch configuration and reboots the switch. If Express Setup is active on the switch, entering the write memory or copy running-configuration startup-configuration privileged EXEC commands deactivates Express Setup. The IP address 10.0.0.1 is no longer valid on the switch, and your connection using this IP address ends. The primary purpose of the no setup express command is to prevent someone from deleting the switch configuration by pressing the Mode button for 10 seconds. Release Modification 12.1(14)EA1 This command was first introduced.2-208 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands setup express Examples This example shows how to enable Express Setup mode: Switch(config)# setup express You can verify that Express Setup mode is enabled by pressing the Mode button: • On an unconfigured switch, the mode LEDs turn solid green after 3 seconds. • On a configured switch, the mode LEDs begin flashing after 2 seconds and turn solid green after 10 seconds. Caution If you hold the Mode button down for a total of 10 seconds, the configuration is deleted, and the switch reboots. This example shows how to disable Express Setup mode: Switch(config)# no setup express You can verify that Express Setup mode is disabled by pressing the Mode button. The mode LEDs do not turn solid green or begin flashing green if Express Setup mode is not enabled on the switch. Related Commands Command Description clear setup express Exits Express Setup mode. show setup express Displays if Express Setup mode is active.2-209 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show access-lists show access-lists Use the show access-lists privileged EXEC command to display access control lists (ACLs) configured on the switch. show access-lists [name | number | hardware counters | ipc] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help strings, the rate-limit keywords are not supported. Command Modes Privileged EXEC Command History Usage Guidelines The switch supports only IP standard and extended access lists. Therefore, the allowed numbers are only 1 to 199 and 1300 to 2699. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. name (Optional) Name of the ACL. number (Optional) ACL number. The range is 1 to 2699. hardware counters (Optional) Display global hardware ACL statistics for switched and routed packets. ipc (Optional) Display Interprocess Communication (IPC) protocol access-list configuration download information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The ipc keyword was added.2-210 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show access-lists Examples This is an example of output from the show access-lists command: Switch# show access-lists Standard IP access list 1 permit 1.1.1.1 permit 2.2.2.2 permit any permit 0.255.255.255, wildcard bits 12.0.0.0 Standard IP access list videowizard_1-1-1-1 permit 1.1.1.1 Standard IP access list videowizard_10-10-10-10 permit 10.10.10.10 Extended IP access list 121 permit ahp host 10.10.10.10 host 20.20.10.10 precedence routine Extended IP access list CMP-NAT-ACL Dynamic Cluster-HSRP deny ip any any deny ip any host 19.19.11.11 deny ip any host 10.11.12.13 Dynamic Cluster-NAT permit ip any any permit ip host 10.99.100.128 any permit ip host 10.46.22.128 any permit ip host 10.45.101.64 any permit ip host 10.45.20.64 any permit ip host 10.213.43.128 any permit ip host 10.91.28.64 any permit ip host 10.99.75.128 any permit ip host 10.38.49.0 any This is an example of output from the show access-lists hardware counters command: Switch# show access-lists hardware counters L2 ACL INPUT Statistics Drop: All frame count: 855 Drop: All bytes count: 94143 Drop And Log: All frame count: 0 Drop And Log: All bytes count: 0 Bridge Only: All frame count: 0 Bridge Only: All bytes count: 0 Bridge Only And Log: All frame count: 0 Bridge Only And Log: All bytes count: 0 Forwarding To CPU: All frame count: 0 Forwarding To CPU: All bytes count: 0 Forwarded: All frame count: 2121 Forwarded: All bytes count: 180762 Forwarded And Log: All frame count: 0 Forwarded And Log: All bytes count: 0 L3 ACL INPUT Statistics Drop: All frame count: 0 Drop: All bytes count: 0 Drop And Log: All frame count: 0 Drop And Log: All bytes count: 0 Bridge Only: All frame count: 0 Bridge Only: All bytes count: 0 Bridge Only And Log: All frame count: 0 Bridge Only And Log: All bytes count: 0 Forwarding To CPU: All frame count: 0 Forwarding To CPU: All bytes count: 0 Forwarded: All frame count: 13586 Forwarded: All bytes count: 1236182 Forwarded And Log: All frame count: 0 Forwarded And Log: All bytes count: 02-211 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show access-lists L2 ACL OUTPUT Statistics Drop: All frame count: 0 Drop: All bytes count: 0 Drop And Log: All frame count: 0 Drop And Log: All bytes count: 0 Bridge Only: All frame count: 0 Bridge Only: All bytes count: 0 Bridge Only And Log: All frame count: 0 Bridge Only And Log: All bytes count: 0 Forwarding To CPU: All frame count: 0 Forwarding To CPU: All bytes count: 0 Forwarded: All frame count: 232983 Forwarded: All bytes count: 16825661 Forwarded And Log: All frame count: 0 Forwarded And Log: All bytes count: 0 L3 ACL OUTPUT Statistics Drop: All frame count: 0 Drop: All bytes count: 0 Drop And Log: All frame count: 0 Drop And Log: All bytes count: 0 Bridge Only: All frame count: 0 Bridge Only: All bytes count: 0 Bridge Only And Log: All frame count: 0 Bridge Only And Log: All bytes count: 0 Forwarding To CPU: All frame count: 0 Forwarding To CPU: All bytes count: 0 Forwarded: All frame count: 514434 Forwarded: All bytes count: 39048748 Forwarded And Log: All frame count: 0 Forwarded And Log: All bytes count: 0 Related Commands Command Description access-list Configures a standard or extended numbered access list on the switch. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. ip access list Configures a named IP access list on the switch. For syntax information, select Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1 > IP Addressing and Services > IP Services Commands. mac access-list extended Configures a named or numbered MAC access list on the switch.2-212 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show auto qos show auto qos Use the show auto qos user EXEC command to display the initial configuration that is generated by the automatic quality of service (auto-QoS) feature. show auto qos [interface [interface-id]] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines The show auto qos [interface [interface-id]] command displays the initial auto-QoS configuration; it does not display any user changes to the configuration that might be in effect. Use the show running-config privileged EXEC command to display the auto-QoS configuration and the user modifications. To display information about the QoS configuration that might be affected by auto-QoS, use one of these commands: • show mls qos • show mls qos maps cos-dscp • show mls qos interface [interface-id] [buffers | queueing] • show mls qos maps [cos-dscp | cos-input-q | cos-output-q | dscp-cos | dscp-input-q | dscp-output-q] • show mls qos input-queue • show running-config Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface [interface-id] (Optional) Display auto-QoS information for the specified interface or for all interfaces. Valid interfaces include physical ports. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced.2-213 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show auto qos Examples This is an example of output from the show auto qos command when auto-QoS is enabled: Switch# show auto qos Initial configuration applied by AutoQoS: mls qos map cos-dscp 0 8 16 26 32 46 48 56 mls qos no mls qos srr-queue input cos-map no mls qos srr-queue output cos-map mls qos srr-queue input cos-map queue 1 threshold 3 0 mls qos srr-queue input cos-map queue 1 threshold 2 1 mls qos srr-queue input cos-map queue 2 threshold 1 2 mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7 mls qos srr-queue input cos-map queue 2 threshold 3 3 5 mls qos srr-queue output cos-map queue 1 threshold 3 5 mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7 mls qos srr-queue output cos-map queue 3 threshold 3 2 4 mls qos srr-queue output cos-map queue 4 threshold 2 1 mls qos srr-queue output cos-map queue 4 threshold 3 0 no mls qos srr-queue input dscp-map no mls qos srr-queue output dscp-map mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 13 14 15 mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4 5 6 7 mls qos srr-queue input dscp-map queue 1 threshold 3 32 mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23 mls qos srr-queue input dscp-map queue 2 threshold 2 26 33 34 35 36 37 38 39 mls qos srr-queue input dscp-map queue 2 threshold 2 48 49 50 51 52 53 54 55 mls qos srr-queue input dscp-map queue 2 threshold 2 56 57 58 59 60 61 62 63 mls qos srr-queue input dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 40 mls qos srr-queue input dscp-map queue 2 threshold 3 41 42 43 44 45 46 47 mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47 mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 48 mls qos srr-queue output dscp-map queue 2 threshold 3 49 50 51 52 53 54 55 56 mls qos srr-queue output dscp-map queue 2 threshold 3 57 58 59 60 61 62 63 mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23 mls qos srr-queue output dscp-map queue 3 threshold 3 26 32 33 34 35 36 37 38 mls qos srr-queue output dscp-map queue 3 threshold 3 39 mls qos srr-queue output dscp-map queue 4 threshold 1 8 mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15 mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7 no mls qos srr-queue input priority-queue 1 no mls qos srr-queue input priority-queue 2 mls qos srr-queue input bandwidth 90 10 no mls qos srr-queue input buffers mls qos queue-set output 1 buffers 20 20 20 40 ! interface GigabitEthernet2/0/2 mls qos trust device cisco-phone mls qos trust cos no queue-set 1 srr-queue bandwidth shape 10 0 0 0 srr-queue bandwidth share 10 10 60 202-214 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show auto qos This is an example of output from the show auto qos interface command after the auto qos voip cisco-phone interface configuration command is entered: Switch# show auto qos interface Initial configuration applied by AutoQoS: ! interface GigabitEthernet2/0/2 mls qos trust device cisco-phone mls qos trust cos no queue-set 1 srr-queue bandwidth shape 10 0 0 0 srr-queue bandwidth share 10 10 60 20 This is an example of output from the show auto qos interface gigabitethernet2/0/2 command after the auto qos voip cisco-phone interface configuration command is entered: Switch# show auto qos interface gigabitethernet2/0/2 mls qos trust device cisco-phone mls qos trust cos no queue-set 1 srr-queue bandwidth shape 10 0 0 0 srr-queue bandwidth share 10 10 60 20 Related Commands Command Description auto qos voip Automatically configures QoS for VoIP within a QoS domain. debug autoqos Enables debugging of the auto-QoS feature.2-215 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show boot show boot Use the show boot privileged EXEC command to display the settings of the boot environment variables. show boot [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show boot command. Table 2- 16 describes each field in the display. Switch# show boot BOOT path-list: flash:c3750-i5q3l2-mz-121.11.AX/c3750-i5q3l2-mz-121.11.AX.bin Config file: flash:config.text Private Config file: private-config Enable Break: no Manual Boot: yes HELPER path-list: Auto upgrade : yes NVRAM/Config file buffer size: 32768 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-216 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show boot Related Commands Table 2-16 show boot Field Descriptions Field Description BOOT path-list Displays a semicolon separated list of executable files to try to load and execute when automatically booting. If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the Flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the Flash file system. Config file Displays the filename that IOS uses to read and write a nonvolatile copy of the system configuration. Private Config file Displays the filename that IOS uses to read and write a nonvolatile copy of the system configuration. Enable Break Displays whether a break during booting is enabled or disabled. If it is set to yes, on, or 1, you can interrupt the automatic boot process by pressing the Break key on the console after the Flash file system is initialized. Manual Boot Displays whether the switch automatically or manually boots. If it is set to no or 0, the boot loader attempts to automatically boot the system. If it is set to anything else, you must manually boot the switch from the boot loader mode. Helper path-list Displays a semicolon separated list of loadable files to dynamically load during the boot loader initialization. Helper files extend or patch the functionality of the boot loader. Auto upgrade Displays whether the switch stack is set to automatically copy its software version to an incompatible switch so that it can join the stack. A switch in version-mismatch (VM) mode is a switch that has a different stack protocol version than the version on the switch stack. Switches in VM mode cannot join the switch stack. If the switch stack has an image that can be copied to a switch in VM mode, and if the boot auto-copy-sw feature is enabled, the switch stack automatically copies the image from another stack member to the switch in VM mode. The switch then exits VM mode, reboots, and joins the switch stack. NVRAM/Config file buffer size Displays the buffer size that IOS uses to hold a copy of the configuration file in memory. The configuration file cannot be larger than the buffer size allocation. Command Description boot auto-copy-sw Automatically upgrade switches in version-mismatch (VM) mode with the switch stack image. boot config-file Specifies the filename that IOS uses to read and write a nonvolatile copy of the system configuration. boot enable-break Enables interrupting the automatic boot process. boot manual Enables manually booting the switch during the next boot cycle. boot private-config-file Specifies the filename that IOS uses to read and write a nonvolatile copy of the private configuration. boot system Specifies the IOS image to load during the next boot cycle.2-217 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show class-map show class-map Use the show class-map user EXEC command to display quality of service (QoS) class maps, which define the match criteria to classify traffic. show class-map [class-map-name] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show class-map command: Switch> show class-map Class Map match-all videowizard_10-10-10-10 (id 2) Match access-group name videowizard_10-10-10-10 Class Map match-any class-default (id 0) Match any Class Map match-all dscp5 (id 3) Match ip dscp 5 Related Commands class-map-name (Optional) Display the contents of the specified class map. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description class-map Creates a class map to be used for matching packets to the class whose name you specify. match (class-map configuration) Defines the match criteria to classify traffic.2-218 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster show cluster Use the show cluster user EXEC command to display the cluster status and a summary of the cluster to which the switch belongs. This command can be entered on the cluster command switch and cluster member switches. show cluster [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines If you enter this command on a switch that is not a cluster member, the error message Not a management cluster member appears. On a cluster member switch, this command displays the identity of the cluster command switch, the switch member number, and the state of its connectivity with the cluster command switch. On a cluster command switch stack or cluster command switch, this command displays the cluster name and the total number of members. It also shows the cluster status and time since the status changed. If redundancy is enabled, it displays the primary and secondary command-switch information. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output when the show cluster command is entered on the active cluster command switch: Switch> show cluster Command switch for cluster "Ajang" Total number of members: 7 Status: 1 members are unreachable Time since last status change: 0 days, 0 hours, 2 minutes Redundancy: Enabled Standby command switch: Member 1 Standby Group: Ajang_standby Standby Group Number: 110 Heartbeat interval: 8 Heartbeat hold-time: 80 Extended discovery hop count: 3 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-219 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster This is an example of output when the show cluster command is entered on a cluster member switch: Switch1> show cluster Member switch for cluster "hapuna" Member number: 3 Management IP address: 192.192.192.192 Command switch mac address: 0000.0c07.ac14 Heartbeat interval: 8 Heartbeat hold-time: 80 This is an example of output when the show cluster command is entered on a cluster member switch that is configured as the standby cluster command switch: Switch> show cluster Member switch for cluster "hapuna" Member number: 3 (Standby command switch) Management IP address: 192.192.192.192 Command switch mac address: 0000.0c07.ac14 Heartbeat interval: 8 Heartbeat hold-time: 80 This is an example of output when the show cluster command is entered on the cluster command switch that has lost connectivity with member 1: Switch> show cluster Command switch for cluster "Ajang" Total number of members: 7 Status: 1 members are unreachable Time since last status change: 0 days, 0 hours, 5 minutes Redundancy: Disabled Heartbeat interval: 8 Heartbeat hold-time: 80 Extended discovery hop count: 3 This is an example of output when the show cluster command is entered on a cluster member switch that has lost connectivity with the cluster command switch: Switch> show cluster Member switch for cluster "hapuna" Member number: Management IP address: 192.192.192.192 Command switch mac address: 0000.0c07.ac14 Heartbeat interval: 8 Heartbeat hold-time: 80 Related Commands Command Description cluster enable Enables a command-capable switch as the cluster command switch, assigns a cluster name, and optionally assigns a member number to it. show cluster candidates Displays a list of candidate switches. show cluster members Displays information about the cluster members.2-220 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster candidates show cluster candidates Use the show cluster candidates privileged EXEC command on a switch stack or on a cluster command switch to display a list of candidate switches. show cluster candidates [detail | mac-address H.H.H.] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines This command is available only on the cluster command switch stack or cluster command switch. If the switch is not a cluster command switch, the command displays an empty line at the prompt. The SN in the display means switch member number. If E appears in the SN column, it means that the switch is discovered through extended discovery. If E does not appear in the SN column, it means that the switch member number is the upstream neighbor of the candidate switch. The hop count is the number of devices the candidate is from the cluster command switch. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show cluster candidates command: Switch> show cluster candidates |---Upstream---| MAC Address Name Device Type PortIf FEC Hops SN PortIf FEC 00d0.7961.c4c0 StLouis-2 WS-C3750-12T Gi6/0/1 2 1 Fa0/11 00d0.bbf5.e900 ldf-dist-128 WS-C3524-XL Fa0/7 1 0 Fa0/24 00e0.1e7e.be80 1900_Switch 1900 3 0 1 0 Fa0/11 00e0.1e9f.7a00 Surfers-24 WS-C2924-XL Fa0/5 1 0 Fa0/3 00e0.1e9f.8c00 Surfers-12-2 WS-C2912-XL Fa0/4 1 0 Fa0/7 00e0.1e9f.8c40 Surfers-12-1 WS-C2912-XL Fa0/1 1 0 Fa0/9 detail (Optional) Display detailed information for all candidates. mac-address H.H.H. (Optional) MAC address of the cluster candidate. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-221 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster candidates This is an example of output from the show cluster candidates command that uses the MAC address of a cluster member switch directly connected to the cluster command switch: Switch> show cluster candidates mac-address 00d0.7961.c4c0 Device 'Tahiti-12' with mac address number 00d0.7961.c4c0 Device type: cisco WS-C3750-12T Upstream MAC address: 00d0.796d.2f00 (Cluster Member 0) Local port: Gi6/0/1 FEC number: Upstream port: GI6/0/11 FEC Number: Hops from cluster edge: 1 Hops from command device: 1 This is an example of output from the show cluster candidates command that uses the MAC address of a cluster member switch three hops from the cluster edge: Switch> show cluster candidates mac-address 0010.7bb6.1cc0 Device 'Ventura' with mac address number 0010.7bb6.1cc0 Device type: cisco WS-C2912MF-XL Upstream MAC address: 0010.7bb6.1cd4 Local port: Fa2/1 FEC number: Upstream port: Fa0/24 FEC Number: Hops from cluster edge: 3 Hops from command device: - This is an example of output from the show cluster candidates detail command: Switch> show cluster candidates detail Device 'Tahiti-12' with mac address number 00d0.7961.c4c0 Device type: cisco WS-C3512-XL Upstream MAC address: 00d0.796d.2f00 (Cluster Member 1) Local port: Fa0/3 FEC number: Upstream port: Fa0/13 FEC Number: Hops from cluster edge: 1 Hops from command device: 2 Device '1900_Switch' with mac address number 00e0.1e7e.be80 Device type: cisco 1900 Upstream MAC address: 00d0.796d.2f00 (Cluster Member 2) Local port: 3 FEC number: 0 Upstream port: Fa0/11 FEC Number: Hops from cluster edge: 1 Hops from command device: 2 Device 'Surfers-24' with mac address number 00e0.1e9f.7a00 Device type: cisco WS-C2924-XL Upstream MAC address: 00d0.796d.2f00 (Cluster Member 3) Local port: Fa0/5 FEC number: Upstream port: Fa0/3 FEC Number: Hops from cluster edge: 1 Hops from command device: 2 Related Commands Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show cluster members Displays information about the cluster members.2-222 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster members show cluster members Use the show cluster members privileged EXEC command on a switch stack or on a cluster command switch to display information about the cluster members. show cluster members [n | detail] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines This command is available only on the cluster command switch stack or cluster command switch. If the cluster has no members, this command displays an empty line at the prompt. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show cluster members command. The SN in the display means switch number. Switch# show cluster members |---Upstream---| SN MAC Address Name PortIf FEC Hops SN PortIf FEC State 0 0002.4b29.2e00 StLouis1 0 Up (Cmdr) 1 0030.946c.d740 tal-switch-1 Fa0/13 1 0 Gi0/1 Up 2 0002.b922.7180 nms-2820 10 0 2 1 Fa0/18 Up 3 0002.4b29.4400 SanJuan2 Gi0/1 2 1 Fa0/11 Up 4 0002.4b28.c480 GenieTest Gi0/2 2 1 Fa0/9 Up n (Optional) Number that identifies a cluster member. The range is 0 to 15. detail (Optional) Display detailed information for all cluster members. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-223 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show cluster members This is an example of output from the show cluster members for cluster member 3: Switch# show cluster members 3 Device 'SanJuan2' with member number 3 Device type: cisco WS-C3750-12T MAC address: 0002.4b29.4400 Upstream MAC address: 0030.946c.d740 (Cluster member 1) Local port: Gi6/0/1 FEC number: Upstream port: GI6/0/11 FEC Number: Hops from command device: 2 This is an example of output from the show cluster members detail command: Switch# show cluster members detail Device 'StLouis1' with member number 0 (Command Switch) Device type: cisco WS-C3750-12T MAC address: 0002.4b29.2e00 Upstream MAC address: Local port: FEC number: Upstream port: FEC Number: Hops from command device: 0 Device 'tal-switch-14' with member number 1 Device type: cisco WS-C3548-XL MAC address: 0030.946c.d740 Upstream MAC address: 0002.4b29.2e00 (Cluster member 0) Local port: Fa0/13 FEC number: Upstream port: Gi0/1 FEC Number: Hops from command device: 1 Device 'nms-2820' with member number 2 Device type: cisco 2820 MAC address: 0002.b922.7180 Upstream MAC address: 0030.946c.d740 (Cluster member 1) Local port: 10 FEC number: 0 Upstream port: Fa0/18 FEC Number: Hops from command device: 2 Device 'SanJuan2' with member number 3 Device type: cisco WS-C3750-12T MAC address: 0002.4b29.4400 Upstream MAC address: 0030.946c.d740 (Cluster member 1) Local port: Gi6/0/1 FEC number: Upstream port: Fa6/0/11 FEC Number: Hops from command device: 2 Device 'GenieTest' with member number 4 Device type: cisco SeaHorse MAC address: 0002.4b28.c480 Upstream MAC address: 0030.946c.d740 (Cluster member 1) Local port: Gi0/2 FEC number: Upstream port: Fa0/9 FEC Number: Hops from command device: 2 Device 'Palpatine' with member number 5 Device type: cisco WS-C2924M-XL MAC address: 00b0.6404.f8c0 Upstream MAC address: 0002.4b29.2e00 (Cluster member 0) Local port: Gi2/1 FEC number: Upstream port: Gi0/7 FEC Number: Hops from command device: 1 Related Commands Command Description show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show cluster candidates Displays a list of candidate switches.2-224 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers cpu-interface show controllers cpu-interface Use the show controllers cpu-interface privileged EXEC command to display the state of the CPU network interface application-specific integrated circuit (ASIC) and the send and receive statistics for packets reaching the CPU. show controllers cpu-interface [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is a partial output example from the show controllers cpu-interface command: Switch# show controllers cpu-interface cpu-queue-frames retrieved dropped invalid hol-block ----------------- ---------- ---------- ---------- ---------- rpc 4523063 0 0 0 stp 1545035 0 0 0 ipc 1903047 0 0 0 routing protocol 96145 0 0 0 L2 protocol 79596 0 0 0 remote console 0 0 0 0 sw forwarding 5756 0 0 0 host 225646 0 0 0 broadcast 46472 0 0 0 cbt-to-spt 0 0 0 0 igmp snooping 68411 0 0 0 icmp 0 0 0 0 logging 0 0 0 0 rpf-fail 0 0 0 0 queue14 0 0 0 0 cpu heartbeat 1710501 0 0 0 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-225 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers cpu-interface Supervisor ASIC receive-queue parameters ---------------------------------------- queue 0 maxrecevsize 5EE pakhead 1419A20 paktail 13EAED4 queue 1 maxrecevsize 5EE pakhead 15828E0 paktail 157FBFC queue 2 maxrecevsize 5EE pakhead 1470D40 paktail 1470FE4 queue 3 maxrecevsize 5EE pakhead 19CDDD0 paktail 19D02C8

Supervisor ASIC Mic Registers ------------------------------ MicDirectPollInfo 80000800 MicIndicationsReceived 00000000 MicInterruptsReceived 00000000 MicPcsInfo 0001001F MicPlbMasterConfiguration 00000000 MicRxFifosAvailable 00000000 MicRxFifosReady 0000BFFF MicTimeOutPeriod: FrameTOPeriod: 00000EA6 DirectTOPeriod: 00004000

MicTransmitFifoInfo: Fifo0: StartPtrs: 038C2800 ReadPtr: 038C2C38 WritePtrs: 038C2C38 Fifo_Flag: 8A800800 Weights: 001E001E Fifo1: StartPtr: 03A9BC00 ReadPtr: 03A9BC60 WritePtrs: 03A9BC60 Fifo_Flag: 89800400 writeHeaderPtr: 03A9BC60 Fifo2: StartPtr: 038C8800 ReadPtr: 038C88E0 WritePtrs: 038C88E0 Fifo_Flag: 88800200 writeHeaderPtr: 038C88E0 Fifo3: StartPtr: 03C30400 ReadPtr: 03C30638 WritePtrs: 03C30638 Fifo_Flag: 89800400 writeHeaderPtr: 03C30638 Fifo4: StartPtr: 03AD5000 ReadPtr: 03AD50A0 WritePtrs: 03AD50A0 Fifo_Flag: 89800400 writeHeaderPtr: 03AD50A0 Fifo5: StartPtr: 03A7A600 ReadPtr: 03A7A600 WritePtrs: 03A7A600 Fifo_Flag: 88800200 writeHeaderPtr: 03A7A600 Fifo6: StartPtr: 03BF8400 ReadPtr: 03BF87F0 WritePtrs: 03BF87F0 Fifo_Flag: 89800400

Related Commands Command Description show controllers ethernet-controller Displays per-interface send and receive statistics read from the hardware or the interface internal registers. show interfaces Displays the administrative and operational status of all interfaces or a specified interface.2-226 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers ethernet-controller show controllers ethernet-controller Use the show controllers ethernet-controller privileged EXEC command without keywords to display per-interface send and receive statistics read from the hardware. Use with the phy keyword to display the interface internal registers or the port-asic keyword to display information about the port application-specific integrated circuit (ASIC). show controllers ethernet-controller [interface-id] [phy[detail]] [port-asic {configuration | statistics}] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC (supported with only the interface-id keywords in user EXEC mode) Command History Usage Guidelines This display without keywords provides traffic statistics, basically the RMON statistics for all interfaces or for the specified interface. When you enter the phy or port-asic keywords, the displayed information is useful primarily for Cisco technical support representatives troubleshooting the switch. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface-id The physical interface (including type, stack member, module, and port number). phy (Optional) Display the status of the internal registers on the switch physical layer device (PHY) for the device or the interface. This display includes the operational state of the automatic media-dependent-interface crossover (Auto MDIX) feature on an interface. detail (Optional) Display details about the PHY internal registers. port-asic (Optional) Display information about the port ASIC internal registers. configuration Display port ASIC internal register configuration. statistics Display port ASIC statistics, including the Rx/Sup Queue and miscellaneous statistics. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-227 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers ethernet-controller Examples This is an example of output from the show controllers ethernet-controller command for an interface: Switch# show controllers ethernet-controller GigabitEthernet6/0/1 Transmit GigabitEthernet6/0/1 Receive 0 Bytes 0 Bytes 0 Unicast frames 0 Unicast frames 0 Multicast frames 0 Multicast frames 0 Broadcast frames 0 Broadcast frames 0 Too old frames 0 Unicast bytes 0 Deferred frames 0 Multicast bytes 0 MTU exceeded frames 0 Broadcast bytes 0 1 collision frames 0 Alignment errors 0 2 collision frames 0 FCS errors 0 3 collision frames 0 Oversize frames 0 4 collision frames 0 Undersize frames 0 5 collision frames 0 Collision fragments 0 6 collision frames 0 7 collision frames 0 Minimum size frames 0 8 collision frames 0 65 to 127 byte frames 0 9 collision frames 0 128 to 255 byte frames 0 10 collision frames 0 256 to 511 byte frames 0 11 collision frames 0 512 to 1023 byte frames 0 12 collision frames 0 1024 to 1518 byte frames 0 13 collision frames 0 Overrun frames 0 14 collision frames 0 Pause frames 0 15 collision frames 0 Symbol error frames 0 Excessive collisions 0 Late collisions 0 Invalid frames, too large 0 VLAN discard frames 0 Valid frames, too large 0 Excess defer frames 0 Invalid frames, too small 0 64 byte frames 0 Valid frames, too small 0 127 byte frames 0 255 byte frames 0 Too old frames 0 511 byte frames 0 Valid oversize frames 0 1023 byte frames 0 System FCS error frames 0 1518 byte frames 0 RxPortFifoFull drop frame 0 Too large frames 0 Good (1 coll) frames This is an example of output from the show controllers ethernet-controller phy command for a specific interface. Note that the last line of the display is the setting for automatic media-dependent-interface crossover (Auto-MDIX) for the interface. Switch# show controllers ethernet-controller gigabitethernet1/0/3 phy Control Register : 0001 0001 0100 0000 Control STATUS : 0111 1001 0100 1001 Phy ID 1 : 0000 0001 0100 0001 Phy ID 2 : 0000 1100 0010 0100 Auto-Negotiation Advertisement : 0000 0011 1110 0001 Auto-Negotiation Link Partner : 0000 0000 0000 0000 Auto-Negotiation Expansion Reg : 0000 0000 0000 0100 Next Page Transmit Register : 0010 0000 0000 0001 Link Partner Next page Registe : 0000 0000 0000 0000 1000BASE-T Control Register : 0000 1111 0000 0000 1000BASE-T Status Register : 0100 0000 0000 0000 Extended Status Register : 0011 0000 0000 0000 PHY Specific Control Register : 0000 0000 0111 1000 PHY Specific Status Register : 1000 0001 0100 0000 Interrupt Enable : 0000 0000 0000 0000 Interrupt Status : 0000 0000 0100 0000 Extended PHY Specific Control : 0000 1100 0110 10002-228 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers ethernet-controller Receive Error Counter : 0000 0000 0000 0000 Reserved Register 1 : 0000 0000 0000 0000 Global Status : 0000 0000 0000 0000 LED Control : 0100 0001 0000 0000 Manual LED Override : 0000 1000 0010 1010 Extended PHY Specific Control : 0000 0000 0001 1010 Disable Receiver 1 : 0000 0000 0000 1011 Disable Receiver 2 : 1000 0000 0000 0100 Extended PHY Specific Status : 1000 0100 1000 0000 Auto-MDIX : On [AdminState=1 Flags=0x00052248] This is an example of output from the show controllers ethernet-controller port-asic configuration command: Switch# show controllers ethernet-controller port-asic configuration ======================================================================== Switch 4, PortASIC 0 Registers ------------------------------------------------------------------------ DeviceType : 000101BC Reset : 00000000 PmadMicConfig : 00000001 PmadMicDiag : 00000003 SupervisorReceiveFifoSramInfo : 000007D0 000007D0 40000000 SupervisorTransmitFifoSramInfo : 000001D0 000001D0 40000000 GlobalStatus : 00000800 IndicationStatus : 00000000 IndicationStatusMask : FFFFFFFF InterruptStatus : 00000000 InterruptStatusMask : 01FFE800 SupervisorDiag : 00000000 SupervisorFrameSizeLimit : 000007C8 SupervisorBroadcast : 000A0F01 GeneralIO : 000003F9 00000000 00000004 StackPcsInfo : FFFF1000 860329BD 5555FFFF FFFFFFFF FF0FFF00 86020000 5555FFFF 00000000 StackRacInfo : 73001630 00000003 7F001644 00000003 24140003 FD632B00 18E418E0 FFFFFFFF StackControlStatus : 18E418E0 stackControlStatusMask : FFFFFFFF TransmitBufferFreeListInfo : 00000854 00000800 00000FF8 00000000 0000088A 0000085D 00000FF8 00000000 TransmitRingFifoInfo : 00000016 00000016 40000000 00000000 0000000C 0000000C 40000000 00000000 TransmitBufferInfo : 00012000 00000FFF 00000000 00000030 TransmitBufferCommonCount : 00000F7A TransmitBufferCommonCountPeak : 0000001E TransmitBufferCommonCommonEmpty : 000000FF NetworkActivity : 00000000 00000000 00000000 02400000 DroppedStatistics : 00000000 FrameLengthDeltaSelect : 00000001 SneakPortFifoInfo : 00000000 MacInfo : 0EC0801C 00000001 0EC0801B 00000001 00C0001D 00000001 00C0001E 00000001

2-229 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers ethernet-controller This is an example of output from the show controllers ethernet-controller port-asic statistics command: Switch# show controllers ethernet-controller port-asic statistics =========================================================================== Switch 1, PortASIC 0 Statistics --------------------------------------------------------------------------- 0 RxQ-0, wt-0 enqueue frames 0 RxQ-0, wt-0 drop frames 4118966 RxQ-0, wt-1 enqueue frames 0 RxQ-0, wt-1 drop frames 0 RxQ-0, wt-2 enqueue frames 0 RxQ-0, wt-2 drop frames 0 RxQ-1, wt-0 enqueue frames 0 RxQ-1, wt-0 drop frames 296 RxQ-1, wt-1 enqueue frames 0 RxQ-1, wt-1 drop frames 2836036 RxQ-1, wt-2 enqueue frames 0 RxQ-1, wt-2 drop frames 0 RxQ-2, wt-0 enqueue frames 0 RxQ-2, wt-0 drop frames 0 RxQ-2, wt-1 enqueue frames 0 RxQ-2, wt-1 drop frames 158377 RxQ-2, wt-2 enqueue frames 0 RxQ-2, wt-2 drop frames 0 RxQ-3, wt-0 enqueue frames 0 RxQ-3, wt-0 drop frames 0 RxQ-3, wt-1 enqueue frames 0 RxQ-3, wt-1 drop frames 0 RxQ-3, wt-2 enqueue frames 0 RxQ-3, wt-2 drop frames 15 TxBufferFull Drop Count 0 Rx Fcs Error Frames 0 TxBufferFrameDesc BadCrc16 0 Rx Invalid Oversize Frames 0 TxBuffer Bandwidth Drop Cou 0 Rx Invalid Too Large Frames 0 TxQueue Bandwidth Drop Coun 0 Rx Invalid Too Large Frames 0 TxQueue Missed Drop Statist 0 Rx Invalid Too Small Frames 74 RxBuffer Drop DestIndex Cou 0 Rx Too Old Frames 0 SneakQueue Drop Count 0 Tx Too Old Frames 0 Learning Queue Overflow Fra 0 System Fcs Error Frames 0 Learning Cam Skip Count 15 Sup Queue 0 Drop Frames 0 Sup Queue 8 Drop Frames 0 Sup Queue 1 Drop Frames 0 Sup Queue 9 Drop Frames 0 Sup Queue 2 Drop Frames 0 Sup Queue 10 Drop Frames 0 Sup Queue 3 Drop Frames 0 Sup Queue 11 Drop Frames 0 Sup Queue 4 Drop Frames 0 Sup Queue 12 Drop Frames 0 Sup Queue 5 Drop Frames 0 Sup Queue 13 Drop Frames 0 Sup Queue 6 Drop Frames 0 Sup Queue 14 Drop Frames 0 Sup Queue 7 Drop Frames 0 Sup Queue 15 Drop Frames =========================================================================== Switch 1, PortASIC 1 Statistics --------------------------------------------------------------------------- 0 RxQ-0, wt-0 enqueue frames 0 RxQ-0, wt-0 drop frames 52 RxQ-0, wt-1 enqueue frames 0 RxQ-0, wt-1 drop frames 0 RxQ-0, wt-2 enqueue frames 0 RxQ-0, wt-2 drop frames

Related Commands Command Description show boot Displays the state of the CPU network ASIC and send and receive statistics for packets reaching the CPU. show controllers tcam Displays the state of registers for all ternary content addressable memory (TCAM) and TCAM ASICs.2-230 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers tcam show controllers tcam Use the show controllers tcam privileged EXEC command to display the state of the registers for all ternary content addressable memory (TCAM) in the system and for all TCAM interface application-specific integrated circuits (ASICs) that are CAM controllers. show controllers tcam [asic [number]] [detail] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines This display provides information that might be useful for Cisco technical support representatives troubleshooting the switch. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. asic (Optional) Display port ASIC TCAM information. number (Optional) Display information for the specified port ASIC number. The range is from 0 to 15. detail (Optional) Display detailed TCAM register information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The asic [number] keywords were added.2-231 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show controllers tcam Examples This is an example of output from the show controllers tcam command: Switch# show controllers tcam ------------------------------------------------------------------------ TCAM-0 Registers ------------------------------------------------------------------------ REV: 00B30103 SIZE: 00080040 ID: 00000000 CCR: 00000000_F0000020 RPID0: 00000000_00000000 RPID1: 00000000_00000000 RPID2: 00000000_00000000 RPID3: 00000000_00000000 HRR0: 00000000_E000CAFC HRR1: 00000000_00000000 HRR2: 00000000_00000000 HRR3: 00000000_00000000 HRR4: 00000000_00000000 HRR5: 00000000_00000000 HRR6: 00000000_00000000 HRR7: 00000000_00000000

GMR31: FF_FFFFFFFF_FFFFFFFF GMR32: FF_FFFFFFFF_FFFFFFFF GMR33: FF_FFFFFFFF_FFFFFFFF ============================================================================= TCAM related PortASIC 1 registers ============================================================================= LookupType: 89A1C67D_24E35F00 LastCamIndex: 0000FFE0 LocalNoMatch: 000069E0 ForwardingRamBaseAddress: 00022A00 0002FE00 00040600 0002FE00 0000D400 00000000 003FBA00 00009000 00009000 00040600 00000000 00012800 00012900 Related Commands Command Description show controllers cpu-interface Displays the state of the CPU network ASIC and send and receive statistics for packets reaching the CPU. show controllers ethernet-controller Displays per-interface send and receive statistics read from the hardware or the interface internal registers.2-232 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show dot1x show dot1x Use the show dot1x privileged EXEC command to display 802.1X statistics, administrative status, and operational status for the switch or for the specified interface. show dot1x [all | interface interface-id | statistics interface interface-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify an interface, global parameters and a summary are displayed. If you specify an interface, details for that interface are displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. all (Optional) Display the 802.1X status for all interfaces. interface interface-id (Optional) Display the 802.1X status for the specified interface (including type, stack member, module, and port number). statistics interface interface-id (Optional) Display 802.1X statistics for the specified interface (including type, stack member, module, and port number). | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The all keyword was added.2-233 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show dot1x Examples This is an example of output from the show dot1x and the show dot1x all privileged EXEC commands: Switch# show dot1x Sysauthcontrol = Enabled Dot1x Protocol Version = 1 Dot1x Oper Controlled Directions = Both Dot1x Admin Controlled Directions = Both Switch# show dot1x all Dot1x Info for interface GigabitEthernet1/0/3 ---------------------------------------------------- Supplicant MAC 00d0.b71b.35de AuthSM State = CONNECTING BendSM State = IDLE PortStatus = UNAUTHORIZED MaxReq = 2 HostMode = Single Port Control = Auto QuietPeriod = 60 Seconds Re-authentication = Disabled ReAuthPeriod = 3600 Seconds ServerTimeout = 30 Seconds SuppTimeout = 30 Seconds TxPeriod = 30 Seconds Guest-Vlan = 0 Dot1x Info for interface GigabitEthernet1/0/7 ---------------------------------------------------- PortStatus = UNAUTHORIZED MaxReq = 2 HostMode = Multi Port Control = Auto QuietPeriod = 60 Seconds Re-authentication = Disabled ReAuthPeriod = 3600 Seconds ServerTimeout = 30 Seconds SuppTimeout = 30 Seconds TxPeriod = 30 Seconds Guest-Vlan = 0 This is an example of output from the show dot1x interface gigabitethernet1/0/3 privileged EXEC command: Switch# show dot1x interface gigabitethernet1/0/3 Supplicant MAC 00d0.b71b.35de AuthSM State = AUTHENTICATED BendSM State = IDLE PortStatus = AUTHORIZED MaxReq = 2 HostMode = Single Port Control = Auto QuietPeriod = 60 Seconds Re-authentication = Disabled ReAuthPeriod = 3600 Seconds ServerTimeout = 30 Seconds SuppTimeout = 30 Seconds TxPeriod = 30 Seconds Guest-Vlan = 0 2-234 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show dot1x This is an example of output from the show dot1x statistics interface gigabitethernet1/0/3 command. Table 2-17 describes the fields in the display. Switch# show dot1x statistics interface gigabitethernet1/0/3 PortStatistics Parameters for Dot1x -------------------------------------------- TxReqId = 15 TxReq = 0 TxTotal = 15 RxStart = 4 RxLogoff = 0 RxRespId = 1 RxResp = 1 RxInvalid = 0 RxLenErr = 0 RxTotal= 6 RxVersion = 1 LastRxSrcMac 00d0.b71b.35de Related Commands Table 2-17 show dot1x statistics Field Descriptions Field Description TxReqId Number of Extensible Authentication Protocol (EAP)-request/identity frames that have been sent. TxReq Number of EAP-request frames (other than request/identity frames) that have been sent. TxTotal Number of Extensible Authentication Protocol over LAN (EAPOL) frames of any type that have been sent. RxStart Number of valid EAPOL-start frames that have been received. RxLogoff Number of EAPOL-logoff frames that have been received. RxRespId Number of EAP-response/identity frames that have been received. RxResp Number of valid EAP-response frames (other than response/identity frames) that have been received. RxInvalid Number of EAPOL frames that have been received and have an unrecognized frame type. RxLenError Number of EAPOL frames that have been received in which the packet body length field is invalid. RxTotal Number of valid EAPOL frames of any type that have been received. RxVersion Number of received packets in the 802.1X version 1 format. LastRxSrcMac Source MAC address carried in the most recently received EAPOL frame. Command Description dot1x default Resets the configurable 802.1X parameters to their default values.2-235 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show dtp show dtp Use the show dtp privileged EXEC command to display Dynamic Trunking Protocol (DTP) information for the switch or for a specified interface. show dtp [interface interface-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show dtp command: Switch# show dtp Global DTP information Sending DTP Hello packets every 30 seconds Dynamic Trunk timeout is 300 seconds 21 interfaces using DTP interface interface-id (Optional) Display port security settings for the specified interface. Valid interfaces include physical ports (including type, stack member, module, and port number). | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-236 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show dtp This is an example of output from the show dtp interface command: Switch# show dtp interface gigabitethernet1/0/1 DTP information for GigabitEthernet1/0/1: TOS/TAS/TNS: ACCESS/AUTO/ACCESS TOT/TAT/TNT: NATIVE/NEGOTIATE/NATIVE Neighbor address 1: 000943A7D081 Neighbor address 2: 000000000000 Hello timer expiration (sec/state): 1/RUNNING Access timer expiration (sec/state): never/STOPPED Negotiation timer expiration (sec/state): never/STOPPED Multidrop timer expiration (sec/state): never/STOPPED FSM state: S2:ACCESS # times multi & trunk 0 Enabled: yes In STP: no Statistics ---------- 3160 packets received (3160 good) 0 packets dropped 0 nonegotiate, 0 bad version, 0 domain mismatches, 0 bad TLVs, 0 other 6320 packets output (6320 good) 3160 native, 3160 software encap isl, 0 isl hardware native 0 output errors 0 trunk timeouts 1 link ups, last link up on Mon Mar 01 1993, 01:02:29 0 link downs Related Commands Command Description show interfaces trunk Displays interface trunking information.2-237 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show env show env Use the show env user EXEC command to display fan, temperature, redundant power system (RPS) availability, and power information for the switch being accessed (standalone switch or stack master or stack member). Use with the stack keyword to display all information for the stack or for a specified switch in the stack. show env {all | fan | power | rps | stack [switch-number] | temperature} [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Use the show access-lists privileged EXEC command to access information from a specific switch other than the master. You can use the show env stack [switch-number] command to display information about any switch in the stack from any switch member. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show env all command entered from the master switch or a standalone switch: Switch> show env all FAN is OK TEMPERATURE is OK POWER is OK RPS is AVAILABLE all Display both fan and temperature environmental status. fan Display the switch fan status. power Display the switch power status. rps Display whether an RPS 300 Redundant Power System is connected to the switch. stack [switch-number] Display all environmental status for each switch in the stack or for the specified switch. The range is 1 to 9, depending on the switch member numbers in the stack. temperature Display the switch temperature status. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-238 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show env This is an example of output from the show env fan command: Switch> show env fan FAN is OK This is an example of output from the show env stack command: Switch> show env stack SWITCH: 1 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT SWITCH: 2 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT SWITCH: 3 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT SWITCH: 4 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT SWITCH: 5 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT SWITCH: 6 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT This example shows how to display information about stack member 3 from the master switch: Switch> show env stack 3 SWITCH: 3 FAN is OK TEMPERATURE is OK POWER is OK RPS is NOT PRESENT2-239 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable detect show errdisable detect Use the show errdisable detect user EXEC command to display error-disable detection status. show errdisable detect [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. On the Catalyst 3750 switch, a displayed gbic-invalid error reason refers to an invalid small form-factor pluggable (SFP) interface. Examples This is an example of output from the show errdisable detect command: Switch> show errdisable detect ErrDisable Reason Detection status ----------------- ---------------- udld Enabled bpduguard Enabled security-violation Enabled channel-misconfig Enabled psecure-violation Enabled dhcp-rate-limit Enabled unicast-flood Enabled vmps Enabled pagp-flap Enabled dtp-flap Enabled link-flap Enabled gbic-invalid Enabled loopback Enabled Note Though visible in the output, the dhcp-rate-limit and unicast-flood fields are not valid. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-240 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable detect Related Commands Command Description errdisable detect cause Enables error-disable detection for a specific cause or all causes. show errdisable flap-values Displays error condition recognition information. show errdisable recovery Displays error-disable recovery timer information. show interfaces status Displays interface status or a list of interfaces in error-disabled state.2-241 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable flap-values show errdisable flap-values Use the show errdisable flap-values user EXEC command to display conditions that cause an error to be recognized for a cause. show errdisable flap-values [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines The Flaps column in the display shows how many changes to the state within the specified time interval will cause an error to be detected and a port to be disabled. For example, the display shows that an error will be assumed and the port shut down if three Dynamic Trunking Protocol (DTP)-state (port mode access/trunk) or Port Aggregation Protocol (PAgP) flap changes occur during a 30-second interval, or if 5 link-state (link up/down) changes occur during a 10-second interval. ErrDisable Reason Flaps Time (sec) ----------------- ------ ---------- pagp-flap 3 30 dtp-flap 3 30 link-flap 5 10 Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show errdisable flap-values command: Switch> show errdisable flap-values ErrDisable Reason Flaps Time (sec) ----------------- ------ ---------- pagp-flap 3 30 dtp-flap 3 30 link-flap 5 10 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-242 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable flap-values Related Commands Command Description errdisable detect cause Enables error-disable detection for a specific cause or all causes. show errdisable detect Displays error-disable detection status. show errdisable recovery Displays error-disable recovery timer information. show interfaces status Displays interface status or a list of interfaces in error-disabled state.2-243 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable recovery show errdisable recovery Use the show errdisable recovery user EXEC command to display the error-disable recovery timer information. show errdisable recovery [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. On the Catalyst 3750 switch, a gbic-invalid error-disable reason refers to an invalid small form-factor pluggable (SFP) interface. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-244 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show errdisable recovery Examples This is an example of output from the show errdisable recovery command: Switch> show errdisable recovery ErrDisable Reason Timer Status ----------------- -------------- udld Disabled bpduguard Disabled security-violatio Disabled channel-misconfig Disabled vmps Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled gbic-invalid Disabled psecure-violation Disabled gbic-invalid Disabled dhcp-rate-limit Disabled unicast-flood Disabled loopback Disabled Timer interval:300 seconds Interfaces that will be enabled at the next timeout: Interface Errdisable reason Time left(sec) --------- ----------------- -------------- Gi1/0/4 link-flap 279 Related Commands Command Description errdisable recovery Configures the recover mechanism variables. show errdisable detect Displays error disable detection status. show errdisable flap-values Displays error condition recognition information. show interfaces status Displays interface status or a list of interfaces in error-disabled state.2-245 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show etherchannel show etherchannel Use the show etherchannel user EXEC command to display EtherChannel information for a channel. show etherchannel [channel-group-number {detail | port | port-channel | protocol | summary}] {detail | load-balance | port | port-channel | protocol | summary} [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines If you do not specify a channel-group, all channel groups are displayed. In the output, the Passive port list field is displayed only for Layer 3 port channels. This field means that the physical interface, which is still not up, is configured to be in the channel group (and indirectly is in the only port channel in the channel group). Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. channel-group-number (Optional) Number of the channel group. The range is 1 to 12. detail Display detailed EtherChannel information. load-balance Display the load-balance or frame-distribution scheme among ports in the port channel. port Display EtherChannel port information. port-channel Display port-channel information. protocol Display the protocol that is being used in the EtherChannel. summary Display a one-line summary per channel-group. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The protocol keyword was added.2-246 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show etherchannel Examples This is an example of output from the show etherchannel 1 detail command: Switch> show etherchannel 1 detail Group state = L2 Ports: 2 Maxports = 16 Port-channels: 1 Max Port-channels = 16 Protocol: LACP Ports in the group: ------------------- Port: Gi1/0/1 ------------ Port state = Up Mstr In-Bndl Channel group = 1 Mode = Active Gcchange = - Port-channel = Po1 GC = - Pseudo port-channel = Po1 Port index = 0 Load = 0x00 Protocol = LACP Flags: S - Device is sending Slow LACPDUs F - Device is sending fast LACPDU A - Device is in active mode. P - Device is in passive mode. Local information: LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi1/0/1 SA bndl 32768 0x1 0x1 0x101 0x3D Gi1/0/2 SA bndl 32768 0x0 0x1 0x0 0x3D Age of the port in the current state: 01d:20h:06m:04s Port-channels in the group: ---------------------- Port-channel: Po1 (Primary Aggregator) ------------ Age of the Port-channel = 01d:20h:20m:26s Logical slot/port = 10/1 Number of ports = 2 HotStandBy port = null Port state = Port-channel Ag-Inuse Protocol = LACP Ports in the Port-channel: Index Load Port EC state No of bits ------+------+------+------------------+----------- 0 00 Gi1/0/1 Active 0 0 00 Gi1/0/2 Active 0 Time since last port bundled: 01d:20h:20m:20s Gi1/0/22-247 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show etherchannel This is an example of output from the show etherchannel 1 summary command: Switch> show etherchannel 1 summary Flags: D - down P - in port-channel I - stand-alone s - suspended H - Hot-standby (LACP only) R - Layer3 S - Layer2 u - unsuitable for bundling U - in use f - failed to allocate aggregator d - default port Number of channel-groups in use: 1 Number of aggregators: 1 Group Port-channel Protocol Ports ------+-------------+-----------+---------------------------------------- 1 Po1(SU) LACP Gi1/0/1(P) Gi1/0/2(P) This is an example of output from the show etherchannel 1 port-channel command: Switch> show etherchannel 1 port-channel Port-channels in the group: ---------------------- Port-channel: Po1 (Primary Aggregator) ------------ Age of the Port-channel = 01d:20h:24m:50s Logical slot/port = 10/1 Number of ports = 2 HotStandBy port = null Port state = Port-channel Ag-Inuse Protocol = LACP Ports in the Port-channel: Index Load Port EC state No of bits ------+------+------+------------------+----------- 0 00 Gi1/0/1 Active 0 0 00 Gi1/0/2 Active 0 Time since last port bundled: 01d:20h:24m:44s Gi1/0/2 This is an example of output from show etherchannel protocol command: Switch# show etherchannel protocol Channel-group listing: ----------------------- Group: 1 ---------- Protocol: LACP Group: 2 ---------- Protocol: PAgP Related Commands Command Description channel-group Assigns an Ethernet interface to an EtherChannel group. channel-protocol Restricts the protocol used on an interface to manage channeling. interface port-channel Accesses or creates the port channel.2-248 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces show interfaces Use the show interfaces privileged EXEC command to display the administrative and operational status of all interfaces or a specified interface. show interfaces [interface-id | vlan vlan-id] [accounting | capabilities [module number] | counters | description | etherchannel | flowcontrol | pruning | stats | status [err-disabled] | switchport | trunk] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help strings, the crb, fair-queue, irb, mac-accounting, precedence, private-vlan mapping, random-detect, rate-limit, and shape keywords are not supported. interface-id (Optional) Valid interfaces include physical ports (including type, stack member, module, and port number) and port channels. The valid port-channel range is 1 to 12. vlan vlan-id (Optional) VLAN identification. The range is 1 to 4094. accounting (Optional) Display accounting information on the interface, including active protocols and input and output packets and octets. capabilities (Optional) Display the capabilities of all interfaces or the specified interface, including the features and options that you can configure on the interface. Though visible in the command line help, this option is not available for VLAN IDs. module number (Optional) Display capabilities of all interfaces on the specified stack member. The range is from 1 to 9. This option is not available if you enter a specific interface ID before the capabilities keyword. counters (Optional) See the show interfaces counters command. description (Optional) Display the administrative status and description set for an interface. etherchannel (Optional) Display interface EtherChannel information. flowcontrol (Optional) Display interface flowcontrol information pruning (Optional) Display interface trunk VTP pruning information. stats (Optional) Display the input and output packets by switching path for the interface. status (Optional) Display the status of the interface. err-disabled (Optional) Display interfaces in error-disabled state. switchport (Optional) Display the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. trunk Display interface trunk information. If you do not specify an interface, information for only active trunking ports is displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point.2-249 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces Command Modes Privileged EXEC Command History Usage Guidelines The show interfaces capabilities command with different keywords has these results: • Entering show interface capabilities module number displays the capabilities of all interfaces on that switch in the stack. If there is no switch with that module number in the stack, the output is blank. Entering show interfaces interface-id capabilities displays the capabilities of the specified interface. • Entering show interfaces capabilities (with no module number or interface ID) displays the capabilities of all interfaces in the stack. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show interfaces command for Gigabit Ethernet interface 3 on stack member 3: Switch# show interfaces gigabitethernet3/0/3 GigabitEthernet3/0/3 is down, line protocol is down Hardware is Gigabit Ethernet, address is 0009.43a7.d085 (bia 0009.43a7.d085) MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Auto-duplex, Auto-speed input flow-control is off, output flow-control is off ARP type: ARPA, ARP Timeout 04:00:00 Last input never, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue :0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 2 packets input, 1040 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 4 packets output, 1040 bytes, 0 underruns 0 output errors, 0 collisions, 3 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 Support for the capabilities keyword was added.2-250 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces This is an example of output from the show interfaces accounting command. Switch# show interfaces accounting Vlan1 Protocol Pkts In Chars In Pkts Out Chars Out IP 1094395 131900022 559555 84077157 Spanning Tree 283896 17033760 42 2520 ARP 63738 3825680 231 13860 Interface Vlan2 is disabled Vlan7 Protocol Pkts In Chars In Pkts Out Chars Out No traffic sent or received on this interface. Vlan31 Protocol Pkts In Chars In Pkts Out Chars Out No traffic sent or received on this interface. GigabitEthernet1/0/1 Protocol Pkts In Chars In Pkts Out Chars Out No traffic sent or received on this interface. GigabitEthernet1/0/2 Protocol Pkts In Chars In Pkts Out Chars Out No traffic sent or received on this interface. GigabitEthernet1/0/3 Protocol Pkts In Chars In Pkts Out Chars Out No traffic sent or received on this interface.

This is an example of output from the show interfaces capabilities command for an interface. Switch# show interfaces gigabitethernet1/0/3 capabilities GigabitEthernet1/0/3 Model: WS-C3750G-24TS Type: 10/100/1000BaseTX Speed: 10,100,1000,auto Duplex: full,auto Trunk encap. type: 802.1Q,ISL Trunk mode: on,off,desirable,nonegotiate Channel: yes Broadcast suppression: percentage(0-100) Flowcontrol: rx-(off,on,desired),tx-(none) Fast Start: yes QoS scheduling: rx-(not configurable on per port basis),tx-(4q2t) CoS rewrite: yes ToS rewrite: yes UDLD: yes Inline power: no SPAN: source/destination PortSecure: yes Dot1x: yes Dot1x: yes This is an example of output from the show interfaces gigabitethernet1/0/4 description command when the interface has been described as Connects to Marketing by using the description interface configuration command. Switch# show interfaces gigabitethernet1/0/4 description Interface Status Protocol Description Gi1/0/4 up down Connects to Marketing2-251 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces This is an example of output from the show interfaces etherchannel command when port channels are configured on the switch: Switch# show interfaces etherchannel ---- Port-channel1: Age of the Port-channel = 03d:20h:17m:29s Logical slot/port = 10/1 Number of ports = 0 GC = 0x00000000 HotStandBy port = null Port state = Port-channel Ag-Not-Inuse Port-channel2: Age of the Port-channel = 03d:20h:17m:29s Logical slot/port = 10/2 Number of ports = 0 GC = 0x00000000 HotStandBy port = null Port state = Port-channel Ag-Not-Inuse Port-channel3: Age of the Port-channel = 03d:20h:17m:29s Logical slot/port = 10/3 Number of ports = 0 GC = 0x00000000 HotStandBy port = null Port state = Port-channel Ag-Not-Inuse This is an example of output from the show interfaces gigabitethernet1/0/6 pruning command when pruning is enabled in the VTP domain: Switch# show interfaces gigibitethernet1/0/6 pruning Port Vlans pruned for lack of request by neighbor Gi1/0/6 3,4 Port Vlans traffic requested of neighbor Gi1/0/6 1-3 This is an example of output from the show interfaces stats command for a specified interface. Switch# show interfaces vlan 1 stats Switching path Pkts In Chars In Pkts Out Chars Out Processor 1165354 136205310 570800 91731594 Route cache 0 0 0 0 Total 1165354 136205310 570800 91731594 This is an example of partial output from the show interfaces status command. It displays the status of all interfaces. Switch# show interfaces status Port Name Status Vlan Duplex Speed Type Fa1/0/1 notconnect 1 auto auto 10/100BaseTX Fa1/0/2 notconnect 1 auto auto 10/100BaseTX Fa1/0/3 notconnect 1 auto auto 10/100BaseTX Fa1/0/4 Test notconnect 1 auto auto 10/100BaseTX Fa1/0/5 notconnect 1 auto auto 10/100BaseTX

This is an example of output from the show interfaces status err-disabled command. It displays the status of interfaces in the error-disabled state. Switch# show interfaces status err-disabled Port Name Status Reason Gi2/0/26 err-disabled gbic-invalid2-252 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces This is an example of output from the show interfaces switchport command for a single interface. Table 2-18 describes the fields in the display. Note Private VLANs are not supported in this release, so those fields are not applicable. Switch# show interfaces gigabitethernet1/0/3 switchport Name: Gi1/0/3 Switchport: Enabled Administrative Mode: static access Operational Mode: down Administrative Trunking Encapsulation: negotiate Negotiation of Trunking: Off Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Voice VLAN: none Administrative private-vlan host-association: none Administrative private-vlan mapping: none Administrative private-vlan trunk native VLAN: none Administrative private-vlan trunk encapsulation: dot1 Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: none Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001 Capture Mode Disabled Capture VLANs Allowed: ALL Protected: false Unknown unicast blocked: disabled Unknown multicast blocked: disabled Appliance trust: none Table 2-18 show interfaces switchport Field Descriptions Field Description Name Displays the port name. Switchport Displays the administrative and operational status of the port. In this display, the port is in switchport mode. Administrative Mode Operational Mode Displays the administrative and operational modes. Administrative Trunking Encapsulation Operational Trunking Encapsulation Negotiation of Trunking Displays the administrative and operational encapsulation method and whether trunking negotiation is enabled. Access Mode VLAN Displays the VLAN ID to which the port is configured. Trunking Native Mode VLAN Trunking VLANs Enabled Trunking VLANs Active Lists the VLAN ID of the trunk that is in native mode. Lists the allowed VLANs on the trunk. Lists the active VLANs on the trunk. Pruning VLANs Enabled Lists the VLANs that are pruning-eligible. Protected Displays whether or not protected port is enabled (True) or disabled (False) on the interface.2-253 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces This is an example of output from the show interfaces interface trunk command. It displays trunking information for the interface. Switch# show interfaces fastethernet1/0/17 trunk Port Mode Encapsulation Status Native vlan Fa1/0/17 desirable n-isl trunking 1 Port Vlans allowed on trunk Fa1/0/17 1-4094 Port Vlans allowed and active in management domain Fa1/0/17 1-4,20,34-36,38-55,57-58,66-67,100,139,200-201,1000 Port Vlans in spanning tree forwarding state and not pruned Fa1/0/17 1-4,20,34-36,38-55,57-58,66-67,100,139,200-201,1000 e Related Commands Unknown unicast blocked Unknown multicast blocked Displays whether or not unknown multicast and unknown unicast traffic is blocked on the interface. Voice VLAN Displays the VLAN ID on which voice VLAN is enabled. Appliance trust Displays the CoS setting of the data packets of the IP phone. Table 2-18 show interfaces switchport Field Descriptions (continued) Field Description Command Description switchport access Configures a port as a static-access or dynamic-access port. switchport block Blocks unknown unicast or multicast traffic on an interface. switchport mode Configures the VLAN membership mode of a port. switchport protected Isolates unicast, multicast, and broadcast traffic at Layer 2 from other protected ports on the same switch. switchport trunk pruning Configures the VLAN pruning-eligible list for ports in trunking mode.2-254 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces counters show interfaces counters Use the show interfaces counters privileged EXEC command to display various counters for the switch or for a specific interface. show interfaces [interface-id | vlan vlan-id] counters [broadcast | errors | module switch- number | multicast | trunk | unicast] [ | {begin | exclude | include} expression] Syntax Descriptions Command Modes Privileged EXEC Command History Usage Guidelines If you do not enter any keywords, all counters for all interfaces are included. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface-id (Optional) ID of the physical interface, including type, stack member, module, and port number. vlan vlan-id (Optional) VLAN number of the management VLAN. The range is 1 to 4094. broadcast (Optional) Display discarded broadcast traffic. errors (Optional) Display error counters. module switch- number (Optional) Display counters for the specified stack member. The range is from 1 to 9, depending upon the switch numbers in the stack. Note In this command, the module keyword refers to the stack member number (1–9). In other commands that contain an interface ID, the module number is always zero. multicast (Optional) Display discarded multicast traffic. trunk (Optional) Display trunk counters. unicast (Optional) Display discarded unicast traffic. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-255 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces counters Examples This is an example of partial output from the show interfaces counters command. It displays all counters for the switch. Switch# show interfaces counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Fa6/0/1 0 0 0 0 Fa6/0/2 0 0 0 0 Fa6/0/3 0 0 0 0 Fa6/0/4 0 0 0 0 Fa6/0/5 0 0 0 0

Fa6/0/24 0 0 0 0 Gi6/0/1 0 0 0 0 Gi6/0/2 0 0 0 0 Fa8/0/1 0 0 0 0 Fa8/0/2 0 0 0 0

This is an example of partial output from the show interfaces counters broadcast command. It displays dropped broadcast traffic for all interfaces. Switch# show interfaces counters broadcast Port BcastSuppDiscards Fa1/0/1 0 Fa1/0/2 0 Fa1/0/3 0 Fa1/0/4 0 Fa1/0/5 0 Fa1/0/6 0

This is an example of partial output from the show interfaces counters module command for stack member 2. It displays all counters for the specified switch in the stack. Switch# show interfaces counters module 2 Sauron#show interface counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Fa2/0/1 520 2 0 0 Fa2/0/2 520 2 0 0 Fa2/0/3 520 2 0 0 Fa2/0/4 520 2 0 0 Fa2/0/5 520 2 0 0 Fa2/0/6 520 2 0 0 Fa2/0/7 520 2 0 0 Fa2/0/8 520 2 0 0

2-256 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show interfaces counters This is an example of output from the show interfaces counters trunk command. It displays trunk counters for all interfaces. Switch# show interfaces counters trunk Port TrunkFramesTx TrunkFramesRx WrongEncap Fa1/0/1 0 0 0 Fa1/0/2 0 0 0 Fa1/0/3 80678 4155 0 Fa1/0/4 82320 126 0 Fa1/0/5 0 0 0

Related Commands Command Description show interfaces Displays additional interface characteristics. show storm-control Displays storm-control settings for an interface or all interfaces. storm-control Sets storm-control broadcast, multicast, and unicast suppression levels for an interface.2-257 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp profile show ip igmp profile Use the show ip igmp profile privileged EXEC command to view all configured Internet Group Management Protocol (IGMP) profiles or a specified IGMP profile. show ip igmp profile [profile number] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples These are examples of output from the show ip igmp profile privileged EXEC command, with and without specifying a profile number. If no profile number is entered, the display includes all profiles configured on the switch. Switch# show ip igmp profile 40 IGMP Profile 40 permit range 233.1.1.1 233.255.255.255 Switch# show ip igmp profile IGMP Profile 3 range 230.9.9.0 230.9.9.0 IGMP Profile 4 permit range 229.9.9.0 229.255.255.255 Related Commands profile number (Optional) The IGMP profile number to be displayed. The range is 1 to 4294967295. If no profile number is entered, all IGMP profiles are displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description ip igmp profile Configures the specified IGMP profile number.2-258 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp snooping show ip igmp snooping Use the show ip igmp snooping privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping configuration of the switch or the VLAN. show ip igmp snooping [mrouter] [multicast] [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use this command to display snooping configuration for the switch or for a specific VLAN. Although visible in the output display, output lines related to topology change notification (TCN), source-only learning, and report suppression are not supported. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show ip igmp snooping vlan 1 command. It shows snooping characteristics for a specific VLAN. Switch# show ip igmp snooping vlan 1 ---------- IGMP snooping is globally enabled IGMP snooping TCN solicit query is globally disabled IGMP snooping global TCN flood query count is 2 IGMP snooping is enabled on this Vlan IGMP snooping immediate-leave is disabled on this Vlan IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan IGMP snooping source only learning age timer is 10 IGMP snooping is running in IGMP_ONLY mode on this Vlan IGMP snooping report suppression is enabled on this Vlan Note TCN, source-only learning, and report suppression are not supported, and information displayed about these features is not valid. mrouter (Optional) See the show ip igmp snooping mrouter command. multicast (Optional) See the show ip igmp snooping multicast command. vlan vlan-id (Optional) Specify a VLAN; the range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-259 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp snooping This is an example of output from the show ip igmp snooping command. It displays snooping characteristics for all VLANs on the switch. Switch# show ip igmp snooping vlan 1 ---------- IGMP snooping is globally enabled IGMP snooping TCN solicit query is globally disabled IGMP snooping global TCN flood query count is 2 IGMP snooping is enabled on this Vlan IGMP snooping immediate-leave is disabled on this Vlan IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan IGMP snooping source only learning age timer is 10 IGMP snooping is running in IGMP_ONLY mode on this Vlan IGMP snooping report suppression is enabled on this Vlan vlan 2 ---------- IGMP snooping is globally enabled IGMP snooping TCN solicit query is globally disabled IGMP snooping global TCN flood query count is 2 IGMP snooping is enabled on this Vlan IGMP snooping immediate-leave is disabled on this Vlan IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan IGMP snooping source only learning age timer is 10 IGMP snooping is running in IGMP_ONLY mode on this Vlan IGMP snooping report suppression is enabled on this Vlan

Related Commands Command Description ip igmp snooping Enables and configures IGMP snooping on the switch or on a VLAN. show ip igmp snooping mrouter Displays IGMP snooping multicast router ports for the switch or for the specified multicast VLAN show ip igmp snooping multicast Displays IGMP snooping multicast information for the switch or for the specified parameter.2-260 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp snooping mrouter show ip igmp snooping mrouter Use the show ip igmp snooping mrouter privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping dynamically learned and manually configured multicast router ports for the switch or for the specified multicast VLAN. show ip igmp snooping mrouter [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use this command to display multicast router ports on the switch or for a specific VLAN. When multicast VLAN registration (MVR) is enabled, the show ip igmp snooping mrouter command displays MVR multicast router information and IGMP snooping information. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show ip igmp snooping mrouter command. It shows how to display multicast router ports on the switch. Switch# show ip igmp snooping mrouter Vlan ports ---- ----- 1 Gi2/0/1(dynamic) Related Commands vlan vlan-id (Optional) Specify a VLAN; the range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12/1(11)AX This command was first introduced. Command Description ip igmp snooping Enables and configures IGMP snooping on the switch or on a VLAN. show ip igmp snooping Displays the IGMP snooping configuration of the switch or the VLAN show ip igmp snooping multicast Displays IGMP snooping multicast information for the switch or for the specified parameter.2-261 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp snooping multicast show ip igmp snooping multicast Use the show ip igmp snooping multicast privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping multicast table for the switch or multicast information for the selected parameter. Use with the vlan keyword to display the multicast table for a specified multicast VLAN or information about the selected parameter for the VLAN. show ip igmp snooping multicast [vlan vlan-id] [count | dynamic [count | group ip_address] | group ip_address | user [count | group ip_address]] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Use this command to display multicast information and the multicast table for specified parameters. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show ip igmp snooping multicast command without any keywords. It displays the multicast table for the switch. Switch# show ip igmp snooping multicast Vlan Group Address Type Ports ---- ------------- ---- ----- 1 224.1.2.30 IGMP Fa3/0/31, Fa4/0/1 1 224.1.2.1 IGMP Fa3/0/31, Fa4/0/1 1 224.4.4.4 USER Fa1/0/4, Fa4/0/1 vlan vlan-id (Optional) Specify a VLAN; the range is 1 to 4094. count (Optional) Display the total number of entries for the specified command options instead of the actual entries. dynamic (Optional) Display entries learned through IGMP snooping. group ip_address (Optional) Display characteristics of the multicast group with the specified group IP address. user (Optional) Display only the user-configured multicast entries. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-262 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show ip igmp snooping multicast This is an example of output from the show ip igmp snooping multicast count command. It displays the total number of multicast groups on the switch. Switch# show ip igmp snooping multicast count Total number of multicast groups: 3 This is an example of output from the show ip igmp snooping multicast dynamic command. It shows only the entries learned through IGMP snooping. Switch# show ip igmp snooping multicast dynamic Vlan Group Address Type Ports ---- ------------- ---- ----- 1 224.1.2.30 IGMP Fa4/0/1, Fa4/0/37 1 224.1.2.1 IGMP Fa4/0/1, Fa4/0/37 This is an example of output from the show ip igmp snooping multicast group command. It shows the entries for the group with the specified IP address. Switch# show ip igmp snooping multicast group 224.1.2.30 Vlan Group Address Type Ports ---- ------------- ---- ----- 1 224.1.2.30 IGMP Fa4/0/1, Fa4/0/37 This is an example of output from the show ip igmp snooping multicast vlan command. It displays all entries belonging to the specified VLAN. Switch# show ip igmp snooping multicast vlan 1 Vlan Group Address Type Ports ---- ------------- ---- ----- 1 224.1.2.30 IGMP Fa4/0/1, Fa4/0/37 1 224.1.2.1 IGMP Fa4/0/1, Fa4/0/37 Related Commands Command Description ip igmp snooping Enables and configures IGMP snooping on the switch or on a VLAN. show ip igmp snooping Displays the IGMP snooping configuration of the switch or the VLAN show ip igmp snooping mrouter Displays IGMP snooping multicast router ports for the switch or for the specified multicast VLAN.2-263 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show lacp show lacp Use the show lacp user EXEC command to display Link Aggregation Control Protocol (LACP) channel-group information. show lacp [channel-group-number] {counters | internal | neighbor | sys-id} [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines You can enter any show lacp command to display the active channel-group information. To display specific channel information, enter the show lacp command with a channel-group number. If you do not specify a channel group, information for all channel groups appears. You can enter the channel-group-number option to specify a channel group for all keywords except sys-id. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear. channel-group-number (Optional) Number of the channel group. The range is 1 to 12. counters Display traffic information. internal Display internal information. neighbor Display neighbor information. sys-id Display the system identifier that is being used by LACP. The system identifier is made up of the LACP system priority and the switch MAC address. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced.2-264 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show lacp Examples This is an example of output from the show lacp counters command user EXEC command. Table 2-19 describes the fields in the display. Switch> show lacp counters LACPDUs Marker Marker Response LACPDUs Port Sent Recv Sent Recv Sent Recv Pkts Err --------------------------------------------------------------------- Channel group:1 Gi2/0/5 19 10 0 0 0 0 0 Gi2/0/6 14 6 0 0 0 0 0 Gi2/0/7 8 7 0 0 0 0 0 This is an example of output from the show lacp internal command: Switch> show lacp 1 internal Flags: S - Device is requesting Slow LACPDUs F - Device is requesting Fast LACPDUs A - Device is in Active mode P - Device is in Passive mode Channel group 1 LACP port Admin Oper Port Port Port Flags State Priority Key Key Number State Gi2/0/5 SA bndl 32768 0x3 0x3 0x4 0x3D Gi2/0/6 SA bndl 32768 0x3 0x3 0x5 0x3D Gi2/0/7 SA bndl 32768 0x3 0x3 0x6 0x3D Table 2-19 show lacp counters Field Descriptions Field Description LACPDUs Sent and Recv The number of LACP packets sent and received by an interface. Marker Sent and Recv The number of LACP marker packets sent and received by an interface. Marker Response Sent and Recv The number of LACP marker response packets sent and received by an interface. LACPDUs Pkts and Err The number of unknown and illegal packets received by LACP for an interface.2-265 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show lacp Table 2-20 describes the fields in the display: Table 2-20 show lacp internal Field Descriptions Field Description State State of the specific port. These are the allowed values: • – —Port is in an unknown state. • bndl—Port is attached to an aggregator and bundled with other ports. • susp—Port is in a suspended state; it is not attached to any aggregator. • hot-sby—Port is in a hot-standby state. • indiv—Port is incapable of bundling with any other port. • indep—Port is in an independent state (not bundled but able to switch data traffic. In this case, LACP is not running on the partner port). • down—Port is down. LACP Port Priority Port priority setting. LACP uses the port priority to put ports s in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. Admin Key Administrative key assigned to this port. LACP automatically generates an administrative key value as a hexadecimal number. The administrative key defines the ability of a port to aggregate with other ports. A port’s ability to aggregate with other ports is determined by the port physical characteristics (for example, data rate and duplex capability) and configuration restrictions that you establish. Oper Key Runtime operational key that is being used by this port. LACP automatically generates this value as a hexadecimal number. Port Number Port number. Port State State variables for the port, encoded as individual bits within a single octet with these meanings: • bit0: LACP_Activity • bit1: LACP_Timeout • bit2: Aggregation • bit3: Synchronization • bit4: Collecting • bit5: Distributing • bit6: Defaulted • bit7: Expired2-266 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show lacp This is an example of output from the show lacp neighbor command: Switch> show lacp neighbor Flags: S - Device is sending Slow LACPDUs F - Device is sending Fast LACPDUs A - Device is in Active mode P - Device is in Passive mode Channel group 3 neighbors Partner’s information: Partner Partner Partner Port System ID Port Number Age Flags Gi2/0/3 32768,0007.eb49.5e80 0xC 19s SP LACP Partner Partner Partner Port Priority Oper Key Port State 32768 0x3 0x3C Partner’s information: Partner Partner Partner Port System ID Port Number Age Flags Gi2/0/4 32768,0007.eb49.5e80 0xD 15s SP LACP Partner Partner Partner Port Priority Oper Key Port State 32768 0x3 0x3C This is an example of output from the show lacp sys-id command: Switch> show lacp sys-id 32765,0002.4b29.3a00 The system identification is made up of the system priority and the system MAC address. The first two bytes are the system priority, and the last six bytes are the globally administered individual MAC address associated to the system. Related Commands Command Description clear lacp Clears LACP channel-group information. lacp port-priority Configures the LACP port priority. lacp system-priority Configures the LACP system priority.2-267 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac access-group show mac access-group Use the show mac access-group user EXEC command to display the MAC access control lists (ACLs) configured for an interface or a switch. show mac access-group [interface interface-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC; the interface keyword is available only in privileged EXEC mode. Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-access group user EXEC command. In this display, Gigabit Ethernet interface 1/0/12 has the MAC access list macl_e1 applied; no MAC ACLs are applied to other interfaces. Switch> show mac access-group Interface GigabitEthernet1/0/1: Inbound access-list is not set Interface GigabitEthernet1/0/2: Inbound access-list is macl_e1 Interface GigabitEthernet1/0/3: Inbound access-list is not set Interface GigabitEthernet1/0/4: Inbound access-list is not set

Interface GigabitEthernet1/0/10: Inbound access-list is not set Interface GigabitEthernet1/0/11: Inbound access-list is not set Interface GigabitEthernet1/0/12: Inbound access-list is macl_e1

interface interface-id (Optional) Display the MAC ACLs configured on a specific interface. Valid interfaces are physical ports and port channels; the port channel range is 1 to 64. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced.2-268 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac access-group This is an example of output from the show mac access-group interface gigabitethernet1/ 0/12 command: Switch# show mac access-group interface gigabitethernet1/0/12 Interface GigabitEthernet1/0/12: Inbound access-list is macl_e1 Related Commands Command Description mac access-group Applies a MAC access group to an interface.2-269 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table show mac-address-table Use the show mac-address-table user EXEC command to display a specific MAC address table static and dynamic entry or the MAC address table static and dynamic entries on a specific interface or VLAN. show mac-address-table [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table command: Switch> show mac-address-table Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- All 0000.0000.0001 STATIC CPU All 0000.0000.0002 STATIC CPU All 0000.0000.0003 STATIC CPU All 0000.0000.0009 STATIC CPU All 0000.0000.0012 STATIC CPU All 0180.c200.000b STATIC CPU All 0180.c200.000c STATIC CPU All 0180.c200.000d STATIC CPU All 0180.c200.000e STATIC CPU All 0180.c200.000f STATIC CPU All 0180.c200.0010 STATIC CPU 1 0030.9441.6327 DYNAMIC Gi6/0/23 Total Mac Addresses for this criterion: 12 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-270 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table Related Commands Command Description clear mac-address-table dynamic Deletes from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-271 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table address show mac-address-table address Use the show mac-address-table address user EXEC command to display MAC address table information for the specified MAC address. show mac-address-table address mac-address [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table address command: Switch# show mac-address-table address 0002.4b28.c482 Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- All 0002.4b28.c482 STATIC CPU Total Mac Addresses for this criterion: 1 mac-address Specify the 48-bit MAC address; the valid format is H.H.H. interface interface-id (Optional) Display information for a specific interface. Valid interfaces include physical ports and port channels. vlan vlan-id (Optional) Display entries for the specific VLAN only. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-272 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table address Related Commands Command Description show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-273 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table aging-time show mac-address-table aging-time Use the show mac-address-table aging-time user EXEC command to display the aging time of a specific address table instance, all address table instances on a specified VLAN or, if a specific VLAN is not specified, on all VLANs. show mac-address-table aging-time [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines If no VLAN number is specified, then the aging time for all VLANs is displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table aging-time command: Switch> show mac-address-table aging-time Vlan Aging Time ---- ---------- 1 300 This is an example of output from the show mac-address-table aging-time vlan 10 command: Switch> show mac-address-table aging-time vlan 10 Vlan Aging Time ---- ---------- 10 300 vlan vlan-id (Optional) Display aging time information for a specific VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-274 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table aging-time Related Commands Command Description mac-address-table aging-time Sets the length of time that a dynamic entry remains in the MAC address table after the entry is used or updated. show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-275 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table count show mac-address-table count Use the show mac-address-table count user EXEC command to display the number of addresses present in all VLANs or the specified VLAN. show mac-address-table count [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines If no VLAN number is specified, the address count for all VLANs is displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table count command: Switch# show mac-address-table count Mac Entries for Vlan : 1 --------------------------- Dynamic Address Count : 2 Static Address Count : 0 Total Mac Addresses : 2 vlan vlan-id (Optional) Display the number of addresses for a specific VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-276 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table count Related Commands Command Description show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-277 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table dynamic show mac-address-table dynamic Use the show mac-address-table dynamic user EXEC command to display only dynamic MAC address table entries. show mac-address-table dynamic [address mac-address] [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC; address keyword available only in privileged EXEC mode. Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table dynamic command: Switch> show mac-address-table dynamic Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- 1 0030.b635.7862 DYNAMIC Gi6/0/2 1 00b0.6496.2741 DYNAMIC Gi6/0/2 Total Mac Addresses for this criterion: 2 address mac-address (Optional) Specify a 48-bit MAC address; the valid format is H.H.H (available in privileged EXEC mode only). interface interface-id (Optional) Specify an interface to match; valid interfaces include physical ports and port channels. vlan vlan-id (Optional) Display entries for a specific VLAN; the range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-278 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table dynamic Related Commands Command Description clear mac-address-table dynamic Deletes from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN. show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-279 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table interface show mac-address-table interface Use the show mac-address-table interface user command to display the MAC address table information for the specified interface in the specified VLAN. show mac-address-table interface interface-id [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table interface command: Switch> show mac-address-table interface gigabitethernet6/0/2 Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- 1 0030.b635.7862 DYNAMIC Gi6/0/2 1 00b0.6496.2741 DYNAMIC Gi6/0/2 Total Mac Addresses for this criterion: 2 interface-id Specify an interface type; valid interfaces include physical ports and port channels. vlan vlan-id (Optional) Display entries for a specific VLAN; the range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-280 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table interface Related Commands Command Description show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-281 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table multicast show mac-address-table multicast Use the show mac-address-table multicast user EXEC command to display the Layer 2 multicast entries for all VLANs. Use the command in privileged EXEC mode to display specific multicast entries. show mac-address-table multicast [vlan-id] [count | user [count]] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help string, the igmp-snooping keyword is not supported. Use the show ip igmp snooping multicast privileged EXEC command to display the Internet Group Management Protocol (IGMP) snooping multicast table. Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table multicast command. It shows how to display all multicast entries for the switch. Switch> show mac-address-table multicast Vlan Mac Address Type Ports ---- ----------- ---- ----- 1 0100.5e00.0128 IGMP Gi1/0/1 This is an example of output from the show mac-address-table multicast count command. It shows how to display a total count of MAC address entries for the switch. Switch> show mac-address-table multicast count Multicast MAC Entries for all vlans: 10 vlan vlan-id (Optional) Display addresses for a specific VLAN. The range is 1 to 4094. count (Optional) Display the total number of entries for the specified command options instead of the actual entries. user (Optional) Display only the user-configured multicast entries. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-282 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table multicast This is an example of output from the show mac-address-table multicast vlan 1 count command. It shows how to display a total count of MAC address entries for a VLAN. Switch> show mac-address-table multicast vlan 1 count Multicast MAC Entries for vlan 1: 4 Related Commands Command Description show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-283 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table notification show mac-address-table notification Use the show mac-address-table notification user EXEC command to display the MAC address notification settings for all interfaces or the specified interface. show mac-address-table notification [interface [interface-id]] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Use the show mac-address-table notification command without any keywords to display whether the feature is enabled or disabled, the MAC notification interval, the maximum number of entries allowed in the history table, and the history table contents. Use the interface keyword to display the flags for all interfaces. If the interface-id is included, only the flags for that interface are displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface (Optional) Display information for all interfaces. Valid interfaces include physical ports and port channels. interface-id (Optional) Display information for the specified interface. Valid interfaces include physical ports and port channels. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(8)AX This command was first introduced.2-284 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table notification Examples This is an example of output from the show mac-address-table notification command: Switch> show mac-address-table notification MAC Notification Feature is Enabled on the switch Interval between Notification Traps : 60 secs Number of MAC Addresses Added : 4 Number of MAC Addresses Removed : 4 Number of Notifications sent to NMS : 3 Maximum Number of entries configured in History Table : 100 Current History Table Length : 3 MAC Notification Traps are Enabled History Table contents ---------------------- History Index 0, Entry Timestamp 1032254, Despatch Timestamp 1032254 MAC Changed Message : Operation: Added Vlan: 2 MAC Addr: 0000.0000.0001 Module: 0 Port: 1 History Index 1, Entry Timestamp 1038254, Despatch Timestamp 1038254 MAC Changed Message : Operation: Added Vlan: 2 MAC Addr: 0000.0000.0000 Module: 0 Port: 1 Operation: Added Vlan: 2 MAC Addr: 0000.0000.0002 Module: 0 Port: 1 Operation: Added Vlan: 2 MAC Addr: 0000.0000.0003 Module: 0 Port: 1 History Index 2, Entry Timestamp 1074254, Despatch Timestamp 1074254 MAC Changed Message : Operation: Deleted Vlan: 2 MAC Addr: 0000.0000.0000 Module: 0 Port: 1 Operation: Deleted Vlan: 2 MAC Addr: 0000.0000.0001 Module: 0 Port: 1 Operation: Deleted Vlan: 2 MAC Addr: 0000.0000.0002 Module: 0 Port: 1 Operation: Deleted Vlan: 2 MAC Addr: 0000.0000.0003 Module: 0 Port: 1 Related Commands Command Description clear mac-address-table notification Clears the MAC address notification global counters. show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table static Displays static MAC address table entries only. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-285 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table static show mac-address-table static Use the show mac-address-table static user EXEC command to display static MAC address table entries only. show mac-address-table static [address mac-address] [interface interface-id] [vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC; address keyword available only in privileged EXEC mode. Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table static command: Switch> show mac-address-table static Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- All 0100.0ccc.cccc STATIC CPU All 0180.c200.0000 STATIC CPU All 0100.0ccc.cccd STATIC CPU All 0180.c200.0001 STATIC CPU All 0180.c200.0002 STATIC CPU All 0180.c200.0003 STATIC CPU All 0180.c200.0004 STATIC CPU All 0180.c200.0005 STATIC CPU All 0180.c200.0006 STATIC CPU All 0180.c200.0007 STATIC CPU Total Mac Addresses for this criterion: 10 address mac-address (Optional) Specify a 48-bit MAC address; the valid format is H.H.H (available in privileged EXEC mode only). interface interface-id (Optional) Specify an interface to match; valid interfaces include physical ports and port channels. vlan vlan-id (Optional) Display addresses for a specific VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-286 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table static Related Commands Command Description mac-address-table static Adds static addresses to the MAC address table. show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.2-287 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table vlan show mac-address-table vlan Use the show mac-address-table vlan user EXEC command to display the MAC address table information for the specified VLAN. show mac-address-table vlan vlan-id [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mac-address-table vlan 1 command: Switch> show mac-address-table vlan 1 Mac Address Table ------------------------------------------ Vlan Mac Address Type Ports ---- ----------- ---- ----- 1 0100.0ccc.cccc STATIC CPU 1 0180.c200.0000 STATIC CPU 1 0100.0ccc.cccd STATIC CPU 1 0180.c200.0001 STATIC CPU 1 0180.c200.0002 STATIC CPU 1 0180.c200.0003 STATIC CPU 1 0180.c200.0004 STATIC CPU 1 0180.c200.0005 STATIC CPU 1 0180.c200.0006 STATIC CPU 1 0180.c200.0007 STATIC CPU Total Mac Addresses for this criterion: 10 vlan-id (Optional) Display addresses for a specific VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-288 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mac-address-table vlan Related Commands Command Description show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays dynamic MAC address table entries only. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC address notification settings for all interfaces or the specified interface. show mac-address-table static Displays static MAC address table entries only.2-289 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos show mls qos Use the show mls qos user EXEC command to display global quality of service (QoS) configuration information. show mls qos [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mls qos command: Switch> show mls qos Qos is enabled Related Commands | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description mls qos Enables quality of service (QoS) for the entire switch.2-290 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos aggregate-policer show mls qos aggregate-policer Use the show mls qos aggregate-policer user EXEC command to display the quality of service (QoS) aggregate policer configuration. A policer defines a maximum permissible rate of transmission, a maximum burst size for transmissions, and an action to take if either maximum is exceeded. show mls qos aggregate-policer [aggregate-policer-name] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mls qos aggregate-policer command: Switch> show mls qos aggregate-policer policer1 aggregate-policer policer1 88000 2000000 exceed-action drop Not used by any policy map Related Commands aggregate-policer-name (Optional) Display the policer configuration for the specified name. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description mls qos aggregate-policer Defines policer parameters that can be shared by multiple classes within a policy map.2-291 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos input-queue show mls qos input-queue Use the show mls qos input-queue user EXEC command to display quality of service (QoS) settings for the ingress queues. show mls qos input-queue [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mls qos input-queue command: Switch> show mls qos input-queue Queue : 1 2 ---------------------------------------------- buffers : 90 10 bandwidth : 4 4 priority : 0 10 threshold1: 100 100 threshold2: 100 100 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-292 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos input-queue Related Commands Command Description mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps assigned class of service (CoS) values to an ingress queue and assigns CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps assigned Differentiated Services Code Point (DSCP) values to an ingress queue and assigns DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns weighted tail-drop (WTD) threshold percentages to an ingress queue.2-293 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos interface show mls qos interface Use the show mls qos interface user EXEC command to display quality of service (QoS) information at the interface level. show mls qos interface [interface-id] [buffers | queueing | statistics] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help string, the policers keyword is not supported. Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mls qos interface command: Switch# show mls qos interface fastethernet1/0/7 FastEthernet1/0/7 Attached policy-map for Ingress: videowizard_policy trust state: not trusted COS override: dis default COS: 0 DSCP Mutation Map: Default DSCP Mutation Map interface-id (Optional) Display QoS information for the specified interface. Valid interfaces include physical ports. buffers (Optional) Display the buffer allocation among the queues. queueing (Optional) Display the queueing strategy (shared or shaped) and the weights corresponding to the queues. statistics (Optional) Display statistics for sent and received Differentiated Services Code Points (DSCPs) and class of service (CoS) values, the number of packets enqueued or dropped per egress queue, and the number of in-profile and out-of-profile packets for each policer. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-294 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos interface This is an example of output from the show mls qos interface fastethernet1/0/7 buffers command: Switch> show mls qos interface fastethernet1/0/7 buffers FastEthernet1/0/7 The port is mapped to qset : 1 The allocations between the queues are : 25 25 25 25 This is an example of output from the show mls qos interface fastethernet1/0/7 queueing command: Switch> show mls qos interface fastethernet1/0/7 queueing FastEthernet1/0/7 Shaped queue weights (absolute) : 25 0 0 0 Shared queue weights : 25 25 25 25 The port bandwidth is limited to: 100% The port is mapped to qset : 1 This is an example of output from the show mls qos interface fastethernet1/0/7 statistics command. Table 2-21 describes the fields in this display. Switch> show mls qos interface fastethernet1/0/7 statistics FastEthernet1/0/7 dscp: incoming ------------------------------- 0 - 4 : 4213 0 0 0 0 5 - 9 : 0 0 0 0 0 10 - 14 : 0 0 0 0 0 15 - 19 : 0 0 0 0 0 20 - 24 : 0 0 0 0 0 25 - 29 : 0 0 0 0 0 30 - 34 : 0 0 0 0 0 35 - 39 : 0 0 0 0 0 40 - 44 : 0 0 0 0 0 45 - 49 : 0 0 0 6 0 50 - 54 : 0 0 0 0 0 55 - 59 : 0 0 0 0 0 60 - 64 : 0 0 0 0 dscp: outgoing ------------------------------- 0 - 4 : 363949 0 0 0 0 5 - 9 : 0 0 0 0 0 10 - 14 : 0 0 0 0 0 15 - 19 : 0 0 0 0 0 20 - 24 : 0 0 0 0 0 25 - 29 : 0 0 0 0 0 30 - 34 : 0 0 0 0 0 35 - 39 : 0 0 0 0 0 40 - 44 : 0 0 0 0 0 45 - 49 : 0 0 0 0 0 50 - 54 : 0 0 0 0 0 55 - 59 : 0 0 0 0 0 60 - 64 : 0 0 0 0 cos: incoming ------------------------------- 0 - 4 : 132067 0 0 0 0 5 - 9 : 0 0 0 cos: outgoing ------------------------------- 0 - 4 : 739155 0 0 0 0 5 - 9 : 90 0 0 Policer: Inprofile: 0 OutofProfile: 02-295 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos interface Related Commands Table 2-21 show mls qos interface statistics Field Descriptions Field Description DSCP incoming Number of received packets for each DSCP value. outgoing Number of sent packets for each DSCP value. CoS incoming Number of received packets for each CoS value. outgoing Number of sent packets for each CoS value. Policer Inprofile Number of in profile packets for each policer. Outofprofile Number of out of profile packets for each policer. Command Description mls qos queue-set output buffers Allocates buffers to a queue-set. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. mls qos srr-queue input bandwidth Assigns shaped round robin (SRR) weights to an ingress queue. mls qos srr-queue input buffers Allocates the buffers between the ingress queues. mls qos srr-queue input cos-map Maps CoS values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps DSCP values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue input priority-queue Configures the ingress priority queue and guarantees bandwidth. mls qos srr-queue input threshold Assigns WTD threshold percentages to an ingress queue. mls qos srr-queue output cos-map Maps CoS values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps DSCP values to an egress queue or maps DSCP values to a queue and to a threshold ID. policy-map Create or modifies a policy map. queue-set Maps a port to a queue-set. srr-queue bandwidth limit Limits the maximum output on a port. srr-queue bandwidth shape Assigns the shaped weights and enables bandwidth shaping on the four egress queues mapped to a port. srr-queue bandwidth share Assigns the shared weights and enables bandwidth sharing on the four egress queues mapped to a port.2-296 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos maps show mls qos maps Use the show mls qos maps user EXEC command to display quality of service (QoS) mapping information. During classification, QoS uses the mapping tables to represent the priority of the traffic and to derive a corresponding class of service (CoS) or Differentiated Services Code Point (DSCP) value from the received CoS, DSCP, or IP precedence value. show mls qos maps [cos-dscp | cos-input-q | cos-output-q | dscp-cos | dscp-input-q | dscp-mutation dscp-mutation-name | dscp-output-q | ip-prec-dscp | policed-dscp] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. The policed-DSCP, DSCP-to-CoS, and the DSCP-to-DSCP-mutation maps are displayed as a matrix. The d1 column specifies the most-significant digit in the DSCP. The d2 row specifies the least-significant digit in the DSCP. The intersection of the d1 and d2 values provides the policed-DSCP, the CoS, or the mutated-DSCP value. For example, in the DSCP-to-CoS map, a DSCP value of 43 corresponds to a CoS value of 5. cos-dscp (Optional) Display class of service (CoS)-to-DSCP map. cos-input-q (Optional) Display the CoS input queue threshold map. cos-output-q (Optional) Display the CoS output queue threshold map. dscp-cos (Optional) Display DSCP-to-CoS map. dscp-input-q (Optional) Display the DSCP input queue threshold map. dscp-mutation dscp-mutation-name (Optional) Display the specified DSCP-to-DSCP-mutation map. dscp-output-q (Optional) Display the DSCP output queue threshold map. ip-prec-dscp (Optional) Display the IP-precedence-to-DSCP map. policed-dscp (Optional) Display the policed-DSCP map. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-297 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos maps The DSCP input queue threshold and the DSCP output queue threshold maps are displayed as a matrix. The d1 column specifies the most-significant digit of the DSCP number. The d2 row specifies the least-significant digit in the DSCP number. The intersection of the d1 and the d2 values provides the queue ID and threshold ID. For example, in the DSCP input queue threshold map, a DSCP value of 43 corresponds to queue 2 and threshold 1 (02-01). The CoS input queue threshold and the CoS output queue threshold maps show the CoS value in the top row and the corresponding queue ID and threshold ID in the second row. For example, in the CoS input queue threshold map, a CoS value of 5 corresponds to queue 2 and threshold 1 (2-1). Examples This is an example of output from the show mls qos maps command: Switch> show mls qos maps Policed-dscp map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 01 02 03 04 05 06 07 08 09 1 : 10 11 12 13 14 15 16 17 18 19 2 : 20 21 22 23 24 25 26 27 28 29 3 : 30 31 32 33 34 35 36 37 38 39 4 : 40 41 42 43 44 45 46 47 48 49 5 : 50 51 52 53 54 55 56 57 58 59 6 : 60 61 62 63 Dscp-cos map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 00 00 00 00 00 00 00 01 01 1 : 01 01 01 01 01 01 02 02 02 02 2 : 02 02 02 02 03 03 03 03 03 03 3 : 03 03 04 04 04 04 04 04 04 04 4 : 05 05 05 05 05 05 05 05 06 06 5 : 06 06 06 06 06 06 07 07 07 07 6 : 07 07 07 07 Cos-dscp map: cos: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 0 8 16 24 32 40 48 56 IpPrecedence-dscp map: ipprec: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 0 8 16 24 32 40 48 56 Dscp-outputq-threshold map: d1 :d2 0 1 2 3 4 5 6 7 8 9 -------------------------------------------------------------------- 0 : 02-01 02-01 02-01 02-01 02-01 02-01 02-01 02-01 02-01 02-01 1 : 02-01 02-01 02-01 02-01 02-01 02-01 03-01 03-01 03-01 03-01 2 : 03-01 03-01 03-01 03-01 03-01 03-01 03-01 03-01 03-01 03-01 3 : 03-01 03-01 04-01 04-01 04-01 04-01 04-01 04-01 04-01 04-01 4 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 04-01 04-01 5 : 04-01 04-01 04-01 04-01 04-01 04-01 04-01 04-01 04-01 04-01 6 : 04-01 04-01 04-01 04-012-298 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos maps Dscp-inputq-threshold map: d1 :d2 0 1 2 3 4 5 6 7 8 9 -------------------------------------------------------------------- 0 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 1 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 2 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 3 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 4 : 02-01 02-01 02-01 02-01 02-01 02-01 02-01 02-01 01-01 01-01 5 : 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 01-01 6 : 01-01 01-01 01-01 01-01 Cos-outputq-threshold map: cos: 0 1 2 3 4 5 6 7 ------------------------------------ queue-threshold: 2-1 2-1 3-1 3-1 4-1 1-1 4-1 4-1 Cos-inputq-threshold map: cos: 0 1 2 3 4 5 6 7 ------------------------------------ queue-threshold: 1-1 1-1 1-1 1-1 1-1 2-1 1-1 1-1 Dscp-dscp mutation map: Default DSCP Mutation Map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 01 02 03 04 05 06 07 08 09 1 : 10 11 12 13 14 15 16 17 18 19 2 : 20 21 22 23 24 25 26 27 28 29 3 : 30 31 32 33 34 35 36 37 38 39 4 : 40 41 42 43 44 45 46 47 48 49 5 : 50 51 52 53 54 55 56 57 58 59 6 : 60 61 62 63 Related Commands Command Description mls qos map Defines the CoS-to-DSCP map, DSCP-to-CoS map, DSCP-to-DSCP-mutation map, IP-precedence-to-DSCP map, and the policed-DSCP map. mls qos srr-queue input cos-map Maps CoS values to an ingress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue input dscp-map Maps DSCP values to an ingress queue or maps DSCP values to a queue and to a threshold ID. mls qos srr-queue output cos-map Maps CoS values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps DSCP values to an egress queue or maps DSCP values to a queue and to a threshold ID.2-299 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos queue-set show mls qos queue-set Use the show mls qos queue-set user EXEC command to display quality of service (QoS) settings for the egress queues. show mls qos queue-set [qset-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mls qos queue-set command: Switch> show mls qos queue-set Queueset: 1 Queue : 1 2 3 4 ---------------------------------------------- buffers : 25 25 25 25 threshold1: 100 50 100 100 threshold2: 100 50 100 100 reserved : 50 100 50 50 maximum : 400 400 400 400 Queueset: 2 Queue : 1 2 3 4 ---------------------------------------------- buffers : 25 25 25 25 threshold1: 100 50 100 100 threshold2: 100 50 100 100 reserved : 50 100 50 50 maximum : 400 400 400 400 qset-id (Optional) ID of the queue-set. Each port belongs to a queue-set, which defines all the characteristics of the four egress queues per port. The range is 1 to 2. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-300 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mls qos queue-set Related Commands Command Description mls qos queue-set output buffers Allocates buffers to the queue-set. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation of the queue-set.2-301 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show monitor show monitor Use the show monitor user EXEC command to display information about all Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) sessions on the switch. Use the command with keywords to show a specific session, all sessions, all local sessions, or all remote sessions. show monitor [session {session_number | all | local | range list | remote} [detail]] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. The output is the same for the show monitor command and the show monitor session all command. session (Optional) Display information about specified SPAN sessions. session_number Specify the number of the SPAN or RSPAN session. The range is 1 to 66. all Display all SPAN sessions. local Display only local SPAN sessions. range list Display a range of SPAN sessions, where list is the range of valid sessions, either a single session or a range of sessions described by two numbers, the lower one first, separated by a hyphen. Do not enter any spaces between comma-separated parameters or in hyphen-specified ranges. Note This keyword is available only in privileged EXEC mode. remote Display only remote SPAN sessions. detail (Optional) Display detailed information about the specified sessions. | begin Display begins with the line that matches the expression. | exclude Display excludes lines that match the expression. | include Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The range list and detail keywords were added.2-302 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show monitor Examples This is an example of output for the show monitor user EXEC command: Switch# show monitor Session 1 --------- Type :Local Session Source Ports: RX Only: Fa4/0/24 TX Only: None Both: Fa2/0/1-2,Fa4/0/1-5 Source VLANs: RX Only: None TX Only: None Both: None Source RSPAN VLAN:None Destination Ports:Fa2/0/18 Encapsulation:Replicate Filter VLANs: None Dest RSPAN VLAN: None Session 2 --------- Type :Remote Source Session Source Ports: RX Only: None TX Only: None Both: None Source VLANs: RX Only: None TX Only: 10 Both: 1-9 Source RSPAN VLAN:None Destination Ports:None Filter VLANs: None Dest RSPAN VLAN: 105 This is an example of output for the show monitor user EXEC command for RSPAN source session 1: Switch# show monitor session 1 Session 1 --------- Type :Local Session Source Ports: RX Only: Fa4/0/24 TX Only: None Both: Fa2/0/1-2,Fa4/0/1-5 Source VLANs: RX Only: None TX Only: None Both: None Source RSPAN VLAN:None Destination Ports:Fa2/0/18 Encapsulation:Replicate Filter VLANs: None Dest RSPAN VLAN: None2-303 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show monitor This is an example of output for the show monitor session all user EXEC command when ingress traffic forwarding is enabled: Switch# show monitor session all Session 1 --------- Type :Local Session Source Ports : Both :Fa1/0/2 Destination Ports :Fa2/0/2 Encapsulation :Replicate Ingress:Enabled, default VLAN = 5 Ingress encapsulation:DOT1Q Session 2 --------- Type :Local Session Source Ports : Both :Fa3/0/2 Destination Ports :Fa3/0/4 Encapsulation :Replicate Ingress:Enabled Ingress encapsulation:ISL Related Commands Command Description monitor session Starts or modifies a SPAN or RSPAN session.2-304 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr show mvr Use the show mvr privileged EXEC command without keywords to display the current Multicast VLAN Registration (MVR) global parameter values, including whether or not MVR is enabled, the MVR multicast VLAN, the maximum query response time, the number of multicast groups, and the MVR mode (dynamic or compatible). show mvr [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mvr command: Switch# show mvr MVR Running: TRUE MVR multicast VLAN: 1 MVR Max Multicast Groups: 256 MVR Current multicast groups: 0 MVR Global query response time: 5 (tenths of sec) MVR Mode: compatible In the preceding display, the maximum number of multicast groups is fixed at 256. The MVR mode is either compatible (for inter-operability with Catalyst 2900 XL and Catalyst 3500 XL switches) or dynamic (where operation is consistent with IGMP snooping operation and dynamic MVR membership on source ports is supported). | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-305 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr Related Commands Command Description mvr (global configuration) Enables and configures multicast VLAN registration on the switch. mvr (interface configuration) Configures MVR ports. show mvr interface Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs when the interface and members keywords are appended to the command. show mvr members Displays all ports that are members of an MVR multicast group or, if there are no members, means the group is inactive.2-306 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr interface show mvr interface Use the show mvr interface privileged EXEC command without keywords to display the Multicast VLAN Registration (MVR) receiver and source ports. Use the command with keywords to display MVR parameters for a specific receiver port. show mvr interface [interface-id [members [vlan vlan-id]]] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If the entered port identification is a non-MVR port or a source port, the command returns an error message. For receiver ports, it displays the port type, per port status, and Immediate-Leave setting. If you enter the members keyword, all MVR group members on the interface are displayed. If you enter a VLAN ID, all MVR group members in the VLAN are displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface-id (Optional) Display MVR type, status, and Immediate Leave setting for the interface. Valid interfaces include physical ports (including type, stack member, module, and port number. members (Optional) Display all MVR groups to which the specified interface belongs. vlan vlan-id (Optional) Display all MVR group members on this VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-307 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr interface Examples This is an example of output from the show mvr interface command: Switch# show mvr interface Port Type Status Immediate Leave ---- ---- ------- --------------- Gi1/0/1 SOURCE ACTIVE/UP DISABLED Gi1/0/2 RECEIVER ACTIVE/DOWN DISABLED Gi1/0/5 RECEIVER ACTIVE/UP ENABLED In the preceding display, Status is defined as follows: • Active means the port is part of a VLAN • Up/Down means that the port is forwarding/nonforwarding • Inactive means that the port is not yet part of any VLAN. This is an example of output from the show mvr interface gigabitethernet 1/0/2 command: Switch# show mvr interface gigabitethernet1/0/2 Type: RECEIVER Status: ACTIVE Immediate Leave: DISABLED This is an example of output from the show mvr interface gigabitethernet1/0/6 members command: Switch# show mvr interface gigabitethernet1/0/6 members 239.255.0.0 DYNAMIC ACTIVE 239.255.0.1 DYNAMIC ACTIVE 239.255.0.2 DYNAMIC ACTIVE 239.255.0.3 DYNAMIC ACTIVE 239.255.0.4 DYNAMIC ACTIVE 239.255.0.5 DYNAMIC ACTIVE 239.255.0.6 DYNAMIC ACTIVE 239.255.0.7 DYNAMIC ACTIVE 239.255.0.8 DYNAMIC ACTIVE 239.255.0.9 DYNAMIC ACTIVE Related Commands Command Description mvr (global configuration) Enables and configures multicast VLAN registration on the switch. mvr (interface configuration) Configures MVR ports. show mvr Displays the global MVR configuration on the switch. show mvr members Displays all receiver ports that are members of an MVR multicast group.2-308 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr members show mvr members Use the show mvr members privileged EXEC command to display all receiver and source ports that are currently members of an IP multicast group. show mvr members [ip-address] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines The show mvr members command applies to receiver and source ports. For MVR compatible mode, all source ports are members of all multicast groups. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show mvr members command: Switch# show mvr members MVR Group IP Status Members ------------ ------ ------- 239.255.0.1 ACTIVE Gi1/0/1(d), Gi1/0/5(s) 239.255.0.2 INACTIVE None 239.255.0.3 INACTIVE None 239.255.0.4 INACTIVE None 239.255.0.5 INACTIVE None 239.255.0.6 INACTIVE None 239.255.0.7 INACTIVE None 239.255.0.8 INACTIVE None 239.255.0.9 INACTIVE None 239.255.0.10 INACTIVE None

239.255.0.255 INACTIVE None 239.255.1.0 INACTIVE None ip-address (Optional) The IP multicast address. If the address is entered, all receiver and source ports that are members of the multicast group are displayed. If no address is entered, all members of all Multicast VLAN Registration (MVR) groups are listed. If a group has no members, the group is listed as Inactive. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-309 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show mvr members This is an example of output from the show mvr members 239.255.0.2 command. It shows how to view the members of the IP multicast group 239.255.0.2: Switch# show mvr members 239.255.0.2 239.255.003.--22 ACTIVE Gi1/0/1(d), Gi1/0/2(d), Gi1/0/3(d), Gi1/0/4(d), Gi1/0/5(s) Related Commands Command Description mvr (global configuration) Enables and configures multicast VLAN registration on the switch. mvr (interface configuration) Configures MVR ports. show mvr Displays the global MVR configuration on the switch. show mvr interface Displays the configured MVR interfaces, status of the specified interface, or all multicast groups to which the interface belongs when the members keyword is appended to the command.2-310 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show pagp show pagp Use the show pagp user EXEC command to display Port Aggregation Protocol (PAgP) channel-group information. show pagp [channel-group-number] {counters | internal | neighbor} [ | {begin | exclude | include} expression]] Syntax Description Command Modes User EXEC Command History Usage Guidelines You can enter any show pagp command to display the active channel-group information. To display the nonactive information, enter the show pagp command with a channel-group number. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show pagp 1 counters command: Switch> show pagp 1 counters Information Flush Port Sent Recv Sent Recv -------------------------------------- Channel group: 1 Gi1/0/1 45 42 0 0 Gi1/0/2 45 41 0 0 channel-group-number (Optional) Number of the channel group. The range is 1 to 12. counters Display traffic information. internal Display internal information. neighbor Display neighbor information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-311 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show pagp This is an example of output from the show pagp 1 internal command: Switch> show pagp 1 internal Flags: S - Device is sending Slow hello. C - Device is in Consistent state. A - Device is in Auto mode. Timers: H - Hello timer is running. Q - Quit timer is running. S - Switching timer is running. I - Interface timer is running. Channel group 1 Hello Partner PAgP Learning Group Port Flags State Timers Interval Count Priority Method Ifindex Gi1/0/1 SC U6/S7 H 30s 1 128 Any 16 Gi1/0/2 SC U6/S7 H 30s 1 128 Any 16 This is an example of output from the show pagp 1 neighbor command: Switch> show pagp 1 neighbor Flags: S - Device is sending Slow hello. C - Device is in Consistent state. A - Device is in Auto mode. P - Device learns on physical port. Channel group 1 neighbors Partner Partner Partner Partner Group Port Name Device ID Port Age Flags Cap. Gi0/1 vegas-p2 0002.4b29.4600 Gi0/1 9s SC 10001 Gi0/2 vegas-p2 0002.4b29.4600 Gi0/2 24s SC 10001 Related Commands Command Description clear pagp Clears PAgP channel-group information.2-312 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show policy-map show policy-map Use the show policy-map user EXEC command to display quality of service (QoS) policy maps, which define classification criteria for incoming traffic. Policy maps can include policers that specify the bandwidth limitations and the action to take if the limits are exceeded. show policy-map [policy-map-name [class class-map-name]] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help string, the interface keyword is not supported, and the statistics shown in the display should be ignored. Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show policy-map command: Switch> show policy-map Policy Map videowizard_policy2 class videowizard_10-10-10-10 set ip dscp 34 police 100000000 2000000 exceed-action drop Policy Map mypolicy class dscp5 set ip dscp 6 policy-map-name (Optional) Display the specified policy-map name. class class-map-name (Optional) Display QoS policy actions for a individual class. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-313 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show policy-map Related Commands Command Description policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy.2-314 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show port-security show port-security Use the show port-security privileged EXEC command to display port-security settings for an interface or for the switch. show port-security [interface interface-id] [address | vlan] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If you enter the command without keywords, the output includes the administrative and operational status of all secure ports on the switch. If you enter an interface-id, the command displays port security settings for the interface. If you enter the address keyword, the show port-security address command displays the secure MAC addresses for all interfaces and the aging information for each secure address. If you enter an interface-id and the address keyword, the show port-security interface interface-id address command displays all the MAC addresses for the interface with aging information for each secure address. You can also use this command to display all the MAC addresses for an interface even if you have not enabled port security on it. If you enter the vlan keyword, the show port-security address interface interface-id vlan command displays the configured maximum and the current number of secure MAC addresses for all VLANs on the interface. This option is visible only on interfaces that have the switchport mode set to trunk. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface interface-id (Optional) Display port security settings for the specified interface. Valid interfaces include physical ports (including type, stack member, module, and port number). address (Optional) Display all secure MAC addresses on all ports or a specified port. vlan (Optional) Display port security settings for all VLANs on the specified interface. This keyword is visible only on interfaces that have the switchport mode set to trunk. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The vlan keyword was added (visible only on trunk ports).2-315 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show port-security Examples This is an example of the output from the show port-security command: Switch# show port-security Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count) ------------------------------------------------------------------------------- Gi1/0/1 1 0 0 Shutdown ------------------------------------------------------------------------------- Total Addresses in System (excluding one mac per port) : 1 Max Addresses limit in System (excluding one mac per port) : 6272 This is an example of output from the show port-security interface gigabitethernet1/0/1 command: Switch# show port-security interface gigabitethernet1/0/1 Port Security : Enabled Port status : SecureUp Violation mode : Shutdown Maximum MAC Addresses : 1 Total MAC Addresses : 0 Configured MAC Addresses : 0 Aging time : 0 mins Aging type : Absolute SecureStatic address aging : Disabled Security Violation count : 0 This is an example of output from the show port-security address command: Switch# show port-security address Secure Mac Address Table ------------------------------------------------------------------- Vlan Mac Address Type Ports Remaining Age (mins) ---- ----------- ---- ----- ------------- 1 0006.0700.0800 SecureConfigured Gi1/0/2 1 ------------------------------------------------------------------- Total Addresses in System (excluding one mac per port) : 1 Max Addresses limit in System (excluding one mac per port) : 6272 This is an example of output from the show port-security interface gigabitethernet1/0/2 address command: Switch# show port-security interface gigabitethernet1/0/2 address Secure Mac Address Table ------------------------------------------------------------------- Vlan Mac Address Type Ports Remaining Age (mins) ---- ----------- ---- ----- ------------- 1 0006.0700.0800 SecureConfigured Gi1/0/2 1 ------------------------------------------------------------------- Total Addresses: 12-316 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show port-security This is an example of output from the show port-security interface gigabitethernet1/0/2 vlan command: Switch# show port-security interface gigabitethernet1/0/2 vlan Default maximum:not set, using 5120 VLAN Maximum Current 5 default 1 10 default 54 11 default 101 12 default 101 13 default 201 14 default 501 Related Commands Command Description switchport port-security Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.2-317 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show running-config vlan show running-config vlan Use the show running-config vlan privileged EXEC command to display all or a range of VLAN-related configurations on the switch. show running-config vlan [vlan-ids] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show running-config vlan command: Switch# show running-config vlan 220-2000 Building configuration... Current configuration: ! vlan 239 ! vlan 501 ! vlan 1000 ! vlan 1002 tb-vlan1 1 tb-vlan2 1003 ! vlan 1003 tb-vlan1 1 tb-vlan2 1002 ! vlan 1004 bridge 1 end vlan-ids (Optional) Display configuration information for a single VLAN identified by VLAN ID number or a range of VLANs separated by a hyphen. For vlan-id, the range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-318 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show running-config vlan Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. vlan (global configuration) Enters config-vlan mode for creating and editing VLANs. When VLAN Trunking Protocol (VTP) mode is transparent, you can use this mode to create extended-range VLANs (VLAN IDs greater than 1005). vlan database Enters VLAN configuration mode for creating and editing normal-range VLANs.2-319 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show sdm prefer show sdm prefer Use the show sdm prefer privileged EXEC command to display information about the Switch Database Management (SDM) templates that can be used to maximize system resources for a particular feature, or use the command without a keyword to display the template in use. show sdm prefer [default | routing | vlan [desktop]] [| {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines When you change the SDM template by using the sdm prefer global configuration command, you must reload the switch for the configuration to take effect. If you enter the show sdm prefer command before you enter the reload privileged EXEC command, the show sdm prefer command shows the template currently in use and the template that will become active after a reload. The numbers displayed for each template represent an approximate maximum number for each feature resource. The actual number might vary, depending on the actual number of other features configured. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. default (Optional) Display the template that balances system resources among features. routing (Optional) Display the template that maximizes system resources for routing. vlan (Optional) Display the template that maximizes system resources for Layer 2 VLANs. desktop (Optional) For Catalyst 3750-12S aggregator switches only, display the desktop templates. For this switch, when you do not enter the desktop keyword, the aggregator templates appear. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The desktop keyword was added.2-320 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show sdm prefer Examples This is an example of output from the show sdm prefer command, displaying the template in use: Switch# show sdm prefer The current template is "desktop default" template. The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 6K number of igmp groups + multicast routes: 1K number of unicast routes: 8K number of directly connected hosts: 6K number of indirect routes: 2K number of policy based routing aces: 0 number of qos aces: 512 number of security aces: 1K This is an example of output from the show sdm prefer routing command entered on an aggregator switch: Switch# show sdm prefer routing "aggregate routing" template: The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 6K number of igmp groups + multicast routes: 1K number of unicast routes: 20K number of directly connected hosts: 6K number of indirect routes: 14K number of policy based routing aces: 512 number of qos aces: 512 number of security aces: 1K This is an example of output from the show sdm prefer routing command entered on a desktop switch: Switch# show sdm prefer routing "desktop routing" template: The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 3K number of igmp groups + multicast routes: 1K number of unicast routes: 11K number of directly connected hosts: 3K number of indirect routes: 8K number of policy based routing aces: 512 number of qos aces: 512 number of security aces: 1K2-321 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show sdm prefer This is an example of output from the show sdm prefer command when you have configured a new template but have not reloaded the switch: Switch# show sdm prefer The current template is "desktop routing" template. The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 3K number of igmp groups + multicast routes: 1K number of unicast routes: 11K number of directly connected hosts: 3K number of indirect routes: 8K number of qos aces: 512 number of security aces: 1K On next reload, template will be "aggregate routing" template. Related Commands Command Description sdm prefer Sets the SDM template to maximize resources for routing or VLANs or to the default template, or to select the desktop or aggregator templates. 2-322 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show setup express show setup express Use the show setup express privileged EXEC command to display if Express Setup mode is active on the switch. show setup express [ | {begin | exclude | include} expression] Syntax Description Defaults No default is defined. Command Modes Privileged EXEC Command History Examples This is an example of output from the show setup express command: Switch# show setup express express setup mode is active Related Commands | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced. Command Description clear setup express Exits Express Setup mode. setup express Enables Express Setup mode.2-323 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree show spanning-tree Use the show spanning-tree user EXEC command to display spanning-tree state information. show spanning-tree [bridge-group | active [detail] | backbonefast | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | mst | pathcost method | root | summary [totals] | uplinkfast | vlan vlan-id] [ | {begin | exclude | include} expression] show spanning-tree bridge-group [active [detail] | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | root | summary] [| {begin | exclude | include} expression] show spanning-tree vlan vlan-id [active [detail] | blockedports | bridge | detail [active] | inconsistentports | interface interface-id | root | summary] [ | {begin | exclude | include} expression] show spanning-tree {vlan vlan-id | bridge-group} bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol] [ | {begin | exclude | include} expression] show spanning-tree {vlan vlan-id | bridge-group} root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id] [ | {begin | exclude | include} expression] show spanning-tree interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state] [ | {begin | exclude | include} expression] show spanning-tree mst [configuration] | [instance-id [detail | interface interface-id [detail]] [ | {begin | exclude | include} expression] Syntax Description bridge-group (Optional) Specify the bridge group number. The range is 1 to 255. active [detail] (Optional) Display spanning-tree information only on active interfaces (available only in privileged EXEC mode). backbonefast (Optional) Display spanning-tree BackboneFast status. blockedports (Optional) Display blocked port information (available only in privileged EXEC mode). bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol] (Optional) Display status and configuration of this switch (optional keywords available only in privileged EXEC mode). detail [active] (Optional) Display a detailed summary of interface information (active keyword available only in privileged EXEC mode). inconsistentports (Optional) Display inconsistent port information (available only in privileged EXEC mode). interface interface-id [active [detail] | cost | detail [active] | inconsistency | portfast | priority | rootcost | state] (Optional) Display spanning-tree information for the specified interface (all options except portfast and state available only in privileged EXEC mode). Enter each interface separated by a space. Ranges are not supported. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 12. 2-324 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree Command Modes User EXEC; indicated keywords available only in privileged EXEC mode. Command History Usage Guidelines If the vlan-id variable is omitted, the command applies to the spanning-tree instance for all VLANs. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. mst [configuration | [instance-id [detail | interface interface-id [detail]] (Optional) Display the multiple spanning-tree (MST) region configuration and status (available only in privileged EXEC mode). You can specify a single instance ID, a range of IDs separated by a hyphen, or a series of IDs separated by a comma. The range is 1 to 15. Valid interfaces include physical ports, VLANs, and port channels. The VLAN range is 1 to 4094. The port-channel range is 1 to 64. pathcost method (Optional) Display the default path cost method (available only in privileged EXEC mode). root [address | cost | detail | forward-time | hello-time | id | max-age | port | priority [system-id]] (Optional) Display root switch status and configuration (all keywords available only in privileged EXEC mode). summary [totals] (Optional) Display a summary of port states or the total lines of the spanning-tree state section. uplinkfast (Optional) Display spanning-tree UplinkFast status. vlan vlan-id [active [detail] | backbonefast | blockedports | bridge [address | detail | forward-time | hello-time | id | max-age | priority [system-id] | protocol] (Optional) Display spanning-tree information for the specified VLAN (some keywords available only in privileged EXEC mode). You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The mst keyword and options were added.2-325 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree Examples This is an example of output from the show spanning-tree active command: Switch# show spanning-tree active VLAN0001 Spanning tree enabled protocol ieee Root ID Priority 32768 Address 0001.42e2.cdd0 Cost 3038 Port 24 (GigabitEthernet2/0/1) Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 49153 (priority 49152 sys-id-ext 1) Address 0003.fd63.9580 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Uplinkfast enabled Interface Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- Gi2/0/1 Root FWD 3019 128.24 P2p

This is an example of output from the show spanning-tree detail command: Switch# show spanning-tree detail VLAN0001 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 49152, sysid 1, address 0003.fd63.9580 Configured hello time 2, max age 20, forward delay 15 Current root has priority 32768, address 0001.42e2.cdd0 Root port is 24 (GigabitEthernet2/0/1), cost of root path is 3038 Topology change flag not set, detected flag not set Number of topology changes 0 last change occurred 1d16h ago Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 0, topology change 0, notification 0, aging 300 Uplinkfast enabled Port 1 (GigabitEthernet2/0/1) of VLAN0001 is forwarding Port path cost 3019, Port priority 128, Port Identifier 128.24. Designated root has priority 32768, address 0001.42e2.cdd0 Designated bridge has priority 32768, address 00d0.bbf5.c680 Designated port id is 128.25, designated path cost 19 Timers: message age 2, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default BPDU: sent 0, received 72364

2-326 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree This is an example of output from the show spanning-tree interface gigabitethernet2/0/1 command: Switch# show spanning-tree interface gigabitethernet2/0/1 Vlan Role Sts Cost Prio.Nbr Type ---------------- ---- --- --------- -------- -------------------------------- VLAN0001 Root FWD 3019 128.24 P2p Switch# show spanning-tree summary Switch is in pvst mode Root bridge for: none EtherChannel misconfiguration guard is enabled Extended system ID is enabled Portfast is disabled by default PortFast BPDU Guard is disabled by default Portfast BPDU Filter is disabled by default Loopguard is disabled by default UplinkFast is enabled BackboneFast is enabled Pathcost method used is short Name Blocking Listening Learning Forwarding STP Active ---------------------- -------- --------- -------- ---------- ---------- VLAN0001 1 0 0 11 12 VLAN0002 3 0 0 1 4 VLAN0004 3 0 0 1 4 VLAN0006 3 0 0 1 4 VLAN0031 3 0 0 1 4 VLAN0032 3 0 0 1 4

---------------------- -------- --------- -------- ---------- ---------- 37 vlans 109 0 0 47 156 Station update rate set to 150 packets/sec. UplinkFast statistics ----------------------- Number of transitions via uplinkFast (all VLANs) : 0 Number of proxy multicast addresses transmitted (all VLANs) : 0 BackboneFast statistics ----------------------- Number of transition via backboneFast (all VLANs) : 0 Number of inferior BPDUs received (all VLANs) : 0 Number of RLQ request PDUs received (all VLANs) : 0 Number of RLQ response PDUs received (all VLANs) : 0 Number of RLQ request PDUs sent (all VLANs) : 0 Number of RLQ response PDUs sent (all VLANs) : 0 This is an example of output from the show spanning-tree mst configuration command: Switch# show spanning-tree mst configuration Name [region1] Revision 1 Instance Vlans Mapped -------- ------------------ 0 1-9,21-4094 1 10-20 ----------------------------2-327 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree This is an example of output from the show spanning-tree mst interface gigabitethernet2/0/1 command: Switch# show spanning-tree mst interface gigabitethernet2/0/1 GigabitEthernet2/0/1 of MST00 is root forwarding Edge port: no (default) port guard : none (default) Link type: point-to-point (auto) bpdu filter: disable (default) Boundary : boundary (STP) bpdu guard : disable (default) Bpdus sent 5, received 74 Instance role state cost prio vlans mapped 0 root FWD 200000 128 1,12,14-4094 This is an example of output from the show spanning-tree mst 0 command: Switch# show spanning-tree mst 0 ###### MST00 vlans mapped: 1-9,21-4094 Bridge address 0002.4b29.7a00 priority 32768 (32768 sysid 0) Root address 0001.4297.e000 priority 32768 (32768 sysid 0) port Gi1/0/1 path cost 200038 IST master *this switch Operational hello time 2, forward delay 15, max age 20, max hops 20 Configured hello time 2, forward delay 15, max age 20, max hops 20 Interface role state cost prio type -------------------- ---- ----- --------- ---- -------------------------------- GigabitEthernet2/0/1 root FWD 200000 128 P2P bound(STP) GigabitEthernet2/0/2 desg FWD 200000 128 P2P bound(STP) Port-channel1 desg FWD 200000 128 P2P bound(STP) Related Commands Command Description clear spanning-tree counters Clears the spanning-tree counters. clear spanning-tree detected-protocols Restarts the protocol migration process. spanning-tree backbonefast Enables the BackboneFast feature. spanning-tree bpdufilter Prevents a port from sending or receiving bridge protocol data units (BPDUs). spanning-tree bpduguard Puts a port in the error-disabled state when it receives a BPDU. spanning-tree cost Sets the path cost for spanning-tree calculations. spanning-tree extend system-id Enables the extended system ID feature. spanning-tree guard Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface. spanning-tree link-type Overrides the default link-type setting for rapid spanning-tree transitions to the forwarding state. spanning-tree loopguard default Prevents alternate or root ports from becoming the designated port because of a failure that leads to a unidirectional link. spanning-tree mst configuration Enters multiple spanning-tree (MST) configuration mode through which the MST region configuration occurs. spanning-tree mst cost Sets the path cost for MST calculations. spanning-tree mst forward-time Sets the forward-delay time for all MST instances. spanning-tree mst hello-time Sets the interval between hello BPDUs sent by root switch configuration messages.2-328 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show spanning-tree spanning-tree mst max-age Sets the interval between messages that the spanning tree receives from the root switch. spanning-tree mst max-hops Sets the number of hops in an MST region before the BPDU is discarded and the information held for a port is aged. spanning-tree mst port-priority Configures an interface priority. spanning-tree mst priority Configures the switch priority for the specified spanning-tree instance. spanning-tree mst root Configures the MST root switch priority and timers based on the network diameter. spanning-tree port-priority Configures an interface priority. spanning-tree portfast (global configuration) Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports. spanning-tree portfast (interface configuration) Enables the Port Fast feature on an interface and all its associated VLANs. spanning-tree uplinkfast Accelerates the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. spanning-tree vlan Configures spanning tree on a per-VLAN basis. Command Description2-329 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show storm-control show storm-control Use the show storm-control user EXEC command to display broadcast, multicast, or unicast storm control settings on the switch or on the specified interface or to display storm-control history. show storm-control [interface-id] [broadcast | multicast | unicast] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines When you enter an interface-id, the storm control thresholds are displayed for the specified interface. If you do not enter an interface-id, settings are displayed for one traffic type for all ports on the switch. If you do not enter a traffic type, settings are displayed for broadcast storm control. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of a partial output from the show storm-control command when no keywords are entered. Because no traffic type keyword was entered, the broadcast storm control settings are displayed. Switch> show storm-control Interface Filter State Level Current --------- ------------- ------- ------- Gi1/0/1 inactive 100.00% N/A Gi1/0/2 inactive 100.00% N/A Gi1/0/3 inactive 100.00% N/A Gi1/0/4 inactive 100.00% N/A Gi1/0/5 inactive 100.00% N/A Gi1/0/6 inactive 100.00% N/A Gi1/0/7 inactive 100.00% N/A Gi1/0/8 inactive 100.00% N/A interface-id (Optional) Interface ID for the physical port (including type, stack member, module, and port number). broadcast (Optional) Display broadcast storm threshold setting. multicast (Optional) Display multicast storm threshold setting. unicast (Optional) Display unicast storm threshold setting. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-330 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show storm-control Gi1/0/9 inactive 100.00% N/A Gi1/0/10 inactive 100.00% N/A Gi1/0/11 inactive 100.00% N/A Gi1/0/12 inactive 100.00% N/A Gi1/0/13 inactive 100.00% N/A Gi1/0/14 inactive 100.00% N/A

This is an example of output from the show storm-control command for a specified interface. Because no traffic type keyword was entered, the broadcast storm control settings are displayed. Switch> show storm-control gigabitethernet 2/0/1 Interface Filter State Level Current --------- ------------- ------- ------- Gi2/0/1 inactive 100.00% N/A This is an example of output from the show storm-control command for a specified interface and traffic type, where no storm control threshold has been set for that traffic type on the specified interface. Switch> show storm-control gigabitethernet1/0/5 multicast Interface Filter State Level Current --------- ------------- ------- ------- Gi1/0/5 inactive 100.00% N/A Table 2-22 describes the fields in the show storm-control display. Related Commands Table 2-22 show storm-control Field Descriptions Field Description Interface Displays the ID of the interface. Filter State Displays the status of the filter: • Blocking—Storm control is enabled, and a storm has occurred. • Forwarding—Storm control is enabled, and no storms have occurred. • Inactive—Storm control is disabled. Level Displays the threshold level set on the interface for broadcast traffic or the specified traffic type (broadcast, multicast, or unicast). Current Displays the bandwidth utilization of broadcast traffic or the specified traffic type (broadcast, multicast, or unicast) as a percentage of total available bandwidth. This field is only valid when storm control is enabled. Command Description storm-control Sets the broadcast, multicast, or unicast storm control levels for the switch.2-331 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show switch show switch Use the show switch user EXEC command to display information related to the stack member or the switch stack. show switch [stack-member-number | detail | neighbors | stack-ports] [ | {begin | exclude | include} expression Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. These are the states displayed from this command: • Waiting—The stage when a switch is booting up and waiting for communication from other switches in the stack. The switch has not yet determined whether it is a stack master or not. Stack members not participating in a stack master election remain in the waiting state until the stack master is elected and ready. • Initializing—The stage when a switch has determined whether it is the stack master or not. If the switch is not the stack master, it is receiving its system- and interface-level configuration from the stack master and loading it. • Ready—The stage when the stack member has completed loading the system- and interface-level configuration and is ready to forward traffic. • Master Re-Init—The stage immediately after a stack master re-election and a different stack member is elected stack master. The new stack master is re-initializing its configuration. This state applies only to the new stack master. stack-member-number (Optional) Display information for the specified stack member. The range is 1 to 9. detail (Optional) Display detailed information about the stack ring. neighbors (Optional) Display the neighbors for the entire switch stack. stack-ports (Optional) Display port information for the entire switch stack. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The output for this command was expanded to include Switch Database Management (SDM) mismatch.2-332 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show switch • Ver Mismatch—The stage of a switch in version mismatch (VM) mode. VM mode is when a switch joining the switch stack has a different stack protocol minor version number from the stack master. • SDM Mismatch—The stage of a switch in Switch Database Management (SDM) mismatch mode. SDM mismatch is when a stack member does not support the SDM template running on the stack master. A typical state transition for a stack member (including a stack master) booting up is Waiting -> Initializing -> Ready. A typical state transition for a stack member becoming a stack master after a stack master election is Ready -> Master Re-Init -> Ready. A typical state transition for a stack member in version mismatch (VM) mode is Waiting -> Ver Mismatch. The word slave in the output refers to a stack member other than the stack master. Examples This example shows how to display summary information about stack member 6: Switch(config)# show switch 6 Current Switch# Role Mac Address Priority State -------------------------------------------------------- 6 Slave 0003.e31a.1e00 1 Ready This example shows how to display summary information about a switch stack: Switch(config)# show switch Current Switch# Role Mac Address Priority State -------------------------------------------------------- 6 Slave 0003.e31a.1e00 1 Ready *8 Master 0003.e31a.1200 1 Ready This example shows detailed information about a switch stack: Switch(config)# show switch detail Current Switch# Role Mac Address Priority State -------------------------------------------------------- 6 Slave 0003.e31a.1e00 1 Ready *8 Master 0003.e31a.1200 1 Ready Stack Port Status Neighbors Switch# Port A Port B Port A Port B -------------------------------------------------------- 6 Down Ok None 8 8 Ok Down 6 None This example shows how to display neighbor information for a switch stack: Switch(config)# show switch neighbors Switch # Port A Port B -------- ------ ------ 6 None 8 8 6 None2-333 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show switch This example shows how to display stack-port information for a switch stack: Switch(config)# show switch stack-ports Switch # Port A Port B -------- ------ ------ 6 Down Ok 8 Ok Down Related Commands Command Description reload Saves the configuration change and restarts the stack member. remote command Monitors all or specified stack members. session Accesses a specific stack member. switch priority Changes the stack member priority value. switch renumber Changes the stack member number.2-334 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show system mtu show system mtu Use the show system mtu privileged EXEC command to display the global maximum transmission unit (MTU) or maximum packet size set for the switch. show system mtu [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines If you have used the system mtu or system mtu jumbo global configuration command to change the MTU setting, the new setting does not take effect until you reset the switch. The system MTU refers to 10/100 ports; the system jumbo MTU refers to Gigabit ports. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show system mtu command: Switch# show system mtu System MTU size is 1500 bytes System Jumbo MTU size is 1500 bytes Related Commands | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description system mtu Sets the MTU size for the Fast Ethernet or Gigabit Ethernet ports.2-335 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show udld show udld Use the show udld user EXEC command to display UniDirectional Link Detection (UDLD) administrative and operational status for all ports or the specified port. show udld [interface-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines If you do not enter an interface-id, administrative and operational UDLD status for all interfaces are displayed. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show udld gigabitethernet6/0/11 command. For this display, UDLD is enabled on both ends of the link, and UDLD detects that the link is bidirectional. Table 2- 23 describes the fields in this display. Switch> show udld gigabitethernet6/0/11 Interface gi6/0/11 --- Port enable administrative configuration setting: Follows device default Port enable operational state: Enabled Current bidirectional state: Bidirectional Current operational state: Advertisement - Single Neighbor detected Message interval: 60 Time out interval: 5 Entry 1 Expiration time: 146 Device ID: 1 Current neighbor state: Bidirectional Device name: 0050e2826000 Port ID: Gi6/0/12 Neighbor echo 1 device: SAD03160954 Neighbor echo 1 port: Gi6/0/11 Message interval: 5 CDP Device name: 066527791 interface-id (Optional) ID of the interface and port number. Valid interfaces include physical ports and VLANs. The VLAN range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-336 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show udld Table 2-23 show udld Field Descriptions Field Description Interface The interface on the local device configured for UDLD. Port enable administrative configuration setting How UDLD is configured on the port. If UDLD is enabled or disabled, the port enable configuration setting is the same as the operational enable state. Otherwise, the enable operational setting depends on the global enable setting. Port enable operational state Operational state that shows whether UDLD is actually running on this port. Current bidirectional state The bidirectional state of the link. An unknown state is displayed if the link is down or if it is connected to an UDLD-incapable device. A bidirectional state is displayed if the link is a normal two-way connection to a UDLD-capable device. All other values mean miswiring. Current operational state The current phase of the UDLD state machine. For a normal bidirectional link, the state machine is most often in the Advertisement phase. Message interval How often advertisement messages are sent from the local device. Measured in seconds. Time out interval The time period, in seconds, that UDLD waits for echoes from a neighbor device during the detection window. Entry 1 Information from the first cache entry, which contains a copy of echo information received from the neighbor. Expiration time The amount of time in seconds remaining before this cache entry is aged out. Device ID The neighbor device identification. Current neighbor state The neighbor’s current state. If both the local and neighbor devices are running UDLD normally, the neighbor state and local state should be bidirectional. If the link is down or the neighbor is not UDLD-capable, no cache entries are displayed. Device name The neighbor MAC address. Port ID The neighbor port ID enabled for UDLD. Neighbor echo 1 device The MAC address of the neighbors’ neighbor from which the echo originated. Neighbor echo 1 port The port number ID of the neighbor from which the echo originated. Message interval The rate, in seconds, at which the neighbor is sending advertisement messages. CDP device name CDP name of the device.2-337 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show udld Related Commands Command Description udld (global configuration) Enables aggressive or normal mode in UDLD or sets the configurable message timer time. udld (interface configuration) Enables UDLD on an individual interface or prevents a fiber-optic interface from being enabled by the udld global configuration command. udld reset Resets all interfaces shutdown by UDLD and permits traffic to begin passing through them again.2-338 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show version show version Use the show version user EXEC command to display version information for the hardware and firmware. show version [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show version command: Switch> show version Cisco Internetwork Operating System Software IOS (tm) C3750 Software (C3750-I5-M), Version 12.1(0.0.709)EA1, CISCO DEVELOPMENT TEST VERSION Copyright (c) 1986-2003 by cisco Systems, Inc. Compiled Fri 02-May-03 21:09 by antonino Image text-base: 0x00003000, data-base: 0x008E36A4 ROM: Bootstrap program is C3750 boot loader BOOTLDR: C3750 Boot Loader (C3750-HBOOT-M) Version 12.1(0.0.130)EA1, CISCO DEVELOPMENT TEST VERSION Switch uptime is 2 days, 11 hours, 16 minutes System returned to ROM by power-on System image file is "flash:i5.709" cisco WS-C3750-48TS (PowerPC405) processor with 120822K/10240K bytes of memory. Last reset from power-on Bridging software. Target IOS Version 12.1(14)EA1 1 Virtual Ethernet/IEEE 802.3 interface(s) 48 FastEthernet/IEEE 802.3 interface(s) 32 Gigabit Ethernet/IEEE 802.3 interface(s) The password-recovery mechanism is enabled. 512K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address : 00:09:43:A7:F2:00 | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-339 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show version Motherboard assembly number : 73-7056-05 Motherboard serial number : CSJ0638004U Motherboard revision number : 05 Model number : 73-7056-05 Switch Ports Model SW Version SW Image ------ ----- ----- ---------- ---------- 1 28 WS-C3750G-24TS 12.1(0.0.709)EA1 C3750-I5-M * 8 52 WS-C3750-48TS 12.1(0.0.709)EA1 C3750-I5-M Switch 01 --------- Switch Uptime : 2 days, 11 hours, 17 minutes Base ethernet MAC Address : 00:0B:46:2E:35:80 Motherboard assembly number : 73-7058-04 Power supply part number : 341-0045-01 Motherboard serial number : CSJ0640010L Model number : WS-C3750-24TS-SMI System serial number : CSJ0642U00A Configuration register is 0xF

2-340 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan show vlan Use the show vlan user EXEC command to display the parameters for all configured VLANs or one VLAN (if the VLAN ID or name is specified) on the switch. show vlan [brief | id vlan-id | internal usage | name vlan-name | remote-span | summary] [ | {begin | exclude | include} expression] Syntax Description Note Though visible in the command-line help string, the ifindex and private-vlan keywords are not supported. Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. brief (Optional) Display one line for each VLAN with the VLAN name, status, and its ports. id vlan-id (Optional) Display information about a single VLAN identified by VLAN ID number. For vlan-id, the range is 1 to 4094. internal usage (Optional) Display list of VLANs being used internally by the switch. These VLANs are always from the extended range (VLAN IDs 1006 to 4094), and you cannot create VLANs with these IDS by using the vlan global configuration command until you remove them from internal use. name vlan-name (Optional) Display information about a single VLAN identified by VLAN name. The VLAN name is an ASCII string from 1 to 32 characters. remote-span (Optional) Display information about Remote SPAN (RSPAN) VLANs. summary (Optional) Display VLAN summary information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-341 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan Examples This is an example of output from the show vlan command. Table 2-24 describes each field in the display. Switch> show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa1/0/1, Fa1/0/2, Fa1/0/3 Fa1/0/4, Fa1/0/5, Fa1/0/6 Fa1/0/7, Fa1/0/8, Fa1/0/9 Fa1/0/10, Fa1/0/11, Fa1/0/12 Fa1/0/13, Fa1/0/14, Fa1/0/15 Fa1/0/16, Fa1/0/17, Fa1/0/18 Fa1/0/19, Fa1/0/20, Fa1/0/21 Fa1/0/22, Fa1/0/23, Fa1/0/24 Fa1/0/25, Fa1/0/26, Fa1/0/27 Fa1/0/28, Fa1/0/29, Fa1/0/30 Fa1/0/31, Fa1/0/32, Fa1/0/33 Fa1/0/34, Fa1/0/35, Fa1/0/36 Fa1/0/46, Gi1/0/1, Gi1/0/2 Gi1/0/3, Gi1/0/4, Gi2/0/1 Gi2/0/2, Gi2/0/3, Gi2/0/4 Gi2/0/5, Gi2/0/6, Gi2/0/7

2 VLAN0002 active 3 VLAN0003 active

1000 VLAN1000 active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 1 enet 100001 1500 - - - - - 1002 1003 2 enet 100002 1500 - - - - - 0 0 3 enet 100003 1500 - - - - - 0 0

1005 trnet 101005 1500 - - - ibm - 0 0 Remote SPAN VLANs ------------------------------------------------------------------------------ Primary Secondary Type Ports ------ --------- ----------------- ------------------------------------------ Table 2-24 show vlan Command Output Fields Field Description VLAN VLAN number. Name Name, if configured, of the VLAN. Status Status of the VLAN (active or suspend). Ports Ports that belong to the VLAN.2-342 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan This is an example of output from the show vlan summary command: Switch> show vlan summary Number of existing VLANs : 45 Number of existing VTP VLANs : 45 Number of existing extended VLANs : 0 This is an example of output from the show vlan id command. Switch# show vlan id 2 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 2 VLAN0200 active Fa1/0/47, Fa1/0/48, Gi2/0/13 Gi3/0/1 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 2 enet 100002 1500 - - - - - 0 0 Remote SPAN VLAN ---------------- Disabled This is an example of output from the show vlan internal usage command. It shows that VLANs 1025 and 1026 are being used as internal VLANs for Fast Ethernet routed ports 23 and 24 on stack member 1. If you want to use one of these VLAN IDs, you must first shut down the routed port, which releases the internal VLAN, and then create the extended-range VLAN. When you start up the routed port, another internal VLAN number is assigned to it. Switch> show vlan internal usage VLAN Usage ---- ------------- 1025 FastEthernet1/0/23 1026 FastEthernet1/0/24 Type Media type of the VLAN. SAID Security association ID value for the VLAN. MTU Maximum transmission unit size for the VLAN. Parent Parent VLAN, if one exists. RingNo Ring number for the VLAN, if applicable. BrdgNo Bridge number for the VLAN, if applicable. Stp Spanning Tree Protocol type used on the VLAN. BrdgMode Bridging mode for this VLAN—possible values are source-route bridging (SRB) and source-route transparent (SRT); the default is SRB. Trans1 Translation bridge 1. Trans2 Translation bridge 2. Remote SPAN VLANs Identifies any RSPAN VLANs that have been configured. Primary/Secondary/ Type/Ports Not applicable to this release. Table 2-24 show vlan Command Output Fields (continued) Field Description2-343 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan Related Commands Command Description switchport mode Configures the VLAN membership mode of a port. vlan (global configuration) Enables config-vlan mode where you can configure VLANs 1 to 4094. vlan (VLAN configuration) Configures VLAN characteristics in the VLAN database. Only available for normal-range VLANs (VLAN IDs 1 to 1005). Do not enter leading zeros.2-344 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan access-map show vlan access-map Use the show vlan access-map privileged EXEC command to display information about a particular VLAN access map or all VLAN access maps. show vlan access-map [mapname] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show vlan access-map command: Switch# show vlan access-map Vlan access-map "SecWiz" 10 Match clauses: ip address: SecWiz_Fa1_0_3_in_ip Action: forward Related Commands mapname (Optional) Name of a specific VLAN access map. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description show vlan filter Displays information about all VLAN filters or about a particular VLAN or VLAN access map. vlan access-map Creates a VLAN map entry for VLAN packet filtering. vlan filter Applies a VLAN map to one or more VLANs.2-345 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vlan filter show vlan filter Use the show vlan filter privileged EXEC command to display information about all VLAN filters or about a particular VLAN or VLAN access map. show vlan filter [access-map name | vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show vlan filter command: Switch# show vlan filter VLAN Map map_1 is filtering VLANs: 20-22 Related Commands access-map name (Optional) Display filtering information for the specified VLAN access map. vlan vlan-id (Optional) Display filtering information for the specified VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. Command Description show vlan access-map Displays information about a particular VLAN access map or all VLAN access maps. vlan access-map Creates a VLAN map entry for VLAN packet filtering. vlan filter Applies a VLAN map to one or more VLANs.2-346 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vmps show vmps Use the show vmps user EXEC command without keywords to display the VLAN Query Protocol (VQP) version, reconfirmation interval, retry count, VLAN Membership Policy Server (VMPS) IP addresses, and the current and primary servers, or use the statistics keyword to display client-side statistics. show vmps [statistics] [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show vmps command: Switch> show vmps VQP Client Status: -------------------- VMPS VQP Version: 1 Reconfirm Interval: 60 min Server Retry Count: 3 VMPS domain server: Reconfirmation status --------------------- VMPS Action: other statistics (Optional) Display VQP client-side statistics and counters. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.2-347 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vmps This is an example of output from the show vmps statistics command. Table 2- 25 describes each field in the display. Switch> show vmps statistics VMPS Client Statistics ---------------------- VQP Queries: 0 VQP Responses: 0 VMPS Changes: 0 VQP Shutdowns: 0 VQP Denied: 0 VQP Wrong Domain: 0 VQP Wrong Version: 0 VQP Insufficient Resource: 0 Table 2-25 show vmps statistics Field Descriptions Field Description VQP Queries Number of queries sent by the client to the VMPS. VQP Responses Number of responses sent to the client from the VMPS. VMPS Changes Number of times that the VMPS changed from one server to another. VQP Shutdowns Number of times the VMPS sent a response to shut down the port. The client disables the port and removes all dynamic addresses on this port from the address table. You must administratively re-enable the port to restore connectivity. VQP Denied Number of times the VMPS denied the client request for security reasons. When the VMPS response denies an address, no frame is forwarded to or from the workstation with that address (broadcast or multicast frames are delivered to the workstation if the port has been assigned to a VLAN). The client keeps the denied address in the address table as a blocked address to prevent more queries from being sent to the VMPS for each new packet received from this workstation. The client ages the address if no new packets are received from this workstation on this port within the aging time period. VQP Wrong Domain Number of times the management domain in the request does not match the one for the VMPS. Any previous VLAN assignments of the port are not changed. This response means that the server and the client have not been configured with the same VTP management domain. VQP Wrong Version Number of times the version field in the query packet contains a value that is higher than the version supported by the VMPS. The VLAN assignment of the port is not changed. The switches send only VMPS version 1 requests. VQP Insufficient Resource Number of times the VMPS is unable to answer the request because of a resource availability problem. If the retry limit has not yet been reached, the client repeats the request with the same server or with the next alternate server, depending on whether the per-server retry count has been reached.2-348 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vmps Related Commands Command Description clear vmps statistics Clears the statistics maintained by the VQP client. vmps reconfirm (privileged EXEC) Sends VQP queries to reconfirm all dynamic VLAN assignments with the VMPS. vmps retry Configures the per-server retry count for the VQP client. vmps server Configures the primary VMPS and up to three secondary servers.2-349 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vtp show vtp Use the show vtp user EXEC command to display general information about the VLAN Trunking Protocol (VTP) management domain, status, and counters. show vtp {counters | password | status} [ | {begin | exclude | include} expression] Syntax Description Command Modes User EXEC Command History Usage Guidelines Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show vtp counters command. Table 2-26 describes each field in the display. Switch> show vtp counters VTP statistics: Summary advertisements received : 0 Subset advertisements received : 0 Request advertisements received : 0 Summary advertisements transmitted : 0 Subset advertisements transmitted : 0 Request advertisements transmitted : 0 Number of config revision errors : 0 Number of config digest errors : 0 Number of V1 summary errors : 0 counters Display the VTP statistics for the switch. password Display the configured VTP password. status Display general information about the VTP management domain status. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The password keyword was added.2-350 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vtp VTP pruning statistics: Trunk Join Transmitted Join Received Summary advts received from non-pruning-capable device ---------------- ---------------- ---------------- --------------------------- Fa1/0/47 0 0 0 Fa1/0/48 0 0 0 Gi2/0/13 0 0 0 Gi3/0/1 0 0 0 Table 2-26 show vtp counters Field Descriptions Field Description Summary advertisements received Number of summary advertisements received by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow. Subset advertisements received Number of subset advertisements received by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs. Request advertisements received Number of advertisement requests received by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs. Summary advertisements transmitted Number of summary advertisements sent by this switch on its trunk ports. Summary advertisements contain the management domain name, the configuration revision number, the update timestamp and identity, the authentication checksum, and the number of subset advertisements to follow. Subset advertisements transmitted Number of subset advertisements sent by this switch on its trunk ports. Subset advertisements contain all the information for one or more VLANs. Request advertisements transmitted Number of advertisement requests sent by this switch on its trunk ports. Advertisement requests normally request information on all VLANs. They can also request information on a subset of VLANs. Number of configuration revision errors Number of revision errors. Whenever you define a new VLAN, delete an existing one, suspend or resume an existing VLAN, or modify the parameters on an existing VLAN, the configuration revision number of the switch increments. Revision errors increment whenever the switch receives an advertisement whose revision number matches the revision number of the switch, but the MD5 digest values do not match. This error means that the VTP password in the two switches is different or that the switches have different configurations. These errors means that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network.2-351 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vtp This is an example of output from the show vtp status command. Table 2-27 describes each field in the display. Switch> show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 1005 Number of existing VLANs : 45 VTP Operating Mode : Transparent VTP Domain Name : shared_testbed1 VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Enabled MD5 digest : 0x3A 0x29 0x86 0x39 0xB4 0x5D 0x58 0xD7 Number of configuration digest errors Number of MD5 digest errors. Digest errors increment whenever the MD5 digest in the summary packet and the MD5 digest of the received advertisement calculated by the switch do not match. This error usually means that the VTP password in the two switches is different. To solve this problem, make sure the VTP password on all switches is the same. These errors mean that the switch is filtering incoming advertisements, which causes the VTP database to become unsynchronized across the network. Number of V1 summary errors Number of version 1 errors. Version 1 summary errors increment whenever a switch in VTP V2 mode receives a VTP version 1 frame. These errors mean that at least one neighboring switch is either running VTP version 1 or VTP version 2 with V2-mode disabled. To solve this problem, change the configuration of the switches in VTP V2-mode to disabled. Join Transmitted Number of VTP pruning messages sent on the trunk. Join Received Number of VTP pruning messages received on the trunk. Summary Advts Received from non-pruning-capable device Number of VTP summary messages received on the trunk from devices that do not support pruning. Table 2-26 show vtp counters Field Descriptions (continued) Field Description Table 2-27 show vtp status Field Descriptions Field Description VTP Version Displays the VTP version operating on the switch. By default, the switch implements version 1 but can be set to version 2. Configuration Revision Current configuration revision number on this switch. Maximum VLANs Supported Locally Maximum number of VLANs supported locally. Number of Existing VLANs Number of existing VLANs.2-352 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands show vtp Related Commands VTP Operating Mode Displays the VTP operating mode, which can be server, client, or transparent. Server: a switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch guarantees that it can recover all the VLAN information in the current VTP database from nonvolatile RAM (NVRAM) after reboot. By default, every switch is a VTP server. Note The switch automatically changes from VTP server mode to VTP client mode if it detects a failure while writing the configuration to NVRAM and cannot return to server mode until the NVRAM is functioning. Client: a switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not send VTP advertisements until it receives advertisements to initialize its VLAN database. Transparent: a switch in VTP transparent mode is disabled for VTP, does not send or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received. VTP Domain Name Name that identifies the administrative domain for the switch. VTP Pruning Mode Displays whether pruning is enabled or disabled. Enabling pruning on a VTP server enables pruning for the entire management domain. Pruning restricts flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. VTP V2 Mode Displays if VTP version 2 mode is enabled. All VTP version 2 switches operate in version 1 mode by default. Each VTP switch automatically detects the capabilities of all the other VTP devices. A network of VTP devices should be configured to version 2 only if all VTP switches in the network can operate in version 2 mode. VTP Traps Generation Displays whether VTP traps are sent to a network management station. MD5 Digest A 16-byte checksum of the VTP configuration. Configuration Last Modified Displays the date and time of the last configuration modification. Displays the IP address of the switch that caused the configuration change to the database. Table 2-27 show vtp status Field Descriptions (continued) Field Description Command Description clear vtp counters Clears the VTP and pruning counters. vtp (global configuration) Configures the VTP filename, interface name, domain name, and mode. vtp (VLAN configuration) Configures the VTP domain name, password, pruning, and mode.2-353 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands shutdown shutdown Use the shutdown interface configuration command on the switch stack or on a standalone switch to disable an interface. Use the no form of this command to restart a disabled interface. shutdown no shutdown Syntax Description This command has no arguments or keywords. Command Modes Interface configuration Command History Usage Guidelines The shutdown command for a port causes it to stop forwarding. You can enable the port with the no shutdown command. The no shutdown command has no effect if the port is a static-access port assigned to a VLAN that has been deleted, suspended, or shut down. The port must first be a member of an active VLAN before it can be re-enabled. The shutdown command disables all functions on the specified interface. This command also marks the interface as unavailable. To see if an interface is disabled, use the show interfaces privileged EXEC command. An interface that has been shut down is shown as administratively down in the display. Examples These examples show how to disable and re-enable an interface: Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# shutdown Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# no shutdown You can verify your settings by entering the show interfaces privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show interfaces Displays the statistical information specific to all interfaces or to a specific interface.2-354 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands shutdown vlan shutdown vlan Use the shutdown vlan global configuration command on the switch stack or on a standalone switch to shut down (suspend) local traffic on the specified VLAN. Use the no form of this command to restart local traffic on the VLAN. shutdown vlan vlan-id no shutdown vlan vlan-id Syntax Description Defaults No default is defined. Command Modes Global configuration Command History Usage Guidelines The shutdown vlan command does not change the VLAN information in the VTP database. It shuts down traffic locally, but the switch still advertises VTP information. Examples This example shows how to shutdown traffic on VLAN 2: Switch(config)# shutdown vlan 2 You can verify your setting by entering the show vlan privileged EXEC command. Related Commands vlan-id ID of the VLAN to be locally shut down. The range is 2 to 1001. VLANs defined as default VLANs under the VLAN Trunking Protocol (VTP), as well as extended-range VLANs (greater than 1005) cannot be shut down. The default VLANs are 1 and 1002 to 1005. Release Modification 12.1(11)AX This command was first introduced. Command Description shutdown (config-vlan mode) Shuts down local traffic on the VLAN when in config-VLAN mode (accessed by the vlan vlan-id global configuration command). vlan database Enters VLAN configuration mode.2-355 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server enable traps snmp-server enable traps Use the snmp-server enable traps global configuration command on the switch stack or on a standalone switch to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting. snmp-server enable traps [bgp | bridge | cluster | config | copy-config | entity | envmon [fan | shutdown | supply | temperature] | flash [insertion | removal] | fru-ctrl | hsrp | mac-notification | port-security [trap-rate value] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | stpx | syslog| vlancreate| vlandelete | vlan-membership | vtp] no snmp-server enable traps [bgp | bridge | cluster | config | copy-config | entity | envmon [fan | shutdown | supply | temperature] | flash [insertion | removal] | fru-ctrl | hsrp | mac-notification | port-security [trap-rate] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | stpx | syslog| vlancreate| vlandelete | vlan-membership | vtp] Syntax Description bgp (Optional) Enable Border Gateway Protocol (BGP) state change traps. Note This keyword is available only when the enhanced multilayer image is installed on the stack master. bridge (Optional) Generate STP bridge MIB traps. cluster (Optional) Enable cluster traps. config (Optional) Enable SNMP configuration traps. copy-config (Optional) Enable SNMP copy configuration traps. entity (Optional) Enable SNMP entity traps. envmon (Optional) Generate environmental monitor traps. fan (Optional) Generate environmental fan trap. shutdown (Optional) Generate environmental monitor shutdown traps. supply (Optional) Generate environmental monitor power supply traps. temperature (Optional) Generate environmental monitor temperature traps. flash (Optional) Enable SNMP FLASH notifications. insertion (Optional) Generate a trap when a switch (flash) is inserted into a stack, either physically or because of a power cycle or reload. removal (Optional) Generate a trap when a switch (flash) is removed from a stack, either physically or because of a power cycle or reload. fru-ctrl (Optional) Generate entity FRU control traps. In the Catalyst 3750 switch stack, this trap refers to the insertion or removal of a switch in the stack. hsrp (Optional) Enable Hot Standby Router Protocol (HSRP) traps. mac-notification (Optional) Enable MAC address notification traps. port-security (Optional) Enable SNMP port security traps. trap-rate value (Optional) Set the maximum number of port-security traps sent per second. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence).2-356 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server enable traps Note Though visible in the command-line help strings, the snmp-server enable informs command is not supported. To enable the sending of SNMP inform notifications, use the snmp-server enable traps command combined with the snmp-server host host-addr informs command. Defaults The sending of SNMP traps is disabled. Command Modes Global configuration Command History Usage Guidelines Specify the host (NMS) that receives the traps by using the snmp-server host global configuration command. If no trap types are specified, all trap types are sent. Use the snmp-server enable traps command to enable sending of traps or informs, when supported. Note Informs are not supported in SNMPv1. To enable more than one type of trap, you must enter a separate snmp-server enable traps command for each trap type. rtr (Optional) Enable SNMP Response Time Reporter traps. snmp (Optional) Enable SNMP traps. authentication (Optional) Enable authentication trap. coldstart (Optional) Enable cold start trap. linkdown (Optional) Enable linkdown trap. linkup (Optional) Enable linkup trap. warmstart (Optional) Enable warmstart trap. stpx (Optional) Enable SNMP STPX MIB traps. syslog (Optional) Enable SNMP syslog traps. vlan-membership (Optional) Enable SNMP VLAN membership traps. vlancreate (Optional) Enable SNMP VLAN-created traps. vlandelete (Optional) Enable SNMP VLAN-deleted traps. vtp (Optional) Enable VLAN Trunking Protocol (VTP) traps. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The bgp, copy-config, envmon, flash, port-security, stpx, syslog, vlancreate, and vlandelete keywords were added.2-357 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server enable traps Examples This example shows how to send VTP traps to the NMS: Switch(config)# snmp-server enable traps vtp You can verify your setting by entering the show vtp status or the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. snmp-server host Specifies the host that receives SNMP traps.2-358 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server host snmp-server host Use the snmp-server host global configuration command on the switch stack or on a standalone switch to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host. snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 [auth | noauth| priv]}] {community-string [ [bgp ] [bridge] [cluster] [config] [copy-config] [ entity] [ envmon] [flash] [fru-ctrl] [ hsrp] [mac-notification] [ port-security] [rtr] [ snmp] [stpx] [ syslog] [tty] [udp-port] [ vlancreate] [ vlandelete] [vlan-membership] [ vtp]] } no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 [auth | noauth | priv]}] community-string Syntax Description host-addr Name or Internet address of the host (the targeted recipient). informs | traps (Optional) Send SNMP traps or informs to this host. version 1 | 2c | 3 (Optional) Version of the Simple Network Management Protocol (SNMP) used to send the traps. These keywords are supported: 1—SNMPv1. This option is not available with informs. 2c—SNMPv2C. 3—SNMPv3. These optional keywords can follow the version 3 keyword: • auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication. • noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth | priv] keyword choice is not specified. • priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the crypto (encrypted) software image is installed. community-string Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command. bgp (Optional) Send Border Gateway Protocol (BGP) state change traps. Note This keyword is available only when the enhanced multilayer image is installed on the stack master. bridge (Optional) Send SNMP Spanning Tree Protocol (STP) bridge MIB traps. cluster (Optional) Send cluster member status traps. config (Optional) Send SNMP configuration traps. copy-config (Optional) Send SNMP copy configuration traps. entity (Optional) Send SNMP entity traps. envmon (Optional) Generate environmental monitor traps.2-359 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server host Defaults This command is disabled by default. No notifications are sent. If you enter this command with no keywords, the default is to send all trap types to the host. No informs are sent to this host. If no version keyword is present, the default is version 1. If version 3 is selected and no authentication keyword is entered, the default is the noauth (noAuthNoPriv) security level. Note If the community-string is not defined by using the snmp-server community global configuration command before using this command, the default form of the snmp-server community command is automatically inserted into the configuration. The password (community-string) used for this automatic configuration of the snmp-server community will be the same as that specified in the snmp-server host command. Command Modes Global configuration Command History flash (Optional) Enable SNMP FLASH notifications. fru-ctrl (Optional) Generate entity FRU control traps. In the Catalyst 3750 switch stack, this trap refers to the insertion or removal of a switch in the stack. hsrp (Optional) Send Hot Standby Router Protocol (HSRP) traps. mac-notification (Optional) Send MAC notification traps. port-security (Optional) Send port security traps. rtr (Optional) Send SNMP Response Time Reporter traps. snmp (Optional) Send SNMP-type traps. stpx (Optional) Enable SNMP STP extended MIB traps. syslog (Optional) Enable SNMP syslog traps. tty (Optional) Send Transmission Control Protocol (TCP) connection traps. udp-port (Optional) Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. vlancreate (Optional) Enable SNMP VLAN-created traps. vlandelete (Optional) Enable SNMP VLAN-deleted traps. vlan-membership (Optional) Send SNMP VLAN membership traps. vtp (Optional) Send VLAN Trunking Protocol (VTP) traps. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The bgp, copy-config, flash, port-security, stpx, syslog, vlancreate, and vlandelete keywords were added.2-360 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server host Usage Guidelines SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations. However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network. If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host. When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first. The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command. The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command. Examples This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10: Switch(config)# snmp-server community comaccess ro 10 Switch(config)# snmp-server host 172.20.2.160 comaccess Switch(config)# access-list 10 deny any This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess: Switch(config)# snmp-server enable traps Switch(config)# snmp-server host myhost.cisco.com comaccess snmp 2-361 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp-server host This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public: Switch(config)# snmp-server enable traps Switch(config)# snmp-server host myhost.cisco.com public You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. snmp-server enable traps Enables SNMP notification for various trap types or inform requests.2-362 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp trap mac-notification snmp trap mac-notification Use the snmp trap mac-notification interface configuration command on the switch stack or on a standalone switch to enable the Simple Network Management Protocol (SNMP) MAC address notification trap on a specific Layer 2 interface. Use the no form of this command to return to the default setting. snmp trap mac-notification {added | removed} no snmp trap mac-notification {added | removed} Syntax Description Defaults By default, the traps for both address addition and address removal are disabled. Command Modes Interface configuration Command History Usage Guidelines Even though you enable the notification trap for a specific interface by using the snmp trap mac-notification command, the trap is generated only when you enable the snmp-server enable traps mac-notification and the mac-address-table notification global configuration commands. Examples This example shows how to enable the MAC notification trap when a MAC address is added to Gigabit Ethernet interface1/ 0/4 on stack member 1: Switch(config)# interface gigabitethernet1/0/4 Switch(config-if)# snmp trap mac-notification added You can verify your settings by entering the show mac-address-table notification interface privileged EXEC command. added Enable the MAC notification trap whenever a MAC address is added on this interface. removed Enable the MAC notification trap whenever a MAC address is removed from this interface. Release Modification 12.1(11)AX This command was first introduced.2-363 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands snmp trap mac-notification Related Commands Command Description clear mac-address-table notification Clears the MAC address notification global counters. mac-address-table notification Enables the MAC address notification feature. show mac-address-table notification Displays the MAC address notification settings for all interfaces or on the specified interface when the interface keyword is appended. snmp-server enable traps Sends the SNMP MAC notification traps when the mac-notification keyword is appended.2-364 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree backbonefast spanning-tree backbonefast Use the spanning-tree backbonefast global configuration command on the switch stack or on a standalone switch to enable the BackboneFast feature. Use the no form of the command to return to the default setting. spanning-tree backbonefast no spanning-tree backbonefast Syntax Description This command has no arguments or keywords. Defaults BackboneFast is disabled. Command Modes Global configuration Command History Usage Guidelines The BackboneFast feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+). It is not supported when the switch is operating in the rapid-PVST+ or multiple spanning-tree (MST) mode. BackboneFast starts when a root port or blocked port on a switch receives inferior BPDUs from its designated switch. An inferior BPDU identifies a switch that declares itself as both the root bridge and the designated switch. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated switch has lost its connection to the root switch. If there are alternate paths to the root switch, BackboneFast causes the maximum aging time on the ports on which it received the inferior BPDU to expire and allows a blocked port to move immediately to the listening state. BackboneFast then transitions the interface to the forwarding state. For more information, refer to the software configuration guide for this release. Enable BackboneFast on all supported switches to allow the detection of indirect link failures and to start the spanning-tree reconfiguration sooner. Examples This example shows how to enable BackboneFast on the switch: Switch(config)# spanning-tree backbonefast You can verify your setting by entering the show spanning-tree summary privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show spanning-tree summary Displays a summary of the spanning-tree port states.2-365 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree bpdufilter spanning-tree bpdufilter Use the spanning-tree bpdufilter interface configuration command on the switch stack or on a standalone switch to prevent a port from sending or receiving bridge protocol data units (BPDUs). Use the no form of this command to return to the default setting. spanning-tree bpdufilter {disable | enable} no spanning-tree bpdufilter Syntax Description Defaults BPDU filtering is disabled. Command Modes Interface configuration Command History Usage Guidelines You can enable the BPDU filtering feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode. Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops. You can globally enable BPDU filtering on all Port Fast-enabled ports by using the spanning-tree portfast bpdufilter default global configuration command. You can use the spanning-tree bpdufilter interface configuration command to override the setting of the spanning-tree portfast bpdufilter default global configuration command. Examples This example shows how to enable the BPDU filtering feature on a port on stack member 2: Switch(config)# interface fastethernet2/0/1 Switch(config-if)# spanning-tree bpdufilter enable You can verify your setting by entering the show running-config privileged EXEC command. disable Disable BPDU filtering on the specified interface. enable Enable BPDU filtering on the specified interface. Release Modification 12.1(11)AX This command was first introduced.2-366 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree bpdufilter Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree portfast (global configuration) Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports. spanning-tree portfast (interface configuration) Enables the Port Fast feature on an interface and all its associated VLANs.2-367 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree bpduguard spanning-tree bpduguard Use the spanning-tree bpduguard interface configuration command on the switch stack or on a standalone switch to put a port in the error-disabled state when it receives a bridge protocol data unit (BPDU). Use the no form of this command to return to the default setting. spanning-tree bpduguard {disable | enable} no spanning-tree bpduguard Syntax Description Defaults BPDU guard is disabled. Command Modes Interface configuration Command History Usage Guidelines The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent a port from being included in the spanning-tree topology. You can enable the BPDU guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode. You can globally enable BPDU guard on all Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command. You can use the spanning-tree bpduguard interface configuration command to override the setting of the spanning-tree portfast bpduguard default global configuration command. Examples This example shows how to enable the BPDU guard feature on a port on stack member 2: Switch(config)# interface fastethernet2/0/1 Switch(config-if)# spanning-tree bpduguard enable You can verify your setting by entering the show running-config privileged EXEC command. disable Disable BPDU guard on the specified interface. enable Enable BPDU guard on the specified interface. Release Modification 12.1(11)AX This command was first introduced.2-368 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree bpduguard Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree portfast (global configuration) Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports. spanning-tree portfast (interface configuration) Enables the Port Fast feature on an interface and all its associated VLANs.2-369 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree cost spanning-tree cost Use the spanning-tree cost interface configuration command on the switch stack or on a standalone switch to set the path cost for spanning-tree calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to place in the forwarding state. Use the no form of this command to return to the default setting. spanning-tree [vlan vlan-id] cost cost no spanning-tree [vlan vlan-id] cost Syntax Description Defaults The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values: • 1000 Mbps—4 • 100 Mbps—19 • 10 Mbps—100 Command Modes Interface configuration Command History Usage Guidelines When you configure the cost, higher values represent higher costs. If you configure an interface with both the spanning-tree vlan vlan-id cost cost command and the spanning-tree cost cost command, the spanning-tree vlan vlan-id cost cost command takes effect. Examples This example shows how to set the path cost to 250 on an interface on stack member 2: Switch(config)# interface fastethernet2/0/4 Switch(config-if)# spanning-tree cost 250 vlan vlan-id (Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. cost Path cost. The range is 1 to 200000000, with higher values meaning higher costs. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The value for the vlan-id variable was changed.2-370 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree cost This example shows how to set a path cost to 300 for VLANs 10, 12 to 15, and 20: Switch(config-if)# spanning-tree vlan 10,12-15,20 cost 300 You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command. Related Commands Command Description show spanning-tree interface interface-id Displays spanning-tree information for the specified interface. spanning-tree port-priority Configures an interface priority. spanning-tree vlan priority Sets the switch priority for the specified spanning-tree instance. 2-371 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree extend system-id spanning-tree extend system-id Use the spanning-tree extend system-id global configuration command on the switch stack or on a standalone switch to enable the extended system ID feature. spanning-tree extend system-id Note Though visible in the command-line help strings, the no version of this command is not supported. You cannot disable the extended system ID feature. Syntax Description This command has no arguments or keywords. Defaults The extended system ID is enabled. Command Modes Global configuration Command History Usage Guidelines The Catalyst 3750 switch supports the 802.1T spanning-tree extensions. Some of the bits previously used for the switch priority are now used for the extended system ID (VLAN identifier for the per-VLAN spanning-tree plus [PVST+] and rapid PVST+ or an instance identifier for the multiple spanning tree [MST]). The spanning tree uses the extended system ID, the switch priority, and the allocated spanning-tree MAC address to make the bridge ID unique for each VLAN or multiple spanning-tree instance. Because the Catalyst 3750 switch stack appears as a single switch to the rest of the network, all switches in the stack use the same bridge ID for a given spanning tree. If the stack master fails, the stack members recalculate their bridge IDs of all running spanning trees based on the new MAC address of the stack master. Support for the extended system ID affects how you manually configure the root switch, the secondary root switch, and the switch priority of a VLAN. For more information, see the “spanning-tree mst root” and the “spanning-tree vlan” sections. If your network consists of switches that do not support the extended system ID and switches that do support it, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches. Release Modification 12.1(11)AX This command was first introduced.2-372 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree extend system-id Related Commands Command Description show spanning-tree summary Displays a summary of spanning-tree port states. spanning-tree mst root Configures the MST root switch priority and timers based on the network diameter. spanning-tree vlan priority Sets the switch priority for the specified spanning-tree instance.2-373 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree guard spanning-tree guard Use the spanning-tree guard interface configuration command on the switch stack or on a standalone switch to enable root guard or loop guard on all the VLANs associated with the selected interface. Root guard restricts which interface is allowed to be the spanning-tree root port or the path-to-the root for the switch. Loop guard prevents alternate or root ports from becoming designated ports when a failure creates a unidirectional link. Use the no form of this command to return to the default setting. spanning-tree guard {loop | none | root} no spanning-tree guard Syntax Description Defaults Root guard is disabled. Loop guard is configured according to the spanning-tree loopguard default global configuration command (globally disabled). Command Modes Interface configuration Command History Usage Guidelines You can enable root guard or loop guard when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode. When root guard is enabled, if spanning-tree calculations cause a port to be selected as the root port, the port transitions to the root-inconsistent (blocked) state to prevent the customer’s switch from becoming the root switch or being in the path to the root. The root port provides the best path from the switch to the root switch. When the no spanning-tree guard or the no spanning-tree guard none command is entered, root guard is disabled for all VLANs on the selected interface. If this interface is in the root-inconsistent (blocked) state, it automatically transitions to the listening state. Do not enable root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state. The UplinkFast feature is not available when the switch is operating in the rapid-PVST+ or MST mode. loop Enable loop guard. none Disable root guard or loop guard. root Enable root guard. Release Modification 12.1(11)AX This command was first introduced.2-374 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree guard Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports if the port is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the port in all MST instances. To disable root guard or loop guard, use the spanning-tree guard none interface configuration command. You cannot enable both root guard and loop guard at the same time. You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command. Examples This example shows how to enable root guard on all the VLANs associated with the specified interface on stack member 2: Switch(config)# interface fastethernet2/0/3 Switch(config-if)# spanning-tree guard root This example shows how to enable loop guard on all the VLANs associated with the specified interface on stack member 2: Switch(config)# interface fastethernet2/0/3 Switch(config-if)# spanning-tree guard loop You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree cost Sets the path cost for spanning-tree calculations. spanning-tree loopguard default Prevents alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. spanning-tree mst cost Configures the path cost for MST calculations. spanning-tree mst port-priority Configures an interface priority. spanning-tree mst root Configures the MST root switch priority and timers based on the network diameter. spanning-tree port-priority Configures an interface priority. spanning-tree vlan priority Sets the switch priority for the specified spanning-tree instance.2-375 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree link-type spanning-tree link-type Use the spanning-tree link-type interface configuration command on the switch stack or on a standalone switch to override the default link-type setting, which is determined by the duplex mode of the port, and to enable rapid spanning-tree transitions to the forwarding state. Use the no form of this command to return to the default setting. spanning-tree link-type {point-to-point | shared} no spanning-tree link-type Syntax Description Defaults The switch derives the link type of a port from the duplex mode. A full-duplex port is considered a point-to-point link, and a half-duplex port is considered a shared link. Command Modes Interface configuration Command History Usage Guidelines You can override the default setting of the link type by using the spanning-tree link-type command; for example, a half-duplex link can be physically connected point-to-point to a single port on a remote switch running the Multiple Spanning Tree Protocol (MSTP) or the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol and be enabled for rapid transitions. Examples This example shows how to specify the link type as shared (regardless of the duplex setting) and to prevent rapid transitions to the forwarding state: Switch(config-if)# spanning-tree link-type shared You can verify your setting by entering the show spanning-tree mst interface interface-id or the show spanning-tree interface interface-id privileged EXEC command. point-to-point Specify that the link type of a port is point-to-point. shared Specify that the link type of a port is shared. Release Modification 12.1(14)EA1 This command was first introduced.2-376 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree link-type Related Commands Command Description clear spanning-tree detected-protocols Restarts the protocol migration process (force the renegotiation with neighboring switches) on all interfaces or on the specified interface. show spanning-tree interface interface-id Displays spanning-tree state information for the specified interface. show spanning-tree mst interface interface-id Displays multiple spanning-tree (MST) information for the specified interface.2-377 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree loopguard default spanning-tree loopguard default Use the spanning-tree loopguard default global configuration command on the switch stack or on a standalone switch to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. Use the no form of this command to return to the default setting. spanning-tree loopguard default no spanning-tree loopguard default Syntax Description This command has no arguments or keywords. Defaults Loop guard is disabled. Command Modes Global configuration Command History Usage Guidelines You can enable the loop guard feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode. Loop guard is most effective when it is configured on the entire switched network. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send bridge protocol data units (BPDUs) on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports if the port is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the port in all MST instances. Loop guard operates only on ports that are considered point-to-point by the spanning tree. You can override the setting of the spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command. Examples This example shows how to globally enable loop guard: Switch(config)# spanning-tree loopguard default You can verify your settings by entering the show running-config privileged EXEC command. Release Modification 12.1(11)AX This command was first introduced.2-378 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree loopguard default Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree guard loop Enables the loop guard feature on all the VLANs associated with the specified interface.2-379 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mode spanning-tree mode Use the spanning-tree mode global configuration command on the switch stack or on a standalone switch to enable per-VLAN spanning-tree plus (PVST+), rapid PVST+, or multiple spanning tree (MST) on your switch. Use the no form of this command to return to the default setting. spanning-tree mode {mst | pvst | rapid-pvst} no spanning-tree mode Syntax Description Defaults The default mode is PVST+. Command Modes Global configuration Command History Usage Guidelines The switch supports PVST+, rapid PVST+, and MSTP, but only one version can be active at any time: All VLANs run PVST+, all VLANs run rapid PVST+, or all VLANs run MSTP. All stack members run the same version of spanning-tree. When you enable the MST mode, RSTP is automatically enabled. Caution Changing spanning-tree modes can disrupt traffic because all spanning-tree instances are stopped for the previous mode and restarted in the new mode. Examples This example shows to enable MST and RSTP on the switch: Switch(config)# spanning-tree mode mst This example shows to enable rapid PVST+ on the switch: Switch(config)# spanning-tree mode rapid-pvst You can verify your setting by entering the show running-config privileged EXEC command. mst Enable MST and Rapid Spanning Tree Protocol (RSTP) (based on IEEE 802.1S and IEEE 802.1W). pvst Enable PVST+ (based on IEEE 802.1D). rapid-pvst Enable rapid PVST+ (based on IEEE 802.1W). Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The mst and rapid-pvst keywords were added.2-380 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mode Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-381 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst configuration spanning-tree mst configuration Use the spanning-tree mst configuration global configuration command on the switch stack or on a standalone switch to enter multiple spanning-tree (MST) configuration mode through which you configure the MST region. Use the no form of this command to return to the default settings. spanning-tree mst configuration no spanning-tree mst configuration Syntax Description This command has no arguments or keywords. Defaults The default mapping is that all VLANs are mapped to the common and internal spanning-tree (CIST) instance (instance 0). The default name is an empty string. The revision number is 0. Command Modes Global configuration Command History Usage Guidelines The spanning-tree mst configuration command enables the MST configuration mode. These configuration commands are available: • abort: exits the MST region configuration mode without applying configuration changes. • exit: exits the MST region configuration mode and applies all configuration changes. • instance instance-id vlan vlan-range: maps VLANs to an MST instance. The range for the instance-id is 1 to 15. The range for vlan-range is 1 to 4094. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. • name name: sets the configuration name. The name string has a maximum length of 32 characters and is case sensitive. • no: negates the instance, name, and revision commands or sets them to their defaults. • private-vlan: Though visible in the command-line help strings, this command is not supported. • revision version: sets the configuration revision number. The range is 0 to 65535. • show [current | pending]: displays the current or pending MST region configuration. In MST mode, the switch stack supports up to 16 MST instances. The number of VLANs that can be mapped to a particular MST instance is unlimited. Release Modification 12.1(14)EA1 This command was first introduced.2-382 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst configuration When you map VLANs to an MST instance, the mapping is incremental, and VLANs specified in the command are added to or removed from the VLANs that were previously mapped. To specify a range, use a hyphen; for example, instance 1 vlan 1-63 maps VLANs 1 to 63 to MST instance 1. To specify a series, use a comma; for example, instance 1 vlan 10, 20, 30 maps VLANs 10, 20, and 30 to MST instance 1. All VLANs that are not explicitly mapped to an MST instance are mapped to the common and internal spanning tree (CIST) instance (instance 0) and cannot be unmapped from the CIST by using the no form of the command. For two or more switches to be in the same MST region, they must have the same VLAN mapping, the same configuration revision number, and the same name. Examples This example shows how to enter MST configuration mode, map VLANs 10 to 20 to MST instance 1, name the region region1, set the configuration revision to 1, display the pending configuration, apply the changes, and return to global configuration mode: Switch# spanning-tree mst configuration Switch(config-mst)# instance 1 vlan 10-20 Switch(config-mst)# name region1 Switch(config-mst)# revision 1 Switch(config-mst)# show pending Pending MST configuration Name [region1] Revision 1 Instance Vlans Mapped -------- --------------------- 0 1-9,21-4094 1 10-20 ------------------------------- Switch(config-mst)# exit Switch(config)# This example shows how to add VLANs 1 to 100 to the ones already mapped (if any) to instance 2, to move VLANs 40 to 60 that were previously mapped to instance 2 to the CIST instance, to add VLAN 10 to instance 10, and to remove all the VLANs mapped to instance 2 and map them to the CIST instance: Switch(config-mst)# instance 2 vlan 1-100 Switch(config-mst)# no instance 2 vlan 40-60 Switch(config-mst)# instance 10 vlan 10 Switch(config-mst)# no instance 2 You can verify your settings by entering the show pending MST configuration command. Related Commands Command Description show spanning-tree mst configuration Displays the MST region configuration.2-383 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst cost spanning-tree mst cost Use the spanning-tree mst cost interface configuration command on the switch stack or on a standalone switch to set the path cost for multiple spanning-tree (MST) calculations. If a loop occurs, spanning tree considers the path cost when selecting an interface to put in the forwarding state. Use the no form of this command to return to the default setting. spanning-tree mst instance-id cost cost no spanning-tree mst instance-id cost Syntax Description Defaults The default path cost is computed from the interface bandwidth setting. These are the IEEE default path cost values: • 1000 Mbps—20000 • 100 Mbps—200000 • 10 Mbps—2000000 Command Modes Interface configuration Command History Usage Guidelines When you configure the cost, higher values represent higher costs. Examples This example shows how to set a path cost of 250 on an interface associated with instances 2 and 4: Switch(config)# interface gigabitethernet1/0/4 Switch(config-if)# spanning-tree mst 2,4 cost 250 You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command. instance-id Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. cost Path cost is 1 to 200000000, with higher values meaning higher costs. Release Modification 12.1(14)EA1 This command was first introduced.2-384 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst cost Related Commands Command Description show spanning-tree mst interface interface-id Displays MST information for the specified interface. spanning-tree mst port-priority Configures an interface priority. spanning-tree mst priority Configures the switch priority for the specified spanning-tree instance.2-385 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst forward-time spanning-tree mst forward-time Use the spanning-tree mst forward-time global configuration command on the switch stack or on a standalone switch to set the forward-delay time for all multiple spanning-tree (MST) instances. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. Use the no form of this command to return to the default setting. spanning-tree mst forward-time seconds no spanning-tree mst forward-time Syntax Description Defaults The default is 15 seconds. Command Modes Global configuration Command History Usage Guidelines Changing the spanning-tree mst forward-time command affects all spanning-tree instances. Examples This example shows how to set the spanning-tree forwarding time to 18 seconds for all MST instances: Switch(config)# spanning-tree mst forward-time 18 You can verify your setting by entering the show spanning-tree mst privileged EXEC command. Related Commands seconds Length of the listening and learning states. The range is 4 to 30 seconds. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show spanning-tree mst Displays MST information. spanning-tree mst hello-time Sets the interval between hello bridge protocol data units (BPDUs) sent by root switch configuration messages. spanning-tree mst max-age Sets the interval between messages that the spanning tree receives from the root switch. spanning-tree mst max-hops Sets the number of hops in a region before the BPDU is discarded.2-386 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst hello-time spanning-tree mst hello-time Use the spanning-tree mst hello-time global configuration command on the switch stack or on a standalone switch to set the interval between hello bridge protocol data units (BPDUs) sent by root switch configuration messages. Use the no form of this command to return to the default setting. spanning-tree mst hello-time seconds no spanning-tree mst hello-time Syntax Description Defaults The default is 2 seconds. Command Modes Global configuration Command History Usage Guidelines After you set the spanning-tree mst max-age seconds global configuration command, if a switch does not receive BPDUs from the root switch within the specified interval, the switch recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting. Changing the spanning-tree mst hello-time command affects all spanning-tree instances. Examples This example shows how to set the spanning-tree hello time to 3 seconds for all multiple spanning-tree (MST) instances: Switch(config)# spanning-tree mst hello-time 3 You can verify your setting by entering the show spanning-tree mst privileged EXEC command. Related Commands seconds Interval between hello BPDUs sent by root switch configuration messages. The range is 1 to 10 seconds. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show spanning-tree mst Displays MST information. spanning-tree mst forward-time Sets the forward-delay time for all MST instances. spanning-tree mst max-age Sets the interval between messages that the spanning tree receives from the root switch. spanning-tree mst max-hops Sets the number of hops in a region before the BPDU is discarded.2-387 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst max-age spanning-tree mst max-age Use the spanning-tree mst max-age global configuration command on the switch stack or on a standalone switch to set the interval between messages that the spanning tree receives from the root switch. If a switch does not receive a bridge protocol data unit (BPDU) message from the root switch within this interval, it recomputes the spanning-tree topology. Use the no form of this command to return to the default setting. spanning-tree mst max-age seconds no spanning-tree mst max-age Syntax Description Defaults The default is 20 seconds. Command Modes Global configuration Command History Usage Guidelines After you set the spanning-tree mst max-age seconds global configuration command, if a switch does not receive BPDUs from the root switch within the specified interval, the switch recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting. Changing the spanning-tree mst max-age command affects all spanning-tree instances. Examples This example shows how to set the spanning-tree max-age to 30 seconds for all multiple spanning-tree (MST) instances: Switch(config)# spanning-tree mst max-age 30 You can verify your setting by entering the show spanning-tree mst privileged EXEC command. seconds Interval between messages the spanning tree receives from the root switch. The range is 6 to 40 seconds. Release Modification 12.1(14)EA1 This command was first introduced.2-388 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst max-age Related Commands Command Description show spanning-tree mst Displays MST information. spanning-tree mst forward-time Sets the forward-delay time for all MST instances. spanning-tree mst hello-time Sets the interval between hello BPDUs sent by root switch configuration messages. spanning-tree mst max-hops Sets the number of hops in a region before the BPDU is discarded.2-389 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst max-hops spanning-tree mst max-hops Use the spanning-tree mst max-hops global configuration command on the switch stack or on a standalone switch to set the number of hops in a region before the bridge protocol data unit (BPDU) is discarded and the information held for a port is aged. Use the no form of this command to return to the default setting. spanning-tree mst max-hops hop-count no spanning-tree mst max-hops Syntax Description Defaults The default is 20 hops. Command Modes Global configuration Command History Usage Guidelines The root switch of the instance always sends a BPDU (or M-record) with a cost of 0 and the hop count set to the maximum value. When a switch receives this BPDU, it decrements the received remaining hop count by one and propagates the decremented count as the remaining hop count in the generated M-records. A switch discards the BPDU and ages the information held for the port when the count reaches 0. Changing the spanning-tree mst max-hops command affects all spanning-tree instances. Examples This example shows how to set the spanning-tree max-hops to 10 for all multiple spanning-tree (MST) instances: Switch(config)# spanning-tree mst max-hops 10 You can verify your setting by entering the show spanning-tree mst privileged EXEC command. hop-count Number of hops in a region before the BPDU is discarded. The range is 1 to 40 hops. Release Modification 12.1(14)EA1 This command was first introduced.2-390 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst max-hops Related Commands Command Description show spanning-tree mst Displays MST information. spanning-tree mst forward-time Sets the forward-delay time for all MST instances. spanning-tree mst hello-time Sets the interval between hello BPDUs sent by root switch configuration messages. spanning-tree mst max-age Sets the interval between messages that the spanning tree receives from the root switch.2-391 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst port-priority spanning-tree mst port-priority Use the spanning-tree mst port-priority interface configuration command on the switch stack or on a standalone switch to configure an interface priority. If a loop occurs, the Multiple Spanning Tree Protocol (MSTP) can determine which interface to put in the forwarding state. Use the no form of this command to return to the default setting. spanning-tree mst instance-id port-priority priority no spanning-tree mst instance-id port-priority Syntax Description Defaults The default is 128. Command Modes Interface configuration Command History Usage Guidelines You can assign higher priority values (lower numerical values) to interfaces that you want selected first and lower priority values (higher numerical values) that you want selected last. If all interfaces have the same priority value, the multiple spanning tree (MST) puts the interface with the lowest interface number in the forwarding state and blocks other interfaces. If your switch is a member of a switch stack, you must use the spanning-tree mst [instance-id] cost cost interface configuration command instead of the spanning-tree mst [instance vlan-id] port-priority priority interface configuration command to select an interface to put in the forwarding state. Assign lower cost values to interfaces that you want selected first and higher cost values to interfaces that you want selected last. instance-id Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. priority The range is 0 to 240 in increments of 16. Valid priority values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority. Release Modification 12.1(14)EA1 This command was first introduced.2-392 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst port-priority Examples This example shows how to increase the likelihood that the interface associated with spanning-tree instances 20 and 22 is placed into the forwarding state if a loop occurs: Switch(config)# interface gigabitethernet2/0/2 Switch(config-if)# spanning-tree mst 20,22 port-priority 0 You can verify your settings by entering the show spanning-tree mst interface interface-id privileged EXEC command. Related Commands Command Description show spanning-tree mst interface interface-id Displays MST information for the specified interface. spanning-tree mst cost Sets the path cost for MST calculations. spanning-tree mst priority Sets the switch priority for the specified spanning-tree instance.2-393 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst priority spanning-tree mst priority Use the spanning-tree mst priority global configuration command on the switch stack or on a standalone switch to set the switch priority for the specified spanning-tree instance. Use the no form of this command to return to the default setting. spanning-tree mst instance-id priority priority no spanning-tree mst instance-id priority Syntax Description Defaults The default is 32768. Command Modes Global configuration Command History Examples This example shows how to set the spanning-tree priority to 8192 for multiple spanning-tree instances (MST) 20 to 21: Switch(config)# spanning-tree mst 20-21 priority 8192 You can verify your settings by entering the show spanning-tree mst instance-id privileged EXEC command. Related Commands instance-id Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. priority Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that the switch is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch. The range is 0 to 61440 in increments of 4096. Valid priority values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show spanning-tree mst instance-id Displays MST information for the specified interface. spanning-tree mst cost Sets the path cost for MST calculations. spanning-tree mst port-priority Configures an interface priority.2-394 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst root spanning-tree mst root Use the spanning-tree mst root global configuration command on the switch stack or on a standalone switch to configure the multiple spanning-tree (MST) root switch priority and timers based on the network diameter. Use the no form of this command to return to the default settings. spanning-tree mst instance-id root {primary | secondary} [diameter net-diameter [hello-time seconds]] no spanning-tree mst instance-id root Syntax Description Defaults The primary root switch priority is 24576. The secondary root switch priority is 28672. The hello time is 2 seconds. Command Modes Global configuration Command History Usage Guidelines Use the spanning-tree mst instance-id root command only on backbone switches. When you enter the spanning-tree mst instance-id root command, the software tries to set a high enough priority to make this switch the root of the spanning-tree instance. Because of the extended system ID support, the switch sets the switch priority for the instance to 24576 if this value will cause this switch to become the root for the specified instance. If any root switch for the specified instance has a switch priority lower than 24576, the switch sets its own priority to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.) instance-id Range of spanning-tree instances. You can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. root primary Force this switch to be the root switch. root secondary Set this switch to be the root switch should the primary root switch fail. diameter net-diameter (Optional) Set the maximum number of switches between any two end stations. The range is 2 to 7. This keyword is available only for MST instance 0. hello-time seconds (Optional) Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds. This keyword is available only for MST instance 0. Release Modification 12.1(14)EA1 This command was first introduced.2-395 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree mst root When you enter the spanning-tree mst instance-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch fails, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768 and are therefore unlikely to become the root switch). Examples This example shows how to configure the switch as the root switch for instance 10 with a network diameter of 4: Switch(config)# spanning-tree mst 10 root primary diameter 4 This example shows how to configure the switch as the secondary root switch for instance 10 with a network diameter of 4: Switch(config)# spanning-tree mst 10 root secondary diameter 4 You can verify your settings by entering the show spanning-tree mst instance-id privileged EXEC command. Related Commands Command Description show spanning-tree mst instance-id Displays MST information for the specified instance. spanning-tree mst forward-time Sets the forward-delay time for all MST instances. spanning-tree mst hello-time Sets the interval between hello BPDUs sent by root switch configuration messages. spanning-tree mst max-age Sets the interval between messages that the spanning tree receives from the root switch. spanning-tree mst max-hops Sets the number of hops in a region before the BPDU is discarded.2-396 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree port-priority spanning-tree port-priority Use the spanning-tree port-priority interface configuration command on the switch stack or on a standalone switch to configure an interface priority. If a loop occurs, spanning tree can determine which interface to put in the forwarding state. Use the no form of this command to return to the default setting. spanning-tree [vlan vlan-id] port-priority priority no spanning-tree [vlan vlan-id] port-priority Syntax Description Defaults The default is 128. Command Modes Interface configuration Command History Usage Guidelines If the variable vlan-id is omitted, the command applies to the spanning-tree instance associated with VLAN 1. You can set the priority on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign the interface to the VLAN. If you configure an interface with both the spanning-tree vlan vlan-id port-priority priority command and the spanning-tree port-priority priority command, the spanning-tree vlan vlan-id port-priority priority command takes effect. If your switch is a member of a switch stack, you must use the spanning-tree [vlan vlan-id] cost cost interface configuration command instead of the spanning-tree [vlan vlan-id] port-priority priority interface configuration command to select an interface to put in the forwarding state. Assign lower cost values to interfaces that you want selected first and higher cost values that you want selected last. vlan vlan-id (Optional) VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. priority Number from 0 to 240, in increments of 16. Valid values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority. Release Modification 12.1(14)EA1 The value for the vlan-id variable was changed. The priority range values changed.2-397 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree port-priority Examples This example shows how to increase the likelihood that Fast Ethernet interface 0/2 on stack member 2 will be put in the forwarding state if a loop occurs: Switch(config)# interface fastethernet2/0/2 Switch(config-if)# spanning-tree vlan 20 port-priority 0 This example shows how to set the port-priority value on VLANs 20 to 25: Switch(config-if)# spanning-tree vlan 20-25 port-priority 0 You can verify your settings by entering the show spanning-tree interface interface-id privileged EXEC command. Related Commands Command Description show spanning-tree interface interface-id Displays spanning-tree information for the specified interface. spanning-tree cost Sets the path cost for spanning-tree calculations. spanning-tree vlan priority Sets the switch priority for the specified spanning-tree instance.2-398 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree portfast (global configuration) spanning-tree portfast (global configuration) Use the spanning-tree portfast global configuration command on the switch stack or on a standalone switch to globally enable bridge protocol data unit (BPDU) filtering on Port Fast-enabled ports, the BPDU guard feature on Port Fast-enabled ports, or the Port Fast feature on all nontrunking ports. The BPDU filtering feature prevents the switch port from sending or receiving BPDUs. The BPDU guard feature puts Port Fast-enabled ports that receive BPDUs in an error-disabled state. Use the no form of this command to return to the default settings. spanning-tree portfast {bpdufilter default | bpduguard default | default} no spanning-tree portfast {bpdufilter default | bpduguard default | default} Syntax Description Defaults The BPDU filtering, the BPDU guard, and the Port Fast features are disabled on all ports unless they are individually configured. Command Modes Global configuration Command History Usage Guidelines You can enable these features when the switch is operating in the per-VLAN spanning-tree plus (PVST+) rapid-PVST+, or the multiple spanning-tree (MST) mode. Use the spanning-tree portfast bpdufilter default global configuration command to globally enable BPDU filtering on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state). The ports still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to switch ports do not receive BPDUs. If a BPDU is received on a Port Fast-enabled port, the port loses its Port Fast-operational status and BPDU filtering is disabled. You can override the spanning-tree portfast bpdufilter default global configuration command by using the spanning-tree bdpufilter interface configuration command. bpdufilter default Globally enable BPDU filtering on Port Fast-enabled ports and prevent the switch port connected to end stations from sending or receiving BPDUs. bpduguard default Globally enable the BPDU guard feature on Port Fast-enabled ports and place the ports that receive BPDUs in an error-disabled state. default Globally enable the Port Fast feature on all nontrunking ports. When the Port Fast feature is enabled, the port changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes. Release Modification 12.1(11)AX This command was first introduced.2-399 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree portfast (global configuration) Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops. Use the spanning-tree portfast bpduguard default global configuration command to globally enable BPDU guard on ports that are in a Port Fast-operational state. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree. You can override the spanning-tree portfast bpduguard default global configuration command by using the spanning-tree bdpuguard interface configuration command. Use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking ports. Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. A Port Fast-enabled port moves directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-delay time. You can override the spanning-tree portfast default global configuration command by using the spanning-tree portfast interface configuration command. You can use the no spanning-tree portfast default global configuration command to disable Port Fast on all ports unless they are individually configured with the spanning-tree portfast interface configuration command. Examples This example shows how to globally enable the BPDU filtering feature: Switch(config)# spanning-tree portfast bpdufilter default This example shows how to globally enable the BPDU guard feature: Switch(config)# spanning-tree portfast bpduguard default This example shows how to globally enable the Port Fast feature on all nontrunking ports: Switch(config)# spanning-tree portfast default You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree bpdufilter Prevents a port from sending or receiving BPDUs. spanning-tree bpduguard Puts a port in the error-disabled state when it receives a BPDU. spanning-tree portfast (interface configuration) Enables the Port Fast feature on an interface in all its associated VLANs.2-400 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree portfast (interface configuration) spanning-tree portfast (interface configuration) Use the spanning-tree portfast interface configuration command on the switch stack or on a standalone switch to enable the Port Fast feature on an interface in all its associated VLANs. When the Port Fast feature is enabled, the interface changes directly from a blocking state to a forwarding state without making the intermediate spanning-tree state changes. Use the no form of this command to return to the default setting. spanning-tree portfast [disable | trunk] no spanning-tree portfast Syntax Description Defaults The Port Fast feature is disabled on all interfaces; however, it is automatically enabled on dynamic-access ports. Command Modes Interface configuration Command History Usage Guidelines Use this feature only on interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. You can enable this feature when the switch is operating in the per-VLAN spanning-tree plus (PVST+), rapid-PVST+, or the multiple spanning-tree (MST) mode. This feature affects all VLANs on the interface. A port with the Port Fast feature enabled is moved directly to the spanning-tree forwarding state without waiting the standard forward-time delay. You can use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking interfaces. However, the spanning-tree portfast interface configuration command can override the global setting. If you configure the spanning-tree portfast default global configuration command, you can enable Port Fast on a port that is not a trunk port by using the no spanning-tree portfast interface configuration command. The no spanning-tree portfast interface configuration command is the same as the spanning-tree portfast disable interface configuration command. disable (Optional) Disable the Port Fast feature on the specified interface. trunk (Optional) Enable the Port Fast feature on a trunking interface. Release Modification 12.1(11)AX This command was first introduced.2-401 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree portfast (interface configuration) Examples This example shows how to enable the Port Fast feature on an interface on stack member 2: Switch(config)# interface fastethernet2/0/2 Switch(config-if)# spanning-tree portfast You can verify your settings by entering the show running-config privileged EXEC command. Related Commands Command Description show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. spanning-tree bpdufilter Prevents a port from sending or receiving bridge protocol data units (BPDUs). spanning-tree bpduguard Puts a port in the error-disabled state when it receives a BPDU. spanning-tree portfast (global configuration) Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports.2-402 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree uplinkfast spanning-tree uplinkfast Use the spanning-tree uplinkfast global configuration command on the switch stack or on a standalone switch to accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. Use the no form of this command to return to the default setting. spanning-tree uplinkfast [max-update-rate pkts-per-second] no spanning-tree uplinkfast [max-update-rate] Syntax Description Defaults UplinkFast is disabled. The update rate is 150 packets per second. Command Modes Global configuration Command History Usage Guidelines Use this command only on access switches. The UplinkFast feature is supported only when the switch is running per-VLAN spanning-tree plus (PVST+). It is not supported when the switch is operating in the rapid-PVST+ or multiple spanning-tree (MST) mode. When you enable UplinkFast, it is enabled for the entire switch and cannot be enabled for individual VLANs. When you enable or disable UplinkFast, cross-stack UplinkFast (CSUF) also is automatically enabled or disabled on all nonstack port interfaces. CSUF accelerates the choice of a new root port when a link or switch fails or when spanning tree reconfigures itself. When UplinkFast is enabled, the switch priority of all VLANs is set to 49152. If you change the path cost to a value less than 3000 and you enable UplinkFast or UplinkFast is already enabled, the path cost of all interfaces and VLAN trunks is increased by 3000 (if you change the path cost to 3000 or above, the path cost is not altered). The changes to the switch priority and the path cost reduces the chance that a switch will become the root switch. When UplinkFast is disabled, the switch priorities of all VLANs and path costs of all interfaces are set to default values if you did not modify them from their defaults. When spanning tree detects that the root port has failed, UplinkFast immediately switches over to an alternate root port, changing the new root port directly to FORWARDING state. During this time, a topology change notification is sent. max-update-rate pkts-per-second (Optional) The number of packets per second at which update packets are sent. The range is 0 to 32000. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The max-update-rate keyword was added.2-403 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree uplinkfast Do not enable the root guard on interfaces that will be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and prevented from reaching the forwarding state. If you set the max-update-rate to 0, station-learning frames are not generated, so the spanning-tree topology converges more slowly after a loss of connectivity. Examples This example shows how to enable UplinkFast: Switch(config)# spanning-tree uplinkfast You can verify your setting by entering the show spanning-tree summary privileged EXEC command. Related Commands Command Description show spanning-tree summary Displays a summary of the spanning-tree port states. spanning-tree vlan root primary Forces this switch to be the root switch.2-404 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree vlan spanning-tree vlan Use the spanning-tree vlan global configuration command on the switch stack or on a standalone switch to configure spanning tree on a per-VLAN basis. Use the no form of this command to return to the default setting. spanning-tree vlan vlan-id [forward-time seconds | hello-time seconds | max-age seconds | priority priority | root {primary | secondary} [diameter net-diameter [hello-time seconds]]] no spanning-tree vlan vlan-id [forward-time | hello-time | max-age | priority | root] Syntax Description Defaults Spanning tree is enabled on all VLANs. The forward-delay time is 15 seconds. The hello time is 2 seconds. The max-age is 20 seconds. vlan-id VLAN range associated with a spanning-tree instance. You can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. forward-time seconds (Optional) Set the forward-delay time for the specified spanning-tree instance. The forwarding time determines how long each of the listening and learning states last before the interface begins forwarding. The range is 4 to 30 seconds. hello-time seconds (Optional) Set the interval between hello bridge protocol data units (BPDUs) sent by the root switch configuration messages. The range is 1 to 10 seconds. max-age seconds (Optional) Set the interval between messages the spanning tree receives from the root switch. If a switch does not receive a BPDU message from the root switch within this interval, it recomputes the spanning-tree topology. The range is 6 to 40 seconds. priority priority (Optional) Set the switch priority for the specified spanning-tree instance. This setting affects the likelihood that a standalone switch or a switch in the stack is selected as the root switch. A lower value increases the probability that the switch is selected as the root switch. The range is 0 to 61440 in increments of 4096. Valid priority values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected. root primary (Optional) Force this switch to be the root switch. root secondary (Optional) Set this switch to be the root switch should the primary root switch fail. diameter net-diameter (Optional) Set the maximum number of switches between any two end stations. The range is 2 to 7.2-405 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree vlan The primary root switch priority is 24576. The secondary root switch priority is 28672. Command Modes Global configuration Command History Usage Guidelines Disabling the STP causes the VLAN to stop participating in the spanning-tree topology. Interfaces that are administratively down remain down. Received BPDUs are forwarded like other multicast frames. The VLAN does not detect and prevent loops when STP is disabled. You can disable the STP on a VLAN that is not currently active and verify the change by using the show running-config or the show spanning-tree vlan vlan-id privileged EXEC command. The setting takes effect when the VLAN is activated. When disabling or re-enabling the STP, you can specify a range of VLANs that you want to disable or enable. When a VLAN is disabled and then enabled, all assigned VLANs continue to be its members. However, all spanning-tree bridge parameters are returned to their previous settings (the last setting before the VLAN was disabled). You can enable spanning-tree options on a VLAN that has no interfaces assigned to it. The setting takes effect when you assign interfaces to it. When setting the max-age seconds, if a switch does not receive BPDUs from the root switch within the specified interval, it recomputes the spanning-tree topology. The max-age setting must be greater than the hello-time setting. The spanning-tree vlan vlan-id root command should be used only on backbone switches. When you enter the spanning-tree vlan vlan-id root command, the software checks the switch priority of the current root switch for each VLAN. Because of the extended system ID support, the switch sets the switch priority for the specified VLAN to 24576 if this value will cause this switch to become the root for the specified VLAN. If any root switch for the specified VLAN has a switch priority lower than 24576, the switch sets its own priority for the specified VLAN to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value.) When you enter the spanning-tree vlan vlan-id root secondary command, because of support for the extended system ID, the software changes the switch priority from the default value (32768) to 28672. If the root switch should fail, this switch becomes the next root switch (if the other switches in the network use the default switch priority of 32768, and therefore, are unlikely to become the root switch). Examples This example shows how to disable the STP on VLAN 5: Switch(config)# no spanning-tree vlan 5 You can verify your setting by entering the show spanning-tree privileged EXEC command. In this instance, VLAN 5 does not appear in the list. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The value for the vlan-id variable was changed.2-406 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands spanning-tree vlan This example shows how to set the spanning-tree forwarding time to 18 seconds for VLANs 20 and 25: Switch(config)# spanning-tree vlan 20,25 forward-time 18 This example shows how to set the spanning-tree hello-delay time to 3 seconds for VLANs 20 to 24: Switch(config)# spanning-tree vlan 20-24 hello-time 3 This example shows how to set spanning-tree max-age to 30 seconds for VLAN 20: Switch(config)# spanning-tree vlan 20 max-age 30 This example shows how to reset the max-age parameter to the default value for spanning-tree instance 100 and 105 to 108: Switch(config)# no spanning-tree vlan 100, 105-108 max-age This example shows how to set the spanning-tree priority to 8192 for VLAN 20: Switch(config)# spanning-tree vlan 20 priority 8192 This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4: Switch(config)# spanning-tree vlan 10 root primary diameter 4 This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4: Switch(config)# spanning-tree vlan 10 root secondary diameter 4 You can verify your settings by entering the show spanning-tree vlan vlan-id privileged EXEC command. Related Commands Command Description show spanning-tree vlan Displays spanning-tree information. spanning-tree cost Sets the path cost for spanning-tree calculations. spanning-tree guard Enables the root guard or the loop guard feature for all the VLANs associated with the selected interface. spanning-tree port-priority Sets an interface priority. spanning-tree portfast (global configuration) Globally enables the BPDU filtering or the BPDU guard feature on Port Fast-enabled ports or enables the Port Fast feature on all nontrunking ports. spanning-tree portfast (interface configuration) Enables the Port Fast feature on an interface in all its associated VLANs. spanning-tree uplinkfast Enables the UplinkFast feature, which accelerates the choice of a new root port.2-407 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands speed speed Use the speed interface configuration command on the switch stack or on a standalone switch to specify the speed of a 10/100 Mbps or 10/100/1000 Mbps port. Use the no or default form of this command to return the port to its default value. speed {10 | 100 | 1000 | auto | nonegotiate} no speed Note You cannot configure speed on small form-factor pluggable (SFP) module ports, but you can configure speed to not negotiate (nonegotiate) if they are connected to a device that does not support autonegotiation. See “Usage Guidelines” for exceptions when a 1000BASE-T SFP module is in the SFP module port. Syntax Description Defaults The default is auto. Command Modes Interface configuration Command History Usage Guidelines You can configure the Fast Ethernet port speed as either 10 or 100 Mbps. You can configure the Gigabit Ethernet port speed as 10, 100, or 1000 Mbps. You cannot configure speed on SFP module ports, but you can configure speed to not negotiate (nonegotiate) if connected to a device that does not support autonegotiation. However, when a 1000BASE-T SFP module is in the SFP module port, you can configure speed as 10, 100, or 1000 Mbps. If the speed is set to auto, the switch negotiates with the device at the other end of the link for the speed setting and then forces the speed setting to the negotiated value. The duplex setting remains as configured on each end of the link, which could result in a duplex setting mismatch. 10 Port runs at 10 Mbps. 100 Port runs at 100 Mbps. 1000 Port runs at 1000 Mbps. This option is valid and visible only on 10/100/1000 Mbps-ports. auto Port automatically detects the speed it should run at based on the port at the other end of the link. nonegotiate Autonegotiation is disabled, and the port runs at 1000 Mbps. This option is valid and visible only on SFP ports. When a 1000BASE-T SFP module is in the SFP module port, the speed can be configured to 10, 100, 1000, or auto, but not nonegotiate. Release Modification 12.1(11)AX This command was first introduced.2-408 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands speed If both ends of the line support autonegotiation, we highly recommend the default autonegotiation settings. If one interface supports autonegotiation and the other end does not, do use the auto setting on the supported side, but set the duplex and speed on both interfaces. For 10/100/1000 Mbps ports, if both the speed and duplex are set to specific values, autonegotiation is disabled. For 10/100 Mbps ports, if both speed and duplex are set to specific values, the link operates at the negotiated speed and duplex value. Caution Changing the interface speed and duplex mode configuration might shut down and re-enable the interface during the reconfiguration. Note For guidelines on setting the switch speed and duplex parameters, refer to the software configuration guide for this release. Examples This example shows how to set the specified interface to 100 Mbps: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# speed 100 You can verify your settings by entering the show interfaces privileged EXEC command. Related Commands Command Description duplex Specifies the duplex mode of operation for Fast Ethernet and Gigabit Ethernet ports. show interfaces Displays the statistical information specific to all interfaces or to a specific interface2-409 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth limit srr-queue bandwidth limit Use the srr-queue bandwidth limit interface configuration command on the switch stack or on a standalone switch to limit the maximum output on a port. Use the no form of this command to return to the default setting. srr-queue bandwidth limit weight1 no srr-queue bandwidth limit Syntax Description Defaults The port is not rate limited and is set to 100 percent. Command Modes Interface configuration Command History Usage Guidelines If you configure this command to 80 percent, the port is idle 20 percent of the time. The line rate drops to 80 percent of the connected speed. These values are not exact because the hardware adjusts the line rate in increments of six. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Examples This example shows how to limit Gigabit Ethernet port 0/1 on stack member 2 to 800 Mbps: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth limit 80 You can verify your settings by entering the show mls qos interface [interface-id] queueing privileged EXEC command. weight1 Percentage of the port speed to which the port should be limited. The range is 10 to 90. Release Modification 12.1(11)AX This command was first introduced.2-410 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth limit Related Commands Command Description mls qos queue-set output buffers Allocates buffers to the queue-set. mls qos srr-queue output cos-map Maps class of service (CoS) values to egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps Differentiated Services Code Point (DSCP) values to an egress queue or maps DSCP values to a queue and to a threshold ID. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation for the queue-set. queue-set Maps a port to a queue-set. show mls qos interface queueing Displays quality of service (QoS) information. srr-queue bandwidth shape Assigns the shaped weights and enables bandwidth shaping on the four egress queues mapped to a port. srr-queue bandwidth share Assigns the shared weights and enables bandwidth sharing on the four egress queues mapped to a port.2-411 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth shape srr-queue bandwidth shape Use the srr-queue bandwidth shape interface configuration command on the switch stack or on a standalone switch to assign the shaped weights and to enable bandwidth shaping on the four egress queues mapped to a port. Use the no form of this command to return to the default setting. srr-queue bandwidth shape weight1 weight2 weight3 weight4 no srr-queue bandwidth shape Syntax Description Defaults Weight1 is set to 25. Weight2, weight3, and weight4 are set to 0, and these queues are in shared mode. Command Modes Interface configuration Command History Usage Guidelines In shaped mode, the queues are guaranteed a percentage of the bandwidth, and they are rate-limited to that amount. Shaped traffic does not use more than the allocated bandwidth even if the link is idle. Use shaping to smooth bursty traffic or to provide a smoother output over time. The shaped mode overrides the shared mode. If you configure a shaped queue weight to 0 by using the srr-queue bandwidth shape interface configuration command, this queue participates in shared mode. The weight specified with the srr-queue bandwidth shape command is ignored, and the weights specified with the srr-queue bandwidth share interface configuration command for a queue come into effect. When configuring queues for the same port for both shaping and sharing, make sure that you configure the lowest numbered queue for shaping. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. weight1 weight2 weight3 weight4 Specify the weights to determine the percentage of the port that is shaped. The inverse ratio (1/weight) determines the shaping bandwidth for this queue. Separate each value with a space. The range is 0 to 65535. Release Modification 12.1(11)AX This command was first introduced.2-412 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth shape Examples This example shows how to configure the queues for the same port for both shaping and sharing. Because the weight ratios for queues 2, 3, and 4 are set to 0, these queues operate in shared mode. The bandwidth weight for queue 1 is 1/8, which is 12.5 percent. Queue 1 is guaranteed this bandwidth and limited to it; it does not extend its slot to the other queues even if the other queues have no traffic and are idle. Queues 2, 3, and 4 are in shared mode, and the setting for queue 1 is ignored. The bandwidth ratio allocated for the queues in shared mode is 4/(4+4+4), which is 33 percent: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth shape 8 0 0 0 Switch(config-if)# srr-queue bandwidth share 4 4 4 4 You can verify your settings by entering the show mls qos interface [interface-id] queueing privileged EXEC command. Related Commands Command Description mls qos queue-set output buffers Allocates buffers to a queue-set. mls qos srr-queue output cos-map Maps class of service (CoS) values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps Differentiated Services Code Point (DSCP) values to an egress queue or maps DSCP values to a queue and to a threshold ID. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface queueing Displays quality of service (QoS) information. srr-queue bandwidth share Assigns the shared weights and enables bandwidth sharing on the four egress queues mapped to a port.2-413 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth share srr-queue bandwidth share Use the srr-queue bandwidth share interface configuration command on the switch stack or on a standalone switch to assign the shared weights and to enable bandwidth sharing on the four egress queues mapped to a port. The ratio of the weights is the ratio of frequency in which the shaped round robin (SRR) scheduler dequeues packets from each queue. Use the no form of this command to return to the default setting. srr-queue bandwidth share weight1 weight2 weight3 weight4 no srr-queue bandwidth share Syntax Description Defaults Weight1, weight2, weight3, and weight4 are 25 (1/4 of the bandwidth is allocated to each queue). Command Modes Interface configuration Command History Usage Guidelines The absolute value of each weight is meaningless, and only the ratio of parameters is used. In shared mode, the queues share the bandwidth among them according to the configured weights. The bandwidth is guaranteed at this level but not limited to it. For example, if a queue empties and does not require a share of the link, the remaining queues can expand into the unused bandwidth and share it among themselves. If you configure a shaped queue weight to 0 by using the srr-queue bandwidth shape interface configuration command, this queue participates in SRR shared mode. The weight specified with the srr-queue bandwidth shape command is ignored, and the weights specified with the srr-queue bandwidth share interface configuration command for a queue take effect. When configuring queues for the same port for both shaping and sharing, make sure that you configure the lowest numbered queue for shaping. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. weight1 weight2 weight3 weight4 The ratios of weight1, weight2, weight3, and weight4 determine the ratio of the frequency in which the SRR scheduler dequeues packets. Separate each value with a space. The range is 1 to 255. Release Modification 12.1(11)AX This command was first introduced.2-414 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands srr-queue bandwidth share Examples This example shows how to configure the weight ratio of the SRR scheduler running on egress port Gigabit Ethernet 0/1 on stack member 2. Four queues are used. The bandwidth ratio allocated for each queue in shared mode is 1/(1+2+3+4), 2/(1+2+3+4), 3/(1+2+3+4), and 4/(1+2+3+4), which is 10 percent, 20 percent, 30 percent, and 40 percent for queues 1, 2, 3, and 4. This means that queue 4 has four times the bandwidth of queue 1, twice the bandwidth of queue 2, and one-and-a-third times the bandwidth of queue 3. Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth share 1 2 3 4 You can verify your settings by entering the show mls qos interface [interface-id] queueing privileged EXEC command. Related Commands Command Description mls qos queue-set output buffers Allocates buffers to a queue-set. mls qos srr-queue output cos-map Maps class of service (CoS) values to an egress queue or maps CoS values to a queue and to a threshold ID. mls qos srr-queue output dscp-map Maps Differentiated Services Code Point (DSCP) values to an egress queue or maps DSCP values to a queue and to a threshold ID. mls qos queue-set output threshold Configures the weighted tail-drop (WTD) thresholds, guarantees the availability of buffers, and configures the maximum memory allocation to a queue-set. queue-set Maps a port to a queue-set. show mls qos interface queueing Displays quality of service (QoS) information. srr-queue bandwidth shape Assigns the shaped weights and enables bandwidth shaping on the four egress queues mapped to a port.2-415 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands storm-control storm-control Use the storm-control interface configuration command on the switch stack or on a standalone switch to enable broadcast, multicast, or unicast storm control on an interface with the specified threshold level. Use the no form of this command to disable broadcast, multicast, or unicast storm control on an interface. storm-control {broadcast | multicast | unicast} level level [.level] no storm-control {broadcast | multicast | unicast} level Syntax Description Defaults Broadcast, multicast, and unicast storm control are disabled. Command Modes Interface configuration Command History Usage Guidelines Storm control is supported only on physical interfaces; it is not supported on EtherChannel port channels, even though it is available in the command-line interface (CLI). Storm-control suppression level is entered as a percentage of total bandwidth. A threshold value of 100 percent means that no limit is placed on the specified traffic type. A value of 0.0 means that all broadcast, multicast, or unicast traffic on that port is blocked. When the storm control threshold for multicast traffic is reached, all multicast traffic except control traffic, such as bridge protocol data unit (BDPU) and Cisco Discovery Protocol (CDP) frames, are blocked. However, the switch does not differentiate between routing updates, such as Open Shortest Path First (OSPF) and regular multicast data traffic, so both types of traffic are blocked. Note For more information about storm control suppression levels, refer to the software configuration guide for this release. broadcast Enable broadcast storm control on the interface. multicast Enable multicast storm control on the interface. unicast Enable unicast storm control on the interface. level Storm-control suppression level as a percent of total bandwidth. The range is 0 to 100 percent. .level (Optional) Fractional storm-control suppression level. The range is 0 to 99. Release Modification 12.1(11)AX This command was first introduced.2-416 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands storm-control Examples This example shows how to enable multicast storm control with a 75.5 percent threshold level: Switch(config-if)# storm-control multicast level 75.5 This example shows how to disable multicast storm control: Switch(config-if)# no storm-control multicast level You can verify your settings by entering the show storm-control privileged EXEC command. Related Commands Command Description show storm-control Displays broadcast, multicast, or unicast storm control settings on all interfaces or on a specified interface.2-417 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switch priority switch priority Use the switch priority global configuration command on the stack master to change the stack member priority value. switch stack-member-number priority new-priority-value Syntax Description Defaults The default priority value is 1. Command Modes Global configuration Command History Usage Guidelines If you do not specify a priority value, the default value is assigned. The new priority value is a factor during a stack-master re-election. Therefore, changing the priority value does not change the stack master immediately. Use the reload slot current stack member number privileged EXEC to reset the stack member and apply this configuration change into effect. Examples This example shows how to change the priority value of stack member 6 to 9: Switch(config)# switch 6 priority 9 Changing the Switch Priority of Switch Number 6 to 9 Do you want to continue?[confirm] Related Commands priority new-priority-value Specify the new stack member priority value. The range is 1 to 15. stack-member-number Specify the current stack member number. The range 1 to 9. Release Modification 12.1(11)AX This command was first introduced. Command Description reload Resets the stack member and puts a configuration change into effect. session Accesses a specific stack member. switch renumber Changes the stack member number. show switch Displays information about the switch stack and its stack members.2-418 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switch renumber switch renumber Use the switch renumber global configuration command on the stack master to change the stack member number. switch current-stack-member-number renumber new-stack-member-number Syntax Description Defaults The default stack member number is 1. Command Modes Global configuration Command History Usage Guidelines If another stack member is already using the member number that you just specified, the stack master assigns the lowest available number when you reset the stack member. Note If you change the number of a stack member, and no configuration is associated with the new stack member number, that stack member loses its current configuration and resets to its default configuration. For more information about stack member numbers and configurations, see the software configuration guide. Use the reload slot current stack member number privileged EXEC to reset the stack member and apply this configuration change into effect. Examples This example shows how to change the member number of stack member 6 to 7: Switch(config)# switch 6 renumber 7 WARNING: Changing the switch number may result in lost or changed configuration for that switch! Do you want to continue?[confirm] renumber new-stack-member-number Specify the new stack member number for the stack member. The range is 1 to 9. current-stack-member-number Specify the current stack member number. The range is 1 to 9. Release Modification 12.1(11)AX This command was first introduced.2-419 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switch renumber Related Commands Command Description reload Resets the stack member and puts a configuration change into effect. session Accesses a specific stack member. switch priority Changes the stack member priority value. show switch Display information about the switch stack and its stack members.2-420 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport switchport Use the switchport interface configuration command with no keywords on the switch stack or on a standalone switch to put an interface that is in Layer 3 mode into Layer 2 mode for Layer 2 configuration. Use the no form of this command to put an interface in Layer 3 mode. switchport no switchport Use the no switchport command (without parameters) to set the interface to the routed-interface status and to erase all Layer 2 configurations. You must use this command before assigning an IP address to a routed port. Note If an interface is configured as a Layer 3 interface, you must first enter this switchport command with no keywords to configure the interface as a Layer 2 port. Then you can enter additional switchport commands with keywords, as shown on the pages that follow. Syntax Description This command has no arguments or keywords. Defaults By default, all interfaces are in Layer 2 mode. Command Modes Interface configuration Command History Usage Guidelines Entering the no switchport command shuts the port down and then re-enables it, which might generate messages on the device to which the port is connected. Examples This example shows how to cause an interface to cease operating as a Layer 2 port and become a Cisco-routed port. Switch(config-if)# no switchport This example shows how to cause the port interface to cease operating as a Cisco-routed port and convert to a Layer 2-switched interface: Switch(config-if)# switchport Note The switchport command without keywords is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces. Release Modification 12.1(11)AX This command was first introduced.2-421 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport You can verify the switchport status of an interface by entering the show running-config privileged EXEC command. Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. show running-config Displays the current operating configuration. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands.2-422 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport access switchport access Use the switchport access interface configuration command on the switch stack or on a standalone switch to configure a port as a static-access or dynamic-access port. If the switchport mode is set to access, the port operates as a member of the specified VLAN. If set to dynamic, the port starts discovery of VLAN assignment based on the incoming packets it receives. Use the no form of this command to reset the access mode to the default VLAN for the switch. switchport access vlan {vlan-id | dynamic} no switchport access vlan Syntax Description Defaults The default access VLAN and trunk interface native VLAN is a default VLAN corresponding to the platform or interface hardware. A dynamic-access port is initially a member of no VLAN and receives its assignment based on the packet it receives. Command Modes Interface configuration Command History Usage Guidelines The no switchport access command resets the access mode VLAN to the appropriate default VLAN for the device. The port must be in access mode before the switchport access vlan command can take effect. An access port can be assigned to only one VLAN. The VMPS server (such as a Catalyst 6000 series switch) must be configured before a port is configured as dynamic. vlan vlan-id Configure the interface as a static access port with the VLAN ID of the access mode VLAN; the range is 1 to 4094. vlan dynamic Specify that the access mode VLAN is dependent on the VLAN Membership Policy Server (VMPS) protocol. The port is assigned to a VLAN based on the source MAC address of a host (or hosts) connected to the port. The switch sends every new MAC address received to the VMPS server to obtain the VLAN name to which the dynamic-access port should be assigned. If the port already has a VLAN assigned and the source has already been approved by the VMPS, the switch forwards the packet to the VLAN. Release Modification 12.1(11)AX This command was first introduced.2-423 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport access These restrictions apply to dynamic-access ports: • The software implements the VLAN Query Protocol (VQP) client, which can query a VMPS such as a Catalyst 6000 series switch. The Catalyst 3750 switches are not VMPS servers. The VMPS server must be configured before a port is configured as dynamic. • Use dynamic-access ports only to connect end stations. Connecting them to switches or routers (that use bridging protocols) can cause a loss of connectivity. • Configure the network so that STP does not put the dynamic-access port into an STP blocking state. The Port Fast feature is automatically enabled on dynamic-access ports. • Dynamic-access ports can only be in one VLAN and do not use VLAN tagging. • Dynamic-access ports cannot be configured as – Members of an EtherChannel port group (dynamic-access ports cannot be grouped with any other port, including other dynamic ports). – Source or destination ports in a static address entry. – Monitor ports. Examples This example shows how to cause a port interface that has already been configured as a switched interface to operate in VLAN 2 instead of the platform’s default VLAN when in access mode: Switch(config-if)# switchport access vlan 2 You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows. Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. switchport mode Configures the VLAN membership mode of a port.2-424 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport block switchport block Use the switchport block interface configuration command on the switch stack or on a standalone switch to prevent unknown multicast or unicast packets from being forwarded. Use the no form of this command to allow forwarding unknown multicast or unicast packets. switchport block {multicast | unicast} no switchport block {multicast | unicast} Syntax Description Defaults Unknown multicast and unicast traffic is not blocked. Command Modes Interface configuration Command History Usage Guidelines By default, all traffic with unknown MAC addresses is sent to all ports. You can block unknown multicast or unicast traffic on protected or nonprotected ports. If unknown multicast or unicast traffic is not blocked on a protected port, there could be security issues. Blocking unknown multicast or unicast traffic is not automatically enabled on protected ports; you must explicitly configure it. Note For more information about blocking packets, refer to the software configuration guide for this release. Examples This example shows how to block unknown multicast traffic on an interface: Switch(config-if)# switchport block multicast You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command. Related Commands multicast Specify that unknown multicast traffic should be blocked. unicast Specify that unknown unicast traffic should be blocked. Release Modification 12.1(11)AX This command was first introduced. Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings.2-425 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport host switchport host Use the switchport host interface configuration command on the switch stack or on a standalone switch to optimize a Layer 2 port for a host connection. The no form of this command has no affect on the system. switchport host Syntax Description This command has no arguments or keywords. Defaults The default is for the port to not be optimized for a host connection. Command Modes Interface configuration Command History Usage Guidelines To optimize the port for a host connection, the switchport host command sets switch port mode to access, enables spanning tree Port Fast, and disables channel grouping. Only an end station can accept this configuration. Because spanning tree Port Fast is enabled, you should enter the switchport host command only on ports that are connected to a single host. Connecting other switches, hubs, concentrators, or bridges to a fast-start port can cause temporary spanning-tree loops. Enable the switchport host command to decrease the time that it takes to start up packet forwarding. Examples This example shows how to optimize the port configuration for a host connection: Switch(config-if)# switchport host switchport mode will be set to access spanning-tree portfast will be enabled channel group will be disabled Switch(config-if)# You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including switchport mode.2-426 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport mode switchport mode Use the switchport mode interface configuration command on the switch stack or on a standalone switch to configure the VLAN membership mode of a port. Use the no form of this command to reset the mode to the appropriate default for the device. switchport mode {access | dynamic {auto | desirable} | trunk} no switchport mode {access| dynamic | trunk} Syntax Description Defaults The default mode is dynamic auto. Command Modes Interface configuration Command History Usage Guidelines A configuration that uses the access or trunk keywords takes effect only when you configure the port in the appropriate mode by using the switchport mode command. The static-access and trunk configuration are saved, but only one configuration is active at a time. When you enter access mode, the interface changes to permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not agree to the change. When you enter trunk mode, the interface changes to permanent trunking mode and negotiates to convert the link into a trunk link even if the interface connecting to it does not agree to the change. When you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode. When you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. access Set the port to access mode (either static-access or dynamic-access depending on the setting of the switchport access vlan interface configuration command). The port is set to access unconditionally and operates as a nontrunking, single VLAN interface that sends and receives nonencapsulated (non-tagged) frames. An access port can be assigned to only one VLAN. dynamic auto Set the interface trunking mode dynamic parameter to auto to specify that the interface convert the link to a trunk link. This is the default switchport mode. dynamic desirable Set the interface trunking mode dynamic parameter to desirable to specify that the interface actively attempt to convert the link to a trunk link. trunk Set the port to trunk unconditionally. The port is a trunking VLAN Layer-2 interface. The port sends and receives encapsulated (tagged) frames that identify the VLAN of origination. A trunk is a point-to-point link between two switches or between a switch and a router. Release Modification 12.1(11)AX This command was first introduced.2-427 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport mode To autonegotiate trunking, the interfaces must be in the same VTP domain. Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a point-to-point protocol. However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations. To avoid this, you should configure interfaces connected to devices that do not support DTP to not forward DTP frames, which turns off DTP. • If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking. • To enable trunking to a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames. Access port and trunk ports are mutually exclusive. The 802.1X feature interacts with switchport modes in these ways: • If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, the port mode is not changed. • If you try to enable 802.1X on a port set to dynamic auto or dynamic desirable, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to dynamic auto or dynamic desirable, the port mode is not changed. • If you try to enable 802.1X on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is not changed. Examples This example shows how to configure a port for access mode: Switch(config-if)# switchport mode access This example shows how set the interface to dynamic desirable mode: Switch(config-if)# switchport mode dynamic desirable This example shows how to configure a port for trunk mode: Switch(config-if)# switchport mode trunk You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command and examining information in the Administrative Mode and Operational Mode rows. Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. switchport access Configures a port as a static-access or dynamic-access port. switchport trunk Configures the trunk characteristics when an interface is in trunking mode.2-428 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport nonegotiate switchport nonegotiate Use the switchport nonegotiate interface configuration command on the switch stack or on a standalone switch to specify that Dynamic Trunking Protocol (DTP) negotiation packets are not sent on the Layer 2 interface. The switch does not engage in DTP negotiation on this interface. Use the no form of this command to return to the default setting. switchport nonegotiate no switchport nonegotiate Syntax Description This command has no arguments or keywords. Defaults The default is to use DTP negotiation to determine trunking status. Command Modes Interface configuration Command History Usage Guidelines The no form of the switchport nonegotiate command removes nonegotiate status. This command is valid only when the interface switchport mode is access or trunk (configured by using the switchport mode access or the switchport mode trunk interface configuration command). This command returns an error if you attempt to execute it in dynamic (auto or desirable) mode. Internetworking devices that do not support DTP might forward DTP frames improperly and cause misconfigurations. To avoid this, you should turn off DTP by using the switchport no negotiate command to configure the interfaces connected to devices that do not support DTP to not forward DTP frames. When you enter the switchport nonegotiate command, DTP negotiation packets are not sent on the interface. The device does or does not trunk according to the mode parameter: access or trunk. • If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking. • To enable trunking on a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames. Release Modification 12.1(11)AX This command was first introduced.2-429 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport nonegotiate Examples This example shows how to cause a port interface to refrain from negotiating trunking mode and to act as a trunk or access port (depending on the mode set): Switch(config-if)# switchport nonegotiate You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command. Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. switchport mode Configures the VLAN membership mode of a port.2-430 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security switchport port-security Use the switchport port-security interface configuration command without keywords on the switch stack or on a standalone switch to enable port security on the interface. Use the keywords to configure secure MAC addresses, sticky MAC address learning, a maximum number of secure MAC addresses, or the violation mode. Use the no form of this command to disable port security or to set the parameters to their default states. switchport port-security [aging] [mac-address mac-address [vlan vlan-id] | mac-address sticky [mac-address]] [maximum value [vlan vlan-list]] [violation {protect | restrict | shutdown}] no switchport port-security [aging] [mac-address mac-address [vlan vlan-id] | mac-address sticky [mac-address]] [maximum value [vlan vlan-list]] [violation {protect | restrict | shutdown}] Syntax Description aging (Optional) See the switchport port-security aging command. mac-address mac-address (Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured. vlan vlan-id (Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used. mac-address sticky [mac-address] (Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses. (Optional) Enter a mac-address to specify a sticky secure MAC address. maximum value (Optional) Set the maximum number of secure MAC addresses for the interface.The maximum number of secure MAC addresses that you can configure on a switch stack is determined by the maximum number of available MAC addresses allowed in the system. This number is determined by the active Switch Database Management (SDM) template. See the sdm prefer command. This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. The default setting is 1. vlan [vlan-list] (Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. • vlan—set a per-VLAN maximum value. • vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hypen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used. violation (Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.2-431 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security Defaults The default is to disable port security. When port security is enabled and no keywords are entered, the default maximum number of secure MAC addresses is 1. The default violation mode is shutdown. Sticky learning is disabled. Command Modes Interface configuration Command History Usage Guidelines A secure port has the following limitations: • A secure port can be an access port or a trunk port; it cannot be a dynamic access port. • A secure port cannot be a routed port. • A secure port cannot be a protected port. • A secure port cannot be a destination port for Switched Port Analyzer (SPAN). protect Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit. restrict Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. shutdown Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The sticky and vlan keywords were added.2-432 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security • A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group. • You cannot configure static secure or sticky secure MAC addresses in the voice VLAN. • When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to two plus the maximum number of secure addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the Cisco IP phone requires up to two MAC addresses. The Cisco IP phone address is learned on the voice VLAN and might also be learned on the access VLAN. Connecting a PC to the Cisco IP phone requires additional MAC addresses. • If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN. You cannot configure port security on a per-VLAN basis. Note Voice VLAN is supported only on access ports and not on trunk ports. • When a voice VLAN is configured on a secure port that is also configured as a sticky secure port, all addresses on the voice VLAN are learned as dynamic secure addresses, and all addresses seen on the access VLAN to which the port belongs are learned as sticky secure addresses. • You cannot configure static secure MAC addresses in the voice VLAN. • When you enter a maximum secure address value for an interface, if the new value is greater than the previous value, the new value overrides the previously configured value. If the new value is less than the previous value and the number of configured secure addresses on the interface exceeds the new value, the command is rejected. • The switch does not support port security aging of sticky secure MAC addresses. A security violation occurs when the maximum number of secure MAC addresses are in the address table and a station whose MAC address is not in the address table attempts to access the interface, or when a station whose MAC address is configured as a secure MAC address on another secure port attempts to access the interface. If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you should set the maximum allowed secure addresses on the port to more than 1. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands. Setting a maximum number of addresses to one and configuring the MAC address of an attached device ensures that the device has the full bandwidth of the port. When you enter a maximum secure address value for an interface, this occurs: • If the new value is greater than the previous value, the new value overrides the previously configured value. • If the new value is less than the previous value and the number of configured secure addresses on the interface exceeds the new value, the command is rejected. Sticky secure MAC addresses have these characteristics: • When you enable sticky learning on an interface by using the switchport port-security mac-address sticky interface configuration command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses and adds all sticky secure MAC addresses to the running configuration.2-433 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security • If you disable sticky learning by using the no switchport port-security mac-address sticky interface configuration command or the running configuration is removed, the sticky secure MAC addresses remain part of the running configuration but are removed from the address table. The addresses that were removed can be dynamically reconfigured and added to the address table as dynamic addresses. • When you configure sticky secure MAC addresses by using the switchport port-security mac-address sticky mac-address interface configuration command, these addresses are added to the address table and the running configuration. If port security is disabled, the sticky secure MAC addresses remain in the running configuration. • If you save the sticky secure MAC addresses in the configuration file, when the switch restarts or the interface shuts down, the interface does not need to relearn these addresses. If you do not save the sticky secure addresses, they are lost. If sticky learning is disabled, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration. • If you disable sticky learning and enter the switchport port-security mac-address sticky mac-address interface configuration command, an error message appears, and the sticky secure MAC address is not added to the running configuration. Examples This example shows how to enable port security on Gigabit Ethernet port 12 on stack member 2 and to set the maximum number of secure addresses to 5. The violation mode is the default, and no secure MAC addresses are configured. Switch(config)# interface gigahitethernet 2/0/12 Switch(config-if)# switchport mode access Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 5 This example shows how to configure a secure MAC address and a VLAN ID on Gigabit Ethernet port 12 on stack member 2. Switch(config)# interface gigabitethernet 2/0/12 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security mac-address 1000.2000.3000 vlan 3 This example shows how to enable sticky learning and to enter two sticky secure MAC addresses: Switch(config-if)# switchport port-security mac-address sticky Switch(config-if)# switchport port-security mac-address sticky 0000.0000.4141 Switch(config-if)# switchport port-security mac-address sticky 0000.0000.000f You can verify your settings by using the show port-security privileged EXEC command. Related Commands Command Description show port-security address Displays all the secure addresses configured on the switch. show port-security interface interface-id Displays port security configuration for the switch or for the specified interface.2-434 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security aging switchport port-security aging Use the switchport port-security aging interface configuration command on the switch stack or on a standalone switch to set the aging time and type for secure address entries or to change the aging behavior for secure addresses on a particular port. Use the no form of this command to disable port security aging or to set the parameters to their default states. switchport port-security aging {static | time time | type {absolute | inactivity}} no switchport port-security aging {static | time | type} Syntax Description Defaults The port security aging feature is disabled. The default time is 0 minutes. The default aging type is absolute. The default static aging behavior is disabled. Command Modes Interface configuration Command History Usage Guidelines To enable secure address aging for a particular port, set the aging time to a value other than 0 for that port. To allow limited time access to particular secure addresses, set the aging type as absolute. When the aging time lapses, the secure addresses are deleted. To allow continuous access to a limited number of secure addresses, set the aging type as inactivity. This removes the secure address when it become inactive, and other addresses can become secure. To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command. static Enable aging for statically configured secure addresses on this port. time time Specify the aging time for this port. The range is 0 to 1440 minutes. If the time is 0, aging is disabled for this port. type Set the aging type. absolute Set absolute aging type. All the secure addresses on this port age out exactly after the time (minutes) specified and are removed from the secure address list. inactivity Set the inactivity aging type. The secure addresses on this port age out only if there is no data traffic from the secure source address for the specified time period. Release Modification 12.1(11)AX This command was first introduced.2-435 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport port-security aging Examples This example sets the aging time as 2 hours for absolute aging for all the secure addresses on Gigabit Ethernet interface 0/1 on stack member 1. Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport port-security aging time 120 This example sets the aging time as 2 minutes for inactivity aging type with aging enabled for configured secure addresses on Gigabit Ethernet interface 0/2 on stack member 1. Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# switchport port-security aging time 2 Switch(config-if)# switchport port-security aging type inactivity Switch(config-if)# switchport port-security aging static This example shows how to disable aging for configured secure addresses. Switch(config-if)# no switchport port-security aging static Related Commands Command Description show port-security Displays the port security settings defined for the port. switchport port-security Enables port security on a port, restricts the use of the port to a user-defined group of stations, and configures secure MAC addresses.2-436 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport priority extend switchport priority extend Use the switchport priority extend interface configuration command on the switch stack or on a standalone switch to set a port priority for the incoming untagged frames or the priority of frames received by the IP phone connected to the specified port. Use the no form of this command to return to the default setting. switchport priority extend {cos value | trust} no switchport priority extend Syntax Description Defaults The default port priority is set to a CoS value of 0 for untagged frames received on the port. Command Modes Interface configuration Command History Usage Guidelines When voice VLAN is enabled, you can configure the switch to send the Cisco Discovery Protocol (CDP) packets to instruct the IP phone how to send data packets from the device attached to the access port on the Cisco IP Phone. You must enable CDP on the switch port connected to the Cisco IP Phone to send the configuration to the Cisco IP Phone. (CDP is enabled by default globally and on all switch interfaces.) You should configure voice VLAN on switch access ports. You can only configure a voice VLAN on Layer 2 ports. Before you enable voice VLAN, we recommend that you enable quality of service (QoS) on the switch by entering the mls qos global configuration command and configure the port trust state to trust by entering the mls qos trust cos interface configuration command. Examples This example shows how to configure the IP phone connected to the specified port to trust the received 802.1P priority: Switch(config-if)# switchport priority extend trust You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command. cos value Set the IP phone port to override the 802.1P priority received from the PC or the attached device with the specified class of service (CoS) value. The range is 0 to 7. Seven is the highest priority. The default is 0. trust Set the IP phone port to trust the 802.1P priority received from the PC or the attached device. Release Modification 12.1(11)AX This command was first introduced.2-437 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport priority extend Related Commands Command Description show interfaces Displays the administrative and operational status of a switching (nonrouting) port. switchport voice vlan Configures the voice VLAN on the port.2-438 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport protected switchport protected Use the switchport protected interface configuration command on the switch stack or on a standalone switch to isolate unicast, multicast, and broadcast traffic at Layer 2 from other protected ports on the same switch. Use the no form of this command to disable protection on the port. switchport protected no switchport protected Syntax Description This command has no arguments or keywords. Defaults No protected port is defined. All ports are nonprotected. Command Modes Interface configuration Command History Usage Guidelines The switchport protection feature is local to the switch; communication between protected ports on the same switch is possible only through a Layer 3 device. To prevent communication between protected ports on different switches, you must configure the protected ports for unique VLANs on each switch and configure a trunk link between the switches. A protected port is different from a secure port. A protected port does not forward any unicast, multicast, or broadcast traffic to any other protected port. A protected port continues to forward unicast, multicast, and broadcast traffic to unprotected ports and vice versa. Because a switch stack represents a single logical switch, Layer 2 traffic is not forwarded between any protected ports in the switch stack, whether they are on the same or different switches in the stack. Port monitoring does not work if both the monitor and monitored ports are protected ports. Examples This example shows how to enable a protected port on an interface: Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# switchport protected You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command. Release Modification 12.1(11)AX This command was first introduced.2-439 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport protected Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. switchport block Prevents unknown multicast or unicast traffic on the interface.2-440 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport trunk switchport trunk Use the switchport trunk interface configuration command on the switch stack or on a standalone switch to set the trunk characteristics when the interface is in trunking mode. Use the no form of this command to reset a trunking characteristic to the default. switchport trunk {allowed vlan vlan-list | encapsulation {dot1q | isl | negotiate} | native vlan vlan-id | pruning vlan vlan-list} no switchport trunk {allowed vlan | encapsulation | native vlan | {pruning vlan} Syntax Description The vlan-list format is all | none | [add | remove | except] vlan-atom [,vlan-atom...] where: • all specifies all VLANs from 1 to 4094. This keyword is not allowed on commands that do not permit all VLANs in the list to be set at the same time. • none means an empty list. This keyword is not allowed on commands that require certain VLANs to be set or at least one VLAN to be set. • add adds the defined list of VLANs to those currently set instead of replacing the list. Valid IDs are from 1 to 1005; extended-range VLANs (VLAN IDs greater than 1005) are valid in some cases. Note You can add extended-range VLANs to the allowed VLAN list, but not to the pruning-eligible VLAN list. Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs. allowed vlan vlan-list Set the list of allowed VLANs that can receive and send traffic on this interface in tagged format when in trunking mode. See the following vlan-list format. The none keyword is not valid. The default is all. encapsulation dot1q Set the encapsulation format on the trunk port to 802.1Q. With this format, the switch supports simultaneous tagged and untagged traffic on a port. encapsulation isl Set the encapsulation format on the trunk port to Inter-Switch Link (ISL). The switch encapsulates all received and sent packets with an ISL header and filters native frames received from an ISL trunk port. encapsulation negotiate Specify that if Dynamic Inter-Switch Link (DISL) and Dynamic Trunking Protocol (DTP) negotiation do not resolve the encapsulation format, ISL is the selected format. native vlan vlan-id Set the native VLAN for sending and receiving untagged traffic when the interface is in 802.1Q trunking mode. The range is 1 to 4094. pruning vlan vlan-list Set the list of VLANs that are eligible for VTP pruning when in trunking mode. The all keyword is not valid.2-441 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport trunk • remove removes the defined list of VLANs from those currently set instead of replacing the list. Valid IDs are from 1 to 1005; extended-range VLAN IDs are valid in some cases. Note You can remove extended-range VLANs from the allowed VLAN list, but you cannot remove them from the pruning-eligible list. Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs. • except lists the VLANs that should be calculated by inverting the defined list of VLANs. (VLANs are added except the ones specified.) Valid IDs are from 1 to 1005. Separate nonconsecutive VLAN IDs with a comma; use a hyphen to designate a range of IDs. • vlan-atom is either a single VLAN number from 1 to 4094 or a continuous range of VLANs described by two VLAN numbers, the lesser one first, separated by a hyphen. Defaults The default encapsulation is negotiate. VLAN 1 is the default native VLAN ID on the port. The default for all VLAN lists is to include all VLANs. Command Modes Interface configuration Command History Usage Guidelines Encapsulation: • The switchport trunk encapsulation command is supported only for platforms and interface hardware that can support both ISL and 802.1Q formats. • You cannot configure one end of the trunk as an 802.1Q trunk and the other end as an ISL or nontrunk port. However, you can configure one port as an ISL trunk and a different port on the same switch as an 802.1Q trunk. • If you enter the negotiate keywords and DTP negotiation does not resolve the encapsulation format, ISL is the selected format. The no form of the command resets the trunk encapsulation format to the default. • The no form of the encapsulation command resets the encapsulation format to the default. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The allowed vlan vlan-list add, remove, and except keywords were modified to accept the VLAN1 and VLANs 1002 to 1005 values.2-442 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport trunk Native VLANs: • All untagged traffic received on an 802.1Q trunk port is forwarded with the native VLAN configured for the port. • If a packet has a VLAN ID that is the same as the sending-port native VLAN ID, the packet is sent without a tag; otherwise, the switch sends the packet with a tag. • The no form of the native vlan command resets the native mode VLAN to the appropriate default VLAN for the device. Allowed VLAN: • To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. When you remove VLAN 1 from a trunk port, the interface continues to send and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), Dynamic Trunking Protocol (DTP), and VLAN Trunking Protocol (VTP) in VLAN 1. • The no form of the allowed vlan command resets the list to the default list, which allows all VLANs. Trunk pruning: • The pruning-eligible list applies only to trunk ports. • Each trunk port has its own eligibility list. • If you do not want a VLAN to be pruned, remove it from the pruning-eligible list. VLANs that are pruning-ineligible receive flooded traffic. • VLAN 1, VLANs 1002 to 1005, and extended-range VLANs (VLANs 1006 to 4094) cannot be pruned. Examples This example shows how to cause a port interface configured as a switched interface to encapsulate in 802.1Q trunking format regardless of its default trunking format in trunking mode: Switch(config-if)# switchport trunk encapsulation dot1q This example shows how to configure VLAN 3 as the default port to send all untagged traffic: Switch(config-if)# switchport trunk native vlan 3 This example shows how to add VLANs 1, 2, 5, and 6 to the allowed list: Switch(config-if)# switchport trunk allowed vlan add 1,2,5,6 This example shows how to remove VLANs 3 and 10 to 15 from the pruning-eligible list: Switch(config-if)# switchport trunk pruning vlan remove 3,10-15 You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command. Related Commands Command Description show interfaces switchport Displays the administrative and operational status of a switching (nonrouting) port, including port blocking and port protection settings. switchport mode Configures the VLAN membership mode of a port.2-443 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport voice vlan switchport voice vlan Use the switchport voice vlan interface configuration command on the switch stack or on a standalone switch to configure voice VLAN on the port. Use the no form of this command to return to the default setting. switchport voice vlan {vlan-id | dot1p | none | untagged} no switchport voice vlan Syntax Description Defaults The switch default is not to automatically configure the telephone (none). The telephone default is not to tag frames. Command Modes Interface configuration Command History Usage Guidelines You should configure voice VLAN on Layer 2 access ports. You must enable Cisco Discovery Protocol (CDP) on the switchport connected to the Cisco IP phone for the switch to send configuration information to the phone. CDP is enabled by default globally and on the interface. Before you enable voice VLAN, we recommend you enable quality of service (QoS) on the switch by entering the mls qos global configuration command and configure the port trust state to trust by entering the mls qos trust cos interface configuration command. When you enter a VLAN ID, the IP phone forwards voice traffic in 802.1Q frames, tagged with the specified VLAN ID. The switch puts 802.1Q voice traffic in the voice VLAN. When you select dot1q, none, or untagged, the switch puts the indicated voice traffic in the access VLAN. In all configurations, the voice traffic carries a Layer 2 IP precedence value. The default is 5 for voice traffic. vlan-id Specify the VLAN to be used for voice traffic. The range is 1 to 4094. By default, the IP phone forwards the voice traffic with an 802.1Q priority of 5. dot1p Configure the telephone to use 802.1P priority tagging and uses VLAN 0 (the native VLAN). By default, the Cisco IP phone forwards the voice traffic with an 802.1P priority of 5. none Do not instruct the IP telephone about the voice VLAN. The telephone uses the configuration from the telephone key pad. untagged Configure the telephone to send untagged voice traffic. This is the default for the telephone. Release Modification 12.1(11)AX This command was first introduced.2-444 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands switchport voice vlan When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to at least two. When the port is connected to a Cisco IP phone, the IP phone requires two MAC addresses: one for the access VLAN and the other for the voice VLAN. Connecting a PC to the IP phone requires additional MAC addresses. If any type of port security is enabled on the access VALN, dynamic port security is automatically enabled on the voice VLAN. You cannot configure static secure MAC addresses in the voice VLAN. The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled. Examples This example shows how to configure VLAN 2 as the voice VLAN: Switch(config-if)# switchport voice vlan 2 You can verify your settings by entering the show interfaces interface-id switchport privileged EXEC command. Related Commands Command Description show interfaces interface-id switchport Displays the administrative and operational status of a switching (nonrouting) port. switchport priority extend Determines how the device connected to the specified port handles priority traffic received on its incoming port.2-445 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands system mtu system mtu Use the system global configuration command on the switch stack or on a standalone switch to set the maximum packet size or maximum transmission unit (MTU) size for Gigabit Ethernet ports or for Fast Ethernet (10/100) ports. Use the no form of this command to restore the global MTU value to its default value. system mtu {bytes | jumbo bytes} no system mtu Syntax Description Defaults The default MTU size for all ports is 1500 bytes. Command Modes Global configuration Command History Usage Guidelines When you use this command to change the MTU size, you must reset the switch before the new configuration takes effect. Gigabit Ethernet ports are not affected by the system mtu command; Fast Ethernet ports are not affected by the system mtu jumbo command. If you enter a value that is outside the range for the specific type of switch, the value is not accepted. Note The switch does not support setting the MTU on a per-interface basis. The size of frames that can be received by the switch CPU is limited to 1500 bytes, no matter what value was entered with the system mtu command. Although frames that are forwarded or routed typically are not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control traffic, SNMP, Telnet, or routing protocols. bytes Set the system MTU for Fast Ethernet (10/100) ports. The range is 1500 to 1546 bytes. jumbo bytes Set the system jumbo frame size (MTU) for Gigabit Ethernet ports. The range is 1500 to 9000 bytes. Release Modification 12.1(11)AX This command was first introduced.2-446 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands system mtu Examples This example shows how to set the maximum packet size for Gigabit Ethernet ports to 1800 bytes: Switch(config)# system mtu jumbo 1800 Switch(config)# exit Switch# reload You can verify your setting by entering the show system mtu privileged EXEC command. Related Commands Command Description show system mtu Displays the packet size set for Fast Ethernet and Gigabit Ethernet ports.Chapter 2 Cisco IOS Commands traceroute mac 2-447 Catalyst 3750 Switch Command Reference 78-15165-02 2 ] traceroute mac Use the traceroute mac privileged EXEC command on the switch stack or on a standalone switch to display the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address. traceroute mac [interface interface-id] {source-mac-address} [interface interface-id] {destination-mac-address} [vlan vlan-id] [detail] Syntax Description Defaults There is no default. Command Modes Privileged EXEC Command History Usage Guidelines The Layer 2 traceroute feature is available on these switches: • Catalyst 2950 switches running Release 12.1(12c)EA1 or later • Catalyst 2955 switches running Release 12.1(12c)EA1 or later • Catalyst 2970 switches running Release 12.1(14)EA1 or later • Catalyst 3550 switches running Release 12.1(12c)EA1 or later • Catalyst 3750 switches running Release 12.1(14)EA1 or later • Catalyst 4000 switches running Catalyst software Release 6.2 or later for the supervisor engine • Catalyst 5000 switches running Catalyst software Release 6.1 or later for the supervisor engine • Catalyst 6000 switches running Catalyst software Release 6.1 or later for the supervisor engine For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP. When the switch detects a device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out. The maximum number of hops identified in the path is ten. interface interface-id (Optional) Specify an interface on the source or destination switch. source-mac-address Specify the MAC address of the source switch in hexadecimal format. destination-mac-address Specify the MAC address of the destination switch in hexadecimal format. vlan vlan-id (Optional) Specify the VLAN on which to trace the Layer 2 path that the packets take from the source switch to the destination switch. Valid VLAN IDs are from 1 to 4094. detail (Optional) Specify that detailed information appears. Release Modification 12.1(14)EA1 This command was first introduced.2-448 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands traceroute mac Layer 2 traceroute supports only unicast traffic. If you specify a multicast source or destination MAC address, the physical path is not identified, and an error message appears. The traceroute mac command output shows the Layer 2 path when the specified source and destination addresses belong to the same VLAN. If you specify source and destination addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears. If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and an error message appears. The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears. This feature is not supported in Token Ring VLANs. Examples This example shows how to display the Layer 2 path by specifying the source and destination MAC addresses: Switch# traceroute mac 0000.0201.0601 0000.0201.0201 Source 0000.0201.0601 found on con6[WS-C3750-12T] (2.2.6.6) con6 (2.2.6.6) :Gi0/0/1 => Gi0/0/3 con5 (2.2.5.5 ) : Gi0/0/3 => Gi0/0/1 con1 (2.2.1.1 ) : Gi0/0/1 => Gi0/0/2 con2 (2.2.2.2 ) : Gi0/0/2 => Gi0/0/1 Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2) Layer 2 trace completed This example shows how to display the Layer 2 path by using the detail keyword: Switch# traceroute mac 0000.0201.0601 0000.0201.0201 detail Source 0000.0201.0601 found on con6[WS-C3750-12T] (2.2.6.6) con6 / WS-C3750-12T / 2.2.6.6 : Gi0/0/2 [auto, auto] => Gi0/0/3 [auto, auto] con5 / WS-C2950G-24-EI / 2.2.5.5 : Fa0/3 [auto, auto] => Gi0/1 [auto, auto] con1 / WS-C3550-12G / 2.2.1.1 : Gi0/1 [auto, auto] => Gi0/2 [auto, auto] con2 / WS-C3550-24 / 2.2.2.2 : Gi0/2 [auto, auto] => Fa0/1 [auto, auto] Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2) Layer 2 trace completed. This example shows how to display the Layer 2 path by specifying the interfaces on the source and destination switches: Switch# traceroute mac interface fastethernet0/1 0000.0201.0601 interface fastethernet0/3 0000.0201.0201 Source 0000.0201.0601 found on con6[WS-C3750-12T] (2.2.6.6) con6 (2.2.6.6) :Gi0/0/1 => Gi0/0/3 con5 (2.2.5.5 ) : Gi0/0/3 => Gi0/0/1 con1 (2.2.1.1 ) : Gi0/0/1 => Gi0/0/2 con2 (2.2.2.2 ) : Gi0/0/2 => Gi0/0/1 Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2) Layer 2 trace completed2-449 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands traceroute mac This example shows the Layer 2 path when the switch is not connected to the source switch: Switch# traceroute mac 0000.0201.0501 0000.0201.0201 detail Source not directly connected, tracing source ..... Source 0000.0201.0501 found on con5[WS-C3750-12T] (2.2.5.5) con5 / WS-C3750-12T / 2.2.5.5 : Gi0/0/1 [auto, auto] => Gi0/0/3 [auto, auto] con1 / WS-C3550-12G / 2.2.1.1 : Gi0/1 [auto, auto] => Gi0/2 [auto, auto] con2 / WS-C3550-24 / 2.2.2.2 : Gi0/2 [auto, auto] => Fa0/1 [auto, auto] Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2) Layer 2 trace completed. This example shows the Layer 2 path when the switch cannot find the destination port for the source MAC address: Switch# traceroute mac 0000.0011.1111 0000.0201.0201 Error:Source Mac address not found. Layer2 trace aborted. This example shows the Layer 2 path when the source and destination devices are in different VLANs: Switch# traceroute mac 0000.0201.0601 0000.0301.0201 Error:Source and destination macs are on different vlans. Layer2 trace aborted. This example shows the Layer 2 path when the destination MAC address is a multicast address: Switch# traceroute mac 0000.0201.0601 0100.0201.0201 Invalid destination mac address This example shows the Layer 2 path when source and destination switches belong to multiple VLANs: Switch# traceroute mac 0000.0201.0601 0000.0201.0201 Error:Mac found on multiple vlans. Layer2 trace aborted. Related Commands Command Description traceroute mac ip Displays the Layer 2 path taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname. 2-450 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands traceroute mac ip traceroute mac ip Use the traceroute mac ip privileged EXEC command on the switch stack or on a standalone switch to display the Layer 2 path taken by the packets from the specified source IP address or hostname to the specified destination IP address or hostname. traceroute mac ip {source-ip-address | source-hostname} {destination-ip-address | destination-hostname} [detail] Syntax Description Defaults There is no default. Command Modes Privileged EXEC Command History Usage Guidelines The Layer 2 traceroute feature is available on these switches: • Catalyst 2950 switches running Release 12.1(12c)EA1 or later • Catalyst 2955 switches running Release 12.1(12c)EA1 or later • Catalyst 2970 switches running Release 12.1(14)EA1 or later • Catalyst 3550 switches running Release 12.1(12c)EA1 or later • Catalyst 3750 switches running Release 12.1(14)EA1 or later • Catalyst 4000 switches running Catalyst software Release 6.2 or later for the supervisor engine • Catalyst 5000 switches running Catalyst software Release 6.1 or later for the supervisor engine • Catalyst 6000 switches running Catalyst software Release 6.1 or later for the supervisor engine For Layer 2 traceroute to function properly, Cisco Discovery Protocol (CDP) must be enabled on all the switches in the network. Do not disable CDP. When the switch detects an device in the Layer 2 path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out. The maximum number of hops identified in the path is ten. source-ip-address Specify the IP address of the source switch as a 32-bit quantity in dotted-decimal format. destination-ip-address Specify the IP address of the destination switch as a 32-bit quantity in dotted-decimal format. source-hostname Specify the IP hostname of the source switch. destination-hostname Specify the IP hostname of the destination switch. detail (Optional) Specify that detailed information appears. Release Modification 12.1(14)EA1 This command was first introduced.2-451 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands traceroute mac ip The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses are in the same subnet. When you specify the IP addresses, the switch uses Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs. • If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path. • If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. The IP addresses must be in the same subnet. If the IP address is not resolved, the path is not identified, and an error message appears. The Layer 2 traceroute feature is not supported when multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port). When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears. This feature is not supported in Token Ring VLANs. Examples This example shows how to display the Layer 2 path by specifying the source and destination IP addresses and by using the detail keyword: Switch# traceroute mac ip 2.2.66.66 2.2.22.22 detail Translating IP to mac ..... 2.2.66.66 => 0000.0201.0601 2.2.22.22 => 0000.0201.0201 Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6) con6 / WS-C3750-12T / 2.2.6.6 : Gi0/0/1 [auto, auto] => Gi0/0/3 [auto, auto] con5 / WS-C2950G-24-EI / 2.2.5.5 : Fa0/3 [auto, auto] => Gi0/1 [auto, auto] con1 / WS-C3550-12G / 2.2.1.1 : Gi0/1 [auto, auto] => Gi0/2 [auto, auto] con2 / WS-C3550-24 / 2.2.2.2 : Gi0/2 [auto, auto] => Fa0/1 [auto, auto] Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2) Layer 2 trace completed. This example shows how to display the Layer 2 path by specifying the source and destination hostnames: Switch# traceroute mac ip con6 con2 Translating IP to mac ..... 2.2.66.66 => 0000.0201.0601 2.2.22.22 => 0000.0201.0201 Source 0000.0201.0601 found on con6 con6 (2.2.6.6) :Gi0/0/1 => Gi0/0/3 con5 (2.2.5.5 ) : Gi0/0/3 => Gi0/1 con1 (2.2.1.1 ) : Gi0/0/1 => Gi0/2 con2 (2.2.2.2 ) : Gi0/0/2 => Fa0/1 Destination 0000.0201.0201 found on con2 Layer 2 trace completed This example shows the Layer 2 path when ARP cannot associate the source IP address with the corresponding MAC address: Switch# traceroute mac ip 2.2.66.66 2.2.77.77 Arp failed for destination 2.2.77.77. Layer2 trace aborted.2-452 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands traceroute mac ip Related Commands Command Description traceroute mac Displays the Layer 2 path taken by the packets from the specified source MAC address to the specified destination MAC address.2-453 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands trust trust Use the trust policy-map class configuration command on the switch stack or on a standalone switch to define a trust state for traffic classified through the class policy-map configuration or the class-map global configuration command. Use the no form of this command to return to the default setting. trust [cos | dscp | ip-precedence] no trust [cos | dscp | ip-precedence] Syntax Description Defaults The action is not trusted. If no keyword is specified when the command is entered, the default is dscp. Command Modes Policy-map class configuration Command History Usage Guidelines Use this command to distinguish the quality of service (QoS) trust behavior for certain traffic from other traffic. For example, incoming traffic with certain DSCP values can be trusted. You can configure a class map to match and trust the DSCP values in the incoming traffic. Trust values set with this command supersede trust values set with the mls qos trust interface configuration command. The trust command is mutually exclusive with set policy-map class configuration command within the same policy map. If you specify trust cos, QoS uses the received or default port CoS value and the CoS-to-DSCP map to generate a DSCP value for the packet. If you specify trust dscp, QoS uses the DSCP value from the ingress packet. For non-IP packets that are tagged, QoS uses the received CoS value; for non-IP packets that are untagged, QoS uses the default port CoS value. In either case, the DSCP value for the packet is derived from the CoS-to-DSCP map. cos (Optional) Classify an ingress packet by using the packet class of service (CoS) value. For an untagged packet, the port default CoS value is used. dscp (Optional) Classify an ingress packet by using the packet Differentiated Services Code Point (DSCP) values (most significant 6 bits of 8-bit service-type field). For a non-IP packet, the packet CoS value is used if the packet is tagged. If the packet is untagged, the default port CoS value is used to map CoS to DSCP. ip-precedence (Optional) Classify an ingress packet by using the packet IP-precedence value (most significant 3 bits of 8-bit service-type field). For a non-IP packet, the packet CoS value is used if the packet is tagged. If the packet is untagged, the port default CoS value is used to map CoS to DSCP. Release Modification 12.1(11)AX This command was first introduced.2-454 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands trust If you specify trust ip-precedence, QoS uses the IP precedence value from the ingress packet and the IP-precedence-to-DSCP map. For non-IP packets that are tagged, QoS uses the received CoS value; for non-IP packets that are untagged, QoS uses the default port CoS value. In either case, the DSCP for the packet is derived from the CoS-to-DSCP map. To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command. Examples This example shows how to define a port trust state to trust incoming DSCP values for traffic classified with class1: Switch(config)# policy-map policy1 Switch(config-pmap)# class class1 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit You can verify your settings by entering the show policy-map privileged EXEC command. Related Commands Command Description class Defines a traffic classification match criteria (through the police, set, and trust policy-map class configuration commands) for the specified class-map name. police Defines a policer for classified traffic. policy-map Creates or modifies a policy map that can be attached to multiple interfaces to specify a service policy. set Classifies IP traffic by setting a DSCP or IP-precedence value in the packet. show policy-map Displays QoS policy maps.2-455 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands udld (global configuration) udld (global configuration) Use the udld global configuration command on the switch stack or on a standalone switch to enable aggressive or normal mode in the UniDirectional Link Detection (UDLD) and to set the configurable message timer time. Use the no form of the command to disable aggressive or normal mode UDLD on all fiber-optic ports. udld {aggressive | enable | message time message-timer-interval} no udld {aggressive | enable | message} Syntax Description Defaults UDLD is disabled on all interfaces. The message timer is set at 60 seconds. Command Modes Global configuration Command History Usage Guidelines In normal mode, if UDLD is in the advertisement or in the detection phase and all the neighbor cache entries are aged out, UDLD restarts the link-up sequence to try to resynchronize with any potentially out-of-sync neighbors. If you enable aggressive mode, when all the neighbors of a port have aged out either in the advertisement or in the detection phase, UDLD restarts the link-up sequence to resynchronize with any potentially out-of-sync neighbor. UDLD shuts down the port if, after the fast train of messages, the link state is still undetermined. Use aggressive mode on point-to-point links where no failure between two neighbors is allowed. In this situation, UDLD probe packets can be considered as a heart beat whose presence guarantees the health of the link. Conversely, the link must be shut down if it is not possible to re-establish a bidirectional link. If you change the message time between probe packets, you are making a trade-off between the detection speed and the CPU load. By decreasing the time, you can make the detection-response faster but increase the load on the CPU. This command affects fiber-optic interfaces only. Use the udld interface configuration command to enable UDLD on other interface types. aggressive Enable UDLD in aggressive mode on all fiber-optic interfaces. enable Enable UDLD in normal mode on all fiber-optic interfaces. message time message-timer-interval Configure the period of time between UDLD probe messages on ports that are in the advertisement phase and are determined to be bidirectional. The range is 7 to 90 seconds. Release Modification 12.1(11)AX This command was first introduced.2-456 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands udld (global configuration) Examples This example shows how to enable UDLD on all fiber-optic interfaces: Switch(config)# udld enable You can verify your setting by entering the show udld privileged EXEC command. Related Commands Command Description show udld Displays UDLD administrative and operational status for all ports or the specified port. udld (interface configuration) Enables UDLD on an individual interface or prevents a fiber-optic interface from being enabled by the udld global configuration command. udld reset Resets all interfaces shut down by UDLD and permits traffic to again pass through.2-457 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands udld (interface configuration) udld (interface configuration) Use the udld interface configuration command on the switch stack or on a standalone switch to enable the UniDirectional Link Detection (UDLD) on an individual interface or prevent a fiber-optic interface from being enabled by the udld global configuration command. Use the no form of this command to return to the udld global configuration command setting or to disable UDLD if entered on a nonfiber-optic port. udld port {aggressive | disable} no udld port {aggressive | disable} Syntax Description Defaults On fiber-optic interfaces, UDLD is not enabled, in aggressive mode, or disabled. For this reason, fiber-optic interfaces enable UDLD according to the state of the udld enable or udld aggressive global configuration command. On nonfiber-optic interfaces, UDLD is disabled. Command Modes Interface configuration Command History Usage Guidelines A UDLD-capable port cannot detect a unidirectional link if it is connected to a UDLD-incapable port of another switch. In normal mode, if UDLD is in the advertisement or in the detection phase and all the neighbor cache entries are aged out, UDLD restarts the link-up sequence to try to resynchronize with any potentially out-of-sync neighbors. If you enable aggressive mode, after all the neighbors of a port have aged out either in the advertisement or in the detection phase, UDLD restarts the link-up sequence to resynchronize with any potentially out-of-sync neighbor. UDLD disables the port if, after the fast train of messages, the link state is still undetermined. Use aggressive mode on point-to-point links where no failure between two neighbors is allowed. In this situation, UDLD probe packets can be considered as a heart beat whose presence guarantees the health of the link. Conversely, the loss of the heart beat that the link must be shut down if it is not possible to re-establish a bidirectional link. Use the no udld enable command on fiber-optic ports to return control of UDLD to the udld enable global configuration command or to disable UDLD on nonfiber-optic ports. aggressive Enable UDLD in aggressive mode on the specified interface. disable Disable UDLD on the specified interface. This keyword applies only to fiber-optic interfaces. enable Enable UDLD in normal mode on the specified interface. Release Modification 12.1(11)AX This command was first introduced.2-458 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands udld (interface configuration) Use the udld aggressive command on fiber-optic ports to override the setting of the udld enable or udld aggressive global configuration command. Use the no form on fiber-optic ports to remove this setting and to return control of UDLD enabling to the udld global configuration command or to disable UDLD on nonfiber-optic ports. The disable keyword is supported on fiber-optic ports only. Use the no form of this command to remove this setting and to return control of UDLD to the udld global configuration command. If the switch software detects a GBIC module change and the port changes from fiber optic to nonfiber optic or vice versa, all configurations are maintained. Examples This example shows how to enable UDLD on an port 11 of stack member 6: Switch(config)# interface gigabitethernet6/0/11 Switch(config-if)# udld enable This example shows how to disable UDLD on a fiber-optic interface despite the setting of the udld global configuration command: Switch(config)# interface gigabitethernet6/0/11 Switch(config-if)# udld disable You can verify your settings by entering the show running-config or the show udld interface privileged EXEC command. Related Commands Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. show udld Displays UDLD administrative and operational status for all ports or the specified port. udld (global configuration) Enables aggressive or normal mode in UDLD or sets the configurable message timer time. udld reset Resets all interfaces shut down by UDLD and permits traffic to again pass through.2-459 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands udld reset udld reset Use the udld reset privileged EXEC command to reset all interfaces disabled by the UniDirectional Link Detection (UDLD) and permit traffic to begin passing through them again (though other features, such as spanning tree, Port Aggregation Protocol (PAgP), and Dynamic Trunking Protocol (DTP) still have their normal effects, if enabled). udld reset Syntax Description This command has no arguments or keywords. Command Modes Privileged EXEC Command History Usage Guidelines If the interface configuration is still enabled for UDLD, these ports begin to run UDLD again and are disabled for the same reason if the problem has not been corrected. Examples This example shows how to reset all interfaces disabled by UDLD: Switch# udld reset 1 ports shutdown by UDLD were reset. You can verify your setting by entering the show udld privileged EXEC command. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show running-config Displays the running configuration on the switch. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 > Cisco IOS File Management Commands > Configuration File Commands. show udld Displays UDLD administrative and operational status for all ports or the specified port. udld (global configuration) Enables aggressive or normal mode in UDLD or sets the configurable message timer time. udld (interface configuration) Enables UDLD on an individual interface or prevents a fiber-optic interface from being enabled by the udld global configuration command.2-460 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) vlan (global configuration) Use the vlan global configuration command on the switch stack or on a standalone switch to add a VLAN and to enter the config-vlan mode. Use the no form of this command to delete the VLAN. Configuration information for normal-range VLANs (VLAN IDs 1 to 1005) is always saved in the VLAN database. When VLAN Trunking Protocol (VTP) mode is transparent, you can create extended-range VLANs (VLAN IDs greater than 1005), and the VTP mode, domain name, and the VLAN configuration are saved in the switch running configuration file. You can save configurations in the switch startup configuration file by entering the copy running-config startup-config privileged EXEC command. vlan vlan-id no vlan vlan-id Syntax Description Defaults This command has no default settings. Command Modes Global configuration Command History Usage Guidelines You must use the vlan vlan-id global configuration command to add extended-range VLANs (VLAN IDs 1006 to 4094). Before configuring VLANs in the extended range, you must use the vtp transparent global configuration or VLAN configuration command to put the switch in VTP transparent mode. Extended-range VLANs are not learned by VTP and are not added to the VLAN database, but when VTP mode is transparent, VTP mode and domain name and all VLAN configurations are saved in the running configuration, and you can save them in the switch startup configuration file. When you save the VLAN and VTP configurations in the startup configuration file and reboot the switch, the configuration is determined in these ways: • If both the VLAN database and the configuration file show the VTP mode as transparent and the VTP domain names match, the VLAN database is ignored. The VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database. • If the VTP mode is server, or if the startup VTP mode or domain names do not match the VLAN database, the VTP mode and the VLAN configuration for the first 1005 VLANs use the VLAN database information. If you try to create an extended-range VLAN when the switch is not in VTP transparent mode, the VLAN is rejected, and you receive an error message. vlan-id ID of the VLAN to be added and configured. For vlan-id, the range is 1 to 4094. You can enter a single VLAN ID, a series of VLAN IDs separated by commas, or a range of VLAN IDs separated by hyphens. Release Modification 12.1(11)AX This command was first introduced.2-461 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) If you enter an invalid VLAN ID, you receive an error message and do not enter config-vlan mode. Entering the vlan command with a VLAN ID enables config-vlan mode. When you enter the VLAN ID of an existing VLAN, you do not create a new VLAN, but you can modify VLAN parameters for that VLAN. The specified VLANs are added or modified when you exit the config-vlan mode. Only the shutdown command (for VLANs 1 to 1005) takes effect immediately. These configuration commands are available in config-vlan mode. The no form of each command returns the characteristic to its default state. Note Although all commands are visible, the only config-vlan command supported on extended-range VLANs is mtu mtu-size. For extended-range VLANs, all other characteristics must remain at the default state. • are are-number: defines the maximum number of all-routes explorer (ARE) hops for this VLAN. This keyword applies only to TrCRF VLANs.The range is 0 to 13. The default is 7. If no value is entered, 0 is assumed to be the maximum. • backupcrf: specifies the backup CRF mode. This keyword applies only to TrCRF VLANs. – enable backup CRF mode for this VLAN. – disable backup CRF mode for this VLAN (the default). • bridge {bridge-number| type}: specifies the logical distributed source-routing bridge, the bridge that interconnects all logical rings having this VLAN as a parent VLAN in FDDI-NET, Token Ring-NET, and TrBRF VLANs. The range is 0 to 15. The default bridge number is 0 (no source-routing bridge) for FDDI-NET, TrBRF, and Token Ring-NET VLANs. The type keyword applies only to TrCRF VLANs and is one of these: – srb (source-route bridging) – srt (source-route transparent) bridging VLAN • exit: applies changes, increments the VLAN database revision number (VLANs 1 to 1005 only), and exits config-vlan mode. • media: defines the VLAN media type. See Table 2-28 for valid commands and syntax for different media types. Note The switch supports only Ethernet ports. You configure only FDDI and Token Ring media-specific characteristics for VLAN Trunking Protocol (VTP) global advertisements to other switches. These VLANs are locally suspended. – ethernet is Ethernet media type (the default). – fddi is FDDI media type. – fd-net is FDDI network entity title (NET) media type. – tokenring is Token Ring media type if the VTP v2 mode is disabled, or TrCRF if the VTP version 2 (v) mode is enabled. – tr-net is Token Ring network entity title (NET) media type if the VTP v2 mode is disabled or TrBRF media type if the VTP v2 mode is enabled. • mtu mtu-size: specifies the maximum transmission unit (MTU) (packet size in bytes). The range is 1500 to 18190. The default is 1500 bytes.2-462 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) • name vlan-name: names the VLAN with an ASCII string from 1 to 32 characters that must be unique within the administrative domain. The default is VLANxxxx where xxxx represents four numeric digits (including leading zeros) equal to the VLAN ID number. • no: negates a command or returns it to the default setting. • parent parent-vlan-id: specifies the parent VLAN of an existing FDDI, Token Ring, or TrCRF VLAN. This parameter identifies the TrBRF to which a TrCRF belongs and is required when defining a TrCRF. The range is 0 to 1005. The default parent VLAN ID is 0 (no parent VLAN) for FDDI and Token Ring VLANs. For both Token Ring and TrCRF VLANs, the parent VLAN ID must already exist in the database and be associated with a Token Ring-NET or TrBRF VLAN. Note Though visible in the command-line interface, the private-vlan command is not supported. • remote-span: configure the VLAN as a Remote SPAN (RSPAN) VLAN. When the RSPAN feature is added to an existing VLAN, the VLAN is first deleted and is then recreated with the RSPAN feature. Any access ports are deactivated until the RSPAN feature is removed. If VTP is enabled, the new RSPAN VLAN is propagated by VTP for VLAN-IDs that are lower than 1024. Learning is disabled on the VLAN. See the remote-span command for more information. • ring ring-number: defines the logical ring for an FDDI, Token Ring, or TrCRF VLAN. The range is 1 to 4095. The default for Token Ring VLANs is 0. For FDDI VLANs, there is no default. • said said-value: specifies the security association identifier (SAID) as documented in IEEE 802.10. The range is 1 to 4294967294, and the number must be unique within the administrative domain. The default value is 100000 plus the VLAN ID number. • shutdown: shuts down VLAN switching on the VLAN. This command takes effect immediately. Other commands take effect when you exit config-vlan mode. • state: specifies the VLAN state: – active means the VLAN is operational (the default). – suspend means the VLAN is suspended. Suspended VLANs do not pass packets. • ste ste-number: defines the maximum number of spanning-tree explorer (STE) hops. This keyword applies only to TrCRF VLANs. The range is 0 to 13. The default is 7. • stp type: defines the spanning-tree type for FDDI-NET, Token Ring-NET, or TrBRF VLANs. For FDDI-NET VLANs, the default STP type is ieee. For Token Ring-NET VLANs, the default STP type is ibm. For FDDI and Token Ring VLANs, the default is no type specified. – ieee for IEEE Ethernet STP running source-route transparent (SRT) bridging. – ibm for IBM STP running source-route bridging (SRB). – auto for STP running a combination of source-route transparent bridging (IEEE) and source-route bridging (IBM). • tb-vlan1 tb-vlan1-id and tb-vlan2 tb-vlan2-id: specifies the first and second VLAN to which this VLAN is translationally bridged. Translational VLANs translate FDDI or Token Ring to Ethernet, for example. The range is 0 to 1005. If no value is specified, 0 (no transitional bridging) is assumed.2-463 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) Table 2-28 Valid Commands and Syntax for Different Media Types Media Type Valid Syntax Ethernet name vlan-name, media ethernet, state {suspend | active}, said said-value, mtu mtu-size, remote-span, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id FDDI name vlan-name, media fddi, state {suspend | active}, said said-value, mtu mtu-size, ring ring-number, parent parent-vlan-id, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id FDDI-NET name vlan-name, media fd-net, state {suspend | active}, said said-value, mtu mtu-size, bridge bridge-number, stp type {ieee | ibm | auto}, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id If VTP v2 mode is disabled, do not set the stp type to auto. Token Ring VTP v1 mode is enabled. name vlan-name, media tokenring, state {suspend | active}, said said-value, mtu mtu-size, ring ring-number, parent parent-vlan-id, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id Token Ring concentrator relay function (TrCRF) VTP v2 mode is enabled. name vlan-name, media tokenring, state {suspend | active}, said said-value, mtu mtu-size, ring ring-number, parent parent-vlan-id, bridge type {srb | srt}, are are-number, ste ste-number, backupcrf {enable | disable}, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id Token Ring-NET VTP v1 mode is enabled. name vlan-name, media tr-net, state {suspend | active}, said said-value, mtu mtu-size, bridge bridge-number, stp type {ieee | ibm}, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id Token Ring bridge relay function (TrBRF) VTP v2 mode is enabled. name vlan-name, media tr-net, state {suspend | active}, said said-value, mtu mtu-size, bridge bridge-number, stp type {ieee | ibm | auto}, tb-vlan1 tb-vlan1-id, tb-vlan2 tb-vlan2-id2-464 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) Table 2-29 describes the rules for configuring VLANs. Examples This example shows how to add an Ethernet VLAN with default media characteristics. The default includes a vlan-name of VLANxxx, where xxxx represents four numeric digits (including leading zeros) equal to the VLAN ID number. The default media option is ethernet; the state option is active. The default said-value variable is 100000 plus the VLAN ID; the mtu-size variable is 1500; the stp-type option is ieee. When you enter the exit config-vlan configuration command, the VLAN is added if it did not already exist; otherwise, this command does nothing. This example shows how to create a new VLAN with all default characteristics and enter config-vlan mode: Switch(config)# vlan 200 Switch(config-vlan)# exit Switch(config)# Table 2-29 VLAN Configuration Rules Configuration Rule VTP v2 mode is enabled, and you are configuring a TrCRF VLAN media type. Specify a parent VLAN ID of a TrBRF that already exists in the database. Specify a ring number. Do not leave this field blank. Specify unique ring numbers when TrCRF VLANs have the same parent VLAN ID. Only one backup concentrator relay function (CRF) can be enabled. VTP v2 mode is enabled, and you are configuring VLANs other than TrCRF media type. Do not specify a backup CRF. VTP v2 mode is enabled, and you are configuring a TrBRF VLAN media type. Specify a bridge number. Do not leave this field blank. VTP v1 mode is enabled. No VLAN can have an STP type set to auto. This rule applies to Ethernet, FDDI, FDDI-NET, Token Ring, and Token Ring-NET VLANs. Add a VLAN that requires translational bridging (values are not set to zero). The translational bridging VLAN IDs that are used must already exist in the database. The translational bridging VLAN IDs that a configuration points to must also contain a pointer to the original VLAN in one of the translational bridging parameters (for example, Ethernet points to FDDI, and FDDI points to Ethernet). The translational bridging VLAN IDs that a configuration points to must be different media types than the original VLAN (for example, Ethernet can point to Token Ring). If both translational bridging VLAN IDs are configured, these VLANs must be different media types (for example, Ethernet can point to FDDI and Token Ring).2-465 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (global configuration) This example shows how to create a new extended-range VLAN with all the default characteristics, to enter config-vlan mode, and to save the new VLAN in the switch startup configuration file: Switch(config)# vtp mode transparent Switch(config)# vlan 2000 Switch(config-vlan)# end Switch# copy running-config startup config You can verify your setting by entering the show vlan privileged EXEC command. Related Commands Command Description show running-config vlan Displays all or a range of VLAN-related configurations on the switch. show vlan Displays the parameters for all configured VLANs or one VLAN (if the VLAN ID or name is specified) in the administrative domain. vlan (VLAN configuration) Configures normal-range VLANs in the VLAN database.2-466 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) vlan (VLAN configuration) Use the vlan VLAN configuration command on the switch stack or on a standalone switch to configure VLAN characteristics for a normal-range VLAN (VLAN IDs 1 to 1005) in the VLAN database. You access VLAN configuration mode by entering the vlan database privileged EXEC command. Use the no form of this command without additional parameters to delete a VLAN. Use the no form with parameters to change its configured characteristics. vlan vlan-id [are are-number] [backupcrf {enable | disable}] [bridge bridge-number | type {srb | srt}] [media {ethernet | fddi | fdi-net | tokenring | tr-net}] [mtu mtu-size] [name vlan-name] [parent parent-vlan-id] [ring ring-number] [said said-value] [state {suspend | active}] [ste ste-number] [stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] no vlan vlan-id [are are-number] [backupcrf {enable | disable}] [bridge bridge-number | type {srb | srt}] [media {ethernet | fddi | fdi-net | tokenring | tr-net}] [mtu mtu-size] [name vlan-name] [parent parent-vlan-id] [ring ring-number] [said said-value] [state {suspend | active}] [ste ste-number] [stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] Extended-range VLANs (with VLAN IDs from 1006 to 4094) cannot be added or modified by using these commands. To add extended-range VLANs, use the vlan (global configuration) command to enter config-vlan mode. Note The switch supports only Ethernet ports. You configure only FDDI and Token Ring media-specific characteristics for VLAN Trunking Protocol (VTP) global advertisements to other switches. These VLANs are locally suspended. Syntax Description vlan-id ID of the configured VLAN. The range is 1 to 1005 and must be unique within the administrative domain. Do not enter leading zeros. are are-number (Optional) Specify the maximum number of all-routes explorer (ARE) hops for this VLAN. This keyword applies only to TrCRF VLANs. The range is 0 to 13. If no value is entered, 0 is assumed to be the maximum. backupcrf {enable | disable} (Optional) Specify the backup CRF mode. This keyword applies only to TrCRF VLANs. • enable backup CRF mode for this VLAN. • disable backup CRF mode for this VLAN. bridge bridge-number| type {srb | srt} (Optional) Specify the logical distributed source-routing bridge, the bridge that interconnects all logical rings having this VLAN as a parent VLAN in FDDI-NET, Token Ring-NET, and TrBRF VLANs. The range is 0 to 15. The type keyword applies only to TrCRF VLANs and is one of these: • srb (source-route bridging) • srt (source-route transparent) bridging VLAN2-467 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) Table 2-30 shows the valid syntax options for different media types. media {ethernet | fddi | fd-net | tokenring | tr-net} (Optional) Specify the VLAN media type. Table 2-30 lists the valid syntax for each media type. • ethernet is Ethernet media type (the default). • fddi is FDDI media type. • fd-net is FDDI network entity title (NET) media type. • tokenring is Token Ring media type if the VTP v2 mode is disabled, or TrCRF if the VTP v2 mode is enabled. • tr-net is Token Ring network entity title (NET) media type if the VTP v2 mode is disabled or TrBRF media type if the VTP v2 mode is enabled. mtu mtu-size (Optional) Specify the maximum transmission unit (MTU) (packet size in bytes). The range is 1500 to 18190. name vlan-name (Optional) Specify the VLAN name, an ASCII string from 1 to 32 characters that must be unique within the administrative domain. parent parent-vlan-id (Optional) Specify the parent VLAN of an existing FDDI, Token Ring, or TrCRF VLAN. This parameter identifies the TrBRF to which a TrCRF belongs and is required when defining a TrCRF. The range is 0 to 1005. ring ring-number (Optional) Specify the logical ring for an FDDI, Token Ring, or TrCRF VLAN. The range is 1 to 4095. said said-value (Optional) Enter the security association identifier (SAID) as documented in IEEE 802.10. The range is 1 to 4294967294, and the number must be unique within the administrative domain. state {suspend | active} (Optional) Specify the VLAN state: • If active, the VLAN is operational. • If suspend, the VLAN is suspended. Suspended VLANs do not pass packets. ste ste-number (Optional) Specify the maximum number of spanning-tree explorer (STE) hops. This keyword applies only to TrCRF VLANs. The range is 0 to 13. stp type {ieee | ibm | auto} (Optional) Specify the spanning-tree type for FDDI-NET, Token Ring-NET, or TrBRF VLAN. • ieee for IEEE Ethernet STP running source-route transparent (SRT) bridging. • ibm for IBM STP running source-route bridging (SRB). • auto for STP running a combination of source-route transparent bridging (IEEE) and source-route bridging (IBM). tb-vlan1 tb-vlan1-id and tb-vlan2 tb-vlan2-id (Optional) Specify the first and second VLAN to which this VLAN is translationally bridged. Translational VLANs translate FDDI or Token Ring to Ethernet, for example. The range is 0 to 1005. Zero is assumed if no value is specified.2-468 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) Table 2-31 describes the rules for configuring VLANs. Table 2-30 Valid Syntax for Different Media Types Media Type Valid Syntax Ethernet vlan vlan-id [name vlan-name] media ethernet [state {suspend | active}] [said said-value] [mtu mtu-size] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] FDDI vlan vlan-id [name vlan-name] media fddi [state {suspend | active}] [said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] FDDI-NET vlan vlan-id [name vlan-name] media fd-net [state {suspend | active}] [said said-value] [mtu mtu-size] [bridge bridge-number] [stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] If VTP v2 mode is disabled, do not set the stp type to auto. Token Ring VTP v1 mode is enabled. vlan vlan-id [name vlan-name] media tokenring [state {suspend | active}] [said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] Token Ring concentrator relay function (TrCRF) VTP v2 mode is enabled. vlan vlan-id [name vlan-name] media tokenring [state {suspend | active}] [said said-value] [mtu mtu-size] [ring ring-number] [parent parent-vlan-id] [bridge type {srb | srt}] [are are-number] [ste ste-number] [backupcrf {enable | disable}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] Token Ring-NET VTP v1 mode is enabled. vlan vlan-id [name vlan-name] media tr-net [state {suspend | active}] [said said-value] [mtu mtu-size] [bridge bridge-number] [stp type {ieee | ibm}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] Token Ring bridge relay function (TrBRF) VTP v2 mode is enabled. vlan vlan-id [name vlan-name] media tr-net [state {suspend | active}] [said said-value] [mtu mtu-size] [bridge bridge-number] [stp type {ieee | ibm | auto}] [tb-vlan1 tb-vlan1-id] [tb-vlan2 tb-vlan2-id] Table 2-31 VLAN Configuration Rules Configuration Rule VTP v2 mode is enabled, and you are configuring a TrCRF VLAN media type. Specify a parent VLAN ID of a TrBRF that already exists in the database. Specify a ring number. Do not leave this field blank. Specify unique ring numbers when TrCRF VLANs have the same parent VLAN ID. Only one backup concentrator relay function (CRF) can be enabled. VTP v2 mode is enabled, and you are configuring VLANs other than TrCRF media type. Do not specify a backup CRF.2-469 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) Defaults The ARE value is 7. Backup CRF is disabled. The bridge number is 0 (no source-routing bridge) for FDDI-NET, TrBRF, and Token Ring-NET VLANs. The media type is ethernet. The default mtu size is 1500 bytes. The vlan-name variable is VLANxxxx, where xxxx represents four numeric digits (including leading zeros) equal to the VLAN ID number. The parent VLAN ID is 0 (no parent VLAN) for FDDI and Token Ring VLANs. For TrCRF VLANs, you must specify a parent VLAN ID. For both Token Ring and TrCRF VLANs, the parent VLAN ID must already exist in the database and be associated with a Token Ring-NET or TrBRF VLAN. The ring number for Token Ring VLANs is 0. For FDDI VLANs, there is no default. The said value is 100000 plus the VLAN ID. The state is active. The STE value is 7. The STP type is ieee for FDDI-NET and ibm for Token Ring-NET VLANs. For FDDI and Token Ring VLANs, the default is no type specified. The tb-vlan1-id and tb-vlan2-id variables are zero (no translational bridging). Command Modes VLAN configuration VTP v2 mode is enabled, and you are configuring a TrBRF VLAN media type. Specify a bridge number. Do not leave this field blank. VTP v1 mode is enabled. No VLAN can have an STP type set to auto. This rule applies to Ethernet, FDDI, FDDI-NET, Token Ring, and Token Ring-NET VLANs. Add a VLAN that requires translational bridging (values are not set to zero). The translational bridging VLAN IDs that are used must already exist in the database. The translational bridging VLAN IDs that a configuration points to must also contain a pointer to the original VLAN in one of the translational bridging parameters (for example, Ethernet points to FDDI, and FDDI points to Ethernet). The translational bridging VLAN IDs that a configuration points to must be different media types than the original VLAN (for example, Ethernet can point to Token Ring). If both translational bridging VLAN IDs are configured, these VLANs must be different media types (for example, Ethernet can point to FDDI and Token Ring). Table 2-31 VLAN Configuration Rules (continued) Configuration Rule2-470 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) Command History Usage Guidelines You can only use this command mode for configuring normal-range VLANs, that is, VLAN IDs 1 to 1005. Note To configure extended-range VLANs (VLAN IDs 1006 to 4094), use the vlan global configuration command. VLAN configuration is always saved in the VLAN database. If VTP mode is transparent, it is also saved in the switch running configuration file, along with the VTP mode and domain name. You can then save it in the switch startup configuration file by using the copy running-config startup-config privileged EXEC command. When you save VLAN and VTP configuration in the startup configuration file and reboot the switch, the configuration is determined in these ways: • If both the VLAN database and the configuration file show the VTP mode as transparent and the VTP domain names match, the VLAN database is ignored. The VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database. • If the VTP mode is server, or if the startup VTP mode or domain names do not match the VLAN database, the VTP mode and the VLAN configuration for the first 1005 VLANs use VLAN database information. The following are the results of using the no vlan commands: • When the no vlan vlan-id form is used, the VLAN is deleted. Deleting VLANs automatically resets to zero any other parent VLANs and translational bridging parameters that refer to the deleted VLAN. • When the no vlan vlan-id bridge form is used, the VLAN source-routing bridge number returns to the default (0). The vlan vlan-id bridge command is used only for FDDI-NET and Token Ring-NET VLANs and is ignored in other VLAN types. • When the no vlan vlan-id media form is used, the media type returns to the default (ethernet). Changing the VLAN media type (including the no form) resets the VLAN MTU to the default MTU for the type (unless the mtu keyword is also present in the command). It also resets the VLAN parent and translational bridging VLAN to the default (unless the parent, tb-vlan1, or tb-vlan2 are also present in the command). • When the no vlan vlan-id mtu form is used, the VLAN MTU returns to the default for the applicable VLAN media type. You can also modify the MTU by using the media keyword. • When the no vlan vlan-id name vlan-name form is used, the VLAN name returns to the default name (VLANxxxx, where xxxx represent four numeric digits [including leading zeros] equal to the VLAN ID number). • When the no vlan vlan-id parent form is used, the parent VLAN returns to the default (0). The parent VLAN resets to the default if the parent VLAN is deleted or if the media keyword changes the VLAN type or the VLAN type of the parent VLAN. • When the no vlan vlan-id ring form is used, the VLAN logical ring number returns to the default (0). Release Modification 12.1(11)AX This command was first introduced.2-471 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan (VLAN configuration) • When the no vlan vlan-id said form is used, the VLAN SAID returns to the default (100,000 plus the VLAN ID). • When the no vlan vlan-id state form is used, the VLAN state returns to the default (active). • When the no vlan vlan-id stp type form is used, the VLAN spanning-tree type returns to the default (ieee). • When the no vlan vlan-id tb-vlan1 or no vlan vlan-id tb-vlan2 form is used, the VLAN translational bridge VLAN (or VLANs, if applicable) returns to the default (0). Translational bridge VLANs must be a different VLAN type than the affected VLAN, and if two are specified, the two must be different VLAN types from each other. A translational bridge VLAN resets to the default if the translational bridge VLAN is deleted, if the media keyword changes the VLAN type, or if the media keyword changes the VLAN type of the corresponding translation bridge VLAN. Examples This example shows how to add an Ethernet VLAN with default media characteristics. The default includes a vlan-name of VLANxxx, where xxxx represents four numeric digits (including leading zeros) equal to the VLAN ID number. The default media option is ethernet; the state option is active. The default said-value variable is 100000 plus the VLAN ID; the mtu-size variable is 1500; the stp-type option is ieee. When you enter the exit or apply vlan configuration command, the VLAN is added if it did not already exist; otherwise, this command does nothing. Switch(vlan)# vlan 2 VLAN 2 added: Name: VLAN0002 Switch(vlan)# exit APPLY completed. Exiting.... This example shows how to modify an existing VLAN by changing its name and MTU size: Switch(vlan)# no vlan name engineering mtu 1200 You can verify your settings by entering the show vlan privileged EXEC command. Related Commands Command Description show vlan Displays the parameters for all configured VLANs or one VLAN (if the VLAN ID or name is specified) in the administrative domain. vlan (global configuration) Enters config-vlan mode for configuring normal-range and extended-range VLANs.2-472 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan access-map vlan access-map Use the vlan access-map global configuration command on the switch stack or on a standalone switch to create or modify a VLAN map entry for VLAN packet filtering. This entry changes the mode to the VLAN access map configuration. Use the no form of this command to delete a VLAN map entry. Use the vlan filter interface configuration command to apply a VLAN map to one or more VLANs. vlan access-map name [number] no vlan access-map name [number] Syntax Description Defaults There are no VLAN map entries and no VLAN maps applied to a VLAN. Command Modes Global configuration Command History Usage Guidelines In global configuration mode, use this command to create or modify a VLAN map. This entry changes the mode to VLAN access-map configuration, where you can use the match access-map configuration command to specify the access lists for IP or non-IP traffic to match and use the action command to set whether a match causes the packet to be forwarded or dropped. In VLAN access map configuration mode, these commands are available: • action: sets the action to be taken (forward or drop). • default: sets a command to its defaults • exit: exits from VLAN access-map configuration mode • match: sets the values to match (IP address or MAC address). • no: negates a command or set its defaults When you do not specify an entry number (sequence number), it is added to the end of the map. There can be only one VLAN map per VLAN and it is applied as packets are received by a VLAN. You can use the no vlan access-map name [number] command with a sequence number to delete a single entry. In global configuration mode, use the vlan filter interface configuration command to apply the map to one or more VLANs. name Name of the VLAN map. number (Optional) The sequence number of the map entry that you want to create or modify (0 to 65535). If you are creating a VLAN map and the sequence number is not specified, it is automatically assigned in increments of 10, starting from 10. This number is the sequence to insert to, or delete from, a VLAN access-map entry. Release Modification 12.1(11)AX This command was first introduced.2-473 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan access-map Note For more information about VLAN map entries, refer to the software configuration guide for this release. Examples This example shows how to create a VLAN map named vac1 and apply matching conditions and actions to it. If no other entries already exist in the map, this will be entry 10. Switch(config)# vlan access-map vac1 Switch(config-access-map)# match ip address acl1 Switch(config-access-map)# action forward This example shows how to delete VLAN map vac1: Switch(config)# no vlan access-map vac1 Related Commands Command Description action Sets the action for the VLAN access map entry. match (access-map configuration)) Sets the VLAN map to match packets against one or more access lists. show vlan access-map Displays information about a particular VLAN access map or all VLAN access maps. vlan filter Applies the VLAN access map to one or more VLANs.2-474 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan database vlan database Use the vlan database privileged EXEC command on the switch stack or on a standalone switch to enter VLAN configuration mode. From this mode, you can add, delete, and modify VLAN configurations for normal-range VLANs and globally propagate these changes by using the VLAN Trunking Protocol (VTP). Configuration information is saved in the VLAN database. vlan database Note VLAN configuration mode is only valid for VLAN IDs 1 to 1005. Syntax Description This command has no arguments or keywords. Defaults No default is defined. Command Modes Privileged EXEC Command History Usage Guidelines You can use the VLAN database configuration commands to configure VLANs 1 to 1005. To configure extended-range VLANs (VLAN IDs 1006 to 4094), use the vlan (global configuration) command to enter config-vlan mode. You can also configure VLAN IDs 1 to 1005 by using the vlan global configuration command. To return to the privileged EXEC mode from the VLAN configuration mode, enter the exit command. Note This command mode is different from other modes because it is session-oriented. When you add, delete, or modify VLAN parameters, the changes are not applied until you exit the session by entering the apply or exit command. When the changes are applied, the VTP configuration version is incremented. You can also not apply the changes to the VTP database by entering abort. When you are in VLAN configuration mode, you can access the VLAN database and make changes by using these commands: • vlan: accesses subcommands to add, delete, or modify values associated with a single VLAN. For more information, see the vlan (VLAN configuration) command. • vtp: accesses subcommands to perform VTP administrative functions. For more information, see the vtp (VLAN configuration) command. Release Modification 12.1(11)AX This command was first introduced.2-475 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan database When you have modified VLAN or VTP parameters, you can use these editing buffer manipulation commands: • abort: exits the mode without applying the changes. The VLAN configuration that was running before you entered VLAN configuration mode continues to be used. • apply: applies current changes to the VLAN database, increments the database configuration revision number, propagates it throughout the administrative domain, and remains in VLAN configuration mode. Note You cannot use this command when the switch is in VTP client mode. • exit: applies all configuration changes to the VLAN database, increments the database configuration number, propagates it throughout the administrative domain, and returns to privileged EXEC mode. • no: negates a command or set its defaults; valid values are vlan and vtp. • reset: abandons proposed changes to the VLAN database, resets the proposed database to the implemented VLAN database on the switch, and remains in VLAN configuration mode. • show: displays VLAN database information. • show changes [vlan-id]: displays the differences between the VLAN database on the switch and the proposed VLAN database for all normal-range VLAN IDs (1 to 1005) or the specified VLAN ID (1 to 1005). • show current [vlan-id]: displays the VLAN database on the switch or on a selected VLAN (1 to 1005). • show proposed [vlan-id]: displays the proposed VLAN database or a selected VLAN (1 to 1005) from the proposed database. The proposed VLAN database is not the running configuration until you use the exit or apply VLAN configuration command. You can verify that VLAN database changes have been made or aborted by using the show vlan privileged EXEC command. This output is different from the show VLAN database configuration command output. Examples This example shows how to enter the VLAN configuration mode from the privileged EXEC mode and to display VLAN database information: Switch# vlan database Switch(vlan)# show VLAN ISL Id: 1 Name: default Media Type: Ethernet VLAN 802.10 Id: 100001 State: Operational MTU: 1500 Translational Bridged VLAN: 1002 Translational Bridged VLAN: 1003 VLAN ISL Id: 2 Name: VLAN0002 Media Type: Ethernet VLAN 802.10 Id: 100002 State: Operational MTU: 15002-476 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan database VLAN ISL Id: 1002 Name: fddi-default Media Type: FDDI VLAN 802.10 Id: 101002 State: Operational MTU: 1500 Bridge Type: SRB Ring Number: 0 Translational Bridged VLAN: 1 Translational Bridged VLAN: 1003

This is an example of output from the show changes command: Switch(vlan)# show changes DELETED: VLAN ISL Id: 4 Name: VLAN0004 Media Type: Ethernet VLAN 802.10 Id: 100004 State: Operational MTU: 1500 MODIFIED: VLAN ISL Id: 7 Current State: Operational Modified State: Suspended This example shows how to display the differences between VLAN 7 in the current database and the proposed database. Switch(vlan)# show changes 7 MODIFIED: VLAN ISL Id: 7 Current State: Operational Modified State: Suspended This is an example of output from the show current 20 command. It displays only VLAN 20 of the current database. Switch(vlan)# show current 20 VLAN ISL Id: 20 Name: VLAN0020 Media Type: Ethernet VLAN 802.10 Id: 100020 State: Operational MTU: 1500 Related Commands Command Description show vlan Displays the parameters for all configured VLANs in the administrative domain. shutdown vlan Shuts down (suspends) local traffic on the specified VLAN. vlan (global configuration) Enters config-vlan mode for configuring normal-range and extended-range VLANs.2-477 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan filter vlan filter Use the vlan filter global configuration command on the switch stack or on a standalone switch to apply a VLAN map to one or more VLANs. Use the no form of this command to remove the map. vlan filter mapname vlan-list {list | all} no vlan filter mapname vlan-list {list | all} Syntax Description Defaults There are no VLAN filters. Command Modes Global configuration Command History Usage Guidelines To avoid accidentally dropping too many packets and disabling connectivity in the middle of the configuration process, we recommend that you completely define the VLAN access map before applying it to a VLAN. Note For more information about VLAN map entries, refer to the software configuration guide for this release. Examples This example applies VLAN map entry map1 to VLANs 20 and 30: Switch(config)# vlan filter map1 vlan-list 20, 30 This example shows how to delete VLAN map entry mac1 from VLAN 20: Switch(config)# no vlan filter map1 vlan-list 20 You can verify your settings by entering the show vlan filter privileged EXEC command. mapname Name of the VLAN map entry. list The list of one or more VLANs in the form tt, uu-vv, xx, yy-zz, where spaces around commas and dashes are optional. The range is 1 to 4094. all Remove the filter from all VLANs. Release Modification 12.1(11)AX This command was first introduced.2-478 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vlan filter Related Commands Command Description show vlan access-map Displays information about a particular VLAN access map or all VLAN access maps. show vlan filter Displays information about all VLAN filters or about a particular VLAN or VLAN access map. vlan access-map Creates a VLAN map entry for VLAN packet filtering.2-479 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vmps reconfirm (privileged EXEC) vmps reconfirm (privileged EXEC) Use the vmps reconfirm privileged EXEC command on the switch stack or on a standalone switch to immediately send VLAN Query Protocol (VQP) queries to reconfirm all dynamic VLAN assignments with the VLAN Membership Policy Server (VMPS). vmps reconfirm Syntax Description This command has no arguments or keywords. Defaults No default is defined. Command Modes Privileged EXEC Command History Examples This example shows how to immediately send VQP queries to the VMPS: Switch# vmps reconfirm You can verify your setting by entering the show vmps privileged EXEC command and examining the VMPS Action row of the Reconfirmation Status section. The show vmps command shows the result of the last time the assignments were reconfirmed either because the reconfirmation timer expired or because the vmps reconfirm command was entered. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show vmps Displays VQP and VMPS information. vmps reconfirm (global configuration) Changes the reconfirmation interval for the VLAN Query Protocol (VQP) client.2-480 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vmps reconfirm (global configuration) vmps reconfirm (global configuration) Use the vmps reconfirm global configuration command on the switch stack or on a standalone switch to change the reconfirmation interval for the VLAN Query Protocol (VQP) client. Use the no form of this command to return to the default setting. vmps reconfirm interval no vmps reconfirm Syntax Description Defaults The default reconfirmation interval is 60 minutes. Command Modes Global configuration Command History Examples This example shows how to set the VQP client to reconfirm dynamic VLAN entries every 20 minutes: Switch(config)# vmps reconfirm 20 You can verify your setting by entering the show vmps privileged EXEC command and examining information in the Reconfirm Interval row. Related Commands interval Reconfirmation interval for VQP client queries to the VLAN Membership Policy Server (VMPS) to reconfirm dynamic VLAN assignments. The range is 1 to 120 minutes. Release Modification 12.1(11)AX This command was first introduced. Command Description show vmps Displays VQP and VMPS information. vmps reconfirm (privileged EXEC) Sends VQP queries to reconfirm all dynamic VLAN assignments with the VMPS.2-481 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vmps retry vmps retry Use the vmps retry global configuration command on the switch stack or on a standalone switch to configure the per-server retry count for the VLAN Query Protocol (VQP) client. Use the no form of this command to return to the default setting. vmps retry count no vmps retry Syntax Description Defaults The default retry count is 3. Command Modes Global configuration Command History Examples This example shows how to set the retry count to 7: Switch(config)# vmps retry 7 You can verify your setting by entering the show vmps privileged EXEC command and examining information in the Server Retry Count row. Related Commands count Number of attempts to contact the VLAN Membership Policy Server (VMPS) by the client before querying the next server in the list. The range is 1 to 10. Release Modification 12.1(11)AX This command was first introduced. Command Description show vmps Displays VQP and VMPS information.2-482 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vmps server vmps server Use the vmps server global configuration command on the switch stack or on a standalone switch to configure the primary VLAN Membership Policy Server (VMPS) and up to three secondary servers. Use the no form of this command to remove a VMPS server. vmps server ipaddress [primary] no vmps server [ipaddress] Syntax Description Defaults No primary or secondary VMPS servers are defined. Command Modes Global configuration Command History Usage Guidelines The first server entered is automatically selected as the primary server whether or not primary is entered. The first server address can be overridden by using primary in a subsequent command. If a member switch in a cluster configuration does not have an IP address, the cluster does not use the VMPS server configured for that member switch. Instead, the cluster uses the VMPS server on the command switch, and the command switch proxies the VMPS requests. The VMPS server treats the cluster as a single switch and uses the IP address of the command switch to respond to requests. When using the no form without specifying the ipaddress, all configured servers are deleted. If you delete all servers when dynamic-access ports are present, the switch cannot forward packets from new sources on these ports because it cannot query the VMPS. Examples This example shows how to configure the server with IP address 191.10.49.20 as the primary VMPS server. The servers with IP addresses 191.10.49.21 and 191.10.49.22 are configured as secondary servers: Switch(config)# vmps server 191.10.49.20 primary Switch(config)# vmps server 191.10.49.21 Switch(config)# vmps server 191.10.49.22 ipaddress IP address or host name of the primary or secondary VMPS servers. If you specify a host name, the Domain Name System (DNS) server must be configured. primary (Optional) Determines whether primary or secondary VMPS servers are being configured. Release Modification 12.1(11)AX This command was first introduced.2-483 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vmps server This example shows how to delete the server with IP address 191.10.49.21: Switch(config)# no vmps server 191.10.49.21 You can verify your setting by entering the show vmps privileged EXEC command and examining information in the VMPS Domain Server row. Related Commands Command Description show vmps Displays VQP and VMPS information.2-484 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (global configuration) vtp (global configuration) Use the vtp global configuration command on the switch stack or on a standalone switch to set or modify the VLAN Trunking Protocol (VTP) configuration characteristics. Use the no form of this command to remove the settings or to return to the default settings. vtp {domain domain-name | file filename | interface name [only] | mode {client | server | transparent} | password password | pruning | version number} no vtp {file | interface | mode | password | pruning | version} Syntax Description domain domain-name Specify the VTP domain name, an ASCII string from 1 to 32 characters that identifies the VTP administrative domain for the switch. The domain name is case sensitive. file filename Specify the IOS file system file where the VTP VLAN configuration is stored. interface name Specify the name of the interface providing the VTP ID updated for this device. only (Optional) Use only the IP address of this interface as the VTP IP updater. mode Specify the VTP device mode as client, server, or transparent. client Place the switch in VTP client mode. A switch in VTP client mode is enabled for VTP, and can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on the switch. When a VTP client starts up, it does not send VTP advertisements until it receives advertisements to initialize its VLAN database. server Place the switch in VTP server mode. A switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on the switch. The switch can recover all the VLAN information in the current VTP database from nonvolatile storage after reboot. transparent Place the switch in VTP transparent mode. A switch in VTP transparent mode is disabled for VTP, does not send advertisements or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received. When VTP mode is transparent, the mode and domain name are saved in the switch running configuration file, and you can save them in the switch startup configuration file by entering the copy running-config startup config privileged EXEC command. password password Set the administrative domain password for the generation of the 16-byte secret value used in MD5 digest calculation to be sent in VTP advertisements and to validate received VTP advertisements. The password can be an ASCII string from 1 to 32 characters. The password is case sensitive. pruning Enable VTP pruning on the switch. version number Set VTP version to version 1 or version 2.2-485 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (global configuration) Defaults The default filename is flash:vlan.dat. The default mode is server mode. No domain name or password is defined. No password is configured. Pruning is disabled. The default version is version 1. Command Modes Global configuration Command History Usage Guidelines When you save VTP mode, domain name, and VLAN configurations in the switch startup configuration file and reboot the switch, the VTP and VLAN configurations are determined by these conditions: • If both the VLAN database and the configuration file show the VTP mode as transparent and the VTP domain names match, the VLAN database is ignored. The VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database. • If the startup VTP mode is server mode, or the startup VTP mode or domain names do not match the VLAN database, VTP mode and VLAN configuration for the first 1005 VLANs are determined by VLAN database information, and VLANs greater than 1005 are configured from the switch configuration file. The vtp file filename cannot be used to load a new database; it renames only the file in which the existing database is stored. Follow these guidelines when configuring a VTP domain name: • The switch is in the no-management-domain state until you configure a domain name. While in the no-management-domain state, the switch does not send any VTP advertisements even if changes occur to the local VLAN configuration. The switch leaves the no-management-domain state after it receives the first VTP summary packet on any port that is trunking or after you configure a domain name by using the vtp domain command. If the switch receives its domain from a summary packet, it resets its configuration revision number to 0. After the switch leaves the no-management-domain state, it can no be configured to re-enter it until you clear the nonvolatile RAM (NVRAM) and reload the software. • Domain names are case-sensitive. • After you configure a domain name, it cannot be removed. You can only reassign it to a different domain. Follow these guidelines when setting VTP mode: • The no vtp mode command returns the switch to VTP server mode. • The vtp mode server command is the same as no vtp mode except that it does not return an error if the switch is not in client or transparent mode. Release Modification 12.1(11)AX This command was first introduced.2-486 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (global configuration) • If the receiving switch is in client mode, the client switch changes its configuration to duplicate the configuration of the server. If you have switches in client mode, be sure to make all VTP or VLAN configuration changes on a switch in server mode. If the receiving switch is in server mode or transparent mode, the switch configuration is not changed. • Switches in transparent mode do not participate in VTP. If you make VTP or VLAN configuration changes on a switch in transparent mode, the changes are not propagated to other switches in the network. • If you change the VTP or VLAN configuration on a switch that is in server mode, that change is propagated to all the switches in the same VTP domain. • The vtp mode transparent command disables VTP from the domain but does not remove the domain from the switch. • The VTP mode must be transparent for you to add extended-range VLANs or for VTP and VLAN information to be saved in the running configuration file. • If extended-range VLANs are configured on the switch and you attempt to set the VTP mode to server or client, you receive an error message, and the configuration is not allowed. • VTP can be set to either server or client mode only when dynamic VLAN creation is disabled. Follow these guidelines when setting a VTP password: • Passwords are case sensitive. Passwords should match on all switches in the same domain. • When you use the no vtp password form of the command, the switch returns to the no-password state. Follow these guidelines when setting VTP pruning: • VTP pruning removes information about each pruning-eligible VLAN from VTP updates if there are no stations belonging to that VLAN. • If you enable pruning on the VTP server, it is enabled for the entire management domain for VLAN IDs 1 to 1005. • Only VLANs in the pruning-eligible list can be pruned. • Pruning is supported with VTP version 1 and version 2. Follow these guidelines when setting the VTP version: • Toggling the version 2 (v2) mode state modifies parameters of certain default VLANs. • Each VTP switch automatically detects the capabilities of all the other VTP devices. To use version 2, all VTP switches in the network must support version 2; otherwise, you must configure them to operate in VTP version 1 mode. • If all switches in a domain are VTP version 2-capable, you need only to configure version 2 on one switch; the version number is then propagated to the other version-2 capable switches in the VTP domain. • If you are using VTP in a Token Ring environment, VTP version 2 must be enabled. • If you are configuring a Token Ring bridge relay function (TrBRF) or Token Ring concentrator relay function (TrCRF) VLAN media type, you must use version 2. • If you are configuring a Token Ring or Token Ring-NET VLAN media type, you must use version 1. You cannot save password, pruning, and version configurations in the switch configuration file.2-487 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (global configuration) Examples This example shows how to rename the filename for VTP configuration storage to vtpfilename: Switch(config)# vtp file vtpfilename This example shows how to clear the device storage filename: Switch(config)# no vtp file vtpconfig Clearing device storage filename. This example shows how to specify the name of the interface providing the VTP updater ID for this device: Switch(config)# vtp interface gigabitethernet This example shows how to set the administrative domain for the switch: Switch(config)# vtp domain OurDomainName This example shows how to place the switch in VTP transparent mode: Switch(config)# vtp mode transparent This example shows how to configure the VTP domain password: Switch(config)# vtp password ThisIsOurDomain’sPassword This example shows how to enable pruning in the VLAN database: Switch(config)# vtp pruning Pruning switched ON This example shows how to enable version 2 mode in the VLAN database: Switch(config)# vtp version 2 You can verify your settings by entering the show vtp status privileged EXEC command. Related Commands Command Description show vtp status Displays the VTP statistics for the switch and general information about the VTP management domain status. vtp (VLAN configuration) Configures VTP domain-name, password, pruning, version, and mode.2-488 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (VLAN configuration) vtp (VLAN configuration) Use the vtp VLAN configuration command on the switch stack or on a standalone switch to configure VLAN Trunking Protocol (VTP) characteristics. You access VLAN configuration mode by entering the vlan database privileged EXEC command. Use the no form of this command to return to the default settings, disable the characteristic, or remove the password. vtp {domain domain-name | password password | pruning | v2-mode | {server | client | transparent}} no vtp {client | password | pruning | transparent | v2-mode} Note VTP configuration in VLAN configuration mode is saved in the VLAN database when applied. Syntax Description domain domain-name Set the VTP domain name by entering an ASCII string from 1 to 32 characters that identifies the VTP administrative domain for the switch. The domain name is case sensitive. password password Set the administrative domain password for the generation of the 16-byte secret value used in MD5 digest calculation to be sent in VTP advertisements and to validate received VTP advertisements. The password can be an ASCII string from 1 to 32 characters. The password is case sensitive. pruning Enable pruning in the VTP administrative domain. VTP pruning causes information about each pruning-eligible VLAN to be removed from VTP updates if there are no stations belonging to that VLAN. v2-mode Enable VLAN Trunking Protocol (VTP) version 2 in the administrative domains. client Place the switch in VTP client mode. A switch in VTP client mode is enabled for VTP, can send advertisements, but does not have enough nonvolatile storage to store VLAN configurations. You cannot configure VLANs on it. When a VTP client starts up, it does not send VTP advertisements until it receives advertisements to initialize its VLAN database. server Place the switch in VTP server mode. A switch in VTP server mode is enabled for VTP and sends advertisements. You can configure VLANs on it. The switch can recover all the VLAN information in the current VTP database from nonvolatile storage after reboot. transparent Place the switch in VTP transparent mode. A switch in VTP transparent mode is disabled for VTP, does not send advertisements or learn from advertisements sent by other devices, and cannot affect VLAN configurations on other devices in the network. The switch receives VTP advertisements and forwards them on all trunk ports except the one on which the advertisement was received. 2-489 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (VLAN configuration) Defaults The default mode is server mode. No domain name is defined. No password is configured. Pruning is disabled. VTP version 2 (v2 mode) is disabled. Command Modes VLAN configuration Command History Usage Guidelines If the VTP mode is transparent, the mode and domain name are saved in the switch running configuration file, and you can save the configuration in the switch startup configuration file by using the copy running-config startup-config privileged EXEC command. Follow these guidelines when setting the VTP mode: • The no vtp client and no vtp transparent forms of the command return the switch to VTP server mode. • The vtp server command is the same as no vtp client or no vtp transparent except that it does not return an error if the switch is not in client or transparent mode. • If the receiving switch is in client mode, the client switch changes its configuration to duplicate the configuration of the server. If you have switches in client mode, make sure to make all VTP or VLAN configuration changes on a switch in server mode. If the receiving switch is in server mode or transparent mode, the switch configuration is not changed. • Switches in transparent mode do not participate in VTP. If you make VTP or VLAN configuration changes on a switch in transparent mode, the changes are not propagated to other switches in the network. • If you make a change to the VTP or VLAN configuration on a switch in server mode, that change is propagated to all the switches in the same VTP domain. • The vtp transparent command disables VTP from the domain but does not remove the domain from the switch. • The VTP mode must be transparent for you to add extended-range VLANs or for the VTP and the VLAN configurations to be saved in the running configuration file. • If extended-range VLANs are configured on the switch and you attempt to set the VTP mode to server or client, you receive an error message and the configuration is not allowed. • VTP can be set to either server or client mode only when dynamic VLAN creation is disabled. Release Modification 12.1(11)AX This command was first introduced.2-490 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (VLAN configuration) Follow these guidelines when configuring a VTP domain name: • The switch is in the no-management-domain state until you configure a domain name. While in the no-management-domain state, the switch does not send any VTP advertisements even if changes occur to the local VLAN configuration. The switch leaves the no-management-domain state after receiving the first VTP summary packet on any port that is currently trunking or after configuring a domain name with the vtp domain command. If the switch receives its domain from a summary packet, it resets its configuration revision number to zero. After the switch leaves the no-management-domain state, it can never be configured to reenter it until you clear the nonvolatile RAM (NVRAM) and reload the software. • Domain names are case sensitive. • After you configure a domain name, it cannot be removed. You can reassign it only to a different domain. Follow these guidelines when configuring a VTP password: • Passwords are case sensitive. Passwords should match on all switches in the same domain. • When the no vtp password form of the command is used, the switch returns to the no-password state. Follow these guidelines when enabling VTP pruning: • If you enable pruning on the VTP server, it is enabled for the entire management domain. • Only VLANs included in the pruning-eligible list can be pruned. • Pruning is supported with VTP version 1 and version 2. Follow these guidelines when enabling VTP version 2 (v2-mode): • Toggling the version (v2-mode) state modifies certain parameters of certain default VLANs. • Each VTP switch automatically detects the capabilities of all the other VTP devices. To use VTP version 2, all VTP switches in the network must support version 2; otherwise, you must configure them to operate in VTP version 1 (no vtp v2-mode). • If all switches in a domain are VTP version 2-capable, you need only to enable VTP version 2 on one switch; the version number is then propagated to the other version-2 capable switches in the VTP domain. • If you are using VTP in a Token Ring environment or configuring a Token Ring bridge relay function (TrBRF) or Token Ring concentrator relay function (TrCRF) VLAN media type, VTP version 2 (v2-mode) must be enabled. • If you are configuring a Token Ring or Token Ring-NET VLAN media type, you must use VTP version 1. Examples This example shows how to place the switch in VTP transparent mode: Switch(vlan)# vtp transparent Setting device to VTP TRANSPARENT mode. This example shows how to set the administrative domain for the switch: Switch(vlan)# vtp domain OurDomainName Changing VTP domain name from cisco to OurDomainName This example shows how to configure the VTP domain password: Switch(vlan)# vtp password private Setting device VLAN database password to private.2-491 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (VLAN configuration) This example shows how to enable pruning in the proposed new VLAN database: Switch(vlan)# vtp pruning Pruning switched ON This example shows how to enable v2 mode in the proposed new VLAN database: Switch(vlan)# vtp v2-mode V2 mode enabled. You can verify your settings by entering the show vtp status privileged EXEC command. Related Commands Command Description show vtp status Displays the VTP statistics for the switch and general information about the VTP management domain status. switchport trunk pruning Configures the VLAN pruning-eligible list for ports in trunking mode. vtp (global configuration) Configures the VTP filename, interface, domain name, and mode.2-492 Catalyst 3750 Switch Command Reference 78-15165-02 Chapter 2 Cisco IOS Commands vtp (VLAN configuration)A-1 Catalyst 3750 Switch Command Reference 78-15165-02 A P P E N D I X A Boot Loader Commands This appendix describes the boot loader commands on the Catalyst 3750 switches. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. During normal boot loader operation, you are not presented with the boot loader command-line prompt. You gain access to the boot loader command line if the switch is set to manually boot, if an error occurs during power-on self test (POST) DRAM testing, or if an error occurs while loading the operating system (a corrupted IOS image). You can also access the boot loader if you have lost or forgotten the switch password. Note The default configuration for Catalyst 3750 switches allows an end user with physical access to the switch to recover from a lost password by interrupting the boot process while the switch is powering up and then entering a new password. The password recovery disable feature allows the system administrator to protect access to the switch password by disabling part of this functionality and allowing the user to interrupt the boot process only by agreeing to set the system back to the default configuration. With password recovery disabled, the user can still interrupt the boot process and change the password, but the configuration file (config.text) and the VLAN database file (vlan.dat) are deleted. For more information, refer to the software configuration guide for this release. You can access the boot loader through a switch console connection at 9600 bps. Unplug the switch power cord, and press the switch Mode button while reconnecting the power cord. You can release the Mode button a second or two after the LED above port 1X goes off. You should then see the boot loader Switch: prompt. The boot loader performs low-level CPU initialization, performs POST, and loads a default operating system image into memory.A-2 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands boot boot Use the boot boot loader command to load and boot an executable image and to enter the command-line interface. boot [-post | -n | -p | flag] filesystem:/file-url ... Syntax Description Defaults The switch attempts to automatically boot the system by using information in the BOOT environment variable. If this variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the Flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. Command Modes Boot loader Command History Usage Guidelines When you enter the boot command without any arguments, the switch attempts to automatically boot the system by using the information in the BOOT environment variable, if any. If you supply an image name for the file-url variable, the boot command attempts to boot the specified image. When you set boot loader boot command options, they are executed immediately and apply only to the current boot loader session. These settings are not saved for the next boot operation. Filenames and directory names are case sensitive. Examples This example shows how to boot the switch using the new-image.bin image: switch: boot flash:/new-images/new-image.bin After entering this command, you are prompted to start the setup program. -post (Optional) Run the loaded image with an extended or comprehensive power-on self-test (POST). Using this keyword causes POST to take longer to complete. -n (Optional) Pause for the IOS debugger immediately after launching. -p (Optional) Pause for the JTAG debugger right after loading the image. filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url (Optional) Path (directory) and name of a bootable image. Separate image names with a semicolon. Release Modification 12.1(11)AX This command was first introduced.A-3 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands boot Related Commands Command Description set Sets the BOOT environment variable to boot a specific image when the BOOT keyword is appended to the command.A-4 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands cat cat Use the cat boot loader command to display the contents of one or more files. cat filesystem:/file-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. If you specify a list of files, the contents of each file is sequentially displayed. Examples This example shows how to display the contents of two files: switch: cat flash:/new-images/info flash:env_vars version_suffix: i5q3l2-121-11.AX version_directory: c3750-i5q3l2-mz.121-11.AX image_name: c3750-i5q3l2-mz.121-11.AX.bin ios_image_file_size: 3049472 total_image_file_size: 4551168 image_feature: LAYER_3|MIN_DRAM_MEG=64 image_family: C3750 info_end: BAUD=57600 MANUAL_BOOT=no Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url Path (directory) and name of the files to display. Separate each filename with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description more Displays the contents of one or more files. type Displays the contents of one or more files.A-5 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands copy copy Use the copy boot loader command to copy a file from a source to a destination. copy [-b block-size] filesystem:/source-file-url filesystem:/destination-file-url Syntax Description Defaults The default block size is 4 KB. Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. Directory names are limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Filenames are limited to 45 characters; the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. If you are copying a file to a new directory, the directory must already exist. Examples This example show how to copy a file at the root: switch: copy flash:test1.text flash:test4.text . File "flash:test1.text" successfully copied to "flash:test4.text" You can verify that the file was copied by entering the dir filesystem: boot loader command. Related Commands -b block-size (Optional) This option is used only for internal development and testing. filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /source-file-url Path (directory) and filename (source) to be copied. /destination-file-url Path (directory) and filename of the destination. Release Modification 12.1(11)AX This command was first introduced. Command Description delete Deletes one or more files from the specified file system.A-6 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands delete delete Use the delete boot loader command to delete one or more files from the specified file system. delete filesystem:/file-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. The switch prompts you for confirmation before deleting each file. Examples This example shows how to delete two files: switch: delete flash:test2.text flash:test5.text Are you sure you want to delete "flash:test2.text" (y/n)?y File "flash:test2.text" deleted Are you sure you want to delete "flash:test5.text" (y/n)?y File "flash:test2.text" deleted You can verify that the files were deleted by entering the dir flash: boot loader command. Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url Path (directory) and filename to delete. Separate each filename with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description copy Copies a file from a source to a destination.A-7 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands dir dir Use the dir boot loader command to display a list of files and directories on the specified file system. dir filesystem:/file-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Directory names are case sensitive. Examples This example shows how to display the files in Flash memory: switch: dir flash: Directory of flash:/ 3 -rwx 1839 Mar 01 2002 00:48:15 config.text 11 -rwx 1140 Mar 01 2002 04:18:48 vlan.dat 21 -rwx 26 Mar 01 2002 00:01:39 env_vars 9 drwx 768 Mar 01 2002 23:11:42 html 16 -rwx 1037 Mar 01 2002 00:01:11 config.text 14 -rwx 1099 Mar 01 2002 01:14:05 homepage.htm 22 -rwx 96 Mar 01 2002 00:01:39 system_env_vars 17 drwx 192 Mar 06 2002 23:22:03 c3750-i5q3l2-mz.121-11.64.AX 15998976 bytes total (6397440 bytes free) filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url (Optional) Path (directory) and directory name whose contents you want to display. Separate each directory name with a space. Release Modification 12.1(11)AX This command was first introduced.A-8 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands dir Table A- 1 describes the fields in the display. Related Commands Table A-1 dir Field Descriptions Field Description 2 Index number of the file. -rwx File permission, which can be any or all of the following: • d—directory • r—readable • w—writable • x—executable 1644045 Size of the file. Last modification date. env_vars Filename. Command Description mkdir Creates one or more directories. rmdir Removes one or more directories.A-9 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands flash_init flash_init Use the flash_init boot loader command to initialize the Flash file system. flash_init Syntax Description This command has no arguments or keywords. Defaults The Flash file system is automatically initialized during normal system operation. Command Modes Boot loader Command History Usage Guidelines During the normal boot process, the Flash file system is automatically initialized. Use this command to manually initialize the Flash file system. For example, you use this command during the recovery procedure for a lost or forgotten password. Release Modification 12.1(11)AX This command was first introduced.A-10 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands format format Use the format boot loader command to format the specified file system and destroy all data in that file system. format filesystem: Syntax Description Command Modes Boot loader Command History Usage Guidelines Caution Use this command with care; it destroys all data on the file system and renders your system unusable. filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. Release Modification 12.1(11)AX This command was first introduced.A-11 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands fsck fsck Use the fsck boot loader command to check the file system for consistency. fsck [-test | -f] filesystem: Syntax Description Defaults No file system check is performed. Command Modes Boot loader Command History Usage Guidelines To stop an in-progress file system consistency check, disconnect the switch power and then reconnect the power. Examples This example shows how to perform an extensive file system check on Flash memory: switch: fsck -test flash: -test (Optional) Initialize the file system code and perform extra POST on Flash memory. An extensive, nondestructive memory test is performed on every byte that makes up the file system. -f (Optional) Initialize the file system code and perform a fast file consistency check. Cyclic redundancy checks (CRCs) in the flashfs sectors are not checked. filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. Release Modification 12.1(11)AX This command was first introduced.A-12 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands help help Use the help boot loader command to display the available commands. help Syntax Description This command has no arguments or keywords. Command Modes Boot loader Command History Usage Guidelines You can also use the question mark (?) to display a list of available boot loader commands. Release Modification 12.1(11)AX This command was first introduced.A-13 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands load_helper load_helper Use the load_helper boot loader command to load and initialize one or more helper images, which extend or patch the functionality of the boot loader. load_helper filesystem:/file-url ... Syntax Description Defaults No helper files are loaded. Command Modes Boot loader Command History Usage Guidelines The load_helper command searches for loadable files only if the HELPER environment variable is set. Filenames and directory names are case sensitive. filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url Path (directory) and a list of loadable helper files to dynamically load during loader initialization. Separate each image name with a semicolon. Release Modification 12.1(11)AX This command was first introduced.A-14 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands memory memory Use the memory boot loader command to display memory heap utilization information. memory Syntax Description This command has no arguments or keywords. Command Modes Boot loader Command History Examples This example shows how to display memory heap utilization information: switch: memory Text: 0x00700000 - 0x0071cf24 (0x0001cf24 bytes) Rotext: 0x00000000 - 0x00000000 (0x00000000 bytes) Data: 0x0071cf24 - 0x00723a0c (0x00006ae8 bytes) Bss: 0x0072529c - 0x00746f94 (0x00021cf8 bytes) Stack: 0x00746f94 - 0x00756f94 (0x00010000 bytes) Heap: 0x00756f98 - 0x00800000 (0x000a9068 bytes) Bottom heap utilization is 22 percent. Top heap utilization is 0 percent. Total heap utilization is 22 percent. Total bytes: 0xa9068 (692328) Bytes used: 0x26888 (157832) Bytes available: 0x827e0 (534496) Alternate heap utilization is 0 percent. Total alternate heap bytes: 0x6fd000 (7327744) Alternate heap bytes used: 0x0 (0) Alternate heap bytes available: 0x6fd000 (7327744) Release Modification 12.1(11)AX This command was first introduced.A-15 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands memory Table A- 2 describes the fields in the display. Table A-2 memory Field Descriptions Field Description Text Beginning and ending address of the text storage area. Rotext Beginning and ending address of the read-only text storage area. This part of the data segment is grouped with the Text entry. Data Beginning and ending address of the data segment storage area. Bss Beginning and ending address of the block started by symbol (Bss) storage area. It is initialized to zero. Stack Beginning and ending address of the area in memory allocated to the software to store automatic variables, return addresses, and so forth. Heap Beginning and ending address of the area in memory that memory is dynamically allocated to and freed from.A-16 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands mkdir mkdir Use the mkdir boot loader command to create one or more new directories on the specified file system. mkdir filesystem:/directory-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Directory names are case sensitive. Directory names are limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Examples This example shows how to make a directory called Saved_Configs: switch: mkdir flash:Saved_Configs Directory "flash:Saved_Configs" created This example shows how to make two directories: switch: mkdir flash:Saved_Configs1 flash:Test Directory "flash:Saved_Configs1" created Directory "flash:Test" created You can verify that the directory was created by entering the dir filesystem: boot loader command. Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /directory-url Name of the directories to create. Separate each directory name with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description dir Displays a list of files and directories on the specified file system. rmdir Removes one or more directories from the specified file system.A-17 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands more more Use the more boot loader command to display the contents of one or more files. more filesystem:/file-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. If you specify a list of files, the contents of each file is sequentially displayed. Examples This example shows how to display the contents of two files: switch: more flash:/new-images/info flash:env_vars version_suffix: i5q3l2-121-11.AX version_directory: c3750-i5q3l2-mz.121-11.AX image_name: c3750-i5q3l2-mz.121-11.AX.bin ios_image_file_size: 3049472 total_image_file_size: 4551168 image_feature: LAYER_3|MIN_DRAM_MEG=64 image_family: C3750 info_end: BAUD=57600 MANUAL_BOOT=no Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url Path (directory) and name of the files to display. Separate each filename with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description cat Displays the contents of one or more files. type Displays the contents of one or more files.A-18 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands rename rename Use the rename boot loader command to rename a file. rename filesystem:/source-file-url filesystem:/destination-file-url Syntax Description Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. Directory names are limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Filenames are limited to 45 characters; the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Examples This example shows a file named config.text being renamed to config1.text: switch: rename flash:config.text flash:config1.text You can verify that the file was renamed by entering the dir filesystem: boot loader command. Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /source-file-url Original path (directory) and filename. /destination-file-url New path (directory) and filename. Release Modification 12.1(11)AX This command was first introduced. Command Description copy Copies a file from a source to a destination.A-19 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands reset reset Use the reset boot loader command to perform a hard reset on the system. A hard reset is similar to power-cycling the switch, clearing the processor, registers, and memory. reset Syntax Description This command has no arguments or keywords. Command Modes Boot loader Command History Examples This example shows how to reset the system: switch: reset Are you sure you want to reset the system (y/n)?y System resetting... Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description boot Loads and boots an executable image and enters the command-line interface.A-20 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands rmdir rmdir Use the rmdir boot loader command to remove one or more empty directories from the specified file system. rmdir filesystem:/directory-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Directory names are case sensitive and limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Before removing a directory, you must first delete all the files in the directory. The switch prompts you for confirmation before deleting each directory. Examples This example shows how to remove a directory: switch: rmdir flash:Test You can verify that the directory was deleted by entering the dir filesystem: boot loader command. Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /directory-url Path (directory) and name of the empty directories to remove. Separate each directory name with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description dir Displays a list of files and directories on the specified file system. mkdir Creates one or more new directories on the specified file system.A-21 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands set set Use the set boot loader command to set or display environment variables, which can be used to control the boot loader or any other software running on the switch. set variable value Note Under normal circumstances, it is not necessary to alter the setting of the environment variables. Syntax Description variable value Use one of these keywords for variable and value: MANUAL_BOOT—Determines whether the switch automatically or manually boots. Valid values are 1, yes, 0, and no. If it is set to no or 0, the boot loader attempts to automatically boot the system. If it is set to anything else, you must manually boot the switch from the boot loader mode. BOOT filesystem:/file-url— A semicolon-separated list of executable files to try to load and execute when automatically booting. If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the flash: file system. If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the Flash file system. ENABLE_BREAK—Determines whether the automatic boot process can be interrupted by using the Break key on the console. Valid values are 1, yes, on, 0, no, and off. If it is set to 1, yes, or on, you can interrupt the automatic boot process by pressing the Break key on the console after the Flash file system has initialized. HELPER filesystem:/file-url— A semicolon-separated list of loadable files to dynamically load during the boot loader initialization. Helper files extend or patch the functionality of the boot loader. PS1 prompt—A string that is used as the command-line prompt in boot loader mode. CONFIG_FILE flash:/file-url—The filename that IOS uses to read and write a nonvolatile copy of the system configuration. BAUD rate—The rate in bits per second (bps) used for the console. The IOS software inherits the baud rate setting from the boot loader and continues to use this value unless the configuration file specifies another setting. The range is from 0 to 4294967295 bps. Valid values are 50, 75, 110, 150, 300, 600, 1200, 1800, 2000, 2400, 3600, 4800, 7200, 9600, 14400, 19200, 28800, 38400, 56000, 57600, 115200, and 128000. The most commonly used values are 300, 1200, 2400, 9600, 19200, 57600, and 115200.A-22 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands set Defaults The environment variables have these default values: MANUAL_BOOT: No (0) BOOT: Null string ENABLE_BREAK: No (Off or 0) (the automatic boot process cannot be interrupted by pressing the Break key on the console). HELPER: No default value (helper files are not automatically loaded). PS1: switch: CONFIG_FILE: config.text BAUD: 9600 bps BOOTHLPR: No default value (no helper images are specified). HELPER_CONFIG_FILE: No default value (no helper configuration file is specified). SWITCH_NUMBER: 1 SWITCH_PRIORITY: 1 Note Environment variables that have values are stored in the Flash file system in various files. The format of these files is that each line contains an environment variable name and an equal sign followed by the value of the variable. A variable has no value if it is not listed in this file; it has a value if it is listed in the file even if the value is a null string. A variable that is set to a null string (for example, “ ”) is a variable with a value. Many environment variables are predefined and have default values. Command Modes Boot loader Command History BOOTHLPR filesystem:/file-url—The name of the IOS helper image that is first loaded into memory so that it can then load a second IOS image into memory and launch it. This variable is used only for internal development and testing. HELPER_CONFIG_FILE filesystem:/file-url—The name of the configuration file to be used by the IOS helper image. If this is not set, the file specified by the CONFIG_FILE environment variable is used by all versions of IOS that are loaded, including the helper image. This variable is used only for internal development and testing. Release Modification 12.1(11)AX This command was first introduced.A-23 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands set Usage Guidelines Environment variables are case sensitive and must be entered as documented. Environment variables that have values are stored in Flash memory outside of the Flash file system. The MANUAL_BOOT environment variable can also be set by using the boot manual global configuration command. The BOOT environment variable can also be set by using the boot system filesystem:/file-url global configuration command. The ENABLE_BREAK environment variable can also be set by using the boot enable-break global configuration command. The HELPER environment variable can also be set by using the boot helper filesystem:/file-url global configuration command. The CONFIG_FILE environment variable can also be set by using the boot config-file flash:/file-url global configuration command. The BOOTHLPR environment variable can also be set by using the boot boothlpr filesystem:/file-url global configuration command. The HELPER_CONFIG_FILE environment variable can also be set by using the boot helper-config-file filesystem:/file-url global configuration command. The HELPER_CONFIG_FILE environment variable can also be set by using the boot helper-config-file filesystem:/file-url global configuration command. The SWITCH_NUMBER environment variable can also be set by using the switch current-stack-member-number renumber new-stack-member-number global configuration command. The SWITCH_PRIORITY environment variable can also be set by using the switch stack-member-number priority priority-number global configuration command. The boot loader prompt string (PS1) can be up to 120 printable characters except the equal sign (=). Examples This example shows how to change the boot loader prompt: switch: set PS1 loader: loader: You can verify your setting by using the set boot loader command. Related Commands Command Description unset Resets one or more environment variables to its previous setting.A-24 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands type type Use the type boot loader command to display the contents of one or more files. type filesystem:/file-url ... Syntax Description Command Modes Boot loader Command History Usage Guidelines Filenames and directory names are case sensitive. If you specify a list of files, the contents of each file is sequentially displayed. Examples This example shows how to display the contents of two files: switch: type flash:/new-images/info flash:env_vars version_suffix: i5q3l2-121-11.AX version_directory: c3750-i5q3l2-mz.121-11.AX image_name: c3750-i5q3l2-mz.121-11.AX.bin ios_image_file_size: 3049472 total_image_file_size: 4551168 image_feature: LAYER_3|MIN_DRAM_MEG=64 image_family: C3750 info_end: BAUD=57600 MANUAL_BOOT=no Related Commands filesystem: Alias for a Flash file system. Use flash: for the system board Flash device. /file-url Path (directory) and name of the files to display. Separate each filename with a space. Release Modification 12.1(11)AX This command was first introduced. Command Description cat Displays the contents of one or more files. more Displays the contents of one or more files.A-25 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands unset unset Use the unset boot loader command to reset one or more environment variables. unset variable ... Note Under normal circumstances, it is not necessary to alter the setting of the environment variables. Syntax Description Command Modes Boot loader Command History variable Use one of these keywords for variable: MANUAL_BOOT—Determines whether the switch automatically or manually boots. BOOT—Resets the list of executable files to try to load and execute when automatically booting. If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the Flash file system. If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the Flash file system. ENABLE_BREAK—Determines whether the automatic boot process can be interrupted by using the Break key on the console after the Flash file system has been initialized. HELPER—A semicolon-separated list of loadable files to dynamically load during the boot loader initialization. Helper files extend or patch the functionality of the boot loader. PS1—A string that is used as the command-line prompt in boot loader mode. CONFIG_FILE—Resets the filename that IOS uses to read and write a nonvolatile copy of the system configuration. BAUD—Resets the rate in bits per second (bps) used for the console. The IOS software inherits the baud rate setting from the boot loader and continues to use this value unless the configuration file specifies another setting. BOOTHLPR—Resets the name of the IOS helper image that is first loaded into memory so that it can then load a second IOS image into memory and launch it. This variable is used only for internal development and testing. HELPER_CONFIG_FILE—Resets the name of the configuration file to be used by the IOS helper image. If this is not set, the file specified by the CONFIG_FILE environment variable is used by all versions of IOS that are loaded, including the helper image. This variable is used only for internal development and testing. Release Modification 12.1(11)AX This command was first introduced.A-26 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands unset Usage Guidelines The MANUAL_BOOT environment variable can also be reset by using the no boot manual global configuration command. The BOOT environment variable can also be reset by using the no boot system global configuration command. The ENABLE_BREAK environment variable can also be reset by using the no boot enable-break global configuration command. The HELPER environment variable can also be reset by using the no boot helper global configuration command. The CONFIG_FILE environment variable can also be reset by using the no boot config-file global configuration command. The BOOTHLPR environment variable can also be reset by using the no boot boothlpr global configuration command. The HELPER_CONFIG_FILE environment variable can also be reset by using the no boot helper-config-file global configuration command. Examples This example shows how to reset the prompt string to its previous setting: switch: unset PS1 switch: Related Commands Command Description set Sets or displays environment variables.A-27 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands version version Use the version boot loader command to display the boot loader version. version Syntax Description This command has no arguments or keywords. Command Modes Boot loader Command History Examples This example shows how to display the boot loader version: switch: version C3750 Boot Loader (C3750-HBOOT-M) Version 12.1(11)AX Compiled Wed 21-Feb-02 14:58 by devgoyal switch: Release Modification 12.1(11)AX This command was first introduced.A-28 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix A Boot Loader Commands versionB-1 Catalyst 3750 Switch Command Reference 78-15165-02 A P P E N D I X B Debug Commands This appendix describes the debug privileged EXEC commands that have been created or changed for use with the Catalyst 3750 switch. These commands are helpful in diagnosing and resolving internetworking problems and should be enabled only under the guidance of Cisco technical support staff. Caution Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use the debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. It is best to use the debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.B-2 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug autoqos debug autoqos Use the debug autoqos privileged EXEC command to enable debugging of the automatic quality of service (auto-QoS) feature. Use the no form of this command to disable debugging output. debug autoqos no debug autoqos Syntax Description This command has no keywords or arguments. Defaults Auto-QoS debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. You enable debugging by entering the debug autoqos privileged EXEC command. The undebug autoqos command is the same as the no debug autoqos command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Examples This example shows how to display the QoS configuration that is automatically generated when auto-QoS is enabled: Switch# debug autoqos AutoQoS debugging is on Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# auto qos voip cisco-phone 21:29:41: mls qos map cos-dscp 0 8 16 26 32 46 48 56 21:29:41: mls qos 21:29:42: no mls qos srr-queue input cos-map 21:29:42: no mls qos srr-queue output cos-map 21:29:42: mls qos srr-queue input cos-map queue 1 threshold 3 0 21:29:42: mls qos srr-queue input cos-map queue 1 threshold 2 1 21:29:42: mls qos srr-queue input cos-map queue 2 threshold 1 2 21:29:42: mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7 21:29:43: mls qos srr-queue input cos-map queue 2 threshold 3 3 5 21:29:43: mls qos srr-queue output cos-map queue 1 threshold 3 5 Release Modification 12.1(14)EA1 This command was first introduced.B-3 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug autoqos 21:29:43: mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7 21:29:44: mls qos srr-queue output cos-map queue 3 threshold 3 2 4 21:29:44: mls qos srr-queue output cos-map queue 4 threshold 2 1 21:29:44: mls qos srr-queue output cos-map queue 4 threshold 3 0 21:29:44: no mls qos srr-queue input dscp-map 21:29:44: no mls qos srr-queue output dscp-map 21:29:44: mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 13 14 15 21:29:45: mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4 5 6 7 21:29:45: mls qos srr-queue input dscp-map queue 1 threshold 3 32 21:29:45: mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23 21:29:45: mls qos srr-queue input dscp-map queue 2 threshold 2 26 33 34 35 36 37 38 39 21:29:46: mls qos srr-queue input dscp-map queue 2 threshold 2 48 49 50 51 52 53 54 55 21:29:46: mls qos srr-queue input dscp-map queue 2 threshold 2 56 57 58 59 60 61 62 63 21:29:46: mls qos srr-queue input dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 40 21:29:47: mls qos srr-queue input dscp-map queue 2 threshold 3 41 42 43 44 45 46 47 21:29:47: mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47 21:29:47: mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 48 21:29:47: mls qos srr-queue output dscp-map queue 2 threshold 3 49 50 51 52 53 54 55 56 21:29:48: mls qos srr-queue output dscp-map queue 2 threshold 3 57 58 59 60 61 62 63 21:29:48: mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23 21:29:48: mls qos srr-queue output dscp-map queue 3 threshold 3 26 32 33 34 35 36 37 38 21:29:48: mls qos srr-queue output dscp-map queue 3 threshold 3 39 21:29:49: mls qos srr-queue output dscp-map queue 4 threshold 1 8 21:29:49: mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15 trs(config-if)# 21:29:49: mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7 21:29:49: no mls qos srr-queue input priority-queue 1 21:29:49: no mls qos srr-queue input priority-queue 2 21:29:50: mls qos srr-queue input bandwidth 90 10 21:29:50: no mls qos srr-queue input buffers 21:29:50: mls qos queue-set output 1 buffers 20 20 20 40 21:29:50: interface GigabitEthernet2/0/1 21:29:50: mls qos trust device cisco-phone 21:29:50: mls qos trust cos 21:29:50: no queue-set 1 21:29:50: srr-queue bandwidth shape 10 0 0 0 21:29:50: srr-queue bandwidth share 10 10 60 20 Related Commands Command Description auto qos voip Configures auto-QoS for voice over IP (VoIP) within a QoS domain. show auto qos Displays the initial configuration that is generated by the automatic auto-QoS feature show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference For IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-4 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug cluster debug cluster Use the debug cluster privileged EXEC command to enable debugging of cluster-specific events. Use the no form of this command to disable debugging output. debug cluster {discovery | events | extended | hsrp | http | ip [packet] | members | nat | neighbors | platform | snmp | vqpxy} no debug cluster {discovery | events | extended | hsrp | http | ip [packet] | members | nat | neighbors | platform | snmp | vqpxy} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines This command is available only on the cluster command switch stack or cluster command switch. The undebug cluster command is the same as the no debug cluster command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. discovery Display cluster discovery debug messages. events Display cluster event debug messages. extended Display extended discovery debug messages. hsrp Display the Hot Standby Router Protocol (HSRP) debug messages. http Display Hypertext Transfer Protocol (HTTP) debug messages. ip [packet] Display IP or transport packet debug messages. members Display cluster member debug messages. nat Display Network Address Translation (NAT) debug messages. neighbors Display cluster neighbor debug messages. platform Display platform-specific cluster debug messages. snmp Display Simple Network Management Protocol (SNMP) debug messages. vqpxy Display VLAN Query Protocol (VQP) proxy debug messages. Release Modification 12.1(11)AX This command was first introduced.B-5 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug cluster Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show cluster Displays the cluster status and a summary of the cluster to which the switch belongs. show cluster candidates Displays a list of candidate switches when entered on the command switch. show cluster members Displays information about cluster members when executed on the command switch.B-6 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug dot1x debug dot1x Use the debug dot1x privileged EXEC command to enable debugging of the 802.1X feature. Use the no form of this command to disable debugging output. debug dot1x {all | errors | events | packets | registry | state-machine} no debug dot1x {all | errors | events | packets | registry | state-machine} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug dot1x command is the same as the no debug dot1x command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all 802.1X debug messages. errors Display 802.1X error debug messages. events Display 802.1X event debug messages. packets Display 802.1X packet debug messages. registry Display 802.1X registry invocation debug messages. state-machine Display state-machine related-events debug messages. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The authsm, backend, besm, core, and reauthsm keywords were removed. The errors, events, packets registry, and state-machine keywords were added. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show dot1x Displays 802.1X statistics, administrative status, and operational status for the switch or for the specified interface.B-7 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug dtp debug dtp Use the debug dtp privileged EXEC command to enable debugging of the Dynamic Trunking Protocol (DTP) activity. Use the no form of this command to disable debugging output. debug dtp {aggregation | all | decision | events | oserrs | packets | queue | states | timers} no debug dtp {aggregation | all | decision | events | oserrs | packets | queue | states | timers} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug dtp command is the same as the no debug dtp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands aggregation Display DTP user-message aggregation debug messages. all Display all DTP debug messages. decision Display the DTP decision-table debug messages. events Display the DTP event debug messages. oserrs Display DTP operating system-related error debug messages. packets Display DTP packet-processing debug messages. queue Display DTP packet-queueing debug messages. states Display DTP state-transition debug messages. timers Display DTP timer-event debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show dtp Displays DTP information for the switch or for a specified interface.B-8 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug etherchannel debug etherchannel Use the debug etherchannel privileged EXEC command to enable debugging of the EtherChannel/PAgP shim. This shim is the software module that is the interface between the Port Aggregation Protocol (PAgP) software module and the port manager software module. Use the no form of this command to disable debugging output. debug etherchannel [all | detail | error | event | idb] no debug etherchannel [all | detail | error | event | idb] Syntax Description Note Though visible in the command-line help strings, the linecard keyword is not supported. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify a keyword, all debug messages are displayed. The undebug etherchannel command is the same as the no debug etherchannel command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all (Optional) Display all EtherChannel debug messages. detail (Optional) Display detailed EtherChannel debug messages. error (Optional) Display EtherChannel error debug messages. event (Optional) Debug major EtherChannel event messages. idb (Optional) Display PAgP interface descriptor block debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show etherchannel Displays EtherChannel information for the channel.B-9 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug interface debug interface Use the debug interface privileged EXEC command to enable debugging of interface-related activities. Use the no form of this command to disable debugging output. debug interface {interface-id | null interface-number | port-channel port-channel-number | vlan vlan-id} no debug interface {interface-id | null interface-number | port-channel port-channel-number | vlan vlan-id} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify a keyword, all debug messages are displayed. The undebug interface command is the same as the no debug interface command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands interface-id Display debug messages for the specified physical interface, identified by type switch number/module number/ port, for example gigabitethernet 6/0/3. null interface-number Display debug messages for null interfaces. The interface-number is always 0. port-channel port-channel-number Display debug messages for the specified EtherChannel port-channel interface. The port-channel-number range is 1 to 12. vlan vlan-id Display debug messages for the specified VLAN. The vlan-id range is 1 to 4094. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show etherchannel Displays EtherChannel information for the channel.B-10 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug ip igmp filter debug ip igmp filter Use the debug ip igmp filter privileged EXEC command to enable debugging of Internet Group Management Protocol (IGMP) filter events. Use the no form of this command to disable debugging output. debug ip igmp filter no debug ip igmp filter Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug ip igmp filter command is the same as the no debug ip igmp filter command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-11 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug ip igmp max-groups debug ip igmp max-groups Use the debug ip igmp max-groups privileged EXEC command to enable debugging of Internet Group Management Protocol (IGMP) maximum groups events. Use the no form of this command to disable debugging output. debug ip igmp max-groups no debug ip igmp max-groups Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug ip igmp max-groups command is the same as the no debug ip igmp max-groups command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-12 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug ip igmp snooping debug ip igmp snooping Use the debug igmp snooping privileged EXEC command to enable debugging of Internet Group Management Protocol (IGMP) snooping activity. Use the no form of this command to disable debugging output. debug ip igmp snooping [group | management | router | timer] no debug ip igmp snooping [group | management | router | timer] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug ip igmp snooping command is the same as the no debug ip igmp snooping command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands group (Optional) Display IGMP snooping group activity debug messages. management (Optional) Display IGMP snooping management activity debug messages. router (Optional) Display IGMP snooping router activity debug messages. timer (Optional) Display IGMP snooping timer event debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description debug platform ip igmp snooping Displays information about platform-dependent IGMP snooping activity. show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-13 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug lacp debug lacp Use the debug lacp privileged EXEC command to enable debugging of Link Aggregation Control Protocol (LACP) activity. Use the no form of this command to disable debugging output. debug lacp [all | event | fsm | misc | packet] no debug lacp [all | event | fsm | misc | packet] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug lacp command is the same as the no debug lacp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all (Optional) Display all LACP debug messages. event (Optional) Display LACP event debug messages. fsm (Optional) Display LACP finite state-machine debug messages. misc (Optional) Display miscellaneous LACP debug messages. packet (Optional) Display LACP packet debug messages. Release Modification 12.1(14)EA1 This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show lacp Displays LACP channel-group information.B-14 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug mac-notification debug mac-notification Use the debug mac-notification privileged EXEC command to enable debugging of MAC notification events. Use the no form of this command to disable debugging output. debug mac-notification no debug mac-notification Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug mac-notification command is the same as the no debug mac-notification command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show mac-address-table notification Displays the MAC address notification information for all interfaces or the specified interface. B-15 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug matm debug matm Use the debug matm privileged EXEC command to enable debugging of platform-independent MAC address management. Use the no form of this command to disable debugging output. debug matm no debug matm Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug matm command is the same as the no debug matm command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description debug platform matm Displays information about platform-dependent MAC address management. show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-16 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug monitor debug monitor Use the debug monitor privileged EXEC command to enable debugging of the Switched Port Analyzer (SPAN) feature. Use the no form of this command to disable debugging output. debug monitor {all | errors | idb-update | info | list | notifications | platform | requests | snmp} no debug monitor {all | errors | idb-update | info | list | notifications | platform | requests | snmp} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug monitor command is the same as the no debug monitor command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all SPAN debug messages. errors Display detailed SPAN error debug messages. idb-update Display SPAN interface description block (IDB) update-trace debug messages. info Display SPAN informational-tracing debug messages. list Display SPAN port and VLAN-list tracing debug messages. notifications Display SPAN notification debug messages. platform Display SPAN platform-tracing debug messages. requests Display SPAN request debug messages. snmp Display SPAN and Simple Network Management Protocol (SNMP) tracing debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show monitor Displays information about all SPAN and remote SPAN (RSPAN) sessions on the switch.B-17 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug mvrdbg debug mvrdbg Use the debug mvrdbg privileged EXEC command to enable debugging of Multicast VLAN Registration (MVR). Use the no form of this command to disable debugging output. debug mvrdbg {all | events | igmpsn | management | ports} no debug mvrdbg {all | events | igmpsn | management | ports} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug mvrdbg command is the same as the no debug mvrdbg command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all MVR activity debug messages. events Display MVR event-handling debug messages. igmpsn Display MVR Internet Group Management Protocol (IGMP) snooping-activity debug messages. management Display MVR management-activity debug messages. ports Display MVR port debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show mvr Displays the current MVR configuration.B-18 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug nvram debug nvram Use the debug nvram privileged EXEC command to enable debugging of nonvolatile random-access memory (NVRAM) activity. Use the no form of this command to disable debugging output. debug nvram no debug nvram Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug nvram command is the same as the no debug nvram command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-19 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug pagp debug pagp Use the debug pagp privileged EXEC command to enable debugging of Port Aggregation Protocol (PAgP) activity. Use the no form of this command to disable debugging output. debug pagp [all | event | fsm | misc | packet] no debug pagp [all | event | fsm | misc | packet] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug pagp command is the same as the no debug pagp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all (Optional) Display all PAgP debug messages. event (Optional) Display PAgP event debug messages. fsm (Optional) Display PAgP finite state-machine debug messages. misc (Optional) Display miscellaneous PAgP debug messages. packet (Optional) Display PAgP packet debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show pagp Displays PAgP channel-group information.B-20 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform acl debug platform acl Use the debug platform acl privileged EXEC command to enable debugging of the access control list (ACL) manager. Use the no form of this command to disable debugging output. debug platform acl {all | exit | label | main | racl | stack | vacl | vlmap | warn} no debug platform acl {all | exit | label | main | racl | stack | vacl | vlmap | warn} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform acl command is the same as the no debug platform acl command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all ACL manager debug messages. exit Display ACL exit-related debug messages. label Display ACL label-related debug messages. main Display the main or important ACL debug messages. racl Display router ACL related debug messages. stack Display ACL stack-related debug messages. vacl Display VLAN ACL-related debug messages. vlmap Display ACL VLAN-map-related debug messages. warn Display ACL warning-related debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-21 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform cli-redirection main debug platform cli-redirection main Use the debug platform cli-redirection main privileged EXEC command to enable debugging of the main (important) command-line interface (CLI) redirection events. Use the no form of this command to disable debugging output. debug platform cli-redirection main no debug platform cli-redirection main Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform cli-redirection main command is the same as the no debug platform cli-redirection main command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-22 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform configuration debug platform configuration Use the debug platform configuration privileged EXEC command to enable debugging of configuration file activity across the stack. Use the no form of this command to disable debugging output. debug platform configuration {all | reception | transmission} no debug platform configuration {all | reception | transmission} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform configuration command is the same as the no debug platform configuration command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display debug messages for all configuration file transmission and reception events throughout the stack. reception Display debug messages for configuration file reception from other stack members. transmission Display debug messages for configuration file transmission to other stack members. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-23 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform cpu-queues debug platform cpu-queues Use the debug platform cpu-queues privileged EXEC command to enable debugging of platform central processing unit (CPU) receive queues. Use the no form of this command to disable debugging output. debug platform cpu-queues {broadcast-q | cbt-to-spt-q | cpuhub-q | host-q | icmp-q | igmp-snooping-q | layer2-protocol-q | logging-q | remote-console-q | routing-protocol-q | rpffail-q | software-fwd-q | stp-q} no debug platform cpu-queues {broadcast-q | cbt-to-spt-q | cpuhub-q | host-q | icmp-q | igmp-snooping-q | layer2-protocol-q | logging-q | remote-console-q | routing-protocol-q | rpffail-q | software-fwd-q | stp-q} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History broadcast-q Display debug messages about packets received by the broadcast queue. cbt-to-spt-q Display debug messages about packets received by the core-based tree to shortest-path tree (cbt-to-spt) queue. cpuhub-q Display debug messages about packets received by the CPU heartbeat queue. host-q Display debug messages about packets received by the host queue. icmp-q Display debug messages about packets received by the Internet Control Message Protocol (ICMP) queue. igmp-snooping-q Display debug messages about packets received by the Internet Group Management Protocol (IGMP)-snooping queue. layer2-protocol-q Display debug messages about packets received by the Layer 2 protocol queue. logging-q Display debug messages about packets received by the logging queue. remote-console-q Display debug messages about packets received by the remote console queue. routing-protocol-q Display debug messages about packets received by the routing protocol queue. rpffail-q Display debug messages about packets received by the reverse path forwarding (RFP) failure queue. software-fwd-q Debug packets received by the software forwarding queue. stp-q Debug packets received by the Spanning Tree Protocol (STP) queue. Release Modification 12.1(11)AX This command was first introduced.B-24 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform cpu-queues Usage Guidelines The undebug platform cpu-queues command is the same as the no debug platform cpu-queues command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-25 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform device-manager debug platform device-manager Use the debug platform device-manager privileged EXEC command to enable debugging of the platform-dependent device manager. Use the no form of this command to disable debugging output. debug platform device-manager {all | device-info | poll | port-download | trace} no debug platform device-manager {all | device-info | poll | port-download | trace} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform device-manager command is the same as the no debug platform device-manager command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all platform device manager debug messages. device-info Display platform device manager device structure debug messages. poll Display platform device manager 1-second poll debug messages. port-download Display platform device manager remote procedure call (RPC) usage debug messages. trace Trace platform device manager function entry and exit debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-26 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform dot1x debug platform dot1x Use the debug platform dot1x privileged EXEC command to enable debugging of stack-related 802.1X events. Use the no form of this command to disable debugging output. debug platform dot1x {initialization | interface-configuration | rpc} no debug platform dot1x {initialization | interface-configuration | rpc} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform dot1x command is the same as the no debug platform dot1x command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands initialization Display 802.1X initialization sequence debug messages. interface-configuration Display 802.1X interface configuration-related debug messages. rpc Display 802.1X remote procedure call (RPC) request debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-27 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform etherchannel debug platform etherchannel Use the debug platform etherchannel privileged EXEC command to enable debugging of platform-dependent EtherChannel events. Use the no form of this command to disable debugging output. debug platform etherchannel {init | link-up | rpc-detailed | rpc-generic | warnings} no debug platform etherchannel {init | link-up | rpc-detailed | rpc-generic | warnings} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform etherchannel command is the same as the no debug platform etherchannel command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands init Display EtherChannel module initialization debug messages. link-up Display EtherChannel link-up and link-down related debug messages. rpc-detailed Display detailed EtherChannel remote procedure call (RPC) debug messages. rpc-generic Display EtherChannel RPC generic debug messages. warnings Display EtherChannel warning debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-28 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform fallback-bridging debug platform fallback-bridging Use the debug platform fallback-bridging privileged EXEC command to enable debugging of the platform-dependent fallback bridging manager. Use the no form of this command to disable debugging output. debug platform fallback-bridging [error | retry | rpc {events | messages}] no debug platform fallback-bridging [error | retry | rpc {events | messages}] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify a keyword, all fallback bridging manager debug messages are displayed. The undebug platform fallback-bridging command is the same as the no debug platform fallback-bridging command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands error (Optional) Display fallback bridging manager error condition messages. retry (Optional) Display fallback bridging manager retry messages. rpc {events | messages} (Optional) Display fallback bridging debugging information. The keywords have these meanings: • events—Display remote procedure call (RPC) events. • messages—Display RPC messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-29 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform forw-tcam debug platform forw-tcam Use the debug platform forw-tcam privileged EXEC command to enable debugging of the forwarding ternary content addressable memory (TCAM) manager. Use the no form of this command to disable debugging output. debug platform forw-tcam [adjustment | allocate | audit | error | move | read | write] no debug platform forw-tcam [adjustment | allocate | audit | error | move | read | write] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines If you do not specify a keyword, all forwarding TCAM manager debug messages are displayed. The undebug platform forw-tcam command is the same as the no debug platform forw-tcam command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands adjustment (Optional) Display TCAM manager adjustment debug messages. allocate (Optional) Display TCAM manager allocation debug messages. audit (Optional) Display TCAM manager audit messages. error (Optional) Display TCAM manager error messages. move (Optional) Display TCAM manager move messages. read (Optional) Display TCAM manager read messages. write (Optional) Display TCAM manager write messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-30 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip igmp snooping debug platform ip igmp snooping Use the debug platform ip igmp snooping privileged EXEC command to enable debugging of platform-dependent Internet Group Management Protocol (IGMP) snooping. Use the no form of this command to disable debugging output. debug platform ip igmp snooping {all | di | error | event | group | mgmt | pak | retry | rpc | warn} debug platform ip igmp snooping pak {ip-address | error | ipopt | leave| query | report | rx | svi | tx} debug platform ip igmp snooping rpc [cfg | l3mm | misc | vlan] no debug platform ip igmp snooping {all | di | error | event | group | mgmt | pak | retry | rpc | warn} Syntax Description all Display all IGMP snooping debug messages. di Display IGMP snooping destination index (di) coordination remote procedure call (RPC) debug messages. error Display IGMP snooping error messages. event Display IGMP snooping event debug messages. group Display IGMP snooping group debug messages. mgmt Display IGMP snooping management debug messages. pak {ip-address | error | ipopt | leave | query | report | rx | svi | tx} Display IGMP snooping packet event debug messages. The keywords have these meanings: • ip-address—IP address of the IGMP group. • error—Display IGMP snooping packet error debug messages. • ipopt—Display IGMP snooping IP bridging options debug messages. • leave—Display IGMP snooping leave debug messages. • query—Display IGMP snooping query debug messages. • report—Display IGMP snooping report debug messages. • rx—Display IGMP snooping received packet debug messages. • svi—Display IGMP snooping switched virtual interface (SVI) packet debug messages. • tx—Display IGMP snooping sent packet debug messages. retry Display IGMP snooping retry debug messages. B-31 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip igmp snooping Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform ip igmp snooping command is the same as the no debug platform ip igmp snooping command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands rpc [cfg | l3mm | misc | vlan] Display IGMP snooping remote procedure call (RPC) event debug messages. The keywords have these meanings: • cfg—(Optional) Display IGMP snooping RPC debug messages. • l3mm—(Optional) IGMP snooping Layer 3 multicast router group RPC debug messages. • misc—(Optional) IGMP snooping miscellaneous RPC debug messages. • vlan—(Optional) IGMP snooping VLAN assert RPC debug messages. warn Display IGMP snooping warning messages. Release Modification 12.1(11)AX This command was first introduced. Command Description debug ip igmp snooping Displays information about platform-independent IGMP snooping activity. show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-32 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip multicast debug platform ip multicast Use the debug platform ip multicast privileged EXEC command to enable debugging of IP multicast routing. Use the no form of this command to disable debugging output. debug platform ip multicast {all | mdb | mdfs-rp-retry | midb | mroute-rp | resources | retry | rpf-throttle | snoop-events | software-forward | swidb-events | vlan-locks} no debug platform ip multicast {all | mdb | mdfs-rp-retry | midb | mroute-rp | resources | retry | rpf-throttle | snoop-events | software-forward | swidb-events | vlan-locks} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History all Display all platform IP-multicast event debug messages. Note Using this command can degrade the performance of the switch. mdb Display IP-multicast debug messages for multicast distributed fast switching (MDFS) multicast descriptor block (mdb) events. mdfs-rp-retry Display IP-multicast MDFS rendezvous point (RP) retry event debug messages. midb Display IP-multicast MDFS multicast interface descriptor block (MIDB) debug messages. mroute-rp Display IP-multicast RP event debug messages. resources Display IP-multicast hardware resource debug messages. retry Display IP-multicast retry processing event debug messages. rpf-throttle Display IP-multicast reverse path forwarding (RPF) throttle event debug messages. snoop-events Display IP-multicast IGMP snooping event debug messages. software-forward Display IP-multicast software forwarding event debug messages. swidb-events Display IP-multicast MDFS software interface descriptor block (swidb) or global event debug messages. vlan-locks Display IP-multicast VLAN lock and unlock event debug messages. Release Modification 12.1(11)AX This command was first introduced.B-33 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip multicast Usage Guidelines The undebug platform ip multicast command is the same as the no debug platform ip multicast command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-34 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip unicast debug platform ip unicast Use the debug platform ip unicast privileged EXEC command to enable debugging of platform-dependent IP unicast routing. Use the no form of this command to disable debugging output. debug platform ip unicast {adjacency | all | arp | dhcp | errors | events | interface | mpath | registries | retry | route | rpc | standby | statistics} no debug platform ip unicast {adjacency | all | arp | dhcp | errors | events | interface | mpath | registries | retry | route | rpc | standby | statistics} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History adjacency Display IP unicast routing adjacency programming event debug messages. all Display all platform IP unicast routing debug messages. Note Using this command can degrade the performance of the switch. arp Display IP unicast routing Address Resolution Protocol (ARP) and ARP throttling debug messages. dhcp Display IP unicast routing Dynamic Host Configuration Protocol (DHCP) dynamic address-related event debug messages. errors Display all IP unicast routing error debug messages, including resource allocation failures. events Display all IP unicast routing event debug messages, including registry and miscellaneous events. interface Display IP unicast routing interface event debug messages. mpath Display IP unicast routing multi-path adjacency programming event debug messages (present when performing equal or unequal cost routing). registries Display IP unicast routing forwarding information database (FIB), adjacency add, update, and delete registry event debug messages. retry Display IP unicast routing reprogram FIBs with ternary content addressable memory (TCAM) allocation failure debug messages. route Display IP unicast routing FIB TCAM programming event debug messages. rpc Display IP unicast routing Layer 3 unicast remote procedure call (RPC) interaction debug messages. standby Display IP unicast routing standby event debug messages, helpful in troubleshooting Hot Standby Routing Protocol (HSRP) issues. statistics Display IP unicast routing statistics gathering-related event debug messages. Release Modification 12.1(11)AX This command was first introduced.B-35 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ip unicast Usage Guidelines The undebug platform ip unicast command is the same as the no debug platform ip unicast command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-36 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform ipc debug platform ipc Use the debug platform ipc privileged EXEC command to enable debugging of the platform-dependent Interprocess Communication (IPC) Protocol. Use the no form of this command to disable debugging output. debug platform ipc {all | init | receive | send | trace} no debug platform {all | init | receive | send | trace} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform ipc command is the same as the no debug platform ipc. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all platform IPC debug messages. Note Using this command can degrade the performance of the switch. init Display debug messages related to IPC initialization. receive Display IPC traces each time an IPC packet is received by the switch. send Display IPC traces each time an IPC packet is sent by the switch. trace Display IPC trace debug messages, tracing the code path as the IPC functions are executed. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-37 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform led debug platform led Use the debug platform led privileged EXEC command to enable debugging of light-emitting diode (LED) actions. Use the no form of this command to disable debugging output. debug platform led {generic | signal | stack} no debug platform led {generic | signal | stack} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform led command is the same as the no debug platform led command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands generic Display LED generic action debug messages. signal Display LED signal bit map debug messages. stack Display LED stack action debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-38 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform matm debug platform matm Use the debug platform matm privileged EXEC command to enable debugging of platform-dependent MAC address management. Use the no form of this command to disable debugging output. debug platform matm {aging | all | ec-aging | errors | learning | rpc | secure-address | warnings} no debug platform matm {aging | all | ec-aging | errors | learning | rpc | secure-address | warnings} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform matm command is the same as the no debug platform matm command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands aging Display MAC address aging debug messages. all Display all platform MAC address management event debug messages. ec-aging Display EtherChannel address aging-related debug messages. errors Display MAC address management error messages. learning Display MAC address management address-learning debug messages. rpc Display MAC address management remote procedure call (RPC) related debug messages. secure-address Display MAC address management secure address learning debug messages. warning Display MAC address management warning messages. Release Modification 12.1(11)AX This command was first introduced. Command Description debug matm Displays information about platform-independent MAC address management. show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-39 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform messaging application debug platform messaging application Use the debug platform messaging application privileged EXEC command to enable debugging of application messaging activity. Use the no form of this command to disable debugging output. debug platform messaging application {all | badpak | cleanup | events | memerr | messages | stackchg | usererr} no debug platform messaging application {all | badpak | cleanup | events | memerr | messages | stackchg | usererr} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform messaging application command is the same as the no debug platform messaging application command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all application-messaging debug messages. badpak Display bad-packet debug messages. cleanup Display clean-up debug messages. events Display event debug messages. memerr Display memory-error debug messages. messages Display application-messaging debug messages. stackchg Display stack-change debug messages. usererr Display user-error debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-40 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform phy debug platform phy Use the debug platform phy privileged EXEC command to enable debugging of PHY driver information. Use the no form of this command to disable debugging output. debug platform phy {automdix | flowcontrol | forced | init-seq | link-status | read | sfp | show-controller | speed | write} no debug platform phy {automdix | flowcontrol | forced | init-seq | link-status | read | sfp | show-controller | speed | write} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform phy command is the same as the no debug platform phy command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. automdix Display PHY automatic media-dependent-interface crossover (Auto MDIX) debug messages. flowcontrol Display PHY flowcontrol debug messages. forced Display PHY forced-mode debug messages. init-seq Display PHY initialization-sequence debug messages. link-status Display PHY link-status debug messages. read Display PHY-read debug messages. sfp Display PHY small form-factor pluggable (SFP) modules debug messages. show-controller Display PHY show-controller debug messages. speed Display PHY speed-change debug messages. write Display PHY-write debug messages. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The automdix keyword was added.B-41 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform phy Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-42 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform pm debug platform pm Use the debug platform pm privileged EXEC command to enable debugging of the platform-dependent port manager software module. Use the no form of this command to disable debugging output. debug platform pm {all | counters | errdisable | etherchnl | exceptions | hpm-events | idb-events | if-numbers | ios-events | link-status | platform | pm-events | pm-vectors [detail] | rpc [general | oper-info | state | vectors | vp-events] | soutput | stack-manager | sync | vlans} no debug platform pm {all | counters | errdisable | etherchnl | exceptions | hpm-events | idb-events | if-numbers | ios-events | link-status | platform | pm-events | pm-vectors [detail] | rpc [general | oper-info | state | vectors | vp-events] | soutput | stack-manager | sync | vlans} Syntax Description all Display all port-manager debug messages. counters Display counters for remote procedure call (RPC) debug messages. errdisable Display error-disabled related-events debug messages. etherchnl Display EtherChannel related-events debug messages. exceptions Display system exception debug messages. hpm-events Display platform port-manager event debug messages. idb-events Display interface descriptor block (IDB) related-events debug messages. if-numbers Display interface-number translation-event debug messages. ios-events Display IOS event debug messages. link-status Display interface link-detection event debug messages. platform Display port-manager function-event debug messages. pm-events Display port manager event debug messages. pm-vectors [detail] Display port-manager vector-related-event debug messages. The keyword has this meaning: • detail—Display vector-function details. rpc [general | oper-info | state | vectors | vp-events] Display RPC related-event debug messages. The keywords have these meanings: • general—(Optional) Display RPC general events. • oper-info—(Optional) Display operational- and informational-related RPC messages. • state—(Optional) Display administrative- and operational-related RPC messages. • vectors—(Optional) Display vector-related RPC messages. • vp-events—(Optional) Display virtual ports related-events RP messages. soutput Display IDB output vector event debug messages. stack-manager Display stack-manager related-events debug messages. sync Display operational synchronization and VLAN line-state event debug messages. vlans Display VLAN creation and deletion event debug messages.B-43 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform pm Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform pm command is the same as the no debug platform pm command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-44 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform port-asic debug platform port-asic Use the debug platform port-asic privileged EXEC command to enable debugging of the port application-specific integrated circuit (ASIC) driver. Use the no form of this command to disable debugging output. debug platform port-asic {interrupt | periodic | read | stack | write} no debug platform port-asic {interrupt | periodic | read | stack | write} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform port-asic command is the same as the no debug platform port-asic command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands interrupt Display port-ASIC interrupt-related function debug messages. periodic Display port-ASIC periodic-function-call debug messages. read Display port-ASIC read debug messages. stack Display stacking-related function debug messages. write Display port-ASIC write debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-45 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform port-security debug platform port-security Use the debug platform port-security privileged EXEC command to enable debugging of platform-dependent port-security information. Use the no form of this command to disable debugging output. debug platform port-security {add | aging | all | delete | errors | rpc | warnings} no debug platform port-security {add | aging | all | delete | errors | rpc | warnings} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform port-security command is the same as the no debug platform port-security command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands add Display secure address addition debug messages. aging Display secure address aging debug messages. all Display all port-security debug messages. delete Display secure address deletion debug messages. errors Display port-security error debug messages. rpc Display remote procedure call (RPC) debug messages. warnings Display warning debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-46 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform qos-acl-tcam debug platform qos-acl-tcam Use the debug platform qos-acl-tcam privileged EXEC command to enable debugging of the quality of service (QoS) and access control list (ACL) ternary content addressable memory (TCAM) manager software. Use the no form of this command to disable debugging output. debug platform qos-acl-tcam {all | ctcam | errors | labels | mask | rpc | tcam} no debug platform qos-acl-tcam {all | ctcam | errors | labels | mask | rpc | tcam} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform qos-acl-tcam command is the same as the no debug platform qos-acl-tcam command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all QoS and ACL TCAM (QATM) manager debug messages. ctcam Display Cisco TCAM (CTCAM) related-events debug messages. errors Display QATM error-related-events debug messages. labels Display QATM label-related-events debug messages. mask Display QATM mask-related-events debug messages. rpc Display QATM remote procedure call (RPC) related-events debug messages. tcam Display QATM TCAM-related events debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-47 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform remote-commands debug platform remote-commands Use the debug platform remote-commands privileged EXEC command to enable debugging of remote commands. Use the no form of this command to disable debugging output. debug platform remote-commands no debug platform remote-commands Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform remote-commands command is the same as the no debug platform remote-commands command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-48 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform resource-manager debug platform resource-manager Use the debug platform resource-manager privileged EXEC command to enable debugging of the resource manager software. Use the no form of this command to disable debugging output. debug platform resource-manager {all | dm | erd | errors | madmed | sd | stats | vld} no debug platform resource-manager {all | dm | erd | errors | madmed | sd | stats | vld} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform resource-manager command is the same as the no debug platform resource-manager command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all resource manager debug messages. dm Display destination-map debug messages. erd Display equal-cost-route descriptor-table debug messages. errors Display error debug messages. madmed Display the MAC address descriptor table and multi-expansion descriptor table debug messages. sd Display the station descriptor table debug messages. stats Display statistics debug messages. vld Display the VLAN-list descriptor debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-49 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform snmp debug platform snmp Use the debug platform snmp privileged EXEC command to enable debugging of the platform-dependent Simple Network Management Protocol (SNMP) software. Use the no form of this command to disable debugging output. debug platform snmp no debug platform snmp Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform snmp command is the same as the no debug platform snmp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-50 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform span debug platform span Use the debug platform span privileged EXEC command to enable debugging of the platform-dependent Switched Port Analyzer (SPAN) software. Use the no form of this command to disable debugging output. debug platform span no debug platform span Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform span command is the same as the no debug platform span command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-51 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform stack-manager debug platform stack-manager Use the debug platform stack-manager privileged EXEC command to enable debugging of the stack manager software. Use the no form of this command to disable debugging output. debug platform stack-manager {all | rpc | sdp | sim | ssm | trace} no debug platform stack-manager {all | rpc | sdp | sim | ssm | trace} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform stack-manager command is the same as the no debug platform stack-manager command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all stack manager debug messages. rpc Display stack manager remote procedure call (RPC) usage debug messages. sdp Display the Stack Discovery Protocol (SDP) debug messages. sim Display the stack information module debug messages. ssm Display the stack state-machine debug messages. trace Trace the stack manager entry and exit debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-52 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform supervisor-asic debug platform supervisor-asic Use the debug platform supervisor-asic privileged EXEC command to enable debugging of the supervisor application-specific integrated circuit (ASIC). Use the no form of this command to disable debugging output. debug platform supervisor-asic {all | errors | receive | send} no debug platform supervisor-asic {all | errors | receive | send} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform supervisor-asic command is the same as the no debug platform supervisor-asic command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all supervisor-ASIC event debug messages. errors Display the supervisor-ASIC error debug messages. receive Display the supervisor-ASIC receive debug messages. send Display the supervisor-ASIC send debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-53 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform sw-bridge debug platform sw-bridge Use the debug platform sw-bridge privileged EXEC command to enable debugging of the software bridging function. Use the no form of this command to disable debugging output. debug platform sw-bridge {broadcast | control | multicast | packet | unicast} no debug platform sw-bridge {broadcast | control | multicast | packet | unicast} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform sw-bridge command is the same as the no debug platform sw-bridge command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands broadcast Display broadcast-data debug messages. control Display protocol-packet debug messages. multicast Display multicast-data debug messages. packet Display sent and received data debug messages. unicast Display unicast-data debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-54 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform tcam debug platform tcam Use the debug platform tcam privileged EXEC command to enable debugging of ternary content addressable memory (TCAM) access and lookups. Use the no form of this command to disable debugging output. debug platform tcam {log | read | search | write} debug platform tcam log l2 {acl {input | output} | local | qos} debug platform tcam log l3 {acl {input | output} | ipv6 {acl {input | output} | local | qos | secondary} | local | qos | secondary} debug platform tcam read {reg | ssram | tcam} debug platform tcam search debug platform tcam write {forw-ram | reg | tcam} no debug platform tcam {log | read | search | write} no debug platform tcam log l2 {acl {input | output} | local | qos} no debug platform tcam log l3 {acl {input | output} | ipv6 {acl {input | output} | local | qos | secondary} | local | qos | secondary} no debug platform tcam read {reg | ssram | tcam} no debug platform tcam search no debug platform tcam write {forw-ram | reg | tcam}B-55 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform tcam Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History log l2 {acl {input | output} | local | qos} Display Layer-2 field-based CAM look-up type debug messages. The keywords have these meanings: • acl {input | output}—Display input or output ACL look-up debug messages. • local—Display local forwarding look-up debug messages. • qos—Display classification and quality of service (QoS) look-up debug messages. l3 {acl {input | output} | ipv6 {acl {input | output} | local | qos | secondary} | local | qos | secondary} Display Layer-3 field-based CAM look-up type debug messages. The keywords have these meanings: • acl {input | output}—Display input or output ACL look-up debug messages. • ipv6 {acl {input | output} | local | qos | secondary}—Display IPv6-based look-up debug messages. Options include displaying input or output ACL look-up, local forwarding look-up, classification and QoS look-up, or secondary forwarding look-up debug messages. • local—Display local forwarding look-up debug messages. • qos—Display classification and quality of service (QoS) look-up debug messages. • secondary—Display secondary forwarding look-up debug messages. read {reg | ssram | tcam} Display TCAM-read debug messages. The keywords have these meanings: • reg—Display TCAM-register read debug messages. • ssram—Display synchronous static RAM (SSRAM)-read debug messages. • tcam—Display TCAM-read debug messages. search Display supervisor-initiated TCAM-search results debug messages. write {forw-ram | reg | tcam} Display TCAM-write debug messages. The keywords have these meanings: forw-ram—Display forwarding-RAM write debug messages. reg—Display TCAM-register write debug messages. tcam—Display TCAM-write debug messages. Release Modification 12.1(11)AX This command was first introduced.B-56 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform tcam Usage Guidelines The undebug platform tcam command is the same as the no debug platform tcam command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-57 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform udld debug platform udld Use the debug platform udld privileged EXEC command to enable debugging of the platform-dependent UniDirectional Link Detection (UDLD) software. Use the no form of this command to disable debugging output. debug platform udld [all | error | rpc {events | messages}] no debug platform udld [all | error | rpc {events | messages}] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform udld command is the same as the no debug platform udld command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all (Optional) Display all UDLD debug messages. error (Optional) Display error condition debug messages. rpc {events | messages} (Optional) Display UDLD remote procedure call (RPC) debug messages. The keywords have these meanings: • events—Display UDLD RPC events. • messages—Display UDLD RPC messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-58 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug platform vlan debug platform vlan Use the debug platform vlan privileged EXEC command to enable debugging of the VLAN manager software. Use the no form of this command to disable debugging output. debug platform vlan {errors | mvid | rpc} no debug platform vlan {errors | mvid | rpc} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug platform vlan command is the same as the no debug platform vlan command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands errors Display VLAN error debug messages. mvid Display mapped VLAN ID allocations and free debug messages. rpc Display remote procedure call (RPC) debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-59 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug pm debug pm Use the debug pm privileged EXEC command to enable debugging of port manager (PM) activity. The port manager is a state machine that controls all the logical and physical interfaces. All features, such as VLANs, UniDirectional Link Detection (UDLD), and so forth, work with the port manager to provide switch functions. Use the no form of this command to disable debugging output. debug pm {all | assert | card | cookies | etherchnl | messages | port | registry | sm | span | split | vlan | vp} no debug pm {all | assert | card | cookies | etherchnl | messages | port | registry | sm | span | split | vlan | vp} Syntax Description Note Though visible in the command-line help strings, the scp and pvlan keywords are not supported. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History all Display all PM debug messages. assert Display assert debug messages. card Display line-card related-events debug messages. cookies Display internal PM cookie validation debug messages. etherchnl Display EtherChannel related-events debug messages. hatable Display Host Access Table events debug messages. messages Display PM debug messages. port Display port related-events debug messages. registry Display PM registry invocation debug messages. sm Display state-machine related-events debug messages. span Display spanning-tree related-events debug messages. split Display split-processor debug messages. vlan Display VLAN related-events debug messages. vp Display virtual port related-events debug messages. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The hatable keyword was added.B-60 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug pm Usage Guidelines The undebug pm command is the same as the no debug pm command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-61 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug port-security debug port-security Use the debug port-security privileged EXEC command to enable debugging of the allocation and states of the port security subsystem. Use the no form of this command to disable debugging output. debug port-security no debug port-security Syntax Description This command has no arguments or keywords. Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug port-security command is the same as the no debug port-security command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show port-security Displays port-security settings for an interface or for the switch.B-62 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug qos-manager debug qos-manager Use the debug qos-manager privileged EXEC command to enable debugging of the quality of service (QoS) manager software. Use the no form of this command to disable debugging output. debug qos-manager {all | event | verbose} no debug qos-manager {all | event | verbose} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug qos-manager command is the same as the no debug qos-manager command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all Display all QoS-manager debug messages. event Display QoS-manager related-event debug messages. verbose Display QoS-manager detailed debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, refer to the Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.B-63 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree debug spanning-tree Use the debug spanning-tree privileged EXEC command to enable debugging of spanning-tree activities. Use the no form of this command to disable debugging output. debug spanning-tree {all | backbonefast | bpdu | bpdu-opt | config | csuf/csrt | etherchannel | events | exceptions | general | mstp | pvst+ | root | snmp | switch | synchronization | uplinkfast} no debug spanning-tree {all | backbonefast | bpdu | bpdu-opt | config | csuf/csrt | etherchannel | events | exceptions | general | mstp | pvst+ | root | snmp | switch | synchronization | uplinkfast} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC all Display all spanning-tree debug messages. backbonefast Display BackboneFast-event debug messages. bpdu Display spanning-tree bridge protocol data unit (BPDU) debug messages. bpdu-opt Display optimized BPDU handling debug messages. config Display spanning-tree configuration change debug messages. csuf/csrt Display cross-stack UplinkFast and cross-stack rapid transition activity debug messages. etherchannel Display EtherChannel-support debug messages. events Display spanning-tree topology event debug messages. exceptions Display spanning-tree exception debug messages. general Display general spanning-tree activity debug messages. mstp Debug Multiple Spanning Tree Protocol events. pvst+ Display per-VLAN spanning-tree plus (PVST+) event debug messages. root Display spanning-tree root-event debug messages. snmp Display spanning-tree Simple Network Management Protocol (SNMP) handling debug messages. synchronization Display the spanning-tree synchronization event debug messages. switch Display switch shim command debug messages. This shim is the software module that is the interface between the generic Spanning Tree Protocol (STP) code and the platform-specific code of various switch platforms. uplinkfast Display UplinkFast-event debug messages.B-64 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree Command History Usage Guidelines The undebug spanning-tree command is the same as the no debug spanning-tree command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The mstp and csuf/csrt keywords were added. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-65 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree backbonefast debug spanning-tree backbonefast Use the debug spanning-tree backbonefast privileged EXEC command to enable debugging of spanning-tree BackboneFast events. Use the no form of this command to disable debugging output. debug spanning-tree backbonefast [detail | exceptions] no debug spanning-tree backbonefast [detail | exceptions] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug spanning-tree backbonefast command is the same as the no debug spanning-tree backbonefast command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands detail (Optional) Display detailed BackboneFast debug messages. exceptions (Optional) Display spanning-tree BackboneFast-exception debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-66 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree bpdu debug spanning-tree bpdu Use the debug spanning-tree bpdu privileged EXEC command to enable debugging of sent and received spanning-tree bridge protocol data units (BPDUs). Use the no form of this command to disable debugging output. debug spanning-tree bpdu [receive | transmit] no debug spanning-tree bpdu [receive | transmit] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug spanning-tree bpdu command is the same as the no debug spanning-tree bpdu command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands receive (Optional) Display the nonoptimized path for received BPDU debug messages. transmit (Optional) Display the nonoptimized path for transmitted BPDU debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-67 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree bpdu-opt debug spanning-tree bpdu-opt Use the debug spanning-tree bpdu-opt privileged EXEC command to enable debugging of optimized spanning-tree bridge protocol data units (BPDUs) handling. Use the no form of this command to disable debugging output. debug spanning-tree bpdu-opt [detail | packet] no debug spanning-tree bpdu-opt [detail | packet] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug spanning-tree bpdu-opt command is the same as the no debug spanning-tree bpdu-opt command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands detail (Optional) Display detailed optimized BPDU-handling debug messages. packet (Optional) Display packet-level optimized BPDU-handling debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-68 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree mstp debug spanning-tree mstp Use the debug spanning-tree mstp privileged EXEC command to enable debugging of the Multiple Spanning Tree Protocol (MSTP) software. Use the no form of this command to disable debugging output. debug spanning-tree mstp {all | boundary | bpdu-rx | bpdu-tx | errors | flush | init | migration | pm | proposals | region | roles | sanity_check | sync | tc | timers} no debug spanning-tree mstp {all | boundary | bpdu-rx | bpdu-tx | errors | flush | init | migration | pm | proposals | region | roles | sanity_check | sync | tc | timers} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History all Enable all the debugging messages. boundary Debug flag changes at these boundaries: • An multiple spanning-tree (MST) region and a single spanning-tree region running Rapid Spanning Tree Protocol (RSTP) • An MST region and a single spanning-tree region running 802.1D • An MST region and another MST region with a different configuration bpdu-rx Debug the received MST bridge protocol data units (BPDUs). bpdu-tx Debug the transmitted MST BPDUs. errors Debug MSTP errors. flush Debug the port flushing mechanism. init Debug the initialization of the MSTP data structures. migration Debug the protocol migration state machine. pm Debug MSTP port manager events. proposals Debug handshake messages between the designated switch and the root switch. region Debug the region synchronization between the switch processor (SP) and the route processor (RP). roles Debug MSTP roles. sanity_check Debug the received BPDU sanity check messages. sync Debug the port synchronization events. tc Debug topology change notification events. timers Debug the MSTP timers for start, stop, and expire events. Release Modification 12.1(14)EA1 This command was first introduced.B-69 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree mstp Usage Guidelines The undebug spanning-tree mstp command is the same as the no debug spanning-tree mstp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-70 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree switch debug spanning-tree switch Use the debug spanning-tree switch privileged EXEC command to enable debugging of the software interface between the Spanning Tree Protocol (STP) software module and the port manager software module. Use the no form of this command to disable debugging output. debug spanning-tree switch {all | errors | flush | general | helper | pm | rx {decode | errors | interrupt | process} | state | tx [decode] | uplinkfast} no debug spanning-tree switch {all | errors | flush | general | helper | pm | rx {decode | errors | interrupt | process} | state | tx [decode] | uplinkfast} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History all Display all spanning-tree switch debug messages. errors Display debug messages for the interface between the spanning-tree software module and the port manager software module. flush Display debug messages for the shim flush operation. general Display general event debug messages. helper Display spanning-tree helper-task debug messages. Helper tasks handle bulk spanning-tree updates. pm Display port-manager event debug messages. rx Display received bridge protocol data unit (BPDU) handling debug messages. The keywords have these meanings: • decode—Display decoded received packets. • errors—Display receive error debug messages. • interrupt—Display interrupt service request (ISR) debug messages. • process—Display process receive BPDU debug messages. state Display spanning-tree port state change debug messages; tx [decode] Display transmitted BPDU handling debug messages. The keyword has this meaning: • decode—(Optional) Display decoded transmitted packets. uplinkfast Display uplinkfast packet transmission debug messages. Release Modification 12.1(11)AX This command was first introduced. 12.1(14)EA1 The flush and uplinkfast keywords were added.B-71 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree switch Usage Guidelines The undebug spanning-tree switch command is the same as the no debug spanning-tree switch command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-72 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug spanning-tree uplinkfast debug spanning-tree uplinkfast Use the debug spanning-tree uplinkfast privileged EXEC command to enable debugging of spanning-tree UplinkFast events. Use the no form of this command to disable debugging output. debug spanning-tree uplinkfast [exceptions] no debug spanning-tree uplinkfast [exceptions] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug spanning-tree uplinkfast command is the same as the no debug spanning-tree uplinkfast command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands exceptions (Optional) Display spanning-tree UplinkFast-exception debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show spanning-tree Displays spanning-tree state information.B-73 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan debug sw-vlan Use the debug sw-vlan privileged EXEC command to enable debugging of VLAN manager activities. Use the no form of this command to disable debugging output. debug sw-vlan {badpmcookies | cfg-vlan {bootup | cli} | events | ifs | management | notification | packets | registries | vtp} no debug sw-vlan {badpmcookies | cfg-vlan {bootup | cli} | events | ifs | management | notification | packets | registries | vtp} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug sw-vlan command is the same as the no debug sw-vlan command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. badpmcookies Display debug messages for VLAN manager incidents of bad port manager cookies. cfg-vlan {bootup | cli} Display config-vlan debug messages. The keywords have these meanings: • bootup—Display messages when the switch is booting up. • cli—Display messages when the command-line interface (CLI) is in config-vlan mode. events Display debug messages for VLAN manager events. ifs See the debug sw-vlan ifs command. management Display debug messages for VLAN manager management of internal VLANs. notification See the debug sw-vlan notification command. packets Display debug messages for packet handling and encapsulation processes. registries Display debug messages for VLAN manager registries. vtp See the debug sw-vlan vtp command. Release Modification 12.1(11)AX This command was first introduced.B-74 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show vlan Displays the parameters for all configured VLANs or one VLAN (if the VLAN name or ID is specified) in the administrative domain. show vtp Displays general information about VTP management domain, status, and counters. B-75 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan ifs debug sw-vlan ifs Use the debug sw-vlan ifs privileged EXEC command to enable debugging of the VLAN manager IOS file system (IFS) error tests. Use the no form of this command to disable debugging output. debug sw-vlan ifs {open {read | write} | read {1 | 2 | 3 | 4} | write} no debug sw-vlan ifs {open {read | write} | read {1 | 2 | 3 | 4} | write} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug sw-vlan ifs command is the same as the no debug sw-vlan ifs command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. When determining the file read operation, Operation 1 reads the file header, which contains the header verification word and the file version number. Operation 2 reads the main body of the file, which contains most of the domain and VLAN information. Operation 3 reads type length version (TLV) descriptor structures. Operation 4 reads TLV data. Related Commands open {read | write} Display VLAN manager IFS file-open operation debug messages. The keywords have these meanings: • read—Display VLAN manager IFS file-read operation debug messages. • write—Display VLAN manager IFS file-write operation debug messages. read {1 | 2 | 3 | 4} Display file-read operation debug messages for the specified error test (1, 2, 3, or 4). write Display file-write operation debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show vlan Displays the parameters for all configured VLANs or one VLAN (if the VLAN name or ID is specified) in the administrative domain. B-76 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan notification debug sw-vlan notification Use the debug sw-vlan notification privileged EXEC command to enable debugging of the activation and deactivation of Inter-Link Switch (ISL) VLAN IDs. Use the no form of this command to disable debugging output. debug sw-vlan notification {accfwdchange | allowedvlancfgchange | fwdchange | linkchange | modechange | pruningcfgchange | statechange} no debug sw-vlan notification {accfwdchange | allowedvlancfgchange | fwdchange | linkchange | modechange | pruningcfgchange | statechange} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug sw-vlan notification command is the same as the no debug sw-vlan notification command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. accfwdchange Display debug messages for VLAN manager notification of aggregated access interface spanning-tree forward changes. allowedvlancfgchange Display debug messages for VLAN manager notification of changes to the allowed VLAN configuration. fwdchange Display debug messages for VLAN manager notification of spanning-tree forwarding changes. linkchange Display debug messages for VLAN manager notification of interface link-state changes. modechange Display debug messages for VLAN manager notification of interface mode changes. pruningcfgchange Display debug messages for VLAN manager notification of changes to the pruning configuration. statechange Display debug messages for VLAN manager notification of interface state changes. Release Modification 12.1(11)AX This command was first introduced.B-77 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan notification Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show vlan Displays the parameters for all configured VLANs or one VLAN (if the VLAN name or ID is specified) in the administrative domain. B-78 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan vtp debug sw-vlan vtp Use the debug sw-vlan vtp privileged EXEC command to enable debugging of the VLAN Trunking Protocol (VTP) code. Use the no form of this command to disable debugging output. debug sw-vlan vtp {events | packets | pruning [packets | xmit] | xmit} no debug sw-vlan vtp {events | packets | pruning | xmit} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug sw-vlan vtp command is the same as the no debug sw-vlan vtp command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. If no further parameters are entered after the pruning keyword, VTP pruning debugging messages are displayed. They are generated by the VTP_PRUNING_LOG_NOTICE, VTP_PRUNING_LOG_INFO, VTP_PRUNING_LOG_DEBUG, VTP_PRUNING_LOG_ALERT, and VTP_PRUNING_LOG_WARNING macros in the VTP pruning code. events Display debug messages for general-purpose logic flow and detailed VTP messages generated by the VTP_LOG_RUNTIME macro in the VTP code. packets Display debug messages for the contents of all incoming VTP packets that have been passed into the VTP code from the IOS VTP platform-dependent layer, except for pruning packets. pruning [packets | xmit] Display debug messages generated by the pruning segment of the VTP code. The keywords have these meanings: • packets—(Optional) Display debug messages for the contents of all incoming VTP pruning packets that have been passed into the VTP code from the IOS VTP platform-dependent layer. • xmit—(Optional) Display debug messages for the contents of all outgoing VTP packets that the VTP code requests the IOS VTP platform-dependent layer to send. xmit Display debug messages for the contents of all outgoing VTP packets that the VTP code requests the IOS VTP platform-dependent layer to send, except for pruning packets. Release Modification 12.1(11)AX This command was first introduced.B-79 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug sw-vlan vtp Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show vtp Displays general information about VTP management domain, status, and counters.B-80 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug udld debug udld Use the debug udld privileged EXEC command to enable debugging of the UniDirectional Link Detection (UDLD) feature. Use the no form of this command to disable UDLD debugging. debug udld {events | packets | registries} no debug udld {events | packets | registries} Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug udld command is the same as the no debug udld command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. For debug udld events, these debugging messages are displayed: • General UDLD program logic flow • State machine state changes • Program actions for the set and clear ErrDisable state • Neighbor cache additions and deletions • Processing of configuration commands • Processing of link-up and link-down indications For debug udld packets, these debugging messages are displayed: • General packet processing program flow on receipt of an incoming packet • Indications of the contents of the various pieces of packets received (such as type length versions [TLVs]) as they are examined by the packet reception code • Packet transmission attempts and the outcome events Display debug messages for UDLD process events as they occur. packets Display debug messages for the UDLD process as it receives packets from the packet queue and tries to send them at the request of the UDLD protocol code. registries Display debug messages for the UDLD process as it processes registry calls from the UDLD process-dependent module and other feature modules. Release Modification 12.1(11)AX This command was first introduced.B-81 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug udld For debug udld registries, these categories of debugging messages are displayed: • Sub-block creation • Fiber-port status changes • State change indications from the port manager software • MAC address registry calls Related Commands Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands. show udld Displays UDLD administrative and operational status for all ports or the specified port. B-82 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix B Debug Commands debug vqpc debug vqpc Use the debug vqpc privileged EXEC command to enable debugging of the VLAN Query Protocol (VQP) client. Use the no form of this command to disable debugging output. debug vqpc [all | cli | events | learn | packet] no debug vqpc [all | cli | events | learn | packet] Syntax Description Defaults Debugging is disabled. Command Modes Privileged EXEC Command History Usage Guidelines The undebug vqpc command is the same as the no debug vqpc command. When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then enter the debug command at the command-line prompt of the stack member. Related Commands all (Optional) Display all VQP client debug messages. cli (Optional) Display the VQP client command-line interface (CLI) debug messages. events (Optional) Display VQP client event debug messages. learn (Optional) Display VQP client address learning debug messages. packet (Optional) Display VQP client packet information debug messages. Release Modification 12.1(11)AX This command was first introduced. Command Description show debugging Displays information about the types of debugging that are enabled. For syntax information, select Cisco IOS Configuration Fundamentals Command Reference for IOS Release 12.1 > Cisco IOS System Management Commands > Troubleshooting Commands.C-1 Catalyst 3750 Switch Command Reference 78-15165-02 A P P E N D I X C Show Platform Commands This appendix describes the show platform privileged EXEC commands that have been created or changed for use with the Catalyst 3750 switch. These commands display information helpful in diagnosing and resolving internetworking problems and should be used only under the guidance of Cisco technical support staff.C-2 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform acl show platform acl Use the show platform acl privileged EXEC command to display platform-dependent access control list (ACL) manager information. show platform acl {interface interface-id | label label-number [detail] | statistics asic-number | vlan vlan-id} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. interface interface-id Display per-interface ACL manager information for the specified interface. The interface can be a physical interface or a VLAN. label label-number [detail] Display per-label ACL manager information. The label-number range is 0 to 255. The keyword has this meaning: • detail—(Optional) Display detailed ACL manager label information. statistics asic-number Display per-ASIC ACL manager information. The asic-number is the port ASIC number, either 0 or 1. vlan vlan-id Display per-VLAN ACL manager information. The vlan-id range is from 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-3 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform configuration show platform configuration Use the show platform configuration privileged EXEC command to display platform-dependent configuration-manager related information. show platform configuration {config-output | default | running | startup} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. config-output Display the output of the last auto-configuration application. default Display whether or not the system is running the default configuration. running Display a snapshot of the backed-up running configuration on the local switch. startup Display a snapshot of the backed-up startup configuration on the local switch. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-4 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform etherchannel show platform etherchannel Use the show platform etherchannel privileged EXEC command to display platform-dependent EtherChannel information. show platform etherchannel {flags | time-stamps} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. flags Display EtherChannel port flags. time-stamps Display EtherChannel time stamps. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-5 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform forward show platform forward Use the show platform forward privileged EXEC command for an interface to determine how the hardware would forward a frame that matches the specified parameters. show platform forward interface-id [vlan vlan-id] src-mac dst-mac [l3protocol-id] [sap | snap] [cos cos] [ip src-ip dst-ip [frag field] [dscp dscp] {l4protocol-id | icmp icmp-type icmp-code | igmp igmp-version igmp-type | tcp src-port dst-port flags | udp src-port dst-port} [ | {begin | exclude | include} expression] Syntax Description interface-id The input physical interface, the port on which the packet comes in to the switch (including type, stack member, module, and port number). vlan vlan-id (Optional) Input VLAN ID. The range is 1 to 4094. If not specified, and the input interface is not a routed port, the default is 1. src-mac 48-bit source MAC address. dst-mac 48-bit destination MAC address. l3protocol-id (Optional) The Layer 3 protocol used in the packet. The number is a value 0 to 65535. sap (Optional) Service access point (SAP) encapsulation type. snap (Optional) Subnetwork Access Protocol (SNAP) encapsulation type. cos cos (Optional) Class of service (CoS) value of the frame. The range is 0 to 7. ip src-ip dst-ip (Optional, but required for IP packets) Source and destination IP addresses in dotted decimal notation. frag field (Optional) The IP fragment field for a fragmented IP packet. The range is 0 to 65535. dscp dscp (Optional) Differentiated Services Code Point (DSCP) field in the IP header. The range is 0 to 63. l4protocol-id The numeric value of the Layer 4 protocol field in the IP header. The range is 0 to 255. For example, 47 is generic routing encapsulation (GRE), and 89 is Open Shortest Path First (OSPF). If the protocol is TCP, UDP, ICMP, or IGMP, you should use the appropriate keyword instead of a numeric value. icmp icmp-type icmp-code Internet Control Message Protocol (ICMP) parameters. The icmp-type and icmp-code ranges are 0 to 255. igmp igmp-version igmp-type Internet Group Management Protocol (IGMP) parameters. The igmp-version range is 1 to 15; the igmp-type range is 0 to 15. tcp src-port dst-port flags Transmission Control Protocol (TCP) parameters: TCP source port, destination port, and the numeric value of the TCP flags byte in the header. The src-port and dst-port ranges are 0 to 65535. The flag range is from 0 to 1024. udp src-port dst-port User Datagram Protocol (UDP) parameters. The src-port and dst-port ranges are 0 to 65535. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point.C-6 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform forward Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples Refer to the “Troubleshooting” chapter of the software configuration guide for this release for examples of the show platform forward command output displays and what they mean. Release Modification 12.1(11)AX This command was first introduced.C-7 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ip igmp snooping show platform ip igmp snooping Use the show platform ip igmp snooping privileged EXEC command to display platform-dependent Internet Group Management Protocol (IGMP) snooping information. show platform ip igmp snooping {all | control [di] | counters | flood [vlan vlan-id] | group ip-address | hardware | retry [count | local [count] | remote [count]]} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History all Display all IGMP snooping platform IP multicast information. control [di] Display IGMP snooping control entries. The keyword has this meaning: • di—(Optional) Display IGMP snooping control destination index entries. counters Display IGMP snooping counters. flood [vlan vlan-id] Display IGMP snooping flood information. The keyword has this meaning: • vlan vlan-id—(Optional) Display flood information for the specified VLAN. The range is 1 to 4094. group ip-address Display the IGMP snooping multicast group information, where ip-address is the IP address of the group. hardware Display IGMP snooping information loaded into hardware. retry [count | local [count] Display IGMP snooping retry information. The keywords have these meanings: • count—(Optional) Display only the retry count. • local—(Optional) Display local retry entries. remote [count] Display remote entries. The keyword has this meaning: • count—(Optional) Display only the remote count. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-8 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ip igmp snooping Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.C-9 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ip multicast show platform ip multicast Use the show platform ip multicast privileged EXEC command to display platform-dependent IP multicast tables and other information. show platform ip multicast {counters | groups | hardware [detail] | interfaces | locks | mdfs-routes | mroute-retry | retry | trace} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. counters Display IP multicast counters and statistics. groups Display IP multicast routes per group. hardware [detail] Display IP multicast routes loaded into hardware. The keyword has this meaning: • detail—(Optional) Display port members in destination index and route index. interfaces Display IP multicast interfaces. locks Display IP multicast destination-index locks. mdfs-routes Display multicast distributed fast switching (MDFS) IP multicast routes. mroute-retry Display the IP multicast route retry queue. retry Display the IP multicast routes in the retry queue. trace Display the IP multicast trace buffer. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-10 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ip unicast show platform ip unicast Use the show platform ip unicast privileged EXEC command to display platform-dependent IP unicast routing information. show platform ip unicast {adjacency | cef-idb | counts | dhcp | failed {adjacency | arp [A.B.C.D] | route} | mpaths | route | standby | statistics | trace} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History adjacency Display the platform adjacency database. cef-idb Display platform information corresponding to Cisco Express Forwarding (CEF) interface descriptor block. counts Display the current counts for the Layer 3 unicast databases. dhcp Display the Dynamic Host Configuration Protocol (DHCP) system dynamic addresses. failed {adjacency | arp [A.B.C.D] | route} Display the hardware resource failures. The keywords have these meanings: • adjacency—Display the adjacency entries that failed to be programmed in hardware. • arp—Display the Address Resolution Protocol (ARP) deletions because of failure and because of retries. • A.B.C.D—(Optional) Prefix of the ARP entries to display. • route—Display the route entries that failed to be programmed in hardware. mpaths Display the Layer 3 unicast routing multipath adjacency database. route Display the platform route database. standby Display the platform standby information. statistics Display the Layer 3 unicast routing accumulated statistics. trace Display the platform event trace logs. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-11 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ip unicast Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.C-12 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform ipc trace show platform ipc trace Use the show platform ipc trace privileged EXEC command to display platform-dependent Interprocess Communication (IPC) Protocol trace log information. show platform ipc trace [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-13 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform layer4op show platform layer4op Use the show platform layer4op privileged EXEC command to display platform-dependent Layer 4 operator information. show platform layer4op {acl | qos [port-asic]} {and-or | map | or-and | vcu} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. acl Display access control list (ACL) Layer 4 operators information. qos [port-asic] Display quality of service (QoS) Layer 4 operators information. The keyword has this meaning: • port-asic—(Optional) QoS port ASIC number. The value can be 0 or 1. and-or Display AND-OR registers information. map Display select map information. or-and Display OR-AND registers information. vcu Display value compare unit (VCU) register information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-14 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform mac-address-table show platform mac-address-table Use the show platform mac-address-table privileged EXEC command to display platform-dependent MAC address table information. show platform mac-address-table [aging-array | hash-table | mac-address mac-address] [vlan vlan-id]] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. aging-array (Optional) Display the MAC address table aging array. hash-table (Optional) Display the MAC address table hash table. mac-address mac-address (Optional) Display the MAC address table MAC address information, where mac-address is the 48-bit hardware address. vlan vlan-id (Optional) Display information for the specified VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-15 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform messaging show platform messaging Use the show platform messaging privileged EXEC command to display platform-dependent application and performance message information. show platform messaging {application [incoming | outgoing | summary] | hiperf [class-number]} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. application [incoming | outgoing | summary] Display application message information. The keywords have these meanings: • incoming—(Optional) Display only information about incoming application messaging requests. • outgoing—(Optional) Display only information about incoming application messaging requests. • summary—(Optional) Display summary information about all application messaging requests. hiperf [class-number] Display outgoing high-performance message information. Specify the class-number option to display information about high-performance messages for this class number. The range is 0 to 36. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-16 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform monitor show platform monitor Use the show platform monitor privileged EXEC command to display platform-dependent Switched Port Analyzer (SPAN) information. show platform monitor [session session-number] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. session session-number (Optional) Display SPAN information for the specified SPAN session. The range is 1 to 66. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-17 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform mvr table show platform mvr table Use the show platform mvr table privileged EXEC command to display the platform-dependent Multicast VLAN Registration (MVR) multi-expansion descriptor (MED) group mapping table. show platform mvr table [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with a technical support representative while troubleshooting a problem. Do not use this command unless a technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-18 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform pm show platform pm Use the show platform pm privileged EXEC command to display platform-dependent port-manager information. show platform pm {counters | group-masks | idbs {active-idbs | deleted-idbs} | if-numbers | link-status | platform-block | port-info interface-id | stack-view | vlan {info | line-state} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. counters Display module counters information. group-masks Display EtherChannel group masks information. idbs {active-idbs | deleted-idbs} Display interface data block (IDB) information. The keywords have these meanings: • active-idbs—Display active IDB information. • deleted-idbs—Display deleted and leaked IDB information. if-numbers Display interface numbers information. link-status Display local port link status information. platform-block Display platform port block information. port-info interface-id Display port administrative and operation fields for the specified interface. stack-view Display status information for the stack. vlan {info | line-state} Display platform VLAN information. The keywords have these meanings: • info—Display information for active VLANs. • line-state—Display line-state information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-19 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-asic show platform port-asic Use the show platform port-asic privileged EXEC command to display platform-dependent port application-specific integrated circuit (ASIC) register information. show platform port-asic {cpu-queue-map-table [asic number | port number [asic number]] | dest-map index number | etherchannel-info [asic number | port number [asic number]] | exception [asic number | port number [asic number]] | global-status [asic number | port number [asic number]] | learning [asic number | port number [asic number]] | mac-info [asic number | port number [asic number]] | mvid [asic number] | packet-info-ram [asic number | index number [asic number]] | port-info [asic number | port number [asic number]] | prog-parser [asic number | port number [asic number]] | receive {buffer-queue | port-fifo | supervisor-sram} [asic number | port number [asic number]] | span [vlan-id [asic number] | [asic number] stack {control | dest-map | learning | messages | mvid | prog-parser | span | stats [asic number | port number [asic number]] stats {drop | enqueue | miscellaneous | supervisor} [asic number | port number [asic number]] | transmit {port-fifo | queue | supervisor-sram} [asic number | port number [asic number]] vct [asic number | port number [asic number]]} [ | {begin | exclude | include} expression] Syntax Description cpu-queue-map-table [asic number | port number [asic number]] Display the CPU queue-map table entries. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27. dest-map index number Display destination-map information for the specified index. The range is 0 to 65535. etherchannel-info [asic number | port number [asic number]] Display the contents of the EtherChannel information register. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports.C-20 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-asic exception [asic number | port number [asic number]] Display the exception-index register information. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. global-status [asic number | port number [asic number]] Display global and interrupt status. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. learning [asic number | port number [asic number]] Display entries in the learning cache. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. mac-info [asic number | port number [asic number]] Display the contents of the MAC information register. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. mvid [asic number] Display the mapped VLAN ID table. The keyword has this meaning: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. packet-info-ram [asic number | index number [asic number]] Display the packet information RAM. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • index number—(Optional) Display information for the specified packet RAM index number and ASIC number. The range is 0 to 63.C-21 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-asic port-info [asic number | port number [asic number]] Display port information register values. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. prog-parser [asic number | port number [asic number]] Display the programmable parser tables. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. receive {buffer-queue | port-fifo | supervisor-sram} [asic number | port number [asic number]] Display receive information. The keywords have these meanings: • buffer-queue—Display the buffer queue information. • port-fifo—Display the port-FIFO information. • supervisor-sram—Display the supervisor static RAM (SRAM) information. • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. span [vlan-id | asic number] Display the Switched Port Analyzer (SPAN)-related information. The keywords have these meanings: • vlan-id—(Optional) Display information for the specified VLAN. The range is 0 to 1023. • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1.C-22 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-asic stack {control | dest-map | learning | messages | mvid | prog-parser | span | stats [asic number | port number [asic number]] Display stack-related information. The keywords have these meanings: • control—Display stack control-status register information. • dest-map—Display destination-map information. • learning—Display entries in the learning-cache. • messages—Display the stack-message register information. • mvid—Display entries in the mapped VLAN-ID table. • prog-parser—Display the programmable parser tables. • span—Display SPAN-related information. • stats—Display raw statistics for the port ASIC. • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. stats {drop | enqueue | miscellaneous | supervisor} [asic number | port number [asic number]] Display raw statistics for the port ASIC. The keywords have these meanings: • drop—Display drop statistics. • enqueue—Display enqueue statistics. • miscellaneous—Display miscellaneous statistics. • supervisor—Display supervisor statistics. • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. transmit {port-fifo | queue | supervisor-sram} [asic number | port number [asic number]] Display transmit information. The keywords have these meanings: • port-fifo—Display the contents of the port-FIFO information register. • queue—Display the contents of the queue information register. • supervisor-sram—Display supervisor SRAM information. • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports.C-23 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-asic Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. vct [asic number | port number [asic number]] Display the VLAN compression table entries for the specified ASIC or for the specified port and ASIC. The keywords have these meanings: • asic number—(Optional) Display information for the specified ASIC. The range is 0 to 1. • port number—(Optional) Display information for the specified port and ASIC number. The range is 0 to 27, where 0 is the supervisor and 1 to 25 are the ports. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-24 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform port-security show platform port-security Use the show platform port-security privileged EXEC command to display platform-dependent port-security information. show platform port-security [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-25 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform qos show platform qos Use the show platform qos privileged EXEC command to display platform-dependent quality of service (QoS) information. show platform qos {label asic number | policer {parameters asic number | port alloc number asic number}} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. label asic number Display QoS label maps for the specified ASIC. (Optional) For asic number, the range is 0 to 1. policer {parameters asic number | port alloc number asic number} Display policer information. The keywords have these meanings: • parameters asic number—Display parameter information for the specified ASIC. The range is 0 to 1. • port alloc number asic number—Display port allocation information for the specified port and ASIC. The port allocation range is 0 to 25. The ASIC range is 0 to 1. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-26 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform resource-manager show platform resource-manager Use the show platform resource-manager privileged EXEC command to display platform-dependent resource-manager information. show platform resource-manager {dm [index number] | erd [index number] | mad [index number] | med [index number] | mod | sd [index number] | vld [index number]} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History dm [index number] Display the destination map. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. erd [index number] Display the equal-cost-route descriptor table for the specified index. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. mad [index number] Display the MAC-address descriptor table for the specified index. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. med [index number] Display the multi-expansion descriptor table for the specified index. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. mod Display the resource-manager module information. sd [index number] Display the station descriptor table for the specified index. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. vld [index number] Display the VLAN-list descriptor table for the specified index. The keyword has this meaning: • index number—(Optional) Display the specified index. The range is 0 to 65535. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-27 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform resource-manager Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.C-28 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform snmp counters show platform snmp counters Use the show platform snmp counters privileged EXEC command to display platform-dependent Simple Network Management Protocol (SNMP) counter information. show platform snmp counters [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-29 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform spanning-tree show platform spanning-tree Use the show platform spanning-tree privileged EXEC command to display platform-dependent spanning-tree information. show platform spanning-tree synchronization [detail | vlan vlan-id] [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. synchronization [detail | vlan vlan-id] Display spanning-tree state synchronization information. The keywords have these meanings: • detail—(Optional) Display detailed spanning-tree information. • vlan vlan-id—(Optional) Display VLAN switch spanning-tree information for the specified VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-30 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform stp-instance show platform stp-instance Use the show platform stp-instance privileged EXEC command to display platform-dependent spanning-tree instance information. show platform stp-instance vlan-id [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. vlan-id Display spanning-tree instance information for the specified VLAN. The range is 1 to 4094. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced.C-31 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform stack-manager show platform stack-manager Use the show platform stack-manager privileged EXEC command to display platform-dependent switch-stack information. show platform stack-manager {all | counters | trace [sdp [reverse] | state [reverse]]} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. These are the states displayed in the summary information about the switch stack: • Waiting—The stage when a switch is booting up and waiting for communication from other switches in the stack. The switch has not yet determined whether it is a stack master or not. Stack members not participating in a stack master election remain in the waiting state until the stack master is elected and ready. all Display all information for the entire switch stack. counters Display the stack manager counters. trace [sdp [reverse]] Display trace information. The keywords have these meanings: • sdp—(Optional) Display Stack Discovery Protocol (SDP) information. • reverse—(Optional) Display trace information in reverse chronological order (from recent to older chronological sequence). trace [state [reverse]] Display trace information. The keywords have these meanings: • state—(Optional) Display stack state machine information. • reverse—(Optional) Display trace information in reverse chronological order (from recent to older chronological sequence). | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.C-32 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform stack-manager • Initializing—The stage when a switch has determined whether it is the stack master or not. If the switch is not the stack master, it is receiving its system- and interface-level configuration from the stack master and loading it. • Ready—The stage when the stack member has completed loading the system- and interface-level configuration and is ready to forward traffic. • Master Re-Init—The stage immediately after a stack master re-election and a different stack member is elected stack master. The new stack master is re-initializing its configuration. This state applies only to the new stack master. • Ver Mismatch—The stage of a switch in version mismatch (VM) mode. VM mode is when a switch joining the switch stack has a different stack protocol minor version number from the stack master. A typical state transition for a stack member (including a stack master) booting up is Waiting -> Initializing -> Ready. A typical state transition for a stack member becoming a stack master after a stack master election is Ready -> Master Re-Init -> Ready. A typical state transition for a stack member in version mismatch (VM) mode is Waiting -> Ver Mismatch.C-33 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform tb show platform tb Use the show platform tb privileged EXEC command to display platform-dependent trusted-boundary information during a stack master change to a new stack master. show platform tb [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Examples This is an example of output from the show platform tb command: Switch# show platform tb Print TB sub-block information (Fa1/0/2) device:(Cisco phone) /* current interfaces with TB enabled, and the trust device type */ Current master switch:(Yes) /* Is this switch the current master switch? */ New elected master :(No) /* Is the master switch-over occurred and this is the new master switch? */ Master ready :(No) /* Is the Master switch in ready state? */ HULC TB process on :(No) /* Is the TB platform process currently running? */ CDP stable timer ON :(No)(360 secs) /* Is the CDP stable timer running? After the CDP stable timer expired, CDP neighbors of all the TB enabled interfaces will be verified to make sure the replacement of IP phone and PC did not happen during the master switch-over. */ Print TB residue trust ports information | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(14)EA1 This command was first introduced.C-34 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform tb /* The interfaces with TB enabled right before master switch-over. */ Print port CDP neighbor information /* Is the CDP message still received after switch-over? */ HULC TB is not detecting CDP events /* Currently, this switch is not detecting any CDP event. */C-35 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform tcam show platform tcam Use the show platform tcam privileged EXEC command to display platform-dependent ternary content addressable memory (TCAM) driver information. show platform tcam {handle number | log-results | table {acl | all | equal-cost-route | ipv6 {acl | qos | secondary} local | mac-address | multicast-expansion | qos | secondary | station | vlan-list} | usage} [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table acl [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table all [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table equal-cost-route [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table ipv6 {acl | qos | secondary} [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table local [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table mac-address [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table multicast-expansion [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table qos [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table secondary [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table station [asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression] show platform tcam table vlan-list [[asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] [ | {begin | exclude | include} expression]C-36 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform tcam Syntax Description Command Modes Privileged EXEC handle number Display the TCAM handle. The range is 0 to 4294967295. log-results Display the TCAM log results. table {acl | all | equal-cost-route | ipv6 {acl | qos | secondary} local | mac-address | multicast-expansion | qos | secondary | station | vlan-list} Display lookup and forwarding table information. The keywords have these meanings: • acl—Display the access-control list (ACL) table. • all—Display all the TCAM tables. • equal-cost-route—Display the equal-cost-route table. • ipv6—Display IPv6 information. – acl—Display the IPv6 ACL-table information. – qos—Display the IPv6 QoS-table information. – secondary—Display the IPv6 secondary-table information. • local—Display the local table. • mac-address—Display the MAC-address table. • multicast-expansion—Display the IPv6 multicast-expansion table. • qos—Display the QoS table. • secondary—Display the secondary table. • station—Display the station table. • vlan-list—Display the VLAN list table. usage Display the CAM and forwarding table usage. [[asic number [detail [invalid]] | [index number [detail [invalid]] | invalid | num number [detail [invalid]] | invalid] | [invalid] | [num number [detail [invalid]] | invalid]] Display information. The keywords have these meanings: • asic number—Display information for the specified ASIC device ID. The range is 0 to 15. • detail [invalid]—(Optional) Display valid or invalid details. • index number—(Optional) Display information for the specified TCAM table index. The range is 0 to 32768. • num number—(Optional) Display information for the specified TCAM table number. The range is 0 to 32768. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point.C-37 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform tcam Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. Release Modification 12.1(11)AX This command was first introduced.C-38 Catalyst 3750 Switch Command Reference 78-15165-02 Appendix C Show Platform Commands show platform vlan show platform vlan Use the show platform vlan privileged EXEC command to display platform-dependent VLAN information. show platform vlan {misc | mvid | prune | refcount | rpc {receive | transmit}} [ | {begin | exclude | include} expression] Syntax Description Command Modes Privileged EXEC Command History Usage Guidelines You should use this command only when you are working directly with your technical support representative while troubleshooting a problem. Do not use this command unless your technical support representative asks you to do so. Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. misc Display miscellaneous VLAN module information. mvid Display the mapped VLAN ID (MVID) allocation information. prune Display the stack pruning database. refcount Display the VLAN lock module-wise reference counts. rpc {receive | transmit} Display remote procedure call (RPC) messages. The keywords have these meanings: • receive—Display received information. • transmit—Display transmitted information. | begin (Optional) Display begins with the line that matches the expression. | exclude (Optional) Display excludes lines that match the expression. | include (Optional) Display includes lines that match the specified expression. expression Expression in the output to use as a reference point. Release Modification 12.1(11)AX This command was first introduced.IN-1 Catalyst 3750 Switch Command Reference 78-15165-02 I N D E X Numerics 802.1X and switchport modes 2-427 See also port-based authentication violation error recovery 2-84 A aaa authentication dot1x command 2-1 AAA methods 2-1 abort command 2-475 access control entries See ACEs access control lists See ACLs access groups IP 2-95 MAC, displaying 2-267 access lists IP 2-95 on Layer 2 interfaces 2-95 access map configuration mode 2-121 access mode 2-426 access ports 2-426 ACEs 2-64, 2-177 ACLs deny 2-62 displaying 2-209 for non-IP protocols 2-115 matching 2-121 permit 2-175 action command 2-3 address aliasing 2-166 aggregate-port learner 2-171 allowed VLANs 2-440 apply command 2-475 archive copy-sw command 2-5 archive download-sw command 2-7 archive tar command 2-10 archive upload-sw command 2-13 audience xv authorization state of controlled port 2-72 autonegotiation of duplex mode 2-81 auto qos voip command 2-15 B BackboneFast, for STP 2-364 boot (boot loader) command A-2 boot auto-copy-sw command 2-19 boot boothlpr command 2-20 boot config-file command 2-21 boot enable-break command 2-22 boot helper command 2-23 boot helper-config file command 2-24 booting displaying environment variables 2-215 interrupting 2-22 IOS image 2-27 manually 2-25Index IN-2 Catalyst 3750 Switch Command Reference 78-15165-02 boot loader accessing A-1 booting helper image 2-23 IOS image A-2 directories creating A-16 displaying a list of A-7 removing A-20 displaying available commands A-12 memory heap utilization A-14 version A-27 environment variables described A-21 displaying settings A-21 location of A-23 setting A-21 unsetting A-25 files copying A-5 deleting A-6 displaying a list of A-7 displaying the contents of A-4, A-17, A-24 renaming A-18 file system formatting A-10 initializing Flash A-9 running a consistency check A-11 loading helper images A-13 prompt A-1 resetting the system A-19 boot manual command 2-25 boot private-config-file command 2-26 boot system command 2-27 BPDU filtering, for spanning tree 2-365, 2-398 BPDU guard, for spanning tree 2-367, 2-398 broadcast storm control 2-415 broadcast traffic counters 2-254 C candidate switches See clusters cat (boot loader) command A-4 caution, description xvi channel-group command 2-28 channel-protocol command 2-32 class command 2-33 class-map command 2-35 class maps creating 2-35 defining the match criteria 2-123 displaying 2-217 class of service See CoS clear lacp command 2-37 clear mac-address-table command 2-38 clear pagp command 2-39 clear setup express command 2-40 clear spanning-tree counters command 2-41 clear spanning-tree detected-protocols command 2-42 clear vmps statistics command 2-43 clear vtp counters command 2-44 cluster commander-address command 2-45 cluster discovery hop-count command 2-47 cluster enable command 2-48 cluster holdtime command 2-50 cluster member command 2-51 cluster outside-interface command 2-53 cluster run command 2-54 clusters adding candidates 2-51 binding to HSRP group 2-55 building manually 2-51 communicating with devices outside the cluster 2-53 members by using Telnet 2-187 debug messages, display B-4Index IN-3 Catalyst 3750 Switch Command Reference 78-15165-02 clusters (continued) displaying candidate switches 2-220 debug messages B-4 member switches 2-222 status 2-218 hop-count limit for extended discovery 2-47 HSRP standby groups 2-55 redundancy 2-55 SNMP trap 2-355 cluster standby-group command 2-55 cluster timer command 2-57 command modes defined 1-2 command switch See clusters configuration files password recovery disable considerations A-1 specifying the name 2-21, 2-26 configuring multiple interfaces 2-90 config-vlan mode commands 2-461 description 1-5 entering 2-460 summary 1-2 conventions command xvi for examples xvi publication xvi text xvi copy (boot loader) command A-5 CoS assigning default value to incoming packets 2-131 overriding the incoming value 2-131 CoS-to-DSCP map 2-135 CPU ASIC statistics, displaying 2-224 D debug autoqos command B-2 debug cluster command B-4 debug dot1x command B-6 debug dtp command B-7 debug etherchannel command B-8 debug interface command B-9 debug ip igmp filter command B-10 debug ip igmp max-groups command B-11 debug ip igmp snooping command B-12 debug lacp command B-13 debug mac-notification command B-14 debug matm command B-15 debug monitor command B-16 debug mvrdbg command B-17 debug nvram command B-18 debug pagp command B-19 debug platform acl command B-20 debug platform cli-redirection main command B-21 debug platform configuration command B-22 debug platform cpu-queues command B-23 debug platform device-manager command B-25 debug platform dot1x command B-26 debug platform etherchannel command B-27 debug platform fallback-bridging command B-28 debug platform forw-tcam command B-29 debug platform ipc command B-36 debug platform ip igmp snooping command B-30 debug platform ip multicast command B-32 debug platform ip unicast command B-34 debug platform led command B-37 debug platform matm command B-38 debug platform messaging application command B-39 debug platform phy command B-40 debug platform pm command B-42 debug platform port-asic command B-44Index IN-4 Catalyst 3750 Switch Command Reference 78-15165-02 debug platform port-security command B-45 debug platform qos-acl-tcam command B-46 debug platform remote-commands command B-47 debug platform resource-manager command B-48 debug platform snmp command B-49 debug platform span command B-50 debug platform stack-manager command B-51 debug platform supervisor-asic command B-52 debug platform sw-bridge command B-53 debug platform tcam command B-54 debug platform udld command B-57 debug platform vlan command B-58 debug pm command B-59 debug port-security command B-61 debug qos-manager command B-62 debug spanning-tree backbonefast command B-65 debug spanning-tree bpdu command B-66 debug spanning-tree bpdu-opt command B-67 debug spanning-tree command B-63 debug spanning-tree mstp command B-68 debug spanning-tree switch command B-70 debug spanning-tree uplinkfast command B-72 debug sw-vlan command B-73 debug sw-vlan ifs command B-75 debug sw-vlan notification command B-76 debug sw-vlan vtp command B-78 debug udld command B-80 debug vqpc command B-82 define interface-range command 2-58 delete (boot loader) command A-6 delete command 2-60 deny command 2-62 detect mechanism, causes 2-82 dir (boot loader) command A-7 directories, deleting 2-60 documentation feedback xviii obtaining CD-ROM xvii world wide web xvii ordering xviii related xvii document conventions xvi domain name, VTP 2-484, 2-488 dot1x default command 2-65 dot1x guest-vlan command 2-66 dot1x host-mode command 2-67 dot1x initialize command 2-69 dot1x max-req command 2-70 dot1x multiple-hosts command 2-71 dot1x port-control command 2-72 dot1x re-authenticate command 2-74 dot1x re-authentication command 2-75 dot1x reauthentication command 2-76 dot1x system-auth-control command 2-77 dot1x timeout command 2-78 dropping packets, with ACL matches 2-3 DSCP-to-CoS map 2-135 DSCP-to-DSCP-mutation map 2-135 DTP 2-427 DTP flap error detection for 2-82 error recovery timer 2-84 duplex command 2-80 dynamic-access ports configuring 2-422 restrictions 2-423 dynamic auto VLAN membership mode 2-426 dynamic desirable VLAN membership mode 2-426 Dynamic Trunking Protocol See DTPIndex IN-5 Catalyst 3750 Switch Command Reference 78-15165-02 E EAP-request/identity frame maximum number to send 2-70 response time before retransmitting 2-78 encapsulation methods 2-440 environment variables, displaying 2-215 errdisable detect cause command 2-82 errdisable recovery command 2-84 error conditions, displaying 2-241 error disable detection 2-82 error-disabled interfaces, displaying 2-248 EtherChannel assigning Ethernet interface to channel group 2-28 creating port-channel logical interface 2-88 debug EtherChannel/PAgP, display B-8 debug platform-specific events, display B-27 displaying 2-245 interface information, displaying 2-248 LACP clearing channel-group information 2-37 debug messages, display B-13 displaying 2-263 modes 2-28 port priority for hot-standby ports 2-107 restricting a protocol 2-32 system priority 2-109 load-distribution methods 2-184 PAgP aggregate-port learner 2-171 clearing channel-group information 2-39 debug messages, display B-19 displaying 2-310 error detection for 2-82 error recovery timer 2-84 learn method 2-171 modes 2-28 physical-port learner 2-171 priority of interface for transmitted traffic 2-173 Ethernet controller, internal register display 2-226 Ethernet statistics, collecting 2-193 examples, conventions for xvi exit command 2-475 extended discovery of candidate switches 2-47 extended-range VLANs and allowed VLAN list 2-440 and pruning-eligible list 2-440 configuring 2-460 extended system ID for STP 2-371 F fan information, displaying 2-237 feedback to Cisco Systems, web xviii file name, VTP 2-484 files, deleting 2-60 flash_init (boot loader) command A-9 flowcontrol command 2-86 format (boot loader) command A-10 forwarding packets, with ACL matches 2-3 forwarding results, display C-5 frame forwarding information, displaying C-5 fsck (boot loader) command A-11 G global configuration mode 1-2, 1-4 H hardware ACL statistics 2-209 help (boot loader) command A-12 hop-count limit for clusters 2-47 host connection, port configuration 2-425 HSRP binding HSRP group to cluster 2-55 standby group 2-55Index IN-6 Catalyst 3750 Switch Command Reference 78-15165-02 I IGMP filters applying 2-100 debug messages, display B-10 IGMP groups, setting maximum 2-101 IGMP maximum groups, debugging B-11 IGMP profiles creating 2-102 displaying 2-257 IGMP snooping displaying 2-258, 2-260 enabling 2-104 images See software images Immediate-Leave feature, MVR 2-168 Immediate-Leave processing 2-104 interface command 2-93 interface configuration mode 1-2, 1-4 interface port-channel command 2-88 interface range command 2-90 interface-range macros 2-58 interfaces assigning Ethernet interface to channel group 2-28 configuring 2-80 configuring multiple 2-90 creating port-channel logical 2-88 debug messages, display B-9 disabling 2-353 displaying the MAC address table 2-279 restarting 2-353 interface speed, configuring 2-407 internal registers, displaying 2-226, 2-230 invalid GBIC error detection for 2-82 error recovery timer 2-84 ip address command 2-98 IP addresses, setting 2-98 IP address matching 2-121 ip igmp filter command 2-100 ip igmp max-groups command 2-101 ip igmp profile command 2-102 ip igmp snooping command 2-104 IP multicast addresses 2-165 IP phones auto-QoS configuration 2-15 trusting packets sent from 2-158 IP-precedence-to-DSCP map 2-135 J jumbo frames. See MTU L LACP See EtherChannel lacp port-priority command 2-107 lacp system-priority command 2-109 Layer 2 mode, enabling 2-420 Layer 2 traceroute IP addresses 2-450 MAC addresses 2-447 Layer 3 mode, enabling 2-420 line configuration mode 1-3, 1-6 Link Aggregation Control Protocol See EtherChannel link flap error detection for 2-82 error recovery timer 2-84 load_helper (boot loader) command A-13 load-distribution methods for EtherChannel 2-184 logging file command 2-111 logical interface 2-88 loopback error detection for 2-82 recovery timer 2-84Index IN-7 Catalyst 3750 Switch Command Reference 78-15165-02 loop guard, for spanning tree 2-373, 2-377 M mac access-group command 2-113 MAC access-groups, displaying 2-267 MAC access list configuration mode 2-115 mac access-list extended command 2-115 MAC access lists 2-62 MAC addresses displaying aging time 2-273 all 2-271 dynamic 2-277 Layer 2 multicast entries 2-281 notification settings 2-283 number of addresses in a VLAN 2-275 per interface 2-279 per VLAN 2-287 static 2-285 static and dynamic entries 2-269 dynamic aging time 2-117 deleting 2-38 displaying 2-277 enabling MAC address notification 2-118 matching 2-121 static adding and removing 2-120 displaying 2-285 tables 2-271 MAC address notification, debugging B-14 mac address-table aging-time 2-113, 2-121 mac-address-table aging-time command 2-117 mac-address-table notification command 2-118 mac-address-table static command 2-120 macros, interface range 2-58, 2-90 manual audience xv purpose of xv maps QoS defining 2-135 displaying 2-296 VLAN creating 2-472 defining 2-121 displaying 2-344 match (access-map configuration) command 2-121 match (class-map configuration) command 2-123 maximum transmission unit See MTU mdix auto command 2-125 member switches See clusters memory (boot loader) command A-14 mkdir (boot loader) command A-16 mls qos aggregate-policer command 2-129 mls qos command 2-127 mls qos cos command 2-131 mls qos dscp-mutation command 2-133 mls qos map command 2-135 mls qos queue-set output buffers command 2-138 mls qos queue-set output threshold command 2-140 mls qos srr-queue input bandwidth command 2-142 mls qos srr-queue input buffers command 2-144 mls qos-srr-queue input cos-map command 2-146 mls qos srr-queue input dscp-map command 2-148 mls qos srr-queue input priority-queue command 2-150 mls qos srr-queue input threshold command 2-152 mls qos-srr-queue output cos-map command 2-154 mls qos srr-queue output dscp-map command 2-156 mls qos trust command 2-158 mode, MVR 2-165 Mode button, and password recovery 2-197 modes, commands 1-2Index IN-8 Catalyst 3750 Switch Command Reference 78-15165-02 monitor session command 2-160 more (boot loader) command A-17 MSTP displaying 2-324 interoperability 2-42 link type 2-375 MST region aborting changes 2-381 applying changes 2-381 configuration name 2-381 configuration revision number 2-381 current or pending display 2-381 displaying 2-324 MST configuration mode 2-381 VLANs-to-instance mapping 2-381 path cost 2-383 protocol mode 2-379 restart protocol migration process 2-42 root port loop guard 2-373 preventing from becoming designated 2-373 restricting which can be root 2-373 root guard 2-373 root switch affects of extended system ID 2-371 hello-time 2-386, 2-394 interval between BDPU messages 2-387 interval between hello BPDU messages 2-386, 2-394 max-age 2-387 maximum hop count before discarding BPDU 2-389 port priority for selection of 2-391 primary or secondary 2-394 switch priority 2-393 MSTP (continued) state changes blocking to forwarding state 2-400 enabling BPDU filtering 2-365, 2-398 enabling BPDU guard 2-367, 2-398 enabling Port Fast 2-398, 2-400 forward-delay time 2-385 length of listening and learning states 2-385 rapid transition to forwarding 2-375 shutting down Port Fast-enabled ports 2-398 state information display 2-323 MTU configuring size 2-445 displaying global setting 2-334 multicast group address, MVR 2-168 multicast groups, MVR 2-166 multicast router learning method 2-104 multicast router ports, configuring 2-104 multicast storm control 2-415 multicast traffic counters 2-254 multicast VLAN, MVR 2-165 multicast VLAN registration See MVR multiple hosts on authorized port 2-67 Multiple Spanning Tree Protocol See MSTP MVR and address aliasing 2-166 configuring 2-165 configuring interfaces 2-168 debug messages, display B-17 displaying 2-304 displaying interface information 2-306 members, displaying 2-308 mvr (global configuration) command 2-165 mvr (interface configuration) command 2-168 mvr vlan group command 2-169Index IN-9 Catalyst 3750 Switch Command Reference 78-15165-02 N native VLANs 2-440 nonegotiate DTP messaging 2-428 speed 2-407 non-IP protocols denying 2-62 forwarding 2-175 non-IP traffic access lists 2-115 non-IP traffic forwarding denying 2-62 permitting 2-175 normal-range VLANs 2-460, 2-466 note, description xvi no vlan command 2-460, 2-470 P PAgP See EtherChannel pagp learn-method command 2-171 pagp port-priority command 2-173 password, VTP 2-484, 2-488 password-recovery mechanism, enabling and disabling 2-197 permit command 2-175 per-VLAN spanning-tree plus See STP physical-port learner 2-171 PIM-DVMRP, as multicast router learning method 2-104 police aggregate command 2-180 police command 2-178 policed-DSCP map 2-135 policy-map command 2-182 policy maps applying to an interface 2-199, 2-204 creating 2-182 displaying 2-312 policers displaying 2-290 for a single class 2-178 for multiple classes 2-129, 2-180 policed-DSCP map 2-135 traffic classification defining the class 2-33 defining trust states 2-453 setting DSCP or IP precedence values 2-202 Port Aggregation Protocol See EtherChannel port-based authentication AAA method list 2-1 debug messages, display B-6 enabling 802.1X globally 2-77 per interface 2-72 guest VLAN 2-66 host modes 2-67 initialize an interface 2-69 manual control of authorization state 2-72 multiple hosts on authorized port 2-67 periodic re-authentication enabling 2-76 time between attempts 2-78 quiet period between failed authentication exchanges 2-78 re-authenticating 802.1X-enabled ports 2-74 resetting configurable 802.1X parameters 2-65 statistics and status display 2-232 switch-to-authentication server retransmission time 2-78 switch-to-client frame-retransmission number 2-70 switch-to-client retransmission time 2-78Index IN-10 Catalyst 3750 Switch Command Reference 78-15165-02 port-channel load-balance command 2-184 Port Fast, for spanning tree 2-400 port ranges, defining 2-58 ports, debugging B-59 ports, protected 2-438 port security aging 2-434 debug messages, display B-61 enabling 2-430 violation error recovery 2-84 port trust states for QoS 2-158 port types, MVR 2-168 power information, displaying 2-237 priority value, stack member 2-331, 2-417 privileged EXEC mode 1-2, 1-3 protected ports, displaying 2-252 pruning VLANs 2-440 VTP displaying interface information 2-248 enabling 2-484, 2-488 pruning-eligible VLAN list 2-442 publications for products, technologies, and network solutions xix PVST+ See STP Q QoS auto-QoS configuring 2-15 debug messages, display B-2 displaying 2-212 class maps creating 2-35 defining the match criteria 2-123 displaying 2-217 defining the CoS value for an incoming packet 2-131 QoS (continued) displaying configuration information 2-212, 2-289 DSCP trusted ports applying DSCP-to-DSCP-mutation map to 2-133 defining DSCP-to-DSCP-mutation map 2-135 egress queues allocating buffers 2-138 defining the CoS output queue threshold map 2-154 defining the DSCP output queue threshold map 2-156 displaying buffer allocations 2-293 displaying CoS output queue threshold map 2-296 displaying DSCP output queue threshold map 2-296 displaying queueing strategy 2-293 displaying queue-set settings 2-299 enabling bandwidth shaping and scheduling 2-411 enabling bandwidth sharing and scheduling 2-413 limiting the maximum output on a port 2-409 mapping a port to a queue-set 2-186 mapping CoS values to a queue and threshold 2-154 mapping DSCP values to a queue and threshold 2-156 setting maximum and reserved memory allocations 2-140 setting WTD thresholds 2-140 enabling 2-127 ingress queues allocating buffers 2-144 assigning SRR scheduling weights 2-142 defining the CoS input queue threshold map 2-146 defining the DSCP input queue threshold map 2-148 displaying buffer allocations 2-293 displaying CoS input queue threshold map 2-296 displaying DSCP input queue threshold map 2-296 displaying queueing strategy 2-293 displaying settings for 2-291 enabling the priority queue 2-150 mapping CoS values to a queue and threshold 2-146 mapping DSCP values to a queue and threshold 2-148 setting WTD thresholds 2-152Index IN-11 Catalyst 3750 Switch Command Reference 78-15165-02 QoS (continued) maps defining 2-135, 2-146, 2-148, 2-154, 2-156 displaying 2-296 policy maps applying an aggregate policer 2-180 applying to an interface 2-199, 2-204 creating 2-182 defining policers 2-129, 2-178 displaying policers 2-290 displaying policy maps 2-312 policed-DSCP map 2-135 setting DSCP or IP precedence values 2-202 traffic classifications 2-33 trust states 2-453 port trust states 2-158 statistics in-profile and out-of-profile packets 2-293 packets enqueued or dropped 2-293 sent and received CoS values 2-293 sent and received DSCP values 2-293 trusted boundary for IP phones 2-158 quality of service See QoS querytime, MVR 2-165 queue-set command 2-186 R rapid per-VLAN spanning-tree plus See STP rapid PVST+ See STP rcommand command 2-187 re-authenticating 802.1X-enabled ports 2-74 re-authentication periodic 2-76 time between attempts 2-78 receiver ports, MVR 2-168 receiving flow-control packets 2-86 recovery mechanism causes 2-84 display 2-239, 2-243 timer interval 2-84 redundancy for cluster switches 2-55 reload command 2-189 remote command command 2-190 remote-span command 2-191 Remote Switched Port Analyzer See RSPAN rename (boot loader) command A-18 reset (boot loader) command A-19 reset command 2-475 resource templates, displaying 2-319 rmdir (boot loader) command A-20 rmon collection stats command 2-193 root guard, for spanning tree 2-373 routed ports IP addresses on 2-99 number supported 2-99 RSPAN configuring 2-160 displaying 2-301 filter RSPAN traffic 2-160 remote-span command 2-191 sessions add interfaces to 2-160 displaying 2-301 start new 2-160 S SDM mismatch mode 2-195, 2-332 sdm prefer command 2-194 secure ports, limitations 2-431 sending flow-control packets 2-86 service password-recovery command 2-197 service-policy command 2-199Index IN-12 Catalyst 3750 Switch Command Reference 78-15165-02 session command 2-201 set (boot loader) command A-21 set command 2-202 setup command 2-204 setup express command 2-207 show access-lists command 2-209 show auto qos command 2-212 show boot command 2-215 show changes command 2-475 show class-map command 2-217 show cluster candidates command 2-220 show cluster command 2-218 show cluster members command 2-222 show controllers cpu-interface command 2-224 show controllers ethernet-controller command 2-226 show controllers tcam command 2-230 show current command 2-475 show dot1x command 2-232 show dtp 2-235 show env command 2-237 show errdisable detect command 2-239 show errdisable flap-values command 2-241 show errdisable recovery command 2-243 show etherchannel command 2-245 show interfaces command 2-248 show interfaces counters command 2-254 show ip igmp profile command 2-257 show ip igmp snooping command 2-258 show ip igmp snooping mrouter command 2-260 show ip igmp snooping multicast command 2-261 show lacp command 2-263 show mac access-group command 2-267 show mac-address-table address command 2-271 show mac-address-table aging time command 2-273 show mac-address-table command 2-269 show mac-address-table count command 2-275 show mac-address-table dynamic command 2-277 show mac-address-table interface command 2-279 show mac address-table multicast command 2-281 show mac-address-table notification command 2-283 show mac-address-table static command 2-285 show mac-address-table vlan command 2-287 show mls qos aggregate-policer command 2-290 show mls qos command 2-289 show mls qos input-queue command 2-291 show mls qos interface command 2-293 show mls qos maps command 2-296 show mls qos queue-set command 2-299 show monitor command 2-301 show mvr command 2-304 show mvr interface command 2-306 show mvr members command 2-308 show pagp command 2-310 show platform acl command C-2 show platform configuration command C-3 show platform etherchannel command C-4 show platform forward command C-5 show platform igmp snooping command C-7 show platform ipc trace command C-12 show platform ip multicast command C-9 show platform ip unicast command C-10 show platform layer4op command C-13 show platform mac-address-table command C-14 show platform messaging command C-15 show platform monitor command C-16 show platform mvr table command C-17 show platform pm command C-18 show platform port-asic command C-19 show platform port-security command C-24 show platform qos command C-25 show platform resource-manager command C-26 show platform snmp counters command C-28 show platform spanning-tree command C-29 show platform stack-manager command C-31 show platform stp-instance command C-30 show platform tb command C-33 show platform tcam command C-35 show platform vlan command C-38Index IN-13 Catalyst 3750 Switch Command Reference 78-15165-02 show policy-map command 2-312 show port security command 2-314 show proposed command 2-475 show running-config vlan command 2-317 show sdm prefer command 2-319 show setup express command 2-322 show spanning-tree command 2-323 show storm-control command 2-329 show switch command 2-331 show system mtu command 2-334 show trust command 2-453 show udld command 2-335 show version command 2-338 show vlan access-map command 2-344 show vlan command 2-340 show vlan command, fields 2-341 show vlan filter command 2-345 show vmps command 2-346 show vtp command 2-349 shutdown command 2-353 shutdown vlan command 2-354 SNMP host, specifying 2-358 SNMP informs, enabling the sending of 2-355 snmp-server enable traps command 2-355 snmp-server host command 2-358 snmp trap mac-notification command 2-362 SNMP traps enabling MAC address notification trap 2-362 enabling the MAC address notification feature 2-118 enabling the sending of 2-355 software images copying 2-5 deleting 2-60 downloading 2-7 upgrading 2-5, 2-7 uploading 2-13 software version, displaying 2-338 source ports, MVR 2-168 SPAN configuring 2-160 debug messages, display B-16 displaying 2-301 filter SPAN traffic 2-160 sessions add interfaces to 2-160 displaying 2-301 start new 2-160 spanning-tree backbonefast command 2-364 spanning-tree bpdufilter command 2-365 spanning-tree bpduguard command 2-367 spanning-tree cost command 2-369 spanning-tree extend system-id command 2-371 spanning-tree guard command 2-373 spanning-tree link-type command 2-375 spanning-tree loopguard default command 2-377 spanning-tree mode command 2-379 spanning-tree mst configuration command 2-381 spanning-tree mst cost command 2-383 spanning-tree mst forward-time command 2-385 spanning-tree mst hello-time command 2-386 spanning-tree mst max-age command 2-387 spanning-tree mst max-hops command 2-389 spanning-tree mst port-priority command 2-391 spanning-tree mst priority command 2-393 spanning-tree mst root command 2-394 spanning-tree portfast (global configuration) command 2-398 spanning-tree portfast (interface configuration) command 2-400 spanning-tree port-priority command 2-396 Spanning Tree Protocol See STP spanning-tree uplinkfast command 2-402 spanning-tree vlan command 2-404 speed command 2-407 srr-queue bandwidth limit command 2-409 srr-queue bandwidth shape command 2-411Index IN-14 Catalyst 3750 Switch Command Reference 78-15165-02 srr-queue bandwidth share command 2-413 stack member access 2-201 number 2-331, 2-418 priority value 2-417 reloading 2-189 stacks, switch reloading 2-189 stack member access 2-201 stack member number 2-331, 2-418 stack member priority value 2-331, 2-417 static-access ports, configuring 2-422 statistics, Ethernet group 2-193 sticky learning, enabling 2-430 storm-control command 2-415 STP BackboneFast 2-364 counters, clearing 2-41 debug messages, display BackboneFast events B-65 MSTP B-68 optimized BPDUs handling B-67 spanning-tree activity B-63 switch shim B-70 transmitted and received BPDUs B-66 UplinkFast B-72 detection of indirect link failures 2-364 extended system ID 2-371 path cost 2-369 protocol modes 2-379 root port accelerating choice of new 2-402 loop guard 2-373 preventing from becoming designated 2-373 restricting which can be root 2-373 root guard 2-373 UplinkFast 2-402 STP (continued) root switch affects of extended system ID 2-371, 2-405 hello-time 2-404 interval between BDPU messages 2-404 interval between hello BPDU messages 2-404 max-age 2-404 port priority for selection of 2-396 primary or secondary 2-404 switch priority 2-404 state changes blocking to forwarding state 2-400 enabling BPDU filtering 2-365, 2-398 enabling BPDU guard 2-367, 2-398 enabling Port Fast 2-398, 2-400 enabling timer to recover from error state 2-84 forward-delay time 2-404 length of listening and learning states 2-404 shutting down Port Fast-enabled ports 2-398 state information display 2-323 VLAN options 2-393, 2-404 SVIs creating 2-93 Switched Port Analyzer See SPAN switching characteristics modifying 2-420, 2-428 returning to interfaces 2-420, 2-428 switchport access command 2-422 switchport block command 2-424 switchport command 2-420 switchport host command 2-425 switchport mode command 2-426 switchport nonegotiate command 2-428 switchport port-security aging command 2-434 switchport port-security command 2-430 switchport priority extend command 2-436 switchport protected command 2-438 switchports, displaying 2-248Index IN-15 Catalyst 3750 Switch Command Reference 78-15165-02 switchport trunk command 2-440 switchport voice vlan command 2-443 switch priority command 2-417 switch renumber command 2-418 system message logging, save message to Flash 2-111 system mtu command 2-445 system resource templates 2-194 T TAC toll-free telephone numbers xix website xviii tar files, creating, listing, and extracting 2-10 technical assistance case priority definitions xix opening a case xix TAC website xviii toll-free telephone numbers xix Telnetting to cluster switches 2-187 temperature information, displaying 2-237 templates, system resources 2-194 traceroute mac command 2-447 traceroute mac ip command 2-450 trunking, VLAN mode 2-426 trunk mode 2-426 trunk ports 2-426 trunks, to non-DTP device 2-427 trusted boundary for QoS 2-158 trusted port states for QoS 2-158 type (boot loader) command A-24 U UDLD aggressive mode 2-455, 2-457 debug messages, display B-80 enable globally 2-455 UDLD (continued) enable per interface 2-457 error recovery timer 2-84 message timer 2-455 normal mode 2-455, 2-457 reset a shutdown interface 2-459 status 2-335 udld (global configuration) command 2-455 udld (interface configuration) command 2-457 udld reset command 2-459 unicast storm control 2-415 unicast traffic counters 2-254 UniDirectional Link Detection See UDLD unknown multicast traffic, preventing 2-424 unknown unicast traffic, preventing 2-424 unset (boot loader) command A-25 upgrading, software images 2-5, 2-7 UplinkFast, for STP 2-402 user EXEC mode 1-2, 1-3 V version (boot loader) command A-27 version mismatch mode 2-332 vlan (global configuration) command 2-460 vlan (VLAN configuration) command 2-466 vlan access-map command 2-472 VLAN access map configuration mode 2-472 VLAN access maps actions 2-3 displaying 2-344 VLAN configuration rules 2-464, 2-468 saving 2-460, 2-470Index IN-16 Catalyst 3750 Switch Command Reference 78-15165-02 VLAN configuration mode commands VLAN 2-466 VTP 2-488 description 1-5 entering 2-474 summary 1-3 vlan database command 2-474 vlan filter command 2-477 VLAN filters, displaying 2-345 VLAN ID range 2-460, 2-466 VLAN maps applying 2-477 creating 2-472 defining 2-121 displaying 2-344 VLAN Query Protocol See VQP VLANs adding 2-460 configuring 2-460, 2-466 debug messages, display ISL B-76 VLAN IOS file system error tests B-75 VLAN manager activity B-73 VTP B-78 displaying configurations 2-317, 2-340 extended-range 2-460 MAC addresses displaying 2-287 number of 2-275 media types 2-463, 2-468 normal-range 2-460, 2-466 restarting 2-354 saving the configuration 2-460 shutting down 2-354 SNMP traps for VTP 2-356, 2-359 suspending 2-354 variables 2-466 VLAN Trunking Protocol See VTP VM mode 2-332 VMPS configuring servers 2-482 displaying 2-346 error recovery timer 2-84 reconfirming dynamic VLAN assignments 2-479 vmps reconfirm (global configuration) command 2-480 vmps reconfirm (privileged EXEC) command 2-479 vmps retry command 2-481 vmps server command 2-482 voice VLAN configuring 2-443 setting port priority 2-436 VQP and dynamic-access ports 2-423 clearing client statistics 2-43 displaying information 2-346 per-server retry count 2-481 reconfirmation interval 2-480 reconfirming dynamic VLAN assignments 2-479 VTP changing characteristics 2-484 clearing pruning counters 2-44 configuring domain name 2-484, 2-488 file name 2-484 mode 2-484, 2-488 password 2-484, 2-488 counters display fields 2-350 displaying information 2-349 enabling pruning 2-484, 2-488 version 2 2-484, 2-488 mode 2-484, 2-488 pruning 2-484, 2-488 saving the configuration 2-460, 2-470 statistics 2-349Index IN-17 Catalyst 3750 Switch Command Reference 78-15165-02 VTP (continued) status 2-349 status display fields 2-351 vtp (global configuration) command 2-484 vtp (VLAN configuration) command 2-488Index IN-18 Catalyst 3750 Switch Command Reference 78-15165-02 You'll be entered into a quarterly drawing for free Cisco Press books by returning this survey! Cisco is dedicated to customer satisfaction and would like to hear your thoughts on these printed manuals. Please visit the Cisco Product Comments on-line survey at www.cisco.com/go/crc to submit your comments about accessing Cisco technical manuals. Thank you for your time. General Information 1 Years of networking experience: Years of experience with Cisco products: 2 I have these network types: LAN Backbone WAN Other: 3 I have these Cisco products: Switches Routers Other (specify models): 4 I perform these types of tasks: H/W installation and/or maintenance S/W configuration Network management Other: 5 I use these types of documentation: H/W installation H/W configuration S/W configuration Command reference Quick reference Release notes Online help Other: 6 I access this information through: % Cisco.com % CD-ROM % Printed manuals % Other: 7 I prefer this access method: Cisco.com CD-ROM Printed manuals Other: 8 I use the following three product features the most: Document Information Document Title: Catalyst 3750 Switch Hardware Installation Guide Part Number: 78-15136-02 S/W Release (if applicable): On a scale of 1–5 (5 being the best), please let us know how we rate in the following areas: The document is complete. The information is accurate. The information is well organized. The information I wanted was easy to find. The document is written at my technical level of understanding. The information I found was useful to my job. Please comment on our lowest scores: Mailing Information Organization Date Contact Name Mailing Address City State/Province Zip/Postal Code Country Phone ( ) Extension E-mail Fax ( ) May we contact you further concerning our documentation? Yes No You can also send us your comments by e-mail to bug-doc@cisco.com, or by fax to 408-527-8089. When mailing this card from outside of the United States, please enclose in an envelope addressed to the location on the back of this card with the required postage or fax to 1-408-527-8089.F I R S T - C L A S S M A I L P E R M I T N O . 4 6 3 1 S A N J O S E C A BUSINESS REPLY MAIL POSTAGE WILL BE PAID BY ADDRESSEE NECESSARY NO POSTAGE IF MAILED IN THE UNITED STATES SAN JOSE CA 95134-9916 170 WEST TASMAN DR CISCO SYSTEMS INC DOCUMENT RESOURCE CONNECTIONCorporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Catalyst 3750 Switch Hardware Installation Guide August 2003 Customer Order Number: DOC-7815136= Text Part Number: 78-15136-02THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Cisco’s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. Modifying the equipment without Cisco’s written authorization may result in the equipment no longer complying with FCC requirements for Class A or Class B digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense. You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the Cisco equipment or one of its peripheral devices. If the equipment causes interference to radio or television reception, try to correct the interference by using one or more of the following measures: • Turn the television or radio antenna until the interference stops. • Move the equipment to one side or the other of the television or radio. • Move the equipment farther away from the television or radio. • Plug the equipment into an outlet that is on a different circuit from the television or radio. (That is, make certain the equipment and the television or radio are on circuits controlled by different circuit breakers or fuses.) Modifications to this product not authorized by Cisco Systems, Inc. could void the FCC approval and negate your authority to operate the product. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.Catalyst 3750 Switch Hardware Installation Guide Copyright © 2003, Cisco Systems, Inc. All rights reserved. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)v Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 C O N T E N T S Cisco Limited Lifetime Hardware Warranty Terms xi Preface xv Audience xv Purpose xv Conventions xvi Related Publications xxiii Obtaining Documentation xxiii Cisco.com xxiv Documentation CD-ROM xxiv Ordering Documentation xxiv Documentation Feedback xxv Obtaining Technical Assistance xxv Cisco.com xxvi Technical Assistance Center xxvi Cisco TAC Website xxvii Cisco TAC Escalation Center xxvii Obtaining Additional Publications and Information xxviii C H A P T E R 1 Using Express Setup 1-1 Taking Out What You Need 1-2 Powering On the Switch 1-3 Starting Express Setup 1-4 Configuring the Switch Settings 1-9 Verifying Switch IP Address (Optional) 1-10Contents vi Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Rerunning Express Setup 1-11 Where to Go Next 1-12 Other Switch Home Page Features 1-12 Installing or Connecting Devices to the Switch 1-12 C H A P T E R 2 Product Overview 2-1 Features 2-1 Front Panel Description 2-3 10/100 and 10/100/1000 Ports 2-6 SFP Module Slots 2-7 SFP Modules 2-7 LEDs 2-8 System LED 2-9 RPS LED 2-9 Master LED 2-10 Port LEDs and Modes 2-10 Rear Panel Description 2-14 StackWise Ports 2-15 Power Connectors 2-16 Internal Power Supply Connector 2-16 Cisco RPS Connector 2-16 Console Port 2-17 Management Options 2-18 Network Configurations 2-19 C H A P T E R 3 Switch Installation 3-1 Preparing for Installation 3-1 Warnings 3-2 EMC Regulatory Statements 3-4vii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Contents U.S.A. 3-4 Taiwan 3-4 Japan 3-4 Korea 3-5 Hungary 3-5 Installation Guidelines 3-6 Verifying Package Contents 3-7 Verifying Switch Operation 3-8 Connecting a PC or Terminal to the Console Port 3-8 Powering On the Switch and Running POST 3-10 Powering Off the Switch and Disconnecting the Console Port 3-11 Planning the Stack 3-12 Planning Considerations 3-12 Powering Considerations 3-13 Cabling Considerations 3-14 Recommended Cabling Configurations 3-15 Installing the Switch 3-17 Rack Mounting 3-18 Removing Screws from the Switch 3-19 Attaching Brackets to the Catalyst 3750G-24TS Switch 3-20 Attaching Brackets to the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS Switches 3-25 Mounting the Switch in a Rack 3-28 Attaching the Cable Guide 3-30 Wall Mounting 3-32 Attaching the Brackets to the Switch for Wall-Mounting 3-32 Attaching the RPS Connector Cover 3-33 Mounting the Switch on a Wall 3-34 Table or Shelf Mounting 3-36 Connecting StackWise Cable to StackWise Ports 3-37Contents viii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Installing and Removing SFP Modules 3-40 Installing SFP Modules into SFP Module Slots 3-41 Removing SFP Modules from SFP Module Slots 3-43 Connecting to the 10/100 and 10/100/1000 Ports 3-44 Connecting to an SFP Module 3-46 Connecting to a Fiber-Optic SFP Module 3-47 Connecting to 1000BASE-T SFP Modules 3-48 Where to Go Next 3-50 C H A P T E R 4 Troubleshooting 4-1 Understanding POST Results 4-1 Clearing the Switch IP Address and Configuration 4-2 Diagnosing Problems 4-3 Replacing a Failed Stack Member 4-7 A P P E N D I X A Technical Specifications A-1 A P P E N D I X B Connector and Cable Specifications B-1 Connector Specifications B-1 10/100/1000 Ports B-1 Connecting to 10BASE-T- and 100BASE-TX-Compatible Devices B-2 Connecting to 1000BASE-T Devices B-2 10/100 Ports B-3 SFP Module Ports B-5 Console Port B-6 Cable and Adapter Specifications B-6 Two Twisted-Pair Cable Pinouts B-6 Four Twisted-Pair Cable Pinouts for 10/100 Ports B-7 Four Twisted-Pair Cable Pinouts for 1000BASE-T Ports B-8ix Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Contents Crossover Cable and Adapter Pinouts B-9 Identifying a Crossover Cable B-9 Adapter Pinouts B-10 A P P E N D I X C Managing the Switch by Using the Cluster Management Suite C-1 Connecting to an Ethernet Port C-2 Launching the Switch Home Page C-3 CMS Requirements C-5 Recommended Configuration for Web-Based Management C-6 Operating System and Browser Support C-6 Supported Java Plug-Ins C-7 Java Plug-In Notes C-8 Where to Go Next C-8 A P P E N D I X D Quick Setup By Using the CLI-Based Setup Program D-1 Methods for Accessing the CLI D-2 Accessing the CLI Through Express Setup (Unconfigured Switch Only) D-2 Accessing the CLI Through the Console Port D-3 Taking Out What You Need D-4 Stacking the Switches (Optional) D-5 Connecting to the Console Port D-7 Starting the Terminal Emulation Software D-9 Connecting to a Power Source D-9 Entering the Initial Configuration Information D-10 IP Settings D-10 Completing the Setup Program D-11Contents x Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X E Translated Safety Warnings E-1 Attaching the Cisco RPS (model PWR300-AC-RPS-N1) E-1 Attaching the Cisco RPS (model PWR675-AC-RPS-N1) E-2 Installation Warning E-4 Installation Instructions E-5 Jewelry Removal Warning E-6 Stacking the Chassis Warning E-8 Main Disconnecting Device E-10 Grounded Equipment Warning E-11 Installing or Replacing the Unit E-12 Overtemperature Warning E-14 Working During Lightning Activity E-16 Product Disposal Warning E-17 Chassis Warning for Rack-Mounting and Servicing E-19 Redundant Power Supply Connection Warning E-24 Switch Installation Warning E-25 Restricted Area E-27 Ethernet Cable Shielding in Offices E-28 Laser Beam Exposure E-30 Laser Radiation E-31 E-32 IN D E Xxi Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Cisco Limited Lifetime Hardware Warranty Terms There are special terms applicable to your hardware warranty and various services that you can use during the warranty period. Follow these steps to access and download the Cisco Information Packet and your warranty document from Cisco.com. 1. Launch your browser, and go to this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/cetrans.htm The Warranties and License Agreements page appears. 2. To r ead the Cisco Information Packet, follow these steps: a. Click the Information Packet Number field, and make sure that the part number 78-5235-02F0 is highlighted. b. Select the language in which you would like to read the document. c. Click Go. The Cisco Limited Warranty and Software License page from the Information Packet appears. d. Read the document online, or click the PDF icon to download and print the document in Adobe Portable Document Format (PDF). Note You must have Adobe Acrobat Reader to view and print PDF files. You can download the reader from Adobe’s website: http://www.adobe.comCisco Limited Lifetime Hardware Warranty Terms xii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 3. To read translated and localized warranty information about your product, follow these steps: a. Enter this part number in the Warranty Document Number field: 78-6310-02C0 b. Select the language in which you would like to view the document. c. Click Go. The Cisco warranty page appears. d. Read the document online, or click the PDF icon to download and print the document in Adobe Portable Document Format (PDF). You can also contact the Cisco service and support website for assistance: http://www.cisco.com/public/Support_root.shtml. Duration of Hardware Warranty A Cisco product hardware warranty is supported for as long as the original end user continues to own or use the product, provided that the fan and power supply warranty is limited to five (5) years. In the event of a discontinuance of product manufacture, the Cisco warranty support is limited to five (5) years from the announcement of the discontinuance. Replacement, Repair, or Refund Policy for Hardware Cisco or its service center will use commercially reasonable efforts to ship a replacement part within ten (10) working days after receipt of the Return Materials Authorization (RMA) request. Actual delivery times can vary, depending on the customer location. Cisco reserves the right to refund the purchase price as its exclusive warranty remedy.xiii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Cisco Limited Lifetime Hardware Warranty Terms To Receive a Return Materials Authorization (RMA) Number Contact the company from whom you purchased the product. If you purchased the product directly from Cisco, contact your Cisco Sales and Service Representative. Complete the information below, and keep it for reference. Company product purchased from Company telephone number Product model number Product serial number Maintenance contract numberCisco Limited Lifetime Hardware Warranty Terms xiv Catalyst 3750 Switch Hardware Installation Guide 78-15136-02xv Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Audience This guide is for the networking or computer technician responsible for installing the Catalyst 3750 switches. We assume that you are familiar with the concepts and terminology of Ethernet and local area networking. Purpose This guide documents the hardware features of the Catalyst 3750 family of switches. It describes the physical and performance characteristics of each switch, explains how to install a switch, and provides troubleshooting information. This guide does not describe system messages that you might receive or how to configure your switch. For more information, refer to the switch software configuration guide, the switch command reference, and the switch system message guide on the Cisco.com Product Documentation home page. For information about the standard Cisco IOS Release 12.1 commands, refer to the IOS documentation set from the Cisco.com home page at Service and Support > Technical Documents. On the Cisco Product Documentation home page, select Release 12.1 from the Cisco IOS Software drop-down list.Preface Conventions xvi Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Conventions This document uses these conventions and symbols for notes, cautions, and warnings: Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual. Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Warning IMPORTANT SAFETY INSTRUCTIONS This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. Use the statement number provided at the end of each warning to locate its translation in the translated safety warnings that accompanied this device. SAVE THESE INSTRUCTIONS Waarschuwing BELANGRIJKE VEILIGHEIDSINSTRUCTIES Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij elektrische schakelingen betrokken risico's en dient u op de hoogte te zijn van de standaard praktijken om ongelukken te voorkomen. Gebruik het nummer van de verklaring onderaan de waarschuwing als u een vertaling van de waarschuwing die bij het apparaat wordt geleverd, wilt raadplegen. BEWAAR DEZE INSTRUCTIESxvii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Conventions Varoitus TÄRKEITÄ TURVALLISUUSOHJEITA Tämä varoitusmerkki merkitsee vaaraa. Tilanne voi aiheuttaa ruumiillisia vammoja. Ennen kuin käsittelet laitteistoa, huomioi sähköpiirien käsittelemiseen liittyvät riskit ja tutustu onnettomuuksien yleisiin ehkäisytapoihin. Turvallisuusvaroitusten käännökset löytyvät laitteen mukana toimitettujen käännettyjen turvallisuusvaroitusten joukosta varoitusten lopussa näkyvien lausuntonumeroiden avulla. SÄILYTÄ NÄMÄ OHJEET Attention IMPORTANTES INFORMATIONS DE SÉCURITÉ Ce symbole d'avertissement indique un danger. Vous vous trouvez dans une situation pouvant entraîner des blessures ou des dommages corporels. Avant de travailler sur un équipement, soyez conscient des dangers liés aux circuits électriques et familiarisez-vous avec les procédures couramment utilisées pour éviter les accidents. Pour prendre connaissance des traductions des avertissements figurant dans les consignes de sécurité traduites qui accompagnent cet appareil, référez-vous au numéro de l'instruction situé à la fin de chaque avertissement. CONSERVEZ CES INFORMATIONS Warnung WICHTIGE SICHERHEITSHINWEISE Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu Verletzungen führen kann. Machen Sie sich vor der Arbeit mit Geräten mit den Gefahren elektrischer Schaltungen und den üblichen Verfahren zur Vorbeugung vor Unfällen vertraut. Suchen Sie mit der am Ende jeder Warnung angegebenen Anweisungsnummer nach der jeweiligen Übersetzung in den übersetzten Sicherheitshinweisen, die zusammen mit diesem Gerät ausgeliefert wurden. BEWAHREN SIE DIESE HINWEISE GUT AUF.Preface Conventions xviii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Avvertenza IMPORTANTI ISTRUZIONI SULLA SICUREZZA Questo simbolo di avvertenza indica un pericolo. La situazione potrebbe causare infortuni alle persone. Prima di intervenire su qualsiasi apparecchiatura, occorre essere al corrente dei pericoli relativi ai circuiti elettrici e conoscere le procedure standard per la prevenzione di incidenti. Utilizzare il numero di istruzione presente alla fine di ciascuna avvertenza per individuare le traduzioni delle avvertenze riportate in questo documento. CONSERVARE QUESTE ISTRUZIONI Advarsel VIKTIGE SIKKERHETSINSTRUKSJONER Dette advarselssymbolet betyr fare. Du er i en situasjon som kan føre til skade på person. Før du begynner å arbeide med noe av utstyret, må du være oppmerksom på farene forbundet med elektriske kretser, og kjenne til standardprosedyrer for å forhindre ulykker. Bruk nummeret i slutten av hver advarsel for å finne oversettelsen i de oversatte sikkerhetsadvarslene som fulgte med denne enheten. TA VARE PÅ DISSE INSTRUKSJONENE Aviso INSTRUÇÕES IMPORTANTES DE SEGURANÇA Este símbolo de aviso significa perigo. Você está em uma situação que poderá ser causadora de lesões corporais. Antes de iniciar a utilização de qualquer equipamento, tenha conhecimento dos perigos envolvidos no manuseio de circuitos elétricos e familiarize-se com as práticas habituais de prevenção de acidentes. Utilize o número da instrução fornecido ao final de cada aviso para localizar sua tradução nos avisos de segurança traduzidos que acompanham este dispositivo. GUARDE ESTAS INSTRUÇÕES xix Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Conventions ¡Advertencia! INSTRUCCIONES IMPORTANTES DE SEGURIDAD Este símbolo de aviso indica peligro. Existe riesgo para su integridad física. Antes de manipular cualquier equipo, considere los riesgos de la corriente eléctrica y familiarícese con los procedimientos estándar de prevención de accidentes. Al final de cada advertencia encontrará el número que le ayudará a encontrar el texto traducido en el apartado de traducciones que acompaña a este dispositivo. GUARDE ESTAS INSTRUCCIONES Varning! VIKTIGA SÄKERHETSANVISNINGAR Denna varningssignal signalerar fara. Du befinner dig i en situation som kan leda till personskada. Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och känna till vanliga förfaranden för att förebygga olyckor. Använd det nummer som finns i slutet av varje varning för att hitta dess översättning i de översatta säkerhetsvarningar som medföljer denna anordning. SPARA DESSA ANVISNINGARPreface Conventions xx Catalyst 3750 Switch Hardware Installation Guide 78-15136-02xxi Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Related Publications Related Publications You can order printed copies of documents with a DOC-xxxxxx= number. For more information, see the “Ordering Documentation” section on page xxii. These documents provide complete information about the switch and are available from this Cisco.com site: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/index.htm • Release Notes for the Catalyst 3750 Switch (not orderable but available on Cisco.com) Note Before installing, configuring, or upgrading the switch, refer to the release notes on Cisco.com for the latest information. • Catalyst 3750 Switch Software Configuration Guide (order number DOC-7815164=) • Catalyst 3750 Switch Command Reference (order number DOC-7815165=) • Catalyst 3750 Switch System Message Guide (order number DOC-7815166=) • Cluster Management Suite (CMS) online help (available only from the switch CMS software) • Catalyst 3750 Switch Hardware Installation Guide (order number DOC-7815136=) • Cisco Small Form-Factor Pluggable Modules Installation Notes (order number DOC-7815160=) • Cisco Small Form-Factor Pluggable Modules Compatibility Matrix (not orderable but available on Cisco.com) • Compatibility Matrix for 1000BASE-T Small Form-Factor Pluggable Modules (not orderable but available on Cisco.com) Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.Preface Obtaining Documentation xxii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL: http://www.cisco.com International Cisco websites can be accessed from this URL: http://www.cisco.com/public/countries_languages.shtml Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription. Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_t ool_launch.html All users can order annual or quarterly subscriptions through the online Subscription Store: http://www.cisco.com/go/subscription Ordering Documentation You can find instructions for ordering documentation at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways: • Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:xxiii Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Obtaining Technical Assistance http://www.cisco.com/en/US/partner/ordering/index.shtml • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can send your comments in e-mail to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Obtaining Technical Assistance For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. Cisco TAC Website The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year.Preface Obtaining Technical Assistance xxiv Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL: http://tools.cisco.com/RPF/register/register.do Opening a TAC Case The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer. For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly. To open a case by telephone, use one of the following numbers: Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55 USA: 1 800 553-2447 For a complete listing of Cisco TAC contacts, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml TAC Case Priority Definitions To ensure that all cases are reported in a standard format, Cisco has established case priority definitions. Priority 1 (P1)—Your network is “down” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. xxv Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Preface Obtaining Additional Publications and Information Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels. Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. • The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: http://www.cisco.com/en/US/products/products_catalog_links_launch.html • Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: http://www.ciscopress.com • Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL: http://www.cisco.com/go/packetPreface Obtaining Additional Publications and Information xxvi Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 • iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL: http://www.cisco.com/go/iqmagazine • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_ protocol_journal.html • Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL: http://www.cisco.com/en/US/learning/index.htmlC H A P T E R 1-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 1 Using Express Setup This chapter provides a quick, step-by-step setup procedure for a standalone switch or a switch stack. Note Express Setup is supported on switches running Cisco IOS Release 12.1(14)EA1 or later. If you are installing a new switch, refer to the Cisco IOS release label on the rear panel of the switch to determine the release. For quick setup instructions for switches running releases earlier than Cisco IOS Release 12.1(14)EA1, go to Appendix D, “Quick Setup By Using the CLI-Based Setup Program.” The setup procedure includes these steps: • Taking Out What You Need, page 1-2 • Powering On the Switch, page 1-3 • Starting Express Setup, page 1-4 • Configuring the Switch Settings, page 1-9 • Where to Go Next, page 1-12Chapter 1 Using Express Setup Taking Out What You Need 1-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Caution Do not start Express Setup when there are any devices connected to the switch or connect a switch that is already in Express Setup mode to any device other than the PC or workstation that is being used to configure it. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch. Taking Out What You Need Remove the items shown in Figure 1-1 from the shipping container. Figure 1-1 Catalyst 3750 Switch and AC Power Cord You also need to provide an Ethernet (Category 5) straight-through cable (not included), as shown in Figure 1-2, to connect the switch to your PC or workstation. 1 Switch 2 AC power cord 1 2 97175 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X1-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 1 Using Express Setup Powering On the Switch Figure 1-2 Ethernet Cable Powering On the Switch Complete these steps to power on the switch: Step 1 Connect one end of the AC power cord to the power connector on the switch rear panel, as shown in Figure 1-3. Figure 1-3 Connecting the Power 89887 1 Switch 2 AC power cord 97176 1 2 RATING 100-240V ~ 1.2A-0>6A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @13A CONSOLE STACK 1 STACK 2Chapter 1 Using Express Setup Starting Express Setup 1-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Step 2 Connect the other end of the power cable to a grounded AC outlet. After the switch powers on, it begins the power-on self-test (POST), a series of tests that run automatically to ensure that the switch functions properly. POST lasts approximately 1 minute. When POST is complete, only the SYST and STAT LEDs remain green. The MASTR LED is also green on a single switch or on a stack master switch. The SYST LED turns amber if the POST fails. If the POST fails, see Chapter 4, “Troubleshooting,” to determine a course of action. Starting Express Setup Express Setup is a browser-based program that you can use to set up and configure the switch. You assign the IP information so that the switch can connect to local routers and the Internet. The IP address is also required if you plan to further configure the switch. You do not create a username with Express Setup. Express Setup provides the mimimum configuration to configure a switch. To create a username for the switch, use the Cluster Managment Suite (CMS) or the command-line interface (CLI). Note Before starting Express Setup, verify that the switch has passed POST and that the SYST and STAT LEDs are green. For information about troubleshooting a POST failure, see the “Understanding POST Results” section on page 4-2. You cannot start Express Setup until POST has completed. Caution Do not start Express Setup when there are any devices connected to the switch. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch.1-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 1 Using Express Setup Starting Express Setup Follow these steps to start the Express Setup program: Step 1 Verify that no devices are connected to the switch. Step 2 Press and hold the Mode button, as shown in Figure 1-4, until the four LEDs above the Mode button turn green. This takes approximately 3 seconds. Figure 1-4 Starting Express Setup Step 3 Release the Mode button. Note If all of the LEDs begin to blink after you press the Mode button, release it. Blinking LEDs mean that the switch has already been configured and cannot go into Express Setup mode. For more information, see the “Clearing the Switch IP Address and Configuration” section on page 4-2. Step 4 Connect the Ethernet cable (not included) to a 10/100 Ethernet port or small form-factor pluggable (SFP) module port on the front panel of the switch, as shown in Figure 1-5. 1 Mode button SYST RPS MASTR STAT DUPLX SPEED STACK MODE 97173 1Chapter 1 Using Express Setup Starting Express Setup 1-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Caution Do not connect the switch to any device other than the PC or workstation being used to configure it. Figure 1-5 Connecting the Switch and PC or Workstation Ethernet Ports Step 5 Connect the other end of the cable to the Ethernet port on the PC or workstation. Verify that the port status LEDs on both connected Ethernet ports are green. Step 6 Wait approximately 30 seconds after the port LEDs turn green, and launch a web browser on your PC or workstation. Step 7 Enter the IP address 10.0.0.1, as shown in Figure 1-6, and press Enter. 1 Switch 3 PC or workstation 2 Ethernet cable Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 97174 2 31-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 1 Using Express Setup Starting Express Setup Figure 1-6 Entering the IP Address The Express Setup home page appears, as shown in Figure 1-7. Figure 1-7 Express Setup Home Page If the Express Setup does not run, or the Express Setup home page does not appear in your browser: • Did you wait 30 seconds after connecting the switch and PC or workstation before entering the IP address in your browser? If not, wait 30 seconds, and re-enter 10.0.0.1 in the browser, and press Enter. • Did you enter the wrong address in the browser, or is there an error message displayed in the browser window? Chapter 1 Using Express Setup Starting Express Setup 1-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Re-enter 10.0.0.1 in the browser, and press Enter. • Did you connect a crossover instead of a straight-through Ethernet cable between an Ethernet port of the switch and the Ethernet port of the PC or workstation, as shown Figure 1-5. Note See Figure B-11 on page B-9 for instructions on identifying a crossover cable. Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference. If not, reconnect the cable to the Ethernet port on the switch and PC or workstation. Wait 30 seconds before entering 10.0.0.1 in the browser. • Did you verify that POST successfully ran before starting Express Setup? If not, make sure that only the SYST and STAT LEDs are green before pressing the Mode button to begin Express Setup. Note The rest of this chapter explains how to configure a switch by using the Express Setup web page. To configure the switch by using the command-line interface (CLI)-based setup program, see Appendix D, “Quick Setup By Using the CLI-Based Setup Program.”1-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 1 Using Express Setup Configuring the Switch Settings Configuring the Switch Settings The Management Interface field displays VLAN1-Default. This is the management interface through which you manage the switch and to which you assign IP information. Follow these steps to configure your switch with Express Setup: Step 1 Contact your system administrator and obtain the IP address, the IP subnet mask, and the default gateway for your switch. Step 2 Enter the IP address of the switch in the IP Address field. Step 3 Click the drop-down arrow in the IP Subnet Mask field, and select an IP Subnet Mask. Step 4 Enter the IP address for the default gateway in the Default Gateway field. A gateway (router or dedicated network device) is a system that connects a network on one subnet to one or more networks on a different subnet. Note You must specify a default gateway if the management workstation and the switch are on different IP segments. Step 5 Enter your password in the Switch Password field. The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end. Step 6 Enter your password again in the Confirm Switch Password field. You do not enter a username for the switch. After the switch is configured with an IP address, you can use CMS to configure a username. Step 7 (Optional) Enter a host name for the switch in the Host Name field. The host name is limited to 31 characters; embedded spaces are not allowed. Step 8 (Optional) Enter the name of your system contact in the System Contact field. This identifies the system administrator for the switch or network. Step 9 (Optional) Enter your system location in the System Location field. This identifies the physical location of the switch. Chapter 1 Using Express Setup Verifying Switch IP Address (Optional) 1-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Step 10 (Optional) Click Enable in the Telnet Access field if you are going to use Telnet to manage the switch by using the CLI. If you enable Telnet access, you must enter a Telnet password: a. Enter a password in the Telnet Password field. The Telnet password can be from 1 to 25 alphanumeric characters, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end. b. Enter the Telnet password again in the Confirm Telnet Password field. Step 11 (Optional) Click Enable to configure Simple Network Management Protocol (SNMP). Enable SNMP only if you plan to manage switches by using Cisco Works or another SNMP-based network-management system. If you enable SNMP, you must enter a community string in either the SNMP Read Community field, the SNMP Write Community field, or both. SNMP community strings authenticate access to MIB objects. Embedded spaces are not allowed in SNMP community strings. If you set the SNMP read community, users can access MIB objects, but cannot modify them. If you set the SNMP write community, users can access and modify MIB objects. Step 12 Click Save to save your settings to the switch, or click Cancel to clear your settings. The switch exits Express Setup mode. Your switch is now configured with the new IP address. You can install the switch in your production network. Verifying Switch IP Address (Optional) After you have installed the switch in your network, follow these steps to verify the IP address configured on your switch: Step 1 Launch a web browser on a PC or workstation that is connected the network. Step 2 Enter the IP address of your switch (for example: 172.20.139.142.) The switch home page appears, as shown in Figure 1-8.1-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 1 Using Express Setup Rerunning Express Setup Figure 1-8 Switch Home Page Rerunning Express Setup If you did not click Save at the end of the Configuring the Switch Settings section, you can rerun Express Setup by clicking Express Setup on the Switch home page. If you have entered a wrong IP address or need to change the IP address of your switch, you can clear the IP address on your switch by following the steps in the “Clearing the Switch IP Address and Configuration” section on page 4-2.Chapter 1 Using Express Setup Where to Go Next 1-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Where to Go Next After you have saved your configuration to the switch, you can install the switch or further configure it by using CMS or the CLI. Other Switch Home Page Features These additional features are available from the switch home page, as shown on the left menu bar in Figure 1-8 on page 1-11: • Cluster Management Suite—Launch the CMS, through which you can configure and monitor a switch or switch clusters, display network topologies to gather link information, and display switch images to modify switch- and port-level settings. For more information, refer to the switch software configuration guide For CMS requirements, see Appendix C, “Managing the Switch by Using the Cluster Management Suite.” • Tools—Access diagnostic and monitoring tools such as Telnet and Extended Ping. • Help Resources—Access Catalyst 3750 documentation. Installing or Connecting Devices to the Switch For detailed installation procedures on mounting your switch on or under a desk or on a wall, or connecting devices to the switch, see Chapter 3, “Installation.”C H A P T E R 2-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 2 Product Overview The Catalyst 3750 family of switches—also referred to as the switches—are stackable Ethernet switches to which you can connect devices like Cisco IP Phones, Cisco Wireless Access Points workstations, and other network devices such as servers, routers, and other switches. This chapter provides a functional overview of the Catalyst 3750 switch models. These topics are included: • Features, page 2-1 • Front Panel Description, page 2-3 • Rear Panel Description, page 2-14 • Management Options, page 2-18 Features The switches can be deployed as backbone switches, aggregating 10BASE-T, 100BASE-TX, and 1000BASE-T Ethernet traffic from other network devices. Refer to the switch software configuration guide for examples showing how you might deploy the switches in your network.Chapter 2 Product Overview Features 2-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 2-1 through Figure 2-5 show the Catalyst 3750 switches. These are the switch features: • Hardware – Catalyst 3750-24TS—24 10/100 Ethernet ports and 2 small form-factor pluggable (SFP) module slots – Catalyst 3750G-24T—24 10/100/1000 Ethernet ports – Catalyst 3750G-24TS—24 10/100/1000 Ethernet ports and 4 SFP module slots – Catalyst 3750-48TS—48 10/100 Ethernet ports and 4 SFP module slots – Catalyst 3750G-12S—12 SFP module slots • The switches support these SFP modules: – 1000BASE-SX – 1000BASE-LX – 1000BASE-T Note When installed in Catalyst 3750 switches, 1000BASE-T small form-factor pluggable (SFP) modules can either operate at 10, 100, or 1000 Mbps in full-duplex mode or in half-duplex mode at 10 or 100 Mbps. • Configuration – For 10/100 ports, autonegotiates the speed and duplex settings – For 10/100/1000 ports, autonegotiates the speed and supports only full-duplex mode • The Catalyst 3750 switches support stacking. You can stack up to nine switches in a stack by cabling the StackWise ports. StackWise ports are not user-configurable. • Switches are hot-swappable • Power redundancy – Connection for optional Cisco RPS 300 redundant power system that operates on AC input and supplies backup DC power output to the Catalyst 3750-24TS, 3750G-24T, 3750-48TS, and 3750G-12S switches.2-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description Note The Cisco RPS 300 does not support the Catalyst 3750G-24TS switch. – Connection for optional Cisco RPS 675 redundant power system that operates on AC input and supplies backup DC power output to the family of Catalyst 3750 switches. Front Panel Description The Catalyst 3750-24TS 10/100 ports are numbered 1 through 24. The ports are grouped in pairs. The first member of the pair (port 1) is above the second member (port 2) on the far left, as shown in Figure 2-1. Port 3 is above port 4, and so on. The SFP port numbers are numbered 1 (left) and 2 (right). Figure 2-1 Catalyst 3750-24TS Front Panel The 10/100/1000 ports on the Catalyst 3750G-24T and 3750G-24TS are grouped in pairs. The first member of the pair (port 1) is above the second member (port 2) on the left, as shown in Figure 2-2 and Figure 2-3. Port 3 is above port 4, and so on. In Figure 2-3 the SFP port are numbered 25 to 28. 1 10/100 ports 2 SFP module ports Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 2 1 86541Chapter 2 Product Overview Front Panel Description 2-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 2-2 Catalyst 3750G-24T Front Panel Figure 2-3 Catalyst 3750G-24TS Front Panel The Catalyst 3750G-12S SFP module slots are numbered 1 through 12. The ports are grouped in three sets of four, as shown in Figure 2-4. 1 10/100/1000 ports 1 10/100 ports 2 SFP module ports Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 1 86543 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 1 2 865442-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description Figure 2-4 Catalyst 3750G-12S Front Panel The Catalyst 3750-48TS 10/100 ports are numbered 1 through 48. The ports are grouped in pairs. The first member of the pair (port 1) is above the second member (port 2) on the far left, as shown in Figure 2-1. Port 3 is above port 4, and so on. The SFP port numbers are 1 (top) and 2 (bottom) and so on. Figure 2-5 Catalyst 3750-48TS Front Panel 1 SFP module ports Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 4 1 2 3 12 9 10 11 8 5 6 7 1 97166 1 10/100 ports 2 SFP module ports Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 3 2 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 15 16 2 1 86542Chapter 2 Product Overview Front Panel Description 2-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 10/100 and 10/100/1000 Ports You can set the 10/100 on the switch to operate in any combination of half duplex, full duplex, 10 Mbps or 100 Mbps. You can set the 10/100/1000 ports to operate in 10 Mbps, 100 Mbps, or 1000 Mbps in full duplex. You can also set these ports for speed and duplex autonegotiation in compliance with IEEE 802.3ab. (The default setting is autonegotiate.) When set for autonegotiation, the port senses the speed and duplex settings of the attached device and advertises its own capabilities. If the connected device also supports autonegotiation, the switch port negotiates the best connection (that is, the fastest line speed that both devices support and full-duplex transmission if the attached device supports it) and configures itself accordingly. In all cases, the attached device must be within 328 feet (100 meters). Note 100BASE-TX and 1000BASE-T traffic requires Category 5 cable. 10BASE-T traffic can use Category 3 or Category 4 cables. When connecting the switch to workstations, servers, routers, and Cisco IP Phones, be sure that the cable is a straight-through cable. When connecting the switch to switches or hubs, use a crossover cable. When using a straight-through or crossover cable for 1000BASE-T connections, be sure to use a twisted four-pair, Category 5 cable for proper operation. Pinouts for the cables are described in Appendix B, “Connector and Cable Specifications.” Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference.2-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description SFP Module Slots The SFP module slots support the SFP modules listed in the Catalyst 3750 release notes. SFP Modules The Catalyst 3750 switch uses Gigabit Ethernet SFP modules to establish fiber-optic connections. These transceiver modules are field-replaceable, providing the uplink interfaces when inserted in an SFP module slot. You can use the SFP modules for Gigabit uplink connections to other switches. You use fiber-optic cables with LC or MT-RJ connectors to connect to a fiber-optic SFP module. You use Category 5 cable with RJ-45 connectors to connect to a copper SFP module. The Catalyst 3750 models support these Cisco SFP options: • 1000BASE-LX • 1000BASE-SX • 1000BASE-T For more information about these SFP modules, refer to your SFP module documentation.Chapter 2 Product Overview Front Panel Description 2-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 LEDs You can use the switch LEDs to monitor switch activity and its performance. Figure 2-6 shows the Catalyst 3750-24TS, 3750G-24T, 3750G-24TS, 3750G-12S, and 3750-48TS LEDs and the Mode button that you use to select one of the port modes. All of the LEDs described in this section are visible on the Cluster Management Suite (CMS) home page. The switch software guide describes how to use CMS to configure and monitor individual switches and switch clusters. Figure 2-6 Catalyst 3750 LEDs 1 Mode button 6 Master LED 2 Stack LED 7 RPS LED 3 Speed LED 8 System LED 4 Duplex LED 9 Port LED 5 Status LED SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 86545 1 2 3 4 5 6 7 8 92-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description System LED The System LED shows whether the system is receiving power and is functioning properly. Table 2- 1 lists the LED colors and their meanings. For information on the System LED colors during power-on self-test (POST), see the “Connecting to the 10/100 and 10/100/1000 Ports” section on page 3-44. RPS LED The RPS LED shows the RPS status. Table 2-2 lists the LED colors and their meanings. Table 2-1 System LED Color System Status Off System is not powered on. Green System is operating normally. Amber System is receiving power but is not functioning properly. Table 2-2 RPS LED Color RPS Status Off RPS is off or not properly connected. Green RPS is connected and ready to provide back-up power, if required. Flashing green RPS is connected but is unavailable because it is providing power to another device (redundancy has been allocated to a neighboring device). Amber The RPS is in standby mode or in a fault condition. Press the Standby/Active button on the RPS, and the LED should turn green. If it does not, the RPS fan could have failed. Contact Cisco Systems. Flashing amber The internal power supply in a switch has failed, and the RPS is providing power to the switch (redundancy has been allocated to this device).Chapter 2 Product Overview Front Panel Description 2-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 For more information about the Cisco RPS 300, refer to the Cisco RPS 300 Redundant Power System Hardware Installation Guide. For more information about the Cisco RPS 675, refer to the Cisco RPS 675 Redundant Power System Hardware Installation Guide. Note The Cisco RPS 300 does not support the Catalyst 3750G-24TS switches. Master LED The Master LED shows the stack master status. Table 2- 2 lists the LED colors and their meanings. Port LEDs and Modes Each RJ-45 port and SFP module slot has a port LED. These port LEDs, as a group or individually, display information about the switch and about the individual ports. The port modes determine the type of information displayed through the port LEDs. Table 2- 4 lists the mode LEDs and their associated port mode and meaning. To select or change a mode, press the Mode button until the desired mode is highlighted. When you change port modes, the meanings of the port LED colors also change. Table 2-5 explains how to interpret the port LED colors in different port modes. If your switches are stacked and you press the Mode button on any one of the switches in the stack, all the switches in the stack change to display the same selected mode. For example, if you press the mode button on the stack master to display SPEED, all the other switches in the stack also display SPEED. Ta b l e 2 - 3 Ma s t e r L E D Port Mode Description Off Switch is not the stack master. Green Switch is the stack master or a standalone switch. Amber An error occurred when the switch was selecting the stack master switch or a stack error.2-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description Table 2-4 Port Mode LEDs Mode LED Port Mode Description STAT Port status The port status. This is the default mode. DUPLX Port duplex mode The port duplex mode: full duplex or half duplex. Note The 10/100/1000 ports operate only in full-duplex mode. SPEED Port speed The port operating speed: 10, 100, or 1000 Mbps. STACK Stack Member Status StackWise Port Status The stack member status. The StackWise port status. See the “Stack LED” section on page 2-12 for more information. Table 2-5 Meaning of LED Colors in Different Modes on the Switch Port Mode LED Color Meaning STAT (port status) Off No link, or port was administratively shut down. Green Link present. Flashing green Activity. Port is transmitting or receiving data. Alternating green-amber Link fault. Error frames can affect connectivity, and errors such as excessive collisions, CRC errors, and alignment and jabber errors are monitored for a link-fault indication. Amber Port is blocked by Spanning Tree Protocol (STP) and is not forwarding data. Note After a port is reconfigured, the port LED can remain amber for up to 30 seconds as STP checks the switch for possible loops. Flashing amber Port is blocked by STP and is transmitting or receiving packets. DUPLX (duplex) Off Port is operating in half duplex. Green Port is operating in full duplex.Chapter 2 Product Overview Front Panel Description 2-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Stack LED The stack LED shows the sequence of member switches in a stack. Up to nine switches can be members of a stack. The first nine port LEDs show the position of a switch in a stack. Figure 2-7 shows a magnified view of the LEDs on the first switch, which is member number 8 of the stack. For example, if you press the Mode button to select the stack member on this switch, the port LED 8 flashes green because this represents the member number of this switch. The port LEDs 3 and 4 are solid green, as these represent the member numbers of other switches in the stack. The other port LEDs are off because there are no more members in the stack. When the stack LED is selected, the representative stack LEDs are green when the StackWise ports (on the switch rear panel) are up, and the representative stack LEDs are amber when the ports are down: • SFP port LEDs 1 and 2 on the Catalyst 3750-24TS switch show the status for StackWise ports 1 and 2, respectively. SPEED 10/100 and 10/100/1000 ports Off Port is operating at 10 Mbps. Green Port is operating at 100 Mbps. Flashing green Port is operating at 1000 Mbps. SFP ports Off Port is operating at 10 Mbps. Green Port is operating at 100 Mbps. Flashing green Port is operating at 1000 Mbps. Note When installed in Catalyst 3750 switches, 1000BASE-T SFP modules can operate at 10, 100, or 1000 Mbps in full-duplex mode or in half-duplex mode at 10 or 100 Mbps. STACK (stack member) Off No stack member corresponding to that member number. Flashing Green Selected switch’s member number. Green Member number of other stack member switches. Table 2-5 Meaning of LED Colors in Different Modes on the Switch (continued) Port Mode LED Color Meaning2-13 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Front Panel Description • SFP port LEDs 3 and 4 on the Catalyst 3750-48TS switch show the status for StackWise ports 1 and 2, respectively. • SFP port LEDs 27 and 28 on the Catalyst 3750G-24TS switch show the status for StackWise ports 1 and 2, respectively. • The 10/100/1000 port LEDs 23 and 24 on the Catalyst 3750G-24T switch show the status for StackWise ports 1 and 2, respectively. • SFP port LEDs 11 and 12 on the Catalyst 3750G-12S switch show the status for StackWise ports 1 and 2, respectively. Note If both the port LEDs are green on all the switches in the stack, the stack is operating at full bandwidth (32 Gbps). If any of the port LEDs are not green, the stack is not operating at full bandwidth. Figure 2-7 Stack LED 1 Stack member 8 3 Stack member 4 2 Stack member 3 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 2 3 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 15 16 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 2 3 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 15 16 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 2 3 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 15 16 1X 2X 1 2 3 4 5 6 7 8 9 10 11 12 13 1 2 3 86686Chapter 2 Product Overview Rear Panel Description 2-14 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Rear Panel Description The switch rear panels have an AC power connector, an RPS connector, an RJ-45 console port, and two StackWise ports. (See Figure 2-8 and Figure 2-9.) Figure 2-8 Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS Rear Panel 1 StackWise ports 4 AC power connector 2 RJ-45 console port 5 RPS connector 3 Fan exhaust RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE STACK 1 STACK 2 1 2 3 4 5 865482-15 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Rear Panel Description Figure 2-9 Catalyst 3750G-24TS Rear Panel StackWise Ports The Catalyst 3750 switch ships with a 0.5-meter StackWise cable (72-2632-XX CABASY) that you can use to connect the StackWise ports. Caution Use only approved cables (CAB-STACK-50CM, CAB-STACK-1M, or CAB-STACK-3M), and connect only to similar Cisco equipment. Equipment might be damaged if connected to other nonapproved Cisco cables or equipment. You can order these StackWise cables from your Cisco sales representative: • CAB-STACK-50CM= (0.5-meter cable) • CAB-STACK-1M= (1-meter cable) • CAB-STACK-3M= (3-meter cable) 1 StackWise ports 4 AC power connector 2 RJ-45 console port 5 RPS connector 3 Fan exhaust CONSOLE STACK 1 STACK 2 DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @17a 1 2 3 4 5 86547Chapter 2 Product Overview Rear Panel Description 2-16 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Power Connectors The switch is powered through the internal power supply. You can also connect the Cisco RPS 300 or the Cisco RPS 675 to provide backup power if the switch internal power supply should fail. Note The Catalyst 3750 switch and the Cisco RPS 300 or RPS 675 should be connected to the same AC power source. Internal Power Supply Connector The internal power supply is an autoranging unit that supports input voltages between 100 and 240 VAC. Use the supplied AC power cord to connect the AC power connector to an AC power outlet. Cisco RPS Connector Specific Cisco RPS modes support specific Catalyst 3750 switches: • Cisco RPS 300 (model PWR300-AC-RPS-N1) supports the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS switches. • Cisco RPS 675 (model PWR675-AC-RPS-N1=) supports the Catalyst 3750 family of switches. Cisco RPS 300 The Cisco RPS 300 has two output levels: –48V and 12V with a total maximum output power of 300W. Use the supplied RPS connector cable to connect the RPS to the switch. Note The Cisco RPS 300 does not support the Catalyst 3750G-24TS switches. Warning Attach only the Cisco RPS (model PWR300-AC-RPS-N1) to the RPS receptacle.2-17 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Rear Panel Description The RPS is a redundant power system that can support six external network devices and provides power to one failed device at a time. It automatically senses when the internal power supply of a connected device fails and provides power to the failed device, preventing loss of network traffic. For more information on the Cisco RPS 300, refer to the Cisco RPS 300 Redundant Power System Hardware Installation Guide. Cisco RPS 675 The Cisco RPS 675 has two output levels: –48V and 12V with a total maximum output power of 675W. Use the supplied RPS connector cable to connect the RPS to the switch. Warning Attach only the Cisco RPS (model PWR675-AC-RPS-N1=) to the RPS receptacle. The RPS is a redundant power system that can support six external network devices and provides power to one failed device at a time. It automatically senses when the internal power supply of a connected device fails and provides power to the failed device, preventing loss of network traffic. For more information on the Cisco RPS 675, refer to the Cisco RPS 675 Redundant Power System Hardware Installation Guide. Console Port You can connect the switch to a PC by means of the console port and the supplied RJ-45-to-DB-9 female cable. If you want to connect the switch console port to a terminal, you need to provide an RJ-45-to-DB-25 female DTE adapter. You can order a kit (part number ACS-DSBUASYN=) containing that adapter from Cisco. For console port and adapter pinout information, see the “Connector and Cable Specifications” section on page B-1.Chapter 2 Product Overview Management Options 2-18 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Management Options The Catalyst 3750 switches offer several management options: • Cluster Management Suite (CMS) CMS is a graphical user interface that can be launched from anywhere in your network through a web browser such as Netscape Communicator or Microsoft Internet Explorer. CMS is already installed on the switch, and no additional installation is required. From CMS, you can fully configure and monitor a switch or switch clusters, display network topologies to gather link information, and display switch images to modify switch- and port-level settings. For more information, refer to the switch software configuration guide on Cisco.com, and the online help for this application. • Cisco IOS command-line interface (CLI) The switch CLI is based on Cisco IOS software and is enhanced to support desktop-switching features. You can fully configure and monitor the switch and switch cluster members from the CLI. You can access the CLI either by connecting your management station directly to the switch console port or by using Telnet from a remote management station. Refer to the Catalyst 3750 Switch Command Reference on Cisco.com for more information. • CiscoView application The CiscoView device-management application displays the switch image that you can use to set configuration parameters and to view switch status and performance information. The CiscoView application, which you purchase separately, can be a standalone application or part of a Simple Network Management Protocol (SNMP) platform. Refer to the CiscoView documentation for more information. • SNMP network management You can manage switches from a SNMP-compatible management station that is running platforms such as HP OpenView or SunNet Manager. The switch supports a comprehensive set of Management Information Base (MIB) extensions and four Remote Monitoring (RMON) groups. Refer to the switch software configuration guide on Cisco.com and the documentation that came with your SNMP application for more information.2-19 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 2 Product Overview Management Options • Cisco Intelligence Engine 2100 (IE2100) Cisco IE200 Series Configuration Registrar is a network management device that works with embedded CNS agents in the switch software. You can automate initial configurations and configuration updates by generating switch-specific configuration changes, sending them to the switch, executing the configuration change, and logging the results. Network Configurations Refer to the switch software configuration guide on Cisco.com for network configuration concepts and examples of using the switch to create dedicated network segments and interconnecting the segments through Gigabit Ethernet connections.Chapter 2 Product Overview Management Options 2-20 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02C H A P T E R 3-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 3 Switch Installation This chapter describes how to start your switch and how to interpret the power-on self-test (POST) that ensures proper operation. It describes the planning and cabling considerations to keep in mind while planning your stack. It describes how to install the switch and make connections to the switch. Read the topics and perform the procedures in this order: • Preparing for Installation, page 3-1 • Verifying Switch Operation, page 3-8 • Planning the Stack, page 3-12 • Installing the Switch, page 3-17 • Connecting StackWise Cable to StackWise Ports, page 3-37 • Connecting to the 10/100 and 10/100/1000 Ports, page 3-44 • Connecting to an SFP Module, page 3-46 • Where to Go Next, page 3-50 Preparing for Installation This section covers these topics: • Warnings, page 3-2 • EMC Regulatory Statements, page 3-4 • Installation Guidelines, page 3-6Chapter 3 Switch Installation Preparing for Installation 3-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 • Verifying Package Contents, page 3-7 • Verifying Switch Operation, page 3-8 Warnings These warnings are translated into several languages in Appendix E, “Translated Safety Warnings.” Warning This equipment is to be installed and maintained by service personnel only as defined by AS/NZS 3260 Clause 1.2.14.3 Service Personnel. Warning Only trained and qualified personnel should be allowed to install or replace this equipment. Warning Read the installation instructions before you connect the system to its power source. Warning Before working on equipment that is connected to power lines, remove jewelry (including rings, necklaces, and watches). Metal objects will heat up when connected to power and ground and can cause serious burns or weld the metal object to the terminals. Warning Do not stack the chassis on any other equipment. If the chassis falls, it can cause severe bodily injury and equipment damage. Warning The plug-socket combination must be accessible at all times because it serves as the main disconnecting device.3-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Preparing for Installation Warning To prevent the switch from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of 113° F (45° C). To prevent airflow restriction, allow at least 3 inches (7.6 cm) of clearance around the ventilation openings. Warning When installing or replacing the unit, the ground connection must always be made first and disconnected last. Warning This equipment is intended to be grounded. Ensure that the host is connected to earth ground during normal use. Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Warning Ultimate disposal of this product should be handled according to all national laws and regulations. Warning Attach only the Cisco RPS (model PWR675-AC-RPS-N1) to the RPS receptacle. Warning Class 1 laser product Warning Avoid exposure to the laser beam.Chapter 3 Switch Installation Preparing for Installation 3-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 EMC Regulatory Statements This section includes specific regulatory statements about the Catalyst 3750 family of switches. U.S.A. U.S. regulatory information for this product is in the front matter of this manual. Class A Notice for Taiwan and Other Traditional Chinese Markets Japan This is a Class A product based on the standard of the Voluntary Control Council for Interference by Information Technology Equipment (VCCI). If this equipment is used in a domestic environment, radio disturbance may arise. When such trouble occurs, the user may be required to take corrective actions. Warning This is a Class A Information Product, when used in residential environment, it may cause radio frequency interference, under such circumstances, the user may be requested to take appropriate countermeasures. 464643-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Preparing for Installation Class A Notice for Korea Class A Notice for Hungary Warning This is a Class A Device and is registered for EMC requirements for industrial use. The seller or buyer should be aware of this. If this type was sold or purchased by mistake, it should be replaced with a residential-use type. Warning This equipment is a class A product and should be used and installed properly according to the Hungarian EMC Class A requirements (MSZEN55022). Class A equipment is designed for typical commercial establishments for which special conditions of installation and protection distance are used. Statement 256Chapter 3 Switch Installation Preparing for Installation 3-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Installation Guidelines When determining where to place the switch, be sure to observe these requirements: • For 10/100 and 10/100/1000 ports, cable lengths from the switch to connected devices are up to 328 feet (100 meters). • Copper 1000BASE-T SFP modules use standard four twisted-pair, Category 5 cable at lengths up to 328 feet (100 meters). • Table 3-1 lists the cable specifications for 1000BASE-SX and 1000BASE-LX fiber-optic SFP connections. Each port must match the wave-length specifications on the other end of the cable, and the cable must not exceed the stipulated cable length for reliable communications. • Operating environment is within the ranges listed in Appendix A, “Technical Specifications.” • Clearance to front and rear panels is such that – Front-panel indicators can be easily read. – Access to ports is sufficient for unrestricted cabling. Table 3-1 Fiber-Optic SFP Module Port Cabling Specifications SFP Module Wavelength (nanometers) Fiber Type Core Size (micron) Modal Bandwidth (MHz/km) Cable Distance 1000BASE-SX 850 MMF 62.5 62.5 50.0 50.0 160 200 400 500 722 feet (220 m) 902 feet (275 m) 1640 feet (500 m) 1804 feet (550 m) 1000BASE-LX/LH 1300 MMF 1 SMF 1. A mode-conditioning patch cord is required. Using an ordinary patch cord with MMF, 1000BASE-LX/LH SFP modules, and a short link distance can cause transceiver saturation, resulting in an elevated bit error rate (BER). When using the LX/LH SFP module with 62.5-micron diameter MMF, you must also install a mode-conditioning patch cord between the SFP module and the MMF cable on both the sending and receiving ends of the link. The mode-conditioning patch cord is required for link distances greater than 984 feet (300 m). 62.5 50.0 50.0 9/10 500 400 500 — 1804 feet (550 m) 1804 feet (550 m) 1804 feet (550 m) 32,810 feet (10 km)3-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Preparing for Installation Make sure that there is access to the rear of the rack if you are planning to stack the switches. If you do not have access to the rear panel, make sure you cable the switches before you rack mount them. – Rear-panel power connector is within reach of an AC power receptacle. • Cabling is away from sources of electrical noise, such as radios, power lines, and fluorescent lighting fixtures. Make sure the cabling is safely away from other devices that might damage the cables. • Airflow around the switch and through the vents is unrestricted. • Temperature around the unit does not exceed 113°F (45°C). Note If the switch is installed in a closed or multirack assembly, the temperature around it might be greater than normal room temperature. Verifying Package Contents Note Carefully remove the contents from the shipping container, and check each item for damage. If any item is missing or damaged, contact your Cisco representative or reseller for support. Return all packing material to the shipping container, and save it. The switch is shipped with these items: • This Catalyst 3750 Switch Hardware Installation Guide • About the Catalyst 3750 Documentation flyer • AC power cord (AC-powered switches) • One RJ-45-to-DB-9 adapter cable • Mounting kit containing: – Four rubber feet for mounting the switch on a table – Two 19-inch rack-mounting brackets – Four Phillips flat-head screws for attaching the brackets to the switch (Catalyst 3750G-24TS switch)Chapter 3 Switch Installation Preparing for Installation 3-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 – Six Phillips flat-head screws for attaching the brackets to the switch (Catalyst 3750-24TS, 3750G-24T, and 3750-48TS switches) – Four Phillips machine screws for attaching the brackets to a rack – One cable guide and one black Phillips machine screw for attaching the cable guide to one of the mounting brackets – One redundant power system (RPS) connector cover (for wall mounting) – Two Phillips pan-head screws (for attaching the RPS cover) – Four Phillips truss-head screws (for wall-mounting brackets) – StackWise cable: 0.5-meter, 1-meter, or 3-meter cable. Note If you don’t specify the length of the StackWise cable, the 0.5-meter cable is supplied by default. Verifying Switch Operation Before installing the switch in a rack, on a wall, or on a table or shelf, you should power the switch and verify that the switch passes POST. These sections describe the steps required to connect a PC to the switch console port, and to power on the switch and observe POST: • Connecting a PC or Terminal to the Console Port, page 3-8 • Powering On the Switch and Running POST, page 3-10 Connecting a PC or Terminal to the Console Port To connect a PC to the console port, use the supplied RJ-45-to-DB-9 adapter cable. To connect the switch console port to a terminal, you need to provide a RJ-45-to-DB-25 female DTE adapter. You can order a kit (part number ACS-DSBUASYN=) containing that adapter from Cisco. For console port and adapter pinout information, see the “Cable and Adapter Specifications” section on page B-6. The terminal-emulation software—frequently a PC application such as Hyperterminal or Procomm Plus—makes communication between the switch and your PC or terminal possible.3-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Preparing for Installation Follow these steps to connect the PC or terminal to the switch: Step 1 Configure the baud rate and character format of the PC or terminal to match these console port default characteristics: • 9600 baud • 8 data bits • 1 stop bit • No parity • None (flow control) After you have gained access to the switch, you can change the console baud rate through the Administration > Console Baud Rate window in the Cluster Management Suite (CMS). Step 2 Using the supplied RJ-45-to-DB-9 adapter cable, insert the RJ-45 connector into the console port, as shown in Figure 3-1. Step 3 Attach the DB-9 female DTE adapter of the RJ-45-to-DB-9 adapter cable to a PC, or attach an appropriate adapter to the terminal. Step 4 Start the terminal-emulation program if you are using a PC or terminal.Chapter 3 Switch Installation Preparing for Installation 3-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-1 Connecting to the Console Port Powering On the Switch and Running POST If your configuration has an RPS, connect the switch and the RPS to the same AC power source. See the “Power Connectors” section on page 2-16, and refer to the Cisco RPS documentation for more information. Note Always put the RPS in standby mode when you are connecting devices to it and in active mode during normal operation. To power on the switch, follow these steps: Step 1 Make sure that you have started the terminal emulation software program (such as ProComm, HyperTerminal, tip, or minicom) from your management station. See the “Connecting a PC or Terminal to the Console Port” section on page 3-8 for information on connecting to the switch console port. Step 2 Connect one end of the AC power cord to the AC power connector on the switch. 1 Console port CONSOLE STACK 1 STACK 2 86685 13-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Preparing for Installation Step 3 Connect the other end of the power cord to an AC power outlet. If you are installing the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, or 3750-48TS switches, you can use the Cisco RPS 300. Warning Attach only the Cisco RPS 300 (model PWR300-AC-RPS-N1) to the RPS receptacle If you are installing the Catalyst 3750-24TS, 3750G-24T, 3750G-24T, 3750G-12S, or 3750-48TS switches, you can use the Cisco RPS 675. Warning Attach only the Cisco RPS 675 (model PWR675-AC-RPS-N1=) to the RPS receptacle As the switch powers on, it begins POST, a series of tests that run automatically to ensure that the switch functions properly. When the switch begins POST, the System, the RPS, the Master, the Status, the Duplex LEDs turn amber for 2 seconds. The Speed and the Stack LEDs turn green for 2 seconds. As POST continues, the System LED flashes green, and the other LEDs turn off. The port LEDs turn solid green, and each port LED turns off as the test successfully checks each port. If there is a failure associated with a particular port, that port LED turns amber, and the system LED turns amber. When POST is complete, only the SYST and STAT LEDs are green. The MASTR LED is also green on a single switch or on a stack master switch. If a switch fails POST, the System LED turns amber. The RPS LED turns either solid amber or blinking amber. Other LEDs are off. If POST fails, see Chapter 4, “Troubleshooting,” to determine a course of action. Powering Off the Switch and Disconnecting the Console Port Disconnect the power cord from the switch. Disconnect the cable from the switch console port. Install the switch in a rack, on a wall, or on a table or shelf as described in the “Installing the Switch” section on page 3-17.Chapter 3 Switch Installation Planning the Stack 3-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Planning the Stack If you plan to stack your switches, read these sections: • Planning Considerations, page 3-12 • Powering Considerations, page 3-13 • Cabling Considerations, page 3-14 • Recommended Cabling Configurations, page 3-15 Planning Considerations Before connecting the Catalyst 3750 switches in a stack, observe these planning considerations: • Size of the switch. For switch dimensions, go to Appendix A, “Technical Specifications.” The Catalyst 3750-24TS, 3750G-24TS, and 3750-48TS switches are the same depth, and the Catalyst 3750G-12S and 3750G-24T switches are deeper than the other switches. Stacking switches of the same size together will make it easier to cable the switches. • Length of cable. Depending on the configurations you have, you might need different sized cables. If you don’t specify the length of the StackWise cable, the 0.5-meter cable is supplied by default. If you require the 1-meter cable or 3-meter cable, you can order it from your Cisco supplier. For cable numbers, see the “StackWise Ports” section on page 2-15. The “Recommended Cabling Configurations” section on page 3-15 provides examples of recommended configurations. • Access to the rear ports for unrestricted cabling. Make sure that there is access to the rear of the rack if you are planning to stack the switches. If you do not have access to the rear panel, make sure you cable the switches before you rack-mount them. • For concepts and procedures to manage switch stacks, refer to the switch software configuration guide. 3-13 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Planning the Stack Powering Considerations Consider the following guidelines before you power the switches in a stack: • The sequence in which the switches are initially powered on might affect the switch that becomes the stack master. • If you want a particular switch to become the stack master, power on that switch first. This switch becomes the stack master and remains the stack master until a master re-election is required. After approximately 10 seconds power on the remaining switches in the stack. • If you have no preference as to which switch becomes the stack master, power on the all the switches in the stack within a 10-second timeframe. These switches participate in the stack master election. Switches powered on after the 10-second timeframe do not participate in the election. • Power off a switch before you add it to or remove it from an existing switch stack. Note For conditions that can cause a stack master re-election or to manually elect the stack master, refer to the “Managing Switch Stacks” chapter in the switch software configuration guide.Chapter 3 Switch Installation Planning the Stack 3-14 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Cabling Considerations The illustrations in this section display cabling configuration examples that show the stack bandwidth and possible stack partitioning. Figure 3-2 shows an example of a stack of Catalyst 3750 switches that provides full bandwidth and redundant StackWise cable connections. Figure 3-2 Example of a Stack with Full Bandwidth Connections Figure 3-3 shows an example of a stack of Catalyst 3750 switches with incomplete StackWise cabling connections. This stack provides only half bandwidth and does not have redundant connections. Figure 3-3 Example of a Stack with Half Bandwidth Connections Figure 3-4 and Figure 3-5 show examples of stacks of Catalyst 3750 switches with failover conditions. In Figure 3-4, theStackWise cable is bad in link B; therefore, this stack provides only half bandwidth and does not have redundant connections. In Figure 3-5 link B is bad; therefore, this stack partitions into two stacks with switch 1 and switch 3 being stack masters. 86821 A B C 86823 A B3-15 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Planning the Stack Figure 3-4 Example of a Stack with a Failover Condition Figure 3-5 Example of a Partitioned Stack with a Failover Condition Recommended Cabling Configurations This section describes the recommended cabling configurations for stacking the switches. Stacking Switches in Vertical Racks or on a Table Figure 3-6 is an example of a recommended configuration using the supplied 0.5-meter StackWise cable. In this example, the switches are stacked in a vertical rack or on a table. This configuration provides redundant connections. 86822 A B C 86824 A BChapter 3 Switch Installation Planning the Stack 3-16 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-6 Stacking the Switches in a Vertical Rack or on a Table Using the 0.5-meter StackWise Cable The configuration examples in Figure 3-7 use the 3-meter StackWise cable in addition to the supplied 0.5-meter StackWise cable. This configuration also provides redundant connections. Figure 3-7 Stacking the Catalyst 3750 Switches in a Vertical Rack or on a Table Using 0.5-meter and 3-meter StackWise Cables 86586 865853-17 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Side-by-Side Mounting in a Rack or on a Wall Figure 3-8 and Figure 3-9 are examples of recommended configurations where the switches are rack- or wall-mounted side-by-side. Use the 1-meter and 3-meter StackWise cables to connect the switches. These configuration provide redundant connections. Figure 3-8 Stacking up to Eight Switches in a Side-by-Side Mounting Configuration Figure 3-9 Stacking Nine Switches in a Side-by-Side Mounting Configuration Installing the Switch This section describes these installation procedures: • Rack Mounting, page 3-18 • Wall Mounting, page 3-32 • Table or Shelf Mounting, page 3-36 86825 90532Chapter 3 Switch Installation Installing the Switch 3-18 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Rack Mounting To install the switch in a 19-inch or 24-inch rack (24-inch racks require optional mounting hardware), follow the instructions described in these procedures: • Removing Screws from the Switch, page 3-19 • Attaching Brackets to the Catalyst 3750G-24TS Switch, page 3-20 • Attaching Brackets to the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS Switches, page 3-25 • Mounting the Switch in a Rack, page 3-28 • Attaching the Cable Guide, page 3-30 Note Installing the switch in a 24-inch rack requires an optional bracket kit not included with the switch. You can order a kit containing the 24-inch rack-mounting brackets and hardware from Cisco. For the Catalyst 3750G-24TS switches, order part number RCKMNT-3550-1.5RU=. For the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS switches, order part number RCKMNT-1RU=. Warning To prevent bodily injury when mounting or servicing this unit in a rack, you must take special precautions to ensure that the system remains stable. The following guidelines are provided to ensure your safety: • This unit should be mounted at the bottom of the rack if it is the only unit in the rack. • When mounting this unit in a partially filled rack, load the rack from the bottom to the top with the heaviest component at the bottom of the rack. • If the rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack. 3-19 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Removing Screws from the Switch If you plan to install the switch in a rack, you must first remove screws in the switch chassis so that mounting brackets can be attached. Figure 3-10 and Figure 3-11 show how to remove the chassis screws in a one-rack-unit (RU) switch. Figure 3-10 Removing Screws from the Catalyst 3750-24TS, 3750G-24T, and 3750-48TS Switches Figure 3-11 Removing Screws from the Catalyst 3750G-12S Switch Catalyst 3750 SERIES 23X 24X 1 2 16 17 18 19 20 21 22 23 24 86819 Catalyst 3750 SERIES 16 8 12 9 10 11 97170Chapter 3 Switch Installation Installing the Switch 3-20 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-12 shows how to remove the chassis screws in a 1.5-RU switch. Figure 3-12 Removing Screws from the 3750G-24TS Switch Attaching Brackets to the Catalyst 3750G-24TS Switch The bracket orientation and the brackets that you use depend on whether you are attaching the brackets for a 19-inch or a 24-inch rack. For 19-inch racks, use part number 700-11523-XX; for 24-inch racks, use part number 700-12398-XX. Figure 3-13 through Figure 3-18 show how to attach each type bracket to one side of the switch. Follow the same steps to attach the second bracket to the opposite side. Catalyst 3750 SERIES 23X 24X 23 24 25 26 27 28 868203-21 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-13 Attaching Brackets for 19-inch Racks, Front Panel Forward 1 Phillips flat-head screws SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 1 86839Chapter 3 Switch Installation Installing the Switch 3-22 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-14 Attaching Brackets for 24-Inch Racks, Front Panel Forward 1 Phillips flat-head screws SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 86557 13-23 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-15 Attaching Brackets for 19-Inch Racks, Rear Panel Forward Figure 3-16 Attaching Brackets for 24-Inch Racks, Rear Panel Forward 1 Phillips flat-head screws 1 Phillips flat-head screws DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @17a 86555 1 DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @17a 86556 1Chapter 3 Switch Installation Installing the Switch 3-24 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-17 Attaching Brackets for 19-Inch Telco Racks Figure 3-18 Attaching Brackets for 24-Inch Telco Racks 1 Phillips flat-head screws 1 Phillips flat-head screws Catalyst 3750 SERIES 13X 14X 23X 24X 25 26 27 28 13 14 15 16 17 18 19 20 21 22 23 24 86558 1 Catalyst 3750 SERIES 13X 14X 23X 24X 25 26 27 28 13 14 15 16 17 18 19 20 21 22 23 24 86559 13-25 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Attaching Brackets to the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS Switches The bracket orientation and the brackets you use depend on whether you are attaching the brackets for a 19-inch or a 24-inch rack. For 19-inch racks, use bracket part number 700-8209-XX; for 24-inch racks, use bracket part number 700-13248-XX. Figure 3-19 through Figure 3-25 show how to attach each type bracket to one side of the switch. Follow the same steps to attach the second bracket to the opposite side. Figure 3-19 Attaching Brackets for 19-Inch Racks, Front Panel Forward 1 Phillips flat-head screws SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 86560 1Chapter 3 Switch Installation Installing the Switch 3-26 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-20 Attaching Brackets for 24-Inch Racks, Front Panel Forward Figure 3-21 Attaching Brackets for 19-Inch Racks, Rear Panel Forward 1 Phillips flat-head screws 1 Phillips flat-head screws SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 1 2 3 4 5 86561 1 RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a 1 865623-27 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-22 Attaching Brackets for 24-Inch Racks, Rear Panel Forward Figure 3-23 Attaching Brackets for 19-Inch Telco Racks to Catalyst 3750-24TS, 3750G-24T, and 3750-48TS Switches 1 Phillips flat-head screws 1 Phillips flat-head screws RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a 1 86563 Catalyst 3750 SERIES 13X 14X 23X 24X 11X 12X 1 2 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 1 86564Chapter 3 Switch Installation Installing the Switch 3-28 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-24 Attaching Brackets for 19-Inch Racks to a Catalyst 3750G-12S switch Figure 3-25 Attaching Brackets for 24-Inch Telco Racks Mounting the Switch in a Rack After the brackets are attached to the switch, use the four supplied number-12 Phillips machine screws to securely attach the brackets to the rack, as shown in Figure 3-26 and Figure 3-27. 1 Phillips truss-head screws 1 Phillips flat-head screws Catalyst 3750 SERIES 16 8 12 9 10 11 97171 1 Catalyst 3750 SERIES 13X 14X 23X 24X 11X 12X 1 2 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 86840 13-29 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-26 Mounting the Catalyst 3750G-24TS Switch in a Rack Figure 3-27 Mounting the Catalyst 3750-24TS, 3750G-24T, 3750G-12S, and 3750-48TS Switches in a Rack 1 Phillips machine screws 1 Phillips machine screws Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 86566 1 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 86567 1 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 86567 1Chapter 3 Switch Installation Installing the Switch 3-30 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 After the switch is mounted in the rack, you might need to perform these tasks to complete the installation, run the setup program, and access the switch: • (Optional) Connect the switches in the stacks. See the “Connecting StackWise Cable to StackWise Ports” section on page 3-37. • Connect to the console port, and start the emulation software. See the “Connecting to the Console Port” section on page 1-4 and the “Starting the Terminal Emulation Software” section on page 1-6. • Power on the switch. See the “Connecting to a Power Source” section on page 1-6. If the switches are stacked, see the “Powering Considerations” section on page 3-13. • Run the setup program. See the “Completing the Setup Program” section on page D-11. • Connect to the front-panel ports. See the “Connecting to the 10/100 and 10/100/1000 Ports” section on page 3-44 and the “Connecting to an SFP Module” section on page 3-46 to complete the installation. To use the CLI, enter commands at the Switch> prompt through the console port by using a terminal program or through the network by using Telnet. For configuration information, refer to the switch software configuration guide or the switch command reference. To use CMS, go to the “Accessing the Switch from Yo u r Br ow s er” section on page 1-13. Attaching the Cable Guide We recommend attaching the cable guide to prevent the cables from obscuring the front panel of the switch and the other devices installed in the rack. Use the supplied black screw, as shown in Figure 3-28 and Figure 3-29 to attach the cable guide to the left or right bracket.3-31 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-28 Attaching the Cable Guide on the Catalyst 3750-24TS, 3750G-24T, 3750G-24TS, and 3750G-12S Switches Note The Catalyst 3750-48 switch ships with a special cable guide, as shown in Figure 3-29. This cable guide secures up to 48 cables. Use the supplied black screw to mount it on the left bracket. Figure 3-29 Attaching the Cable Guide on the Catalyst 3750-48TS Switch 1 Cable guide screws 1 Cable guide screws Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 25 26 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 1 86568 Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 2 3 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 15 16 1 86569Chapter 3 Switch Installation Installing the Switch 3-32 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Wall Mounting To install the switch on a wall, follow the instructions in these procedures: • Attaching the Brackets to the Switch for Wall-Mounting, page 3-32 • Attaching the RPS Connector Cover, page 3-33 • Mounting the Switch on a Wall, page 3-34 Note The illustrations in this section show the Catalyst 3750G-24TS switch as an example. All the Catalyst 3750 switches are wall-mounted following the same procedures. Attaching the Brackets to the Switch for Wall-Mounting Figure 3-30 shows how to attach a 19-inch bracket to one side of the switch. Follow the same steps to attach the second bracket to the opposite side. Figure 3-30 Attaching the 19-inch Brackets for Wall-Mounting 1 Phillips truss-head screws Catalyst 3750 SERIES 23X 24X 23 24 25 26 27 28 1 866873-33 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Attaching the RPS Connector Cover If you are not using an RPS with your switch, use the two Phillips pan-head screws to attach the RPS connector cover to the back of the switch, as shown in Figure 3-31 and Figure 3-32. Warning If an RPS is not connected to the switch, install an RPS connector cover on the back of the switch. Figure 3-31 Attaching the RPS Connector Cover on the Catalyst 3750G-24TS Switch 1 Phillips pan-head screws 3 RPS connector 2 RPS connector cover CONSOLE STACK 1 STACK 2 DC INPUTS FOR R POW EMOTE SPECIFIED IN M ER SUPPLY ANUAL +12v @8.5a 1 2 3 86571Chapter 3 Switch Installation Installing the Switch 3-34 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-32 Attaching the RPS Connector Cover on the Catalyst 3750G-12S, 3750-24TS, 3750G-24T, and the 3750-48TS Switches Mounting the Switch on a Wall For the best support of the switch and cables, make sure the switch is attached securely to wall studs or to a firmly attached plywood mounting backboard. Mount the switch with the front panel facing up, as shown in Figure 3-33. Warning To comply with safety regulations, mount the switches on a wall with the front panel facing up. 1 Phillips pan-head screws 3 RPS connector 2 RPS connector cover RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE STACK 1 STACK 2 1 2 3 865723-35 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing the Switch Figure 3-33 Mounting the Switch on a Wall After the switch is mounted on the wall, you might need to perform these tasks to complete the installation, run the setup program, and access the switch: • (Optional) Connect the switches in the stacks. See the “Connecting StackWise Cable to StackWise Ports” section on page 3-37. • Connect to the console port, and start the emulation software. See the “Connecting to the Console Port” section on page 1-4 and the “Starting the Terminal Emulation Software” section on page 1-6. • Power on the switch. See the “Connecting to a Power Source” section on page 1-6. If the switches are stacked, see the “Powering Considerations” section on page 3-13. 1 User-supplied screws Catalyst 50 37 RES S IE SYS T SP TS R AM R TAT L S PUD X EPS DE CATS K DE MO 3X 1 X 14 X32 24X 31 41 15 61 71 81 91 02 12 32 42 1X X2 1X 1 2X 1 1 2 3 4 5 6 7 8 9 10 11 12 1 1 86570Chapter 3 Switch Installation Installing the Switch 3-36 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 • Run the setup program. See the “Completing the Setup Program” section on page D-11. • Connect to the front-panel ports. See the “Connecting to the 10/100 and 10/100/1000 Ports” section on page 3-44 and the “Connecting to an SFP Module” section on page 3-46 to complete the installation. To use the CLI, enter commands at the Switch> prompt through the console port by using a terminal program or through the network by using Telnet. For configuration information, refer to the switch software configuration guide or the switch command reference. To use CMS, go to the “Launching the Switch Home Page” section on page C-3. Table or Shelf Mounting Follow these steps to install the switch on a table or shelf: Step 1 Locate the adhesive strip with the rubber feet in the mounting-kit envelope. Attach the four rubber feet to the recessed areas on the bottom of the unit. Step 2 Place the switch on the table or shelf near an AC power source. After the switch is mounted on the table, you might need to perform these tasks to complete the installation, run the setup program, and access the switch: • (Optional) Connect the switches in the stacks. See the “Connecting StackWise Cable to StackWise Ports” section on page 3-37. • Connect to the console port, and start the emulation software. See the “Connecting to the Console Port” section on page 1-4 and the “Starting the Terminal Emulation Software” section on page 1-6. • Power on the switch. See the “Connecting to a Power Source” section on page 1-6. If the switches are stacked, see the “Powering Considerations” section on page 3-13. • Run the setup program. See the “Completing the Setup Program” section on page D-11. • Connect to the front-panel ports. See the “Connecting to the 10/100 and 10/100/1000 Ports” section on page 3-44 and the “Connecting to an SFP Module” section on page 3-46 to complete the installation.3-37 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Connecting StackWise Cable to StackWise Ports To use the CLI, enter commands at the Switch> prompt through the console port by using a terminal program or through the network by using Telnet. For configuration information, refer to the switch software configuration guide or the switch command reference. To use CMS, go to the “Launching the Switch Home Page” section on page C-3. Connecting StackWise Cable to StackWise Ports Follow these steps to connect the StackWise cable to the StackWise ports: Step 1 Remove the dust covers from the StackWise cables and StackWise ports, and store them for future use. Step 2 Insert one end of the StackWise cable into the StackWise port on the back of the switch. Note Always use a Cisco-approved StackWise cable to connect the switches. Step 3 Use the window in the StackWise cable to align the connector correctly. Secure the screws tightly. Step 4 Insert the other end of the cable into the connector of the other switch, and secure the screws tightly. Caution Removing and installing the StackWise cable can shorten its useful life. Do not remove and insert the cable more often than is absolutely necessary. Note When the connectors are not being used, replace the dust covers on them to protect them from dust. Chapter 3 Switch Installation Connecting StackWise Cable to StackWise Ports 3-38 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-34 Inserting the StackWise Cable in a StackWise Port When you need to remove the StackWise cable from the connector, make sure to fully unscrew the screws before removing the connector. Also make sure that you remove the correct screws from the StackWise port. See Figure 3-35 for correct removal procedures and Figure 3-36 for incorrect removal procedures. CONSOLE STACK 1 STACK 2 865493-39 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Connecting StackWise Cable to StackWise Ports Figure 3-35 Correct Removal of the StackWise Cable from a StackWise Port CONSOLE STACK 1 STACK 2 86826Chapter 3 Switch Installation Installing and Removing SFP Modules 3-40 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-36 Incorrect Removal of a StackWise Cable from a StackWise Port Installing and Removing SFP Modules These sections describe how to install and remove SFP modules. SFP modules are inserted into SFP module slots on the front of the Catalyst 3750 switches. These field-replaceable modules provide uplink interfaces. You can use any combination of SFP modules. Refer to the Catalyst 3750 release notes for the list of SFP modules that the Catalyst 3750 switch supports. Each port must match the wave-length specifications on the other end of the cable, and the cable must not exceed the stipulated cable length for reliable communications. See the “Installation Guidelines” section on page 3-6 for cable stipulations for SFP connections. Use only Cisco SFP modules on the Catalyst 3750 switch. Each SFP module has an internal serial EEPROM that is encoded with security information. This encoding provides a way for Cisco to identify and validate that the SFP module meets the requirements for the switch. CONSOLE STACK 1 STACK 2 868273-41 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing and Removing SFP Modules For detailed instructions on installing, removing, and cabling the SFP module, refer to your SFP module documentation. Installing SFP Modules into SFP Module Slots Figure 3-37 shows an SFP module that has a bale-clasp latch. Caution We strongly recommend that you do not install or remove fiber-optic SFP modules with cables attached because of the potential damage to the cables, the cable connector, or the optical interfaces in the SFP module. Disconnect all cables before removing or installing an SFP module. Removing and installing an SFP module can shorten its useful life. Do not remove and insert SFP modules more often than is absolutely necessary. Figure 3-37 SFP Module with a Bale-Clasp Latch To insert an SFP module into the SFP module slot, follow these steps: Step 1 Attach an ESD-preventive wrist strap to your wrist and to a bare metal surface on the chassis. Step 2 Find the send (TX) and receive (RX) markings that identify the top side of the SFP module. 86575Chapter 3 Switch Installation Installing and Removing SFP Modules 3-42 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Note On some SFP modules, the send and receive (TX and RX) markings might be replaced by arrows that show the direction of the connection, either send or receive (TX or RX). Step 3 Align the SFP module in front of the slot opening. Step 4 Insert the SFP module into the slot until you feel the connector on the module snap into place in the rear of the slot. Figure 3-38 Installing an SFP Module into an SFP Module Slot Step 5 For fiber-optic SFP modules, remove the dust plugs from the optical ports, and store them for later use. Caution Do not remove the dust plugs from the fiber-optic SFP module port or the rubber caps from the fiber-optic cable until you are ready to connect the cable. The plugs and caps protect the SFP module ports and cables from contamination and ambient light. Catalyst 3750 SERIES 13X 14X 13 12 9 10 11 8 5 6 7 971693-43 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Installing and Removing SFP Modules Step 6 Insert the cable connector into the SFP module: • For fiber-optic SFP modules, insert the LC or MT-RJ cable connector into the SFP module. • For copper SFP modules, insert the RJ-45 cable connector into the SFP module. Note When connecting to 1000BASE-T SFP modules, be sure to use a twisted four-pair, Category 5 cable. Removing SFP Modules from SFP Module Slots To remove an SFP module from a module receptacle, follow these steps: Step 1 Attach an ESD-preventive wrist strap to your wrist and to a bare metal surface on the chassis. Step 2 Disconnect the cable from the SFP module. Tip For reattachment, note which cable connector plug is send (TX) and which is receive (RX). Step 3 For fiber-optic SFP modules, insert a dust plug into the optical ports of the SFP module to keep the optical interfaces clean. Step 4 Unlock and remove the SFP module, as shown in Figure 3-39. If the module has a bale-clasp latch, pull the bale out and down to eject the module. If the bale-clasp latch is obstructed and you cannot use your index finger to open it, use a small, flat-blade screwdriver or other long, narrow instrument to open the bale-clasp latch.Chapter 3 Switch Installation Connecting to the 10/100 and 10/100/1000 Ports 3-44 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-39 Removing a Bale-Clasp Latch SFP Module by Using a Flat-Blade Screwdriver Step 5 Grasp the SFP module between your thumb and index finger, and carefully remove it from the module slot. Step 6 Place the removed SFP module in an antistatic bag or other protective environment. Connecting to the 10/100 and 10/100/1000 Ports The switch 10/100 and 10/100/1000 ports configure themselves to operate at the speed of attached devices. If the attached ports do not support autonegotiation, you can explicitly set the speed and duplex parameters. Connecting devices that do not autonegotiate or that have their speed and duplex parameters manually set can reduce performance or result in no linkage. To maximize performance, choose one of these methods for configuring the Ethernet ports: • Let the ports autonegotiate both speed and duplex. • Set the port speed and duplex parameters on both ends of the connection. 1 Bale clasp Catalyst 3750 SERIES 13X 14X 23X 24X 13 14 15 16 17 18 19 20 21 22 23 24 1 2 86554 13-45 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Connecting to the 10/100 and 10/100/1000 Ports Follow these steps to connect to 10BASE-T, 100BASE-TX or 1000BASE-T devices: Caution To prevent electrostatic-discharge (ESD) damage, follow your normal board and component handling procedures. Step 1 When connecting to workstations, servers, routers, and Cisco IP Phones, connect a straight-through cable to an RJ-45 connector on the front panel. (See Figure 3-40.) When connecting to switches or repeaters, use a crossover cable. (See the “Cable and Adapter Specifications” section on page B-6 for cable-pinout descriptions.) Note When connecting to 1000BASE-T-compatible devices, be sure to use a twisted four-pair, Category 5 cable. Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference. Step 2 Connect the other end of the cable to an RJ-45 connector on the other device. The port LED turns on when both the switch and the connected device have established link. The port LED is amber while Spanning Tree Protocol (STP) discovers the topology and searches for loops. This takes about 30 seconds, and then the port LED turns green. If the port LED does not turn on, the device at the other end Chapter 3 Switch Installation Connecting to an SFP Module 3-46 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 might not be turned on, or there might be a cable problem or a problem with the adapter installed in the attached device. See Chapter 4, “Troubleshooting,” for solutions to cabling problems. Step 3 Reconfigure and reboot the connected device if necessary. Step 4 Repeat Steps 1 through 3 to connect each device. Figure 3-40 Connecting to an Ethernet Port Connecting to an SFP Module This section describes how to connect to SFP modules. For instructions on how to connect to fiber-optic SFP modules, see the “Connecting to 1000BASE-T SFP Modules” section. For instructions on how to connect to 1000BASE-T SFP modules, see the “Connecting to 1000BASE-T SFP Modules” section. For instructions about how to install or remove an SFP module, see the “Installing and Removing SFP Modules” section on page 3-40. SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 868183-47 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Connecting to an SFP Module Connecting to a Fiber-Optic SFP Module Follow these steps to connect a fiber-optic cable to an SFP module: Caution Do not remove the rubber plugs from the SFP module port or the rubber caps from the fiber-optic cable until you are ready to connect the cable. The plugs and caps protect the SFP module ports and cables from contamination and ambient light. Before connecting to the SFP module, be sure that you understand the port and cabling stipulations in “Installation Guidelines” section on page 3-6 and in the “SFP Module Slots” section on page 2-7. See Appendix B, “Connector and Cable Specifications” for information about the LC on the SFP module. Step 1 Remove the rubber plugs from the module port and fiber-optic cable, and store them for future use. Step 2 Insert one end of the fiber-optic cable into the SFP module port (see Figure 3-41). Step 3 Insert the other cable end into a fiber-optic receptacle on a target device. Step 4 Observe the port status LED. The LED turns green when the switch and the target device have an established link. The LED turns amber while the STP discovers the network topology and searches for loops. This process takes about 30 seconds, and then the port LED turns green. If the LED is off, the target device might not be turned on, there might be a cable problem, or there might be problem with the adapter installed in the target device. See Chapter 4, “Troubleshooting,” for solutions to cabling problems.Chapter 3 Switch Installation Connecting to an SFP Module 3-48 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure 3-41 Connecting to an SFP Module Port Step 5 If necessary, reconfigure and restart the switch or target device. Caution For detailed instructions on removing the SFP modules, refer to your SFP documentation. Connecting to 1000BASE-T SFP Modules Follow these steps to connect a Category 5 cable to a 1000BASE-T SFP module: Caution To prevent ESD damage, follow your normal board and component handling procedures. 1 LC connector 0 SERIES 23X 24X 1 2 86550 1 Catalyst 3750 SERIES 13X 14X 23X 24X 13 14 15 16 17 18 19 20 21 22 23 24 1 2 86550 13-49 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 3 Switch Installation Connecting to an SFP Module Step 1 When connecting to servers, workstations, and routers, insert a four twisted-pair, straight-through cable in the RJ-45 connector. When connecting to switches or repeaters, insert a four twisted-pair, crossover cable. Note When connecting to a 1000BASE-T device, be sure to use a four twisted-pair, Category 5 cable. Figure 3-42 Connecting to an SFP Module Port Step 2 Insert the other cable end in an RJ-45 connector on a target device. Step 3 Observe the port status LED. The LED turns green when the switch and the target device have an established link. The LED turns amber while the STP discovers the network topology and searches for loops. This process takes about 30 seconds, and then the port LED turns green. If the LED is off, the target device might not be turned on, there might be a cable problem, or there might be problem with the adapter installed in the target device. See Chapter 4, “Troubleshooting,” for solutions to cabling problems. Step 4 If necessary, reconfigure and restart the switch or target device. 1 RJ-45 connector Catalyst 3750 SERIES 13X 14X 23X 24X 13 14 15 16 17 18 19 20 21 22 23 24 1 2 97348 1Chapter 3 Switch Installation Where to Go Next 3-50 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Where to Go Next If the default configuration is satisfactory, the switch does not need further configuration. You can use any of these management options to change the default configuration: • Start CMS as described in the switch software configuration guide, and configure the switch as a member of a cluster or as an individual switch. • Use the CLI to configure the switch as a member of a cluster or as an individual switch from the console. Refer to the Catalyst 3750 Switch Command Reference on Cisco.com for information on using the CLI with a Catalyst 3750 switch. • Start an SNMP application such as the CiscoView application.C H A P T E R 4-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 4 Troubleshooting The LEDs on the front panel provide troubleshooting information about the switch. They show failures in the power-on self-test (POST), port-connectivity problems, and overall switch performance. For a full description of the switch LEDs, see the “LEDs” section on page 2-8. You can also get statistics from the browser interface, from the command-line interface (CLI), or from a Simple Network Management Protocol (SNMP) workstation. Refer to the software configuration guide, the switch command reference guide on Cisco.com, or the documentation that came with your SNMP application for details. This chapter describes these topics for troubleshooting problems: • Understanding POST Results, page 4-1 • Clearing the Switch IP Address and Configuration, page 4-2 • Replacing a Failed Stack Member, page 4-7 Understanding POST Results As the switch powers on, it begins POST, a series of tests that run automatically to ensure that the switch functions properly. When the switch begins POST, the System, the RPS, the Master, the Status, and the Duplex LEDs turn amber for 2 seconds. The Speed and the Stack LEDs turn green for 2 seconds.Chapter 4 Troubleshooting Clearing the Switch IP Address and Configuration 4-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 As POST continues, the System LED blinks green, and the other LEDs turn off. The port LEDs turn solid green, and each port LED turns off as the test successfully checks each port. If there is a failure associated with a particular port, that port LED turns amber. When POST is complete, only the SYST and STAT LEDs remain green. The MASTR LED is also green on a single switch or on a stack master switch. Note For information on operating status for the LEDs, go to the “LEDs” section on page 2-8. If a switch fails POST, the System LED turns amber. The RPS LED turns either solid amber or blinking amber. Other LEDs are off. Note POST failures are usually fatal. Call Cisco Systems if your switch does not pass POST. Clearing the Switch IP Address and Configuration If you have configured a new switch with a wrong IP address, or all the switch LEDs start blinking when you are trying to enter Express Setup mode, you can clear the IP address that is configured on the switch. Note This procedure will clear the IP address and all configuration information stored on the switch. Do not follow this procedure unless you want to completely reconfigure the switch. To clear the IP address and the switch configuration information, follow these steps: Step 1 Press and hold the Mode button, as shown in Figure 1-4 on page 1-5. The switch LEDs begin blinking after about 2 seconds.4-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 4 Troubleshooting Diagnosing Problems Note If the switch is not configured, the mode buttons are all green. You can omit Step 2 and run Express Setup to configure the switch. Step 2 Continue holding down the Mode button. The LEDs stop blinking after 8 additional seconds, and then the switch reboots. Note These steps only work on a previously-configured switch. The switch now behaves like an unconfigured switch. You can configure the switch by using Express Setup as described in these sections. • “Starting Express Setup” section on page 1-4 • “Configuring the Switch Settings” section on page 1-9 • “Verifying Switch IP Address (Optional)” section on page 1-10 You can also configure the switch by using the command-line interface (CLI) setup procedure described in these sections: • “Starting the Terminal Emulation Software” section on page D-9 • “Entering the Initial Configuration Information” section on page D-10 Diagnosing Problems Common switch problems fall into these categories: • Poor performance • No connectivity • Corrupted software Table 4-1 describes how to detect and resolve these problems.Chapter 4 Troubleshooting Diagnosing Problems 4-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Table 4-1 Common Problems and Solutions Symptom Possible Cause Resolution Poor performance or excessive errors Duplex autonegotiation mismatch. Refer to the switch software configuration guide for information on identifying autonegotiation mismatches. Cabling distance exceeded • Port statistics show excessive frame check sequence (FCS), late-collision, or alignment errors. • For 10/100 and 10/100/1000BASE-T connections: – The distance between the port and the attached device exceeds 328 feet (100 meters). – If the switch is attached to a repeater, the total distance between the two end stations exceeds the cabling guidelines. • For SFP port connections: – The distance between the SFP port and the attached device exceeds the SFP cabling guidelines. • Refer to the switch software configuration guide for information on displaying port statistics. • Reduce the cable length to within the recommended distances. • Refer to your repeater documentation for cabling guidelines. • Refer to your SFP documentation for cabling guidelines. Bad adapter in attached device • Excessive errors found in port statistics. • STP checking for possible loops. • Run adapter card diagnostic utility. • Wait 30 seconds for the port LED to turn green.4-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 4 Troubleshooting Diagnosing Problems No connectivity Incorrect or bad cable These are results of no link at both ends: • A crossover cable was used when a straight-through was required, or vice-versa. • The cable is wired incorrectly. • A crossover or straight-through cable is wired incorrectly. • STP checking for possible loops. • For the correct pinouts and the proper application of crossover vs. straight-through cables, see the “Two Twisted-Pair Cable Pinouts” section on page B-6. • Replace with a tested good cable. • For 1000BASE-T connections, be sure to use a twisted four-pair, Category 5 cable. • Wait 30 seconds for the port LED to turn green. Unreadable characters on the management console Incorrect baud rate. Reset the emulation software to 9600 baud. Amber system LED Fatal POST error detected. Contact Cisco Systems. Table 4-1 Common Problems and Solutions (continued) Symptom Possible Cause ResolutionChapter 4 Troubleshooting Diagnosing Problems 4-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 The switch port is placed in error-disabled state after SFP is inserted Bad or non-Cisco-approved SFP. Remove the SFP module from the switch, and replace it with a Cisco-approved module. Use the errdisable recovery cause gbic-invalid global configuration command to verify the port status, and enter a time interval to recover from the error-disable state. Refer to the switch command reference guide for information on the errdisable recovery command. Switch does not recognize the SFP module The SFP module might be installed upside down. The SFP module does not snap into the slot. Verify that the SFP module is not installed upside down. Remove the SFP module. Inspect for physical damage to the connector, the module, and the module slot. Replace the SFP module with a known good SFP module. No stack link between switches or high error rate between switches in the stack Poor cable connection. Bad StackWise cable or damaged StackWise port. Secure the thumb screws on the StackWise cables. See Figure 3-35. Remove the StackWise cable, and inspect the cable and StackWise port for bent pins or damaged connectors. If the StackWise cable is bad, replace it with a known good cable. Table 4-1 Common Problems and Solutions (continued) Symptom Possible Cause Resolution4-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Chapter 4 Troubleshooting Replacing a Failed Stack Member Replacing a Failed Stack Member If you need to replace a failed stack member, you can hot swap or replace the switch by following this procedure: Step 1 Get a replacement switch that has the same model number as the failed switch. Step 2 Power down the failed switch. Step 3 Make sure the replacement switch is powered off, and then connect the replacement switch to the stack. Note If you had manually set the member numbers for any members in the stack, you need to manually assign the replacement switch the same member number as the failed switch. To assign the member number manually, refer to the switch software configuration guide. Step 4 Make the same Ethernet and Gigabit Ethernet connections on the replacement switch (as were on the failed switch). Step 5 Power on the replacement switch. The replacement switch will have the same configuration for all the interfaces as the failed switch and will function the same as the failed switch.Chapter 4 Troubleshooting Replacing a Failed Stack Member 4-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02A-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X A Technical Specifications This appendix lists the switch technical specifications in Table A-2, Table A- 3, Table A- 4, Table A-5, and the regulatory agency approvals in Table A-6. Table A-1 Specifications for the Catalyst 3750G-12S Switch Environmental Ranges Operating temperature 32 to 113°F (0 to 45°C) Storage temperature –13 to 158°F (–25 to 70°C) Relative humidity 10 to 85% (noncondensing) Operating altitude Up to 10,000 ft (3049 m) Storage altitude Up to 15,000 ft (4573 m) Power Requirements AC input voltage 100 to 240 VAC (autoranging) 1.2A/0.6A, 50 to 60 Hz DC input voltages for RPS 300 +12V @13A DC input voltages for RPS 675 +12V @13A Power consumption 120 W, 409 BTUs per hour Power rating 0.120 kVAAppendix A Technical Specifications A-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Physical Dimensions Weight 10 lb (4.55 kg) Dimensions (H x D x W) 1.73 x 12.83 x 17.5 in. (4.39 x 32.59 x 44.45 cm) Table A-2 Specifications for the Catalyst 3750-24TS Switch Environmental Ranges Operating temperature 32 to 113°F (0 to 45°C) Storage temperature –13 to 158°F (–25 to 70°C) Relative humidity 10 to 85% (noncondensing) Operating altitude Up to 10,000 ft (3049 m) Storage altitude Up to 15,000 ft (4573 m) Power Requirements AC input voltage 100 to 240 VAC (autoranging) 1.2A/0.6A, 50 to 60 Hz DC input voltages for RPS 300 +12V @8.5A DC input voltages for RPS 675 +12V @8.5A Power consumption 50W, 171 BTUs per hour Power rating 0.083 kVA Table A-1 Specifications for the Catalyst 3750G-12S Switch (continued) Environmental RangesA-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix A Technical Specifications Physical Dimensions Weight 8 lb (3.6 kg) Dimensions (H x D x W) 1.73 x 11.83 x 17.5 in. (4.39 x 30.05 x 44.45 cm) Table A-3 Specifications for the Catalyst 3750G-24T Switch Environmental Ranges Operating temperature 32 to 113°F (0 to 45°C) Storage temperature –13 to 158°F (–25 to 70°C) Relative humidity 10 to 85% (noncondensing) Operating altitude Up to 10,000 ft (3049 m) Storage altitude Up to 15,000 ft (4573 m) Power Requirements AC input voltage 100 to 240 VAC (autoranging) 1.6A/0.9A, 50 to 60 Hz DC input voltage for RPS 300 +12V @13A DC input voltages for RPS 675 +12V @13A Power consumption 165W, 563 BTUs per hour Power rating 0.165 kVA Physical Dimensions Weight 10 lb (4.55 kg) Dimensions (H x D x W) 1.73 x 12.83 x 17.5 in. (4.39 x 32.59 x 44.45 cm) Table A-2 Specifications for the Catalyst 3750-24TS Switch (continued) Environmental RangesAppendix A Technical Specifications A-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Table A-4 Specifications for the Catalyst 3750G-24TS Switch Environmental Ranges Operating temperature 32 to 113°F (0 to 45°C) Storage temperature –13 to 158°F (–25 to 70°C) Relative humidity 10 to 85% (noncondensing) Operating altitude Up to 10,000 ft (3049 m) Storage altitude Up to 15,000 ft (4573 m) Power Requirements AC input voltage 100 to 240 VAC (autoranging) 2.3A/1.5A, 50 to 60 Hz DC input voltages for RPS 675 +12V @17A Power consumption 190W, 650 BTUs per hour Power rating 0.190 kVA Physical Dimensions Weight 12.5 lb (5.68 kg) Dimensions (H x D x W) 2.59 x 11.60 x 17.5 in. (6.59 x 29.46 x 44.45 cm) Table A-5 Specifications for the Catalyst 3750-48TS Switch Environmental Ranges Operating temperature 32 to 113°F (0 to 45°C) Storage temperature –13 to 158°F (–25 to 70°C) Relative humidity 10 to 85% (noncondensing) Operating altitude Up to 10,000 ft (3049 m) Storage altitude Up to 15,000 ft (4573 m) Power Requirements AC input voltage 100 to 240 VAC (autoranging) 1.2A/0.6A, 50 to 60 HzA-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix A Technical Specifications DC input voltages for RPS 300 +12V@8.5A DC input voltages for RPS 675 +12V @8.5A Power consumption 75W, 256 BTUs per hour Power rating 0.075 kVA Physical Dimensions Weight 9.1 lb (4.1 kg) Dimensions (H x D x W) 1.73 x 11.83 x 17.5 in. (4.39 x 30.05 x 44.45 cm) Table A-6 Catalyst 3750 Switch Agency Approvals Safety EMC UL to UL 60950, Third Edition FCC Part 15 Class A c-UL to CAN/CSA -C22.2 No. 60950-00, Third Edition EN 55022 1998 Class A (CISPR 22) EN 55024 1998 Class A (CISPR 24) TUV/GS to EN 60950:2000 VCCI Class A CB to IEC 60950 with all country deviations AS/NZS 3548 Class A NOM to NOM-019-SCFI CNS13438 Class A CE Marking CE MIC Table A-5 Specifications for the Catalyst 3750-48TS Switch (continued) Environmental RangesAppendix A Technical Specifications A-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02B-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X B Connector and Cable Specifications This appendix describes the Catalyst 3750 switch ports and the cables and adapters that you use to connect the switch to other devices. Connector Specifications These sections describe the connectors used with the Catalyst 3750 switches. 10/100/1000 Ports The 10/100/1000 Ethernet ports on Catalyst 3750 switches use standard RJ-45 connectors. Figure B-1 shows the pinout. Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference.Appendix B Connector and Cable Specifications Connector Specifications B-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Connecting to 10BASE-T- and 100BASE-TX-Compatible Devices When connecting the ports to 10BASE-T- and 100BASE-TX-compatible devices, such as servers, workstations, and routers, you can use a two or four twisted-pair, straight-through cable wired for 10BASE-T and 100BASE-TX. Figure B-5 shows the two twisted-pair, straight-through cable schematics. Figure B-7 shows the four twisted-pair, straight-through cable schematics. When connecting the ports to 10BASE-T- and 100BASE-TX-compatible devices, such as switches or repeaters, you can use a two or four twisted-pair, crossover cable. Figure B-6 shows the two twisted-pair, crossover cable schematics. Figure B-10 shows the four twisted-pair, crossover cable schematics. You can use Category 3, 4, or 5 cabling when connecting to 10BASE-T-compatible devices. You must use Category 5 cabling when connecting to 100BASE-TX-compatible devices. Connecting to 1000BASE-T Devices When connecting the ports to 1000BASE-T devices, such as servers, workstations, and routers, you must use a four twisted-pair, Category 5, straight-through cable wired for 10BASE-T, 100BASE-TX, and 1000BASE-T. Figure B-9 shows the straight-through cable schematics. When connecting the ports to other devices, such as switches or repeaters, you must use a four twisted-pair, Category 5, crossover cable. Figure B-10 shows the crossover cable schematics. Note Be sure to use a four twisted-pair, Category 5 cable when connecting to a 1000BASE-T-compatible device. Note Use a straight-through cable to connect two ports only when one port is designated with an X. Use a crossover cable to connect two ports when both ports are designated with an X or when both ports do not have an X.B-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix B Connector and Cable Specifications Connector Specifications Figure B-1 10/100/1000 Port Pinouts 10/100 Ports The 10/100 Ethernet ports use standard RJ-45 connectors and Ethernet pinouts with internal crossovers, as shown by an X in the port name. These ports have the transmit (TD) and receive (RD) signals internally crossed so that a twisted-pair straight-through cable and adapter can be attached to the port. Figure B-2 shows the pinout. Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference. 60915 Pin Label 1 4 5 6 7 8 2 3 1 2 3 4 5 6 7 8 TP0+ TP0- TP1+ TP2+ TP2- TP1- TP3+ TP3-Appendix B Connector and Cable Specifications Connector Specifications B-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 When connecting 10/100 ports to compatible devices such as servers, workstations, and routers, you can use a two or four twisted-pair straight-through cable wired for 10BASE-T and 100BASE-TX. Figure B-5 shows the two twisted-pair straight-through cable schematics. Figure B-7 shows the four twisted-pair straight-through cable schematics. When connecting the ports to other devices, such as switches or repeaters, you can use a two or four twisted-pair crossover cable. Figure B-6 shows the two twisted-pair crossover cable schematics. Figure B-7 shows the four twisted-pair crossover cable schematics. You can use Category 3, 4, or 5 cabling when connecting to 10BASE-T-compatible devices. You must use Category 5 cabling when connecting to 100BASE-TX-compatible devices. Note Use a straight-through cable to connect two ports only when one port is designated with an X. Use a crossover cable to connect two ports when both ports are designated with an X or when both ports do not have an X. Figure B-2 10/100 Port Pinouts H5318 Pin Label 1 4 5 6 7 8 2 3 1 2 3 4 5 6 7 8 RD+ RDTD+ NC NC TDNC NCB-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix B Connector and Cable Specifications Connector Specifications SFP Module Ports The Catalyst 3750 switch uses SFP modules for fiber-optic and copper uplink ports. Refer to the Catalyst 3750 release notes for a list of supported SFP modules. Figure B-3 Fiber-Optic SFP Module LC Connector Warning Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments. Figure B-4 Copper SFP Module RJ-45 Connector 58476 60915 Pin Label 1 4 5 6 7 8 2 3 1 2 3 4 5 6 7 8 TP0+ TP0- TP1+ TP2+ TP2- TP1- TP3+ TP3-Appendix B Connector and Cable Specifications Cable and Adapter Specifications B-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Console Port The console port uses an 8-pin RJ-45 connector, which is described in Table B- 1 and Table B- 2. The supplied RJ-45-to-DB-9 adapter cable is used to connect the console port of the switch to a console PC. You need to provide a RJ-45-to-DB-25 female DTE adapter if you want to connect the switch console port to a terminal. You can order a kit (part number ACS-DSBUASYN=) containing that adapter from Cisco. For console port and adapter pinout information, see Table B-1 and Table B-2. Cable and Adapter Specifications These sections describe the cables and adapters used with Catalyst 3750 switches. Two Twisted-Pair Cable Pinouts Figure B-5 and Figure B-6 show the schematics of two twisted-pair cables for 10/100 ports. Figure B-5 Two Twisted-Pair Straight-Through Cable Schematic Figure B-6 Two Twisted-Pair Crossover Cable Schematic Switch 3 TD+ 6 TD– 1 RD+ 2 RD– Switch 3 RD+ 6 RD– 1 TD+ 2 TD– H5578 Switch 3 TD+ 6 TD– 1 RD+ 2 RD– Switch 3 TD+ 6 TD– 1 RD+ 2 RD– H5579B-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix B Connector and Cable Specifications Cable and Adapter Specifications Four Twisted-Pair Cable Pinouts for 10/100 Ports Figure B-7 and Figure B-8 show the schematics of four twisted-pair cables for 10/100 ports. Figure B-7 Four Twisted-Pair Straight-Through Cable Schematic for 10/100 Ports Figure B-8 Four Twisted-Pair Crossover Cable Schematic for 10/100 Ports 1 RD+ 2 RD- 3 TD+ 6 TD- 1 TD+ Switch Switch 2 TD- 3 RD+ 6 RD- 4 NC 5 NC 7 NC 8 NC 4 NC 5 NC 7 NC 8 NC 65271 1 RD+ 2 RD- 3 TD+ 6 TD- 1 RD+ MT 10/100 Switch/Hub 2 RD- 3 TD+ 6 TD- 4 NC 5 NC 7 NC 8 NC 4 NC 5 NC 7 NC 8 NC 65273Appendix B Connector and Cable Specifications Cable and Adapter Specifications B-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Four Twisted-Pair Cable Pinouts for 1000BASE-T Ports Figure B-9 and Figure B-10 show the schematics of four twisted-pair cables for 10/100/1000 ports on Catalyst 3750 switches. Figure B-9 Four Twisted-Pair Straight-Through Cable Schematic for 10/100/1000 Ports Figure B-10 Four Twisted-Pair Crossover Cable Schematics for 10/100/1000 Ports 1 TPO+ 2 TPO- 3 TP1+ 6 TP1- 1 TP1+ Switch Switch 2 TP1- 3 TPO+ 6 TPO- 4 TP2+ 5 TP2- 7 TP3+ 8 TP3- 4 TP3+ 5 TP3- 7 TP2+ 8 TP2- 65272 1 TPO+ 2 TPO- 3 TP1+ 6 TP1- 1 TP0+ Switch Switch 2 TP0- 3 TP1+ 6 TP1- 4 TP2+ 5 TP2- 7 TP3+ 8 TP3- 4 TP2+ 5 TP2- 7 TP3+ 8 TP3- 65274B-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix B Connector and Cable Specifications Cable and Adapter Specifications Crossover Cable and Adapter Pinouts This section describes how to identify a crossover cable and also describes the adapter pinouts. Identifying a Crossover Cable To identify a crossover cable, compare the two modular ends of the cable. Hold the cable ends side-by-side, with the tab at the back. The wire connected to the pin on the outside of the left plug should be the same color as the wire connected to the pin on the outside of the right plug. (See Figure B-11.) Figure B-11 Identifying a Crossover Cable Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command in the CLI to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100 or 10/100/1000 port on the switch, regardless the type of device on the other end of the connection. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference. Pin 1 H10632 Pin 8 Pin 1 on one connector and pin 8 on the other connector should be the same color.Appendix B Connector and Cable Specifications Cable and Adapter Specifications B-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Adapter Pinouts Table B-1 lists the pinouts for the console port, the RJ-45-to-DB-9 adapter cable, and the console device. Table B-2 lists the pinouts for the console port, RJ-45-to-DB-25 female DTE adapter, and the console device. Note The RJ-45-to-DB-25 female DTE adapter is not supplied with the switch. You can order a kit (part number ACS-DSBUASYN=) containing this adapter from Cisco. Table B-1 Console Port Signaling Using a DB-9 Adapter Switch Console Port (DTE) RJ-45-to-DB-9 Terminal Adapter Console Device Signal DB-9 Pin Signal RTS 8 CTS DTR 6 DSR TxD 2 RxD GND 5 GND GND 5 GND RxD 3 TxD DSR 4 DTR CTS 7 RTS Table B-2 Console Port Signaling Using a DB-25 Adapter Switch Console Port (DTE) RJ-45-to-DB-25 Terminal Adapter Console Device Signal DB-25 Pin Signal RTS 5 CTS DTR 6 DSRB-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix B Connector and Cable Specifications Cable and Adapter Specifications TxD 3 RxD GND 7 GND GND 7 GND RxD 2 TxD DSR 20 DTR CTS 4 RTS Table B-2 Console Port Signaling Using a DB-25 Adapter (continued) Switch Console Port (DTE) RJ-45-to-DB-25 Terminal Adapter Console Device Signal DB-25 Pin SignalAppendix B Connector and Cable Specifications Cable and Adapter Specifications B-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02C-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X C Managing the Switch by Using the Cluster Management Suite This appendix describes the requirements for using the web-based Cluster Management Suite (CMS) tools. See these sections for information about running CMS and the CMS requirements: • Connecting to an Ethernet Port, page C-2 • Launching the Switch Home Page, page C-3 • CMS Requirements, page C-5 This appendix assumes that you have already assigned an IP address to your switch. If you have not, configure the switch as described in Chapter 1, “Using Express Setup” or in Appendix D, “Quick Setup By Using the CLI-Based Setup Program.” After you have assigned an IP address to the switch and installed the Java plug-in, you can access the switch from your browser and use the CMS to configure the switch. Note If you have downloaded a new version of CMS, you must clear your browser cache before launching the new version. When you clear the cache, all the jar_cache*.tmp CMS files are removed from the temporary directory. Appendix C Managing the Switch by Using the Cluster Management Suite Connecting to an Ethernet Port C-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Connecting to an Ethernet Port Follow these steps to connect to an 10/100 or 10/100/1000 Ethernet port: Step 1 Connect a Category 5 straight-through cable (not supplied) to an 10/100 or 10/100/1000 port on the front panel of a switch. See Figure C-1. Step 2 Connect the other end of the cable to the Ethernet (RJ-45) port of the workstation, PC, server, or router. For information on connecting to the SFP ports, see the “Connecting to an SFP Module” section on page 3-46. Figure C-1 Connecting a Front Panel Port Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 1 3 86832 2 1 Catalyst 3750 switches 3 Category 5 straight-through cable 2 PCC-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix C Managing the Switch by Using the Cluster Management Suite Launching the Switch Home Page Launching the Switch Home Page To display the switch access page, follow these steps: Step 1 Enter the switch IP address in the browser, and press Return. Step 2 Enter your username and password when prompted. If no username is configured on your switch (the default), enter only the enable password in the password field. The switch home page appears, as shown in Figure C-2. Figure C-2 Switch Home PageAppendix C Managing the Switch by Using the Cluster Management Suite Launching the Switch Home Page C-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Step 3 Click Cluster Management Suite to launch the CMS interface. The CMS Setup Report runs and verifies that your PC or workstation can correctly run the CMS. If you are running an unsupported operating system, web browser, Java plug-in, or if the Java plug-in is not enabled, the CMS Setup Report page appears, as shown in Figure C-3. Figure C-3 CMS Setup Report The CMS Setup Report has links that instruct you how to configure your PC or workstation to run CMS. When your PC or workstation is correctly configured, CMS launches, as shown in Figure C-4. Note If your PC or workstation is correctly configured for CMS, you do not see the CMS Setup Report.C-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix C Managing the Switch by Using the Cluster Management Suite CMS Requirements Figure C-4 CMS Front Panel View For more information about the CMS, refer to the software configuration guide or to the online help. CMS Requirements These sections list the recommended platform configurations and supported operating systems, web browsers, and Java plug-ins for running CMS: • Operating System and Browser Support, page C-6 • Operating System and Browser Support, page C-6 • Supported Java Plug-Ins, page C-7Appendix C Managing the Switch by Using the Cluster Management Suite CMS Requirements C-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Recommended Configuration for Web-Based Management Table C-1 lists the recommended platforms for web-based management. The minimum PC requirement is a Pentium processor running at 233 MHz with 64 MB of DRAM. The minimum UNIX workstation requirement is a Sun Ultra 1 running at 143 MHz with 64 MB of DRAM. Note These are only the recommended configurations for running the CMS. For information about all supported operating systems, see the next section. Operating System and Browser Support You can access CMS by using the operating systems and browsers listed in Table C-2. CMS checks the browser version when starting a session to ensure that the browser is supported. Table C-1 Recommended Platform Configuration for Web-Based Management OS Processor Speed DRAM Number of Colors Resolution Font Size Windows NT 4.0 1 1. Service Pack 3 or higher is required. Pentium 300 MHz 128 MB 65,536 1024 x 768 Small Solaris 2.5.1 or higher SPARC 333 MHz 128 MB Most colors for applications — Small (3)C-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix C Managing the Switch by Using the Cluster Management Suite CMS Requirements Supported Java Plug-Ins One of these Java plug-ins is required for the browser to access and run the Java-based CMS: • Java plug-in 1.4 • Java plug-in 1.3.1 These Java plug-ins are supported both in Windows environments and on Solaris platforms. You can download the plug-ins and installation instructions from this URL: http://www.cisco.com/pcgi-bin/tablebuild.pl/java Note Only one of these Java plug-ins is required for CMS. Do not install more than one. On Solaris platforms, follow the instructions in the README_FIRST.txt file to install the Java plug-in. Table C-2 Supported Operating Systems and Browsers Operating System Minimum Service Pack or Patch Netscape Communicator 1 Microsoft Internet Explorer 2 Windows 95 Service Pack 1 4.75 or 6.2 5.5 or 6.0 Windows 98 Second Edition 4.75 or 6.2 5.5 or 6.0 Windows NT 4.0 Service Pack 3 or later 4.75 or 6.2 5.5 or 6.0 Windows 2000 None 4.75 or 6.2 5.5 or 6.0 Windows XP None 4.75 or 6.2 5.5 or 6.0 Solaris 2.5.1 or later Sun-recommended patch cluster for the OS and Motif library patch 103461-24 4.75 or 6.2 Not supported 1. Netscape Communicator version 6.0 is not supported. 2. Service Pack 1 or higher is required for Internet Explorer 5.5.Appendix C Managing the Switch by Using the Cluster Management Suite Where to Go Next C-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Java Plug-In Notes These notes apply to the Java plug-in configuration: • To verify that a supported version of the Java plug-in is installed, select Start > Settings > Control Panel. The Java plug-in is listed with the version number in the Control Panel menu. • If you have installed the Java plug-in but CMS still does not launch, make sure that the plug-in is enabled by selecting Start > Settings > Control Panel > Java Plug-in. Click the Basic tab, select Enable Java Plug-in, and click Apply. • If the Java applet does not initialize after you have installed and enabled the plug-in, open the Java Plug-in Control Panel (Start > Programs > Java Plug-in Control Panel), and verify these settings: In the Proxies tab, verify that Use browser settings is checked and that no proxies are enabled. • If you are running an Internet virus checker on Windows 2000 and the plug-in takes a long time to load, you can speed up CMS operation by disabling the virus checker filter option, the download option, or both. From the Start menu on McAfee VirusScan, disable the VirusScan Internet Filter option, the Download Scan option, or both by selecting Start > Programs > Network Associates > Virus Scan Console > Configure. or From the taskbar, right-click the Virus Shield icon and in the Quick Enable menu, disable the options by deselecting Internet Filter or Download Scan. Where to Go Next For more information about the CMS, refer to the software configuration guide or to the online help.D-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X D Quick Setup By Using the CLI-Based Setup Program This chapter provides a quick step-by-step installation and setup procedure for a standalone switch or a switch stack. Note For detailed installation procedures on rack-mounting your switch, stacking your switches, or connecting to the small form-factor pluggable (SFP) modules, see Chapter 3, “Switch Installation.” For product overview information, see Chapter 2, “Product Overview.” These steps describe how to do a simple installation: 1. Methods for Accessing the CLI, page D-2 2. Taking Out What You Need, page D-4 3. Stacking the Switches (Optional), page D-5 4. Connecting to the Console Port, page D-7 5. Starting the Terminal Emulation Software, page D-9 6. Connecting to a Power Source, page D-9 7. Entering the Initial Configuration Information, page D-10Appendix D Quick Setup By Using the CLI-Based Setup Program Methods for Accessing the CLI D-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Methods for Accessing the CLI You can access the CLI by these methods: • Accessing the CLI Through Express Setup (Unconfigured Switch Only), page D-2 • Accessing the CLI Through the Console Port, page D-3 Accessing the CLI Through Express Setup (Unconfigured Switch Only) Note Express Setup is supported on switches running Cisco IOS Release 12.1(14)EA1 or later. If you are installing a new switch, refer to the Cisco IOS release label on the rear panel of the switch to determine the release. For switches running releases earlier than Cisco IOS Release 12.1(14)EA1, go to the “Taking Out What You Need” section on page D-4. You can access the CLI on an unconfigured switch by placing the switch in Express Setup mode and then connecting an Ethernet port of the switch to the Ethernet port of your PC or workstation. To put the switch into Express Setup mode, follow the steps described in these sections of Chapter 1, “Using Express Setup”: • Taking Out What You Need, page 1-2 • Powering On the Switch, page 1-3 • Starting Express Setup, page 1-4 After the switch is in Express Setup mode, Telnet to the switch by using the IP address 10.0.0.1, and enter the setup user EXEC command. See these sections in this chapter to then configure the switch by using the CLI: • Entering the Initial Configuration Information, page D-10 • Completing the Setup Program, page D-11 After you have entered the configuration information for the switch, save it to Flash memory by using the write memory privileged EXEC command. D-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Methods for Accessing the CLI Note While in Express Setup mode, the IP address 10.0.0.1 remains active on the switch until you enter the write memory command. You lose the Telnet connection after entering the write memory command. For more information about using the CLI, refer to the command reference for this release. Accessing the CLI Through the Console Port You can access the CLI by connecting the console port of the switch to the serial port on your PC or workstation and access the switch through a Telnet session. To access the switch through the console port, follow the steps in the rest of this chapter, beginning with the “Taking Out What You Need” section on page D-4.Appendix D Quick Setup By Using the CLI-Based Setup Program Taking Out What You Need D-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Taking Out What You Need Remove the items shown in Figure D-1 from the shipping container: Figure D-1 The Catalyst 3750 Switch, Adapter Cable, AC Power Cord, and the StackWise Cable 1 Catalyst 3750 switch 3 AC power cord 2 RJ-45-to-DB-9 adapter cable 4 StackWise cable (optional) Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 13X 14X 23X 24X 1X 2X 11X 12X 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 1 2 3 4 90533D-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Stacking the Switches (Optional) Note You need to provide the Category 5 straight-through cables to connect the switch ports to other Ethernet devices. Note On switches running Cisco IOS Release 12.1(14)EA1 or later, you can use the mdix auto command to enable the automatic crossover feature. When the automatic crossover feature is enabled, the switch detects the required cable type and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for all connections to an Ethernet port on the switch. The automatic crossover feature is disabled by default. For configuration information for this feature, refer to the switch software configuration guide or the switch command reference. Stacking the Switches (Optional) You can stack up to nine switches by using the StackWise cables and ports to connect the switches. Read the “Planning the Stack” section on page 3-12 before you stack your switches. Figure D-2 Stacking the Switches RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE 90529Appendix D Quick Setup By Using the CLI-Based Setup Program Stacking the Switches (Optional) D-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Step 1 Insert one end of the StackWise cable into the StackWise port at the back of a switch. See Figure D-3. Note Always use a Cisco-approved StackWise cable to connect the switches. Step 2 Use the window in the StackWise cable to align the connector correctly. Secure the screws tightly. Step 3 Insert the other end of the cable into the connector of the other switch, and secure the screws tightly. See the “Connecting StackWise Cable to StackWise Ports” section on page 3-37 for detailed installation procedures on how to connect the switches in a stack. Figure D-3 Connecting the StackWise Cable to a StackWise Port CONSOLE STACK 1 STACK 2 90530D-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Connecting to the Console Port Connecting to the Console Port You can use the console port to perform the initial configuration. To connect the switch console port to a PC, use the supplied RJ-45-to-DB-9 adapter cable. Note If you have stacked your switches, connect to the console port of one of the switches in the stack. The initial configuration for the entire stack can be performed on any switch in the stack. Follow these steps to connect the PC or terminal to the switch: Step 1 Using the supplied RJ-45-to-DB-9 adapter cable, insert the RJ-45 connector into the console port on the rear of a switch, as shown in Figure D-4. Step 2 Attach the DB-9 female DTE of the adapter cable to a PC’s serial port, or attach an appropriate adapter to the terminal.Appendix D Quick Setup By Using the CLI-Based Setup Program Connecting to the Console Port D-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Figure D-4 Connecting a Switch to a PC 1 Catalyst 3750 switches 3 RJ-45-to-DB-9 adapter cable 2 Power cord RATING 100-200V ~ 1.6A-0>9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MA +12v NUAL @8.5a CONSOLE RATING 100-200V 1.6A-0>9A ~ , 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN MANUAL +12v @8.5a CONSOLE RATING 100-200V 1.6A-0> ~ 9A, 50-60 HZ DC INPUTS FOR REMOTE POWER SUPPLY SPECIFIED IN M +12v @8.5a ANUAL CONSOLE 1 2 3 90531D-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Starting the Terminal Emulation Software Starting the Terminal Emulation Software Before you power on the switch, start the terminal emulation session so that you can see the output display from the power-on self-test (POST). The terminal-emulation software—frequently a PC application such as Hyperterminal or ProcommPlus—makes communication between the switch and your PC or terminal possible. Step 1 Start the terminal-emulation program if you are using a PC or terminal. Step 2 Start a terminal-emulation session. Step 3 Configure the baud rate and character format of the PC or terminal to match these console port default characteristics: • 9600 baud • 8 data bits • 1 stop bit • No parity • None (flow control) Connecting to a Power Source Follow these steps to connect to a power source: Step 1 Connect one end of the supplied AC power cord to the power connector on a switch rear panel. See Figure D-4. Step 2 Connect the other end of the power cable to a grounded AC outlet. Step 3 (Optional) If you have a stack, power on all the switches in the stack. Note If you have stacked your switches, refer to the “Powering Considerations” section on page 3-13 for more information.Appendix D Quick Setup By Using the CLI-Based Setup Program Entering the Initial Configuration Information D-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Note If you are connecting the switch to a Cisco redundant power system (RPS), refer to the documentation that shipped with your RPS. As the switch powers on, it begins POST, a series of tests that run automatically to ensure that the switch functions properly. If POST fails, see Chapter 4, “Troubleshooting,” to determine a course of action. After you have powered all the switches in the stack, a switch is elected as the stack master. The master LED is green on the stack master switch. If you started the terminal emulation program before you powered on your switch, the PC or terminal displays the bootloader sequence. You need to press Enter to display the setup program prompt. Entering the Initial Configuration Information To set up the switch, you need to complete the setup program, which runs automatically after the switch is powered up. You must assign an IP address and other configuration information necessary for the switch to communicate with the local routers and the Internet. This information is also required if you plan to use the Cluster Management Suite (CMS) to configure and manage the switch. IP Settings You will need this information from your network administrator before you complete the setup program: • Switch IP address • Subnet mask (IP netmask) • Default gateway (router) • Enable secret password • Enable password • Telnet passwordD-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Entering the Initial Configuration Information Completing the Setup Program Note If your switches are stacked and there are multiple console connections to individual switches in the stack, the initial setup dialog appears in the first console where the user presses Enter. Follow these steps to complete the setup program and to create an initial configuration for the switch: Step 1 Enter Yes at the following two prompts. Would you like to enter the initial configuration dialog? [yes/no]: yes At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system. Would you like to enter basic management setup? [yes/no]: yes Step 2 Enter a host name for the switch, and press Return. On a command switch, the host name is limited to 28 characters; on a member switch to 31 characters. Do not use -n, where n is a number, as the last character in a host name for any switch. Enter host name [Switch]: host_name Step 3 Enter an enable secret password, and press Return. The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows spaces, but ignores leading spaces. The secret password is encrypted and the enable password is in plain text. Enter enable secret: secret_password Step 4 Enter an enable password, and press Return. Enter enable password: enable_passwordAppendix D Quick Setup By Using the CLI-Based Setup Program Entering the Initial Configuration Information D-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Step 5 Enter a virtual terminal (Telnet) password, and press Return. The password can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces. Enter virtual terminal password: terminal-password Step 6 (Optional) Configure Simple Network Management Protocol (SNMP) by responding to the prompts. You can also configure SNMP later through the CLI or CMS interface. To configure SNMP later type no. Configure SNMP Network Management? [no]: no Step 7 Enter the interface name (physical interface or VLAN name) of the interface that connects to the management network, and press Return. For this release, always use vlan1 as that interface. Enter interface name used to connect to the management network from the above interface summary: vlan1 Step 8 Configure the interface by entering the switch IP address and subnet mask and pressing Return. The IP address and subnet masks shown below are examples. Configuring interface vlan1: Configure IP on this interface? [yes]: yes IP address for this interface: 10.4.120.106 Subnet mask for this interface [255.0.0.0]: 255.0.0.0 Step 9 Enter Y to configure the switch as the cluster command switch. Enter N to configure it as a member switch or as a standalone switch. If you enter N, the switch appears as a candidate switch in the CMS. You can configure the switch as a command switch later through the CLI or CMS interface. To configure it later type no. Would you like to enable as a cluster command switch? [yes/no]: no You have now completed the initial configuration of the switch and the switch displays its initial configuration. This is an example of output that appears: The following configuration command script was created: hostname switch1 enable secret 5 $1$Ulq8$DlA/OiaEbl90WcBPd9cOn1 enable password enable_password line vty 0 15 password terminal-password no snmp-server ! no ip routingD-13 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix D Quick Setup By Using the CLI-Based Setup Program Entering the Initial Configuration Information ! interface Vlan1 no shutdown ip address 10.4.120.106 255.0.0.0 ! interface FastEthernet1/0/1 ! interface FastEthernet1/0/2 interface FastEthernet1/0/3 ! ...

! interface GigabitEthernet2/0/28 ! end Step 10 These choices are displayed: [0] Go to the IOS command prompt without saving this config. [1] Return back to the setup without saving this config. [2] Save this configuration to nvram and exit. If you want to save the configuration and use it the next time the switch reboots, save it in nonvolatile RAM (NVRAM) by selecting option 2. Enter your selection [2]:2 Make your selection, and press Return. After you complete the setup program, the switch can run the default configuration that you created. If you want to change this configuration or want to perform other management tasks, use one of these tools: • Command-line interface (CLI) • CMS from your browserAppendix D Quick Setup By Using the CLI-Based Setup Program Entering the Initial Configuration Information D-14 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 To use the CLI, enter commands at the Switch> prompt through the console port by using a terminal program or through the network by using telnet. For configuration information, refer to the switch software configuration guide or the switch command reference. To use the CMS, go to Appendix C, “Managing the Switch by Using the Cluster Management Suite.”E-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 A P P E N D I X E Translated Safety Warnings This appendix repeats in multiple languages the warnings in this guide. These translated warnings can be used with other documents related to this guide. Attaching the Cisco RPS (model PWR300-AC-RPS-N1) Warning Attach only the Cisco RPS (model PWR300-AC-RPS-N1) to the RPS receptacle. Waarschuwing Slechts de Cisco RPS (model PWR300-AC-RPS-N1) aan de RPS contactdoos verbinden. Varoitus Kiinnitä RPS-vastakappaleeseen vain Cisco RPS (malli PWR300-AC-RPS-N1). Avertissement Raccordez le bloc d’alimentation Cisco RPS (modèle PWR300-AC-RPS-N1) uniquement au connecteur RPS. Warnung An die RPS-Steckhülse darf nur das Cisco RPS (Modell PWR300-AC-RPS-N1) angeschlossen werden. Avvertenza Collegare soltanto il Cisco RPS (modello PWR300-AC-RPS-N1) alla presa RPS.Appendix E Translated Safety Warnings Attaching the Cisco RPS (model PWR675-AC-RPS-N1) E-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Attaching the Cisco RPS (model PWR675-AC-RPS-N1) Advarsel! Koble bare Cisco RPS (modell PWR300-AC-RPS-N1) til RPS-stikkontakten. Aviso Anexe o RPS Cisco (modelo PWR300-AC-RPS-N1) apenas ao receptáculo RPS. ¡Advertencia! Sólo conecte el Cisco RPS (modelo PWR300-AC-RPS-N1) al receptáculo RPS. Varning! Koppla endast Ciscos RPS (modell PWR300-AC-RPS-N1) till RPS-uttaget. Warning Attach only the Cisco RPS (model PWR675-AC-RPS-N1) to the RPS receptacle. Waarschuwing Slechts de Cisco RPS (model PWR675-AC-RPS-N1) aan de RPS contactdoos verbinden. Varoitus Kiinnitä RPS-vastakappaleeseen vain Cisco RPS (malli PWR675-AC-RPS-N1).E-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Attaching the Cisco RPS (model PWR675-AC-RPS-N1) Avertissement Raccordez le bloc d’alimentation Cisco RPS (modèle PWR675-AC-RPS-N1) uniquement au connecteur RPS. Warnung An die RPS-Steckhülse darf nur das Cisco RPS (Modell PWR675-AC-RPS-N1) angeschlossen werden. Avvertenza Collegare soltanto il Cisco RPS (modello PWR675-AC-RPS-N1) alla presa RPS. Advarsel! Koble bare Cisco RPS (modell PWR675-AC-RPS-N1) til RPS-stikkontakten. Aviso Anexe o RPS Cisco (modelo PWR675-AC-RPS-N1) apenas ao receptáculo RPS. ¡Advertencia! Sólo conecte el Cisco RPS (modelo PWR675-AC-RPS-N1) al receptáculo RPS. Varning! Koppla endast Ciscos RPS (modell PWR675-AC-RPS-N1) till RPS-uttaget.Appendix E Translated Safety Warnings Installation Warning E-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Installation Warning Warning Only trained and qualified personnel should be allowed to install, replace, or service this equipment. Waarschuwing Deze apparatuur mag alleen worden geïnstalleerd, vervangen of hersteld door bevoegd geschoold personeel. Varoitus Tämän laitteen saa asentaa, vaihtaa tai huoltaa ainoastaan koulutettu ja laitteen tunteva henkilökunta. Attention Il est vivement recommandé de confier l'installation, le remplacement et la maintenance de ces équipements à des personnels qualifiés et expérimentés. Warnung Das Installieren, Ersetzen oder Bedienen dieser Ausrüstung sollte nur geschultem, qualifiziertem Personal gestattet werden. Avvertenza Questo apparato può essere installato, sostituito o mantenuto unicamente da un personale competente. Advarsel Bare opplært og kvalifisert personell skal foreta installasjoner, utskiftninger eller service på dette utstyret. Aviso Apenas pessoal treinado e qualificado deve ser autorizado a instalar, substituir ou fazer a revisão deste equipamento. ¡Advertencia! Solamente el personal calificado debe instalar, reemplazar o utilizar este equipo. Varning! Endast utbildad och kvalificerad personal bör få tillåtelse att installera, byta ut eller reparera denna utrustning.E-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Installation Instructions Installation Instructions Warning Read the installation instructions before connecting the system to the power source. Waarschuwing Raadpleeg de installatie-instructies voordat u het systeem op de voedingsbron aansluit. Varoitus Lue asennusohjeet ennen järjestelmän yhdistämistä virtalähteeseen. Attention Avant de brancher le système sur la source d'alimentation, consulter les directives d'installation. Warnung Vor dem Anschließen des Systems an die Stromquelle die Installationsanweisungen lesen. Avvertenza Consultare le istruzioni di installazione prima di collegare il sistema all'alimentatore. Advarsel Les installasjonsinstruksjonene før systemet kobles til strømkilden. Aviso Leia as instruções de instalação antes de ligar o sistema à fonte de energia. ¡Advertencia! Lea las instrucciones de instalación antes de conectar el sistema a la red de alimentación. Varning! Läs installationsanvisningarna innan du kopplar systemet till strömförsörjningsenheten.Appendix E Translated Safety Warnings Jewelry Removal Warning E-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Jewelry Removal Warning Warning Before working on equipment that is connected to power lines, remove jewelry (including rings, necklaces, and watches). Metal objects will heat up when connected to power and ground and can cause serious burns or weld the metal object to the terminals. Waarschuwing Alvorens aan apparatuur te werken die met elektrische leidingen is verbonden, sieraden (inclusief ringen, kettingen en horloges) verwijderen. Metalen voorwerpen worden warm wanneer ze met stroom en aarde zijn verbonden, en kunnen ernstige brandwonden veroorzaken of het metalen voorwerp aan de aansluitklemmen lassen. Varoitus Ennen kuin työskentelet voimavirtajohtoihin kytkettyjen laitteiden parissa, ota pois kaikki korut (sormukset, kaulakorut ja kellot mukaan lukien). Metalliesineet kuumenevat, kun ne ovat yhteydessä sähkövirran ja maan kanssa, ja ne voivat aiheuttaa vakavia palovammoja tai hitsata metalliesineet kiinni liitäntänapoihin. Attention Avant d’accéder à cet équipement connecté aux lignes électriques, ôter tout bijou (anneaux, colliers et montres compris). Lorsqu’ils sont branchés à l’alimentation et reliés à la terre, les objets métalliques chauffent, ce qui peut provoquer des blessures graves ou souder l’objet métallique aux bornes.E-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Jewelry Removal Warning Warnung Vor der Arbeit an Geräten, die an das Netz angeschlossen sind, jeglichen Schmuck (einschließlich Ringe, Ketten und Uhren) abnehmen. Metallgegenstände erhitzen sich, wenn sie an das Netz und die Erde angeschlossen werden, und können schwere Verbrennungen verursachen oder an die Anschlußklemmen angeschweißt werden. Avvertenza Prima di intervenire su apparecchiature collegate alle linee di alimentazione, togliersi qualsiasi monile (inclusi anelli, collane, braccialetti ed orologi). Gli oggetti metallici si riscaldano quando sono collegati tra punti di alimentazione e massa: possono causare ustioni gravi oppure il metallo può saldarsi ai terminali. Advarsel Fjern alle smykker (inkludert ringer, halskjeder og klokker) før du skal arbeide på utstyr som er koblet til kraftledninger. Metallgjenstander som er koblet til kraftledninger og jord blir svært varme og kan forårsake alvorlige brannskader eller smelte fast til polene. Aviso Antes de trabalhar em equipamento que esteja ligado a linhas de corrente, retire todas as jóias que estiver a usar (incluindo anéis, fios e relógios). Os objectos metálicos aquecerão em contacto com a corrente e em contacto com a ligação à terra, podendo causar queimaduras graves ou ficarem soldados aos terminais. ¡Advertencia! Antes de operar sobre equipos conectados a líneas de alimentación, quitarse las joyas (incluidos anillos, collares y relojes). Los objetos de metal se calientan cuando se conectan a la alimentación y a tierra, lo que puede ocasionar quemaduras graves o que los objetos metálicos queden soldados a los bornes. Varning! Tag av alla smycken (inklusive ringar, halsband och armbandsur) innan du arbetar på utrustning som är kopplad till kraftledningar. Metallobjekt hettas upp när de kopplas ihop med ström och jord och kan förorsaka allvarliga brännskador; metallobjekt kan också sammansvetsas med kontakterna.Appendix E Translated Safety Warnings Stacking the Chassis Warning E-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Stacking the Chassis Warning Warning Do not stack the chassis on any other equipment. If the chassis falls, it can cause severe bodily injury and equipment damage. Waarschuwing Het chassis mag niet op andere apparatuur gestapeld te worden. Als het chassis mocht vallen, kan dit ernstig lichamelijk letsel en beschadiging van de apparatuur veroorzaken. Varoitus Älä aseta asennuspohjaa minkään muun laitteen päälle. Asennuspohja voi pudotessaan aiheuttaa vaikean ruumiinvamman tai laitevaurion. Avertissement Ne placez pas ce châssis sur un autre appareil. En cas de chute, il pourrait provoquer de graves blessures corporelles et d'importants dommages. Achtung Das Gehäuse nicht auf andere Geräte stellen. Wenn das Gehäuse herunterfällt, besteht Gefahr schwerer Personenverletzungen und Geräteschäden.E-9 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Stacking the Chassis Warning Avvertenza Non collocare lo chassis su nessun altro apparecchio. Se lo chassis cade, può causare lesioni gravi e danni alle apparecchiature. Advarsel Stable ikke kabinettet oppå annet utstyr. Hvis kabinettet faller, kan det forårsake alvorlig skade på mennesker og utstyr. Aviso Não coloque o chassis em cima de qualquer outro equipamento. Se o chassis cair, poderá causar ferimentos graves e danos no equipamento. ¡Atención! No apilar los chasis sobre ningún otro equipo. Si el chasis se cae al suelo puede causar graves lesiones físicas y daños al equipo. Varning Placera inte chassit ovanpå annan utrustning. Om chassit faller kan allvarlig kroppsskada såväl som skada på utrustningen uppstå.Appendix E Translated Safety Warnings Main Disconnecting Device E-10 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Main Disconnecting Device Warning The plug-socket combination must be accessible at all times, because it serves as the main disconnecting device. Waarschuwing De combinatie van de stekker en het elektrisch contactpunt moet te allen tijde toegankelijk zijn omdat deze het hoofdmechanisme vormt voor verbreking van de aansluiting. Varoitus Pistoke/liitinkohta toimii pääkatkaisumekanismina. Pääsy siihen on pidettävä aina esteettömänä. Attention La combinaison de prise de courant doit être accessible à tout moment parce qu'elle fait office de système principal de déconnexion. Warnung Der Netzkabelanschluß am Gerät muß jederzeit zugänglich sein, weil er als primäre Ausschaltvorrichtung dient. Avvertenza Il gruppo spina-presa deve essere sempre accessibile, poiché viene utilizzato come dispositivo di scollegamento principale. Advarsel Kombinasjonen støpsel/uttak må alltid være tilgjengelig ettersom den fungerer som hovedfrakoplingsenhet. Aviso A combinação ficha-tomada deverá ser sempre acessível, porque funciona como interruptor principal. ¡Advertencia! El conjunto de clavija y toma ha de encontrarse siempre accesible ya que hace las veces de dispositivo de desconexión principal. Varning! Man måste alltid kunna komma åt stickproppen i uttaget, eftersom denna koppling utgör den huvudsakliga frånkopplingsanordningen.E-11 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Grounded Equipment Warning Grounded Equipment Warning Warning This equipment is intended to be grounded. Ensure that the host is connected to earth ground during normal use. Waarschuwing Deze apparatuur hoort geaard te worden Zorg dat de host-computer tijdens normaal gebruik met aarde is verbonden. Varoitus Tämä laitteisto on tarkoitettu maadoitettavaksi. Varmista, että isäntälaite on yhdistetty maahan normaalikäytön aikana. Attention Cet équipement doit être relié à la terre. S’assurer que l’appareil hôte est relié à la terre lors de l’utilisation normale. Warnung Dieses Gerät muß geerdet werden. Stellen Sie sicher, daß das Host-Gerät während des normalen Betriebs an Erde gelegt ist. Avvertenza Questa apparecchiatura deve essere collegata a massa. Accertarsi che il dispositivo host sia collegato alla massa di terra durante il normale utilizzo. Advarsel Dette utstyret skal jordes. Forviss deg om vertsterminalen er jordet ved normalt bruk.Appendix E Translated Safety Warnings Installing or Replacing the Unit E-12 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Installing or Replacing the Unit Aviso Este equipamento deverá estar ligado à terra. Certifique-se que o host se encontra ligado à terra durante a sua utilização normal. ¡Advertencia! Este equipo debe conectarse a tierra. Asegurarse de que el equipo principal esté conectado a tierra durante el uso normal. Varning! Denna utrustning är avsedd att jordas. Se till att värdenheten är jordad vid normal användning. Warning When installing or replacing the unit, the ground connection must always be made first and disconnected last. Waarschuwing Bij installatie of vervanging van het toestel moet de aardverbinding altijd het eerste worden gemaakt en het laatste worden losgemaakt. Varoitus Laitetta asennettaessa tai korvattaessa on maahan yhdistäminen aina tehtävä ensiksi ja maadoituksen irti kytkeminen viimeiseksi.E-13 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Installing or Replacing the Unit Attention Lors de l’installation ou du remplacement de l’appareil, la mise à la terre doit toujours être connectée en premier et déconnectée en dernier. Warnung Der Erdanschluß muß bei der Installation oder beim Austauschen der Einheit immer zuerst hergestellt und zuletzt abgetrennt werden. Avvertenza In fase di installazione o sostituzione dell'unità, eseguire sempre per primo il collegamento a massa e disconnetterlo per ultimo. Advarsel Når enheten installeres eller byttes, må jordledningen alltid tilkobles først og frakobles sist. Aviso Ao instalar ou substituir a unidade, a ligação à terra deverá ser sempre a primeira a ser ligada, e a última a ser desligada. ¡Advertencia! Al instalar o sustituir el equipo, conecte siempre la toma de tierra al principio y desconéctela al final. Varning! Vid installation eller utbyte av enheten måste jordledningen alltid anslutas först och kopplas bort sist.Appendix E Translated Safety Warnings Overtemperature Warning E-14 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Overtemperature Warning Warning To prevent the switch from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of 113°F (45°C). To prevent airflow restriction, allow at least 3 inches (7.6 cm) of clearance around the ventilation openings. Waarschuwing Om oververhitting van de schakelaar te voorkomen, mag u die niet bedienen in een ruimte die de maximale aanbevolen omgevingstemperatuur van 113°F (45°C) overschrijdt. Om beperking van de luchtstroom te voorkomen, dient u ten minste 3 inch (7,6 cm) speling te laten rondom de ventilatie-openingen. Varoitus Estääksesi kytkimen ylikuumenemisen älä käytä sitä sellaisissa paikoissa, joiden lämpötila ylittää ympäristön enimmäislämpötilaksi suositellun 45°C. Jätä vähintään 7,6 cm:n vapaa tila tuuletusaukkojen ympärille, jotta ilma pääsee vapaasti virtaamaan. Attention Pour éviter une surchauffe du commutateur, ne pas le faire fonctionner dans un local dont la température ambiante dépasse le maximum recommandé de 45°C (113°F). Pour faciliter la circulation d'air, aménager un dégagement d'au moins 7,6 cm (3 pouces) autour des bouches d'aération. Warnung Um eine Überhitzung des Schalters zu vermeiden, ist das System nicht in einem Bereich zu betreiben, in dem die empfohlene Höchsttemperatur von 45°C überschritten wird. Damit der Luftfluß nicht behindert wird, ist ein Freiraum von mindestens 7,6 cm um die Belüftungsöffnungen herum einzuhalten. Avvertenza Per evitare il surriscaldamento dell’interruttore, non usare l'apparecchiatura in un’area che supera la temperatura ambientale minima consigliata di 45°C. Per evitare una limitazione del flusso dell’aria, lasciare come minimo uno spazio libero di 7,6 cm intorno alle aperture di ventilazione.E-15 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Overtemperature Warning Advarsel For å unngå at bryteren overopphetes skal utstyret ikke brukes på steder hvor anbefalt maks omgivelsestemperatur overstiger 113 grader Farenheit (45°C). La det være minst 3 tommer (7,6 cm) klaring rundt ventilasjonsåpningene for at luftsirkulasjonen skal være uhindret. Aviso Para evitar sobreaquecimento do interruptor, não utilize o equipamento numa àrea que exceda uma temperatura máxima de 45°C. Para evitar o bloqueamento da circulação de ar, deixe pelo menos um espaço de 7.6 cm em volta das aberturas de ventilação. ¡Advertencia! Para evitar que el interruptor se recaliente, no se debe usar en áreas cuya temperatura ambiente exceda la máxima recomendada, esto es, 45°C (113°F). Para no entorpecer la corriente de aire, dejar por lo menos 7,6 cm (3 pulgadas) de espacio muerto alrededor de la rejilla de ventilación. Varning! I syfte att undvika överhettning av switchen skall den inte användas i utrymmen vars temperatur överskrider den maximalt rekommenderade omgivningstemperaturen som är 45°C. Kontrollera att det finns minst 7,6 cm fritt utrymme runt ventilationsöppningarna så att luftflödet inte begränsas.Appendix E Translated Safety Warnings Working During Lightning Activity E-16 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Working During Lightning Activity Warning Do not work on the system or connect or disconnect cables during periods of lightning activity. Waarschuwing Tijdens onweer dat gepaard gaat met bliksem, dient u niet aan het systeem te werken of kabels aan te sluiten of te ontkoppelen. Varoitus Älä työskentele järjestelmän parissa äläkä yhdistä tai irrota kaapeleita ukkosilmalla. Attention Ne pas travailler sur le système ni brancher ou débrancher les câbles pendant un orage. Warnung Arbeiten Sie nicht am System und schließen Sie keine Kabel an bzw. trennen Sie keine ab, wenn es gewittert. Avvertenza Non lavorare sul sistema o collegare oppure scollegare i cavi durante un temporale con fulmini. Advarsel Utfør aldri arbeid på systemet, eller koble kabler til eller fra systemet når det tordner eller lyner.E-17 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Product Disposal Warning Product Disposal Warning Aviso Não trabalhe no sistema ou ligue e desligue cabos durante períodos de mau tempo (trovoada). ¡Advertencia! No operar el sistema ni conectar o desconectar cables durante el transcurso de descargas eléctricas en la atmósfera. Varning! Vid åska skall du aldrig utföra arbete på systemet eller ansluta eller koppla loss kablar. Warning Ultimate disposal of this product should be handled according to all national laws and regulations. Waarschuwing Het uiteindelijke wegruimen van dit product dient te geschieden in overeenstemming met alle nationale wetten en reglementen. Varoitus Tämä tuote on hävitettävä kansallisten lakien ja määräysten mukaisesti.Appendix E Translated Safety Warnings Product Disposal Warning E-18 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Attention La mise au rebut ou le recyclage de ce produit sont généralement soumis à des lois et/ou directives de respect de l'environnement. Renseignez-vous auprès de l'organisme compétent. Warnung Die Entsorgung dieses Produkts sollte gemäß allen Bestimmungen und Gesetzen des Landes erfolgen. Avvertenza Lo smaltimento di questo prodotto deve essere eseguito secondo le leggi e regolazioni locali. Advarsel Endelig kassering av dette produktet skal være i henhold til alle relevante nasjonale lover og bestemmelser. Aviso Deitar fora este produto em conformidade com todas as leis e regulamentos nacionais. ¡Advertencia! Al deshacerse por completo de este producto debe seguir todas las leyes y reglamentos nacionales. Varning! Vid deponering hanteras produkten enligt gällande lagar och bestämmelser. E-19 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Chassis Warning for Rack-Mounting and Servicing Chassis Warning for Rack-Mounting and Servicing Warning To prevent bodily injury when mounting or servicing this unit in a rack, you must take special precautions to ensure that the system remains stable. The following guidelines are provided to ensure your safety: • This unit should be mounted at the bottom of the rack if it is the only unit in the rack. • When mounting this unit in a partially filled rack, load the rack from the bottom to the top with the heaviest component at the bottom of the rack. • If the rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack. Waarschuwing Om lichamelijk letsel te voorkomen wanneer u dit toestel in een rek monteert of het daar een servicebeurt geeft, moet u speciale voorzorgsmaatregelen nemen om ervoor te zorgen dat het toestel stabiel blijft. De onderstaande richtlijnen worden verstrekt om uw veiligheid te verzekeren: • Dit toestel dient onderaan in het rek gemonteerd te worden als het toestel het enige in het rek is. • Wanneer u dit toestel in een gedeeltelijk gevuld rek monteert, dient u het rek van onderen naar boven te laden met het zwaarste onderdeel onderaan in het rek. • Als het rek voorzien is van stabiliseringshulpmiddelen, dient u de stabilisatoren te monteren voordat u het toestel in het rek monteert of het daar een servicebeurt geeft. Varoitus Kun laite asetetaan telineeseen tai huolletaan sen ollessa telineessä, on noudatettava erityisiä varotoimia järjestelmän vakavuuden säilyttämiseksi, jotta vältytään loukkaantumiselta. Noudata seuraavia turvallisuusohjeita: • Jos telineessä ei ole muita laitteita, aseta laite telineen alaosaan. • Jos laite asetetaan osaksi täytettyyn telineeseen, aloita kuormittaminen sen alaosasta kaikkein raskaimmalla esineellä ja siirry sitten sen yläosaan. • Jos telinettä varten on vakaimet, asenna ne ennen laitteen asettamista telineeseen tai sen huoltamista siinä.Appendix E Translated Safety Warnings Chassis Warning for Rack-Mounting and Servicing E-20 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Attention Pour éviter toute blessure corporelle pendant les opérations de montage ou de réparation de cette unité en casier, il convient de prendre des précautions spéciales afin de maintenir la stabilité du système. Les directives ci-dessous sont destinées à assurer la protection du personnelþ: • Si cette unité constitue la seule unité montée en casier, elle doit être placée dans le bas. • Si cette unité est montée dans un casier partiellement rempli, charger le casier de bas en haut en plaçant l'élément le plus lourd dans le bas. • Si le casier est équipé de dispositifs stabilisateurs, installer les stabilisateurs avant de monter ou de réparer l'unité en casier. Warnung Zur Vermeidung von Körperverletzung beim Anbringen oder Warten dieser Einheit in einem Gestell müssen Sie besondere Vorkehrungen treffen, um sicherzustellen, daß das System stabil bleibt. Die folgenden Richtlinien sollen zur Gewährleistung Ihrer Sicherheit dienen: • Wenn diese Einheit die einzige im Gestell ist, sollte sie unten im Gestell angebracht werden. • Bei Anbringung dieser Einheit in einem zum Teil gefüllten Gestell ist das Gestell von unten nach oben zu laden, wobei das schwerste Bauteil unten im Gestell anzubringen ist. • Wird das Gestell mit Stabilisierungszubehör geliefert, sind zuerst die Stabilisatoren zu installieren, bevor Sie die Einheit im Gestell anbringen oder sie warten. Figyelem! A készülék rackbe történõ beszerelése és karbantartása során bekövetkezõ sérülések elkerülése végett speciális óvintézkedésekkel meg kell õrizni a rendszer stabilitását. A személyes biztonsága érdekében tartsa be a következõ szabályokat: • Ha a rackben csak ez az egy készülék található, a rack aljába kell beszerelni. • Ha nincs teljesen tele az a rack, amelybe beszerelik a készüléket, alulról fölfelé haladva töltse fel a racket úgy, hogy a legnehezebb készülék kerüljön a rack aljába. • Ha stabilizáló eszközök is tartoznak a rackhez, szerelje fel a stabilizátorokat, mielõtt beszerelné az egységet a rackbe, vagy karbantartást végezne rajta.E-21 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Chassis Warning for Rack-Mounting and Servicing Avvertenza Per evitare infortuni fisici durante il montaggio o la manutenzione di questa unità in un supporto, occorre osservare speciali precauzioni per garantire che il sistema rimanga stabile. Le seguenti direttive vengono fornite per garantire la sicurezza personale: • Questa unità deve venire montata sul fondo del supporto, se si tratta dell’unica unità da montare nel supporto. • Quando questa unità viene montata in un supporto parzialmente pieno, caricare il supporto dal basso all’alto, con il componente più pesante sistemato sul fondo del supporto. • Se il supporto è dotato di dispositivi stabilizzanti, installare tali dispositivi prima di montare o di procedere alla manutenzione dell’unità nel supporto. Advarsel Unngå fysiske skader under montering eller reparasjonsarbeid på denne enheten når den befinner seg i et kabinett. Vær nøye med at systemet er stabilt. Følgende retningslinjer er gitt for å verne om sikkerheten: • Denne enheten bør monteres nederst i kabinettet hvis dette er den eneste enheten i kabinettet. • Ved montering av denne enheten i et kabinett som er delvis fylt, skal kabinettet lastes fra bunnen og opp med den tyngste komponenten nederst i kabinettet. • Hvis kabinettet er utstyrt med stabiliseringsutstyr, skal stabilisatorene installeres før montering eller utføring av reparasjonsarbeid på enheten i kabinettet. Aviso Para se prevenir contra danos corporais ao montar ou reparar esta unidade numa estante, deverá tomar precauções especiais para se certificar de que o sistema possui um suporte estável. As seguintes directrizes ajudá-lo-ão a efectuar o seu trabalho com segurança: • Esta unidade deverá ser montada na parte inferior da estante, caso seja esta a única unidade a ser montada. • Ao montar esta unidade numa estante parcialmente ocupada, coloque os itens mais pesados na parte inferior da estante, arrumando-os de baixo para cima. • Se a estante possuir um dispositivo de estabilização, instale-o antes de montar ou reparar a unidade.Appendix E Translated Safety Warnings Chassis Warning for Rack-Mounting and Servicing E-22 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 ¡Advertencia! Para evitar lesiones durante el montaje de este equipo sobre un bastidor, o posteriormente durante su mantenimiento, se debe poner mucho cuidado en que el sistema quede bien estable. Para garantizar su seguridad, proceda según las siguientes instrucciones: • Colocar el equipo en la parte inferior del bastidor, cuando sea la única unidad en el mismo. • Cuando este equipo se vaya a instalar en un bastidor parcialmente ocupado, comenzar la instalación desde la parte inferior hacia la superior colocando el equipo más pesado en la parte inferior. • Si el bastidor dispone de dispositivos estabilizadores, instalar éstos antes de montar o proceder al mantenimiento del equipo instalado en el bastidor. Varning! För att undvika kroppsskada när du installerar eller utför underhållsarbete på denna enhet på en ställning måste du vidta särskilda försiktighetsåtgärder för att försäkra dig om att systemet står stadigt. Följande riktlinjer ges för att trygga din säkerhet: • Om denna enhet är den enda enheten på ställningen skall den installeras längst ned på ställningen. • Om denna enhet installeras på en delvis fylld ställning skall ställningen fyllas nedifrån och upp, med de tyngsta enheterna längst ned på ställningen. • Om ställningen är försedd med stabiliseringsdon skall dessa monteras fast innan enheten installeras eller underhålls på ställningen.E-23 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Chassis Warning for Rack-Mounting and Servicing • • • • • • • • •Appendix E Translated Safety Warnings Redundant Power Supply Connection Warning E-24 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Redundant Power Supply Connection Warning Warning If a redundant power system (RPS) is not connected to the switch, install an RPS connector cover on the back of the switch. Statement 265 Waarschuwing Als er geen redundant voedingssysteem (RPS) aan de schakelaar is gekoppeld, dient u een RPS-connectorkapje op de achterkant van de schakelaar te installeren. Varoitus Jos korvautuvaa tehojärjestelmää (redundant power system, RPS) ei ole liitetty kytkimeen, kiinnitä RPS-liittimen suojus kytkimen takapuolelle. Attention Si un système d’alimentation électrique redondant (RPS) n’est pas connecté au commutateur, installez un cache de connecteur RPS à l’arrière du commutateur. Warnung Wenn keine redundante Stromversorgung (RSV) an den Schalter angeschlossen ist, eine RSV-Steckerabdeckung an der Rückseite des Schalters anbringen. Avvertenza Se un sistema RPS (Redundant Power System ) di alimentazione ridondante non è collegato al dispositivo switch, installare un copri-connettore RPS sul retro del switch. Advarsel Dersom et redundant strømsystem ( Redundant Power System -RPS) ikke er koblet til bryteren, skal det installeres et RPS-koblingsdeksel på baksiden av bryteren. Aviso Se um sistema de alimentação redundante (RPS) não estiver conectado a um switch, instale uma capa de conector RPS na parte de trás do switch. ¡Advertencia! Si no se conecta un sistema de potencia redundante (RPS) al interruptor, instale una cubierta de conector RPS en la parte posterior del interruptor.E-25 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Switch Installation Warning Switch Installation Warning Varning! Om ett redundant strömförsörjningssystem (redundant power system, RPS) inte finns anslutet till switchen skall ett RPS-kontaktskydd installeras på switchens baksida. Warning To comply with safety regulations, mount switches on a wall with the front panel facing up. Waarschuwing Om te voldoen aan de veiligheidsvoorschriften dient u de schakelaars op een muur te monteren met het voorpaneel omhoog. Varoitus Turvallisuusmääräykset edellyttävät, että kytkimet kiinnitetään seinään etupaneeli ylöspäin. Attention Pour satisfaire aux dispositions de sécurité, installez les commutateurs muraux avec le panneau frontal vers le haut.Appendix E Translated Safety Warnings Switch Installation Warning E-26 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Warnung Zur Einhaltung der Sicherheitsvorschriften die Schalter so an einer Wand montieren, dass die Frontplatte nach oben zeigt. Avvertenza In conformità ai regolamenti di sicurezza, installare i dispositivi switch a muro con il pannello frontale rivolto in su. Advarsel For å etterkomme sikkerhetsreglene skal brytere monteres på en vegg med frontpanelet vendt opp. Aviso Para cumprir com os regulamentos de segurança, faça a montagem de switches em uma parede com o painel frontal virado para cima. ¡Advertencia! Para cumplir con las reglas de seguridad, instale los interruptores en una pared con el panel del frente hacia arriba. Varning! För att uppfylla säkerhetsföreskrifter skall switcharna monteras på en vägg med frampanelen riktad uppåt.E-27 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Restricted Area Restricted Area Warning This unit is intended for installation in restricted access areas. A restricted access area can be accessed only through the use of a special tool, lock and key, or other means of security. Waarschuwing Deze eenheid is bestemd voor installatie in plaatsen met beperkte toegang. Toegang tot een dergelijke plaats kan alleen verkregen worden door middel van een speciaal instrument, een slot en sleutel of een ander veiligheidsmiddel. Varoitus Tämä laite on tarkoitettu asennettavaksi paikkaan, johon pääsy on rajoitettua. Tällaiseen paikkaan pääsee vain erikoistyökalua, lukkoon sopivaa avainta tai jotakin muuta turvalaitetta käyttämällä. Attention Cet appareil est à installer dans des zones d'accès réservé. L'accès à une zone d'accès réservé n'est possible qu'en utilisant un outil spécial, un mécanisme de verrouillage et une clé, ou tout autre moyen de sécurité. Warnung Diese Einheit ist zur Installation in Bereichen mit beschränktem Zutritt vorgesehen. Der Zutritt zu derartigen Bereichen ist nur mit einem Spezialwerkzeug, Schloss und Schlüssel oder einer sonstigen Sicherheitsvorkehrung möglich. Avvertenza Questa unità è prevista per essere installata in un'area ad accesso limitato, vale a dire un'area accessibile solo mediante l'uso di un attrezzo speciale, come lucchetto e chiave, o altri dispositivi di sicurezza. Advarsel Denne enheten er beregnet på installasjon i områder med begrenset tilgang. Et begrenset tilgangsområde kan bare nås ved hjelp av et spesielt verktøy, lås og nøkkel, eller andre sikkerhetsanordninger. Aviso Esta unidade foi concebida para instalação em áreas de acesso restrito. Uma área de acesso restrito é uma área à qual apenas tem acesso o pessoal de serviço autorizado, que possua uma ferramenta, chave e fechadura especial, ou qualquer outra forma de segurança.Appendix E Translated Safety Warnings Ethernet Cable Shielding in Offices E-28 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Ethernet Cable Shielding in Offices ¡Advertencia! Esta unidad ha sido diseñada para instalación en áreas de acceso restringido. Sólo puede obtenerse acceso a una de estas áreas mediante la utilización de una herramienta especial, cerradura con llave u otro medio de seguridad. Varning! Denna enhet är avsedd för installation i områden med begränsat tillträde. Ett område med begränsat tillträde kan endast tillträdas med hjälp av specialverktyg, lås och nyckel eller annan säkerhetsanordning. Warning Ethernet cables must be shielded when used in a central office environment. Waarschuwing Ethernetkabels dienen beveiligd te worden als ze in een centrale kantooromgeving worden gebruikt.E-29 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Ethernet Cable Shielding in Offices Varoitus Ethernet-kaapelit täytyy suojata, kun niitä käytetään yleisessä toimistoympäristössä. Attention Pour une utilisation en site central, les câbles Ethernet doivent être impérativement blindés. Warnung Ethernet-Kabel müssen abgeschirmt werden, wenn sie in einer Zentrale eingesetzt werden. Avvertenza I cavi Ethernet devono essere schermati se utilizzati in un ambiente di ufficio centrale. Advarsel Ethernet-kabler skal være skjermet når de brukes i et sentralt kontormiljø. Aviso Os cabos “Ethernet” deverão estar armados quando usados em ambiente de escritório central. ¡Advertencia! Los cables Ethernet deben estar protegidos cuando se usen dentro de una oficina central. Varning! Ethernetkablar måste vara avskärmade vid användning i central kontorsmiljö.Appendix E Translated Safety Warnings Laser Beam Exposure E-30 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Laser Beam Exposure Warning Avoid direct exposure to the laser beam. Waarschuwing Voorkom rechtstreekse blootstelling aan de laserstraal. Varoitus Vältä säteelle altistumista. Attention Éviter toute exposition directe au faisceau. Warnung Schützen Sie sich vor direkter Laserbestrahlung. Avvertenza Evitare l'esposizione diretta al raggio laser. Advarsel Unngå direkte eksponering til laserstrålen. Aviso Evite exposição a raios laser. ¡Advertencia! Evite la exposición directa al haz del láser. Varning! Utsätt dig inte för laserstrålning.E-31 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Appendix E Translated Safety Warnings Laser Radiation Laser Radiation Warning Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments. Waarschuwing Losgekoppelde of losgeraakte glasvezels of aansluitingen kunnen onzichtbare laserstraling produceren. Kijk niet rechtstreeks in de straling en gebruik geen optische instrumenten rond deze glasvezels of aansluitingen. Varoitus Irrotetuista kuiduista tai liittimistä voi tulla näkymätöntä lasersäteilyä. Älä tuijota säteitä tai katso niitä suoraan optisilla välineillä. Attention Les fibres ou connecteurs débranchés risquent d'émettre des rayonnements laser invisibles à l'œil. Ne regardez jamais directement les faisceaux laser à l'œil nu, ni d'ailleurs avec des instruments optiques. Warnung Unterbrochene Fasern oder Steckerverbindungenkönnen unsichtbare Laserstrahlung abgeben. Blicken Sie weder mit bloßem Auge noch mit optischen Instrumenten direkt in Laserstrahlen. Avvertenza Le fibre ottiche ed i relativi connettori possono emettere radiazioni laser. I fasci di luce non devono mai essere osservati direttamente o attraverso strumenti ottici. Advarsel Det kan forekomme usynlig laserstråling fra fiber eller kontakter som er frakoblet. Stirr ikke direkte inn i strålene eller se på dem direkte gjennom et optisk instrument. Aviso Radiação laser invisível pode ser emitida de conectores ou fibras desconectadas. Não olhe diretamente para os feixes ou com instrumentos ópticos. ¡Advertencia! Es posible que las fibras desconectadas emitan radiación láser invisible. No fije la vista en los rayos ni examine éstos con instrumentos ópticos. Appendix E Translated Safety Warnings E-32 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Varning! Osynlig laserstrålning kan avges från frånkopplade fibrer eller kontaktdon. Rikta inte blicken in i strålar och titta aldrig direkt på dem med hjälp av optiska instrument.IN-1 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 I N D E X Numerics 10/100/1000 ports cable lengths 3-6 connecting to 3-44 connectors and cables B-1 to B-2 described 2-6 illustrated 2-3 10/100 ports cable lengths 3-6 connecting to 3-44 connectors and cables B-3 to B-4 described 2-6 illustrated 2-4 numbering 2-3 19- and 24-inch racks 3-18 A AC power connecting to 3-10 connector 2-16 specifications A-1 to A-4 adapter cable 3-9 adapter pinouts, terminal RJ-45-to-DB-25 B-10 RJ-45-to-DB-9 B-10 agency approvals A-5 altitude, operating and storage A-1 to A-4 automatic crossover 2-6 autonegotiation 2-6 B brackets See mounting brackets C cable guide, attaching 3-30 cable lengths 3-6 cables crossover connecting to B-2 to B-4 four twisted-pair pinout, 10/100 ports B-7 four twisted-pair pinout, 1000BASE-T ports B-8 identifying B-9Index IN-2 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 two twisted-pair pinout, 10/100 ports B-6 SFP module 1000BASE-T module 3-49 straight-through connecting to B-2 to B-4 four twisted-pair pinout, 10/100 ports B-7 four twisted-pair pinout, 1000BASE-T ports B-8 two twisted-pair pinout, 10/100 ports B-6 See also connectors and cables cabling 10/100/1000 ports 2-6, 3-44 10/100 ports 2-6, 3-44, B-4 automatic crossover 2-6 considerations 3-14 pinouts B-6 See also connectors and cables StackWise cables cable numbers 2-15 connecting to 3-37 cautions xvi chassis warning, rack-mounting and servicing E-19 Cisco IP Phones, connecting to 3-45 Cisco RPS See RPS CiscoView 2-18 CLI 2-18 accessing by using Express Setup D-2 accessing through console port D-3 Cluster Management Suite See CMS CMS 2-18 accessing your switch C-1 operating systems and supported browsers C-6 requirements C-5 to C-7 supported Java plug-ins C-7 command-line interface See CLI connecting to 10/100/1000 ports 3-44 to 10/100 ports 3-44 to console port 3-8, B-6 to SFP modules 3-46 to 3-49 connecting to the console port D-7 connection procedures 3-44 to 3-48 connectivity problems, solving 4-3 connectors and cables 10/100/1000 ports B-1 to B-2 10/100 ports B-3 to B-4 console port B-6 to B-11 power (AC and RPS) 2-16 SC connectors B-5 SFP module ports B-5 See also cables console port connecting to 3-8, D-7 connectors and cables B-6 to B-11 described 2-17IN-3 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Index conventions, document xvi crossover cable B-9 to B-10 connecting to 1000BASE-T SFP module ports 3-49 connectivity problems 4-5 pinout four twisted-pair, 1000BASE-T ports B-8 four twisted-pair 10/100 ports B-7 D DC power RPS 2-2 to 2-3 diagnosing problems 4-3 dimensions A-2 to A-5 document conventions xvi duplex LED 2-11 E electrical noise, avoiding 3-7 electromagnetic interference (EMI) A-5 EMC regulatory statements 3-4 Ethernet cable shielding in offices warning E-28 Express Setup accessing CLI by using D-2 procedure 1-4 to 1-10 troubleshooting 1-7 to 1-8 F features 2-1 to 2-2 front panel 10/100/1000 ports 2-6 10/100 ports 2-6 clearance 3-6 description 2-3 to 2-5 LEDs 2-8 to 2-12 SFP module ports 2-7 G Grounded E-11 grounded equipment warning E-11 H HP OpenView 2-18 humidity, relative A-1 to A-4 I installation assigning the IP Address D-10 connecting to an Ethernet port C-2 connecting to a power source D-9 rack-mounting 3-18 to 3-36 site requirements 3-6Index IN-4 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 stacking the switches See also stacking starting the terminal emulation software D-9 table or shelf-mounting 3-36 wall mounting 3-32 warning E-5 See also procedures installing or replacing the unit warning E-12 installing SFP modules 3-41 to 3-43 IOS command-line interface 2-18 IP address configuring by using Express Setup 1-9 verifying 1-10 to 1-11 J jewelry removal warning E-6 L laser beam exposure warning E-30 laser radiation warning E-31 LEDs color meanings 2-10 duplex 2-11 front panel 2-8 interpreting 2-10 master 2-10 port 2-10 to 2-12 port mode 2-10 POST results 4-2 RPS 2-9, 2-10 speed 2-11 stack 2-12 STATUS 2-11 system 2-9 lightning activity warning E-16 M main disconnecting device warning E-10 methods for accessing the switch D-2 mode button 2-8 mounting, table or shelf 3-36 mounting, wall mounting 3-32 mounting brackets attaching 3-20 to 3-28 rack-mount 3-28 N noise, electrical 3-7 P packing list 3-7 PC, connecting to switch 3-9 performance problems, solving 4-3IN-5 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Index pinouts 10/100 ports B-5 adapters B-9 to B-11 console port B-10, B-10 to B-11 crossover cable B-9 crossover cables four twisted-pair, 1000BASE-T ports B-8 four twisted-pair 10/100 ports B-7 two twisted-pair 10/100 ports B-6 RJ-45-to-DB-25 terminal adapter B-10 RJ-45-to-DB-9 terminal adapter B-10 SFP module ports B-5 straight-through cables four twisted-pair 10/100 ports B-7 four twisted-pair 1000BASE-T ports B-8 two twisted-pair 10/100 ports B-6 port LEDs 2-10 to 2-12 port modes changing 2-8 LEDs 2-10, 2-11 See also mode button ports 10/100 2-6 10/100/1000 2-3 numbering of 10/100 2-6 numbering of 10/100/1000 2-6 POST LEDs 4-2 results 4-1 running at powerup 1-4 power connecting to 3-10 connectors 2-14, 2-16 specifications A-1 to A-5 power on 3-10 power supply AC power outlet 2-16 RPS connector 2-16 procedures connection 3-44 to 3-48 installation 3-17 to 3-36 product disposal warning E-17 publications, related xxi Q qualified personnel warning E-4 R rack-mounting 3-18 to 3-36 rear panel clearance 3-6 description 2-14 to 2-17 redundant power supply See RPS regulatory statements, EMC 3-4 removing SFP modules 3-43 to 3-44Index IN-6 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 restricted area warning E-27 RJ-45 connector, console port B-6 RJ-45 console port 2-14 RPS connecting to 3-10 connector 2-16 LED 2-9, 2-10 RPS connection warning E-24 S safety 3-2, E-1 SC connector B-5 SFP modules 1000BASE-LX 2-7 1000BASE-SX 2-7 1000BASE-T 2-7 supported speeds 2-12 bale-clasp latch removal 3-43 connecting to 3-46 to 3-49 connectors B-5 described 2-7 fiber-optic cabling guidelines 3-6 installation 3-41 to 3-43 shelf-mounting 3-36 Simple Network Management Protocol See SNMP SNMP network management platforms 2-18 software switch management 2-18 specifications A-1 stacking cabling considerations 3-14 connecting to a StackWise port 3-12 examples 3-12 planning considerations 3-12 powering considerations 3-13 StackWise ports 2-15 straight-through cable pinout four twisted-pair 10/100 ports B-7 four twisted-pair 1000BASE-T ports B-8 two twisted-pair 10/100 ports B-6 SunNet Manager 2-18 switch installation warning E-25 switch powering on 3-10 system LED 2-9 T table-mounting 3-36 technical specifications A-1 telco racks 3-18 Telnet, and accessing the CLI 2-18 temperature, operating A-1 terminal, connecting to switch 3-9 terminal emulation software 3-8, D-9 translated warnings E-1 to E-31IN-7 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Index troubleshooting 4-1 to 4-5 W wall mounting 3-32 warnings defined xvi installation 3-2 translated E-1 to E-31Index IN-8 Catalyst 3750 Switch Hardware Installation Guide 78-15136-02 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Catalyst 3750 Switch Software Configuration Guide Cisco IOS Release 12.1(14)EA1 July 2003 Customer Order Number: DOC-7815164= Text Part Number: 78-15164-02THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R) Catalyst 3750 Switch Software Configuration Guide Copyright © 2003 Cisco Systems, Inc. All rights reserved.iii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C O N T E N T S Preface xxxiii Audience xxxiii Purpose xxxiii Conventions xxxiv Related Publications xxxv Obtaining Documentation xxxv Cisco.com xxxv Documentation CD-ROM xxxv Ordering Documentation xxxvi Documentation Feedback xxxvi Obtaining Technical Assistance xxxvi Cisco TAC Website xxxvi Opening a TAC Case xxxvii TAC Case Priority Definitions xxxvii Obtaining Additional Publications and Information xxxvii C H A P T E R 1 Overview 1-1 Features 1-1 Default Settings After Initial Switch Configuration 1-9 Network Configuration Examples 1-11 Design Concepts for Using the Switch 1-11 Small to Medium-Sized Network Using Catalyst 3750 Switches 1-17 Large Network Using Catalyst 3750 Switches 1-18 Multidwelling Network Using Catalyst 3750 Switches 1-20 Where to Go Next 1-21 C H A P T E R 2 Using the Command-Line Interface 2-1 Understanding Command Modes 2-1 Understanding the Help System 2-3 Understanding Abbreviated Commands 2-4 Understanding no and default Forms of Commands 2-4 Understanding CLI Error Messages 2-5 Using Command History 2-5Contents iv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Changing the Command History Buffer Size 2-5 Recalling Commands 2-6 Disabling the Command History Feature 2-6 Using Editing Features 2-6 Enabling and Disabling Editing Features 2-7 Editing Commands through Keystrokes 2-7 Editing Command Lines that Wrap 2-8 Searching and Filtering Output of show and more Commands 2-9 Accessing the CLI 2-10 Accessing the CLI through a Console Connection or through Telnet 2-10 Accessing the CLI from a Browser 2-11 C H A P T E R 3 Getting Started with CMS 3-1 Launching CMS 3-2 Features 3-3 Front Panel View 3-5 Cluster Tree 3-6 Front-Panel Images 3-7 Redundant Power System LED 3-8 Port Modes and LEDs 3-9 VLAN Membership Modes 3-10 Topology View 3-11 Topology Icons and Labels 3-14 Device and Link Information 3-14 Colors in the Topology View 3-15 Topology Display Options 3-16 Menus and Toolbar 3-16 Menu Bar 3-16 Toolbar 3-20 Front Panel View Popup Menus 3-21 Device Popup Menu 3-21 Port Popup Menu 3-22 Topology View Popup Menus 3-22 Link Popup Menu 3-22 Device Popup Menus 3-23 Interaction Modes 3-25 Guide Mode 3-25 Expert Mode 3-26Contents v Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Wizards 3-26 Tool Tips 3-26 Online Help 3-27 CMS Window Components 3-28 Host Name List 3-28 Tabs, Lists, and Tables 3-29 Table Filtering 3-29 Buttons 3-29 Accessing CMS 3-30 Access Modes in CMS 3-30 HTTP Access to CMS 3-31 Verifying Your Changes 3-31 Change Notification 3-31 Error Checking 3-31 Saving Your Configuration 3-32 Restoring Your Configuration 3-32 CMS Preferences 3-32 Using Different Versions of CMS 3-33 Where to Go Next 3-33 C H A P T E R 4 Assigning the Switch IP Address and Default Gateway 4-1 Understanding the Boot Process 4-1 Assigning Switch Information 4-2 Default Switch Information 4-3 Understanding DHCP-Based Autoconfiguration 4-3 DHCP Client Request Process 4-4 Configuring the DHCP Server 4-5 Configuring the TFTP Server 4-5 Configuring the DNS 4-6 Configuring the Relay Device 4-6 Obtaining Configuration Files 4-7 Example Configuration 4-8 Manually Assigning IP Information 4-9 Checking and Saving the Running Configuration 4-10 Modifying the Startup Configuration 4-12 Default Boot Configuration 4-12 Automatically Downloading a Configuration File 4-12 Specifying the Filename to Read and Write the System Configuration 4-13Contents vi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Booting Manually 4-13 Booting a Specific Software Image 4-14 Controlling Environment Variables 4-15 Scheduling a Reload of the Software Image 4-17 Configuring a Scheduled Reload 4-17 Displaying Scheduled Reload Information 4-18 C H A P T E R 5 Managing Switch Stacks 5-1 Understanding Switch Stacks 5-1 Switch Stack Membership 5-3 Stack Master Election and Re-Election 5-5 Switch Stack Bridge ID and Router MAC Address 5-6 Stack Member Numbers 5-6 Stack Member Priority Values 5-7 Hardware Compatibility in Switch Stacks 5-7 Software Compatibility in Switch Stacks 5-7 Compatibility Recommendations 5-8 Stack Protocol Version Compatibility 5-8 Switch Stack Configuration Files 5-9 Additional Considerations for System-Wide Configuration on Switch Stacks 5-10 Switch Stack Management Connectivity 5-11 Connectivity to the Switch Stack Through an IP Address 5-11 Connectivity to the Switch Stack Through an SSH Session 5-11 Connectivity to the Switch Stack Through Console Ports 5-11 Connectivity to Specific Stack Members 5-12 Switch Stack Configuration Scenarios 5-12 Assigning Stack Member Information 5-15 Default Switch Stack Configuration 5-15 Assigning a Stack Member Number 5-15 Setting the Stack Member Priority Value 5-16 Accessing the CLI of a Specific Stack Member 5-16 Displaying Information about the Switch Stack 5-16 C H A P T E R 6 Clustering Switches 6-1 Understanding Switch Clusters 6-2 Cluster Command Switch Characteristics 6-3 Standby Cluster Command Switch Characteristics 6-3 Candidate Switch and Cluster Member Switch Characteristics 6-4Contents vii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Planning a Switch Cluster 6-4 Automatic Discovery of Cluster Candidates and Members 6-5 Discovery Through CDP Hops 6-5 Discovery Through Non-CDP-Capable and Noncluster-Capable Devices 6-6 Discovery Through Different VLANs 6-7 Discovery Through Different Management VLANs 6-8 Discovery Through Routed Ports 6-9 Discovery of Newly Installed Switches 6-10 HSRP and Standby Cluster Command Switches 6-11 Virtual IP Addresses 6-12 Other Considerations for Cluster Standby Groups 6-12 Automatic Recovery of Cluster Configuration 6-13 IP Addresses 6-14 Host Names 6-14 Passwords 6-15 SNMP Community Strings 6-15 Switch Clusters and Switch Stacks 6-15 TACACS+ and RADIUS 6-17 Access Modes in CMS 6-17 Availability of Switch-Specific Features in Switch Clusters 6-17 Creating a Switch Cluster 6-18 Enabling a Cluster Command Switch 6-18 Adding Cluster Member Switches 6-19 Creating a Cluster Standby Group 6-21 Verifying a Switch Cluster 6-22 Using the CLI to Manage Switch Clusters 6-24 Catalyst 1900 and Catalyst 2820 CLI Considerations 6-24 Using SNMP to Manage Switch Clusters 6-25 C H A P T E R 7 Administering the Switch 7-1 Managing the System Time and Date 7-1 Understanding the System Clock 7-2 Understanding Network Time Protocol 7-2 Configuring NTP 7-4 Default NTP Configuration 7-4 Configuring NTP Authentication 7-5 Configuring NTP Associations 7-6 Configuring NTP Broadcast Service 7-7 Configuring NTP Access Restrictions 7-8Contents viii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Configuring the Source IP Address for NTP Packets 7-10 Displaying the NTP Configuration 7-11 Configuring Time and Date Manually 7-11 Setting the System Clock 7-12 Displaying the Time and Date Configuration 7-12 Configuring the Time Zone 7-13 Configuring Summer Time (Daylight Saving Time) 7-14 Configuring a System Name and Prompt 7-16 Default System Name and Prompt Configuration 7-16 Configuring a System Name 7-16 Configuring a System Prompt 7-17 Understanding DNS 7-17 Default DNS Configuration 7-18 Setting Up DNS 7-18 Displaying the DNS Configuration 7-19 Creating a Banner 7-19 Default Banner Configuration 7-19 Configuring a Message-of-the-Day Login Banner 7-20 Configuring a Login Banner 7-21 Managing the MAC Address Table 7-22 Building the Address Table 7-22 MAC Addresses and VLANs 7-23 MAC Addresses and Switch Stacks 7-23 Default MAC Address Table Configuration 7-23 Changing the Address Aging Time 7-23 Removing Dynamic Address Entries 7-24 Configuring MAC Address Notification Traps 7-24 Adding and Removing Static Address Entries 7-26 Displaying Address Table Entries 7-27 Managing the ARP Table 7-28 C H A P T E R 8 Configuring SDM Templates 8-1 Understanding the SDM Templates 8-1 SDM Templates and Switch Stacks 8-2 Configuring the Switch SDM Template 8-3 Default SDM Template 8-3 SDM Template Configuration Guidelines 8-4 Setting the SDM Template 8-4 Displaying the SDM Templates 8-6Contents ix Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 9 Configuring Switch-Based Authentication 9-1 Preventing Unauthorized Access to Your Switch 9-1 Protecting Access to Privileged EXEC Commands 9-2 Default Password and Privilege Level Configuration 9-2 Setting or Changing a Static Enable Password 9-3 Protecting Enable and Enable Secret Passwords with Encryption 9-4 Disabling Password Recovery 9-5 Setting a Telnet Password for a Terminal Line 9-6 Configuring Username and Password Pairs 9-7 Configuring Multiple Privilege Levels 9-8 Setting the Privilege Level for a Command 9-8 Changing the Default Privilege Level for Lines 9-9 Logging into and Exiting a Privilege Level 9-10 Controlling Switch Access with TACACS+ 9-10 Understanding TACACS+ 9-10 TACACS+ Operation 9-12 Configuring TACACS+ 9-13 Default TACACS+ Configuration 9-13 Identifying the TACACS+ Server Host and Setting the Authentication Key 9-13 Configuring TACACS+ Login Authentication 9-14 Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 9-16 Starting TACACS+ Accounting 9-17 Displaying the TACACS+ Configuration 9-17 Controlling Switch Access with RADIUS 9-18 Understanding RADIUS 9-18 RADIUS Operation 9-19 Configuring RADIUS 9-20 Default RADIUS Configuration 9-20 Identifying the RADIUS Server Host 9-21 Configuring RADIUS Login Authentication 9-23 Defining AAA Server Groups 9-25 Configuring RADIUS Authorization for User Privileged Access and Network Services 9-27 Starting RADIUS Accounting 9-28 Configuring Settings for All RADIUS Servers 9-29 Configuring the Switch to Use Vendor-Specific RADIUS Attributes 9-29 Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 9-31 Displaying the RADIUS Configuration 9-31Contents x Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Controlling Switch Access with Kerberos 9-32 Understanding Kerberos 9-32 Kerberos Operation 9-34 Authenticating to a Boundary Switch 9-35 Obtaining a TGT from a KDC 9-35 Authenticating to Network Services 9-35 Configuring Kerberos 9-36 Configuring the Switch for Local Authentication and Authorization 9-37 Configuring the Switch for Secure Shell 9-38 Understanding SSH 9-38 Configuring SSH 9-38 C H A P T E R 10 Configuring 802.1X Port-Based Authentication 10-1 Understanding 802.1X Port-Based Authentication 10-1 Device Roles 10-2 Authentication Initiation and Message Exchange 10-3 Ports in Authorized and Unauthorized States 10-4 Supported Topologies 10-5 Using 802.1X with Port Security 10-6 Using 802.1X with Voice VLAN Ports 10-6 Using 802.1X with VLAN Assignment 10-7 Using 802.1X with Guest VLAN 10-8 Using 802.1X with Per-User ACLs 10-9 802.1X and Switch Stacks 10-10 Configuring 802.1X Authentication 10-10 Default 802.1X Configuration 10-11 802.1X Configuration Guidelines 10-12 Upgrading from a Previous Software Release 10-12 Configuring 802.1X Authentication 10-13 Configuring the Switch-to-RADIUS-Server Communication 10-14 Configuring Periodic Re-Authentication 10-15 Manually Re-Authenticating a Client Connected to a Port 10-16 Changing the Quiet Period 10-16 Changing the Switch-to-Client Retransmission Time 10-17 Setting the Switch-to-Client Frame-Retransmission Number 10-17 Configuring the Host Mode 10-18 Configuring a Guest VLAN 10-19 Resetting the 802.1X Configuration to the Default Values 10-20 Displaying 802.1X Statistics and Status 10-20Contents xi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 11 Configuring Interface Characteristics 11-1 Understanding Interface Types 11-1 Port-Based VLANs 11-2 Switch Ports 11-2 Access Ports 11-2 Trunk Ports 11-3 Routed Ports 11-3 Switch Virtual Interfaces 11-4 EtherChannel Port Groups 11-5 Connecting Interfaces 11-5 Using Interface Configuration Mode 11-6 Procedures for Configuring Interfaces 11-7 Configuring a Range of Interfaces 11-8 Configuring and Using Interface Range Macros 11-10 Configuring Ethernet Interfaces 11-11 Default Ethernet Interface Configuration 11-12 Configuring Interface Speed and Duplex Mode 11-13 Configuration Guidelines 11-13 Setting the Interface Speed and Duplex Parameters 11-14 Configuring IEEE 802.3X Flow Control 11-15 Configuring Auto-MDIX on an Interface 11-16 Adding a Description for an Interface 11-17 Configuring Layer 3 Interfaces 11-18 Configuring the System MTU 11-19 Monitoring and Maintaining the Interfaces 11-21 Monitoring Interface Status 11-21 Clearing and Resetting Interfaces and Counters 11-22 Shutting Down and Restarting the Interface 11-22 C H A P T E R 12 Configuring VLANs 12-1 Understanding VLANs 12-1 Supported VLANs 12-3 VLAN Port Membership Modes 12-3 Configuring Normal-Range VLANs 12-4 Token Ring VLANs 12-5 Normal-Range VLAN Configuration Guidelines 12-6Contents xii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 VLAN Configuration Mode Options 12-6 VLAN Configuration in config-vlan Mode 12-7 VLAN Configuration in VLAN Database Configuration Mode 12-7 Saving VLAN Configuration 12-7 Default Ethernet VLAN Configuration 12-8 Creating or Modifying an Ethernet VLAN 12-8 Deleting a VLAN 12-10 Assigning Static-Access Ports to a VLAN 12-11 Configuring Extended-Range VLANs 12-12 Default VLAN Configuration 12-12 Extended-Range VLAN Configuration Guidelines 12-13 Creating an Extended-Range VLAN 12-13 Creating an Extended-Range VLAN with an Internal VLAN ID 12-15 Displaying VLANs 12-16 Configuring VLAN Trunks 12-16 Trunking Overview 12-16 Encapsulation Types 12-18 802.1Q Configuration Considerations 12-19 Default Layer 2 Ethernet Interface VLAN Configuration 12-19 Configuring an Ethernet Interface as a Trunk Port 12-19 Interaction with Other Features 12-20 Configuring a Trunk Port 12-20 Defining the Allowed VLANs on a Trunk 12-21 Changing the Pruning-Eligible List 12-23 Configuring the Native VLAN for Untagged Traffic 12-23 Configuring Trunk Ports for Load Sharing 12-24 Load Sharing Using STP Port Priorities 12-24 Load Sharing Using STP Path Cost 12-26 Configuring VMPS 12-28 Understanding VMPS 12-28 Dynamic-Access Port VLAN Membership 12-29 Default VMPS Client Configuration 12-29 VMPS Configuration Guidelines 12-30 Configuring the VMPS Client 12-30 Entering the IP Address of the VMPS 12-30 Configuring Dynamic-Access Ports on VMPS Clients 12-31 Reconfirming VLAN Memberships 12-32 Changing the Reconfirmation Interval 12-32 Changing the Retry Count 12-32Contents xiii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Monitoring the VMPS 12-33 Troubleshooting Dynamic-Access Port VLAN Membership 12-33 VMPS Configuration Example 12-34 C H A P T E R 13 Configuring VTP 13-1 Understanding VTP 13-1 The VTP Domain 13-2 VTP Modes 13-3 VTP Advertisements 13-3 VTP Version 2 13-4 VTP Pruning 13-4 VTP and Switch Stacks 13-6 Configuring VTP 13-6 Default VTP Configuration 13-7 VTP Configuration Options 13-7 VTP Configuration in Global Configuration Mode 13-7 VTP Configuration in VLAN Database Configuration Mode 13-8 VTP Configuration Guidelines 13-8 Domain Names 13-8 Passwords 13-8 VTP Version 13-9 Configuration Requirements 13-9 Configuring a VTP Server 13-9 Configuring a VTP Client 13-11 Disabling VTP (VTP Transparent Mode) 13-12 Enabling VTP Version 2 13-13 Enabling VTP Pruning 13-14 Adding a VTP Client Switch to a VTP Domain 13-15 Monitoring VTP 13-16 C H A P T E R 14 Configuring Voice VLAN 14-1 Understanding Voice VLAN 14-1 Cisco IP Phone Voice Traffic 14-2 Cisco IP Phone Data Traffic 14-2 Configuring Voice VLAN 14-3 Default Voice VLAN Configuration 14-3 Voice VLAN Configuration Guidelines 14-3Contents xiv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Configuring a Port Connected to a Cisco 7960 IP Phone 14-4 Configuring IP Phone Voice Traffic 14-4 Configuring the Priority of Incoming Data Frames 14-5 Displaying Voice VLAN 14-6 C H A P T E R 15 Configuring STP 15-1 Understanding Spanning-Tree Features 15-1 STP Overview 15-2 Spanning-Tree Topology and BPDUs 15-3 Bridge ID, Switch Priority, and Extended System ID 15-4 Spanning-Tree Interface States 15-5 Blocking State 15-6 Listening State 15-7 Learning State 15-7 Forwarding State 15-7 Disabled State 15-7 How a Switch or Port Becomes the Root Switch or Root Port 15-8 Spanning Tree and Redundant Connectivity 15-8 Spanning-Tree Address Management 15-9 Accelerated Aging to Retain Connectivity 15-9 Spanning-Tree Modes and Protocols 15-10 Supported Spanning-Tree Instances 15-10 Spanning-Tree Interoperability and Backward Compatibility 15-11 STP and IEEE 802.1Q Trunks 15-11 VLAN-Bridge Spanning Tree 15-12 Spanning Tree and Switch Stacks 15-12 Configuring Spanning-Tree Features 15-13 Default Spanning-Tree Configuration 15-13 Spanning-Tree Configuration Guidelines 15-14 Changing the Spanning-Tree Mode 15-15 Disabling Spanning Tree 15-16 Configuring the Root Switch 15-16 Configuring a Secondary Root Switch 15-18 Configuring Port Priority 15-19 Configuring Path Cost 15-20 Configuring the Switch Priority of a VLAN 15-21 Configuring Spanning-Tree Timers 15-22 Configuring the Hello Time 15-22 Configuring the Forwarding-Delay Time for a VLAN 15-23Contents xv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Configuring the Maximum-Aging Time for a VLAN 15-23 Displaying the Spanning-Tree Status 15-24 C H A P T E R 16 Configuring MSTP 16-1 Understanding MSTP 16-2 Multiple Spanning-Tree Regions 16-2 IST, CIST, and CST 16-3 Operations Within an MST Region 16-3 Operations Between MST Regions 16-4 Hop Count 16-5 Boundary Ports 16-5 MSTP and Switch Stacks 16-6 Interoperability with 802.1D STP 16-6 Understanding RSTP 16-7 Port Roles and the Active Topology 16-7 Rapid Convergence 16-8 Synchronization of Port Roles 16-9 Bridge Protocol Data Unit Format and Processing 16-10 Processing Superior BPDU Information 16-11 Processing Inferior BPDU Information 16-11 Topology Changes 16-11 Configuring MSTP Features 16-12 Default MSTP Configuration 16-13 MSTP Configuration Guidelines 16-13 Specifying the MST Region Configuration and Enabling MSTP 16-14 Configuring the Root Switch 16-15 Configuring a Secondary Root Switch 16-17 Configuring Port Priority 16-18 Configuring Path Cost 16-19 Configuring the Switch Priority 16-20 Configuring the Hello Time 16-20 Configuring the Forwarding-Delay Time 16-21 Configuring the Maximum-Aging Time 16-22 Configuring the Maximum-Hop Count 16-22 Specifying the Link Type to Ensure Rapid Transitions 16-23 Restarting the Protocol Migration Process 16-23 Displaying the MST Configuration and Status 16-24Contents xvi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 17 Configuring Optional Spanning-Tree Features 17-1 Understanding Optional Spanning-Tree Features 17-1 Understanding Port Fast 17-2 Understanding BPDU Guard 17-3 Understanding BPDU Filtering 17-3 Understanding UplinkFast 17-4 Understanding Cross-Stack UplinkFast 17-5 How CSUF Works 17-6 Events that Cause Fast Convergence 17-7 Understanding BackboneFast 17-8 Understanding Root Guard 17-10 Understanding Loop Guard 17-11 Configuring Optional Spanning-Tree Features 17-12 Default Optional Spanning-Tree Configuration 17-12 Optional Spanning-Tree Configuration Guidelines 17-12 Enabling Port Fast 17-13 Enabling BPDU Guard 17-14 Enabling BPDU Filtering 17-15 Enabling UplinkFast for Use with Redundant Links 17-16 Enabling Cross-Stack UplinkFast 17-17 Enabling BackboneFast 17-17 Enabling Root Guard 17-18 Enabling Loop Guard 17-18 Displaying the Spanning-Tree Status 17-19 C H A P T E R 18 Configuring IGMP Snooping and MVR 18-1 Understanding IGMP Snooping 18-2 Joining a Multicast Group 18-2 Leaving a Multicast Group 18-4 Immediate-Leave Processing 18-4 IGMP Snooping and Switch Stacks 18-5 Configuring IGMP Snooping 18-5 Default IGMP Snooping Configuration 18-5 Enabling or Disabling IGMP Snooping 18-6 Setting the Snooping Method 18-6 Configuring a Multicast Router Port 18-8 Configuring a Host Statically to Join a Group 18-9 Enabling IGMP Immediate-Leave Processing 18-9 Displaying IGMP Snooping Information 18-10Contents xvii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Understanding Multicast VLAN Registration 18-12 Using MVR in a Multicast Television Application 18-13 Configuring MVR 18-14 Default MVR Configuration 18-15 MVR Configuration Guidelines and Limitations 18-15 Configuring MVR Global Parameters 18-15 Configuring MVR Interfaces 18-17 Displaying MVR Information 18-18 Configuring IGMP Filtering 18-19 Default IGMP Filtering Configuration 18-19 Configuring IGMP Profiles 18-19 Applying IGMP Profiles 18-20 Setting the Maximum Number of IGMP Groups 18-21 Displaying IGMP Filtering Configuration 18-22 C H A P T E R 19 Configuring Port-Based Traffic Control 19-1 Configuring Storm Control 19-1 Understanding Storm Control 19-1 Default Storm Control Configuration 19-3 Enabling Storm Control 19-3 Configuring Protected Ports 19-4 Default Protected Port Configuration 19-4 Protected Port Configuration Guidelines 19-5 Configuring a Protected Port 19-5 Configuring Port Blocking 19-5 Default Port Blocking Configuration 19-5 Blocking Flooded Traffic on an Interface 19-6 Configuring Port Security 19-7 Understanding Port Security 19-7 Secure MAC Addresses 19-7 Security Violations 19-8 Default Port Security Configuration 19-9 Configuration Guidelines 19-9 Enabling and Configuring Port Security 19-10 Enabling and Configuring Port Security Aging 19-13 Port Security and Switch Stacks 19-14 Displaying Port-Based Traffic Control Settings 19-15Contents xviii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 20 Configuring CDP 20-1 Understanding CDP 20-1 CDP and Switch Stacks 20-2 Configuring CDP 20-2 Default CDP Configuration 20-2 Configuring the CDP Characteristics 20-2 Disabling and Enabling CDP 20-3 Disabling and Enabling CDP on an Interface 20-4 Monitoring and Maintaining CDP 20-5 C H A P T E R 21 Configuring UDLD 21-1 Understanding UDLD 21-1 Configuring UDLD 21-3 Default UDLD Configuration 21-3 Enabling UDLD Globally 21-4 Enabling UDLD on an Interface 21-4 Resetting an Interface Disabled by UDLD 21-5 Displaying UDLD Status 21-5 C H A P T E R 22 Configuring SPAN and RSPAN 22-1 Understanding SPAN and RSPAN 22-1 Local SPAN 22-2 Remote SPAN 22-3 SPAN and RSPAN Concepts and Terminology 22-4 SPAN Sessions 22-4 Monitored Traffic 22-5 Source Ports 22-6 Source VLANs 22-7 VLAN Filtering 22-7 Destination Port 22-8 RSPAN VLAN 22-9 SPAN and RSPAN Interaction with Other Features 22-9 SPAN and RSPAN and Switch Stacks 22-10 Configuring SPAN and RSPAN 22-10 Default SPAN and RSPAN Configuration 22-11 Configuring Local SPAN 22-11 SPAN Configuration Guidelines 22-11 Creating a Local SPAN Session 22-12Contents xix Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Creating a Local SPAN Session and Configuring Ingress Traffic 22-14 Specifying VLANs to Filter 22-16 Configuring RSPAN 22-17 RSPAN Configuration Guidelines 22-17 Configuring a VLAN as an RSPAN VLAN 22-18 Creating an RSPAN Source Session 22-19 Creating an RSPAN Destination Session 22-20 Creating an RSPAN Destination Session and Configuring Ingress Traffic 22-21 Specifying VLANs to Filter 22-23 Displaying SPAN and RSPAN Status 22-24 C H A P T E R 23 Configuring RMON 23-1 Understanding RMON 23-1 Configuring RMON 23-2 Default RMON Configuration 23-3 Configuring RMON Alarms and Events 23-3 Collecting Group History Statistics on an Interface 23-5 Collecting Group Ethernet Statistics on an Interface 23-6 Displaying RMON Status 23-6 C H A P T E R 24 Configuring System Message Logging 24-1 Understanding System Message Logging 24-1 Configuring System Message Logging 24-2 System Log Message Format 24-2 Default System Message Logging Configuration 24-4 Disabling Message Logging 24-4 Setting the Message Display Destination Device 24-5 Synchronizing Log Messages 24-6 Enabling and Disabling Timestamps on Log Messages 24-8 Enabling and Disabling Sequence Numbers in Log Messages 24-8 Defining the Message Severity Level 24-9 Limiting Syslog Messages Sent to the History Table and to SNMP 24-10 Configuring UNIX Syslog Servers 24-11 Logging Messages to a UNIX Syslog Daemon 24-11 Configuring the UNIX System Logging Facility 24-12 Displaying the Logging Configuration 24-13Contents xx Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 25 Configuring SNMP 25-1 Understanding SNMP 25-1 SNMP Versions 25-2 SNMP Manager Functions 25-3 SNMP Agent Functions 25-4 SNMP Community Strings 25-4 Using SNMP to Access MIB Variables 25-5 SNMP Notifications 25-5 Configuring SNMP 25-6 Default SNMP Configuration 25-6 SNMP Configuration Guidelines 25-7 Disabling the SNMP Agent 25-7 Configuring Community Strings 25-8 Configuring SNMP Groups and Users 25-9 Configuring SNMP Notifications 25-12 Setting the Agent Contact and Location Information 25-15 Limiting TFTP Servers Used Through SNMP 25-15 SNMP Examples 25-16 Displaying SNMP Status 25-17 C H A P T E R 26 Configuring Network Security with ACLs 26-1 Understanding ACLs 26-1 Supported ACLs 26-2 Router ACLs 26-3 Port ACLs 26-4 VLAN Maps 26-4 Handling Fragmented and Unfragmented Traffic 26-5 ACLs and Switch Stacks 26-6 Configuring IP ACLs 26-6 Creating Standard and Extended IP ACLs 26-7 Access List Numbers 26-8 Creating a Numbered Standard ACL 26-9 Creating a Numbered Extended ACL 26-10 Creating Named Standard and Extended ACLs 26-14 Using Time Ranges with ACLs 26-16 Including Comments in ACLs 26-18 Applying an IP ACL to a Terminal Line 26-18 Applying an IP ACL to an Interface 26-19 Hardware and Software Treatment of IP ACLs 26-20Contents xxi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 IP ACL Configuration Examples 26-21 Numbered ACLs 26-23 Extended ACLs 26-23 Named ACLs 26-24 Time Range Applied to an IP ACL 26-24 Commented IP ACL Entries 26-25 ACL Logging 26-25 Creating Named MAC Extended ACLs 26-26 Applying a MAC ACL to a Layer 2 Interface 26-28 Configuring VLAN Maps 26-29 VLAN Map Configuration Guidelines 26-29 Creating a VLAN Map 26-30 Examples of ACLs and VLAN Maps 26-31 Applying a VLAN Map to a VLAN 26-33 Using VLAN Maps in Your Network 26-33 Wiring Closet Configuration 26-33 Denying Access to a Server on Another VLAN 26-35 Using VLAN Maps with Router ACLs 26-36 Guidelines 26-36 Examples of Router ACLs and VLAN Maps Applied to VLANs 26-37 ACLs and Switched Packets 26-37 ACLs and Bridged Packets 26-38 ACLs and Routed Packets 26-39 ACLs and Multicast Packets 26-40 Displaying ACL Configuration 26-41 C H A P T E R 27 Configuring QoS 27-1 Understanding QoS 27-1 Basic QoS Model 27-3 Classification 27-4 Classification Based on QoS ACLs 27-7 Classification Based on Class Maps and Policy Maps 27-7 Policing and Marking 27-8 Mapping Tables 27-10 Queueing and Scheduling Overview 27-11 Weighted Tail Drop 27-11 SRR Shaping and Sharing 27-12 Queueing and Scheduling on Ingress Queues 27-13 Queueing and Scheduling on Egress Queues 27-15Contents xxii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Packet Modification 27-17 Configuring Auto-QoS 27-18 Generated Auto-QoS Configuration 27-18 Effects of Auto-QoS on the Configuration 27-22 Auto-QoS Configuration Guidelines 27-22 Enabling Auto-QoS for VoIP 27-22 Auto-QoS Configuration Example 27-24 Displaying Auto-QoS Information 27-26 Configuring Standard QoS 27-26 Default Standard QoS Configuration 27-27 Default Ingress Queue Configuration 27-27 Default Egress Queue Configuration 27-28 Default Mapping Table Configuration 27-28 Standard QoS Configuration Guidelines 27-29 Enabling QoS Globally 27-30 Configuring Classification Using Port Trust States 27-30 Configuring the Trust State on Ports within the QoS Domain 27-31 Configuring the CoS Value for an Interface 27-33 Configuring a Trusted Boundary to Ensure Port Security 27-34 Configuring the DSCP Trust State on a Port Bordering Another QoS Domain 27-35 Configuring a QoS Policy 27-36 Classifying Traffic by Using ACLs 27-37 Classifying Traffic by Using Class Maps 27-40 Classifying, Policing, and Marking Traffic by Using Policy Maps 27-42 Classifying, Policing, and Marking Traffic by Using Aggregate Policers 27-45 Configuring DSCP Maps 27-47 Configuring the CoS-to-DSCP Map 27-47 Configuring the IP-Precedence-to-DSCP Map 27-48 Configuring the Policed-DSCP Map 27-49 Configuring the DSCP-to-CoS Map 27-50 Configuring the DSCP-to-DSCP-Mutation Map 27-51 Configuring Ingress Queue Characteristics 27-52 Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds 27-53 Allocating Buffer Space Between the Ingress Queues 27-54 Allocating Bandwidth Between the Ingress Queues 27-55 Configuring the Ingress Priority Queue 27-56 Configuring Egress Queue Characteristics 27-57 Allocating Buffer Space to and Setting WTD Thresholds for an Egress Queue-Set 27-57 Mapping DSCP or CoS Values to an Egress Queue and to a Threshold ID 27-59Contents xxiii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Configuring SRR Shaped Weights on Egress Queues 27-61 Configuring SRR Shared Weights on Egress Queues 27-62 Limiting the Bandwidth on an Egress Interface 27-63 Displaying Standard QoS Information 27-64 C H A P T E R 28 Configuring EtherChannels 28-1 Understanding EtherChannels 28-1 EtherChannel Overview 28-2 Port-Channel Interfaces 28-4 Port Aggregation Protocol 28-5 PAgP Modes 28-5 PAgP Interaction with Other Features 28-6 Link Aggregation Control Protocol 28-6 LACP Modes 28-7 LACP Interaction with Other Features 28-7 Load Balancing and Forwarding Methods 28-7 EtherChannel and Switch Stacks 28-9 Configuring EtherChannels 28-10 Default EtherChannel Configuration 28-10 EtherChannel Configuration Guidelines 28-11 Configuring Layer 2 EtherChannels 28-12 Configuring Layer 3 EtherChannels 28-14 Creating Port-Channel Logical Interfaces 28-14 Configuring the Physical Interfaces 28-15 Configuring EtherChannel Load Balancing 28-17 Configuring the PAgP Learn Method and Priority 28-18 Configuring LACP Hot-Standby Ports 28-20 Configuring the LACP System Priority 28-20 Configuring the LACP Port Priority 28-21 Displaying EtherChannel, PAgP, and LACP Status 28-22 C H A P T E R 29 Configuring IP Unicast Routing 29-1 Understanding IP Routing 29-2 Types of Routing 29-2 IP Routing and Switch Stacks 29-3 Steps for Configuring Routing 29-4 Configuring IP Addressing 29-5 Default Addressing Configuration 29-5 Assigning IP Addresses to Network Interfaces 29-6Contents xxiv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Use of Subnet Zero 29-7 Classless Routing 29-7 Configuring Address Resolution Methods 29-9 Define a Static ARP Cache 29-10 Set ARP Encapsulation 29-11 Enable Proxy ARP 29-11 Routing Assistance When IP Routing is Disabled 29-12 Proxy ARP 29-12 Default Gateway 29-12 ICMP Router Discovery Protocol (IRDP) 29-13 Configuring Broadcast Packet Handling 29-14 Enabling Directed Broadcast-to-Physical Broadcast Translation 29-14 Forwarding UDP Broadcast Packets and Protocols 29-15 Establishing an IP Broadcast Address 29-16 Flooding IP Broadcasts 29-17 Monitoring and Maintaining IP Addressing 29-18 Enabling IP Unicast Routing 29-19 Configuring RIP 29-20 Default RIP Configuration 29-20 Configuring Basic RIP Parameters 29-21 Configuring RIP Authentication 29-23 Configuring Summary Addresses and Split Horizon 29-23 Configuring IGRP 29-25 Default IGRP Configuration 29-26 Understanding Load Balancing and Traffic Distribution Control 29-26 Configuring Basic IGRP Parameters 29-27 Configuring Split Horizon 29-29 Configuring OSPF 29-30 Default OSPF Configuration 29-31 Configuring Basic OSPF Parameters 29-32 Configuring OSPF Interfaces 29-33 Configuring OSPF Area Parameters 29-34 Configuring Other OSPF Parameters 29-35 Changing LSA Group Pacing 29-37 Configuring a Loopback Interface 29-37 Monitoring OSPF 29-38Contents xxv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Configuring EIGRP 29-39 Default EIGRP Configuration 29-40 Configuring Basic EIGRP Parameters 29-41 Configuring EIGRP Interfaces 29-42 Configuring EIGRP Route Authentication 29-43 Monitoring and Maintaining EIGRP 29-44 Configuring BGP 29-45 Default BGP Configuration 29-47 Enabling BGP Routing 29-49 Managing Routing Policy Changes 29-51 Configuring BGP Decision Attributes 29-52 Configuring BGP Filtering with Route Maps 29-54 Configuring BGP Filtering by Neighbor 29-55 Configuring Prefix Lists for BGP Filtering 29-56 Configuring BGP Community Filtering 29-57 Configuring BGP Neighbors and Peer Groups 29-59 Configuring Aggregate Addresses 29-61 Configuring Routing Domain Confederations 29-61 Configuring BGP Route Reflectors 29-62 Configuring Route Dampening 29-63 Monitoring and Maintaining BGP 29-64 Configuring Protocol-Independent Features 29-66 Configuring Distributed Cisco Express Forwarding 29-66 Configuring the Number of Equal-Cost Routing Paths 29-67 Configuring Static Unicast Routes 29-68 Specifying Default Routes and Networks 29-69 Using Route Maps to Redistribute Routing Information 29-70 Configuring Policy-Based Routing 29-74 PBR Configuration Guidelines 29-75 Enabling PBR 29-76 Filtering Routing Information 29-77 Setting Passive Interfaces 29-77 Controlling Advertising and Processing in Routing Updates 29-78 Filtering Sources of Routing Information 29-79 Managing Authentication Keys 29-80 Monitoring and Maintaining the IP Network 29-81Contents xxvi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 30 Configuring HSRP 30-1 Understanding HSRP 30-1 HSRP and Switch Stacks 30-2 Configuring HSRP 30-3 Default HSRP Configuration 30-4 HSRP Configuration Guidelines 30-4 Enabling HSRP 30-5 Configuring HSRP Group Attributes 30-6 Configuring HSRP Priority 30-6 Configuring HSRP Authentication and Timers 30-8 Configuring HSRP Groups and Clustering 30-9 Displaying HSRP Configurations 30-10 C H A P T E R 31 Configuring IP Multicast Routing 31-1 Understanding Cisco’s Implementation of IP Multicast Routing 31-2 Understanding IGMP 31-2 IGMP Version 1 31-3 IGMP Version 2 31-3 Understanding PIM 31-3 PIM Versions 31-4 PIM Modes 31-4 Auto-RP 31-5 Bootstrap Router 31-5 Multicast Forwarding and Reverse Path Check 31-6 Understanding DVMRP 31-7 Understanding CGMP 31-7 Multicast Routing and Switch Stacks 31-8 Configuring IP Multicast Routing 31-8 Default Multicast Routing Configuration 31-9 Multicast Routing Configuration Guidelines 31-9 PIMv1 and PIMv2 Interoperability 31-9 Auto-RP and BSR Configuration Guidelines 31-10 Configuring Basic Multicast Routing 31-10 Configuring a Rendezvous Point 31-12 Manually Assigning an RP to Multicast Groups 31-12 Configuring Auto-RP 31-14 Configuring PIMv2 BSR 31-18 Using Auto-RP and a BSR 31-22Contents xxvii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Monitoring the RP Mapping Information 31-23 Troubleshooting PIMv1 and PIMv2 Interoperability Problems 31-23 Configuring Advanced PIM Features 31-23 Understanding PIM Shared Tree and Source Tree 31-23 Delaying the Use of PIM Shortest-Path Tree 31-25 Modifying the PIM Router-Query Message Interval 31-26 Configuring Optional IGMP Features 31-27 Default IGMP Configuration 31-27 Configuring the Switch as a Member of a Group 31-27 Controlling Access to IP Multicast Groups 31-28 Changing the IGMP Version 31-29 Modifying the IGMP Host-Query Message Interval 31-30 Changing the IGMP Query Timeout for IGMPv2 31-31 Changing the Maximum Query Response Time for IGMPv2 31-31 Configuring the Switch as a Statically Connected Member 31-32 Configuring Optional Multicast Routing Features 31-32 Enabling CGMP Server Support 31-33 Configuring sdr Listener Support 31-34 Enabling sdr Listener Support 31-34 Limiting How Long an sdr Cache Entry Exists 31-35 Configuring an IP Multicast Boundary 31-35 Configuring Basic DVMRP Interoperability Features 31-37 Configuring DVMRP Interoperability 31-37 Configuring a DVMRP Tunnel 31-39 Advertising Network 0.0.0.0 to DVMRP Neighbors 31-41 Responding to mrinfo Requests 31-42 Configuring Advanced DVMRP Interoperability Features 31-42 Enabling DVMRP Unicast Routing 31-43 Rejecting a DVMRP Nonpruning Neighbor 31-44 Controlling Route Exchanges 31-46 Limiting the Number of DVMRP Routes Advertised 31-46 Changing the DVMRP Route Threshold 31-46 Configuring a DVMRP Summary Address 31-47 Disabling DVMRP Autosummarization 31-49 Adding a Metric Offset to the DVMRP Route 31-49 Monitoring and Maintaining IP Multicast Routing 31-50 Clearing Caches, Tables, and Databases 31-51 Displaying System and Network Statistics 31-51 Monitoring IP Multicast Routing 31-52Contents xxviii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 32 Configuring MSDP 32-1 Understanding MSDP 32-1 MSDP Operation 32-2 MSDP Benefits 32-3 Configuring MSDP 32-4 Default MSDP Configuration 32-4 Configuring a Default MSDP Peer 32-4 Caching Source-Active State 32-6 Requesting Source Information from an MSDP Peer 32-8 Controlling Source Information that Your Switch Originates 32-8 Redistributing Sources 32-9 Filtering Source-Active Request Messages 32-11 Controlling Source Information that Your Switch Forwards 32-12 Using a Filter 32-12 Using TTL to Limit the Multicast Data Sent in SA Messages 32-14 Controlling Source Information that Your Switch Receives 32-14 Configuring an MSDP Mesh Group 32-16 Shutting Down an MSDP Peer 32-16 Including a Bordering PIM Dense-Mode Region in MSDP 32-17 Configuring an Originating Address other than the RP Address 32-18 Monitoring and Maintaining MSDP 32-19 C H A P T E R 33 Configuring Fallback Bridging 33-1 Understanding Fallback Bridging 33-1 Fallback Bridging Overview 33-1 Fallback Bridging and Switch Stacks 33-3 Configuring Fallback Bridging 33-3 Default Fallback Bridging Configuration 33-4 Fallback Bridging Configuration Guidelines 33-4 Creating a Bridge Group 33-4 Adjusting Spanning-Tree Parameters 33-6 Changing the VLAN-Bridge Spanning-Tree Priority 33-7 Changing the Interface Priority 33-7 Assigning a Path Cost 33-8 Adjusting BPDU Intervals 33-9 Disabling the Spanning Tree on an Interface 33-11 Monitoring and Maintaining Fallback Bridging 33-11Contents xxix Catalyst 3750 Switch Software Configuration Guide 78-15164-02 C H A P T E R 34 Troubleshooting 34-1 Recovering from Corrupted Software By Using the XMODEM Protocol 34-2 Recovering from a Lost or Forgotten Password 34-4 Procedure with Password Recovery Enabled 34-5 Procedure with Password Recovery Disabled 34-6 Preventing Switch Stack Problems 34-8 Recovering from a Command Switch Failure 34-9 Replacing a Failed Command Switch with a Cluster Member 34-9 Replacing a Failed Command Switch with Another Switch 34-11 Recovering from Lost Cluster Member Connectivity 34-12 Preventing Autonegotiation Mismatches 34-12 SFP Module Security and Identification 34-13 Using Ping 34-13 Understanding Ping 34-13 Executing Ping 34-14 Using Layer 2 Traceroute 34-15 Understanding Layer 2 Traceroute 34-15 Switches Supporting Layer 2 Traceroute 34-15 Usage Guidelines 34-16 Displaying the Physical Path 34-17 Using Debug Commands 34-17 Enabling Debugging on a Specific Feature 34-17 Enabling All-System Diagnostics 34-18 Redirecting Debug and Error Message Output 34-18 Using the show platform forward Command 34-19 Using the crashinfo File 34-21 A P P E N D I X A Supported MIBs A-1 MIB List A-1 Using FTP to Access the MIB Files A-3 A P P E N D I X B Working with the Cisco IOS File System, Configuration Files, and Software Images B-1 Working with the Flash File System B-1 Displaying Available File Systems B-2 Setting the Default File System B-3 Displaying Information about Files on a File System B-3 Changing Directories and Displaying the Working Directory B-4 Creating and Removing Directories B-4Contents xxx Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Copying Files B-5 Deleting Files B-6 Creating, Displaying, and Extracting tar Files B-6 Creating a tar File B-6 Displaying the Contents of a tar File B-7 Extracting a tar File B-8 Displaying the Contents of a File B-8 Working with Configuration Files B-9 Guidelines for Creating and Using Configuration Files B-10 Configuration File Types and Location B-10 Creating a Configuration File By Using a Text Editor B-11 Copying Configuration Files By Using TFTP B-11 Preparing to Download or Upload a Configuration File By Using TFTP B-11 Downloading the Configuration File By Using TFTP B-12 Uploading the Configuration File By Using TFTP B-12 Copying Configuration Files By Using FTP B-13 Preparing to Download or Upload a Configuration File By Using FTP B-14 Downloading a Configuration File By Using FTP B-14 Uploading a Configuration File By Using FTP B-16 Copying Configuration Files By Using RCP B-17 Preparing to Download or Upload a Configuration File By Using RCP B-17 Downloading a Configuration File By Using RCP B-18 Uploading a Configuration File By Using RCP B-19 Clearing Configuration Information B-20 Clearing the Startup Configuration File B-20 Deleting a Stored Configuration File B-20 Working with Software Images B-21 Image Location on the Switch B-21 tar File Format of Images on a Server or Cisco.com B-22 Copying Image Files By Using TFTP B-23 Preparing to Download or Upload an Image File By Using TFTP B-23 Downloading an Image File By Using TFTP B-24 Uploading an Image File By Using TFTP B-25 Copying Image Files By Using FTP B-26 Preparing to Download or Upload an Image File By Using FTP B-26 Downloading an Image File By Using FTP B-27 Uploading an Image File By Using FTP B-29Contents xxxi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Copying Image Files By Using RCP B-30 Preparing to Download or Upload an Image File By Using RCP B-30 Downloading an Image File By Using RCP B-32 Uploading an Image File By Using RCP B-34 Copying an Image File from One Stack Member to Another B-35 A P P E N D I X C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 C-1 Access Control Lists C-1 Unsupported Privileged EXEC Commands C-1 Unsupported Global Configuration Commands C-1 ARP Commands C-2 Unsupported Global Configuration Commands C-2 Unsupported Interface Configuration Commands C-2 FallBack Bridging C-2 Unsupported Privileged EXEC Commands C-2 Unsupported Global Configuration Commands C-2 Unsupported Interface Configuration Commands C-3 HSRP C-4 Unsupported Global Configuration Commands C-4 Unsupported Interface Configuration Commands C-4 IGMP Snooping Commands C-4 Unsupported Global Configuration Commands C-4 Interface Commands C-4 Unsupported Privileged EXEC Commands C-4 Unsupported Interface Configuration Commands C-5 IP Multicast Routing C-5 Unsupported Privileged EXEC Commands C-5 Unsupported Global Configuration Commands C-5 Unsupported Interface Configuration Commands C-6 IP Unicast Routing C-6 Unsupported Privileged EXEC or User EXEC Commands C-6 Unsupported Global Configuration Commands C-7 Unsupported Interface Configuration Commands C-7 Unsupported BGP Router Configuration Commands C-8 Unsupported VPN Configuration Commands C-8 Unsupported Route Map Commands C-8 MSDP C-9 Unsupported Privileged EXEC Commands C-9 Unsupported Global Configuration Commands C-9Contents xxxii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 RADIUS C-9 Unsupported Global Configuration Commands C-9 SNMP C-9 Unsupported Global Configuration Commands C-9 Spanning Tree C-10 Unsupported Global Configuration Commands C-10 Unsupported Interface Configuration Commands C-10 VLAN C-10 Unsupported vlan-config Commands C-10 Unsupported User EXEC Commands C-10 VTP C-10 Unsupported Privileged EXEC Commands C-10 Miscellaneous C-11 Unsupported Global Configuration Commands C-11 IN D E Xxxxiii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Audience This guide is for the networking professional managing the Catalyst 3750 switch, hereafter referred to as the switch. Before using this guide, you should have experience working with the Cisco IOS software and be familiar with the concepts and terminology of Ethernet and local area networking. Purpose The Catalyst 3750 switch is supported by either the standard multilayer image (SMI) or the enhanced multilayer image (EMI). The SMI provides Layer 2+ features including access control lists (ACLs), quality of service (QoS), static routing, and the Routing Information Protocol (RIP). The EMI provides a richer set of enterprise-class features. It includes Layer 2+ features and full Layer 3 routing (IP unicast routing, IP multicast routing, and fallback bridging). To distinguish it from the Layer 2+ static routing and RIP, the EMI includes protocols such as the Enhanced Interior Gateway Routing Protocol (EIGRP) and Open Shortest Path First (OSPF) Protocol. This guide provides procedures for using the commands that have been created or changed for use with the Catalyst 3750 switch. It does not provide detailed information about these commands. For detailed information about these commands, refer to the Catalyst 3750 Switch Command Reference for this release. For information about the standard Cisco IOS Release 12.1 commands, refer to the IOS documentation set available from the Cisco.com home page at Service and Support > Technical Documents. On the Cisco Product Documentation home page, select Release 12.1 from the Cisco IOS Software drop-down list. This guide also includes an overview of the Cluster Management Suite (CMS), a web-based switch management interface that helps you create and manage clusters of switches. This guide does not provide field-level descriptions of the CMS windows nor does it provide the procedures for configuring switches and switch clusters from CMS. For all CMS window descriptions and procedures, refer to the CMS online help, which is integrated with the software image. This guide does not describe system messages you might encounter or how to install your switch. For more information, refer to the Catalyst 3750 Switch System Message Guide for this release and to the Catalyst 3750 Switch Hardware Installation Guide.xxxiv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Conventions Conventions This publication uses these conventions to convey instructions and information: Command descriptions use these conventions: • Commands and keywords are in boldface text. • Arguments for which you supply values are in italic. • Square brackets ([ ]) mean optional elements. • Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements. • Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional element. Interactive examples use these conventions: • Terminal sessions and system displays are in screen font. • Information you enter is in boldface screen font. • Nonprinting characters, such as passwords or tabs, are in angle brackets (< >). Notes, cautions, and timesavers use these conventions and symbols: Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual. Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data. Timesaver Means the following will help you solve a problem. The tips information might not be troubleshooting or even an action, but could be useful information.xxxv Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Related Publications Related Publications These documents provide complete information about the switch and are available from this Cisco.com site: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/index.htm You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the “Ordering Documentation” section on page xxxvi. • Release Notes for the Catalyst 3750 Switch (not orderable but available on Cisco.com) • Catalyst 3750 Switch Software Configuration Guide (order number DOC-7815164=) • Catalyst 3750 Switch Command Reference (order number DOC-7815165=) • Catalyst 3750 Switch System Message Guide (order number DOC-7815166=) • Cluster Management Suite (CMS) online help (available only from the switch CMS software) • Catalyst 3750 Switch Hardware Installation Guide (order number DOC-7815136=) • Cisco Small Form-Factor Pluggable Modules Installation Notes (not orderable but available on Cisco.com) Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL: http://www.cisco.com International Cisco websites can be accessed from this URL: http://www.cisco.com/public/countries_languages.shtml Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription. Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html All users can order annual or quarterly subscriptions through the online Subscription Store: http://www.cisco.com/go/subscriptionxxxvi Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Obtaining Technical Assistance Ordering Documentation You can find instructions for ordering documentation at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways: • Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace: http://www.cisco.com/en/US/partner/ordering/index.shtml • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can send your comments in e-mail to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Obtaining Technical Assistance For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. Cisco TAC Website The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year. Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL: http://tools.cisco.com/RPF/register/register.doxxxvii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Obtaining Additional Publications and Information Opening a TAC Case The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer. For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly. To open a case by telephone, use one of the following numbers: Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227) EMEA: +32 2 704 55 55 USA: 1 800 553-2447 For a complete listing of Cisco TAC contacts, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml TAC Case Priority Definitions To ensure that all cases are reported in a standard format, Cisco has established case priority definitions. Priority 1 (P1)—Your network is “down” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels. Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. • The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: http://www.cisco.com/en/US/products/products_catalog_links_launch.html • Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: http://www.ciscopress.comxxxviii Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Preface Obtaining Additional Publications and Information • Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL: http://www.cisco.com/go/packet • iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL: http://www.cisco.com/go/iqmagazine • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html • Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL: http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.htmlC H A P T E R 1-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 1 Overview This chapter provides these topics about the Catalyst 3750 switch software: • Features, page 1-1 • Default Settings After Initial Switch Configuration, page 1-9 • Network Configuration Examples, page 1-11 • Where to Go Next, page 1-21 Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Features The Catalyst 3750 switches are shipped with either of these software images installed: • Standard multilayer image (SMI), which provides Layer 2+ features (enterprise-class intelligent services). These features include access control lists (ACLs), quality of service (QoS), static routing, and the Hot Standby Router Protocol (HSRP) and Routing Information Protocol (RIP). Switches with the SMI installed can be upgraded to the EMI. • Enhanced multilayer image (EMI), which provides a richer set of enterprise-class intelligent services. It includes all SMI features plus full Layer 3 routing (IP unicast routing, IP multicast routing, and fallback bridging). To distinguish it from the Layer 2+ static routing and RIP, the EMI includes protocols such as the Enhanced Interior Gateway Routing Protocol (EIGRP) and Open Shortest Path First (OSPF) Protocol. EMI-only features are noted in the “Layer 3 Features” section on page 1-8. Note Unless otherwise noted, all features described in this chapter and in this guide are supported on both the SMI and EMI. Note Some features noted in this chapter are available only on the cryptographic (that is, supports encryption) versions of the SMI and EMI. You must obtain authorization to use this feature and to download the cryptographic version of the software from Cisco.com. For more information, refer to the release notes for this release.1-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features The Catalyst 3750 switches have these features: • Ease-of-Use and Ease-of-Deployment Features, page 1-2 • Performance Features, page 1-3 • Management Options, page 1-4 • Manageability Features, page 1-4 (includes a feature requiring the cryptographic [that is, supports encryption] versions of the SMI and EMI) • Availability Features, page 1-5 • VLAN Features, page 1-5 • Security Features, page 1-6 (includes a feature requiring the cryptographic [that is, supports encryption] versions of the SMI and EMI) • QoS and CoS Features, page 1-7 • Layer 3 Features, page 1-8 (includes features requiring the EMI) • Monitoring Features, page 1-8 Ease-of-Use and Ease-of-Deployment Features • Express Setup for quickly configuring a switch for the first time with basic IP information, contact information, switch and Telnet passwords, and Simple Network Management Protocol (SNMP) information through a browser-based program • Cluster Management Suite (CMS) graphical user interface (GUI) for – Simplifying and minimizing switch, switch stack, and switch cluster management through a supported web browser from anywhere in your intranet. – Accomplishing multiple configuration tasks from a single CMS window without needing to remember command-line interface (CLI) commands to accomplish specific tasks. – Interactive guide mode that guides you in configuring complex features such as VLANs, ACLs, and quality of service (QoS). – Automated configuration wizards that prompt you to provide only the minimum required information to configure complex features such as QoS priorities for video traffic, priority levels for data applications, and security. – Applying actions to multiple ports and multiple switches at the same time, such as VLAN and QoS settings, inventory and statistic reports, link- and switch-level monitoring and troubleshooting, and multiple switch software upgrades. – Viewing a topology of interconnected devices to identify existing switch clusters and eligible switches that can join a cluster and to identify link information between switches. – Monitoring real-time status of a switch or multiple switches from the LEDs on the front-panel images. The system, redundant power system (RPS), and port LED colors on the images are similar to those used on the physical LEDs. • Cisco StackWise technology for – Connecting up to nine switches through their StackWise ports and operating as a single switch or switch-router in the network. – Creating a bidirectional 32-Gbps switching fabric across the switch stack, where all stack members have full access to the system bandwidth. – Using a single IP address and configuration file to manage the entire switch stack.1-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features – Automatic Cisco IOS version-check of new stack members with the option to automatically load images from the stack master or from a Trivial File Transfer Protocol (TFTP) server. – Adding, removing, and replacing switches in the stack without disrupting the operation of the stack. • Switch clustering technology for – Unified configuration, monitoring, authentication, and software upgrade of multiple, cluster-capable switches, regardless of their geographic proximity and interconnection media, including Ethernet, Fast Ethernet, Fast EtherChannel, small form-factor pluggable (SFP) modules, Gigabit Ethernet, and Gigabit EtherChannel connections. Refer to the release notes for a list of cluster-capable switches. – Automatic discovery of candidate switches and creation of clusters of up to 16 switches that can be managed through a single IP address. – Extended discovery of cluster candidates that are not directly connected to the command switch. Performance Features • Autosensing of port speed and autonegotiation of duplex mode on all switch ports for optimizing bandwidth • Automatic-media-dependent interface crossover (Auto MDIX) capability on 10/100 and 10/100/1000 Mbps interfaces that enables the interface to automatically detect the required cable connection type (straight through or crossover) and configure the connection appropriately • IEEE 802.3X flow control on all ports (the switch does not send pause frames) • Up to 32 Gbps of forwarding rates in a switch stack • EtherChannel for enhanced fault tolerance and for providing up to 8 Gbps (Gigabit EtherChannel) or 800 Mbps (Fast EtherChannel) full duplex of bandwidth between switches, routers, and servers • Port Aggregation Protocol (PAgP) and Link Aggregation Control Protocol (LACP) for automatic creation of EtherChannel links • Forwarding of Layer 2 and Layer 3 packets at Gigabit line rate across the switches in the stack • Per-port storm control for preventing broadcast, multicast, and unicast storms • Port blocking on forwarding unknown Layer 2 unknown unicast, multicast, and bridged broadcast traffic • Cisco Group Management Protocol (CGMP) server support and Internet Group Management Protocol (IGMP) snooping for IGMP versions 1 and 2: – (For CGMP devices) CGMP for limiting multicast traffic to specified end stations and reducing overall network traffic – (For IGMP devices) IGMP snooping for efficiently forwarding multimedia and multicast traffic • Multicast VLAN registration (MVR) to continuously send multicast streams in a multicast VLAN while isolating the streams from subscriber VLANs for bandwidth and security reasons • IGMP filtering for controlling the set of multicast groups to which hosts on a switch port can belong • Switch Database Management (SDM) templates for allocating system resources to maximize support for user-selected features1-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features Management Options • CMS—CMS is a graphical user interface that can be launched from anywhere in your network through a web browser such as Netscape Communicator or Microsoft Internet Explorer. CMS is already installed on the switch. For more information about CMS, see Chapter 3, “Getting Started with CMS.” • CLI—The Cisco IOS CLI software is enhanced to support desktop- and multilayer-switching features. You can access the CLI either by connecting your management station directly to the switch console port or by using Telnet from a remote management station. You can manage the switch stack by connecting to the console port of any stack member. For more information about the CLI, see Chapter 2, “Using the Command-Line Interface.” • SNMP—SNMP management applications such as CiscoWorks2000 LAN Management Suite (LMS) and HP OpenView. You can manage from an SNMP-compatible management station that is running platforms such as HP OpenView or SunNet Manager. The switch supports a comprehensive set of MIB extensions and four remote monitoring (RMON) groups. For more information about using SNMP, see Chapter 25, “Configuring SNMP.” Manageability Features Note The encrypted Secure Shell (SSH) feature listed in this section is available only on the cryptographic (that is, supports encryption) versions of the SMI and EMI. • Dynamic Host Configuration Protocol (DHCP) for automating configuration of switch information (such as IP address, default gateway, host name, and Domain Name System [DNS] and Trivial File Transfer Protocol (TFTP) server names) • Directed unicast requests to a DNS server for identifying a switch through its IP address and its corresponding host name and to a TFTP server for administering software upgrades from a TFTP server • Address Resolution Protocol (ARP) for identifying a switch through its IP address and its corresponding Media Access Control (MAC) address • Cisco Discovery Protocol (CDP) versions 1 and 2 for network topology discovery and mapping between the switch and other Cisco devices on the network • Network Time Protocol (NTP) for providing a consistent timestamp to all switches from an external source • Cisco IOS File System (IFS) for providing a single interface to all file systems that the switch uses • In-band management access through CMS over a Netscape Communicator or Microsoft Internet Explorer browser session • In-band management access for up to 16 simultaneous Telnet connections for multiple CLI-based sessions over the network • In-band management access for up to five simultaneous, encrypted Secure Shell (SSH) connections for multiple CLI-based sessions over the network (requires the cryptographic [that is, supports encryption] versions of the SMI and EMI) • In-band management access through SNMP versions 1 and 2c, and 3 get and set requests • Out-of-band management access through the switch console port to a directly attached terminal or to a remote terminal through a serial connection or a modem Note For additional descriptions of the management interfaces, see the “Network Configuration Examples” section on page 1-11.1-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features Availability Features • HSRP for command switch and Layer 3 router redundancy • Automatic stack master re-election for replacing stack masters that become unavailable (failover support) The newly elected stack master begins accepting Layer 2 traffic in less than 1 second and Layer 3 traffic between 3 to 5 seconds. • Cross-stack EtherChannel for providing redundant links across the switch stack • UniDirectional Link Detection (UDLD) and aggressive UDLD for detecting and disabling unidirectional links on fiber-optic interfaces caused by incorrect fiber-optic wiring or port faults • IEEE 802.1D Spanning Tree Protocol (STP) for redundant backbone connections and loop-free networks. STP has these features: – Up to 128 spanning-tree instances supported – Per-VLAN spanning-tree plus (PVST+) for balancing load across VLANs – Rapid PVST+ for balancing load across VLANs and providing rapid convergence of spanning-tree instances – UplinkFast, cross-stack UplinkFast, and BackboneFast for fast convergence after a spanning-tree topology change and for achieving load balancing between redundant uplinks, including Gigabit uplinks and cross-stack Gigabit uplinks • IEEE 802.1S Multiple Spanning Tree Protocol (MSTP) for grouping VLANs into a spanning-tree instance and for providing multiple forwarding paths for data traffic and load balancing and IEEE 802.1W Rapid Spanning Tree Protocol (RSTP) for rapid convergence of the spanning tree by immediately transitioning root and designated ports to the forwarding state • Optional spanning-tree features available in PVST+, rapid-PVST+, and MSTP mode: – Port Fast for eliminating the forwarding delay by enabling a port to immediately transition from the blocking state to the forwarding state – BPDU guard for shutting down Port Fast-enabled ports that receive bridge protocol data units (BPDUs) – BPDU filtering for preventing a Port Fast-enabled port from sending or receiving BPDUs – Root guard for preventing switches outside the network core from becoming the spanning-tree root – Loop guard for preventing alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link • Equal-cost routing for link-level and switch-level redundancy • RPS support through the Cisco RPS 300 and Cisco RPS 675 for enhancing power reliability VLAN Features • Support for up to 1005 VLANs for assigning users to VLANs associated with appropriate network resources, traffic patterns, and bandwidth • Support for VLAN IDs in the full 1 to 4094 range allowed by the IEEE 802.1Q standard • VLAN Query Protocol (VQP) for dynamic VLAN membership1-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features • Inter-Switch Link (ISL) and IEEE 802.1Q trunking encapsulation on all ports for network moves, adds, and changes; management and control of broadcast and multicast traffic; and network security by establishing VLAN groups for high-security users and network resources • Dynamic Trunking Protocol (DTP) for negotiating trunking on a link between two devices and for negotiating the type of trunking encapsulation (802.1Q or ISL) to be used • VLAN Trunking Protocol (VTP) and VTP pruning for reducing network traffic by restricting flooded traffic to links destined for stations receiving the traffic • Voice VLAN for creating subnets for voice traffic from Cisco IP Phones • VLAN1 minimization for reducing the risk of spanning-tree loops or storms by allowing VLAN 1 to be disabled on any individual VLAN trunk link. With this feature enabled, no user traffic is sent or received on the trunk. The switch CPU continues to send and receive control protocol frames. Security Features Note The Kerberos feature listed in this section is available only on the cryptographic (that is, supports encryption) versions of the SMI and EMI. • Password-protected access (read-only and read-write access) to management interfaces (CMS and CLI) for protection against unauthorized configuration changes • Multilevel security for a choice of security level, notification, and resulting actions • Static MAC addressing for ensuring security • Protected port option for restricting the forwarding of traffic to designated ports on the same switch • Port security option for limiting and identifying MAC addresses of the stations allowed to access the port • Port security aging to set the aging time for secure addresses on a port • BPDU guard for shutting down a Port Fast-configured port when an invalid configuration occurs • Standard and extended IP access control lists (ACLs) for defining security policies in both directions on routed interfaces (router ACLs) and VLANs and inbound on Layer 2 interfaces (port ACLs) • Extended MAC access control lists for defining security policies in the inbound direction on Layer 2 interfaces • VLAN ACLs (VLAN maps) for providing intra-VLAN security by filtering traffic based on information in the MAC, IP, and TCP/User Datagram Protocol (UDP) headers • Source and destination MAC-based ACLs for filtering non-IP traffic • IEEE 802.1X port-based authentication to prevent unauthorized devices (clients) from gaining access to the network – 802.1X with VLAN assignment for restricting 802.1X-authenticated users to a specified VLAN – 802.1X with port security for controlling access to 802.1X ports – 802.1X with voice VLAN to permit an IP phone access to the voice VLAN regardless of the authorized or unauthorized state of the port – 802.1X with guest VLAN to provide limited services to non-802.1X-compliant users • Terminal Access Controller Access Control System Plus (TACACS+), a proprietary feature for managing network security through a TACACS server1-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features • Remote Authentication Dial-In User Service (RADIUS) for verifying the identity of, granting access to, and tracking the actions of remote users through authentication, authorization, and accounting (AAA) services • Kerberos security system to authenticate requests for network resources by using a trusted third party (requires the cryptographic [that is, supports encryption] versions of the SMI and EMI) QoS and CoS Features • Automatic QoS (auto-QoS) to simplify the deployment of existing QoS features by classifying traffic and configuring egress queues (voice over IP only) • Cross-stack QoS for configuring QoS features to all switches in a switch stack rather than on an individual-switch basis • Classification – IP type-of-service/Differentiated Services Code Point (IP TOS/DSCP) and 802.1P CoS marking priorities on a per-port basis for protecting the performance of mission-critical applications – IP TOS/DSCP and 802.1P CoS marking based on flow-based packet classification (classification based on information in the MAC, IP, and TCP/UDP headers) for high-performance quality of service at the network edge, allowing for differentiated service levels for different types of network traffic and for prioritizing mission-critical traffic in the network – Trusted port states (CoS, DSCP, and IP precedence) within a QoS domain and with a port bordering another QoS domain – Trusted boundary for detecting the presence of a Cisco IP phone, trusting the CoS value received, and ensuring port security • Policing – Traffic-policing policies on the switch port for managing how much of the port bandwidth should be allocated to a specific traffic flow – Aggregate policing for policing traffic flows in aggregate to restrict specific applications or traffic flows to metered, predefined rates • Out-of-Profile – Out-of-profile markdown for packets that exceed bandwidth utilization limits • Ingress queueing and scheduling – Two configurable ingress queues for user traffic (one queue can be the priority queue) – Weighted tail drop (WTD) as the congestion-avoidance mechanism for managing the queue lengths and providing drop precedences for different traffic classifications – Shaped round robin (SRR) as the scheduling service for determining the rate at which packets are dequeued to the stack ring (sharing is the only supported mode on ingress queues) • Egress queues and scheduling – Four egress queues per port – WTD as the congestion-avoidance mechanism for managing the queue lengths and providing drop precedences for different traffic classifications – SRR as the scheduling service for determining the rate at which packets are dequeued to the egress interface (shaping or sharing is supported on egress queues). Shaped egress queues are guaranteed but limited to using a share of port bandwidth. Shared egress queues are also guaranteed a configured share of bandwidth, but can use more than the guarantee if other queues become empty and do not use their share of the bandwidth.1-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Features Layer 3 Features Note Some features noted in this section are available only on the EMI. • HSRP for Layer 3 router redundancy • IP routing protocols for load balancing and for constructing scalable, routed backbones: – RIP versions 1 and 2 – OSPF (requires the EMI) – Interior Gateway Routing Protocol (IGRP) and Enhanced IGRP (EIGRP) (requires the EMI) – Border Gateway Protocol (BGP) Version 4 (requires the EMI) • IP routing between VLANs (inter-VLAN routing) for full Layer 3 routing between two or more VLANs, allowing each VLAN to maintain its own autonomous data-link domain • Policy-based routing (PBR) for configuring defined policies for traffic flows • Fallback bridging for forwarding non-IP traffic between two or more VLANs (requires the EMI) • Static IP routing for manually building a routing table of network path information • Equal-cost routing for load balancing and redundancy • Internet Control Message Protocol (ICMP) and ICMP Router Discovery Protocol (IRDP) for using router advertisement and router solicitation messages to discover the addresses of routers on directly attached subnets • Protocol-Independent Multicast (PIM) for multicast routing within the network, allowing for devices in the network to receive the multicast feed requested and for switches not participating in the multicast to be pruned. Includes support for PIM sparse mode (PIM-SM), PIM dense mode (PIM-DM), and PIM sparse-dense mode. (requires the EMI) • Multicast Source Discovery Protocol (MSDP) for connecting multiple PIM-SM domains (requires the EMI) • Distance Vector Multicast Routing Protocol (DVMRP) tunnelling for interconnecting two multicast-enabled networks across non-multicast networks (requires the EMI) • DHCP relay for forwarding UDP broadcasts, including IP address requests, from DHCP clients Monitoring Features • Switch LEDs that provide port-, switch-, and stack-level status • MAC address notification traps and RADIUS accounting for tracking users on a network by storing the MAC addresses that the switch has learned or removed • Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) for traffic monitoring on any port or VLAN • SPAN and RSPAN support of Intrusion Detection Systems (IDS) to monitor, repel, and report network security violations • Four groups (history, statistics, alarms, and events) of embedded RMON agents for network monitoring and traffic analysis • Syslog facility for logging system messages about authentication or authorization errors, resource issues, and time-out events • Layer 2 traceroute to identify the physical path that a packet takes from a source device to a destination device1-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Default Settings After Initial Switch Configuration Default Settings After Initial Switch Configuration The switch is designed for plug-and-play operation, requiring only that you assign basic IP information to the switch and connect it to the other devices in your network. If you have specific network needs, you can change the interface-specific and system- and stack-wide settings. If you do not configure the switch at all, the switch operates with the default settings listed in Table 1-1. This table lists the key software features, their defaults, and where to find more information about the features. For information about setting up the initial switch configuration and assigning basic IP information to the switch, refer to the hardware installation guide. Table 1-1 Default Settings After Initial Switch Configuration Feature Default Setting More information in... Switch IP address, subnet mask, and default gateway 0.0.0.0 Chapter 4, “Assigning the Switch IP Address and Default Gateway” Domain name None DHCP DHCP client enabled Switch stack Enabled (not configurable) Chapter 5, “Managing Switch Stacks” Switch cluster Disabled Chapter 6, “Clustering Switches” Passwords None defined Chapter 7, “Administering the Switch” TACACS+ Disabled RADIUS Disabled System name and prompt Switch NTP Enabled DNS Enabled 802.1X Disabled Chapter 10, “Configuring 802.1X Port-Based Authentication” Port parameters Operating mode Layer 2 (switchport) Chapter 11, “Configuring Interface Characteristics” Interface speed and duplex mode Autonegotiate Auto MDIX Disabled Flow control Off VLANs Default VLAN VLAN 1 Chapter 12, “Configuring VLANs” VLAN trunking Dynamic auto (DTP) Trunk encapsulation Negotiate VTP mode Server Chapter 13, “Configuring VTP” VTP version 1 Voice VLAN Disabled Chapter 14, “Configuring Voice VLAN” STP PVST+ enabled on VLAN 1 Chapter 15, “Configuring STP” MSTP Disabled Chapter 16, “Configuring MSTP”1-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Default Settings After Initial Switch Configuration Optional spanning-tree features Disabled Chapter 17, “Configuring Optional Spanning-Tree Features” IGMP snooping IGMP snooping Enabled Chapter 18, “Configuring IGMP Snooping and MVR” IGMP filters None applied MVR Disabled Port-based Traffic Broadcast, multicast, and unicast storm control Disabled Chapter 19, “Configuring Port-Based Traffic Control” Protected ports None defined Unicast and multicast traffic flooding Not blocked Secure ports None configured CDP Enabled Chapter 20, “Configuring CDP” UDLD Disabled Chapter 21, “Configuring UDLD” SPAN and RSPAN Disabled Chapter 22, “Configuring SPAN and RSPAN” RMON Disabled Chapter 23, “Configuring RMON” Syslog messages Enabled; displayed on the console Chapter 24, “Configuring System Message Logging” SNMP Enabled; version 1 Chapter 25, “Configuring SNMP” ACLs None configured Chapter 26, “Configuring Network Security with ACLs” QoS Disabled Chapter 27, “Configuring QoS” EtherChannels None configured Chapter 28, “Configuring EtherChannels” IP unicast routing Disabled Chapter 29, “Configuring IP Unicast Routing” HSRP groups None configured Chapter 30, “Configuring HSRP” IP multicast routing Disabled on all interfaces Chapter 31, “Configuring IP Multicast Routing” MSDP Disabled Chapter 32, “Configuring MSDP” Fallback bridging Not configured Chapter 33, “Configuring Fallback Bridging” Table 1-1 Default Settings After Initial Switch Configuration (continued) Feature Default Setting More information in...1-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Network Configuration Examples This section provides network configuration concepts and includes examples of using the switch to create dedicated network segments and interconnecting the segments through Fast Ethernet and Gigabit Ethernet connections. • “Design Concepts for Using the Switch” section on page 1-11 • “Small to Medium-Sized Network Using Catalyst 3750 Switches” section on page 1-17 • “Large Network Using Catalyst 3750 Switches” section on page 1-18 • “Multidwelling Network Using Catalyst 3750 Switches” section on page 1-20 Design Concepts for Using the Switch As your network users compete for network bandwidth, it takes longer to send and receive data. When you configure your network, consider the bandwidth required by your network users and the relative priority of the network applications they use. Table 1-2 describes what can cause network performance to degrade and how you can configure your network to increase the bandwidth available to your network users. Table 1-2 Increasing Network Performance Network Demands Suggested Design Methods Too many users on a single network segment and a growing number of users accessing the Internet • Create smaller network segments so that fewer users share the bandwidth, and use VLANs and IP subnets to place the network resources in the same logical network as the users who access those resources most. • Use full-duplex operation between the switch and its connected workstations. • Increased power of new PCs, workstations, and servers • High bandwidth demand from networked applications (such as e-mail with large attached files) and from bandwidth-intensive applications (such as multimedia) • Connect global resources—such as servers and routers to which the network users require equal access—directly to the high-speed switch ports so that they have their own high-speed segment. • Use the EtherChannel feature between the switch and its connected servers and routers.1-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Bandwidth alone is not the only consideration when designing your network. As your network traffic profiles evolve, consider providing network services that can support applications for voice and data integration, multimedia integration, application prioritization, and security. Table 1-3 describes some network demands and how you can meet those demands. Table 1-3 Providing Network Services Network Demands Suggested Design Methods Efficient bandwidth usage for multimedia applications and guaranteed bandwidth for critical applications • Use IGMP snooping to efficiently forward multimedia and multicast traffic. • Use other QoS mechanisms such as packet classification, marking, scheduling, and congestion avoidance to classify traffic with the appropriate priority level, thereby providing maximum flexibility and support for mission-critical, unicast, and multicast and multimedia applications. • Use optional IP multicast routing to design networks better suited for multicast traffic. • Use MVR to continuously send multicast streams in a multicast VLAN but to isolate the streams from subscriber VLANs for bandwidth and security reasons. High demand on network redundancy and availability to provide always on mission-critical applications • Use switch stacks, where all stack members are eligible stack masters in case of stack-master failure. All stack members have synchronized copies of the saved and running configuration files of the switch stack. • Cross-stack EtherChannel for providing redundant links across the switch stack. • Use Hot Standby Router Protocol (HSRP) for cluster command switch and router redundancy. • Use VLAN trunks, cross-stack UplinkFast, and BackboneFast for traffic-load balancing on the uplink ports so that the uplink port with a lower relative port cost is selected to carry the VLAN traffic. An evolving demand for IP telephony • Use QoS to prioritize applications such as IP telephony during congestion and to help control both delay and jitter within the network. • Use switches that support at least two queues per port to prioritize voice and data traffic as either high- or low-priority, based on 802.1P/Q. The Catalyst 3750 switch supports at least four queues per port. • Use voice VLAN IDs (VVIDs) to provide separate VLANs for voice traffic. A growing demand for using existing infrastructure to transport data and voice from a home or office to the Internet or an intranet at higher speeds Use the Catalyst Long-Reach Ethernet (LRE) switches to provide up to 15 Mb of IP connectivity over existing infrastructure, such as existing telephone lines. Note LRE is the technology used in the Catalyst 2900 LRE XL and Catalyst 2950 LRE switches. Refer to the documentation sets specific to these switches for LRE information.1-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples You can use the switches and switch stacks to create the following: • Cost-effective wiring closet (Figure 1-1)—A cost-effective way to connect many users to the wiring closet is to have a switch stack of up to nine Catalyst 3750 switches. To preserve switch connectivity if one switch in the stack fails, connect the switches as recommended in the hardware installation guide, and enable either cross-stack Etherchannel or cross-stack UplinkFast. You can have redundant uplink connections, using SFP modules in the switch stack to a Gigabit backbone switch, such as a Catalyst 4500 or Catalyst 3750-12S Gigabit switch. You can also create backup paths by using Fast Ethernet, Gigabit, or EtherChannel links. If one of the redundant connections fails, the other can serve as a backup path. If the Gigabit switch is cluster-capable, you can configure it and the switch stack as a switch cluster to manage them through a single IP address. The Gigabit switch can be connected to a Gigabit server through a 1000BASE-T connection. Figure 1-1 Cost-Effective Wiring Closet • High-performance wiring closet (Figure 1-2) —For high-speed access to network resources, you can use Catalyst 3750 switches and switch stacks in the access layer to provide Gigabit Ethernet to the desktop. To prevent congestion, use QoS DSCP marking priorities on these switches. For high-speed IP forwarding at the distribution layer, connect the switches in the access layer to a Gigabit multilayer switch in the backbone, such as a Catalyst 4500 Gigabit switch or Catalyst 6500 Gigabit switch. Each switch in this configuration provides users with a dedicated 1-Gbps connection to network resources. Using SFP modules also provides flexibility in media and distance options through fiber-optic connections. Si Catalyst 3750 Layer 2 StackWise switch stack Catalyst Gigabit Ethernet multilayer switch Gigabit server 869271-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Figure 1-2 High-Performance Wiring Closet • Redundant Gigabit backbone—Using HSRP, you can create backup paths between two Catalyst 3750G multilayer Gigabit switches to enhance network reliability and load balancing for different VLANs and subnets. Using HSRP also provides faster network convergence if any network failure occurs. You can connect the Catalyst switches, again in a star configuration, to two Catalyst 3750 multilayer backbone switches. If one of the backbone switches fails, the second backbone switch preserves connectivity between the switches and network resources. Figure 1-3 Redundant Gigabit Backbone Si 86928 Catalyst 4500 or 6500 multilayer switch Catalyst 3750 Layer 3 StackWise switch stack 1-Gbps HSRP 93794 Catalyst 3750 switch Catalyst 3750 switch Catalyst switches1-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples • Server aggregation (Figure 1-4) and Linux server cluster (Figure 1-5)—You can use the switches and switch stacks to interconnect groups of servers, centralizing physical security and administration of your network. For high-speed IP forwarding at the distribution layer, connect the switches in the access layer to multilayer switches with routing capability. The Gigabit interconnections minimize latency in the data flow. QoS and policing on the switches provide preferential treatment for certain data streams, if required. They segment traffic streams into different paths for processing. Security features on the switch ensure rapid handling of packets. Dual homing of servers to dual switch stacks with redundant Gigabit EtherChannel and cross-stack EtherChannel provide fault tolerance from the server racks to the core. Using dual SFP uplinks from the Catalyst 3750 switches provide redundant uplinks to the network core. Using SFP modules provides flexibility in media and distance options through fiber-optic connections. The various lengths of stack cable available, ranging from 0.5 meter to 3 meters provide extended connections to the switch stacks across multiple server racks, for multiple stack aggregation. Figure 1-4 Server Aggregation 86931 Si Si Si Si Si Si Campus core Catalyst 6500 switches Catalyst 4500 multilayer switches Catalyst 3750 StackWise switch stacks Server racks1-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Figure 1-5 Linux Server Cluster 86932 Campus core Etherchannel across uplinks Linux cluster parallelprocessing server farm 32-Gbps ring Catalyst 3750 StackWise switch stack Catalyst 3750 StackWise switch stack Redundant SFP uplinks1-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Small to Medium-Sized Network Using Catalyst 3750 Switches Figure 1-6 shows a configuration for a network of up to 500 employees. This network uses a Layer 3 Catalyst 3750 switch stack with high-speed uplinks to two routers. For network reliability and load balancing, this network has HSRP enabled on the routers and on the switch stack. This ensures connectivity to the Internet, WAN, and mission-critical network resources in case one of the routers or switches fails. The switch stack is using routed uplinks for faster failover. It is also configured with equal-cost routing for load sharing and redundancy. (A Layer 2 switch stack can use cross-stack EtherChannel for load sharing.) The switch stack is connected to workstations, Cisco IP Phones, and local servers. This network uses VLANs to logically segment the network into well-defined broadcast groups and for security management. Data and multimedia traffic are configured on the same VLAN. Voice traffic from the Cisco IP Phones are configured on separate VVIDs. If data, multimedia, and voice traffic are assigned to the same VLAN, only one VLAN can be configured per wiring closet. For any switch port connected to Cisco IP Phones, 802.1P/Q QoS gives voice traffic forwarding-priority over data traffic. Cisco IP Phones not connected to Catalyst inline-power switches must be connected to AC power sources to receive power. When an end station in one VLAN needs to communicate with an end station in another VLAN, a router or multilayer switch routes the traffic to the appropriate destination VLAN. In this network, the switch stack is providing inter-VLAN routing. VLAN access control lists (VLAN maps) on the switch stack provide intra-VLAN security and prevent unauthorized users from accessing critical pieces of the network. In addition to inter-VLAN routing, the switch stack provides QoS mechanisms such as DSCP priorities to prioritize the different types of network traffic and to deliver high-priority traffic in a predictable manner. If congestion occurs, QoS drops low-priority traffic to allow delivery of high-priority traffic. With the switch stack providing inter-VLAN routing and other network services, the routers focus on firewall services, Network Address Translation (NAT) services, voice-over-IP (VoIP) gateway services, and WAN and Internet access. Figure 1-6 Catalyst 3750 Switch Stack in a Collapsed Backbone Configuration Gigabit servers 86929 Cisco 2600 or 3700 routers Catalyst 3750 multilayer StackWise switch stack Internet Cisco IP phones Workstations running Cisco SoftPhone software Aironet wireless access points IP IP1-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Large Network Using Catalyst 3750 Switches Switches in the wiring closet have traditionally been Layer 2-only devices, but as network traffic profiles evolve, switches in the wiring closet are increasingly employing multilayer services such as multicast management and traffic classification. Figure 1-7 shows a configuration for a network exclusively using multilayer switch stacks in the wiring closets and two backbone switches, such as the Catalyst 6000 switches, to aggregate up to ten wiring closets. In the wiring closet, each switch stack has IGMP snooping enabled to efficiently forward multimedia and multicast traffic. QoS ACLs that either drop or mark nonconforming traffic based on bandwidth limits are also configured on each switch stack. VLAN maps provide intra-VLAN security and prevent unauthorized users from accessing critical pieces of the network. QoS features can limit bandwidth on a per-port or per-user basis. The switch ports are configured as either trusted or untrusted. You can configure a trusted port to trust the CoS value, the DSCP value, or the IP precedence. If you configure the port as untrusted, you can use an ACL to mark the frame in accordance with the network policy. Each switch stack provides inter-VLAN routing. They provide proxy ARP services to determine IP and MAC address mapping, thereby removing this task from the routers and decreasing this type of traffic on the WAN links. These switch stacks also have redundant uplink connections to the backbone switches, with each uplink port configured as a trusted routed uplink to provide faster convergence in case of an uplink failure. The routers and backbone switches have HSRP enabled for load balancing and redundant connectivity to guarantee mission-critical traffic.1-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Figure 1-7 Catalyst 3750 Switch Stacks in Wiring Closets in a Backbone Configuration Cisco 7x00 routers Catalyst 6000 multilayer switches Cisco IP Phones with workstations Cisco IP Phones with workstations WAN IP IP IP IP IP IP 86930 Catalyst 3750 multilayer StackWise switch stack Catalyst 3750 multilayer StackWise switch stack1-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Network Configuration Examples Multidwelling Network Using Catalyst 3750 Switches A growing segment of residential and commercial customers are requiring high-speed access to Ethernet metropolitan-area networks (MANs). Figure 1-8 shows a configuration for a Gigabit Ethernet MAN ring using Catalyst 3750 multilayer switches as aggregation switches in the mini-point-of-presence (POP) location. These switches are connected through 1000BASE-X SFP module ports. The resident switches can be Catalyst 3750 switches, providing customers with high-speed connections to the MAN. Catalyst 2900 LRE XL and Catalyst 2950 LRE switches also can be used as residential switches for customers requiring connectivity through existing phone lines. The Catalyst 2900 LRE XL and Catalyst 2950 LRE switches can then connect to another residential switch or to a Catalyst 3750 aggregation switch. For more information about the Catalyst Long-Reach Ethernet (LRE) switches, refer to the documentation sets specific to these switches for LRE information. All ports on the residential Catalyst 3750 switches (and Catalyst 2950 LRE switches if they are included) are configured as 802.1Q trunks with Private VLAN Edge (protected port) and STP root guard features enabled. The protected port feature provides security and isolation between ports on the switch, ensuring that subscribers cannot view packets destined for other subscribers. STP root guard prevents unauthorized devices from becoming the STP root switch. All ports have IGMP snooping or CGMP enabled for multicast traffic management. ACLs on the uplink ports to the aggregating Catalyst 3750 multilayer switches provide security and bandwidth management. The aggregating switches and routers provide services such as those described in the examples in the “Small to Medium-Sized Network Using Catalyst 3750 Switches” section on page 1-17 and “Large Network Using Catalyst 3750 Switches” section on page 1-18.1-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Where to Go Next Figure 1-8 Catalyst 3750 Switches in a MAN Configuration Where to Go Next Before configuring the switch, review these sections for startup information: • Chapter 2, “Using the Command-Line Interface” • Chapter 3, “Getting Started with CMS” • Chapter 4, “Assigning the Switch IP Address and Default Gateway” 93795 Service Provider POP Mini-POP Gigabit MAN Residential location Catalyst 3750 StackWise switch stack Catalyst switches Catalyst 6500 switches Cisco 12000 Gigabit switch routers Si Si Si Residential gateway (hub) Set-top box TV PC Set-top box TV1-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 1 Overview Where to Go NextC H A P T E R 2-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 2 Using the Command-Line Interface This chapter describes the Cisco IOS command-line interface (CLI) and how to use it to configure your Catalyst 3750 switch. It contains these sections: • Understanding Command Modes, page 2-1 • Understanding the Help System, page 2-3 • Understanding Abbreviated Commands, page 2-4 • Understanding no and default Forms of Commands, page 2-4 • Understanding CLI Error Messages, page 2-5 • Using Command History, page 2-5 • Using Editing Features, page 2-6 • Searching and Filtering Output of show and more Commands, page 2-9 • Accessing the CLI, page 2-10 Understanding Command Modes The Cisco IOS user interface is divided into many different modes. The commands available to you depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a list of commands available for each command mode. When you start a session on the switch, you begin in user mode, often called user EXEC mode. Only a limited subset of the commands are available in user EXEC mode. For example, most of the user EXEC commands are one-time commands, such as show commands, which show the current configuration status, and clear commands, which clear counters or interfaces. The user EXEC commands are not saved when the switch reboots. To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a password to enter privileged EXEC mode. From this mode, you can enter any privileged EXEC command or enter global configuration mode. Using the configuration modes (global, interface, and line), you can make changes to the running configuration. If you save the configuration, these commands are stored and used when the switch reboots. To access the various configuration modes, you must start at global configuration mode. From global configuration mode, you can enter interface configuration mode and line configuration mode.2-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Understanding Command Modes Table 2- 1 describes the main command modes, how to access each one, the prompt you see in that mode, and how to exit the mode. The examples in the table use the host name Switch. Table 2-1 Command Mode Summary Mode Access Method Prompt Exit Method About This Mode User EXEC Begin a session with your switch. Switch> Enter logout or quit. Use this mode to • Change terminal settings. • Perform basic tests. • Display system information. Privileged EXEC While in user EXEC mode, enter the enable command. Switch# Enter disable to exit. Use this mode to verify commands that you have entered. Use a password to protect access to this mode. Global configuration While in privileged EXEC mode, enter the configure command. Switch(config)# To exit to privileged EXEC mode, enter exit or end, or press Ctrl-Z. Use this mode to configure parameters that apply to the entire switch. Config-vlan While in global configuration mode, enter the vlan vlan-id command. Switch(config-vlan)# To exit to global configuration mode, enter the exit command. To return to privileged EXEC mode, press Ctrl-Z or enter end. Use this mode to configure VLAN parameters. When VTP mode is transparent, you can create extended-range VLANs (VLAN IDs greater than 1005) and save configurations in the switch startup configuration file. VLAN configuration While in privileged EXEC mode, enter the vlan database command. Switch(vlan)# To exit to privileged EXEC mode, enter exit. Use this mode to configure VLAN parameters for VLANs 1 to 1005 in the VLAN database.2-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Understanding the Help System Understanding the Help System You can enter a question mark (?) at the system prompt to display a list of commands available for each command mode. You can also obtain a list of associated keywords and arguments for any command, as shown in Table 2-2. Interface configuration While in global configuration mode, enter the interface command (with a specific interface). Switch(config-if)# To exit to global configuration mode, enter exit. To return to privileged EXEC mode, press Ctrl-Z or enter end. Use this mode to configure parameters for the Ethernet interfaces. For information about defining interfaces, see the “Using Interface Configuration Mode” section on page 11-6. To configure multiple interfaces with the same parameters, see the “Configuring a Range of Interfaces” section on page 11-8. Line configuration While in global configuration mode, specify a line with the line vty or line console command. Switch(config-line)# To exit to global configuration mode, enter exit. To return to privileged EXEC mode, press Ctrl-Z or enter end. Use this mode to configure parameters for the terminal line. Table 2-1 Command Mode Summary (continued) Mode Access Method Prompt Exit Method About This Mode Ta b l e 2 - 2 H e l p S u mm a r y Command Purpose help Obtain a brief description of the help system in any command mode. abbreviated-command-entry? Obtain a list of commands that begin with a particular character string. For example: Switch# di? dir disable disconnect abbreviated-command-entry Complete a partial command name. For example: Switch# sh conf Switch# show configuration ? List all commands available for a particular command mode. For example: Switch> ?2-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Understanding Abbreviated Commands Understanding Abbreviated Commands You need to enter only enough characters for the switch to recognize the command as unique. This example shows how to enter the show configuration privileged EXEC command in an abbreviated form: Switch# show conf Understanding no and default Forms of Commands Almost every configuration command also has a no form. In general, use the no form to disable a feature or function or reverse the action of a command. For example, the no shutdown interface configuration command reverses the shutdown of an interface. Use the command without the keyword no to re-enable a disabled feature or to enable a feature that is disabled by default. Configuration commands can also have a default form. The default form of a command returns the command setting to its default. Most commands are disabled by default, so the default form is the same as the no form. However, some commands are enabled by default and have variables set to certain default values. In these cases, the default command enables the command and sets variables to their default values. command ? List the associated keywords for a command. For example: Switch> show ? command keyword ? List the associated arguments for a keyword. For example: Switch(config)# cdp holdtime ? <10-255> Length of time (in sec) that receiver must keep this packet Table 2-2 Help Summary (continued) Command Purpose2-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Understanding CLI Error Messages Understanding CLI Error Messages Table 2-3 lists some error messages that you might encounter while using the CLI to configure your switch. Using Command History The software provides a history or record of commands that you have entered. The command history feature is particularly useful for recalling long or complex commands or entries, including access lists. You can customize this feature to suit your needs as described in these sections: • Changing the Command History Buffer Size, page 2-5 (optional) • Recalling Commands, page 2-6 (optional) • Disabling the Command History Feature, page 2-6 (optional) Changing the Command History Buffer Size By default, the switch records ten command lines in its history buffer. You can alter this number for a current terminal session or for all sessions on a particular line. These procedures are optional. Beginning in privileged EXEC mode, enter this command to change the number of command lines that the switch records during the current terminal session: Switch# terminal history [size number-of-lines] The range is from 0 to 256. Table 2-3 Common CLI Error Messages Error Message Meaning How to Get Help % Ambiguous command: "show con" You did not enter enough characters for your switch to recognize the command. Re-enter the command followed by a question mark (?) with a space between the command and the question mark. The possible keywords that you can enter with the command are displayed. % Incomplete command. You did not enter all the keywords or values required by this command. Re-enter the command followed by a question mark (?) with a space between the command and the question mark. The possible keywords that you can enter with the command are displayed. % Invalid input detected at ‘^’ marker. You entered the command incorrectly. The caret (^) marks the point of the error. Enter a question mark (?) to display all the commands that are available in this command mode. The possible keywords that you can enter with the command are displayed.2-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Using Editing Features Beginning in line configuration mode, enter this command to configure the number of command lines the switch records for all sessions on a particular line: Switch(config-line)# history [size number-of-lines] The range is from 0 to 256. Recalling Commands To recall commands from the history buffer, perform one of the actions listed in Table 2-4. These actions are optional. Disabling the Command History Feature The command history feature is automatically enabled. You can disable it for the current terminal session or for the command line. These procedures are optional. To disable the feature during the current terminal session, enter the terminal no history privileged EXEC command. To disable command history for the line, enter the no history line configuration command. Using Editing Features This section describes the editing features that can help you manipulate the command line. It contains these sections: • Enabling and Disabling Editing Features, page 2-7 (optional) • Editing Commands through Keystrokes, page 2-7 (optional) • Editing Command Lines that Wrap, page 2-8 (optional) Table 2-4 Recalling Commands Action 1 1. The arrow keys function only on ANSI-compatible terminals such as VT100s. Result Press Ctrl-P or the up arrow key. Recall commands in the history buffer, beginning with the most recent command. Repeat the key sequence to recall successively older commands. Press Ctrl-N or the down arrow key. Return to more recent commands in the history buffer after recalling commands with Ctrl-P or the up arrow key. Repeat the key sequence to recall successively more recent commands. show history While in privileged EXEC mode, list the last several commands that you just entered. The number of commands that are displayed is determined by the setting of the terminal history global configuration command and history line configuration command.2-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Using Editing Features Enabling and Disabling Editing Features Although enhanced editing mode is automatically enabled, you can disable it, re-enable it, or configure a specific line to have enhanced editing. These procedures are optional. To globally disable enhanced editing mode, enter this command in line configuration mode: Switch (config-line)# no editing To re-enable the enhanced editing mode for the current terminal session, enter this command in privileged EXEC mode: Switch# terminal editing To reconfigure a specific line to have enhanced editing mode, enter this command in line configuration mode: Switch(config-line)# editing Editing Commands through Keystrokes Table 2-5 shows the keystrokes that you need to edit command lines. These keystrokes are optional. Table 2-5 Editing Commands through Keystrokes Capability Keystroke 1 Purpose Move around the command line to make changes or corrections. Press Ctrl-B, or press the left arrow key. Move the cursor back one character. Press Ctrl-F, or press the right arrow key. Move the cursor forward one character. Press Ctrl-A. Move the cursor to the beginning of the command line. Press Ctrl-E. Move the cursor to the end of the command line. Press Esc B. Move the cursor back one word. Press Esc F. Move the cursor forward one word. Press Ctrl-T. Transpose the character to the left of the cursor with the character located at the cursor. Recall commands from the buffer and paste them in the command line. The switch provides a buffer with the last ten items that you deleted. Press Ctrl-Y. Recall the most recent entry in the buffer. Press Esc Y. Recall the next buffer entry. The buffer contains only the last 10 items that you have deleted or cut. If you press Esc Y more than ten times, you cycle to the first buffer entry. Delete entries if you make a mistake or change your mind. Press the Delete or Backspace key. Erase the character to the left of the cursor.2-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Using Editing Features Editing Command Lines that Wrap You can use a wraparound feature for commands that extend beyond a single line on the screen. When the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the first ten characters of the line, but you can scroll back and check the syntax at the beginning of the command. The keystroke actions are optional. To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You can also press Ctrl-A to immediately move to the beginning of the line. Note The arrow keys function only on ANSI-compatible terminals such as VT100s. Press Ctrl-D. Delete the character at the cursor. Press Ctrl-K. Delete all characters from the cursor to the end of the command line. Press Ctrl-U or Ctrl-X. Delete all characters from the cursor to the beginning of the command line. Press Ctrl-W. Delete the word to the left of the cursor. Press Esc D. Delete from the cursor to the end of the word. Capitalize or lowercase words or capitalize a set of letters. Press Esc C. Capitalize at the cursor. Press Esc L. Change the word at the cursor to lowercase. Press Esc U. Capitalize letters from the cursor to the end of the word. Designate a particular keystroke as an executable command, perhaps as a shortcut. Press Ctrl-V or Esc Q. Scroll down a line or screen on displays that are longer than the terminal screen can display. Note The More prompt is used for any output that has more lines than can be displayed on the terminal screen, including show command output. You can use the Return and Space bar keystrokes whenever you see the More prompt. Press the Return key. Scroll down one line. Press the Space bar. Scroll down one screen. Redisplay the current command line if the switch suddenly sends a message to your screen. Press Ctrl-L or Ctrl-R. Redisplay the current command line. 1. The arrow keys function only on ANSI-compatible terminals such as VT100s. Table 2-5 Editing Commands through Keystrokes (continued) Capability Keystroke 1 Purpose2-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Searching and Filtering Output of show and more Commands In this example, the access-list global configuration command entry extends beyond one line. When the cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line, the line is again shifted ten spaces to the left. Switch(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1 Switch(config)# $ 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.25 Switch(config)# $t tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq Switch(config)# $108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq 45 After you complete the entry, press Ctrl-A to check the complete syntax before pressing the Return key to execute the command. The dollar sign ($) appears at the end of the line to show that the line has been scrolled to the right: Switch(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1$ The software assumes you have a terminal screen that is 80 columns wide. If you have a width other than that, use the terminal width privileged EXEC command to set the width of your terminal. Use line wrapping with the command history feature to recall and modify previous complex command entries. For information about recalling previous command entries, see the “Editing Commands through Keystrokes” section on page 2-7. Searching and Filtering Output of show and more Commands You can search and filter the output for show and more commands. This is useful when you need to sort through large amounts of output or if you want to exclude output that you do not need to see. Using these commands is optional. To use this functionality, enter a show or more command followed by the pipe character (|), one of the keywords begin, include, or exclude, and an expression that you want to search for or filter out: command | {begin | include | exclude} regular-expression Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed. This example shows how to include in the output display only lines where the expression protocol appears: Switch# show interfaces | include protocol Vlan1 is up, line protocol is up Vlan10 is up, line protocol is down GigabitEthernet1/0/1 is up, line protocol is down GigabitEthernet1/0/2 is up, line protocol is up 2-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Accessing the CLI Accessing the CLI You can access the CLI through a console connection, through Telnet, or by using the browser. You manage the switch stack and the stack member interfaces through the stack master. You cannot manage stack members on an individual switch basis. You can connect to the stack master through the console port of one or more stack members. Be careful with using multiple CLI sessions to the stack master. Commands you enter in one session are not displayed in the other sessions. Therefore, it is possible to lose track of the session from which you entered commands. Note We recommend using one CLI session when managing the switch stack. If you want to configure a specific stack member port, you must include the stack member number in the CLI command interface notation. For more information about interface notations, see the “Using Interface Configuration Mode” section on page 11-6. To debug a specific stack member, you can access it from the stack master by using the session stack-member-number privileged EXEC command. The stack member number is appended to the system prompt. For example, Switch-2# is the prompt in privileged EXEC mode for stack member 2, and where the system prompt for the stack master is Switch. Only the show and debug commands are available in a CLI session to a specific stack member. Accessing the CLI through a Console Connection or through Telnet Before you can access the CLI, you must connect a terminal or PC to the switch console port and power on the switch as described in the hardware installation guide that shipped with your switch. Then, to understand the boot process and the options available for assigning IP information, see Chapter 4, “Assigning the Switch IP Address and Default Gateway.” If your switch is already configured, you can access the CLI through a local console connection or through a remote Telnet session, but your switch must first be configured for this type of access. For more information, see the “Setting a Telnet Password for a Terminal Line” section on page 9-6. You can use one of these methods to establish a connection with the switch: • Connect the switch console port to a management station or dial-up modem. For information about connecting to the console port, refer to the switch hardware installation guide. • Use any Telnet TCP/IP or encrypted Secure Shell (SSH) package from a remote management station. The switch must have network connectivity with the Telnet or SSH client, and the switch must have an enable secret password configured. For information about configuring the switch for Telnet access, see the “Setting a Telnet Password for a Terminal Line” section on page 9-6. The switch supports up to 16 simultaneous Telnet sessions. Changes made by one Telnet user are reflected in all other Telnet sessions. For information about configuring the switch for SSH, see the “Configuring the Switch for Secure Shell” section on page 9-38. The switch supports up to five simultaneous secure SSH sessions. After you connect through the console port, through a Telnet session, or through an SSH session, the user EXEC prompt appears on the management station.2-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Accessing the CLI Accessing the CLI from a Browser Before performing this procedure, make sure that you have met the software requirements (including browser and Java plug-in configurations) and have assigned IP information as described in the switch hardware installation guide. You also must assign a Telnet password to the switch (the stack or, if clustering, the command switch) as described in “Setting a Telnet Password for a Terminal Line” section on page 9-6 To access the CLI from a web browser, follow these steps: Step 1 Start one of the supported browsers. Step 2 In the URL field, enter the IP address of the switch (the stack or, if clustering, the command switch). Step 3 When the Cisco Systems Access page appears, click Telnet to start a Telnet session. Step 4 Enter the switch password. The user EXEC prompt appears on the management station. Note Copies of the HTML pages that you display are saved in your browser memory cache until you exit the browser session. A password is not required to redisplay these pages, including the Cisco Systems Access page. You can access the CLI by clicking Web Console - HTML access to the command line interface from a cached copy of the Cisco Systems Access page. To prevent unauthorized access to the CLI or to the Cluster Management Suite (CMS), exit your browser to end the browser session.2-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 2 Using the Command-Line Interface Accessing the CLIC H A P T E R 3-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 3 Getting Started with CMS This chapter describes the Cluster Management Suite (CMS) on Catalyst 3750 switches. It contains these topics: • Launching CMS, page 3-2 • Features, page 3-3 • Front Panel View, page 3-5 • Topology View, page 3-11 • Menus and Toolbar, page 3-16 • Interaction Modes, page 3-25 • Wizards, page 3-26 • Online Help, page 3-27 • CMS Window Components, page 3-28 • Accessing CMS, page 3-30 • Verifying Your Changes, page 3-31 • Saving Your Configuration, page 3-32 • Restoring Your Configuration, page 3-32 • CMS Preferences, page 3-32 • Using Different Versions of CMS, page 3-33 • Where to Go Next, page 3-33 It does not contain: • Procedures for using the configuration windows in CMS. The online help gives this information. • System requirements and procedures for browser and Java plug-in configuration. The hardware installation guide gives this information. Refer to the appropriate switch documentation for descriptions of CMS on other Catalyst switches.3-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Launching CMS Launching CMS Before you can launch CMS, you need to follow the steps for setting up your switch and assigning it an IP address. These instructions are in the “Quick Setup” chapter of the switch hardware installation guide. After you complete these steps, you will enter the IP address of your switch and your password (if one has been set) in a browser window. Then the Switch Home Page opens (see Figure 3-1). To launch CMS, click Cluster Management Suite on the left side of the Switch Home Page. Figure 3-1 Switch Home Page The Switch Home Page has these tabs: • Express Setup—Opens the Express Setup page, on which you can configure your switch • Cluster Management Suite—Launches CMS, through which you can manage the switch • Tools—Accesses diagnostic and monitoring tools • Help Resources—Provides links to the Cisco web site, technical documentation, and the Cisco Technical Assistance Center (TAC) Refer to your switch hardware installation guide to find instructions for launching the Switch Home Page, including information about the Java plug-in and other requirements for using CMS. 97245 Click Cluster Management Suite3-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Features Features CMS has menus, a toolbar, and network views (Figure 3-2) for managing switch clusters and individual switches from web browsers such as Netscape Communicator or Microsoft Internet Explorer. Figure 3-2 CMS Features These network views can be displayed at the same time: • The Front Panel view, which displays the front-panel image of a specific switch or the front-panel images of all switches in a cluster. From this view, you can select multiple ports or multiple switches and configure them with the same settings. When CMS is launched from the command switch, the Front Panel view displays the front-panel images of all switches in the cluster. When CMS is launched from a noncommand switch, the Front Panel view displays only the front panel of the specific switch. Menu bar Toolbar Move the cursor over the icon to display the tool tip. For example, the button displays the legend of icons and color codes. Click Guide or Expert interaction mode to change how some configuration options are presented to you. 97233 Front Panel view of the cluster. Topology view of the cluster. 972293-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Features Note CMS from a standalone switch or from a noncommand switch is referred to as the device manager. The device manager is for configuring an individual switch. When you select the device manager, you launch a separate CMS session. The device manager interface can vary from one Catalyst switch to another. • The Topology view, which displays a network map. It uses icons to represent switch clusters, cluster members (including switch stacks, each of which functions as a single member), cluster candidates, neighboring devices that are not eligible to join a cluster, and link types. You can select multiple switches and configure them to run with the same settings. You can also display link information in the form of link reports and link graphs. This view is available only when CMS is launched from the command switch. The menu bar, toolbar, and popup menus give you access to configuration and management options: • The menubar provides a complete list of options for managing a single switch and switch clusters. • The toolbar provides buttons for commonly used switch and cluster configuration options, the legend, and online help. • The port popup menu, in the Front Panel view, provides options specific for configuring and monitoring switch ports. • The device popup menu, in either the Front Panel or the Topology views, provides switch and cluster configuration and monitoring options. • The candidate, member, and link popup menus provide options for configuring and monitoring devices and links in the Topology view. CMS includes these features to simplify configuration tasks: • Interactive modes—guide mode and expert mode—to give you more control over the presentation of complex configuration options • Wizards, which require minimal information from you to configure some complex features • Comprehensive online help, which provides high-level concepts and procedures for performing tasks from configuration windows • Two levels of access to the configuration options: read-write access for users who are allowed to change switch settings; read-only access for users who are only allowed to view switch settings • A consistent set of GUI components (tabs, buttons, drop-down lists, tables, and so on) for a uniform approach to viewing and for setting configuration parameters3-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View Front Panel View When you launch CMS from a command switch, the Front Panel view displays the front-panel images of all the switches in the cluster (Figure 3-3). Figure 3-3 Front Panel View from a Command Switch Cluster tree. Right-click a member switch image to display the device popup menu, and select an option to view or change systemrelated settings. Right-click the command switch image to display the cluster popup menu, and select a clusterrelated option. 972313-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View When you launch CMS from a standalone or noncommand member switch, the Front Panel view displays only the front panel of the specific switch (Figure 3-4). Figure 3-4 Front Panel View from a Standalone Switch Cluster Tree The cluster tree (Figure 3-3) appears in the left frame of the Front Panel view and shows the name of the cluster and a list of members. If a switch stack is a member, you see its name and the stack members in a nested list. A stack member refers to the devices within a stack. The color of a stack member shows its status (Table 3-1). If the box beside an icon is unchecked, the front-panel image that corresponds with the icon is not displayed. By checking and unchecking the boxes, you control the contents of the view. The sequence of the icons (Figure 3-5) mirrors the sequence of the front-panel images. You can change the sequence by dragging and dropping icons or by selecting View > Front Panel. Figure 3-5 Cluster-Tree Icons Right-click a port to display the port popup menu, and select an option to view or change port-related settings. Press Ctrl, and then leftclick ports to select multiple ports. The color of the port LED reflects port or link status. LEDs display the current port mode and the status of the switch and connected RPS. Left-click the Mode button to change the meaning of the port LEDs. 97234 Table 3-1 Cluster Tree Icon Colors Color Device Status Green Switch is operating normally. Yellow The internal fan of the switch is not operating, or the switch is receiving power from an RPS. Red Switch is not powered on, has lost power, or the command switch is unable to communicate with the member switch. 97236 Layer 3 Switch LRE Switch Stack Layer 2 Switch Stack3-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View If you want to configure switch or cluster settings on one or more switches, select the appropriate front-panel images. To select a front-panel image, click either the cluster-tree icon or the corresponding front-panel image. The front-panel image is then highlighted with a yellow outline. To select multiple front-panel images, press the Ctrl key, and left-click the cluster-tree icons or the front-panel images. To deselect an icon or image, press the Ctrl key, and left-click the icon or image. If the cluster has many switches, you might need to scroll down the window to display the rest of the front-panel images. Front-Panel Images You can manage the switch from a remote station by using the front-panel images. The front-panel images are updated based on the network polling interval that you set from CMS > Preferences. This section includes descriptions of the LED images. Similar descriptions of the switch LEDs are provided in the switch hardware installation guide. Note The Preferences window is available if your switch access level is read-write or read-only, but you cannot change any values in read-only mode. Note For more information about the read-only access mode, see the “Access Modes in CMS” section on page 3-30. Figure 3-6 shows the port icons as they appear in the front-panel images. Figure 3-6 Port Icons 97237 GBIC (empty) GBIC fiber (LX, SX, ZX, CWDM) GBIC Gigastack GBIC-T SFP (empty) SFP (populated) RJ-21 RJ-45 Fiber RJ-45 RJ-453-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View To select a port, click the port on the front-panel image. The port is then highlighted with a yellow outline. To select multiple ports, you can: • Press the left mouse button, drag the pointer over the group of ports that you want to select, and then release the mouse button. • Press the Ctrl key, and click the ports that you want to select. • Right-click a port, and select Select All Ports from the port popup menu. Table 3-2 describes the colors representing the wavelengths on the Coarse Wave Division Multiplexer (CWDM) Gigabit interface converter (GBIC) modules. For port status LED information, see the “Port Modes and LEDs” section on page 3-9. Redundant Power System LED The redundant power system (RPS) LED shows the RPS status (Table 3-3). Certain switches in the switch cluster use a specific RPS model: • Cisco RPS 300 (model PWR300-AC-RPS-N1)—Catalyst 2900 LRE XL, Catalyst 2950, Catalyst 3524-PWR XL, and Catalyst 3550 switches • Cisco RPS 600 (model PWR600-AC-RPS)—Catalyst 2900 XL and Catalyst 3500 XL switches, except the Catalyst 2900 LRE XL and Catalyst 3524-PWR XL switches • Cisco RPS 675 (model PWR675-AC-RPS-N1)—Catalyst 2950, Catalyst 2970, and Catalyst 3550 switches, and Catalyst 3750 switches. Refer to the appropriate switch hardware documentation for RPS descriptions specific for the switch. Table 3-2 Port Icon Colors for the CWDM GBIC Module Ports Wavelength Color 1470 nanometers (nm) Gray 1490 nm Violet 1510 nm Blue 1530 nm Green 1550 nm Yellow 1570 nm Orange 1590 nm Red 1610 nm Brown Table 3-3 RPS LED Color RPS Status Black (off) RPS is off or is not installed. Green RPS is connected and operational. Blinking green RPS is providing power to another switch in the switch stack.3-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View Port Modes and LEDs The port modes (Table 3-4) determine the type of information displayed through the port LEDs. When you change port modes, the meanings of the port LED colors (Table 3-5) also change. Note The bandwidth utilization mode (UTIL LED) does not appear on the front-panel images. Select Reports > Bandwidth Graphs to display the total bandwidth in use by the switch. Refer to the switch hardware installation guide for information about using the UTIL LED. To select or change a mode, click the Mode button until the desired mode LED is green. You can check the status of ports by using the switch graphic on the Front Panel view. Click the Mode button on the graphic to display the STAT, SPD, FDUP, and LINE PWR settings in sequence. The port LEDs change color to reflect the setting. If the switches are stacked and if you press the Mode button on any one of the switches in the switch stack graphic, all the switches in the switch stack also change to display the same selected mode. For example, if you press the mode button on the stack master to display SPEED, all the other switches in the switch stack will also display SPEED. When the switch stack LED is selected, these LEDs are green when the StackWise ports are up and are amber when the ports are down: • SFP module ports LEDs 1 and 2 on the Catalyst 3750-24TS switch show the status for StackWise ports 1 and 2, respectively. • SFP module ports LEDs 3 and 4 on the Catalyst 3750-48TS switch show the status for StackWise ports 1 and 2, respectively. Amber RPS is connected but not functioning. The RPS could be in standby mode. To put the RPS in Active mode, press the Standby/Active button on the RPS, and the LED should turn green. If it does not, one of these conditions could exist: • One of the RPS power supplies could be down. Contact Cisco Systems. • The RPS fan could have failed. Contact Cisco Systems. Blinking amber Internal power supply of the switch is down, and redundancy is lost. The switch is operating on the RPS. Table 3-3 RPS LED (continued) Color RPS Status Table 3-4 Port Modes Mode LED Description STAT Shows the link status of the ports. Default mode. STACK Shows the number of the switch in the switch stack. DUPLX Shows the duplex setting on the ports. The default setting on the 10/100 and 10/100/1000 ports is auto. SPEED Shows the speed setting on the ports. The default setting on the 10/100 and 10/100/1000 ports is auto.3-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Front Panel View • SFP module ports LEDs 27 and 28 on the Catalyst 3750G-24TS switch show the status for StackWise ports 1 and 2, respectively. • The 10/100/1000 port LEDs 23 and 24 on the Catalyst 3750G-24T switch show the status for StackWise ports 1 and 2, respectively. VLAN Membership Modes Ports in the Front Panel view are outlined by colors (Table 3- 6) when you click Highlight VLAN Port Membership Modes on the Configure VLANs tab on the VLAN window (VLAN > VLAN > Configure VLANs). The colors show the VLAN membership mode of each port. The VLAN membership mode determines the kind of traffic the port carries and the number of VLANs it can belong to. For more information about these modes, see the “VLAN Port Membership Modes” section on page 12-3. Note This feature is not supported on the Catalyst 1900 and Catalyst 2820 switches. Table 3-5 Port LEDs Port Mode Port LED Color Description STAT Cyan (off) No link. Green Link present. Amber Link fault. Error frames can affect connectivity, and errors such as excessive collisions, CRC errors, and alignment and jabber errors are monitored for a link-fault indication. Port is not forwarding. Port was disabled by management, by an address violation, or by Spanning Tree Protocol (STP). Note After a port is reconfigured, the port LED can remain amber for up to 30 seconds as STP checks the switch for possible loops. Brown No link and port is administratively shut down. STACK Blinking green Port that corresponds to the current stack member. Ports that correspond to other stack members are solid green. DUPLX Cyan (off) Port is operating in half-duplex mode. Green Port is operating in full-duplex mode. SPEED Cyan (off) Port is operating at 10 Mbps (10/100 ports) or no link (10/100/1000 ports and GBIC module ports). Green Port is operating at 100 Mbps (10/100 ports) or 1000 Mbps (GBIC module ports). Blinking green Port is operating at 1000 Mbps (10/100/1000 ports). Table 3-6 VLAN Membership Modes Mode Color Static access Light green Dynamic access Pink ISL trunk Orange3-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Topology View Topology View The Topology view shows how the devices within a cluster are connected and how the cluster is connected to other clusters and devices. From this view, you can add and remove cluster members. This view shows the network topology at different levels of detail: • When you right-click a cluster icon and select Expand Cluster, the Topology view displays the cluster in detail. You see the command switch, member switches (including switch stacks, each of which functions as a single stack member), and candidate switches that can join the cluster. You cannot see the details of any neighboring switch clusters (Figure 3-7). Figure 3-7 Expanded Cluster View 802.1Q trunk Peach Negotiate trunk White Table 3-6 VLAN Membership Modes (continued) Mode Color 97238 Cluster members of cluster1 and other devices connected to cluster1. Right-click a device icon to display a device popup menu. Right-click a link icon for more link information. Neighboring cluster connected to cluster 1.3-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Topology View • When you right-click a command-switch icon and select Collapse Cluster, the cluster collapses into a single icon. You see how the cluster is connected to other clusters, candidate switches, and devices that are not eligible to join the cluster (such as routers, access points, IP phones, and so on) (Figure 3-8). Figure 3-8 Collapsed Cluster View cluster1 97240 Devices connected to cluster1 that are not eligible to join the cluster. Neighboring cluster connected to cluster1.3-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Topology View • When you right-click a collapsed switch stack icon and select Expand Stack, the switch stack expands to show the links of stack members to cluster member switches and to each other (Figure 3-9). Figure 3-9 Expanded Switch Stack View Note The Topology view displays only the cluster and network neighborhood of the specific command or member switch that you access. To display a different cluster, you need to access the command switch or member switch of that cluster. You can arrange the device icons in this view. To move a device icon, click and drag the icon. To select multiple device icons, you can either: • Press the left mouse button, drag the pointer over the group of device icons that you want to select, and then release the mouse button. • Press the Ctrl key, and click the device icons that you want to select. After selecting the icons, drag them to any area in the view.3-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Topology View Topology Icons and Labels The Topology view and the cluster tree use the same set of device icons to represent clusters, Layer 3 switches, Layer 2 switches, and switch stacks. They also use the same labels to identify the command switch (CMD), the standby command switch (STBY), and the stack master (MASTER). The Topology view uses additional icons to represent these types of neighboring devices: • Customer premises equipment (CPE) devices that are connected to Long-Reach Ethernet (LRE) switches • Devices that are not eligible to join the cluster, such as Cisco IP phones, Cisco access points, and Cisco Discovery Protocol (CDP)-capable hubs and routers Note The System Switch Processor (SSP) card in the Cisco Integrated Communications System (ICS) 7750 appears as a Layer 2 switch. SSP cards are not eligible to join switch clusters. • Devices that are unknown, such as some Cisco devices and third-party devices Tip Neighboring devices are only displayed if they are connected to cluster members. To display neighboring devices in the Topology view, either add a switch to which they are connected to the cluster, or enable that switch as a command switch. Note Candidate switches are distinguished by the color of their device label. Device labels and their colors are described in the “Colors in the Topology View” section on page 3-15. To select a device, click the icon. The icon is then highlighted. To select multiple devices, you can either: • Press the left mouse button, drag the pointer over the group of icons that you want to select, and release the mouse button. • Press the Ctrl key and click the icons that you want to select. The Topology view also uses a set of link icons to show the link type and status between two devices. To select a link, click it. To select multiple links, press the Ctrl key, and click the links. Device and Link Information The Topology view displays this device and link information: • Cluster and switch names • Switch MAC and IP addresses • Link type between the devices • Link speed and IDs of the interfaces on both ends of the link3-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Topology View In some cases, there are limitations on what is displayed: • IP addresses are displayed only for the command switch and member switches. • For a neighboring cluster, only the IP address of the command switch is displayed. • The displayed link speeds are the actual link speeds except on the LRE links, which display the administratively assigned speed settings. To choose the information you want to see, use the Topology Options window, which is displayed by selecting View > Topology Options. Colors in the Topology View The colors of the Topology view icons show the status of the devices and links (Table 3- 7, Table 3-8, and Table 3-9). Table 3-7 Device Icon Colors Icon Color Color Meaning Green The device is operating. Yellow 1 1. Available only on the cluster members. The internal fan of the switch is not operating, or the switch is receiving power from an RPS. Red 1 The device is not operating. Table 3-8 Single Link Icon Colors Link Color Color Meaning Green Active link Red Down or blocked link Table 3-9 Multiple Link Icon Colors Link Color Color Meaning Both green All links are active. One green; one red At least one link is active, and at least one other link is down or blocked. Both red All links are down or blocked.3-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar The color of a device label shows the cluster membership of the device (Table 3-10). Topology Display Options You can set the type of information displayed in the Topology view by changing the settings in the Topology Options window. To display this window, select View > Topology Options. From this window, you can select: • Device icons (including IP Phones, CPEs, Neighbors, Access Points, and Candidates) that you want displayed in or filtered from the Topology View window • Interface IDs and Actual Speed values that you want displayed in the Link window • Host Names, IP addresses, and MAC address labels that you want displayed in the Node window Menus and Toolbar The configuration and monitoring options for configuring switches and switch clusters are available from menus and a toolbar. Menu Bar The menu bar provides the complete list of options for managing a cluster. These options can vary: • A Catalyst 3750 switch can run the standard multilayer software image (SMI) or the enhanced multilayer image (EMI). Table 3- 11 identifies the options available if the switch is running the EMI. • Access modes affect the availability of features on CMS. Table 3-11 identifies which options are affected by your access mode: read-only (access level 1–14) and read-write (access level 15). For more information about access modes, see the “Access Modes in CMS” section on page 3-30. • The option for enabling a command switch is only available from a CMS session launched from a command-capable switch. • Cluster management tasks, such as upgrading the software of groups of switches, are available only from a CMS session that is launched from a command switch. • If you launch CMS from a specific switch, the menu bar displays the features supported only by that switch. • If you launch CMS from a command switch, the menu bar displays the features supported on all the switches in the cluster. (The “Cluster Command Switch Characteristics” section on page 6-3 lists the characteristics that command switches must have. The “Standby Cluster Command Switch Characteristics” section on page 6-3 lists the characteristics that standby command switches must have.) Table 3-10 Device Label Colors Label Color Color Meaning Green A cluster member, either a member switch or the command switch Cyan A candidate switch that is eligible to join the cluster Yellow An unknown device or a device that is not eligible to join the cluster3-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar Table 3-11 lists the menu-bar options available from a Catalyst 3750 command switch when the cluster contains only Catalyst 3750 member switches. Table 3-11 Menu Bar Menu-Bar Options Task CMS Page Setup Set default document printer properties to be used when printing from CMS. Print Preview View the way the CMS window or help file will appear when printed. Print Print a CMS window or help file. Guide Mode/Expert Mode 1 Select which interaction mode to use when you select a configuration option. Preferences 2 Set CMS display properties, such as polling intervals, the default views to open at startup, and the color of administratively shutdown ports. Administration IP Addresses 2 Configure IP information for a switch. SNMP 2 Enable and disable Simple Network Management Protocol (SNMP), enter community strings, and configure end stations as trap managers. System Time 2 Configure the system time or configure the Network Time Protocol (NTP). HTTP Port 2 Configure the Hypertext Transfer Protocol (HTTP) port number. Users and Passwords Configure usernames and passwords for privilege levels 0 to 15. Console Baud Rate 2 Change the baud rate for the switch console port. MAC Addresses 2 Enter dynamic, secure, and static addresses in a switch address table. You can also define the forwarding behavior of static addresses. ARP 2 Display the device Address Resolution Protocol (ARP) table, and configure the ARP cache timeout setting. Save Configuration 1 Save the configuration for the cluster or switch to Flash memory. Restore Configuration Restore the configuration file to one or more switches in the cluster. Software Upgrade 1 Upgrade the software for the cluster or a switch. System Reload 1 Reboot the switch with the latest installed software. Event Notification Create notification IDs that generate e-mail notifications when system events occur. Cluster Create Cluster 1 3 Designate a command switch, and name a cluster. Delete Cluster 1 4 Delete a cluster. Add to Cluster 1 4 Add a candidate to a cluster. Remove from Cluster 1 4 Remove a member from the cluster. Standby Command Switches 2 4 Create a Hot Standby Router Protocol (HSRP) standby group to provide command-switch redundancy. Hop Count 2 4 Enter the number of hops away that a command switch looks for members and for candidate switches. Device Device Manager 4 Launch Device Manager for a specific switch. Host Name 1 Change the host name of a switch.3-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar STP 2 Display and configure STP parameters for a switch. IGMP Snooping 2 Enable and disable Internet Group Management Protocol (IGMP) snooping and IGMP Immediate-Leave processing on the switch. Join or leave multicast groups, and configure multicast routers. 802.1X 1 Configure 802.1X authentication of devices as they are attached to LAN ports in a point-to-point infrastructure. ACL 2 (guide mode available 1 ) Create and maintain access control lists (ACLs), and attach ACLs to specific ports. Security Wizard 1 Filter certain traffic, such as HTTP traffic, to certain networks or devices. Restrict access to servers, networks, or application data from certain networks or devices. Inter-VLAN Routing Wizard 1 Enable a Catalyst 3550 or 3750 switch to become a router of IP traffic between different VLANs QoS 2 (guide mode available on some options 1 ) Display submenu options to enable and disable quality of service (QoS) and to configure or modify these parameters: • Enable/disable 2 • Trust settings 2 • Queues 2 • Maps 2 • Classes 2 (guide mode available 1 ) • Aggregate policers 2 (guide mode available 1 ) • Policies 2 (guide mode available 1 ) • Statistics 2 • Rate Limit 2 IP Routing 2 5 (guide mode available 1 ) Display submenu options to: • Enable or disable IP routing • Configure IP routing protocols 2 and static routing 2 (guide mode available 1 ) IP Multicast Wizard 1 5 Provide minimum information to configure IP multicast routing on a device so that it can forward multicast packets as a part of a multicast tree. IP Multicast Routing 2 5 Enable and configure multicast routing. Router Redundancy 2 (guide mode available 1 ) Add a switch to or remove a switch from an HSRP group. Fallback Bridging 2 Create a fallback bridging group, modify a group, delete a group, or view its details. AVVID Wizards 1 • Voice Wizard 1 —Configure a port to send or receive voice traffic. • Video Wizard 1 —Optimize multiple video servers for sending video traffic. • Data Wizard 1 —Provide a higher priority to specific applications. Port Port Settings 2 Display and configure port parameters on a switch. Port Search Search for a port through its description. Table 3-11 Menu Bar (continued) Menu-Bar Options Task3-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar Port Security 1 Enable port security on a port. EtherChannels 2 Group ports into logical units for high-speed links between switches. SPAN 2 Enable Switch Port Analyzer (SPAN) port monitoring. Protected Port 2 Configure a port to prevent it from receiving bridged traffic from another port on the same switch. Flooding Control 2 Block the normal flooding of unicast and multicast packets, and enable the switch to block packet storms. VLAN VLAN 2 (guide mode available 1 ) Display VLAN membership, assign ports to VLANs, and configure Inter-Switch Link (ISL) and 802.1Q trunks. Display and configure the VLAN Trunking Protocol (VTP) for interswitch VLAN membership. Management VLAN 2 Change the management VLAN on the switch. VMPS 2 Configure the VLAN Membership Policy Server (VMPS). VLAN Maps 2 Configure VLAN maps. Voice VLAN 2 Configure a port to use a voice VLAN for voice traffic, separating it from the VLANs for data traffic. Reports Inventory Display the device type, software version, IP address, and other information about a switch. Port Statistics Display port statistics. Bandwidth Graphs Display graphs that plot the total bandwidth in use by the switch. Link Graphs Display a graph showing the bandwidth being used for the selected link. Link Reports Display the link report for two connected devices. If one device is an unknown device or a candidate, only the cluster-member side of the link displays. QoS Reports Display QoS reports of incoming or outgoing traffic for specific device interfaces. QoS Graphs Display QoS graphs of incoming or outgoing traffic for specific device interfaces. ACL Reports Display a report about ACL statistics. Router Reports Display reports with an excerpt from the routing table on the switch and the attributes of the HSRP group in which the switch participates. Multicast Display reports about multicast or IGMP statistics. Fallback Bridging Display a report of all fallback bridging groups and their attributes. System Messages Display the most recent system messages (Cisco IOS messages and switch-specific messages) sent by the switch software. Tools Ping and Trace Ping a device or trace a Layer 3 route from a source address to a destination address. View Refresh Update the views with the latest status. Front Panel Display the Front Panel view. Topology 4 Display the Topology view. Table 3-11 Menu Bar (continued) Menu-Bar Options Task3-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar Toolbar The toolbar icons display commonly used switch and cluster configuration options and information windows such as legends and online help. Hover the cursor over an icon to display its use. Table 3-12 describes the toolbar options, from left to right on the toolbar. Topology Options 4 Select the information to be displayed in the Topology view. Automatic Topology Layout 4 Request CMS to rearrange the topology layout. Save Topology Layout 1 4 Save the presentation of the cluster icons that you arranged in the Topology view to Flash memory. Window List the open windows in your CMS session. Help Overview Obtain an overview of the CMS interface. What’s New Obtain a description of the new CMS features. Help For Active Window Display the help for the active open window. This is the same as clicking Help from the active window. Contents List all of the available online help topics. Legend Display the legend, which describes the icons, labels, and links. About Display the CMS version number. 1. Not available in read-only mode. For more information about the read-only and read-write access modes, see the “Access Modes in CMS” section on page 3-30. 2. Some options from this menu option are not available in read-only mode. 3. Available only from a device manager session on a command-capable switch that is not a cluster member. 4. Available only from a cluster management session. 5. You can configure IGRP, EIGRP, OSPF, and multicast routing only from a switch running the EMI. Table 3-11 Menu Bar (continued) Menu-Bar Options Task Table 3-12 Toolbar Buttons Toolbar Option Icon Keyboard Shortcut Task Print Ctrl-P Print a CMS window or help file. Preferences 1 Ctrl-R Set CMS display properties, such as polling intervals, the views to open at CMS startup, and the color of administratively shutdown ports. Save Configuration 2 Ctrl-S Save the configuration for the cluster or switch to Flash memory. Software Upgrade 2 Ctrl-U Upgrade the software for the cluster or a switch. Port Settings 1 – Display and configure port parameters on a switch.3-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar Front Panel View Popup Menus These popup menus are available in the Front Panel view. Device Popup Menu You can display all switch and cluster configuration windows from the menu bar, or you can display commonly used configuration windows from the device popup menu (Table 3- 13). To display the device popup menu, right-click the front-panel image of a switch. VLAN 1 – Display VLAN membership, assign ports to VLANs, and configure ISL and 802.1Q trunks. Inventory – Display the device type, the software version, the IP address, and other information about a switch. Refresh – Update the views with the latest status. Front Panel – Display the Front Panel view. Topology 3 – Display the Topology view. Topology Options 3 – Select the information to be displayed in the Topology view. Save Topology Layout 2 3 – Save the presentation of the cluster icons that you arranged in the Topology view to Flash memory. Legend – Display the legend that describes the icons, labels, and links. Help For Active Window F1 key Display the help for the active open window. This is the same as clicking Help from the active window. 1. Not available in read-only mode. For more information about the read-only and read-write access modes, see the “Access Modes in CMS” section on page 3-30. 2. Some options are not available in read-only mode. 3. Available only from a cluster management session. Table 3-12 Toolbar Buttons (continued) Toolbar Option Icon Keyboard Shortcut Task Table 3-13 Device Popup Menu Popup Menu Option Task Device Manager 1 Launch Device Manager for the switch. Host Name 2 Change the name of the switch. Delete Cluster 2 3 4 Delete a cluster. Remove from Cluster 2 4 Remove a member from the cluster.3-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar Port Popup Menu You can display all port configuration windows from the Port menu on the menu bar, or you can display commonly used port configuration windows from the port popup menu (Table 3-14). To display the port popup menu, right-click a port image. Topology View Popup Menus These popup menus are available in the Topology view. Link Popup Menu You can display reports and graphs for a specific link displayed in the Topology view (Table 3- 15). To display the link popup menu, right-click the link icon. Bandwidth Graphs Display graphs that plot the total bandwidth in use. Properties Display information about the device and port on either end of the link and the state of the link. 1. Available from a cluster member switch but not from the command switch. 2. Not available in read-only mode. For more information about the read-only mode, see the “Access Modes in CMS” section on page 3-30. 3. Available only from the command switch. 4. Available only from a cluster-management session. Table 3-13 Device Popup Menu (continued) Popup Menu Option Task Table 3-14 Port Popup Menu Popup Menu Option Task Port Settings 1 1. Some options from this menu option are not available in read-only mode. Display and configure port settings. VLAN 1 Define the VLAN mode for a port or ports and add ports to VLANs. Port Security 1 2 2. Available on switches that support the Port Security feature. Enable port security on a port. Link Graphs 3 3. Available only when there is an active link on the port (that is, the port LED is green when in port status mode). Display a graph showing the bandwidth used by the selected link. Select All Ports Select all ports on the switch for global configuration. Table 3-15 Link Popup Menu Popup Menu Option Task Link Report Display the link report for two connected devices. If one device is an unknown device or a candidate, only the cluster member side of the link is displayed.3-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar The Link Report and Link Graph options are not available if these devices are at both ends of the link: • Candidate switches • Catalyst 1900 and Catalyst 2820 switches • Devices that are not eligible to join the cluster If multiple links connect two devices or if a link connects to a collapsed icon, the Logical Link Content window appears when you right-click the link icon (Figure 3-10). Right-click a link icon in this window to display the link popup menu for the link. Figure 3-10 Logical Link Content Window Device Popup Menus Specific devices in the Topology view display a specific popup menu: • Cluster (Table 3- 16) • Command switch (Table 3-17) • Member or standby command switch (Table 3-18) • Device member of a switch stack (Table 3- 19) • Candidate switch with an IP address (Table 3-20) • Candidate switch without an IP address (Table 3- 21) • Neighboring devices (Table 3-22) Note The device manager option in these popup menus is available in read-only mode on Catalyst 2900 XL and Catalyst 3500 XL switches running Cisco IOS Release 12.0(5)WC2 and later. It is also available on Catalyst 2950 switches running Cisco IOS Release 12.1(6)EA2 and later and on Catalyst 3550 switches running Cisco IOS Release 12.1(8)EA1 or later. It is not available on the Catalyst 1900 and Catalyst 2820 switches. Link Graph Display a graph showing the bandwidth used by the selected link. You can change the graph polling interval by selecting CMS > Preferences. Properties Display information about the device and port on either end of the link and the state of the link. Table 3-15 Link Popup Menu (continued) Popup Menu Option Task3-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Menus and Toolbar To display a device popup menu, right-click an icon. Table 3-16 Device Popup Menu of a Cluster Icon Popup Menu Option Task Expand cluster View a cluster-specific topology view. Properties Display information about the device. Table 3-17 Device Popup Menu of a Command-Switch Icon Popup Menu Option Task Collapse cluster View the neighborhood outside a specific cluster. Host Name 1 1. Not available in read-only mode. For more information about the read-only and read-write access modes, see the “Access Modes in CMS” section on page 3-30. Change the host name of a switch. Bandwidth Graphs Display graphs that plot the total bandwidth in use by the switch. Properties Display information about the device. Table 3-18 Device Popup Menu of a Member or Standby Command-Switch Icon Popup Menu Option Task Remove from Cluster 1 1. Available only from a cluster-management session. Remove a member from the cluster. Host Name 1 Change the host name of a switch. Device Manager 2 2. Available from a cluster member switch but not from the command switch. Launch Device Manager for a switch. Bandwidth Graphs Display graphs that plot the total bandwidth in use by the switch. Properties Display information about the device. Table 3-19 Device Popup Menu of a Switch Stack Popup Menu Option Task Expand Stack View all the members of a switch stack. Host Name 1 1. Available only from a cluster-management session. Change the host name of the switch stack. Bandwidth Graphs Display graphs that plot the total bandwidth in use by the switch stack. Properties Display information about the switch stack.3-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Interaction Modes Interaction Modes You can change the interaction mode of CMS to either guide or expert mode. Guide mode steps you through each feature option and gives information about it. Expert mode displays a configuration window in which you configure all the feature options together. Guide Mode Note Guide mode is not available if your switch access level is read-only. For more information about the read-only access mode, see the “Access Modes in CMS” section on page 3-30. Table 3-20 Device Popup Menu of a Candidate-Switch Icon (Candidate Switch Has IP Address) Popup Menu Option Task Add to Cluster 1 1. Not available in read-only mode. For more information about the read-only and read-write access modes, see the “Access Modes in CMS” section on page 3-30. Add a candidate to a cluster. Device Manager 2 2. Available from a cluster member switch but not from the command switch. Launch Device Manager for a switch. Properties Display information about the device. Table 3-21 Device Popup Menu of a Candidate-Switch Icon (Candidate Switch Does Not Have IP Address) Popup Menu Option Task Add to Cluster 1 1. Not available in read-only mode. For more information about the read-only and read-write access modes, see the “Access Modes in CMS” section on page 3-30. Add a candidate to a cluster. Properties Display information about the device. Table 3-22 Device Popup Menu of a Neighboring-Device Icon Popup Menu Option Task Device Manager 1 1. Available from a cluster member switch but not from the command switch. Access the web management interface of the device. Note This option is available on Cisco access points, but not on Cisco IP phones, hubs, routers and on unknown devices such as some Cisco devices and third-party devices. Disqualification Code Display the reason why the device could not join the cluster. Properties Display information about the device.3-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Wizards Guide mode is for users who want a step-by-step approach for completing a specific configuration task. It is not available for all features. A menu-bar option that has a person icon means that guide mode is available for that option. When you click Guide Mode and then select a menu-bar option that supports guide mode, CMS displays a specific option of the feature with information about it. To configure the feature, you provide the information that CMS requests in each step until you click Finish in the last step. Clicking Cancel at any time closes and ends the configuration task without applying any changes. If Expert Mode is selected and you want to use guide mode, you must click Guide Mode before selecting an option from the menu bar, tool bar, or popup menu. If you change the interaction mode after selecting a configuration option, the mode change does not take effect until you select another configuration option. Expert Mode Expert mode is for users who prefer to display all the options of a feature in a single CMS window. Click the Help button to get information about the options that are available. Wizards Note Wizards are not available if your switch access level is read-only. For more information about the read-only access mode, see the “Access Modes in CMS” section on page 3-30. Wizards simplify some configuration tasks on the switch. Similar to the guide mode, wizards take a step-by-step approach to completing a specific configuration task. Unlike guide mode, a wizard does not prompt you to provide information for all of the feature options. Instead, it prompts you for minimal information and then uses the default settings of the remaining options to set up default configurations. Wizards are not available for all features. A menu-bar option that says Wizard means that it launches the wizard for that feature. Tool Tips CMS displays a popup message when you move your mouse over these devices: • A yellow device icon in the cluster tree or in Topology view A popup displays a fault message, such as that the RPS is faulty or that the switch is unavailable because you are in read-only mode. • A red device icon in the cluster tree or in Topology view A popup displays a message that the switch is down. If you move your mouse over a table column heading, a popup displays the full heading.3-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Online Help Online Help CMS has an online help system with many features to help you perform configuration and monitoring tasks from the CMS windows (Figure 3-11). These features include: • Background information and concepts, available from the menu bar by selecting Help > Contents • Task steps for configuration windows, available by clicking Help in the window • An index of online help topics • A glossary of terms used in the online help You can send us feedback about the online help. Click Feedback to display an online form. After completing the form, click Submit to send your comments to Cisco. We appreciate and value your comments. Figure 3-11 Online Help Features Information about the CMS interface. Help for CMS tasks. Legend of icons and color codes. Help for all CMS windows. Glossary of terms used in the online help. Supplemental help information. Click Feedback to send us your comments about the online help. Enter the first letters of the topic, and click Find to search the index. 87867 Click Back and Forward to redisplay previously displayed pages. Click Glossary to access the glossary from the button bar. 3-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS CMS Window Components CMS Window Components CMS windows present configuration information. Figure 3-12 shows the components of a typical CMS window. Figure 3-12 CMS Window Components Host Name List To display or change the configuration of a cluster member, you need to select the specific switch from the Host Name drop-down list. The list appears in the configuration window of each feature and lists only the cluster members that support that feature. For example, the Host Name list on the VLAN window would not include Catalyst 1900 and Catalyst 2820 switches even if they were part of the cluster. Similarly, the Host Name list on the LRE Profiles window would list only the LRE switches in the cluster. Click a tab to display more information. Click a row to select it. Press Shift, and left-click another row to select contiguous multiple rows. Press Ctrl, and left-click rows to select noncontiguous rows. Modify displays a secondary window from which you can change settings. OK saves your changes and closes the window. Apply saves your changes and leaves the window open. Refresh refreshes the window to display the latest information. Cancel closes the window without saving the changes. Help displays help for the window and the menu of Help topics. Select a cluster member from the Host Name list to display its settings. 972433-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS CMS Window Components Tabs, Lists, and Tables Some CMS windows have tabs that present different sets of information. Tabs are arranged like folder headings across the top of the window. Click the tab to display its information. Listed information can often be changed by selecting an item from a list. To change the information, select one or more items, and click Modify. Changing multiple items is limited to those items that apply to at least one of the selections. Some CMS windows present information in a table format. You can edit the information in these tables. Note To display an incomplete column heading, you can resize the width of the column or hover your cursor over the heading to display a popup description. Table Filtering When you click Filter in a CMS window that contains a table, the Filter Editor window appears. The column names in the table become the field names in this window. You can enter selection criteria in these fields to display only the table rows that interest you. For procedures on using the Filter Editor window, refer to the online help. Buttons These are the most common buttons that you use to change the information in a CMS window: • OK—Save any changes and close the window. If you made no changes, the window closes. If CMS detects errors in your entry, the window remains open. For more information about error detection, see the “Error Checking” section on page 3-31. • Apply—Save any changes made in the window and leave the window open. If you made no changes, the Apply button is disabled. • Refresh—Update the CMS window with the latest status of the device. Unsaved changes are lost. • Cancel—Do not save any changes made in the window and close the window. • Help—Display procedures on performing tasks from the window. • Modify—Display the secondary window for changing information on the selected item or items. You usually select an item from a list or table and click Modify.3-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Accessing CMS Accessing CMS This section assumes the following: • You know the IP address and password of the command switch or a specific switch. This information is either: – Assigned to the switch by following the Express Setup program, as described in the hardware installation guide. – Changed on the switch by following the information in the “Assigning Switch Information” section on page 4-2 and the “Preventing Unauthorized Access to Your Switch” section on page 9-1. Considerations for assigning IP addresses and passwords to a command switch and cluster members are described in the “IP Addresses” section on page 6-14 and the “Passwords” section on page 6-15. • You know your access privilege level to the switch (see the “Access Modes in CMS” section on page 3-30). • You have referred to the hardware installation guide for system requirements and have followed the procedures in that guide. Caution Copies of the CMS pages that you display are saved in your browser memory cache until you exit the browser session. A password is not required to redisplay these pages, including the Cisco Systems Access page. You can access the CLI by clicking Monitor the router - HTML access to the command line interface from a cached copy of the Cisco Systems Access page. To prevent unauthorized access to CMS and the CLI, exit your browser to end the browser session. Note If you have configured the Terminal Access Controller Access Control System Plus (TACACS+) or Remote Authentication Dial-In User Service (RADIUS) feature on the switch, you can still access the switch through CMS. For information about how inconsistent authentication configurations in switch clusters can affect access through CMS, see the “TACACS+ and RADIUS” section on page 6-17. Access Modes in CMS CMS has two levels of access to the configuration options, read-write access and read-only access, and privilege levels from 0 to 15. This is how access levels and privilege levels are related: • Privilege level 15 gives you read-write access to CMS. • Privilege levels 1 to 14 give you read-only access to CMS. Any options in the CMS windows, menu bar, toolbar, and popup menus that change the switch or cluster configuration are not shown. • Privilege level 0 denies access to CMS. If you do not include a privilege level when you access CMS, the switch verifies that you have privilege-level 15. If you do not, you are denied access to CMS. If you do have privilege-level 15, you are granted read-write access. Therefore, you do not need to include the privilege level if it is 15. Entering zero denies access to CMS. For more information about privilege levels, see the “Preventing Unauthorized Access to Your Switch” section on page 9-1.3-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Verifying Your Changes If your cluster has these member switches running earlier software releases and if you have read-only access to them, some configuration windows for the switches display incomplete information: • Catalyst 2900 XL or Catalyst 3500 XL member switches running Cisco IOS Release 12.0(5)WC2 or earlier • Catalyst 2950 member switches running Cisco IOS Release 12.0(5)WC2 or earlier • Catalyst 3550 member switches running Cisco IOS Release 12.1(6)EA1 or earlier For more information about this limitation, refer to the release notes. These switches do not support read-only mode on CMS: • Catalyst 1900 and Catalyst 2820 • Catalyst 2900 XL switches with 4-MB CPU DRAM In read-only mode, these switches appear as unavailable devices and cannot be configured from CMS. HTTP Access to CMS CMS uses HTTP, an in-band form of communication with the switch through an Ethernet port. HTTP allows switch management from a standard web browser. The default HTTP port is 80. If you change the HTTP port, you must include the new port number when you enter the IP address in the browser Location or Address field (for example, http://10.1.126.45:184, where 184 is the new HTTP port number). Do not disable or misconfigure the port through which your management station is communicating with the switch. You might want to write down the port number to which you are connected. Changes to the switch IP information should be done with care. For information about connecting to a switch port, refer to the switch hardware installation guide. Verifying Your Changes CMS provides notification cues to help you track and confirm the changes you make. Change Notification A green border around a field or table cell means that you made an unsaved change to the field or table cell. Previous information in that field or table cell is displayed in the window status bar. When you save the changes or if you cancel the change, the green border disappears. Error Checking A red border around a field means that you entered invalid data in the field. An error message appears in the window status bar. When you enter valid data in the field, a green border replaces the red border until you either save or cancel the change. If there is an error in communicating with the switch or if you make an error while performing an action, a message notifies you about the error.3-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Saving Your Configuration Saving Your Configuration Note The Save Configuration option is not available if your switch access level is read-only. For more information about the read-only access mode, see the “Access Modes in CMS” section on page 3-30. Tip As you make cluster configuration changes (except for changes to the Topology view and in the Preferences window), make sure that you periodically save the configuration from the command switch. The configuration is saved on the command and member switches. The front-panel images and CMS windows always display the running configuration of the switch. When you make a configuration change to a switch or switch cluster, the change becomes part of the running configuration. The change does not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you do not save your changes, they are lost when the switch restarts. Note Catalyst 1900 and Catalyst 2820 switches automatically save configuration changes to Flash memory as they occur. For CMS procedures for saving your switch configuration, refer to the online help. Restoring Your Configuration After you save a switch configuration, you might restore the configuration to one or more switches for these reasons: • You made an incorrect change to the current running configuration and want to reload a saved configuration. • You need to reload a switch after a switch failure or power failure. • You want to copy the configuration of a switch to other switches. For CMS procedures for restoring a switch configuration, refer to the online help. CMS Preferences When you exit from CMS, your CMS preferences are saved to your PC in a file called .cms_properties. You can copy this file to other PCs. The file is stored in a default configuration directory, such as C:\Documents and Settings\username. If you cannot locate the CMS preferences file, select Start > Search > For Files or Folders, and search for .cms_properties.3-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Using Different Versions of CMS Using Different Versions of CMS When managing switch clusters through CMS, remember: • Clusters can have a mix of switch models using different Cisco IOS releases. • CMS in earlier Cisco IOS releases and on different switch platforms might look and function differently from CMS in this release. When you select Device > Device Manager for a cluster member, a new browser session is launched, and the CMS version for that switch appears. Here are examples of how CMS can differ between Cisco IOS releases and switch platforms: • On Catalyst switches running Cisco IOS Release 12.0(5)WC2 or earlier or Cisco IOS Release 12.1(6)EA1 or earlier, the CMS versions in those software releases might appear similar but are not the same as this release. For example, the Topology view in this release is not the same as the Topology view or Cluster View in those earlier software releases. • CMS on the Catalyst 1900 and Catalyst 2820 switches is referred to as Switch Manager. Cluster management options are not available on these switches. This is the earliest version of CMS. Refer to the documentation specific to the switch and its Cisco IOS release for descriptions of the CMS version that you are using. Where to Go Next See Chapter 7, “Administering the Switch,” for information about administrative tasks. The rest of this guide provides information about and CLI procedures for the software features supported in this release. For CMS procedures and window descriptions, refer to the online help.3-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 3 Getting Started with CMS Where to Go NextC H A P T E R 4-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 4 Assigning the Switch IP Address and Default Gateway This chapter describes how to create the initial switch configuration (for example, assigning the switch IP address and default gateway information) for the Catalyst 3750 switch by using a variety of automatic and manual methods. It also describes how to modify the switch startup configuration. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding the Boot Process, page 4-1 • Assigning Switch Information, page 4-2 • Checking and Saving the Running Configuration, page 4-10 • Modifying the Startup Configuration, page 4-12 • Scheduling a Reload of the Software Image, page 4-17 Understanding the Boot Process To start your switch, you need to follow the procedures in the hardware installation guide about installing and powering on the switch, and setting up the initial configuration (IP address, subnet mask, default gateway, secret and Telnet passwords, and so forth) of the switch. The normal boot process involves the operation of the boot loader software, which performs these activities: • Performs low-level CPU initialization. It initializes the CPU registers, which control where physical memory is mapped, its quantity, its speed, and so forth. • Performs power-on self-test (POST) for the CPU subsystem. It tests the CPU DRAM and the portion of the Flash device that makes up the Flash file system. • Initializes the Flash file system on the system board. • Loads a default operating system software image into memory and boots the switch.4-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information The boot loader provides access to the Flash file system before the operating system is loaded. Normally, the boot loader is used only to load, uncompress, and launch the operating system. After the boot loader gives the operating system control of the CPU, the boot loader is not active until the next system reset or power-on. The boot loader also provides trap-door access into the system if the operating system has problems serious enough that it cannot be used. The trap-door mechanism provides enough access to the system so that if it is necessary, you can format the Flash file system, reinstall the operating system software image by using the XMODEM Protocol, recover from a lost or forgotten password, and finally restart the operating system. For more information, see the “Recovering from Corrupted Software By Using the XMODEM Protocol” section on page 34-2 and the “Recovering from a Lost or Forgotten Password” section on page 34-4. Note You can disable password recovery. For more information, see the “Disabling Password Recovery” section on page 9-5. Before you can assign switch information, make sure you have connected a PC or terminal to the console port, and configured the PC or terminal-emulation software baud rate and character format to match these of the switch console port: • Baud rate default is 9600. • Data bits default is 8. Note If the data bits option is set to 8, set the parity option to none. • Stop bits default is 1. • Parity settings default is none. Assigning Switch Information You can assign IP information through the switch setup program, through a Dynamic Host Configuration Protocol (DHCP) server, or manually. Use the switch setup program if you are a new user and want to be prompted for specific IP information. With this program, you can also configure a host name and an enable secret password. It gives you the option of assigning a Telnet password (to provide security during remote management) and configuring your switch as a command or member switch of a cluster or as a standalone switch. For more information about the setup program, refer to the release notes on Cisco.com. The switch stack is managed through a single IP address. The IP address is a system-level setting and is not specific to the stack master or to any other stack member. You can still manage the stack through the same IP address even if you remove the stack master or any other stack member from the stack, provided there is IP connectivity. Note Stack members retain their IP address when you remove them from a switch stack. To avoid a conflict by having two devices with the same IP address in your network, change the IP address of the switch that you removed from the switch stack.4-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information Use a DHCP server for centralized control and automatic assignment of IP information once the server is configured. Note If you are using DHCP, do not respond to any of the questions in the setup program until the switch receives the dynamically-assigned IP address and reads the configuration file. Use the manual method of configuration if you are an experienced user familiar with the switch configuration steps; otherwise, use the setup program described earlier. This section contains this configuration information: • Default Switch Information, page 4-3 • Understanding DHCP-Based Autoconfiguration, page 4-3 • Manually Assigning IP Information, page 4-9 Default Switch Information Table 4-1 shows the default switch information. Understanding DHCP-Based Autoconfiguration The DHCP provides configuration information to Internet hosts and internetworking devices. This protocol consists of two components: one for delivering configuration parameters from a DHCP server to a device and a mechanism for allocating network addresses to devices. DHCP is built on a client-server model, in which designated DHCP servers allocate network addresses and deliver configuration parameters to dynamically configured devices. During DHCP-based autoconfiguration, your switch (DHCP client) is automatically configured at startup with IP address information and a configuration file. With DHCP-based autoconfiguration, no DHCP client-side configuration is needed on your switch. However, you need to configure the DHCP server for various lease options associated with IP addresses. If you are using DHCP to relay the configuration file location on the network, you might also need to configure a Trivial File Transfer Protocol (TFTP) server and a Domain Name System (DNS) server. Table 4-1 Default Switch Information Feature Default Setting IP address and subnet mask No IP address or subnet mask are defined. Default gateway No default gateway is defined. Enable secret password No password is defined. Host name The factory-assigned default host name is Switch. Telnet password No password is defined. Cluster command switch functionality Disabled. Cluster name No cluster name is defined.4-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information Note We recommend a redundant connection between a switch stack and the DHCP, DNS, and TFTP servers. This is to help ensure that these servers remain accessible in case one of the connected stack members is removed from the switch stack. The DHCP server can be on the same LAN or on a different LAN than the switch. If the DHCP server is running on a different LAN, you should configure a DHCP relay. A relay device forwards broadcast traffic between two directly connected LANs. A router does not forward broadcast packets, but it forwards packets based on the destination IP address in the received packet. DHCP-based autoconfiguration replaces the BOOTP client functionality on your switch. DHCP Client Request Process When you boot your switch, the DHCP client is invoked and automatically requests configuration information from a DHCP server when the configuration file is not present on the switch. Figure 4-1 shows the sequence of messages that are exchanged between the DHCP client and the DHCP server. Figure 4-1 DHCP Client and Server Message Exchange The client, Switch A, broadcasts a DHCPDISCOVER message to locate a DHCP server. The DHCP server offers configuration parameters (such as an IP address, subnet mask, gateway IP address, DNS IP address, a lease for the IP address, and so forth) to the client in a DHCPOFFER unicast message. In a DHCPREQUEST broadcast message, the client returns a formal request for the offered configuration information to the DHCP server. The formal request is broadcast so that all other DHCP servers that received the DHCPDISCOVER broadcast message from the client can reclaim the IP addresses that they offered to the client. The DHCP server confirms that the IP address has been allocated to the client by returning a DHCPACK unicast message to the client. With this message, the client and server are bound, and the client uses configuration information received from the server. The amount of information the switch receives depends on how you configure the DHCP server. For more information, see the “Configuring the DHCP Server” section on page 4-5. If the configuration parameters sent to the client in the DHCPOFFER unicast message are invalid (a configuration error exists), the client returns a DHCPDECLINE broadcast message to the DHCP server. The DHCP server sends the client a DHCPNAK denial broadcast message, which means that the offered configuration parameters have not been assigned, that an error has occurred during the negotiation of the parameters, or that the client has been slow in responding to the DHCPOFFER message (the DHCP server assigned the parameters to another client). A DHCP client might receive offers from multiple DHCP or BOOTP servers and can accept any of the offers; however, the client usually accepts the first offer it receives. The offer from the DHCP server is not a guarantee that the IP address is allocated to the client; however, the server usually reserves the Switch A DHCPACK (unicast) DHCPREQUEST (broadcast) DHCPOFFER (unicast) DHCPDISCOVER (broadcast) DHCP server 518074-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information address until the client has had a chance to formally request the address. If the switch accepts replies from a BOOTP server and configures itself, the switch broadcasts, instead of unicasts, TFTP requests to obtain the switch configuration file. Configuring the DHCP Server You should configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address. If you want the switch to receive IP address information, you must configure the DHCP server with these lease options: • IP address of the client (required) • Subnet mask of the client (required) • DNS server IP address (optional) • Router IP address (default gateway address to be used by the switch) (required) If you want the switch to receive the configuration file from a TFTP server, you must configure the DHCP server with these lease options: • TFTP server name (required) • Boot filename (the name of the configuration file that the client needs) (recommended) • Host name (optional) Depending on the settings of the DHCP server, the switch can receive IP address information, the configuration file, or both. If you do not configure the DHCP server with the lease options described earlier, it replies to client requests with only those parameters that are configured. If the IP address and subnet mask are not in the reply, the switch is not configured. If the router IP address or TFTP server name are not found, the switch might send broadcast, instead of unicast, TFTP requests. Unavailability of other lease options does not affect autoconfiguration. The DHCP server can be on the same LAN or on a different LAN than the switch. If the DHCP server is running on a different LAN, you should configure a DHCP relay. For more information, see the “Configuring the Relay Device” section on page 4-6. If your DHCP server is a Cisco device, refer to the “IP Addressing and Services” section in the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1. Configuring the TFTP Server Based on the DHCP server configuration, the switch attempts to download one or more configuration files from the TFTP server. If you configured the DHCP server to respond to the switch with all the options required for IP connectivity to the TFTP server, and if you configured the DHCP server with a TFTP server name, address, and configuration filename, the switch attempts to download the specified configuration file from the specified TFTP server. If you did not specify the configuration filename, the TFTP server, or if the configuration file could not be downloaded, the switch attempts to download a configuration file by using various combinations of filenames and TFTP server addresses. The files include the specified configuration filename (if any) and these files: network-config, cisconet.cfg, hostname.config, or hostname.cfg, where hostname is the switch’s current hostname. The TFTP server addresses used include the specified TFTP server address (if any) and the broadcast address (255.255.255.255).4-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information For the switch to successfully download a configuration file, the TFTP server must contain one or more configuration files in its base directory. The files can include these files: • The configuration file named in the DHCP reply (the actual switch configuration file). • The network-confg or the cisconet.cfg file (known as the default configuration files). • The router-confg or the ciscortr.cfg file (These files contain commands common to all switches. Normally, if the DHCP and TFTP servers are properly configured, these files are not accessed.) If you specify the TFTP server name in the DHCP server-lease database, you must also configure the TFTP server name-to-IP-address mapping in the DNS-server database. If the TFTP server to be used is on a different LAN from the switch, or if it is to be accessed by the switch through the broadcast address (which occurs if the DHCP server response does not contain all the required information described earlier), a relay must be configured to forward the TFTP packets to the TFTP server. For more information, see the “Configuring the Relay Device” section on page 4-6. The preferred solution is to configure the DHCP server with all the required information. Configuring the DNS The DHCP server uses the DNS server to resolve the TFTP server name to an IP address. You must configure the TFTP server name-to-IP address map on the DNS server. The TFTP server contains the configuration files for the switch. You can configure the IP addresses of the DNS servers in the lease database of the DHCP server from where the DHCP replies will retrieve them. You can enter up to two DNS server IP addresses in the lease database. The DNS server can be on the same or on a different LAN as the switch. If it is on a different LAN, the switch must be able to access it through a router. Configuring the Relay Device You must configure a relay device when a switch sends broadcast packets that need to be responded to by a host on a different LAN. Examples of broadcast packets that the switch might send are DHCP, DNS, and in some cases, TFTP packets. You must configure this relay device to forward received broadcast packets on an interface to the destination host. If the relay device is a Cisco router, enable IP routing (ip routing global configuration command), and configure helper addresses by using the ip helper-address interface configuration command. For example, in Figure 4-2, configure the router interfaces as follows: On interface 10.0.0.2: router(config-if)# ip helper-address 20.0.0.2 router(config-if)# ip helper-address 20.0.0.3 router(config-if)# ip helper-address 20.0.0.4 On interface 20.0.0.1 router(config-if)# ip helper-address 10.0.0.1 Note If the switch is acting as the relay device, configure the interface as a routed port. For more information, see the “Routed Ports” section on page 11-3 and the “Configuring Layer 3 Interfaces” section on page 11-18.4-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information Figure 4-2 Relay Device Used in Autoconfiguration Obtaining Configuration Files Depending on the availability of the IP address and the configuration filename in the DHCP reserved lease, the switch obtains its configuration information in these ways: • The IP address and the configuration filename is reserved for the switch and provided in the DHCP reply (one-file read method). The switch receives its IP address, subnet mask, TFTP server address, and the configuration filename from the DHCP server. The switch sends a unicast message to the TFTP server to retrieve the named configuration file from the base directory of the server, and upon receipt, completes its boot-up process. • The IP address and the configuration filename is reserved for the switch, but the TFTP server address is not provided in the DHCP reply (one-file read method). The switch receives its IP address, subnet mask, and the configuration filename from the DHCP server. The switch sends a broadcast message to a TFTP server to retrieve the named configuration file from the base directory of the server, and upon receipt, completes its boot-up process. • Only the IP address is reserved for the switch and provided in the DHCP reply. The configuration filename is not provided (two-file read method). The switch receives its IP address, subnet mask, and the TFTP server address from the DHCP server. The switch sends a unicast message to the TFTP server to retrieve the network-confg or cisconet.cfg default configuration file. (If the network-confg file cannot be read, the switch reads the cisconet.cfg file.) The default configuration file contains the host names-to-IP-address mapping for the switch. The switch fills its host table with the information in the file and obtains its host name. If the host name is not found in the file, the switch uses the host name in the DHCP reply. If the host name is not specified in the DHCP reply, the switch uses the default Switch as its host name. After obtaining its host name from the default configuration file or the DHCP reply, the switch reads the configuration file that has the same name as its host name (hostname-confg or hostname.cfg, depending on whether network-confg or cisconet.cfg was read earlier) from the TFTP server. If the cisconet.cfg file is read, the filename of the host is truncated to eight characters. If the switch cannot read the network-confg, cisconet.cfg, or the hostname file, it reads the router-confg file. If the switch cannot read the router-confg file, it reads the ciscortr.cfg file. Switch (DHCP client) Cisco router (Relay) DHCP server TFTP server DNS server 49068 20.0.0.2 20.0.0.3 20.0.0.1 10.0.0.2 10.0.0.1 20.0.0.44-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information Note The switch broadcasts TFTP server requests if the TFTP server is not obtained from the DHCP replies, if all attempts to read the configuration file through unicast transmissions fail, or if the TFTP server name cannot be resolved to an IP address. Example Configuration Figure 4-3 shows a sample network for retrieving IP information by using DHCP-based autoconfiguration. Figure 4-3 DHCP-Based Autoconfiguration Network Example Table 4-2 shows the configuration of the reserved leases on the DHCP server. Switch 1 00e0.9f1e.2001 Cisco router 49066 Switch 2 00e0.9f1e.2002 Switch 3 00e0.9f1e.2003 DHCP server DNS server TFTP server (maritsu) 10.0.0.1 10.0.0.10 10.0.0.2 10.0.0.3 Switch 4 00e0.9f1e.2004 Table 4-2 DHCP Server Configuration Switch-1 Switch-2 Switch-3 Switch-4 Binding key (hardware address) 00e0.9f1e.2001 00e0.9f1e.2002 00e0.9f1e.2003 00e0.9f1e.2004 IP address 10.0.0.21 10.0.0.22 10.0.0.23 10.0.0.24 Subnet mask 255.255.255.0 255.255.255.0 255.255.255.0 255.255.255.0 Router address 10.0.0.10 10.0.0.10 10.0.0.10 10.0.0.10 DNS server address 10.0.0.2 10.0.0.2 10.0.0.2 10.0.0.2 TFTP server name maritsu or 10.0.0.3 maritsu or 10.0.0.3 maritsu or 10.0.0.3 maritsu or 10.0.0.3 Boot filename (configuration file) (optional) switch1-confg switch2-confg switch3-confg switch4-confg Host name (optional) switch1 switch2 switch3 switch44-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Assigning Switch Information DNS Server Configuration The DNS server maps the TFTP server name maritsu to IP address 10.0.0.3. TFTP Server Configuration (on UNIX) The TFTP server base directory is set to /tftpserver/work/. This directory contains the network-confg file used in the two-file read method. This file contains the host name to be assigned to the switch based on its IP address. The base directory also contains a configuration file for each switch (switch1-confg, switch2-confg, and so forth) as shown in this display: prompt> cd /tftpserver/work/ prompt> ls network-confg switch1-confg switch2-confg switch3-confg switch4-confg prompt> cat network-confg ip host switch1 10.0.0.21 ip host switch2 10.0.0.22 ip host switch3 10.0.0.23 ip host switch4 10.0.0.24 DHCP Client Configuration No configuration file is present on Switch 1 through Switch 4. Configuration Explanation In Figure 4-3, Switch 1 reads its configuration file as follows: • It obtains its IP address 10.0.0.21 from the DHCP server. • If no configuration filename is given in the DHCP server reply, Switch 1 reads the network-confg file from the base directory of the TFTP server. • It adds the contents of the network-confg file to its host table. • It reads its host table by indexing its IP address 10.0.0.21 to its host name (switch1). • It reads the configuration file that corresponds to its host name; for example, it reads switch1-confg from the TFTP server. Switches 2 through 4 retrieve their configuration files and IP addresses in the same way. Manually Assigning IP Information Beginning in privileged EXEC mode, follow these steps to manually assign IP information to multiple switched virtual interfaces (SVIs) or ports: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface vlan vlan-id Enter interface configuration mode, and enter the VLAN to which the IP information is assigned. The range is 1 to 4094; do not enter leading zeros. Step 3 ip address ip-address subnet-mask Enter the IP address and subnet mask. Step 4 exit Return to global configuration mode.4-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Checking and Saving the Running Configuration To remove the switch IP address, use the no ip address interface configuration command. If you are removing the address through a Telnet session, your connection to the switch will be lost. To remove the default gateway address, use the no ip default-gateway global configuration command. For information on setting the switch system name, protecting access to privileged EXEC commands, and setting time and calendar services, see Chapter 7, “Administering the Switch.” Checking and Saving the Running Configuration You can check the configuration settings you entered or changes you made by entering this privileged EXEC command: Switch# show running-config Building configuration... Current configuration: 1363 bytes ! version 12.1 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Stack1 ! enable secret 5 $1$ej9.$DMUvAUnZOAmvmgqBEzIxE0 ! interface GigabitEthernet6/0/1 no switchport ip address 172.20.137.50 255.255.255.0 ! interface GigabitEthernet6/0/2 ! interface GigabitEthernet6/0/3 mvr type source ! interface GigabitEthernet6/0/4 ! interface GigabitEthernet6/0/5 ! Step 5 ip default-gateway ip-address Enter the IP address of the next-hop router interface that is directly connected to the switch where a default gateway is being configured. The default gateway receives IP packets with unresolved destination IP addresses from the switch. Once the default gateway is configured, the switch has connectivity to the remote networks with which a host needs to communicate. Note When your switch is configured to route with IP, it does not need to have a default gateway set. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose4-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Checking and Saving the Running Configuration interface GigabitEthernet6/0/6 ! interface GigabitEthernet6/0/7 ! interface GigabitEthernet6/0/8 ! interface GigabitEthernet6/0/9 no ip address ! interface GigabitEthernet6/0/10 ! interface GigabitEthernet6/0/11 ! interface GigabitEthernet6/0/12 ...! interface VLAN1 ip address 172.20.137.50 255.255.255.0 no ip directed-broadcast ! ip default-gateway 172.20.137.1 ! ! snmp-server community private RW snmp-server community public RO snmp-server community private@es0 RW snmp-server community public@es0 RO snmp-server chassis-id 0x12 ! end To store the configuration or changes you have made to your startup configuration in Flash memory, enter this privileged EXEC command: Switch# copy running-config startup-config Destination filename [startup-config]? Building configuration... This command saves the configuration settings that you made. If you fail to do this, your configuration will be lost the next time you reload the system. To display information stored in the NVRAM section of Flash memory, use the show startup-config or more startup-config privileged EXEC command. For more information about alternative locations to copy the configuration file, see Appendix B, “Working with the Cisco IOS File System, Configuration Files, and Software Images.”4-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Modifying the Startup Configuration Modifying the Startup Configuration This section describes how to modify the switch startup configuration. It contains this configuration information: • Default Boot Configuration, page 4-12 • Automatically Downloading a Configuration File, page 4-12 • Booting Manually, page 4-13 • Booting a Specific Software Image, page 4-14 • Controlling Environment Variables, page 4-15 See also “Switch Stack Configuration Files” section on page 5-9 and Appendix B, “Working with the Cisco IOS File System, Configuration Files, and Software Images,” for information about switch stack configuration files. Default Boot Configuration Table 4-3 shows the default boot configuration. Automatically Downloading a Configuration File You can automatically download a configuration file to your switch by using the DHCP-based autoconfiguration feature. For more information, see the “Understanding DHCP-Based Autoconfiguration” section on page 4-3. Table 4-3 Default Boot Configuration Feature Default Setting Operating system software image The switch attempts to automatically boot the system using information in the BOOT environment variable. If the variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the Flash file system. The IOS image is stored in a directory that has the same name as the image file (excluding the .bin extension). In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. Configuration file Configured switches use the config.text file stored on the system board in Flash memory. A new switch has no configuration file.4-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Modifying the Startup Configuration Specifying the Filename to Read and Write the System Configuration By default, the IOS software uses the file config.text to read and write a nonvolatile copy of the system configuration. However, you can specify a different filename, which will be loaded during the next boot cycle. Note This command only works properly from a standalone switch. Beginning in privileged EXEC mode, follow these steps to specify a different configuration filename: To return to the default setting, use the no boot config-file global configuration command. Booting Manually By default, the switch automatically boots; however, you can configure it to manually boot. Note This command only works properly from a standalone switch. Beginning in privileged EXEC mode, follow these steps to configure the switch to manually boot during the next boot cycle: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 boot config-file flash:/file-url Specify the configuration file to load during the next boot cycle. For file-url, specify the path (directory) and the configuration filename. Filenames and directory names are case sensitive. Step 3 end Return to privileged EXEC mode. Step 4 show boot Verify your entries. The boot config-file global configuration command changes the setting of the CONFIG_FILE environment variable. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 boot manual Enable the switch to manually boot during the next boot cycle. Step 3 end Return to privileged EXEC mode.4-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Modifying the Startup Configuration To disable manual booting, use the no boot manual global configuration command. Booting a Specific Software Image By default, the switch attempts to automatically boot the system using information in the BOOT environment variable. If this variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the Flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory. However, you can specify a specific image to boot. Note This command only works properly from a standalone switch. Beginning in privileged EXEC mode, follow these steps to configure the switch to boot a specific image during the next boot cycle: Step 4 show boot Verify your entries. The boot manual global command changes the setting of the MANUAL_BOOT environment variable. The next time you reboot the system, the switch is in boot loader mode, shown by the switch: prompt. To boot the system, use the boot filesystem:/file-url boot loader command. • For filesystem:, use flash: for the system board Flash device. • For file-url, specify the path (directory) and the name of the bootable image. Filenames and directory names are case sensitive. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 boot system filesystem:/file-url Configure the switch to boot a specific image in Flash memory during the next boot cycle. • For filesystem:, use flash: for the system board Flash device. • For file-url, specify the path (directory) and the name of the bootable image. Filenames and directory names are case sensitive. Step 3 end Return to privileged EXEC mode.4-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Modifying the Startup Configuration To return to the default setting, use the no boot system global configuration command. Controlling Environment Variables With a normally operating switch, you enter the boot loader mode only through a switch console connection configured for 9600 bps. Unplug the switch power cord and press the switch Mode button while reconnecting the power cord. You can release the Mode button a second or two after the LED above port 1 turns off. Then the boot loader switch: prompt is displayed. The switch boot loader software provides support for nonvolatile environment variables, which can be used to control how the boot loader, or any other software running on the system, behaves. Boot loader environment variables are similar to environment variables that can be set on UNIX or DOS systems. Environment variables that have values are stored in Flash memory outside of the Flash file system. Each line in these files contains an environment variable name and an equal sign followed by the value of the variable. A variable has no value if it is not listed in this file; it has a value if it is listed in the file even if the value is a null string. A variable that is set to a null string (for example, “ ”) is a variable with a value. Many environment variables are predefined and have default values. Environment variables store two kinds of data: • Data that controls code, which does not read the IOS configuration file. For example, the name of a boot loader helper file, which extends or patches the functionality of the boot loader can be stored as an environment variable. • Data that controls code, which is responsible for reading the IOS configuration file. For example, the name of the IOS configuration file can be stored as an environment variable. You can change the settings of the environment variables by accessing the boot loader or by using IOS commands. Under normal circumstances, it is not necessary to alter the setting of the environment variables. Note For complete syntax and usage information for the boot loader commands and environment variables, refer to the command reference for this release. Step 4 show boot Verify your entries. The boot system global command changes the setting of the BOOT environment variable. During the next boot cycle, the switch attempts to automatically boot the system using information in the BOOT environment variable. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose4-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Modifying the Startup Configuration Table 4-4 describes the function of the most common environment variables. Table 4-4 Environment Variables Variable Boot Loader Command IOS Global Configuration Command BOOT set BOOT filesystem:/file-url ... A semicolon-separated list of executable files to try to load and execute when automatically booting. If the BOOT environment variable is not set, the system attempts to load and execute the first executable image it can find by using a recursive, depth-first search through the Flash file system. If the BOOT variable is set but the specified images cannot be loaded, the system attempts to boot the first bootable file that it can find in the Flash file system. boot system filesystem:/file-url Specifies the IOS image to load during the next boot cycle. This command changes the setting of the BOOT environment variable. MANUAL_BOOT set MANUAL_BOOT yes Determines whether the switch automatically or manually boots. Valid values are 1, yes, 0, and no. If it is set to no or 0, the boot loader attempts to automatically boot the system. If it is set to anything else, you must manually boot the switch from the boot loader mode. boot manual Enables manually booting the switch during the next boot cycle and changes the setting of the MANUAL_BOOT environment variable. The next time you reboot the system, the switch is in boot loader mode. To boot the system, use the boot loader boot flash:filesystem:/file-url command, and specify the name of the bootable image. CONFIG_BUFSIZE set CONFIG_BUFSIZE size Changes the buffer size that IOS uses to hold a copy of the configuration file in memory. The configuration file cannot be larger than the buffer size allocation. The range is from 4096 to 524288 bytes. boot buffersize size Specifies the size of the file system-simulated NVRAM in Flash memory. The buffer holds a copy of the configuration file in memory. This command changes the setting of the CONFIG_BUFSIZE environment variable. You must reload the switch by using the reload privileged EXEC command for this command to take effect. CONFIG_FILE set CONFIG_FILE flash:/file-url Changes the filename that IOS uses to read and write a nonvolatile copy of the system configuration. boot config-file flash:/file-url Specifies the filename that IOS uses to read and write a nonvolatile copy of the system configuration. This command changes the CONFIG_FILE environment variable. SWITCH_NUMBER set SWITCH_NUMBER stack-member-number Changes the member number of a stack member. switch current-stack-member-number renumber new-stack-member-number Changes the member number of a stack member. SWITCH_PRIORITY set SWITCH_PRIORITY stack-member-number Changes the priority value of a stack member. switch stack-member-number priority priority-number Changes the priority value of a stack member.4-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Scheduling a Reload of the Software Image Scheduling a Reload of the Software Image You can schedule a reload of the software image to occur on the switch at a later time (for example, late at night or during the weekend when the switch is used less), or you can synchronize a reload network-wide (for example, to perform a software upgrade on all switches in the network). Note A scheduled reload must take place within approximately 24 days. Configuring a Scheduled Reload To configure your switch to reload the software image at a later time, use one of these commands in privileged EXEC mode: • reload in [hh:]mm [text] This command schedules a reload of the software to take affect in the specified minutes or hours and minutes. The reload must take place within approximately 24 days. You can specify the reason for the reload in a string up to 255 characters in length. To reload a specific switch in a switch stack, use the reload slot stack-member-number privileged EXEC command. • reload at hh:mm [month day | day month] [text] This command schedules a reload of the software to take place at the specified time (using a 24-hour clock). If you specify the month and day, the reload is scheduled to take place at the specified time and date. If you do not specify the month and day, the reload takes place at the specified time on the current day (if the specified time is later than the current time) or on the next day (if the specified time is earlier than the current time). Specifying 00:00 schedules the reload for midnight. Note Use the at keyword only if the switch system clock has been set (through Network Time Protocol (NTP), the hardware calendar, or manually). The time is relative to the configured time zone on the switch. To schedule reloads across several switches to occur simultaneously, the time on each switch must be synchronized with NTP. The reload command halts the system. If the system is not set to manually boot, it reboots itself. Use the reload command after you save the switch configuration information to the startup configuration (copy running-config startup-config). If your switch is configured for manual booting, do not reload it from a virtual terminal. This restriction prevents the switch from entering the boot loader mode and thereby taking it from the remote user’s control. If you modify your configuration file, the switch prompts you to save the configuration before reloading. During the save operation, the system requests whether you want to proceed with the save if the CONFIG_FILE environment variable points to a startup configuration file that no longer exists. If you proceed in this situation, the system enters setup mode upon reload. This example shows how to reload the software on the switch on the current day at 7:30 p.m: Switch# reload at 19:30 Reload scheduled for 19:30:00 UTC Wed Jun 5 1996 (in 2 hours and 25 minutes) Proceed with reload? [confirm]4-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-01 Chapter 4 Assigning the Switch IP Address and Default Gateway Scheduling a Reload of the Software Image This example shows how to reload the software on the switch at a future time: Switch# reload at 02:00 jun 20 Reload scheduled for 02:00:00 UTC Thu Jun 20 1996 (in 344 hours and 53 minutes) Proceed with reload? [confirm] To cancel a previously scheduled reload, use the reload cancel privileged EXEC command. Displaying Scheduled Reload Information To display information about a previously scheduled reload or to determine if a reload has been scheduled on the switch, use the show reload privileged EXEC command. It displays reload information including the time the reload is scheduled to occur and the reason for the reload (if it was specified when the reload was scheduled). C H A P T E R 5-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 5 Managing Switch Stacks This chapter provides the concepts and procedures to manage Catalyst 3750 switch stacks. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding Switch Stacks, page 5-1 • Assigning Stack Member Information, page 5-15 • Accessing the CLI of a Specific Stack Member, page 5-16 • Displaying Information about the Switch Stack, page 5-16 Refer to the hardware installation guide for other switch stack-related information, such as cabling the switches through their StackWise ports and using the LEDs to display switch stack status. Understanding Switch Stacks A switch stack is a set of up to nine Catalyst 3750 switches connected through their StackWise ports. One of the switches controls the operation of the stack and is called the stack master. The stack master and the other switches in the stack are stack members. The stack members use the Cisco StackWise technology to behave and work together as a unified system. Layer 2 and Layer 3 protocols present the entire switch stack as a single entity to the network. The stack master is the single point of stack-wide management. From the stack master, you configure: • System-level (global) features that apply to all stack members • Interface-level features for each stack member A switch stack is identified in the network by its bridge ID and, if the switch stack is operating as a Layer 3 device, its router MAC address. The bridge ID and router MAC address are determined by the MAC address of the stack master. Every stack member is uniquely identified by its own stack member number. All stack members are eligible stack masters. If the stack master becomes unavailable, the remaining stack members participate in electing a new stack master from among themselves. A set of factors determine which switch is elected the stack master. One of the factors is the stack member priority value. The switch with the highest priority value becomes the stack master.5-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks The system-level features supported on the stack master are supported on the entire switch stack. If the switch stack must have switches running both standard multilayer image (SMI) and enhanced multilayer image (EMI) software, we recommend that a switch running the EMI software be the stack master. EMI features are unavailable if the stack master is running the SMI software. Similarly, we recommend that a switch running the cryptographic (that is, supports encryption) version of the SMI or EMI software be the stack master. Encryption features are unavailable if the stack master is running the noncryptographic version of the SMI or EMI software. The stack master contains the saved and running configuration files for the switch stack. The configuration files include the system-level settings for the switch stack and the interface-level settings for each stack member. Each stack member has a current copy of these files for back-up purposes. You manage the switch stack through a single IP address. The IP address is a system-level setting and is not specific to the stack master or to any other stack member. You can manage the stack through the same IP address even if you remove the stack master or any other stack member from the stack. You can use these methods to manage switch stacks: • Using the CMS software through a Netscape or Internet Explorer browser session • Using the command-line interface (CLI) over a serial connection to the console port of any stack member • Using a network management application through Simple Network Management Protocol (SNMP) • Using the CiscoWorks network management software To manage switch stacks, you should understand: • These concepts on how switch stacks are formed: – Switch Stack Membership, page 5-3 – Stack Master Election and Re-Election, page 5-5 • These concepts on how switch stacks and stack members are configured: – Switch Stack Bridge ID and Router MAC Address, page 5-6 – Stack Member Numbers, page 5-6 – Stack Member Priority Values, page 5-7 – Hardware Compatibility in Switch Stacks, page 5-7 – Software Compatibility in Switch Stacks, page 5-7 – Switch Stack Configuration Files, page 5-9 – Additional Considerations for System-Wide Configuration on Switch Stacks, page 5-10 – Switch Stack Management Connectivity, page 5-11 – Switch Stack Configuration Scenarios, page 5-12 Note A switch stack is different from a switch cluster. A switch cluster is a set of switches connected through their LAN ports, such as the 10/100/1000 ports. For more information about how switch stacks differ from switch clusters, see the “Switch Clusters and Switch Stacks” section on page 6-15.5-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Switch Stack Membership A switch stack has up to nine stack members connected through their StackWise ports. A switch stack always has one stack master. A standalone switch is a switch stack with one stack member that also operates as the stack master. You can connect one standalone switch to another (Figure 5-1) to create a switch stack containing two stack members, with one of them being the stack master. You can connect standalone switches to an existing switch stack (Figure 5-2) to increase the stack membership. If you replace a stack member with an identical model, the new switch functions with exactly the same configuration as the replaced switch, assuming that the new switch is using the same member number as the replaced switch. The specific procedure for replacing a failed switch is described in the “Troubleshooting” chapter in the hardware installation guide. The operation of the switch stack continues uninterrupted during membership changes unless you remove the stack master or you add powered-on standalone switches or switch stacks. Note • Make sure the switches that you add to or remove from the switch stack are powered off. • After adding or removing stack members, make sure that the switch stack is operating at full bandwidth (32 Gbps). Press the Mode button on a stack member until the Stack mode LED is on. The last two port LEDs on all switches in the stack should be green. Depending on the switch model, the last two ports are either 10/100/1000 ports or small form-factor pluggable (SFP) module ports. If, on any of the switches, one or both of the last two port LEDs are not green, the stack is not operating at full bandwidth. • Adding powered-on switches (merging) causes the stack masters of the merging switch stacks to elect a stack master from among themselves. The re-elected stack master retains its role and configuration and so do its stack members. All remaining switches, including the former stack masters, reload and join the switch stack as stack members. They change their stack member numbers to the lowest available numbers and use the stack configuration of the re-elected stack master. • Removing powered-on stack members causes the switch stack to divide (partition) into two or more switch stacks, each with the same configuration. This can cause an IP address configuration conflict in your network. If you want the switch stacks to remain separate, change the IP address or addresses of the newly created switch stacks. If you did not intend to partition the switch stack: a. Power off the newly created switch stacks. b. Reconnect them to the original switch stack through their StackWise ports. c. Power on the switches. For additional information about cabling and powering switch stacks, refer to the “Switch Installation” chapter in the hardware installation guide.5-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Figure 5-1 Creating a Switch Stack from Two Standalone Switches Figure 5-2 Adding a Standalone Switch to a Switch Stack 86880 Stack member 1 Stack member 1 Stack member 1 Stack member 2 and stack master 86881 Stack member 1 Stack member 2 and stack master Stack member 3 Stack member 4 Stack member 1 Stack member 2 and stack master Stack member 3 Stack member 15-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Stack Master Election and Re-Election The stack master is elected or re-elected based on one of these factors and in the order as listed: 1. The switch currently the stack master. 2. The switch with the highest stack member priority value. Note We recommend assigning the highest priority value to the switch that you prefer to be the stack master. This ensures that the switch is re-elected as stack master if a re-election occurs. 3. The switch not using the default interface-level configuration. 4. The switch with the higher priority switch version. The switch versions listed below are ordered from highest to lowest priority: 1. Cryptographic EMI software 2. Noncryptographic EMI software 3. Cryptographic SMI software 4. Noncryptographic SMI software 5. The switch with the longest system up-time. 6. The switch with the lowest MAC address. A stack master retains its role unless one of these events occurs: • The switch stack is reset. * • The stack master is removed from the switch stack. • The stack master is reset or powered off. • The stack master has failed. • The switch stack membership is increased by adding powered-on standalone switches or switch stacks. * In the events marked by an asterisk (*), the current stack master might be re-elected based on the listed factors. When you power on or reset an entire switch stack, some stack members might not participate in the stack master election. Stack members that are powered on within the same 10-second time frame participate in the stack master election and have a chance to become the stack master. Stack members that are powered on after the 10-second time frame do not participate in this initial election and only become stack members. All stack members participate in re-elections. For all powering considerations that affect stack-master elections, refer to the “Switch Installation” chapter in the hardware installation guide. The new stack master becomes available after a few seconds. In the meantime, the switch stack uses the forwarding tables in memory to minimize network disruption. The physical interfaces on the other available stack members are not affected while a new stack master is elected and is resetting. If a new stack master is elected and the previous stack master becomes available, the previous stack master does not resume its role as stack master. As described in the hardware installation guide, you can use the Master LED on the switch to see if the switch is the stack master.5-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Switch Stack Bridge ID and Router MAC Address The bridge ID and router MAC address identify the switch stack in the network. When the switch stack initializes, the MAC address of the stack master determines the bridge ID and router MAC address. If the stack master changes, the MAC address of the new stack master determines the new bridge ID and router MAC address. Stack Member Numbers The stack member number (1 to 9) identifies each member in the switch stack. The member number also determines the interface-level configuration that a stack member uses. You can display the stack member number by using the show switch user EXEC command. A new, out-of-the-box switch (one that has not joined a switch stack or has not been manually assigned a stack member number) ships with a default stack member number of 1. When it joins a switch stack, its default stack member number changes to the lowest available member number in the stack. Stack members in the same switch stack cannot have the same stack member number. Every stack member, including a standalone switch, retains its member number until you manually change the number or unless the number is already being used by another member in the stack. • If you manually change the stack member number by using the switch current-stack-member-number renumber new-stack-member-number global configuration command, the new number goes into effect after that stack member resets (or after you use the reload slot stack-member-number privileged EXEC command) and only if that number is not already assigned to any other members in the stack. Another way to change the stack member number is by changing the SWITCH_NUMBER environment variable, as explained in the “Controlling Environment Variables” section on page 4-15. If the number is being used by another member in the stack, the switch selects the lowest available number in the stack. Note If you manually change the number of a stack member and no interface-level configuration is associated with that new member number, that stack member resets to its default configuration. For more information about stack member numbers and configurations, see the “Switch Stack Configuration Files” section on page 5-9. • If you move a stack member to a different switch stack, the stack member retains its number only if the number is not being used by another member in the stack. If it is being used by another member in the stack, the switch selects the lowest available number in the stack. • If you merge switch stacks, the switches that join the switch stack of a new stack master select the the lowest available numbers in the stack. For more information about merging switch stacks, see the “Switch Stack Membership” section on page 5-3). As described in the hardware installation guide, you can use the switch port LEDs in Stack mode to visually determine the stack member number of each stack member.5-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Stack Member Priority Values A higher priority value for a stack member increases its likelihood to be elected stack master and to retain its stack member number. The priority value can be 1 to 15. The default priority value is 1. You can display the stack member priority value by using the show switch user EXEC command. Note We recommend assigning the highest priority value to the switch that you prefer to be the stack master. This ensures that the switch is re-elected as stack master if a re-election occurs. You can change the priority value for a stack member by using the switch stack-member-number priority priority-number global configuration command. Another way to change the member priority value is by changing the SWITCH_PRIORITY environment variable, as explained in the “Controlling Environment Variables” section on page 4-15. The new priority value takes effect immediately but does not affect the current stack master. The new priority value helps determine which stack member is elected as the new stack master when the current stack master or the switch stack resets. Hardware Compatibility in Switch Stacks The Catalyst 3750-12S switch supports desktop and aggregator Switch Database Management (SDM) templates. All other Catalyst 3750 switches support only the desktop SDM templates. All stack members use the SDM template configured on the stack master. If the stack master is using an aggregator template, only Catalyst 3750-12S switches can be stack members. All other switches attempting to join this switch stack enter SDM mismatch mode. These switches can join the stack only when the stack master is running a desktop SDM template. We recommend that your stack master use an aggregator template only if you plan to create a switch stack of Catalyst 3750-12S switches. If you plan to have a switch stack with different Catalyst 3750 switch models, configure the stack master to use one of the desktop templates. Note Version mismatch (VM) mode has priority over SDM mismatch mode. If a VM mode condition and an SDM mismatch mode exist, the switch stack attempts to resolve the VM mode condition first. You can use the show switch privileged EXEC command to see if any stack members are in SDM mismatch mode. For more information about SDM templates and SDM mismatch mode, see the Chapter 8, “Configuring SDM Templates.” Software Compatibility in Switch Stacks This section describes how to ensure software compatibility between stack members: • Compatibility Recommendations, page 5-8 • Stack Protocol Version Compatibility, page 5-8 Use the information in this section and in the “Hardware Compatibility in Switch Stacks” section on page 5-7 to ensure complete compatibility between stack members.5-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Compatibility Recommendations All stack members must run the same Cisco IOS software version to ensure compatibility between stack members. We recommend the following: • The Cisco IOS software version on all stack members, including the stack master, should be the same. This helps ensure full compatibility in the stack protocol version among the stack members. For example, all stack members should have the EMI Cisco IOS Release 12.1(14)EA1 installed. • If your switch stack must have switches running SMI and EMI software, the switch running the EMI software should be the stack master. EMI features become unavailable to all stack members if the stack master is running the SMI software. • At least two stack members should have the EMI software installed to ensure redundant support of the EMI features. The EMI has precedence over the SMI during stack master election, assuming that the priority value of the stack members are the same. If the EMI stack master fails, the other stack member running the EMI software becomes the stack master. • When a switch running the EMI joins a switch stack running the SMI of the same version, the EMI switch does not automatically become the stack master. If you want the EMI switch to become the stack master, reset the current SMI stack master by using the reload slot stack-member-number privileged EXEC command. The EMI switch is elected the stack master, assuming its priority value is higher or the same as the other stack members. Stack Protocol Version Compatibility Each software image includes a stack protocol version. The stack protocol version has a major version number and a minor version number. Both version numbers determine the level of compatibility among the stack members. You can display the stack protocol version by using the show platform stack-manager all privileged EXEC command. Switches with the same Cisco IOS software version have the same stack protocol version. Such switches are fully compatible, and all features function properly across the switch stack. Switches with the same Cisco IOS software version as the stack master join the switch stack immediately. If an incompatibility exists, the incompatible stack members generate a system error message that describes the cause of the incompatibility on the specific stack members. The stack master displays the error message to all stack members. These sections provide more detail about incompatibility in switch stacks: • Major Incompatibility Between Switches, page 5-8 • Minor Incompatibility Between Switches, page 5-9 Major Incompatibility Between Switches Switches with different Cisco IOS software versions likely have different stack protocol versions. Switches with different major stack protocol version numbers are incompatible and cannot exist in the same switch stack.5-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Minor Incompatibility Between Switches Switches with the same major version number but a different minor version number as the stack master are considered partially compatible. When connected to a switch stack, partially compatible switches enter into version mismatch (VM) mode and cannot join the stack. The stack master downloads the software version it is using to any switch in VM mode. • If there is a stack member that is not in VM mode and is running software that can also run on the switch in VM mode, the stack master uses that software to upgrade (or downgrade) the software on the switch in VM mode. The switch in VM mode automatically reloads and joins the stack as a fully functioning member. Note The stack master does not automatically install EMI software on an SMI-running switch or SMI software on an EMI-running switch. • If none of the stack members are running software that can be installed on the switch in VM mode, the stack master scans the switch stack to see if there are any other recommended actions. Recommended actions appear in the system messages log. If there are no other actions to try, the stack master displays the recommended action to upgrade the software running on the switch stack. The port LEDs on switches in VM mode remain off and pressing the Mode button does not change the LED mode. You can also use the show switch privileged EXEC command to see if any stack members are in VM mode. Switch Stack Configuration Files The configuration files record • System-level (global) configuration settings—such as IP, STP, VLAN, and SNMP settings—that apply to all stack members • Stack member interface-specific configuration settings, which are specific for each stack member The stack master has the saved and running configuration files for the switch stack. All stack members periodically receive synchronized copies of the configuration files from the stack master. If the stack master becomes unavailable, any stack member assuming the role of stack master has the latest configuration files. Note We recommend that all stack members are installed with Cisco IOS Release 12.1(14)EA1 or later to ensure that the interface-specific settings of the stack master are saved, in case the stack master is replaced without saving the running configuration to the startup configuration. When a new, out-of-box switch joins a switch stack, it uses the system-level settings of that switch stack. If a switch is moved to a different switch stack, that switch loses its saved configuration file and uses the system-level configuration of the new switch stack.5-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks The interface-specific configuration of each stack member is associated with the stack member number. As mentioned in the “Stack Member Numbers” section on page 5-6, stack members retain their numbers unless they are manually changed or they are already used by another member in the same switch stack. • If an interface-specific configuration does not exist for that member number, the stack member uses its default interface-specific configuration. • If an interface-specific configuration exists for that member number, the stack member uses the interface-specific configuration associated with that member number. If a stack member fails and you replace with it with an identical model, the replacement switch automatically uses the same interface-specific configuration as the failed switch. Hence, you do not need to reconfigure the interface settings. The replacement switch must have the same stack member number as the failed switch. You back up and restore the stack configuration in the same way as you would for a standalone switch configuration. For more information about file systems and configuration files, see Appendix B, “Working with the Cisco IOS File System, Configuration Files, and Software Images.” Additional Considerations for System-Wide Configuration on Switch Stacks These sections provide additional considerations for configuring system-wide features on switch stacks: • “Switch Clusters and Switch Stacks” section on page 6-15 • “MAC Addresses and Switch Stacks” section on page 7-23 • “802.1X and Switch Stacks” section on page 10-10 • “VTP and Switch Stacks” section on page 13-6 • “Setting the SDM Template” section on page 8-4 • “Spanning Tree and Switch Stacks” section on page 15-12 • “MSTP and Switch Stacks” section on page 16-6 • “IGMP Snooping and Switch Stacks” section on page 18-5 • “Port Security and Switch Stacks” section on page 19-14 • “CDP and Switch Stacks” section on page 20-2 • “SPAN and RSPAN and Switch Stacks” section on page 22-10 • “ACLs and Switch Stacks” section on page 26-6 • “EtherChannel and Switch Stacks” section on page 28-9 • “IP Routing and Switch Stacks” section on page 29-3 • “HSRP and Switch Stacks” section on page 30-2 • “Multicast Routing and Switch Stacks” section on page 31-8 • “Fallback Bridging and Switch Stacks” section on page 33-35-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Switch Stack Management Connectivity You manage the switch stack and the stack member interfaces through the stack master. You can use Cluster Management Suite (CMS), the CLI, and SNMP and CiscoWorks network management applications. You cannot manage stack members on an individual switch basis. This section describes these considerations: • Connectivity to the Switch Stack Through an IP Address, page 5-11 • Connectivity to the Switch Stack Through an SSH Session, page 5-11 • Connectivity to the Switch Stack Through Console Ports, page 5-11 • Connectivity to Specific Stack Members, page 5-12 Connectivity to the Switch Stack Through an IP Address The switch stack is managed through a single IP address. The IP address is a system-level setting and is not specific to the stack master or to any other stack member. You can still manage the stack through the same IP address even if you remove the stack master or any other stack member from the stack, provided there is IP connectivity. Note Stack members retain their IP addresses when you remove them from a switch stack. To avoid a conflict by having two devices with the same IP address in your network, change the IP address or addresses of the switch that you removed from the switch stack. For related information about switch stack configurations, see the “Switch Stack Configuration Files” section on page 5-9. Connectivity to the Switch Stack Through an SSH Session The Secure Shell (SSH) connectivity to the switch stack can be lost if a stack master, running the cryptographic (that is, support encryption) version of the SMI or EMI software, fails and is replaced by a switch that is running a noncryptographic version of the software. We recommend that a switch running the cryptographic version of the SMI or EMI software be the stack master. Encryption features are unavailable if the stack master is running the noncryptographic version of the SMI or EMI software. Connectivity to the Switch Stack Through Console Ports You can connect to the stack master through the console port of one or more stack members. Be careful when using multiple CLI sessions to the stack master. Commands that you enter in one session are not displayed in the other sessions. Therefore, it is possible that you might not be able to identify the session from which you entered a command. Note We recommend using only one CLI session when managing the switch stack.5-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Connectivity to Specific Stack Members If you want to configure a specific stack member port, you must include the stack member number in the CLI command interface notation. For more information about interface notations, see the “Using Interface Configuration Mode” section on page 11-6. To debug a specific stack member, you can access it from the stack master by using the session stack-member-number privileged EXEC command. The stack member number is appended to the system prompt. For example, Switch-2# is the prompt in privileged EXEC mode for stack member 2, and the system prompt for the stack master is Switch. Only the show and debug commands are available in a CLI session to a specific stack member. Switch Stack Configuration Scenarios Table 5-1 provides scenarios of how switch stack features are determined. Most of the scenarios assume at least two switches are connected through their StackWise ports. Table 5-1 Switch Stack Configuration Scenarios Scenario Result Stack master election specifically determined by existing stack masters Connect two powered-on switch stacks through the StackWise ports. Only one of the two stack masters becomes the new stack master. None of the other stack members become the stack master. Stack master election specifically determined by the stack member priority value 1. Connect two switches through their StackWise ports. 2. Use the switch stack-member-number priority priority-number global configuration command to set one stack member with a higher member priority value. 3. Restart both stack members at the same time. The stack member with the higher priority value is elected stack master. Stack master election specifically determined by the configuration file Assuming that both stack members have the same priority value: 1. Make sure that one stack member has a default configuration and that the other stack member has a saved (nondefault) configuration file. 2. Restart both stack members at the same time. The stack member with the saved configuration file is elected stack master.5-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Stack master election specifically determined by the cryptographic EMI software Assuming that all stack members have the same priority value: 1. Make sure that one stack member has the cryptographic EMI software installed and that the other stack member has the noncryptographic EMI software installed. 2. Restart both stack members at the same time. The stack member with the cryptographic EMI software is elected stack master. Stack master election specifically determined by the EMI software Assuming that all stack members have the same priority value: 1. Make sure that one stack member has the noncryptographic EMI software installed and that the other stack member has the cryptographic SMI software installed. 2. Restart both stack members at the same time. The stack member with the noncryptographic EMI software is elected stack master. Stack master election specifically determined by the cryptographic SMI software Assuming that all stack members have the same priority value: 1. Make sure that one stack member has the cryptographic SMI software installed and that the other stack member has the noncryptographic SMI software installed. 2. Restart both stack members at the same time. The stack member with the cryptographic SMI software is elected stack master. Stack master election specifically determined by the MAC address Assuming that both stack members have the same priority value, configuration file, and software image, restart both stack members at the same time. The stack member with the lower MAC address is elected stack master. Stack member number conflict Assuming that one stack member has a higher priority value than the other stack member: 1. Ensure that both stack members have the same stack member number. If necessary, use the switch current-stack-member-number renumber new-stack-member-number global configuration command. 2. Restart both stack members at the same time. The stack member with the higher priority value retains its stack member number. The other stack member has a new stack member number. Table 5-1 Switch Stack Configuration Scenarios (continued) Scenario Result5-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Understanding Switch Stacks Add a stack member 1. Power off the new switch. 2. Through their StackWise ports, connect the new switch to a powered-on switch stack. 3. Power on the new switch. The stack master is retained. The new switch is added to the switch stack. Stack master failure Remove (or power off) the stack master. Based on the factors described in the “Stack Master Election and Re-Election” section on page 5-5, one of the remaining stack members becomes the new stack master. All other stack members in the stack remain as stack members and do not reboot. Add more than nine stack members 1. Through their StackWise ports, connect ten switches. 2. Power on all switches. Two switches become stack masters. One stack master has nine stack members. The other stack master remains as a standalone switch. Use the Mode button and port LEDs on the switches to identify which switches are stack masters and which switches belong to which stack master. For information about using the Mode button and the LEDs, refer to the hardware installation guide. Table 5-1 Switch Stack Configuration Scenarios (continued) Scenario Result5-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Assigning Stack Member Information Assigning Stack Member Information Note For complete syntax and usage information for the commands used in this section, refer to the switch command reference. This section contains this configuration information: • Default Switch Stack Configuration, page 5-15 • Assigning a Stack Member Number, page 5-15 (optional) • Setting the Stack Member Priority Value, page 5-16 (optional) • Accessing the CLI of a Specific Stack Member, page 5-16 (optional) Default Switch Stack Configuration Table 5-2 shows the default switch stack configuration. Assigning a Stack Member Number Note This task is available only from the stack master. Beginning in global configuration mode, follow these steps to assign a member number to a stack member: Table 5-2 Default Switch Stack Configuration Feature Default Setting Stack member number 1 Stack member priority value 1 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 switch current-stack-member-number renumber new-stack-member-number Specify the current stack member number and the new stack member number for the stack member. The stack member number range is 1 to 9. You can display the current stack member number by using the show switch user EXEC command. Step 3 end Return to privileged EXEC mode. Step 4 reload slot stack-member-number Reset the stack member, and apply this configuration change. Step 5 show switch Verify the stack member number.5-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 5 Managing Switch Stacks Accessing the CLI of a Specific Stack Member Setting the Stack Member Priority Value Note This task is available only from the stack master. Beginning in global configuration mode, follow these steps to assign a priority value to a stack member: Accessing the CLI of a Specific Stack Member Note This task is available only from the stack master. This task is only for debugging purposes. You can access all or specific stack members by using the remote command {all | stack-member-number} privileged EXEC command. The stack member number range is 1 to 9. You can access specific stack members by using the session stack-member-number privileged EXEC command. The stack member number range is 1 to 9. The stack member number is appended to the system prompt. For example, Switch-2# is the prompt in privileged EXEC mode for stack member 2, and the system prompt for the stack master is Switch. Enter exit to return to the CLI session on the stack master. Only the show and debug commands are available in a CLI session to a specific stack member. Displaying Information about the Switch Stack You can use these commands to display the configuration changes that you save after you reset a specific stack member or the switch stack. • show platform stack-manager all privileged EXEC command to display all switch stack information • show switch stack-member-number user EXEC command to display information about a specific member • These user EXEC commands to display switch stack information: – show switch detail – show switch neighbors – show switch stack-ports Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 switch stack-member-number priority priority-number Specify the stack member number and the priority for the stack member. The stack member number range is 1 to 9. The priority value range is 1 to 15. You can display the current priority value by using the show switch user EXEC command. The new priority value takes effect immediately but does not affect the current stack master. The new priority value helps determine which stack member is elected as the new stack master when the current stack master or switch stack resets. Step 3 end Return to privileged EXEC mode. Step 4 show switch stack-member-number Verify the stack member priority value.C H A P T E R 6-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 6 Clustering Switches This chapter provides the concepts and procedures to create and manage Catalyst 3750 switch clusters. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note This chapter focuses on Catalyst 3750 switch clusters. It also includes guidelines and limitations for clusters mixed with other cluster-capable Catalyst switches, but it does not provide complete descriptions of the cluster features for these other switches. For complete cluster information for a specific Catalyst platform, refer to the software configuration guide for that switch. This chapter consists of these sections: • Understanding Switch Clusters, page 6-2 • Planning a Switch Cluster, page 6-4 • Creating a Switch Cluster, page 6-18 Note Configuring switch clusters is more easily done from the Cluster Management Suite (CMS) web-based interface than through the command-line interface (CLI). Therefore, information in this chapter focuses on using CMS to create a cluster. See Chapter 3, “Getting Started with CMS,” for additional information about switch clusters and the clustering options. For complete procedures about using CMS to configure switch clusters, refer to the online help. For the CLI cluster commands, refer to the switch command reference. • Verifying a Switch Cluster, page 6-22 • Using the CLI to Manage Switch Clusters, page 6-24 • Using SNMP to Manage Switch Clusters, page 6-256-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Understanding Switch Clusters Understanding Switch Clusters A switch cluster is a set of up to 16 connected, cluster-capable Catalyst switches that are managed as a single entity. The switches in the cluster use the switch clustering technology so that you can configure and troubleshoot a group of different Catalyst desktop switch platforms through a single IP address. In a switch cluster, 1 switch must be the cluster command switch and up to 15 other switches can be cluster member switches. The total number of switches in a cluster cannot exceed 16 switches. The cluster command switch is the single point of access used to configure, manage, and monitor the cluster member switches. Cluster members can belong to only one cluster at a time. The benefits of clustering switches include: • Management of Catalyst switches regardless of their interconnection media and their physical locations. The switches can be in the same location, or they can be distributed across a Layer 2 or Layer 3 (if your cluster is using a Catalyst 3550 or Catalyst 3750 switch as a Layer 3 router between the Layer 2 switches in the cluster) network. Cluster members are connected to the cluster command switch according to the connectivity guidelines described in the “Automatic Discovery of Cluster Candidates and Members” section on page 6-5. This section includes management VLAN considerations for the Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL switches. For complete information about these switches in a switch-cluster environment, refer to the software configuration guide for that specific switch. • Command-switch redundancy if a cluster command switch fails. One or more switches can be designated as standby cluster command switches to avoid loss of contact with cluster members. A cluster standby group is a group of standby cluster command switches. • Management of a variety of Catalyst switches through a single IP address. This conserves on IP addresses, especially if you have a limited number of them. All communication with the switch cluster is through the cluster command switch IP address. Note A switch cluster is different from a switch stack. A switch stack is a set of Catalyst 3750 switches connected through their stack ports. For more information about how switch stacks differ from switch clusters, see the “Switch Clusters and Switch Stacks” section on page 6-15. Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be cluster command switches and which ones can only be cluster member switches, and the required software versions. These sections describe: • Cluster Command Switch Characteristics, page 6-3 • Standby Cluster Command Switch Characteristics, page 6-3 • Candidate Switch and Cluster Member Switch Characteristics, page 6-46-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Understanding Switch Clusters Cluster Command Switch Characteristics A cluster command switch must meet these requirements: • It is running Cisco IOS Release 12.1(11)AX or later. • It has an IP address. • It has Cisco Discovery Protocol (CDP) version 2 enabled (the default). • It is not a command or cluster member switch of another cluster. • It is connected to the standby cluster command switches through the management VLAN and to the cluster member switches through a common VLAN. Note If your switch cluster has a Catalyst 3750 switch or switch stack, it must be the cluster command switch. Standby Cluster Command Switch Characteristics A standby cluster command switch must meet these requirements: • It is running Cisco IOS Release 12.1(11)AX or later. • It has an IP address. • It has CDP version 2 enabled. • It is connected to the command switch and to other standby command switches through its management VLAN. • It is connected to all other cluster member switches (except the cluster command and standby command switches) through a common VLAN. • It is redundantly connected to the cluster so that connectivity to cluster member switches is maintained. • It is not a command or member switch of another cluster. Note Standby cluster command switches must be the same type of switches as the cluster command switch. For example, if the cluster command switch is a Catalyst 3750 switch, the standby cluster command switches must also be Catalyst 3750 switches. Refer to the switch configuration guide of other cluster-capable switches for their requirements on standby cluster command switches.6-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Candidate Switch and Cluster Member Switch Characteristics Candidate switches are cluster-capable switches and switch stacks that have not yet been added to a cluster. Cluster member switches are switches and switch stacks that have actually been added to a switch cluster. Although not required, a candidate or cluster member switch can have its own IP address and password (for related considerations, see the “IP Addresses” section on page 6-14 and “Passwords” section on page 6-15). To join a cluster, a candidate switch must meet these requirements: • It is running cluster-capable software. • It has CDP version 2 enabled. • It is not a command or cluster member switch of another cluster. • If a cluster standby group exists, it is connected to every standby cluster command switch through at least one common VLAN. The VLAN to each standby cluster command switch can be different. • It is connected to the cluster command switch through at least one common VLAN. Note Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL candidate and cluster member switches must be connected through their management VLAN to the cluster command switch and standby cluster command switches. For complete information about these switches in a switch-cluster environment, refer to the software configuration guide for that specific switch. This requirement does not apply if you have a Catalyst 3550 or Catalyst 3750 cluster command switch. Candidate and cluster member switches can connect through any VLAN in common with the cluster command switch. Planning a Switch Cluster Anticipating conflicts and compatibility issues is a high priority when you manage several switches through a cluster. This section describes these guidelines, requirements, and caveats that you should understand before you create the cluster: • Automatic Discovery of Cluster Candidates and Members, page 6-5 • HSRP and Standby Cluster Command Switches, page 6-11 • IP Addresses, page 6-14 • Host Names, page 6-14 • Passwords, page 6-15 • SNMP Community Strings, page 6-15 • Switch Clusters and Switch Stacks, page 6-15 • TACACS+ and RADIUS, page 6-17 • Access Modes in CMS, page 6-17 • Availability of Switch-Specific Features in Switch Clusters, page 6-17 Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be cluster command switches and which ones can only be cluster member switches, and for the required software versions and browser and Java plug-in configurations.6-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Automatic Discovery of Cluster Candidates and Members The cluster command switch uses Cisco Discovery Protocol (CDP) to discover cluster member switches, candidate switches, neighboring switch clusters, and edge devices across multiple VLANs and in star or cascaded topologies. Note Do not disable CDP on the cluster command switch, on cluster members, or on any cluster-capable switches that you might want a cluster command switch to discover. For more information about CDP, see Chapter 20, “Configuring CDP.” Following these connectivity guidelines ensures automatic discovery of the switch cluster, cluster candidates, connected switch clusters, and neighboring edge devices: • Discovery Through CDP Hops, page 6-5 • Discovery Through Non-CDP-Capable and Noncluster-Capable Devices, page 6-6 • Discovery Through Different VLANs, page 6-7 • Discovery Through Different Management VLANs, page 6-8 • Discovery Through Routed Ports, page 6-9 • Discovery of Newly Installed Switches, page 6-10 Discovery Through CDP Hops By using CDP, a cluster command switch can discover switches up to seven CDP hops away (the default is three hops) from the edge of the cluster. The edge of the cluster is where the last cluster member switches are connected to the cluster and to candidate switches. For example, cluster member switches 9 and 10 in Figure 6-1 are at the edge of the cluster. You can set the number of hops the cluster command switch searches for candidate and cluster member switches by selecting Cluster > Hop Count. When new candidate switches are added to the network, the cluster command switch discovers them and adds them to the list of candidate switches. Note A switch stack in a cluster equates to a single cluster member switch. There is a restriction specific to adding cluster members through CMS. For more information, see the “Switch Clusters and Switch Stacks” section on page 6-15. In Figure 6-1, the cluster command switch has ports assigned to VLANs 16 and 62. The CDP hop count is three. The cluster command switch discovers switches 11, 12, 13, and 14 because they are within three hops from the edge of the cluster. It does not discover switch 15 because it is four hops from the edge of the cluster.6-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Figure 6-1 Discovery Through CDP Hops Discovery Through Non-CDP-Capable and Noncluster-Capable Devices If a cluster command switch is connected to a non-CDP-capable third-party hub (such as a non-Cisco hub), it can discover cluster-enabled devices connected to that third-party hub. However, if the cluster command switch is connected to a noncluster-capable Cisco device, it cannot discover a cluster-enabled device connected beyond the noncluster-capable Cisco device. Figure 6-2 shows that the cluster command switch discovers the switch that is connected to a third-party hub. However, the cluster command switch does not discover the switch that is connected to a Catalyst 5000 switch. Figure 6-2 Discovery Through Non-CDP-Capable and Noncluster-Capable Devices Si Command switch Member switch 10 Member switch 8 Member switch 9 VLAN 62 Edge of cluster VLAN 16 86884 Switch 11 candidate switch Candidate switches Switch 12 Switch 13 Switch 14 Switch 15 Si Si Si Si Si Command switch Catalyst 5000 switch (noncluster-capable) Third-party hub (non-CDP-capable) Catalyst 3750 candidate switch Catalyst 3750 candidate switch 868856-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Discovery Through Different VLANs If the cluster command switch is a Catalyst 3550 or Catalyst 3750 switch, the cluster can have cluster member switches in different VLANs. As cluster member switches, they must be connected through at least one VLAN in common with the cluster command switch. The cluster command switch in Figure 6-3 has ports assigned to VLANs 9, 16, and 62 and therefore discovers the switches in those VLANs. It does not discover the switch in VLAN 50. It also does not discover the switch in VLAN 16 in the first column because the cluster command switch has no VLAN connectivity to it. Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL cluster member switches must be connected to the cluster command switch through their management VLAN. For information about discovery through management VLANs, the “Discovery Through Different Management VLANs” section on page 6-8. For more information about VLANs, see Chapter 12, “Configuring VLANs.” Note For additional considerations about VLANs in switch stacks, see the “Switch Clusters and Switch Stacks” section on page 6-15. Figure 6-3 Discovery Through Different VLANs Si Si VLAN 62 VLAN 62 VLAN 16 VLAN trunk 9,16 Command switch VLAN 50 VLAN trunk 9,16 VLAN trunk 4,16 868866-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Discovery Through Different Management VLANs Catalyst 2970, Catalyst 3550, or Catalyst 3750 cluster command switches can discover and manage cluster member switches in different VLANs and different management VLANs. As cluster member switches, they must be connected through at least one VLAN in common with the cluster command switch. They do not need to be connected to the cluster command switch through their management VLAN. The default management VLAN is VLAN 1. Note If the switch cluster has a Catalyst 3750 switch or switch stack, that switch or switch stack must be the cluster command switch. The cluster command switch and standby command switch in Figure 6-4 have ports assigned to VLANs 9, 16, and 62. The management VLAN on the cluster command switch is VLAN 9. Each cluster command switch discovers the switches in the different management VLANs except these: • Switches 7 and 10 (switches in management VLAN 4) because they are not connected through a common VLAN (meaning VLANs 62 and 9) with the cluster command switch • Switch 9 because automatic discovery does not extend beyond a noncandidate device, which is switch 7 Figure 6-4 Discovery Through Different Management VLANs with a Layer 3 Cluster Command Switch Si Si Si VLAN 62 VLAN trunk 4, 62 VLAN 62 VLAN 16 VLAN 9 VLAN 16 VLAN 9 Standby command switch Command switch VLAN 9 Switch 7 (management VLAN 4) Switch 9 (management VLAN 62) VLAN 4 86887 Switch 3 (management VLAN 16) Switch 4 (management VLAN 16) Switch 10 (management VLAN 4) Switch 8 (management VLAN 9) Switch 6 (management VLAN 9) Switch 5 (management VLAN 62)6-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Discovery Through Routed Ports If the cluster command switch has a routed port (RP) configured, it discovers only candidate and cluster member switches in the same VLAN as the routed port. For more information about routed ports, see the “Routed Ports” section on page 11-3. The cluster command switch in Figure 6-5 can discover the switches in VLANs 9 and 62 but not the switch in VLAN 4. If the routed port path between the cluster command switch and cluster member switch 7 is lost, connectivity with cluster member switch 7 is maintained because of the redundant path through VLAN 9. Figure 6-5 Discovery Through Routed Ports Si Si Si RP RP VLAN 62 VLAN 9 VLAN 62 VLAN 9 VLAN 4 VLAN 9 Command switch 65813 (management VLAN 62) Member switch 76-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Discovery of Newly Installed Switches To join a cluster, the new, out-of-the-box switch must be connected to the cluster through one of its access ports. An access port (AP) carries the traffic of and belongs to only one VLAN. By default, the new switch and its access ports are assigned to VLAN 1. When the new switch joins a cluster, its default VLAN changes to the VLAN of the immediately upstream neighbor. The new switch also configures its access port to belong to the VLAN of the immediately upstream neighbor. The cluster command switch in Figure 6-6 belongs to VLANs 9 and 16. When new cluster-capable switches join the cluster: • One cluster-capable switch and its access port are assigned to VLAN 9. • The other cluster-capable switch and its access port are assigned to management VLAN 16. Figure 6-6 Discovery of Newly Installed Switches Si Command switch New (out-of-box) Catalyst 3750 switch AP Catalyst 2950 switch VLAN 9 VLAN 9 VLAN 16 VLAN 16 New (out-of-box) Catalyst 3750 switch Catalyst 3550 switch 86888 AP (Management VLAN 9)6-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster HSRP and Standby Cluster Command Switches The switch supports Hot Standby Router Protocol (HSRP) so that you can configure a group of standby cluster command switches. Because a cluster command switch manages the forwarding of all communication and configuration information to all the cluster member switches, we strongly recommend the following: • For a cluster command switch stack, a standby cluster command switch is necessary if the entire switch stack fails. However, if only the stack master in the command switch stack fails, the switch stack elects a new stack master and resumes its role as the cluster command switch stack. • For a cluster command switch that is a standalone switch, configure a standby cluster command switch to take over if the primary cluster command switch fails. A cluster standby group is a group of command-capable switches that meet the requirements described in the “Standby Cluster Command Switch Characteristics” section on page 6-3. Only one cluster standby group can be assigned per cluster. Note If your switch cluster has a Catalyst 3750 switch or switch stack, it must be the cluster command switch. Note The cluster standby group is an HSRP group. Disabling HSRP disables the cluster standby group. The switches in the cluster standby group are ranked according to HSRP priorities. The switch with the highest priority in the group is the active cluster command switch (AC). The switch with the next highest priority is the standby cluster command switch (SC). The other switches in the cluster standby group are the passive cluster command switches (PC). If the active cluster command switch and the standby cluster command switch become disabled at the same time, the passive cluster command switch with the highest priority becomes the active cluster command switch. For the limitations to automatic discovery, see the “Automatic Recovery of Cluster Configuration” section on page 6-13. For information about changing HSRP priority values, see the “Configuring HSRP Priority” section on page 30-6. The HSRP standby priority interface configuration commands are the same for changing the priority of cluster standby group members and router-redundancy group members. Note The HSRP standby hold time interval should be greater than or equal to three times the hello time interval. The default HSRP standby hold time interval is 10 seconds. The default HSRP standby hello time interval is 3 seconds. For more information about the standby hold time and standby hello time intervals, see the “Configuring HSRP Authentication and Timers” section on page 30-8. These connectivity guidelines ensure automatic discovery of the switch cluster, cluster candidates, connected switch clusters, and neighboring edge devices. These topics also provide more detail about standby cluster command switches: • Virtual IP Addresses, page 6-12 • Other Considerations for Cluster Standby Groups, page 6-12 • Automatic Recovery of Cluster Configuration, page 6-136-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Virtual IP Addresses You need to assign a unique virtual IP address and group number and name to the cluster standby group. This information must be configured on a specific VLAN or routed port on the active cluster command switch. The active cluster command switch receives traffic destined for the virtual IP address. To manage the cluster, you must access the active cluster command switch through the virtual IP address, not through the command-switch IP address. This is in case the IP address of the active cluster command switch is different from the virtual IP address of the cluster standby group. If the active cluster command switch fails, the standby cluster command switch assumes ownership of the virtual IP address and becomes the active cluster command switch. The passive switches in the cluster standby group compare their assigned priorities to determine the new standby cluster command switch. The passive standby switch with the highest priority then becomes the standby cluster command switch. When the previously active cluster command switch becomes active again, it resumes its role as the active cluster command switch, and the current active cluster command switch becomes the standby cluster command switch again. For more information about IP address in switch clusters, see the “IP Addresses” section on page 6-14. Other Considerations for Cluster Standby Groups Note For additional considerations about cluster standby groups in switch stacks, see the “Switch Clusters and Switch Stacks” section on page 6-15. These requirements also apply: • Standby cluster command switches must be the same type of switches as the cluster command switch. For example, if the cluster command switch is a Catalyst 3750 switch, the standby cluster command switches must also be Catalyst 3750 switches. Refer to the switch configuration guide of other cluster-capable switches for their requirements on standby cluster command switches. If your switch cluster has a Catalyst 3750 switch or switch stack, it must be the cluster command switch. • Only one cluster standby group can be assigned to a cluster. You can have more than one router-redundancy standby group. An HSRP group can be both a cluster standby group and a router-redundancy group. However, if a router-redundancy group becomes a cluster standby group, router redundancy becomes disabled on that group. You can reenable it by using the CLI. For more information about HSRP and router redundancy, see Chapter 30, “Configuring HSRP.” • All standby-group members must be members of the cluster. Note There is no limit to the number of switches that you can assign as standby cluster command switches. However, the total number of switches in the cluster—which would include the active cluster command switch, standby-group members, and cluster member switches—cannot be more than 16.6-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster • Each standby-group member (Figure 6-7) must be connected to the cluster command switch through the same VLAN. Each standby-group member must also be redundantly connected to each other through at least one VLAN in common with the switch cluster. Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL cluster member switches must be connected to the cluster standby group through their management VLANs. For more information about VLANs in switch clusters, see these sections: – “Discovery Through Different VLANs” section on page 6-7 – “Discovery Through Different Management VLANs” section on page 6-8 Figure 6-7 VLAN Connectivity between Standby-Group Members and Cluster Members Automatic Recovery of Cluster Configuration The active cluster command switch continually forwards cluster-configuration information (but not device-configuration information) to the standby cluster command switch. This ensures that the standby cluster command switch can take over the cluster immediately after the active cluster command switch fails. Automatic discovery has these limitations: • This limitation applies only to clusters that have Catalyst 2950, Catalyst 3550, and Catalyst 3750 command and standby cluster command switches: If the active cluster command switch and standby cluster command switch become disabled at the same time, the passive cluster command switch with the highest priority becomes the active cluster command switch. However, because it was a passive standby cluster command switch, the previous cluster command switch did not forward cluster-configuration information to it. The active cluster command switch only forwards cluster-configuration information to the standby cluster command switch. You must therefore rebuild the cluster. • This limitation applies to all clusters: If the active cluster command switch fails and there are more than two switches in the cluster standby group, the new cluster command switch does not discover any Catalyst 1900, Catalyst 2820, and Catalyst 2916M XL cluster member switches. You must re-add these cluster member switches to the cluster. • This limitation applies to all clusters: If the active cluster command switch fails and becomes active again, it does not discover any Catalyst 1900, Catalyst 2820, and Catalyst 2916M XL cluster member switches. You must again add these cluster member switches to the cluster. Si Management VLAN 16 Standby command switch VLAN 16 VLAN 9 Si VLAN 9 Command switch Passive command switch Member switches Management VLAN 9 VLANs 9,16 VLANs 9,16 Management VLAN 16 86889 Si6-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster When the previously active cluster command switch resumes its active role, it receives a copy of the latest cluster configuration from the active cluster command switch, including members that were added while it was down. The active cluster command switch sends a copy of the cluster configuration to the cluster standby group. IP Addresses You must assign IP information to a cluster command switch. You can assign more than one IP address to the cluster command switch, and you can access the cluster through any of the command-switch IP addresses. If you configure a cluster standby group, you must use the standby-group virtual IP address to manage the cluster from the active cluster command switch. Using the virtual IP address ensures that you retain connectivity to the cluster if the active cluster command switch fails and that a standby cluster command switch becomes the active cluster command switch. If the active cluster command switch fails and the standby cluster command switch takes over, you must either use the standby-group virtual IP address or any of the IP addresses available on the new active cluster command switch to access the cluster. You can assign an IP address to a cluster-capable switch, but it is not necessary. A cluster member switch is managed and communicates with other cluster member switches through the command-switch IP address. If the cluster member switch leaves the cluster and it does not have its own IP address, you then must assign IP information to it to manage it as a standalone switch. Note Changing the cluster command switch IP address ends your CMS session on the switch. Restart your CMS session by entering the new IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer), as described in the release notes. For more information about IP addresses, see Chapter 4, “Assigning the Switch IP Address and Default Gateway.” Host Names You do not need to assign a host name to either a cluster command switch or an eligible cluster member. However, a host name assigned to the cluster command switch can help to identify the switch cluster. The default host name for the switch is Switch. If a switch joins a cluster and it does not have a host name, the cluster command switch appends a unique member number to its own host name and assigns it sequentially as each switch joins the cluster. The number means the order in which the switch was added to the cluster. For example, a cluster command switch named eng-cluster could name the fifth cluster member eng-cluster-5. If a switch has a host name, it retains that name when it joins a cluster. It retains that host name even after it leaves the cluster. If a switch received its host name from the cluster command switch, was removed from a cluster, was then added to a new cluster, and kept the same member number (such as 5), the old host name (such as eng-cluster-5) is overwritten with the host name of the cluster command switch in the new cluster (such as mkg-cluster-5). If the switch member number changes in the new cluster (such as 3), the switch retains the previous name (eng-cluster-5).6-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Passwords You do not need to assign passwords to an individual switch if it will be a cluster member. When a switch joins a cluster, it inherits the command-switch password and retains it when it leaves the cluster. If no command-switch password is configured, the cluster member switch inherits a null password. Cluster member switches only inherit the command-switch password. If you change the member-switch password to be different from the command-switch password and save the change, the switch is not manageable by the cluster command switch until you change the member-switch password to match the command-switch password. Rebooting the member switch does not revert the password back to the command-switch password. We recommend that you do not change the member-switch password after it joins a cluster. For more information about passwords, see the “Preventing Unauthorized Access to Your Switch” section on page 9-1. For password considerations specific to the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides for those switches. SNMP Community Strings A cluster member switch inherits the command-switch first read-only (RO) and read-write (RW) community strings with @esN appended to the community strings: • command-switch-readonly-community-string@esN, where N is the member-switch number. • command-switch-readwrite-community-string@esN, where N is the member-switch number. If the cluster command switch has multiple read-only or read-write community strings, only the first read-only and read-write strings are propagated to the cluster member switch. The switches support an unlimited number of community strings and string lengths. For more information about SNMP and community strings, see Chapter 25, “Configuring SNMP.” For SNMP considerations specific to the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides specific to those switches. Switch Clusters and Switch Stacks A switch cluster can have one or more Catalyst 3750 switch stacks. Each switch stack can act as the cluster command switch or as a single cluster member. Table 6-1 describes the basic differences between switch stacks and switch clusters. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.” Table 6-1 Basic Comparison of Switch Stacks and Switch Clusters Switch Stack Switch Cluster Made up of Catalyst 3750 switches only Made up of cluster-capable switches, such as Catalyst 3750, Catalyst 3550, and Catalyst 2950 switches Stack members are connected through StackWise ports Cluster members are connected through LAN ports Requires one stack master and supports up to eight other stack members Requires 1 cluster command switch and supports up to 15 other cluster member switches Can be a cluster command switch or a cluster member switch Cannot be a stack master or stack member6-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster Recall that stack members work together to behave as a unified system (as a single switch stack) in the network and are presented to the network as such by Layer 2 and Layer 3 protocols. Therefore, the switch cluster recognizes switch stacks, not individual stack members, as eligible cluster members. Individual stack members cannot join a switch cluster or participate as separate cluster members. Because a switch cluster must have 1 cluster command switch and can have up to 15 cluster members, a cluster can potentially have up to 16 switch stacks, totalling 144 devices. Cluster configuration of switch stacks is through the stack master. Note From the CLI, you can configure a switch cluster to contain up to 16 switch stacks. However, from CMS, the maximum number of actual devices in a switch cluster is 16, irrespective of the number of devices in switch stack cluster members. For example, if a switch stack contains three stack members, they are counted as three separate devices. If you used the CLI to configure a switch cluster that contains more than 16 actual devices and then try to display the cluster from CMS, CMS requires you to remove cluster members until the CMS limit of 16 is reached. These are considerations to keep in mind when you have switch stacks in switch clusters: • If the cluster command switch is not a Catalyst 3750 switch or switch stack and a new stack master is elected in a cluster member switch stack, the switch stack loses its connectivity to the switch cluster if there are no redundant connections between the switch stack and the cluster command switch. You must add the switch stack to the switch cluster. • If the cluster command switch is a switch stack and new stack masters are simultaneously elected in the cluster command switch stack and in cluster member switch stacks, connectivity between the switch stacks is lost if there are no redundant connections between the switch stack and the cluster command switch. You must add the switch stacks to the cluster, including the cluster command switch stack. Stack master is the single point of complete management for all stack members in a particular switch stack Cluster command switch is the single point of some management for all cluster members in a particular switch cluster Back-up stack master is automatically determined in case the stack master fails Standby cluster command switch must be pre-assigned in case the cluster command switch fails Switch stack supports up to eight simultaneous stack master failures Switch cluster supports only one cluster command switch failure at a time Stack members (as a switch stack) behave and is presented as a single, unified system in the network Cluster members are various, independent switches that are not managed as and do not behave as a unified system Integrated management of stack members through a single configuration file Cluster members have separate, individual configuration files Stack- and interface-level configurations are stored on each stack member Cluster configuration are stored on the cluster command switch and the standby cluster command switch New stack members are automatically added to the switch stack New cluster members must be manually added to the switch cluster Table 6-1 Basic Comparison of Switch Stacks and Switch Clusters (continued) Switch Stack Switch Cluster6-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Planning a Switch Cluster • All stack members should have redundant connectivity to all VLANs in the switch cluster. Otherwise, if a new stack master is elected, stack members connected to any VLANs not configured on the new stack master lose their connectivity to the switch cluster. You must change the VLAN configuration of the stack master or the stack members and add the stack members back to the switch cluster. • If a cluster member switch stack reloads and a new stack master is elected, the switch stack loses connectivity with the cluster command switch. You must add the switch stack back to the switch cluster. • If a cluster command switch stack reloads, and the original stack master is not re-elected, you must rebuild the entire switch cluster. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks,” TACACS+ and RADIUS Inconsistent authentication configurations in switch clusters cause CMS to continually prompt for a user name and password. If Terminal Access Controller Access Control System Plus (TACACS+) is configured on a cluster member, it must be configured on all cluster members. Similarly, if Remote Authentication Dial-In User Service (RADIUS) is configured on a cluster member, it must be configured on all cluster members. Further, the same switch cluster cannot have some members configured with TACACS+ and other members configured with RADIUS. For more information about TACACS+, see the “Controlling Switch Access with TACACS+” section on page 9-10. For more information about RADIUS, see the “Controlling Switch Access with RADIUS” section on page 9-18. Access Modes in CMS If your cluster has these cluster member switches running earlier software releases and if you have read-only access to these cluster member switches, some configuration windows for those switches display incomplete information: • Catalyst 2900 XL or Catalyst 3500 XL cluster member switches running Cisco IOS Release 12.0(5)WC2 or earlier • Catalyst 2950 cluster member switches running Cisco IOS Release 12.0(5)WC2 or earlier • Catalyst 3550 cluster member switches running Cisco IOS Release 12.1(6)EA1 or earlier These switches do not support read-only mode on CMS: • Catalyst 1900 and Catalyst 2820 • Catalyst 2900 XL switches with 4-MB CPU DRAM In read-only mode, these switches appear as unavailable devices and cannot be configured from CMS. For more information about CMS access modes, see the “Access Modes in CMS” section on page 3-30. Availability of Switch-Specific Features in Switch Clusters The menu bar on the cluster command switch displays all options available from the switch cluster. Therefore, features specific to a cluster member switch are available from the command-switch menu bar. For example, Device > LRE Profile appears in the command-switch menu bar when at least one Catalyst 2900 LRE XL switch is in the cluster.6-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Creating a Switch Cluster Creating a Switch Cluster Using CMS to create a cluster is easier than using the CLI commands. This section provides this information: • Enabling a Cluster Command Switch, page 6-18 • Adding Cluster Member Switches, page 6-19 • Creating a Cluster Standby Group, page 6-21 This section assumes you have already connected the switches, as described in the switch hardware installation guide, and followed the guidelines described in the “Planning a Switch Cluster” section on page 6-4. Note Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be cluster command switches and which ones can only be cluster member switches, and for the required software versions and browser and Java plug-in configurations. Enabling a Cluster Command Switch The switch you designate as the cluster command switch must meet the requirements described in the “Cluster Command Switch Characteristics” section on page 6-3, the “Planning a Switch Cluster” section on page 6-4, and the release notes. Note If your switch cluster has a Catalyst 3750 switch or switch stack, it must be the cluster command switch. You can enable a cluster command switch, name the cluster, and assign an IP address and a password to the cluster command switch when you run the setup program during initial switch setup. For information about using the setup program, refer to the release notes. If you did not enable a cluster command switch during initial switch setup, launch Device Manager from a command-capable switch, and select Cluster > Create Cluster. Enter a cluster number (the default is 0), and use up to 31 characters to name the cluster (Figure 6-8). Instead of using CMS to enable a cluster command switch, you can use the cluster enable global configuration command. Figure 6-8 Create Cluster Window Enter up to 31 characters to name the cluster. 93333 C3750-24TS6-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Creating a Switch Cluster Adding Cluster Member Switches Note This task is available only on the stack master. As explained in the “Automatic Discovery of Cluster Candidates and Members” section on page 6-5, the cluster command switch automatically discovers candidate switches. When you add new cluster-capable switches to the network, the cluster command switch discovers them and adds them to a list of candidate switches. Note A switch stack in a cluster equates to a single cluster member switch. There is a restriction specific to adding cluster members through CMS. From CMS, you can create a switch cluster with up to 15 cluster members. From the CLI, you can create a switch cluster with up to 144 devices. For more information, see the “Switch Clusters and Switch Stacks” section on page 6-15. To display an updated cluster candidates list from the Add to Cluster window (Figure 6-9), either relaunch CMS and redisplay this window, or follow these steps: 1. Close the Add to Cluster window. 2. Select View > Refresh. 3. Select Cluster > Add to Cluster to redisplay the Add to Cluster window. From CMS, there are two ways to add switches to a cluster: • Select Cluster > Add to Cluster, select a candidate switch from the list, click Add, and click OK. To add more than one candidate switch, press Ctrl, and make your choices, or press Shift, and choose the first and last switch in a range. • Display the Topology view, right-click a candidate-switch icon, and select Add to Cluster (Figure 6-10). In the Topology view, candidate switches are cyan, and cluster member switches are green. To add more than one candidate switch, press Ctrl, and left-click the candidates that you want to add. Instead of using CMS to add members to the cluster, you can use the cluster member global configuration command from the cluster command switch. Use the password option in this command if the candidate switch has a password. You can select 1 or more switches as long as the total number of switches in the cluster does not exceed 16 (this includes the cluster command switch). When a cluster has 16 members, the Add to Cluster option is not available for that cluster. In this case, you must remove a cluster member switch before adding a new one. If a password has been configured on a candidate switch, you are prompted to enter it before it can be added it to the cluster. If the candidate switch does not have a password, any entry is ignored. If multiple candidates switches have the same password, you can select them as a group, and add them at the same time. If a candidate switch in the group has a password different from the group, only that specific candidate switch is not added to the cluster. When a candidate switch joins a cluster, it inherits the command-switch password. For more information about setting passwords, see the “Passwords” section on page 6-15. For additional authentication considerations in switch clusters, see the “TACACS+ and RADIUS” section on page 6-17.6-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Creating a Switch Cluster Figure 6-9 Add to Cluster Window Figure 6-10 Using the Topology View to Add Cluster Member Switches Enter the password of the candidate switch. If no password exists for the switch, leave this field blank. Select a switch, and click Add. Press Ctrl and leftclick to select more than one switch. 93334 3750G-24T stack12 stack10 stack1 - 4 stack1 - 6 stack1 - 5 stack1 - 2 stack1 - 1 3750G-24T stack1 - 3 Thin line means a connection to a candidate switch. Right-click a candidate switch to display the pop-up menu, and select Add to Cluster to add the switch to the cluster. 93335 Add To Cluster Device Manager... Properties...6-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Creating a Switch Cluster Creating a Cluster Standby Group Note This task is available only on the stack master. The cluster standby group members must meet the requirements described in the “Standby Cluster Command Switch Characteristics” section on page 6-3 and “HSRP and Standby Cluster Command Switches” section on page 6-11. To create a cluster standby group, select Cluster > Standby Command Switches (Figure 6-11). Instead of using CMS to add switches to a standby group and to bind the standby group to a cluster, you can use the standby ip, the standby name, and the standby priority interface configuration commands and the cluster standby group global configuration command. Note Standby cluster command switches must be the same type of switches as the cluster command switch. For example, if the cluster command switch is a Catalyst 3750 switch, the standby cluster command switches must also be Catalyst 3750 switches. Refer to the switch configuration guide of other cluster-capable switches for their requirements on standby cluster command switches. These abbreviations are appended to the switch host names in the Standby Command Group list to show their eligibility or status in the cluster standby group: • AC—Active cluster command switch • SC—Standby cluster command switch • PC—Member of the cluster standby group but not the standby cluster command switch • HC—Candidate switch that can be added to the cluster standby group • CC—Cluster command switch when HSRP is disabled You must enter a virtual IP address for the cluster standby group. This address must be in the same subnet as the IP addresses of the switch. The group number must be unique within the IP subnet. It can be from 0 to 255, and the default is 0. The group name can have up to 31 characters. The Standby Command Configuration window uses the default values for the preempt and name commands that you have set by using the CLI. If you use this window to create the standby group, all switches in the group have the preempt command enabled. You must also provide a name for the group. Note The HSRP standby hold time interval should be greater than or equal to three times the hello time interval. The default HSRP standby hold time interval is 10 seconds. The default HSRP standby hello time interval is 3 seconds. For more information about the standby hold time and standby hello time intervals, see the “Configuring HSRP Authentication and Timers” section on page 30-8.6-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Verifying a Switch Cluster Figure 6-11 Standby Command Configuration Window Verifying a Switch Cluster When you finish adding cluster members, follow these steps to verify the cluster: Step 1 Enter the cluster command switch IP address in the browser Location field (Netscape Communicator) or Address field (Microsoft Internet Explorer) to access all switches in the cluster. Step 2 Enter the command-switch password. Step 3 Select View > Topology to display the cluster topology and to view link information (Figure 3-7 on page 3-11). For complete information about the Topology view, including descriptions of the icons, links, and colors, see the “Topology View” section on page 3-11. Step 4 Select Reports > Inventory to display an inventory of the switches in the cluster (Figure 6-12). The summary includes information such as switch model numbers, serial numbers, software versions, IP information, and location. You can also display port and switch statistics from Reports > Port Statistics and Port > Port Settings > Runtime Status. Instead of using CMS to verify the cluster, you can use the show cluster members user EXEC command from the cluster command switch or use the show cluster user EXEC command from the cluster command switch or from a cluster member switch. stack10 (cisco WS-C3750-24TS, HC, .. TRS (cisco WS-C37xx-24, HC, ...) stack1 (cisco WS-3750-48, CC, 0) G-M-C3550-24 (cisco WS-C3550-24, H Active command switch. Standby command switch. Must be a valid IP address in the same subnet as the active command switch. Once entered, this information cannot be changed. 933366-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Verifying a Switch Cluster Figure 6-12 Inventory Window If you lose connectivity with a cluster member switch or if a cluster command switch fails, see the cluster-related recovery procedures in Chapter 34, “Troubleshooting.” For more information about creating and managing clusters, refer to the online help. For information about the cluster commands, refer to the switch command reference.6-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Using the CLI to Manage Switch Clusters Using the CLI to Manage Switch Clusters You can configure cluster member switches from the CLI by first logging into the cluster command switch. Enter the rcommand user EXEC command and the cluster member switch number to start a Telnet session (through a console or Telnet connection) and to access the cluster member switch CLI. The command mode changes, and the Cisco IOS commands operate as usual. Enter the exit privileged EXEC command on the cluster member switch to return to the command-switch CLI. This example shows how to log into member-switch 3 from the command-switch CLI: switch# rcommand 3 If you do not know the member-switch number, enter the show cluster members privileged EXEC command on the cluster command switch. For more information about the rcommand command and all other cluster commands, refer to the switch command reference. The Telnet session accesses the member-switch CLI at the same privilege level as on the cluster command switch. The Cisco IOS commands then operate as usual. For instructions on configuring the switch for a Telnet session, see the “Disabling Password Recovery” section on page 9-5. Note The CLI supports creating and maintaining switch clusters with up to 16 switch stacks. For more information about switch stack and switch cluster, see the “Switch Clusters and Switch Stacks” section on page 6-15. Catalyst 1900 and Catalyst 2820 CLI Considerations If your switch cluster has Catalyst 1900 and Catalyst 2820 switches running standard edition software, the Telnet session accesses the management console (a menu-driven interface) if the cluster command switch is at privilege level 15. If the cluster command switch is at privilege level 1 to 14, you are prompted for the password to access the menu console. Command-switch privilege levels map to the Catalyst 1900 and Catalyst 2820 cluster member switches running standard and Enterprise Edition Software as follows: • If the command-switch privilege level is 1 to 14, the cluster member switch is accessed at privilege level 1. • If the command-switch privilege level is 15, the cluster member switch is accessed at privilege level 15. Note The Catalyst 1900 and Catalyst 2820 CLI is available only on switches running Enterprise Edition Software. For more information about the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides for those switches.6-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Using SNMP to Manage Switch Clusters Using SNMP to Manage Switch Clusters When you first power on the switch, SNMP is enabled if you enter the IP information by using the setup program and accept its proposed configuration. If you did not use the setup program to enter the IP information and SNMP was not enabled, you can enable it as described in the “Configuring SNMP” section on page 25-6. On Catalyst 1900 and Catalyst 2820 switches, SNMP is enabled by default. When you create a cluster, the cluster command switch manages the exchange of messages between cluster member switches and an SNMP application. The cluster software on the cluster command switch appends the cluster member switch number (@esN, where N is the switch number) to the first configured read-write and read-only community strings on the cluster command switch and propagates them to the cluster member switch. The cluster command switch uses this community string to control the forwarding of gets, sets, and get-next messages between the SNMP management station and the cluster member switches. Note When a cluster standby group is configured, the cluster command switch can change without your knowledge. Use the first read-write and read-only community strings to communicate with the cluster command switch if there is a cluster standby group configured for the cluster. If the cluster member switch does not have an IP address, the cluster command switch redirects traps from the cluster member switch to the management station, as shown in Figure 6-13. If a cluster member switch has its own IP address and community strings, the cluster member switch can send traps directly to the management station, without going through the cluster command switch. If a cluster member switch has its own IP address and community strings, they can be used in addition to the access provided by the cluster command switch. For more information about SNMP and community strings, see Chapter 25, “Configuring SNMP.” Figure 6-13 SNMP Management for a Cluster Tr a p Tr a p Tr a p Command switch Trap 1, Trap 2, Trap 3 Member 1 Member 2 Member 3 33020 SNMP Manager6-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 6 Clustering Switches Using SNMP to Manage Switch ClustersC H A P T E R 7-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 7 Administering the Switch This chapter describes how to perform one-time operations to administer the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. This chapter consists of these sections: • Managing the System Time and Date, page 7-1 • Configuring a System Name and Prompt, page 7-16 • Creating a Banner, page 7-19 • Managing the MAC Address Table, page 7-22 • Managing the ARP Table, page 7-28 Managing the System Time and Date You can manage the system time and date on your switch using automatic configuration, such as the Network Time Protocol (NTP), or manual configuration methods. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This section contains this configuration information: • Understanding the System Clock, page 7-2 • Understanding Network Time Protocol, page 7-2 • Configuring NTP, page 7-4 • Configuring Time and Date Manually, page 7-117-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Understanding the System Clock The heart of the time service is the system clock. This clock runs from the moment the system starts up and keeps track of the date and time. The system clock can then be set from these sources: • Network Time Protocol • Manual configuration The system clock can provide time to these services: • User show commands • Logging and debugging messages The system clock keeps track of time internally based on Universal Time Coordinated (UTC), also known as Greenwich Mean Time (GMT). You can configure information about the local time zone and summer time (daylight saving time) so that the time is correctly displayed for the local time zone. The system clock keeps track of whether the time is authoritative or not (that is, whether it has been set by a time source considered to be authoritative). If it is not authoritative, the time is available only for display purposes and is not redistributed. For configuration information, see the “Configuring Time and Date Manually” section on page 7-11. Understanding Network Time Protocol The NTP is designed to time-synchronize a network of devices. NTP runs over User Datagram Protocol (UDP), which runs over IP. NTP is documented in RFC 1305. An NTP network usually gets its time from an authoritative time source, such as a radio clock or an atomic clock attached to a time server. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two devices to within a millisecond of one another. NTP uses the concept of a stratum to describe how many NTP hops away a device is from an authoritative time source. A stratum 1 time server has a radio or atomic clock directly attached, a stratum 2 time server receives its time through NTP from a stratum 1 time server, and so on. A device running NTP automatically chooses as its time source the device with the lowest stratum number with which it communicates through NTP. This strategy effectively builds a self-organizing tree of NTP speakers. NTP avoids synchronizing to a device whose time might not be accurate by never synchronizing to a device that is not synchronized. NTP also compares the time reported by several devices and does not synchronize to a device whose time is significantly different than the others, even if its stratum is lower. The communications between devices running NTP (known as associations) are usually statically configured; each device is given the IP address of all devices with which it should form associations. Accurate timekeeping is possible by exchanging NTP messages between each pair of devices with an association. However, in a LAN environment, NTP can be configured to use IP broadcast messages instead. This alternative reduces configuration complexity because each device can simply be configured to send or receive broadcast messages. However, in that case, information flow is one-way only. The time kept on a device is a critical resource; you should use the security features of NTP to avoid the accidental or malicious setting of an incorrect time. Two mechanisms are available: an access list-based restriction scheme and an encrypted authentication mechanism.7-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Cisco’s implementation of NTP does not support stratum 1 service; it is not possible to connect to a radio or atomic clock. We recommend that the time service for your network be derived from the public NTP servers available on the IP Internet. Figure 7-1 show a typical network example using NTP. If the network is isolated from the Internet, Cisco’s implementation of NTP allows a device to act as though it is synchronized through NTP, when in fact it has determined the time by using other means. Other devices then synchronize to that device through NTP. When multiple sources of time are available, NTP is always considered to be more authoritative. NTP time overrides the time set by any other method. Several manufacturers include NTP software for their host systems, and a publicly available version for systems running UNIX and its various derivatives is also available. This software allows host systems to be time-synchronized as well. Figure 7-1 Typical NTP Network Configuration Catalyst 3750 switch These Catalyst 3750 switches are configured in NTP server mode (server association) with the Catalyst 6500 series switch. Catalyst 6500 series switch (NTP master) This Catalyst 3750 switch is configured as an NTP peer to the upstream and downstream Catalyst 3750 switches. Workstations Workstations Local workgroup servers 868927-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring NTP The switches do not have a hardware-supported clock, and they cannot function as an NTP master clock to which peers synchronize themselves when an external NTP source is not available. These switches also have no hardware support for a calendar. As a result, the ntp update-calendar and the ntp master global configuration commands are not available. This section contains this configuration information: • Default NTP Configuration, page 7-4 • Configuring NTP Authentication, page 7-5 • Configuring NTP Associations, page 7-6 • Configuring NTP Broadcast Service, page 7-7 • Configuring NTP Access Restrictions, page 7-8 • Configuring the Source IP Address for NTP Packets, page 7-10 • Displaying the NTP Configuration, page 7-11 Default NTP Configuration Table 7-1 shows the default NTP configuration. NTP is enabled on all interfaces by default. All interfaces receive NTP packets. Table 7-1 Default NTP Configuration Feature Default Setting NTP authentication Disabled. No authentication key is specified. NTP peer or server associations None configured. NTP broadcast service Disabled; no interface sends or receives NTP broadcast packets. NTP access restrictions No access control is specified. NTP packet source IP address The source address is determined by the outgoing interface.7-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring NTP Authentication This procedure must be coordinated with the administrator of the NTP server; the information you configure in this procedure must be matched by the servers used by the switch to synchronize its time to the NTP server. Beginning in privileged EXEC mode, follow these steps to authenticate the associations (communications between devices running NTP that provide for accurate timekeeping) with other devices for security purposes: To disable NTP authentication, use the no ntp authenticate global configuration command. To remove an authentication key, use the no ntp authentication-key number global configuration command. To disable authentication of the identity of a device, use the no ntp trusted-key key-number global configuration command. This example shows how to configure the switch to synchronize only to devices providing authentication key 42 in the device’s NTP packets: Switch(config)# ntp authenticate Switch(config)# ntp authentication-key 42 md5 aNiceKey Switch(config)# ntp trusted-key 42 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ntp authenticate Enable the NTP authentication feature, which is disabled by default. Step 3 ntp authentication-key number md5 value Define the authentication keys. By default, none are defined. • For number, specify a key number. The range is 1 to 4294967295. • md5 specifies that message authentication support is provided by using the message digest algorithm 5 (MD5). • For value, enter an arbitrary string of up to eight characters for the key. The switch does not synchronize to a device unless both have one of these authentication keys, and the key number is specified by the ntp trusted-key key-number command. Step 4 ntp trusted-key key-number Specify one or more key numbers (defined in Step 3) that a peer NTP device must provide in its NTP packets for this switch to synchronize to it. By default, no trusted keys are defined. For key-number, specify the key defined in Step 3. This command provides protection against accidentally synchronizing the switch to a device that is not trusted. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.7-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring NTP Associations An NTP association can be a peer association (this switch can either synchronize to the other device or allow the other device to synchronize to it), or it can be a server association (meaning that only this switch synchronizes to the other device, and not the other way around). Beginning in privileged EXEC mode, follow these steps to form an NTP association with another device: You need to configure only one end of an association; the other device can automatically establish the association. If you are using the default NTP version (version 3) and NTP synchronization does not occur, try using NTP version 2. Many NTP servers on the Internet run version 2. To remove a peer or server association, use the no ntp peer ip-address or the no ntp server ip-address global configuration command. This example shows how to configure the switch to synchronize its system clock with the clock of the peer at IP address 172.16.22.44 using NTP version 2: Switch(config)# ntp server 172.16.22.44 version 2 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ntp peer ip-address [version number] [key keyid] [source interface] [prefer] or ntp server ip-address [version number] [key keyid] [source interface] [prefer] Configure the switch system clock to synchronize a peer or to be synchronized by a peer (peer association). or Configure the switch system clock to be synchronized by a time server (server association). No peer or server associations are defined by default. • For ip-address in a peer association, specify either the IP address of the peer providing, or being provided, the clock synchronization. For a server association, specify the IP address of the time server providing the clock synchronization. • (Optional) For number, specify the NTP version number. The range is 1 to 3. By default, version 3 is selected. • (Optional) For keyid, enter the authentication key defined with the ntp authentication-key global configuration command. • (Optional) For interface, specify the interface from which to pick the IP source address. By default, the source IP address is taken from the outgoing interface. • (Optional) Enter the prefer keyword to make this peer or server the preferred one that provides synchronization. This keyword reduces switching back and forth between peers and servers. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring NTP Broadcast Service The communications between devices running NTP (known as associations) are usually statically configured; each device is given the IP addresses of all devices with which it should form associations. Accurate timekeeping is possible by exchanging NTP messages between each pair of devices with an association. However, in a LAN environment, NTP can be configured to use IP broadcast messages instead. This alternative reduces configuration complexity because each device can simply be configured to send or receive broadcast messages. However, the information flow is one-way only. The switch can send or receive NTP broadcast packets on an interface-by-interface basis if there is an NTP broadcast server, such as a router, broadcasting time information on the network. The switch can send NTP broadcast packets to a peer so that the peer can synchronize to it. The switch can also receive NTP broadcast packets to synchronize its own clock. This section provides procedures for both sending and receiving NTP broadcast packets. Beginning in privileged EXEC mode, follow these steps to configure the switch to send NTP broadcast packets to peers so that they can synchronize their clock to the switch: To disable the interface from sending NTP broadcast packets, use the no ntp broadcast interface configuration command. This example shows how to configure an interface to send NTP version 2 packets: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ntp broadcast version 2 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Specify the interface to send NTP broadcast packets, and enter interface configuration mode. Step 3 ntp broadcast [version number] [key keyid] [destination-address] Enable the interface to send NTP broadcast packets to a peer. By default, this feature is disabled on all interfaces. • (Optional) For number, specify the NTP version number. The range is 1 to 3. If you do not specify a version, version 3 is used. • (Optional) For keyid, specify the authentication key to use when sending packets to the peer. • (Optional) For destination-address, specify the IP address of the peer that is synchronizing its clock to this switch. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Step 7 Configure the connected peers to receive NTP broadcast packets as described in the next procedure.7-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps to configure the switch to receive NTP broadcast packets from connected peers: To disable an interface from receiving NTP broadcast packets, use the no ntp broadcast client interface configuration command. To change the estimated round-trip delay to the default, use the no ntp broadcastdelay global configuration command. This example shows how to configure an interface to receive NTP broadcast packets: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ntp broadcast client Configuring NTP Access Restrictions You can control NTP access on two levels as described in these sections: • Creating an Access Group and Assigning a Basic IP Access List, page 7-9 • Disabling NTP Services on a Specific Interface, page 7-10 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Specify the interface to receive NTP broadcast packets, and enter interface configuration mode. Step 3 ntp broadcast client Enable the interface to receive NTP broadcast packets. By default, no interfaces receive NTP broadcast packets. Step 4 exit Return to global configuration mode. Step 5 ntp broadcastdelay microseconds (Optional) Change the estimated round-trip delay between the switch and the NTP broadcast server. The default is 3000 microseconds; the range is 1 to 999999. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.7-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Creating an Access Group and Assigning a Basic IP Access List Beginning in privileged EXEC mode, follow these steps to control access to NTP services by using access lists: The access group keywords are scanned in this order, from least restrictive to most restrictive: 1. peer—Allows time requests and NTP control queries and allows the switch to synchronize itself to a device whose address passes the access list criteria. 2. serve—Allows time requests and NTP control queries, but does not allow the switch to synchronize itself to a device whose address passes the access list criteria. 3. serve-only—Allows only time requests from a device whose address passes the access list criteria. 4. query-only—Allows only NTP control queries from a device whose address passes the access list criteria. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ntp access-group {query-only | serve-only | serve | peer} access-list-number Create an access group, and apply a basic IP access list. The keywords have these meanings: • query-only—Allows only NTP control queries. • serve-only—Allows only time requests. • serve—Allows time requests and NTP control queries, but does not allow the switch to synchronize to the remote device. • peer—Allows time requests and NTP control queries and allows the switch to synchronize to the remote device. For access-list-number, enter a standard IP access list number from 1 to 99. Step 3 access-list access-list-number permit source [source-wildcard] Create the access list. • For access-list-number, enter the number specified in Step 2. • Enter the permit keyword to permit access if the conditions are matched. • For source, enter the IP address of the device that is permitted access to the switch. • (Optional) For source-wildcard, enter the wildcard bits to be applied to the source. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.7-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date If the source IP address matches the access lists for more than one access type, the first type is granted. If no access groups are specified, all access types are granted to all devices. If any access groups are specified, only the specified access types are granted. To remove access control to the switch NTP services, use the no ntp access-group {query-only | serve-only | serve | peer} global configuration command. This example shows how to configure the switch to allow itself to synchronize to a peer from access list 99. However, the switch restricts access to allow only time requests from access list 42: Switch# configure terminal Switch(config)# ntp access-group peer 99 Switch(config)# ntp access-group serve-only 42 Switch(config)# access-list 99 permit 172.20.130.5 Switch(config)# access list 42 permit 172.20.130.6 Disabling NTP Services on a Specific Interface NTP services are enabled on all interfaces by default. Beginning in privileged EXEC mode, follow these steps to disable NTP packets from being received on an interface: To re-enable receipt of NTP packets on an interface, use the no ntp disable interface configuration command. Configuring the Source IP Address for NTP Packets When the switch sends an NTP packet, the source IP address is normally set to the address of the interface through which the NTP packet is sent. Use the ntp source global configuration command when you want to use a particular source IP address for all NTP packets. The address is taken from the specified interface. This command is useful if the address on an interface cannot be used as the destination for reply packets. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to disable. Step 3 ntp disable Disable NTP packets from being received on the interface. By default, all interfaces receive NTP packets. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.7-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps to configure a specific interface from which the IP source address is to be taken: The specified interface is used for the source address for all packets sent to all destinations. If a source address is to be used for a specific association, use the source keyword in the ntp peer or ntp server global configuration command as described in the “Configuring NTP Associations” section on page 7-6. Displaying the NTP Configuration You can use two privileged EXEC commands to display NTP information: • show ntp associations [detail] • show ntp status For detailed information about the fields in these displays, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. Configuring Time and Date Manually If no other source of time is available, you can manually configure the time and date after the system is restarted. The time remains accurate until the next system restart. We recommend that you use manual configuration only as a last resort. If you have an outside source to which the switch can synchronize, you do not need to manually set the system clock. Note You must reset this setting if you have manually set the system clock and the stack master fails and different stack member resumes the role of stack master. This section contains this configuration information: • Setting the System Clock, page 7-12 • Displaying the Time and Date Configuration, page 7-12 • Configuring the Time Zone, page 7-13 • Configuring Summer Time (Daylight Saving Time), page 7-14 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ntp source type number Specify the interface type and number from which the IP source address is taken. By default, the source address is determined by the outgoing interface. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Setting the System Clock If you have an outside source on the network that provides time services, such as an NTP server, you do not need to manually set the system clock. Beginning in privileged EXEC mode, follow these steps to set the system clock: This example shows how to manually set the system clock to 1:32 p.m. on July 23, 2001: Switch# clock set 13:32:00 23 July 2001 Displaying the Time and Date Configuration To display the time and date configuration, use the show clock [detail] privileged EXEC command. The system clock keeps an authoritative flag that shows whether the time is authoritative (believed to be accurate). If the system clock has been set by a timing source such as NTP, the flag is set. If the time is not authoritative, it is used only for display purposes. Until the clock is authoritative and the authoritative flag is set, the flag prevents peers from synchronizing to the clock when the peers’ time is invalid. The symbol that precedes the show clock display has this meaning: • *—Time is not authoritative. • (blank)—Time is authoritative. • .—Time is authoritative, but NTP is not synchronized. Command Purpose Step 1 clock set hh:mm:ss day month year or clock set hh:mm:ss month day year Manually set the system clock using one of these formats. • For hh:mm:ss, specify the time in hours (24-hour format), minutes, and seconds. The time specified is relative to the configured time zone. • For day, specify the day by date in the month. • For month, specify the month by name. • For year, specify the year (no abbreviation). Step 2 show running-config Verify your entries. Step 3 copy running-config startup-config (Optional) Save your entries in the configuration file.7-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring the Time Zone Beginning in privileged EXEC mode, follow these steps to manually configure the time zone: The minutes-offset variable in the clock timezone global configuration command is available for those cases where a local time zone is a percentage of an hour different from UTC. For example, the time zone for some sections of Atlantic Canada (AST) is UTC-3.5, where the 3 means 3 hours and .5 means 50 percent. In this case, the necessary command is clock timezone AST -3 30. To set the time to UTC, use the no clock timezone global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 clock timezone zone hours-offset [minutes-offset] Set the time zone. The switch keeps internal time in universal time coordinated (UTC), so this command is used only for display purposes and when the time is manually set. • For zone, enter the name of the time zone to be displayed when standard time is in effect. The default is UTC. • For hours-offset, enter the hours offset from UTC. • (Optional) For minutes-offset, enter the minutes offset from UTC. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Configuring Summer Time (Daylight Saving Time) Beginning in privileged EXEC mode, follow these steps to configure summer time (daylight saving time) in areas where it starts and ends on a particular day of the week each year: The first part of the clock summer-time global configuration command specifies when summer time begins, and the second part specifies when it ends. All times are relative to the local time zone. The start time is relative to standard time. The end time is relative to summer time. If the starting month is after the ending month, the system assumes that you are in the southern hemisphere. This example shows how to specify that summer time starts on the first Sunday in April at 02:00 and ends on the last Sunday in October at 02:00: Switch(config)# clock summer-time PDT recurring 1 Sunday April 2:00 last Sunday October 2:00 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 clock summer-time zone recurring [week day month hh:mm week day month hh:mm [offset]] Configure summer time to start and end on the specified days every year. Summer time is disabled by default. If you specify clock summer-time zone recurring without parameters, the summer time rules default to the United States rules. • For zone, specify the name of the time zone (for example, PDT) to be displayed when summer time is in effect. • (Optional) For week, specify the week of the month (1 to 5 or last). • (Optional) For day, specify the day of the week (Sunday, Monday...). • (Optional) For month, specify the month (January, February...). • (Optional) For hh:mm, specify the time (24-hour format) in hours and minutes. • (Optional) For offset, specify the number of minutes to add during summer time. The default is 60. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the System Time and Date Beginning in privileged EXEC mode, follow these steps if summer time in your area does not follow a recurring pattern (configure the exact date and time of the next summer time events): The first part of the clock summer-time global configuration command specifies when summer time begins, and the second part specifies when it ends. All times are relative to the local time zone. The start time is relative to standard time. The end time is relative to summer time. If the starting month is after the ending month, the system assumes that you are in the southern hemisphere. To disable summer time, use the no clock summer-time global configuration command. This example shows how to set summer time to start on October 12, 2000, at 02:00, and end on April 26, 2001, at 02:00: Switch(config)# clock summer-time pdt date 12 October 2000 2:00 26 April 2001 2:00 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 clock summer-time zone date [month date year hh:mm month date year hh:mm [offset]] or clock summer-time zone date [date month year hh:mm date month year hh:mm [offset]] Configure summer time to start on the first date and end on the second date. Summer time is disabled by default. • For zone, specify the name of the time zone (for example, PDT) to be displayed when summer time is in effect. • (Optional) For week, specify the week of the month (1 to 5 or last). • (Optional) For day, specify the day of the week (Sunday, Monday...). • (Optional) For month, specify the month (January, February...). • (Optional) For hh:mm, specify the time (24-hour format) in hours and minutes. • (Optional) For offset, specify the number of minutes to add during summer time. The default is 60. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Configuring a System Name and Prompt Configuring a System Name and Prompt You configure the system name on the switch to identify it. By default, the system name and prompt are Switch. If you have not configured a system prompt, the first 20 characters of the system name are used as the system prompt. A greater-than symbol [>] is appended. The prompt is updated whenever the system name changes, unless you manually configure the prompt by using the prompt global configuration command. If you are accessing a stack member through the stack master, you must use the session stack-member-number privileged EXEC command. The stack member number range is from 1 through 9. When you use this command, the stack member number is appended to the system prompt. For example, Switch-2# is the prompt in privileged EXEC mode for stack member 2, and the system prompt for the switch stack is Switch. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference and the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This section contains this configuration information: • Default System Name and Prompt Configuration, page 7-16 • Configuring a System Name, page 7-16 • Configuring a System Prompt, page 7-17 • Understanding DNS, page 7-17 Default System Name and Prompt Configuration The default switch system name and prompt is Switch. Configuring a System Name Beginning in privileged EXEC mode, follow these steps to manually configure a system name: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 hostname name Manually configure a system name. The default setting is switch. The name must follow the rules for ARPANET host names. They must start with a letter, end with a letter or digit, and have as interior characters only letters, digits, and hyphens. Names can be up to 63 characters. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Configuring a System Name and Prompt When you set the system name, it is also used as the system prompt. You can override the prompt setting by using the prompt global configuration command. To return to the default hostname, use the no hostname global configuration command. Configuring a System Prompt Beginning in privileged EXEC mode, follow these steps to manually configure a system prompt: To return to the default prompt, use the no prompt [string] global configuration command. Understanding DNS The DNS protocol controls the Domain Name System (DNS), a distributed database with which you can map host names to IP addresses. When you configure DNS on your switch, you can substitute the host name for the IP address with all IP commands, such as ping, telnet, connect, and related Telnet support operations. IP defines a hierarchical naming scheme that allows a device to be identified by its location or domain. Domain names are pieced together with periods (.) as the delimiting characters. For example, Cisco Systems is a commercial organization that IP identifies by a com domain name, so its domain name is cisco.com. A specific device in this domain, for example, the File Transfer Protocol (FTP) system is identified as ftp.cisco.com. To keep track of domain names, IP has defined the concept of a domain name server, which holds a cache (or database) of names mapped to IP addresses. To map domain names to IP addresses, you must first identify the host names, specify the name server that is present on your network, and enable the DNS. This section contains this configuration information: • Default DNS Configuration, page 7-18 • Setting Up DNS, page 7-18 • Displaying the DNS Configuration, page 7-19 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 prompt string Configure the command-line prompt to override the setting from the hostname command. The default prompt is either switch or the name defined with the hostname global configuration command, followed by an angle bracket (>) for user EXEC mode or a pound sign (#) for privileged EXEC mode. The prompt can consist of all printing characters and escape sequences. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Configuring a System Name and Prompt Default DNS Configuration Table 7-2 shows the default DNS configuration. Setting Up DNS Beginning in privileged EXEC mode, follow these steps to set up your switch to use the DNS: Table 7-2 Default DNS Configuration Feature Default Setting DNS enable state Enabled. DNS default domain name None configured. DNS servers No name server addresses are configured. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip domain-name name Define a default domain name that the software uses to complete unqualified host names (names without a dotted-decimal domain name). Do not include the initial period that separates an unqualified name from the domain name. At boot time, no domain name is configured; however, if the switch configuration comes from a BOOTP or Dynamic Host Configuration Protocol (DHCP) server, then the default domain name might be set by the BOOTP or DHCP server (if the servers were configured with this information). Step 3 ip name-server server-address1 [server-address2 ... server-address6] Specify the address of one or more name servers to use for name and address resolution. You can specify up to six name servers. Separate each server address with a space. The first server specified is the primary server. The switch sends DNS queries to the primary server first. If that query fails, the backup servers are queried. Step 4 ip domain-lookup (Optional) Enable DNS-based host name-to-address translation on your switch. This feature is enabled by default. If your network devices require connectivity with devices in networks for which you do not control name assignment, you can dynamically assign device names that uniquely identify your devices by using the global Internet naming scheme (DNS). Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.7-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Creating a Banner If you use the switch IP address as its hostname, the IP address is used and no DNS query occurs. If you configure a hostname that contains no periods (.), a period followed by the default domain name is appended to the hostname before the DNS query is made to map the name to an IP address. The default domain name is the value set by the ip domain-name global configuration command. If there is a period (.) in the hostname, the Cisco IOS software looks up the IP address without appending any default domain name to the hostname. To remove a domain name, use the no ip domain-name name global configuration command. To remove a name server address, use the no ip name-server server-address global configuration command. To disable DNS on the switch, use the no ip domain-lookup global configuration command. Displaying the DNS Configuration To display the DNS configuration information, use the show running-config privileged EXEC command. Creating a Banner You can configure a message-of-the-day (MOTD) and a login banner. The MOTD banner displays on all connected terminals at login and is useful for sending messages that affect all network users (such as impending system shutdowns). The login banner also displays on all connected terminals. It is displayed after the MOTD banner and before the login prompts. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This section contains this configuration information: • Default Banner Configuration, page 7-19 • Configuring a Message-of-the-Day Login Banner, page 7-20 • Configuring a Login Banner, page 7-21 Default Banner Configuration The MOTD and login banners are not configured.7-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Creating a Banner Configuring a Message-of-the-Day Login Banner You can create a single or multiline message banner that appears on the screen when someone logs in to the switch. Beginning in privileged EXEC mode, follow these steps to configure a MOTD login banner: To delete the MOTD banner, use the no banner motd global configuration command. This example shows how to configure a MOTD banner for the switch by using the pound sign (#) symbol as the beginning and ending delimiter: Switch(config)# banner motd # This is a secure site. Only authorized users are allowed. For access, contact technical support. # Switch(config)# This example shows the banner displayed from the previous configuration: Unix> telnet 172.2.5.4 Trying 172.2.5.4... Connected to 172.2.5.4. Escape character is '^]'. This is a secure site. Only authorized users are allowed. For access, contact technical support. User Access Verification Password: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 banner motd c message c Specify the message of the day. For c, enter the delimiting character of your choice, for example, a pound sign (#), and press the Return key. The delimiting character signifies the beginning and end of the banner text. Characters after the ending delimiter are discarded. For message, enter a banner message up to 255 characters. You cannot use the delimiting character in the message. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Creating a Banner Configuring a Login Banner You can configure a login banner to be displayed on all connected terminals. This banner appears after the MOTD banner and before the login prompt. Beginning in privileged EXEC mode, follow these steps to configure a login banner: To delete the login banner, use the no banner login global configuration command. This example shows how to configure a login banner for the switch by using the dollar sign ($) symbol as the beginning and ending delimiter: Switch(config)# banner login $ Access for authorized users only. Please enter your username and password. $ Switch(config)# Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 banner login c message c Specify the login message. For c, enter the delimiting character of your choice, for example, a pound sign (#), and press the Return key. The delimiting character signifies the beginning and end of the banner text. Characters after the ending delimiter are discarded. For message, enter a login message up to 255 characters. You cannot use the delimiting character in the message. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table Managing the MAC Address Table The MAC address table contains address information that the switch uses to forward traffic between ports. All MAC addresses in the address table are associated with one or more ports. The address table includes these types of addresses: • Dynamic address: a source MAC address that the switch learns and then ages when it is not in use. • Static address: a manually entered unicast address that does not age and that is not lost when the switch resets. The address table lists the destination MAC address, the associated VLAN ID, and port number associated with the address and the type (static or dynamic). Note For complete syntax and usage information for the commands used in this section, refer to the command reference for this release. This section contains this configuration information: • Building the Address Table, page 7-22 • MAC Addresses and VLANs, page 7-23 • MAC Addresses and Switch Stacks, page 7-23 • Default MAC Address Table Configuration, page 7-23 • Changing the Address Aging Time, page 7-23 • Removing Dynamic Address Entries, page 7-24 • Configuring MAC Address Notification Traps, page 7-24 • Adding and Removing Static Address Entries, page 7-26 • Displaying Address Table Entries, page 7-27 Building the Address Table With multiple MAC addresses supported on all ports, you can connect any port on the switch to individual workstations, repeaters, switches, routers, or other network devices. The switch provides dynamic addressing by learning the source address of packets it receives on each port and adding the address and its associated port number to the address table. As stations are added or removed from the network, the switch updates the address table, adding new dynamic addresses and aging out those that are not in use. The aging interval is globally configured on a standalone switch or on the switch stack. However, the switch maintains an address table for each VLAN, and STP can accelerate the aging interval on a per-VLAN basis. The switch sends packets between any combination of ports, based on the destination address of the received packet. Using the MAC address table, the switch forwards the packet only to the port associated with the destination address. If the destination address is on the port that sent the packet, the packet is filtered and not forwarded. The switch always uses the store-and-forward method: complete packets are stored and checked for errors before transmission.7-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table MAC Addresses and VLANs All addresses are associated with a VLAN. An address can exist in more than one VLAN and have different destinations in each. Unicast addresses, for example, could forward to port 1 in VLAN 1 and port 9 in VLAN 5. Note Multiport static addresses are not supported. Each VLAN maintains its own logical address table. A known address in one VLAN is unknown in another until it is learned or statically associated with a port in the other VLAN. MAC Addresses and Switch Stacks The MAC address tables on all stack members are synchronized. At any given time, each stack member has the same copy of the address tables for each VLAN. When an address ages out, the address is removed from the address tables on all stack members. When a switch joins a switch stack, that switch receives the addresses for each VLAN learned on the other stack members. When a stack member leaves the switch stack, the remaining stack members age out or remove all addresses learned by the former stack member. Default MAC Address Table Configuration Table 7-3 shows the default MAC address table configuration. Changing the Address Aging Time Dynamic addresses are source MAC addresses that the switch learns and then ages when they are not in use. You can change the aging time setting for all VLANs or for a specified VLAN. Setting too short an aging time can cause addresses to be prematurely removed from the table. Then when the switch receives a packet for an unknown destination, it floods the packet to all ports in the same VLAN as the receiving port. This unnecessary flooding can impact performance. Setting too long an aging time can cause the address table to be filled with unused addresses, which prevents new addresses from being learned. Flooding results, which can impact switch performance. Table 7-3 Default MAC Address Table Configuration Feature Default Setting Aging time 300 seconds Dynamic addresses Automatically learned Static addresses None configured7-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table Beginning in privileged EXEC mode, follow these steps to configure the dynamic address table aging time: To return to the default value, use the no mac-address-table aging-time global configuration command. Removing Dynamic Address Entries To remove all dynamic entries, use the clear mac-address-table dynamic command in privileged EXEC mode. You can also remove a specific MAC address (clear mac-address-table dynamic address mac-address), remove all addresses on the specified physical port or port channel (clear mac-address-table dynamic interface interface-id), or remove all addresses on a specified VLAN (clear mac-address-table dynamic vlan vlan-id). To verify that dynamic entries have been removed, use the show mac-address-table dynamic privileged EXEC command. Configuring MAC Address Notification Traps MAC address notification enables you to track users on a network by storing the MAC address activity on the switch. Whenever the switch learns or removes a MAC address, an SNMP notification can be generated and sent to the NMS. If you have many users coming and going from the network, you can set a trap interval time to bundle the notification traps and reduce network traffic. The MAC notification history table stores the MAC address activity for each hardware port for which the trap is enabled. MAC address notifications are generated for dynamic and secure MAC addresses; events are not generated for self addresses, multicast addresses, or other static addresses. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mac-address-table aging-time [0 | 10-1000000] [vlan vlan-id] Set the length of time that a dynamic entry remains in the MAC address table after the entry is used or updated. The range is 10 to 1000000 seconds. The default is 300. You can also enter 0, which disables aging. Static address entries are never aged or removed from the table. For vlan-id, valid IDs are 1 to 4094. Do not enter leading zeros. Step 3 end Return to privileged EXEC mode. Step 4 show mac-address-table aging-time Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.7-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table Beginning in privileged EXEC mode, follow these steps to configure the switch to send MAC address notification traps to an NMS host: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server host host-addr {traps | informs} {version {1 | 2c | 3}} community-string notification-type Specify the recipient of the trap message. • For host-addr, specify the name or address of the NMS. • Specify traps (the default) to send SNMP traps to the host. Specify informs to send SNMP informs to the host. • Specify the SNMP version to support. Version 1, the default, is not available with informs. • For community-string, specify the string to send with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community command before using the snmp-server host command. • For notification-type, use the mac-notification keyword. Step 3 snmp-server enable traps mac-notification Enable the switch to send MAC address traps to the NMS. Step 4 mac-address-table notification Enable the MAC address notification feature. Step 5 mac-address-table notification [interval value] | [history-size value] Enter the trap interval time and the history table size. • (Optional) For interval value, specify the notification trap interval in seconds between each set of traps that are generated to the NMS. The range is 0 to 2147483647 seconds; the default is 1 second. • (Optional) For history-size value, specify the maximum number of entries in the MAC notification history table. The range is 0 to 500; the default is 1. Step 6 interface interface-id Enter interface configuration mode, and specify the interface on which to enable the SNMP MAC address notification trap. Step 7 snmp trap mac-notification {added | removed} Enable the MAC address notification trap. • Enable the MAC notification trap whenever a MAC address is added on this interface. • Enable the MAC notification trap whenever a MAC address is removed from this interface. Step 8 end Return to privileged EXEC mode.7-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table To disable the switch from sending MAC address notification traps, use the no snmp-server enable traps mac-notification global configuration command. To disable the MAC address notification traps on a specific interface, use the no snmp trap mac-notification {added | removed} interface configuration command. To disable the MAC address notification feature, use the no mac-address-table notification global configuration command. This example shows how to specify 172.20.10.10 as the NMS, enable the switch to send MAC address notification traps to the NMS, enable the MAC address notification feature, set the interval time to 60 seconds, set the history-size to 100 entries, and enable traps whenever a MAC address is added on Fast Ethernet interface 1/0/4. Switch(config)# snmp-server host 172.20.10.10 traps private Switch(config)# snmp-server enable traps mac-notification Switch(config)# mac-address-table notification Switch(config)# mac-address-table notification interval 60 Switch(config)# mac-address-table notification history-size 100 Switch(config)# interface gigabitethernet1/0/4 Switch(config-if)# snmp trap mac-notification added You can verify the previous commands by entering the show mac-address-table notification interface and the show mac-address-table notification privileged EXEC commands. Adding and Removing Static Address Entries A static address has these characteristics: • It is manually entered in the address table and must be manually removed. • It can be a unicast address. • It does not age and is retained when the switch restarts. You can add and remove static addresses and define the forwarding behavior for them. The forwarding behavior determines how a port that receives a packet forwards it to another port for transmission. Because all ports are associated with at least one VLAN, the switch acquires the VLAN ID for the address from the ports that you specify. A packet with a static address that arrives on a VLAN where it has not been statically entered is flooded to all ports and not learned. You add a static address to the address table by specifying the destination MAC unicast address and the VLAN from which it is received. Packets received with this destination address are forwarded to the interface specified with the interface-id option. Step 9 show mac-address-table notification interface show running-config Verify your entries. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose7-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the MAC Address Table Beginning in privileged EXEC mode, follow these steps to add a static address: To remove static entries from the address table, use the no mac-address-table static mac-addr vlan vlan-id interface interface-id global configuration command. This example shows how to add the static address c2f3.220a.12f4 to the MAC address table. When a packet is received in VLAN 4 with this MAC address as its destination address, the packet is forwarded to the specified interface: Switch(config)# mac-address-table static c2f3.220a.12f4 vlan 4 interface gigabitethernet1/0/1 Displaying Address Table Entries You can display the MAC address table by using one or more of the privileged EXEC commands described in Table 7- 4: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mac-address-table static mac-addr vlan vlan-id interface interface-id Add a static address to the MAC address table. • For mac-addr, specify the destination MAC unicast address to add to the address table. Packets with this destination address received in the specified VLAN are forwarded to the specified interface. • For vlan-id, specify the VLAN for which the packet with the specified MAC address is received. Valid VLAN IDs are 1 to 4094; do not enter leading zeros. • For interface-id..., specify the interface to which the received packet is forwarded. Valid interfaces include physical ports. Step 3 end Return to privileged EXEC mode. Step 4 show mac-address-table static Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Table 7-4 Commands for Displaying the MAC Address Table Command Description show mac-address-table address Displays MAC address table information for the specified MAC address. show mac-address-table aging-time Displays the aging time in all VLANs or the specified VLAN. show mac-address-table count Displays the number of addresses present in all VLANs or the specified VLAN. show mac-address-table dynamic Displays only dynamic MAC address table entries. show mac-address-table interface Displays the MAC address table information for the specified interface. show mac-address-table multicast Displays the Layer 2 multicast entries for all VLANs or the specified VLAN. show mac-address-table notification Displays the MAC notification parameters and history table. show mac-address-table static Displays only static MAC address table entries. show mac-address-table vlan Displays the MAC address table information for the specified VLAN.7-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 7 Administering the Switch Managing the ARP Table Managing the ARP Table To communicate with a device (over Ethernet, for example), the software first must determine the 48-bit MAC or the local data link address of that device. The process of determining the local data link address from an IP address is called address resolution. The Address Resolution Protocol (ARP) associates a host IP address with the corresponding media or MAC addresses and the VLAN ID. Taking an IP address as input, ARP determines the associated MAC address. Once a MAC address is determined, the IP-MAC address association is stored in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests and replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). By default, standard Ethernet-style ARP encapsulation (represented by the arpa keyword) is enabled on the IP interface. ARP entries added manually to the table do not age and must be manually removed. For CLI procedures, refer to the Cisco IOS Release 12.1 documentation on Cisco.com.C H A P T E R 8-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 8 Configuring SDM Templates This chapter describes how to configure the Switch Database Management (SDM) templates on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding the SDM Templates, page 8-1 • Configuring the Switch SDM Template, page 8-3 • Displaying the SDM Templates, page 8-6 Understanding the SDM Templates You can use SDM templates to configure system resources in the switch to optimize support for specific features, depending on how the switch is used in the network. You can select a template to provide maximum system usage for some functions or to use the default template to balance resources. The templates prioritize system resources to optimize support for these types of features: • Routing—The routing template maximizes system resources for unicast routing, typically required for a router or aggregator in the center of a network. • VLANs—The VLAN template disables routing and supports the maximum number of unicast MAC addresses. It would typically be selected for a Layer 2 switch. • Default—The default template gives balance to all functions. There are two versions of each template: a desktop template and an aggregator template. The Catalyst 3750-12S switch can use the larger ternary content addressable memory (TCAM) size available in the aggregator templates or can use the standard desktop templates. All other Catalyst 3750 switches support only the desktop templates. If you do not enter the desktop keyword on an aggregator switch, the aggregator templates are selected. Table 8-1 lists the approximate numbers of each resource supported in each of the three templates for a desktop or an aggregator switch. 8-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 8 Configuring SDM Templates Understanding the SDM Templates . The first eight rows in the tables (unicast MAC addresses through security ACEs) represent approximate hardware boundaries set when a template is selected. If a section of a hardware resource is full, all processing overflow is sent to the CPU, seriously impacting switch performance. The last row is a guideline used to calculate hardware resource consumption related to the number of Layer 2 VLANs on the switch. SDM Templates and Switch Stacks All stack members use the same SDM desktop or aggregator template that is stored on the stack master. When a new switch is added to a stack, as with the switch configuration and VLAN database files, the SDM configuration that is stored on the stack master overrides the template configured on an individual switch. Note For more information about stacking, refer to Chapter 5, “Managing Switch Stacks.” If the stack master is a desktop switch and a Catalyst 3750-12S running the aggregator template is added as a stack member, the stack operates with the desktop template selected on the stack master. This could result in configuration losses on the Catalyst 3750-12S if the number of TCAM entries on it exceeds desktop template sizes. If the stack master is a Catalyst 3750-12S switch using an aggregator template and a new stack member is not a Catalyst 3750-12S, the stack member is not able to support the template that is running on the stack master. The switch attempting to join the stack goes into SDM mismatch mode, the stack master does not attempt to change the SDM template, and the switch cannot be a functioning member of the stack. Table 8-1 Approximate Number of Feature Resources Allowed by Each Template Resource Desktop Templates Aggregator Templates Default Routing VLAN Default Routing VLAN Unicast MAC addresses 6 K 3 K 12 K 6 K 6 K 12 K IGMP groups and multicast routes 1 K 1 K 1 K 1 K 1 K 1 K Unicast routes 8 K 11 K 0 12 K 20 K 0 • Directly connected hosts 6 K 3 K 0 6 K 6 K 0 • Indirect routes 2 K 8 K 0 6 K 14 K 0 Policy-based routing ACEs 0 512 0 0 512 0 QoS classification ACEs 512 512 512 896 512 896 Security ACEs 1 K 1 K 1 K 1 K 1 K 1 K Layer 2 VLANs 1 K 1 K 1 K 1 K 1 K 1 K8-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 8 Configuring SDM Templates Configuring the Switch SDM Template You can use the show switch privileged EXEC command to see if any stack members are in SDM mismatch mode. This example shows the output from the show switch privileged EXEC command when an SDM mismatch exists: Switch# show switch Current Switch# Role Mac Address Priority State ------------------------------------------------------------ *2 Master 000a.fdfd.0100 5 Ready 4 Slave 0003.fd63.9c00 5 SDM Mismatch If the stack master is a Catalyst 3750-12S, changing the template can create these results: • If you change the template from an aggregator template to a desktop template and reload the switch, the entire stack operates with the selected desktop template. This could cause configuration losses if the number of TCAM entries exceeds the desktop template sizes. • If you change the template from a desktop template to an aggregator template and reload the switch, any desktop switches that were part of the stack go into the SDM mismatch mode. When this occurs, a syslog message is sent to the stack master indicating that a stack member has gone into the SDM mismatch mode and suggesting the steps to take to bring the switch out of the mismatch mode. This is an example of a syslog message notifying the stack master that a stack member is in SDM mismatch mode: 2d23h:%STACKMGR-6-SWITCH_ADDED_SDM:Switch 2 has been ADDED to the stack (SDM_MISMATCH) 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE:System (#2) is incompatible with the SDM 2d23h:%SDM-6-MISMATCH_ADVISE:template currently running on the stack and 2d23h:%SDM-6-MISMATCH_ADVISE:will not function unless the stack is 2d23h:%SDM-6-MISMATCH_ADVISE:downgraded. Issuing the following commands 2d23h:%SDM-6-MISMATCH_ADVISE:will downgrade the stack to use a smaller 2d23h:%SDM-6-MISMATCH_ADVISE:compatible desktop SDM template: 2d23h:%SDM-6-MISMATCH_ADVISE: 2d23h:%SDM-6-MISMATCH_ADVISE: "sdm prefer vlan desktop" 2d23h:%SDM-6-MISMATCH_ADVISE: "reload" Configuring the Switch SDM Template This section describes how to configure the SDM template to be used on the switch. This section contains this configuration information: • Default SDM Template, page 8-3 • SDM Template Configuration Guidelines, page 8-4 • Setting the SDM Template, page 8-4 Default SDM Template The default template for desktop switches is default desktop template; the default template for the Catalyst 3750-12S is the default aggregator template.8-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 8 Configuring SDM Templates Configuring the Switch SDM Template SDM Template Configuration Guidelines You must reload the switch for the configuration to take effect. Use the sdm prefer vlan [desktop] global configuration command only on switches intended for Layer 2 switching with no routing. When you use the VLAN template, no system resources are reserved for routing entries, and any routing is done through software. This overloads the CPU and severely degrades routing performance. Do not use the routing template if you do not have routing enabled on your switch. The sdm prefer routing [desktop] global configuration command prevents other features from using the memory allocated to unicast routing in the routing template. Setting the SDM Template Beginning in privileged EXEC mode, follow these steps to use the SDM template to maximize feature usage: After the system reboots, you can use the show sdm prefer privileged EXEC command to verify the new template configuration. If you enter the show sdm prefer command before you enter the reload privileged EXEC command, the show sdm prefer command shows the template currently in use and the template that will become active after a reload. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 sdm prefer {default | routing | vlan} [desktop] Specify the SDM template to be used on the switch: The keywords have these meanings: • default—Visible only on Catalyst 3750-12S switches to use with the desktop keyword to set the switch to the default desktop template. (Use the no sdm prefer command to set a desktop switch to the default desktop template or to set an aggregator switch to the default aggregator template.) • routing—Maximizes routing on the switch. • vlan—Maximizes VLAN configuration on the switch with no routing supported in hardware. • desktop—Supported only on Catalyst 3750-12S switches. Sets the switch to the default, routing, or VLAN desktop template. The default templates balance the use of system resources. Step 3 end Return to privileged EXEC mode. Step 4 reload Reload the operating system.8-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 8 Configuring SDM Templates Configuring the Switch SDM Template This is an example of an output display when you have changed the template and have not reloaded the switch: Switch# show sdm prefer The current template is "desktop routing" template. The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 3K number of igmp groups + multicast routes: 1K number of unicast routes: 11K number of directly connected hosts: 3K number of indirect routes: 8K number of qos aces: 512 number of security aces: 1K On next reload, template will be "aggregate routing" template. To return to the default template, use the no sdm prefer global configuration command. This example shows how to configure a switch with the routing template (the desktop routing template for a desktop switch or the aggregator routing template for a Catalyst 3750-12S). Switch(config)# sdm prefer routing Switch(config)# end Switch# reload Proceed with reload? [confirm] This example shows how to configure the desktop routing template on a Catalyst 3750-12S switch: Switch(config)# sdm prefer routing desktop Switch(config)# end Switch# reload Proceed with reload? [confirm]8-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 8 Configuring SDM Templates Displaying the SDM Templates Displaying the SDM Templates Use the show sdm prefer privileged EXEC command with no parameters to display the active template. Use the show sdm prefer [default | routing | vlan [desktop]] privileged EXEC command to display the resource numbers supported by the specified template. Note The desktop keyword is available only on Catalyst 3750-12S aggregator switches. This is an example of output from the show sdm prefer command, displaying the template in use. Switch# show sdm prefer The current template is "desktop default" template. The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 6K number of igmp groups + multicast routes: 1K number of unicast routes: 8K number of directly connected hosts: 6K number of indirect routes: 2K number of policy based routing aces: 0 number of qos aces: 512 number of security aces: 1K This is an example of output from the show sdm prefer routing command entered on an aggregator switch: Switch# show sdm prefer routing "aggregate routing" template: The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 6K number of igmp groups + multicast routes: 1K number of unicast routes: 20K number of directly connected hosts: 6K number of indirect routes: 14K number of policy based routing aces: 512 number of qos aces: 512 number of security aces: 1K This is an example of output from the show sdm prefer routing command entered on a desktop switch: Switch# show sdm prefer routing "desktop routing" template: The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. number of unicast mac addresses: 3K number of igmp groups + multicast routes: 1K number of unicast routes: 11K number of directly connected hosts: 3K number of indirect routes: 8K number of policy based routing aces: 512 number of qos aces: 512 number of security aces: 1KC H A P T E R 9-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 9 Configuring Switch-Based Authentication This chapter describes how to configure switch-based authentication on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. This chapter consists of these sections: • Preventing Unauthorized Access to Your Switch, page 9-1 • Protecting Access to Privileged EXEC Commands, page 9-2 • Controlling Switch Access with TACACS+, page 9-10 • Controlling Switch Access with RADIUS, page 9-18 • Controlling Switch Access with Kerberos, page 9-32 • Configuring the Switch for Local Authentication and Authorization, page 9-37 • Configuring the Switch for Secure Shell, page 9-38 Preventing Unauthorized Access to Your Switch You can prevent unauthorized users from reconfiguring your switch and viewing configuration information. Typically, you want network administrators to have access to your switch while you restrict access to users who dial from outside the network through an asynchronous port, connect from outside the network through a serial port, or connect through a terminal or workstation from within the local network. To prevent unauthorized access into your switch, you should configure one or more of these security features: • At a minimum, you should configure passwords and privileges at each switch port. These passwords are locally stored on the switch. When users attempt to access the switch through a port or line, they must enter the password specified for the port or line before they can access the switch. For more information, see the “Protecting Access to Privileged EXEC Commands” section on page 9-2. • For an additional layer of security, you can also configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or interfaces and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair. For more information, see the “Configuring Username and Password Pairs” section on page 9-7. • If you want to use username and password pairs, but you want to store them centrally on a server instead of locally, you can store them in a database on a security server. Multiple networking devices can then use the same database to obtain user authentication (and, if necessary, authorization) information. For more information, see the “Controlling Switch Access with TACACS+” section on page 9-10.9-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands Protecting Access to Privileged EXEC Commands A simple way of providing terminal access control in your network is to use passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels define what commands users can enter after they have logged into a network device. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1. This section describes how to control access to the configuration file and privileged EXEC commands. It contains this configuration information: • Default Password and Privilege Level Configuration, page 9-2 • Setting or Changing a Static Enable Password, page 9-3 • Protecting Enable and Enable Secret Passwords with Encryption, page 9-4 • Disabling Password Recovery, page 9-5 • Setting a Telnet Password for a Terminal Line, page 9-6 • Configuring Username and Password Pairs, page 9-7 • Configuring Multiple Privilege Levels, page 9-8 Default Password and Privilege Level Configuration Table 9-1 shows the default password and privilege level configuration. Table 9-1 Default Password and Privilege Levels Feature Default Setting Enable password and privilege level No password is defined. The default is level 15 (privileged EXEC level). The password is not encrypted in the configuration file. Enable secret password and privilege level No password is defined. The default is level 15 (privileged EXEC level). The password is encrypted before it is written to the configuration file. Line password No password is defined.9-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands Setting or Changing a Static Enable Password The enable password controls access to the privileged EXEC mode. Beginning in privileged EXEC mode, follow these steps to set or change a static enable password: To remove the password, use the no enable password global configuration command. This example shows how to change the enable password to l1u2c3k4y5. The password is not encrypted and provides access to level 15 (traditional privileged EXEC mode access): Switch(config)# enable password l1u2c3k4y5 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 enable password password Define a new password or change an existing password for access to privileged EXEC mode. By default, no password is defined. For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. It can contain the question mark (?) character if you precede the question mark with the key combination Crtl-v when you create the password; for example, to create the password abc?123, do this: Enter abc. Enter Crtl-v. Enter ?123. When the system prompts you to enter the enable password, you need not precede the question mark with the Ctrl-v; you can simply enter abc?123 at the password prompt. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. The enable password is not encrypted and can be read in the switch configuration file.9-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands Protecting Enable and Enable Secret Passwords with Encryption To provide an additional layer of security, particularly for passwords that cross the network or that are stored on a Trivial File Transfer Protocol (TFTP) server, you can use either the enable password or enable secret global configuration commands. Both commands accomplish the same thing; that is, you can establish an encrypted password that users must enter to access privileged EXEC mode (the default) or any privilege level you specify. We recommend that you use the enable secret command because it uses an improved encryption algorithm. If you configure the enable secret command, it takes precedence over the enable password command; the two commands cannot be in effect simultaneously. Beginning in privileged EXEC mode, follow these steps to configure encryption for enable and enable secret passwords: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 enable password [level level] {password | encryption-type encrypted-password} or enable secret [level level] {password | encryption-type encrypted-password} Define a new password or change an existing password for access to privileged EXEC mode. or Define a secret password, which is saved using a nonreversible encryption method. • (Optional) For level, the range is from 0 to 15. Level 1 is normal user EXEC mode privileges. The default level is 15 (privileged EXEC mode privileges). • For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. • (Optional) For encryption-type, only type 5, a Cisco proprietary encryption algorithm, is available. If you specify an encryption type, you must provide an encrypted password—an encrypted password that you copy from another switch configuration. Note If you specify an encryption type and then enter a clear text password, you can not re-enter privileged EXEC mode. You cannot recover a lost encrypted password by any method. Step 3 service password-encryption (Optional) Encrypt the password when the password is defined or when the configuration is written. Encryption prevents the password from being readable in the configuration file. Step 4 end Return to privileged EXEC mode. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.9-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands If both the enable and enable secret passwords are defined, users must enter the enable secret password. Use the level keyword to define a password for a specific privilege level. After you specify the level and set a password, give the password only to users who need to have access at this level. Use the privilege level global configuration command to specify commands accessible at various levels. For more information, see the “Configuring Multiple Privilege Levels” section on page 9-8. If you enable password encryption, it applies to all passwords including username passwords, authentication key passwords, the privileged command password, and console and virtual terminal line passwords. To remove a password and level, use the no enable password [level level] or no enable secret [level level] global configuration command. To disable password encryption, use the no service password-encryption global configuration command. This example shows how to configure the encrypted password $1$FaD0$Xyti5Rkls3LoyxzS8 for privilege level 2: Switch(config)# enable secret level 2 5 $1$FaD0$Xyti5Rkls3LoyxzS8 Disabling Password Recovery The default configuration for the switches allows an end user with physical access to the switch to recover from a lost password by interrupting the boot process while the switch is powering up and then by entering a new password. The password recovery disable feature allows the system administrator to protect access to the switch password by disabling part of this functionality and allowing the user to interrupt the boot process only by agreeing to set the system back to the default configuration. With password recovery disabled, you can still interrupt the boot process and change the password, but the configuration file (config.text) and the VLAN database file (vlan.dat) are deleted. Note If you disable password recovery, we recommend that you keep a backup copy of the configuration file on a secure server in case the end user interrupts the boot process and sets the system back to defaults. Do not keep a backup copy of the configuration file on the switch. If the switch is operating in VTP transparent mode, we recommend that you also keep a backup copy of the VLAN database file on a secure server. When the switch is returned to the default system configuration, you can download the saved files to the switch by using the XMODEM protocol. For more information, see the “Recovering from a Lost or Forgotten Password” section on page 34-4. Beginning in privileged EXEC mode, follow these steps to disable password recovery: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no service password-recovery Disable password recovery. This setting is saved in an area of the Flash memory that is accessible by the boot loader and the Cisco IOS image, but it is not part of the file system and is not accessible by any user. Step 3 end Return to privileged EXEC mode. Step 4 show version Verify the configuration by checking the last few lines of the display.9-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands To re-enable password recovery, use the service password-recovery global configuration command. Note Disabling password recovery will not work if you have set the switch to boot manually by using the boot manual global configuration command because this command allows the user to automatically see the boot loader prompt (switch:) after power cycling the switch. Setting a Telnet Password for a Terminal Line When you power-up your switch for the first time, an automatic setup program runs to assign IP information and to create a default configuration for continued use. The setup program also prompts you to configure your switch for Telnet access through a password. If you did not configure this password during the setup program, you can configure it now through the command-line interface (CLI). Beginning in privileged EXEC mode, follow these steps to configure your switch for Telnet access: To remove the password, use the no password global configuration command. This example shows how to set the Telnet password to let45me67in89: Switch(config)# line vty 10 Switch(config-line)# password let45me67in89 Command Purpose Step 1 Attach a PC or workstation with emulation software to the switch console port. The default data characteristics of the console port are 9600, 8, 1, no parity. You might need to press the Return key several times to see the command-line prompt. Step 2 enable password password Enter privileged EXEC mode. Step 3 configure terminal Enter global configuration mode. Step 4 line vty 0 15 Configure the number of Telnet sessions (lines), and enter line configuration mode. There are 16 possible sessions on a command-capable switch. The 0 and 15 mean that you are configuring all 16 possible Telnet sessions. Step 5 password password Enter a Telnet password for the line or lines. For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. The password is listed under the command line vty 0 15. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.9-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands Configuring Username and Password Pairs You can configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or interfaces and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair. Beginning in privileged EXEC mode, follow these steps to establish a username-based authentication system that requests a login username and a password: To disable username authentication for a specific user, use the no username name global configuration command. To disable password checking and allow connections without a password, use the no login line configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 username name [privilege level] {password encryption-type password} Enter the username, privilege level, and password for each user. • For name, specify the user ID as one word. Spaces and quotation marks are not allowed. • (Optional) For level, specify the privilege level the user has after gaining access. The range is 0 to 15. Level 15 gives privileged EXEC mode access. Level 1 gives user EXEC mode access. • For encryption-type, enter 0 to specify that an unencrypted password will follow. Enter 7 to specify that a hidden password will follow. • For password, specify the password the user must enter to gain access to the switch. The password must be from 1 to 25 characters, can contain embedded spaces, and must be the last option specified in the username command. Step 3 line console 0 or line vty 0 15 Enter line configuration mode, and configure the console port (line 0) or the VTY lines (line 0 to 15). Step 4 login local Enable local password checking at login time. Authentication is based on the username specified in Step 2. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.9-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands Configuring Multiple Privilege Levels By default, the Cisco IOS software has two modes of password security: user EXEC and privileged EXEC. You can configure up to 16 hierarchical levels of commands for each mode. By configuring multiple passwords, you can allow different sets of users to have access to specified commands. For example, if you want many users to have access to the clear line command, you can assign it level 2 security and distribute the level 2 password fairly widely. But if you want more restricted access to the configure command, you can assign it level 3 security and distribute that password to a more restricted group of users. This section includes this configuration information: • Setting the Privilege Level for a Command, page 9-8 • Changing the Default Privilege Level for Lines, page 9-9 • Logging into and Exiting a Privilege Level, page 9-10 Setting the Privilege Level for a Command Beginning in privileged EXEC mode, follow these steps to set the privilege level for a command mode: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 privilege mode level level command Set the privilege level for a command. • For mode, enter configure for global configuration mode, exec for EXEC mode, interface for interface configuration mode, or line for line configuration mode. • For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. Level 15 is the level of access permitted by the enable password. • For command, specify the command to which you want to restrict access. Step 3 enable password level level password Specify the enable password for the privilege level. • For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. • For password, specify a string from 1 to 25 alphanumeric characters. The string cannot start with a number, is case sensitive, and allows spaces but ignores leading spaces. By default, no password is defined. Step 4 end Return to privileged EXEC mode. Step 5 show running-config or show privilege Verify your entries. The first command displays the password and access level configuration. The second command displays the privilege level configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Protecting Access to Privileged EXEC Commands When you set a command to a privilege level, all commands whose syntax is a subset of that command are also set to that level. For example, if you set the show ip traffic command to level 15, the show commands and show ip commands are automatically set to privilege level 15 unless you set them individually to different levels. To return to the default privilege for a given command, use the no privilege mode level level command global configuration command. This example shows how to set the configure command to privilege level 14 and define SecretPswd14 as the password users must enter to use level 14 commands: Switch(config)# privilege exec level 14 configure Switch(config)# enable password level 14 SecretPswd14 Changing the Default Privilege Level for Lines Beginning in privileged EXEC mode, follow these steps to change the default privilege level for a line: Users can override the privilege level you set using the privilege level line configuration command by logging in to the line and enabling a different privilege level. They can lower the privilege level by using the disable command. If users know the password to a higher privilege level, they can use that password to enable the higher privilege level. You might specify a high level or privilege level for your console line to restrict line usage. To return to the default line privilege level, use the no privilege level line configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 line vty line Select the virtual terminal line on which to restrict access. Step 3 privilege level level Change the default privilege level for the line. For level, the range is from 0 to 15. Level 1 is for normal user EXEC mode privileges. Level 15 is the level of access permitted by the enable password. Step 4 end Return to privileged EXEC mode. Step 5 show running-config or show privilege Verify your entries. The first command displays the password and access level configuration. The second command displays the privilege level configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ Logging into and Exiting a Privilege Level Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit to a specified privilege level: Controlling Switch Access with TACACS+ This section describes how to enable and configure Terminal Access Controller Access Control System Plus (TACACS+), which provides detailed accounting information and flexible administrative control over authentication and authorization processes. TACACS+ is facilitated through authentication, authorization, accounting (AAA) and can be enabled only through AAA commands. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1. This section contains this configuration information: • Understanding TACACS+, page 9-10 • TACACS+ Operation, page 9-12 • Configuring TACACS+, page 9-13 • Displaying the TACACS+ Configuration, page 9-17 Understanding TACACS+ TACACS+ is a security application that provides centralized validation of users attempting to gain access to your switch. TACACS+ services are maintained in a database on a TACACS+ daemon typically running on a UNIX or Windows NT workstation. You should have access to and should configure a TACACS+ server before the configuring TACACS+ features on your switch. Note We recommend a redundant connection between a switch stack and the TACACS+ server. This is to help ensure that the TACACS+ server remains accessible in case one of the connected stack members is removed from the switch stack. TACACS+ provides for separate and modular authentication, authorization, and accounting facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each service—authentication, authorization, and accounting—independently. Each service can be tied into its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon. Command Purpose Step 1 enable level Log in to a specified privilege level. For level, the range is 0 to 15. Step 2 disable level Exit to a specified privilege level. For level, the range is 0 to 15.9-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ The goal of TACACS+ is to provide a method for managing multiple network access points from a single management service. Your switch can be a network access server along with other Cisco routers and access servers. A network access server provides connections to a single user, to a network or subnetwork, and to interconnected networks as shown in Figure 9-1. Figure 9-1 Typical TACACS+ Network Configuration TACACS+, administered through the AAA security services, can provide these services: • Authentication—Provides complete control of authentication through login and password dialog, challenge and response, and messaging support. The authentication facility can conduct a dialog with the user (for example, after a username and password are provided, to challenge a user with several questions, such as home address, mother’s maiden name, service type, and social security number). The TACACS+ authentication service can also send messages to user screens. For example, a message could notify users that their passwords must be changed because of the company’s password aging policy. • Authorization—Provides fine-grained control over user capabilities for the duration of the user’s session, including but not limited to setting autocommands, access control, session duration, or protocol support. You can also enforce restrictions on what commands a user can execute with the TACACS+ authorization feature. • Accounting—Collects and sends information used for billing, auditing, and reporting to the TACACS+ daemon. Network managers can use the accounting facility to track user activity for a security audit or to provide information for user billing. Accounting records include user identities, start and stop times, executed commands (such as PPP), number of packets, and number of bytes. UNIX workstation (TACACS+ server 2) UNIX workstation (TACACS+ server 1) Catalyst 3750 switches Configure the switches with the TACACS+ server addresses. Set an authentication key (also configure the same key on the TACACS+ servers). Enable AAA. Create a login authentication method list. Apply the list to the terminal lines. Create an authorization and accounting method list as required. Catalyst 6500 series switch Workstations 171.20.10.8 171.20.10.7 86890 Workstations9-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ The TACACS+ protocol provides authentication between the switch and the TACACS+ daemon, and it ensures confidentiality because all protocol exchanges between the switch and the TACACS+ daemon are encrypted. You need a system running the TACACS+ daemon software to use TACACS+ on your switch. TACACS+ Operation When a user attempts a simple ASCII login by authenticating to a switch using TACACS+, this process occurs: 1. When the connection is established, the switch contacts the TACACS+ daemon to obtain a username prompt, which is then displayed to the user. The user enters a username, and the switch then contacts the TACACS+ daemon to obtain a password prompt. The switch displays the password prompt to the user, the user enters a password, and the password is then sent to the TACACS+ daemon. TACACS+ allows a conversation to be held between the daemon and the user until the daemon receives enough information to authenticate the user. The daemon prompts for a username and password combination, but can include other items, such as the user’s mother’s maiden name. 2. The switch eventually receives one of these responses from the TACACS+ daemon: • ACCEPT—The user is authenticated and service can begin. If the switch is configured to require authorization, authorization begins at this time. • REJECT—The user is not authenticated. The user can be denied access or is prompted to retry the login sequence, depending on the TACACS+ daemon. • ERROR—An error occurred at some time during authentication with the daemon or in the network connection between the daemon and the switch. If an ERROR response is received, the switch typically tries to use an alternative method for authenticating the user. • CONTINUE—The user is prompted for additional authentication information. After authentication, the user undergoes an additional authorization phase if authorization has been enabled on the switch. Users must first successfully complete TACACS+ authentication before proceeding to TACACS+ authorization. 3. If TACACS+ authorization is required, the TACACS+ daemon is again contacted, and it returns an ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response contains data in the form of attributes that direct the EXEC or NETWORK session for that user, determining the services that the user can access: – Telnet, Secure Shell (SSH), rlogin, or privileged EXEC services – Connection parameters, including the host or client IP address, access list, and user timeouts9-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ Configuring TACACS+ This section describes how to configure your switch to support TACACS+. At a minimum, you must identify the host or hosts maintaining the TACACS+ daemon and define the method lists for TACACS+ authentication. You can optionally define method lists for TACACS+ authorization and accounting. A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted. This section contains this configuration information: • Default TACACS+ Configuration, page 9-13 • Identifying the TACACS+ Server Host and Setting the Authentication Key, page 9-13 • Configuring TACACS+ Login Authentication, page 9-14 • Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services, page 9-16 • Starting TACACS+ Accounting, page 9-17 Default TACACS+ Configuration TACACS+ and AAA are disabled by default. To prevent a lapse in security, you cannot configure TACACS+ through a network management application. When enabled, TACACS+ can authenticate users accessing the switch through the CLI. Note Although TACACS+ configuration is performed through the CLI, the TACACS+ server authenticates HTTP connections that have been configured with a privilege level of 15. Identifying the TACACS+ Server Host and Setting the Authentication Key You can configure the switch to use a single server or AAA server groups to group existing server hosts for authentication. You can group servers to select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list and contains the list of IP addresses of the selected server hosts. Beginning in privileged EXEC mode, follow these steps to identify the IP host or host maintaining TACACS+ server and optionally set the encryption key:9-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ To remove the specified TACACS+ server name or address, use the no tacacs-server host hostname global configuration command. To remove a server group from the configuration list, use the no aaa group server tacacs+ group-name global configuration command. To remove the IP address of a TACACS+ server, use the no server ip-address server group subconfiguration command. Configuring TACACS+ Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A defined method list overrides the default method list. A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 tacacs-server host hostname [port integer] [timeout integer] [key string] Identify the IP host or hosts maintaining a TACACS+ server. Enter this command multiple times to create a list of preferred hosts. The software searches for hosts in the order in which you specify them. • For hostname, specify the name or IP address of the host. • (Optional) For port integer, specify a server port number. The default is port 49. The range is 1 to 65535. • (Optional) For timeout integer, specify a time in seconds the switch waits for a response from the daemon before it times out and declares an error. The default is 5 seconds. The range is 1 to 1000 seconds. • (Optional) For key string, specify the encryption key for encrypting and decrypting all traffic between the switch and the TACACS+ daemon. You must configure the same key on the TACACS+ daemon for encryption to be successful. Step 3 aaa new-model Enable AAA. Step 4 aaa group server tacacs+ group-name (Optional) Define the AAA server-group with a group name. This command puts the switch in a server group subconfiguration mode. Step 5 server ip-address (Optional) Associate a particular TACACS+ server with the defined server group. Repeat this step for each TACACS+ server in the AAA server group. Each server in the group must be previously defined in Step 2. Step 6 end Return to privileged EXEC mode. Step 7 show tacacs Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.9-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle—meaning that the security server or local username database responds by denying the user access—the authentication process stops, and no other authentication methods are attempted. Beginning in privileged EXEC mode, follow these steps to configure login authentication: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa new-model Enable AAA. Step 3 aaa authentication login {default | list-name} method1 [method2...] Create a login authentication method list. • To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. • For list-name, specify a character string to name the list you are creating. • For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods: • enable—Use the enable password for authentication. Before you can use this authentication method, you must define an enable password by using the enable password global configuration command. • group tacacs+—Uses TACACS+ authentication. Before you can use this authentication method, you must configure the TACACS+ server. For more information, see the “Identifying the TACACS+ Server Host and Setting the Authentication Key” section on page 9-13. • line—Use the line password for authentication. Before you can use this authentication method, you must define a line password. Use the password password line configuration command. • local—Use the local username database for authentication. You must enter username information in the database. Use the username password global configuration command. • local-case—Use a case-sensitive local username database for authentication. You must enter username information in the database by using the username name password global configuration command. • none—Do not use any authentication for login. Step 4 line [console | tty | vty] line-number [ending-line-number] Enter line configuration mode, and configure the lines to which you want to apply the authentication list. Step 5 login authentication {default | list-name} Apply the authentication list to a line or set of lines. • If you specify default, use the default list created with the aaa authentication login command. • For list-name, specify the list created with the aaa authentication login command.9-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable TACACS+ authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch uses information retrieved from the user’s profile, which is located either in the local user database or on the security server, to configure the user’s session. The user is granted access to a requested service only if the information in the user profile allows it. You can use the aaa authorization global configuration command with the tacacs+ keyword to set parameters that restrict a user’s network access to privileged EXEC mode. The aaa authorization exec tacacs+ local command sets these authorization parameters: • Use TACACS+ for privileged EXEC access authorization if authentication was performed by using TACACS+. • Use the local database if authentication was not performed by using TACACS+. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. Beginning in privileged EXEC mode, follow these steps to specify TACACS+ authorization for privileged EXEC access and network services: To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa authorization network tacacs+ Configure the switch for user TACACS+ authorization for all network-related service requests. Step 3 aaa authorization exec tacacs+ Configure the switch for user TACACS+ authorization to determine if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with TACACS+ Starting TACACS+ Accounting The AAA accounting feature tracks the services that users are accessing and the amount of network resources that they are consuming. When AAA accounting is enabled, the switch reports user activity to the TACACS+ security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing, or auditing. Beginning in privileged EXEC mode, follow these steps to enable TACACS+ accounting for each Cisco IOS privilege level and for network services: To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global configuration command. Displaying the TACACS+ Configuration To display TACACS+ server statistics, use the show tacacs privileged EXEC command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa accounting network start-stop tacacs+ Enable TACACS+ accounting for all network-related service requests. Step 3 aaa accounting exec start-stop tacacs+ Enable TACACS+ accounting to send a start-record accounting notice at the beginning of a privileged EXEC process and a stop-record at the end. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Controlling Switch Access with RADIUS This section describes how to enable and configure the Remote Authentication Dial-In User Service (RADIUS), which provides detailed accounting information and flexible administrative control over authentication and authorization processes. RADIUS is facilitated through AAA and can be enabled only through AAA commands. Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1. This section contains this configuration information: • Understanding RADIUS, page 9-18 • RADIUS Operation, page 9-19 • Configuring RADIUS, page 9-20 • Displaying the RADIUS Configuration, page 9-31 Understanding RADIUS RADIUS is a distributed client/server system that secures networks against unauthorized access. RADIUS clients run on supported Cisco routers and switches. Clients send authentication requests to a central RADIUS server, which contains all user authentication and network service access information. The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access Control Server version 3.0), Livingston, Merit, Microsoft, or another software provider. For more information, refer to the RADIUS server documentation. Note We recommend a redundant connection between a switch stack and the RADIUS server. This is to help ensure that the RADIUS server remains accessible in case one of the connected stack members is removed from the switch stack. Use RADIUS in these network environments that require access security: • Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database. In an IP-based network with multiple vendors’ access servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos security system. • Turnkey network security environments in which applications support the RADIUS protocol, such as in an access environment that uses a smart card access control system. In one case, RADIUS has been used with Enigma’s security cards to validates users and to grant access to network resources. • Networks already using RADIUS. You can add a Cisco switch containing a RADIUS client to the network. This might be the first step when you make a transition to a TACACS+ server. See Figure 9-2 on page 9-19. • Network in which the user must only access a single service. Using RADIUS, you can control user access to a single host, to a single utility such as Telnet, or to the network through a protocol such as IEEE 802.1X. For more information about this protocol, see Chapter 10, “Configuring 802.1X Port-Based Authentication.”9-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS • Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session. An Internet service provider might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs. RADIUS is not suitable in these network security situations: • Multiprotocol access environments. RADIUS does not support AppleTalk Remote Access (ARA), NetBIOS Frame Control Protocol (NBFCP), NetWare Asynchronous Services Interface (NASI), or X.25 PAD connections. • Switch-to-switch or router-to-router situations. RADIUS does not provide two-way authentication. RADIUS can be used to authenticate from one device to a non-Cisco device if the non-Cisco device requires authentication. • Networks using a variety of services. RADIUS generally binds a user to one service model. Figure 9-2 Transitioning from RADIUS to TACACS+ Services RADIUS Operation When a user attempts to log in and authenticate to a switch that is access controlled by a RADIUS server, these events occur: 1. The user is prompted to enter a username and password. 2. The username and encrypted password are sent over the network to the RADIUS server. 3. The user receives one of these responses from the RADIUS server: a. ACCEPT—The user is authenticated. b. REJECT—The user is either not authenticated and is prompted to re-enter the username and password, or access is denied. c. CHALLENGE—A challenge requires additional data from the user. d. CHALLENGE PASSWORD—A response requests the user to select a new password. 86891 RADIUS server RADIUS server TACACS+ server TACACS+ server R1 R2 T1 Remote T2 PC Workstation9-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS The ACCEPT or REJECT response is bundled with additional data that is used for privileged EXEC or network authorization. Users must first successfully complete RADIUS authentication before proceeding to RADIUS authorization, if it is enabled. The additional data included with the ACCEPT or REJECT packets includes these items: • Telnet, SSH, rlogin, or privileged EXEC services • Connection parameters, including the host or client IP address, access list, and user timeouts Configuring RADIUS This section describes how to configure your switch to support RADIUS. At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting. A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more security protocols to be used (such as TACACS+ or local username lookup), thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted. You should have access to and should configure a RADIUS server before configuring RADIUS features on your switch. This section contains this configuration information: • Default RADIUS Configuration, page 9-20 • Identifying the RADIUS Server Host, page 9-21 (required) • Configuring RADIUS Login Authentication, page 9-23 (required) • Defining AAA Server Groups, page 9-25 (optional) • Configuring RADIUS Authorization for User Privileged Access and Network Services, page 9-27 (optional) • Starting RADIUS Accounting, page 9-28 (optional) • Configuring Settings for All RADIUS Servers, page 9-29 (optional) • Configuring the Switch to Use Vendor-Specific RADIUS Attributes, page 9-29 (optional) • Configuring the Switch for Vendor-Proprietary RADIUS Server Communication, page 9-31 (optional) Default RADIUS Configuration RADIUS and AAA are disabled by default. To prevent a lapse in security, you cannot configure RADIUS through a network management application. When enabled, RADIUS can authenticate users accessing the switch through the CLI.9-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Identifying the RADIUS Server Host Switch-to-RADIUS-server communication involves several components: • Host name or IP address • Authentication destination port • Accounting destination port • Key string • Timeout period • Retransmission value You identify RADIUS security servers by their host name or IP address, host name and specific UDP port numbers, or their IP address and specific UDP port numbers. The combination of the IP address and the UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This unique identifier enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, accounting—the second host entry configured acts as a fail-over backup to the first one. Using this example, if the first host entry fails to provide accounting services, the switch tries the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the order that they are configured.) A RADIUS server and the switch use a shared secret text string to encrypt passwords and exchange responses. To configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text (key) string that it shares with the switch. The timeout, retransmission, and encryption key values can be configured globally for all RADIUS servers, on a per-server basis, or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers communicating with the switch, use the three unique global configuration commands: radius-server timeout, radius-server retransmit, and radius-server key. To apply these values on a specific RADIUS server, use the radius-server host global configuration command. Note If you configure both global and per-server functions (timeout, retransmission, and key commands) on the switch, the per-server timer, retransmission, and key value commands override global timer, retransmission, and key value commands. For information on configuring these setting on all RADIUS servers, see the “Configuring Settings for All RADIUS Servers” section on page 9-29. You can configure the switch to use AAA server groups to group existing server hosts for authentication. For more information, see the “Defining AAA Server Groups” section on page 9-25.9-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in privileged EXEC mode, follow these steps to configure per-server RADIUS server communication. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string] Specify the IP address or host name of the remote RADIUS server host. • (Optional) For auth-port port-number, specify the UDP destination port for authentication requests. • (Optional) For acct-port port-number, specify the UDP destination port for accounting requests. • (Optional) For timeout seconds, specify the time interval that the switch waits for the RADIUS server to reply before resending. The range is 1 to 1000. This setting overrides the radius-server timeout global configuration command setting. If no timeout is set with the radius-server host command, the setting of the radius-server timeout command is used. • (Optional) For retransmit retries, specify the number of times a RADIUS request is resent to a server if that server is not responding or responding slowly. The range is 1 to 1000. If no retransmit value is set with the radius-server host command, the setting of the radius-server retransmit global configuration command is used. • (Optional) For key string, specify the authentication and encryption key used between the switch and the RADIUS daemon running on the RADIUS server. Note The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. To configure the switch to recognize more than one host entry associated with a single IP address, enter this command as many times as necessary, making sure that each UDP port number is different. The switch software searches for hosts in the order in which you specify them. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.9-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command. This example shows how to configure one RADIUS server to be used for authentication and another to be used for accounting: Switch(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1 Switch(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2 This example shows how to configure host1 as the RADIUS server and to use the default ports for both authentication and accounting: Switch(config)# radius-server host host1 Note You also need to configure some settings on the RADIUS server. These settings include the IP address of the switch and the key string to be shared by both the server and the switch. For more information, refer to the RADIUS server documentation. Configuring RADIUS Login Authentication To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined. A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle—meaning that the security server or local username database responds by denying the user access—the authentication process stops, and no other authentication methods are attempted.9-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in privileged EXEC mode, follow these steps to configure login authentication. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa new-model Enable AAA. Step 3 aaa authentication login {default | list-name} method1 [method2...] Create a login authentication method list. • To create a default list that is used when a named list is not specified in the login authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. • For list-name, specify a character string to name the list you are creating. • For method1..., specify the actual method the authentication algorithm tries. The additional methods of authentication are used only if the previous method returns an error, not if it fails. Select one of these methods: – enable—Use the enable password for authentication. Before you can use this authentication method, you must define an enable password by using the enable password global configuration command. – group radius—Use RADIUS authentication. Before you can use this authentication method, you must configure the RADIUS server. For more information, see the “Identifying the RADIUS Server Host” section on page 9-21. – line—Use the line password for authentication. Before you can use this authentication method, you must define a line password. Use the password password line configuration command. – local—Use the local username database for authentication. You must enter username information in the database. Use the username name password global configuration command. – local-case—Use a case-sensitive local username database for authentication. You must enter username information in the database by using the username password global configuration command. – none—Do not use any authentication for login. Step 4 line [console | tty | vty] line-number [ending-line-number] Enter line configuration mode, and configure the lines to which you want to apply the authentication list.9-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable RADIUS authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command. Defining AAA Server Groups You can configure the switch to use AAA server groups to group existing server hosts for authentication. You select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list, which lists the IP addresses of the selected server hosts. Server groups also can include multiple host entries for the same server if each entry has a unique identifier (the combination of the IP address and UDP port number), allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. If you configure two different host entries on the same RADIUS server for the same service, (for example, accounting), the second configured host entry acts as a fail-over backup to the first one. You use the server group server configuration command to associate a particular server with a defined group server. You can either identify the server by its IP address or identify multiple host instances or entries by using the optional auth-port and acct-port keywords. Step 5 login authentication {default | list-name} Apply the authentication list to a line or set of lines. • If you specify default, use the default list created with the aaa authentication login command. • For list-name, specify the list created with the aaa authentication login command. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose9-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in privileged EXEC mode, follow these steps to define the AAA server group and associate a particular RADIUS server with it: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number] [timeout seconds] [retransmit retries] [key string] Specify the IP address or host name of the remote RADIUS server host. • (Optional) For auth-port port-number, specify the UDP destination port for authentication requests. • (Optional) For acct-port port-number, specify the UDP destination port for accounting requests. • (Optional) For timeout seconds, specify the time interval that the switch waits for the RADIUS server to reply before resending. The range is 1 to 1000. This setting overrides the radius-server timeout global configuration command setting. If no timeout is set with the radius-server host command, the setting of the radius-server timeout command is used. • (Optional) For retransmit retries, specify the number of times a RADIUS request is resent to a server if that server is not responding or responding slowly. The range is 1 to 1000. If no retransmit value is set with the radius-server host command, the setting of the radius-server retransmit global configuration command is used. • (Optional) For key string, specify the authentication and encryption key used between the switch and the RADIUS daemon running on the RADIUS server. Note The key is a text string that must match the encryption key used on the RADIUS server. Always configure the key as the last item in the radius-server host command. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. To configure the switch to recognize more than one host entry associated with a single IP address, enter this command as many times as necessary, making sure that each UDP port number is different. The switch software searches for hosts in the order in which you specify them. Set the timeout, retransmit, and encryption key values to use with the specific RADIUS host. Step 3 aaa new-model Enable AAA. Step 4 aaa group server radius group-name Define the AAA server-group with a group name. This command puts the switch in a server group configuration mode. Step 5 server ip-address Associate a particular RADIUS server with the defined server group. Repeat this step for each RADIUS server in the AAA server group. Each server in the group must be previously defined in Step 2. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries.9-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS To remove the specified RADIUS server, use the no radius-server host hostname | ip-address global configuration command. To remove a server group from the configuration list, use the no aaa group server radius group-name global configuration command. To remove the IP address of a RADIUS server, use the no server ip-address server group configuration command. In this example, the switch is configured to recognize two different RADIUS group servers (group1 and group2). Group1 has two different host entries on the same RADIUS server configured for the same services. The second host entry acts as a fail-over backup to the first entry. Switch(config)# radius-server host 172.20.0.1 auth-port 1000 acct-port 1001 Switch(config)# radius-server host 172.10.0.1 auth-port 1645 acct-port 1646 Switch(config)# aaa new-model Switch(config)# aaa group server radius group1 Switch(config-sg-radius)# server 172.20.0.1 auth-port 1000 acct-port 1001 Switch(config-sg-radius)# exit Switch(config)# aaa group server radius group2 Switch(config-sg-radius)# server 172.20.0.1 auth-port 2000 acct-port 2001 Switch(config-sg-radius)# exit Configuring RADIUS Authorization for User Privileged Access and Network Services AAA authorization limits the services available to a user. When AAA authorization is enabled, the switch uses information retrieved from the user’s profile, which is in the local user database or on the security server, to configure the user’s session. The user is granted access to a requested service only if the information in the user profile allows it. You can use the aaa authorization global configuration command with the radius keyword to set parameters that restrict a user’s network access to privileged EXEC mode. The aaa authorization exec radius local command sets these authorization parameters: • Use RADIUS for privileged EXEC access authorization if authentication was performed by using RADIUS. • Use the local database if authentication was not performed by using RADIUS. Note Authorization is bypassed for authenticated users who log in through the CLI even if authorization has been configured. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Step 9 Enable RADIUS login authentication. See the “Configuring RADIUS Login Authentication” section on page 9-23. Command Purpose9-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in privileged EXEC mode, follow these steps to specify RADIUS authorization for privileged EXEC access and network services: To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Starting RADIUS Accounting The AAA accounting feature tracks the services that users are accessing and the amount of network resources that they are consuming. When AAA accounting is enabled, the switch reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. This data can then be analyzed for network management, client billing, or auditing. Beginning in privileged EXEC mode, follow these steps to enable RADIUS accounting for each Cisco IOS privilege level and for network services: To disable accounting, use the no aaa accounting {network | exec} {start-stop} method1... global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa authorization network radius Configure the switch for user RADIUS authorization for all network-related service requests. Step 3 aaa authorization exec radius Configure the switch for user RADIUS authorization to determine if the user has privileged EXEC access. The exec keyword might return user profile information (such as autocommand information). Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa accounting network start-stop radius Enable RADIUS accounting for all network-related service requests. Step 3 aaa accounting exec start-stop radius Enable RADIUS accounting to send a start-record accounting notice at the beginning of a privileged EXEC process and a stop-record at the end. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Configuring Settings for All RADIUS Servers Beginning in privileged EXEC mode, follow these steps to configure global communication settings between the switch and all RADIUS servers: To return to the default setting for the retransmit, timeout, and deadtime, use the no forms of these commands. Configuring the Switch to Use Vendor-Specific RADIUS Attributes The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the switch and the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification. Cisco’s vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair. The value is a string with this format: protocol : attribute sep value * Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate attribute-value (AV) pair defined in the Cisco TACACS+ specification, and sep is = for mandatory attributes and is * for optional attributes. The full set of features available for TACACS+ authorization can then be used for RADIUS. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server key string Specify the shared secret text string used between the switch and all RADIUS servers. Note The key is a text string that must match the encryption key used on the RADIUS server. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. Step 3 radius-server retransmit retries Specify the number of times the switch sends each RADIUS request to the server before giving up. The default is 3; the range 1 to 1000. Step 4 radius-server timeout seconds Specify the number of seconds a switch waits for a reply to a RADIUS request before resending the request. The default is 5 seconds; the range is 1 to 1000. Step 5 radius-server deadtime minutes Specify the number of minutes a RADIUS server, which is not responding to authentication requests, to be skipped, thus avoiding the wait for the request to timeout before trying the next configured server. The default is 0; the range is 1 to 1440 minutes. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your settings. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.9-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS For example, this AV pair activates Cisco’s multiple named ip address pools feature during IP authorization (during PPP IPCP address assignment): cisco-avpair= ”ip:addr-pool=first“ This example shows how to provide a user logging in from a switch with immediate access to privileged EXEC commands: cisco-avpair= ”shell:priv-lvl=15“ This example shows how to specify an authorized VLAN in the RADIUS server database: cisco-avpair= ”tunnel-type(#64)=VLAN(13)” cisco-avpair= ”tunnel-medium-type(#65)=802 media(6)” cisco-avpair= ”tunnel-private-group-ID(#81)=vlanid” This example shows how to apply an input ACL in ASCII format to an interface for the duration of this connection: cisco-avpair= “ip:inacl#1=deny ip 10.10.10.10 0.0.255.255 20.20.20.20 255.255.0.0” cisco-avpair= “ip:inacl#2=deny ip 10.10.10.10 0.0.255.255 any” cisco-avpair= “mac:inacl#3=deny any any decnet-iv” This example shows how to apply an output ACL in ASCII format to an interface for the duration of this connection: cisco-avpair= “ip:outacl#2=deny ip 10.10.10.10 0.0.255.255 any” Other vendors have their own unique vendor-IDs, options, and associated VSAs. For more information about vendor-IDs and VSAs, refer to RFC 2138, “Remote Authentication Dial-In User Service (RADIUS).” Beginning in privileged EXEC mode, follow these steps to configure the switch to recognize and use VSAs: For a complete list of RADIUS attributes or more information about vendor-specific attribute 26, refer to the “RADIUS Attributes” appendix in the Cisco IOS Security Configuration Guide for Release 12.1. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server vsa send [accounting | authentication] Enable the switch to recognize and use VSAs as defined by RADIUS IETF attribute 26. • (Optional) Use the accounting keyword to limit the set of recognized vendor-specific attributes to only accounting attributes. • (Optional) Use the authentication keyword to limit the set of recognized vendor-specific attributes to only authentication attributes. If you enter this command without keywords, both accounting and authentication vendor-specific attributes are used. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your settings. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.9-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with RADIUS Configuring the Switch for Vendor-Proprietary RADIUS Server Communication Although an IETF draft standard for RADIUS specifies a method for communicating vendor-proprietary information between the switch and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way. Cisco IOS software supports a subset of vendor-proprietary RADIUS attributes. As mentioned earlier, to configure RADIUS (whether vendor-proprietary or IETF draft-compliant), you must specify the host running the RADIUS server daemon and the secret text string it shares with the switch. You specify the RADIUS host and secret text string by using the radius-server global configuration commands. Beginning in privileged EXEC mode, follow these steps to specify a vendor-proprietary RADIUS server host and a shared secret text string: To delete the vendor-proprietary RADIUS host, use the no radius-server host {hostname | ip-address} non-standard global configuration command. To disable the key, use the no radius-server key global configuration command. This example shows how to specify a vendor-proprietary RADIUS host and to use a secret key of rad124 between the switch and the server: Switch(config)# radius-server host 172.20.30.15 nonstandard Switch(config)# radius-server key rad124 Displaying the RADIUS Configuration To display the RADIUS configuration, use the show running-config privileged EXEC command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server host {hostname | ip-address} non-standard Specify the IP address or host name of the remote RADIUS server host and identify that it is using a vendor-proprietary implementation of RADIUS. Step 3 radius-server key string Specify the shared secret text string used between the switch and the vendor-proprietary RADIUS server. The switch and the RADIUS server use this text string to encrypt passwords and exchange responses. Note The key is a text string that must match the encryption key used on the RADIUS server. Leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks are part of the key. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your settings. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.9-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with Kerberos Controlling Switch Access with Kerberos This section describes how to enable and configure the Kerberos security system, which authenticates requests for network resources by using a trusted third party. To use this feature, the cryptographic (that is, supports encryption) versions of the switch software must be installed on your switch. You must obtain authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information, refer to the release notes for this release. This section consists of these topics: • Understanding Kerberos, page 9-32 • Kerberos Operation, page 9-34 • Configuring Kerberos, page 9-36 For Kerberos configuration examples, refer to the “Kerberos Configuration Examples” section in the “Security Server Protocols” chapter of the Cisco IOS Security Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_c/scprt2/. Note For complete syntax and usage information for the commands used in this section, refer to the “Kerberos Commands” section in the “Security Server Protocols” chapter of the Cisco IOS Security Command Reference, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_r/srprt2/srdkerb.htm. Note In the Kerberos configuration examples and in the Cisco IOS Security Command Reference, Release 12.1, the trusted third party can be a Catalyst 3750 switch that supports Kerberos, that is configured as a network security server, and that can authenticate users by using the Kerberos protocol. Understanding Kerberos Kerberos is a secret-key network authentication protocol, which was developed at the Massachusetts Institute of Technology (MIT). It uses the Data Encryption Standard (DES) cryptographic algorithm for encryption and authentication and authenticates requests for network resources. Kerberos uses the concept of a trusted third party to perform secure verification of users and services. This trusted third party is called the key distribution center (KDC). Kerberos verifies that users are who they claim to be and the network services that they use are what the services claim to be. To do this, a KDC or trusted Kerberos server issues tickets to users. These tickets, which have a limited lifespan, are stored in user credential caches. The Kerberos server uses the tickets instead of usernames and passwords to authenticate users and network services. Note A Kerberos server can be a Catalyst 3750 switch that is configured as a network security server and that can authenticate users by using the Kerberos protocol. The Kerberos credential scheme uses a process called single logon. This process authenticates a user once and then allows secure authentication (without encrypting another password) wherever that user credential is accepted.9-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with Kerberos This software release supports Kerberos 5, which allows organizations that are already using Kerberos 5 to use the same Kerberos authentication database on the KDC that they are already using on their other network hosts (such as UNIX servers and PCs). In this software release, Kerberos supports these network services: • Telnet • rlogin • rsh (Remote Shell Protocol) Table 9-2 lists the common Kerberos-related terms and definitions: Table 9-2 Kerberos Terms Term Definition Authentication A process by which a user or service identifies itself to another service. For example, a client can authenticate to a switch or a switch can authenticate to another switch. Authorization A means by which the switch determines what privileges the user has in a network or on the switch and what actions the user can perform. Credential A general term that refers to authentication tickets, such as TGTs 1 and service credentials. Kerberos credentials verify the identity of a user or service. If a network service decides to trust the Kerberos server that issued a ticket, it can be used in place of re-entering a username and password. Credentials have a default lifespan of eight hours. Instance An authorization level label for Kerberos principals. Most Kerberos principals are of the form user@REALM (for example, smith@EXAMPLE.COM). A Kerberos principal with a Kerberos instance has the form user/instance@REALM (for example, smith/admin@EXAMPLE.COM). The Kerberos instance can be used to specify the authorization level for the user if authentication is successful. The server of each network service might implement and enforce the authorization mappings of Kerberos instances but is not required to do so. Note The Kerberos principal and instance names must be in all lowercase characters. Note The Kerberos realm name must be in all uppercase characters. KDC 2 Key distribution center that consists of a Kerberos server and database program that is running on a network host. Kerberized A term that describes applications and services that have been modified to support the Kerberos credential infrastructure. Kerberos realm A domain consisting of users, hosts, and network services that are registered to a Kerberos server. The Kerberos server is trusted to verify the identity of a user or network service to another user or network service. Note The Kerberos realm name must be in all uppercase characters. Kerberos server A daemon that is running on a network host. Users and network services register their identity with the Kerberos server. Network services query the Kerberos server to authenticate to other network services.9-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with Kerberos Kerberos Operation A Kerberos server can be a Catalyst 3750 switch that is configured as a network security server and that can authenticate remote users by using the Kerberos protocol. Although you can customize Kerberos in a number of ways, remote users attempting to access network services must pass through three layers of security before they can access network services. To authenticate to network services by using a Catalyst 3750 switch as a Kerberos server, remote users must follow these steps: 1. Authenticating to a Boundary Switch, page 9-35 2. Obtaining a TGT from a KDC, page 9-35 3. Authenticating to Network Services, page 9-35 KEYTAB 3 A password that a network service shares with the KDC. In Kerberos 5 and later Kerberos versions, the network service authenticates an encrypted service credential by using the KEYTAB to decrypt it. In Kerberos versions earlier than Kerberos 5, KEYTAB is referred to as SRVTAB 4 . Principal Also known as a Kerberos identity, this is who you are or what a service is according to the Kerberos server. Note The Kerberos principal name must be in all lowercase characters. Service credential A credential for a network service. When issued from the KDC, this credential is encrypted with the password shared by the network service and the KDC. The password is also shared with the user TGT. SRVTAB A password that a network service shares with the KDC. In Kerberos 5 or later Kerberos versions, SRVTAB is referred to as KEYTAB. TGT Ticket granting ticket that is a credential that the KDC issues to authenticated users. When users receive a TGT, they can authenticate to network services within the Kerberos realm represented by the KDC. 1. TGT = ticket granting ticket 2. KDC = key distribution center 3. KEYTAB = key table 4. SRVTAB = server table Table 9-2 Kerberos Terms (continued) Term Definition9-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with Kerberos Authenticating to a Boundary Switch This section describes the first layer of security through which a remote user must pass. The user must first authenticate to the boundary switch. This process then occurs: 1. The user opens an un-Kerberized Telnet connection to the boundary switch. 2. The switch prompts the user for a username and password. 3. The switch requests a TGT from the KDC for this user. 4. The KDC sends an encrypted TGT that includes the user identity to the switch. 5. The switch attempts to decrypt the TGT by using the password that the user entered. – If the decryption is successful, the user is authenticated to the switch. – If the decryption is not successful, the user repeats Step 2 either by re-entering the username and password (noting if Caps Lock or Num Lock is on or off) or by entering a different username and password. A remote user who initiates a un-Kerberized Telnet session and authenticates to a boundary switch is inside the firewall, but the user must still authenticate directly to the KDC before getting access to the network services. The user must authenticate to the KDC because the TGT that the KDC issues is stored on the switch and cannot be used for additional authentication until the user logs on to the switch. Obtaining a TGT from a KDC This section describes the second layer of security through which a remote user must pass. The user must now authenticate to a KDC and obtain a TGT from the KDC to access network services. For instructions about how to authenticate to a KDC, refer to the “Obtaining a TGT from a KDC” section in the “Security Server Protocols” chapter of the Cisco IOS Security Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_c/scprt2/scdkerb.htm #xtocid154005. Authenticating to Network Services This section describes the third layer of security through which a remote user must pass. The user with a TGT must now authenticate to the network services in a Kerberos realm. For instructions about how to authenticate to a network service, refer to the “Authenticating to Network Services” section in the “Security Server Protocols” chapter of the Cisco IOS Security Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_c/scprt2/scdkerb.htm #xtocid154006.9-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Controlling Switch Access with Kerberos Configuring Kerberos So that remote users can authenticate to network services, you must configure the hosts and the KDC in the Kerberos realm to communicate and mutually authenticate users and network services. To do this, you must identify them to each other. You add entries for the hosts to the Kerberos database on the KDC and add KEYTAB files generated by the KDC to all hosts in the Kerberos realm. You also create entries for the users in the KDC database. When you add or create entries for the hosts and users, follow these guidelines: • The Kerberos principal name must be in all lowercase characters. • The Kerberos instance name must be in all lowercase characters. • The Kerberos realm name must be in all uppercase characters. Note A Kerberos server can be a Catalyst 3750 switch that is configured as a network security server and that can authenticate users by using the Kerberos protocol. To set up a Kerberos-authenticated server-client system, follow these steps: • Configure the KDC by using Kerberos commands. • Configure the switch to use the Kerberos protocol. For instructions, refer to the “Kerberos Configuration Task List” section in the “Security Server Protocols” chapter of the Cisco IOS Security Configuration Guide, Release 12.1, at this URL: http://www.cisco.com/univercd/cc/td/doc/product/software/ios121/121cgcr/secur_c/scprt2/scdkerb.htm #xtocid154007.9-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Configuring the Switch for Local Authentication and Authorization Configuring the Switch for Local Authentication and Authorization You can configure AAA to operate without a server by setting the switch to implement AAA in local mode. The switch then handles authentication and authorization. No accounting is available in this configuration. Beginning in privileged EXEC mode, follow these steps to configure the switch for local AAA: To disable AAA, use the no aaa new-model global configuration command. To disable authorization, use the no aaa authorization {network | exec} method1 global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa new-model Enable AAA. Step 3 aaa authentication login default local Set the login authentication to use the local username database. The default keyword applies the local user database authentication to all interfaces. Step 4 aaa authorization exec local Configure user AAA authorization to determine if the user is allowed to run an EXEC shell by checking the local database. Step 5 aaa authorization network local Configure user AAA authorization for all network-related service requests. Step 6 username name [privilege level] {password encryption-type password} Enter the local database, and establish a username-based authentication system. Repeat this command for each user. • For name, specify the user ID as one word. Spaces and quotation marks are not allowed. • (Optional) For level, specify the privilege level the user has after gaining access. The range is 0 to 15. Level 15 gives privileged EXEC mode access. Level 0 gives user EXEC mode access. • For encryption-type, enter 0 to specify that an unencrypted password follows. Enter 7 to specify that a hidden password follows. • For password, specify the password the user must enter to gain access to the switch. The password must be from 1 to 25 characters, can contain embedded spaces, and must be the last option specified in the username command. Step 7 end Return to privileged EXEC mode. Step 8 show running-config Verify your entries. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.9-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 9 Configuring Switch-Based Authentication Configuring the Switch for Secure Shell Configuring the Switch for Secure Shell This section describes how to configure the Secure Shell (SSH) feature. The cryptographic (that is, supports encryption) versions of the switch software must be installed on your switch. You must obtain authorization to use this feature and to download the cryptographic software files from Cisco.com. For more information, refer to the release notes for this release. This section contains this configuration information: • Understanding SSH, page 9-38 • Configuring SSH, page 9-38 Note For complete syntax and usage information for the commands used in this section, refer to the “Secure Shell Commands” section in the Cisco IOS Security Command Reference for Release 12.1. Understanding SSH SSH is a protocol that provides a secure, remote connection to a device. SSH provides more security for remote connections than Telnet by providing strong encryption when a device is authenticated. The SSH feature has an SSH server and an SSH integrated client. Note The SSH connection to the switch stack can be lost if a stack master, running the cryptographic (that is, supports encryption) version of the SMI or EMI software, fails and is replaced by a switch that is running a noncryptographic version of the software. We recommend that a switch running the cryptographic version of the SMI or EMI software be the stack master. Encryption features are unavailable if the stack master is running the noncryptographic version of the SMI or EMI software. This software release only supports SSH version 1. Note The SSH feature in this software release does not support IP Security (IPSec). SSH supports these user authentication methods: • TACACS+ (For more information, see the “Controlling Switch Access with TACACS+” section on page 9-10.) • RADIUS (For more information, see the “Controlling Switch Access with RADIUS” section on page 9-18.) • Local authentication and authorization (For more information, see the “Configuring the Switch for Local Authentication and Authorization” section on page 9-37.) For more information about SSH, refer to the “Configuring Secure Shell” section in the Cisco IOS Security Configuration Guide for Release 12.1. Configuring SSH Before configuring SSH, download the cryptographic version of the switch software image from Cisco.com. For more information, refer to the release notes for this release. For information about configuring SSH and displaying SSH settings, refer to the “Configuring Secure Shell” section in the Cisco IOS Security Configuration Guide for Release 12.1.C H A P T E R 10-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 10 Configuring 802.1X Port-Based Authentication This chapter describes how to configure IEEE 802.1X port-based authentication on the Catalyst 3750 switch. As LANs extend to hotels, airports, and corporate lobbies, creating insecure environments, 802.1X prevents unauthorized devices (clients) from gaining access to the network. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding 802.1X Port-Based Authentication, page 10-1 • Configuring 802.1X Authentication, page 10-10 • Displaying 802.1X Statistics and Status, page 10-20 Understanding 802.1X Port-Based Authentication The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that restricts unauthorized clients from connecting to a LAN through publicly accessible ports. The authentication server authenticates each client connected to a switch port before making available any services offered by the switch or the LAN. Until the client is authenticated, 802.1X access control allows only Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Protocol (CDP), and Spanning Tree Protocol (STP) traffic through the port to which the client is connected. After authentication is successful, normal traffic can pass through the port. These sections describe 802.1X port-based authentication: • Device Roles, page 10-2 • Authentication Initiation and Message Exchange, page 10-3 • Ports in Authorized and Unauthorized States, page 10-4 • Supported Topologies, page 10-5 • Using 802.1X with Port Security, page 10-6 • Using 802.1X with Voice VLAN Ports, page 10-6 • Using 802.1X with VLAN Assignment, page 10-710-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication • Using 802.1X with Guest VLAN, page 10-8 • Using 802.1X with Per-User ACLs, page 10-9 • 802.1X and Switch Stacks, page 10-10 Device Roles With 802.1X port-based authentication, the devices in the network have specific roles as shown in Figure 10-1. Figure 10-1 802.1X Device Roles • Client—the device (workstation) that requests access to the LAN and switch services and responds to requests from the switch.The workstation must be running 802.1X-compliant client software such as that offered in the Microsoft Windows XP operating system. (The client is the supplicant in the IEEE 802.1X specification.) Note To resolve Windows XP network connectivity and 802.1X authentication issues, read the Microsoft Knowledge Base article at this URL: http://support.microsoft.com/support/kb/articles/Q303/5/97.ASP • Authentication server—performs the actual authentication of the client. The authentication server validates the identity of the client and notifies the switch whether or not the client is authorized to access the LAN and switch services. Because the switch acts as the proxy, the authentication service is transparent to the client. In this release, the Remote Authentication Dial-In User Service (RADIUS) security system with Extensible Authentication Protocol (EAP) extensions is the only supported authentication server. It is available in Cisco Secure Access Control Server version 3.0 or later. RADIUS operates in a client/server model in which secure authentication information is exchanged between the RADIUS server and one or more RADIUS clients. • Switch (edge switch or wireless access point)—controls the physical access to the network based on the authentication status of the client. The switch acts as an intermediary (proxy) between the client and the authentication server, requesting identity information from the client, verifying that information with the authentication server, and relaying a response to the client. The switch includes the RADIUS client, which is responsible for encapsulating and decapsulating the EAP frames and interacting with the authentication server. When the switch receives EAPOL frames and relays them to the authentication server, the Ethernet header is stripped and the remaining EAP frame is re-encapsulated in the RADIUS format. The EAP frames are not modified or examined during encapsulation, and the authentication server must Workstations (clients) Catalyst 3750 (switch) Authentication server (RADIUS) 8647210-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication support EAP within the native frame format. When the switch receives frames from the authentication server, the server’s frame header is removed, leaving the EAP frame, which is then encapsulated for Ethernet and sent to the client. The devices that can act as intermediaries include the Catalyst 3750, Catalyst 3550, Catalyst 2970, Catalyst 2955, Catalyst 2950, Catalyst 2940 switches, or a wireless access point. These devices must be running software that supports the RADIUS client and 802.1X. Authentication Initiation and Message Exchange The switch or the client can initiate authentication. If you enable authentication on a port by using the dot1x port-control auto interface configuration command, the switch must initiate authentication when it determines that the port link state transitions from down to up. It then sends an EAP-request/identity frame to the client to request its identity (typically, the switch sends an initial identity/request frame followed by one or more requests for authentication information). Upon receipt of the frame, the client responds with an EAP-response/identity frame. However, if during bootup, the client does not receive an EAP-request/identity frame from the switch, the client can initiate authentication by sending an EAPOL-start frame, which prompts the switch to request the client’s identity. Note If 802.1X is not enabled or supported on the network access device, any EAPOL frames from the client are dropped. If the client does not receive an EAP-request/identity frame after three attempts to start authentication, the client sends frames as if the port is in the authorized state. A port in the authorized state effectively means that the client has been successfully authenticated. For more information, see the “Ports in Authorized and Unauthorized States” section on page 10-4. When the client supplies its identity, the switch begins its role as the intermediary, passing EAP frames between the client and the authentication server until authentication succeeds or fails. If the authentication succeeds, the switch port becomes authorized. For more information, see the “Ports in Authorized and Unauthorized States” section on page 10-4. The specific exchange of EAP frames depends on the authentication method being used. Figure 10-2 shows a message exchange initiated by the client using the One-Time-Password (OTP) authentication method with a RADIUS server.10-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Figure 10-2 Message Exchange Ports in Authorized and Unauthorized States The switch port state determines whether or not the client is granted access to the network. The port starts in the unauthorized state. While in this state, the port disallows all ingress and egress traffic except for 802.1X, CDP, and STP protocol packets. When a client is successfully authenticated, the port transitions to the authorized state, allowing all traffic for the client to flow normally. If a client that does not support 802.1X is connected to an unauthorized 802.1X port, the switch requests the client’s identity. In this situation, the client does not respond to the request, the port remains in the unauthorized state, and the client is not granted access to the network. In contrast, when an 802.1X-enabled client connects to a port that is not running the 802.1X protocol, the client initiates the authentication process by sending the EAPOL-start frame. When no response is received, the client sends the request for a fixed number of times. Because no response is received, the client begins sending frames as if the port is in the authorized state. You control the port authorization state by using the dot1x port-control interface configuration command and these keywords: • force-authorized—disables 802.1X authentication and causes the port to transition to the authorized state without any authentication exchange required. The port sends and receives normal traffic without 802.1X-based authentication of the client. This is the default setting. • force-unauthorized—causes the port to remain in the unauthorized state, ignoring all attempts by the client to authenticate. The switch cannot provide authentication services to the client through the interface. • auto—enables 802.1X authentication and causes the port to begin in the unauthorized state, allowing only EAPOL frames to be sent and received through the port. The authentication process begins when the link state of the port transitions from down to up or when an EAPOL-start frame is received. The switch requests the identity of the client and begins relaying authentication messages between the client and the authentication server. Each client attempting to access the network is uniquely identified by the switch by using the client MAC address. Client Catalyst 3750 switch Port Authorized Port Unauthorized EAPOL-Start EAP-Request/Identity EAP-Response/Identity EAP-Request/OTP EAP-Response/OTP EAP-Success RADIUS Access-Request RADIUS Access-Challenge RADIUS Access-Request RADIUS Access-Accept EAPOL-Logoff Authentication server (RADIUS) 8647310-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication If the client is successfully authenticated (receives an Accept frame from the authentication server), the port state changes to authorized, and all frames from the authenticated client are allowed through the port. If the authentication fails, the port remains in the unauthorized state, but authentication can be retried. If the authentication server cannot be reached, the switch can resend the request. If no response is received from the server after the specified number of attempts, authentication fails, and network access is not granted. When a client logs off, it sends an EAPOL-logoff message, causing the switch port to transition to the unauthorized state. If the link state of a port transitions from up to down, or if an EAPOL-logoff frame is received, the port returns to the unauthorized state. Supported Topologies The 802.1X port-based authentication is supported in two topologies: • Point-to-point • Wireless LAN In a point-to-point configuration (see Figure 10-1 on page 10-2), only one client can be connected to the 802.1X-enabled switch port. The switch detects the client when the port link state changes to the up state. If a client leaves or is replaced with another client, the switch changes the port link state to down, and the port returns to the unauthorized state. Figure 10-3 shows 802.1X port-based authentication in a wireless LAN. The 802.1X port is configured as a multiple-hosts port that becomes authorized as soon as one client is authenticated. When the port is authorized, all other hosts indirectly attached to the port are granted access to the network. If the port becomes unauthorized (re-authentication fails or an EAPOL-logoff message is received), the switch denies access to the network to all of the attached clients. In this topology, the wireless access point is responsible for authenticating the clients attached to it, and the wireless access point acts as a client to the switch. Figure 10-3 Wireless LAN Example Wireless clients Access point Catalyst 3750 switch Authentication server (RADIUS) 8647410-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Using 802.1X with Port Security You can configure 802.1X port and port security in either single-host or multiple-hosts mode. (You also must configure port security on the port by using the switchport port-security interface configuration command.) When you enable port security and 802.1X on a port, 802.1X authenticates the port, and port security manages network access for all MAC addresses, including that of the client. You can then limit the number or group of clients that can access the network through an 802.1X port. These are some examples of the interaction between 802.1X and port security on the switch: • When a client is authenticated, and the port security table is not full, the client MAC address is added to the port security list of secure hosts. The port then proceeds to come up normally. When a client is authenticated and manually configured for port security, it is guaranteed an entry in the secure host table (unless port security static aging has been enabled). A security violation occurs if the client is authenticated, but the port security table is full. This can happen if the maximum number of secure hosts has been statically configured or if the client ages out of the secure host table. If the client address is aged, its place in the secure host table can be taken by another host. If the security violation is caused by the first authenticated host, the interface becomes error-disabled and immediately shuts down. The port security violation modes determine the action for security violations. For more information, see the “Security Violations” section on page 19-8. • When you manually remove an 802.1X client address from the port security table by using the no switchport port-security mac-address mac-address interface configuration command, you should re-authenticate the 802.1X client by using the dot1x re-authenticate interface interface-id privileged EXEC command. • When an 802.1X client logs off, the port transitions to an unauthenticated state, and all dynamic entries in the secure host table are cleared, including the entry for the client. Normal authentication then takes place. • If the port is administratively shut down, the port becomes unauthenticated, and all dynamic entries are removed from the secure host table. • Port security and a voice VLAN can be configured simultaneously on an 802.1X port that is in either single-host or multiple-hosts mode. Port security applies to both the voice VLAN identifier (VVID) and the port VLAN identifier (PVID). For more information about enabling port security on your switch, see the “Configuring Port Security” section on page 19-7. Using 802.1X with Voice VLAN Ports A voice VLAN port is a special access port associated with two VLAN identifiers: • VVID to carry voice traffic to and from the IP phone. The VVID is used to configure the IP phone connected to the port. • PVID to carry the data traffic to and from the workstation connected to the switch through the IP phone. The PVID is the native VLAN of the port. Each port that you configure for a voice VLAN is associated with a PVID and a VVID. This configuration allows voice traffic and data traffic to be separated onto different VLANs. 10-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Before Cisco IOS Release 12.1(14)EA1, a switch in single-host mode accepted traffic from a single host, and voice traffic was not allowed. In multiple-hosts mode, the switch did not accept voice traffic until the client was authenticated on the primary VLAN, thus making the IP phone inoperable until the user logged in. With Cisco IOS Release 12.1(14)EA1 and later, the IP phone uses the VVID for its voice traffic regardless of the authorized or unauthorized state of the port. This allows the phone to work independently of 802.1X authentication. When you enable the single-host mode, multiple IP phones are allowed on the VVID; only one 802.1X client is allowed on the PVID. When you enable the multiple-hosts mode and when an 802.1X user is authenticated on the primary VLAN, additional clients on the voice VLAN are unrestricted after 802.1X authentication succeeds on the primary VLAN. A voice VLAN port becomes active when there is link, and the device MAC address appears after the first CDP message from the IP phone. Cisco IP phones do not relay CDP messages from other devices. As a result, if several IP phones are connected in series, the switch recognizes only the one directly connected to it. When 802.1X is enabled on a voice VLAN port, the switch drops packets from unrecognized IP phones more than one hop away. When 802.1X is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN. For more information about voice VLANs, see the Chapter 14, “Configuring Voice VLAN.” Using 802.1X with VLAN Assignment Before Cisco IOS Release 12.1(14)EA1, when an 802.1X port was authenticated, it was authorized to be in the access VLAN configured on the port even if the RADIUS server returned an authorized VLAN from its database. Recall that an access VLAN is a VLAN assigned to an access port. All packets sent from or received on this port belong to this VLAN. However, with Cisco IOS Release 12.1(14)EA1 and later, the switch supports 802.1X with VLAN assignment. After successful 802.1X authentication of a port, the RADIUS server sends the VLAN assignment to configure the switch port. The RADIUS server database maintains the username-to-VLAN mappings, which assigns the VLAN based on the username of the client connected to the switch port. You can use this feature to limit network access for certain users. When configured on the switch and the RADIUS server, 802.1X with VLAN assignment has these characteristics: • If no VLAN is supplied by the RADIUS server or if 802.1X authorization is disabled, the port is configured in its access VLAN after successful authentication. • If 802.1X authorization is enabled but the VLAN information from the RADIUS server is not valid, the port returns to the unauthorized state and remains in the configured access VLAN. This prevents ports from appearing unexpectedly in an inappropriate VLAN because of a configuration error. Configuration errors could include specifying a VLAN for a routed port, a malformed VLAN ID, a nonexistent or internal (routed port) VLAN ID, or an attempted assignment to a voice VLAN ID. • If 802.1X authorization is enabled and all information from the RADIUS server is valid, the port is placed in the specified VLAN after authentication. • If the multiple-hosts mode is enabled on an 802.1X port, all hosts are placed in the same VLAN (specified by the RADIUS server) as the first authenticated host. • If 802.1X and port security are enabled on a port, the port is placed in RADIUS server assigned VLAN. • If 802.1X is disabled on the port, it is returned to the configured access VLAN. 10-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication When the port is in the force authorized, force unauthorized, unauthorized, or shutdown state, it is put into the configured access VLAN. If an 802.1X port is authenticated and put in the RADIUS server assigned VLAN, any change to the port access VLAN configuration does not take effect. The 802.1X with VLAN assignment feature is not supported on trunk ports, dynamic ports, or with dynamic-access port assignment through a VLAN Membership Policy Server (VMPS). To configure VLAN assignment you need to perform these tasks: • Enable AAA authorization by using the network keyword to allow interface configuration from the RADIUS server. • Enable 802.1X. (The VLAN assignment feature is automatically enabled when you configure 802.1X on an access port). • Assign vendor-specific tunnel attributes in the RADIUS server. The RADIUS server must return these attributes to the switch: – [64] Tunnel-Type = VLAN – [65] Tunnel-Medium-Type = 802 – [81] Tunnel-Private-Group-ID = VLAN name or VLAN ID Attribute [64] must contain the value VLAN (type 13). Attribute [65] must contain the value 802 (type 6). Attribute [81] specifies the VLAN name or VLAN ID assigned to the 802.1X-authenticated user. For examples of tunnel attributes, see the “Configuring the Switch to Use Vendor-Specific RADIUS Attributes” section on page 9-29. Using 802.1X with Guest VLAN You can configure a guest VLAN for each 802.1X port on the switch to provide limited services to clients (for example, how to download the 802.1X client). These clients might be upgrading their system for 802.1X authentication, and some hosts, such as Windows 98 systems, might not be 802.1X-capable. When the authentication server does not receive a response to its EAPOL request/identity frame, clients that are not 802.1X-capable are put into the guest VLAN for the port, if one is configured. However, the server does not grant 802.1X-capable clients that fail authentication access to the network. Any number of hosts are allowed access when the switch port is moved to the guest VLAN. If an 802.1X-capable host joins the same port on which the guest VLAN is configured, the port is put into the unauthorized state in the user-configured access VLAN, and authentication is restarted. Guest VLANs are supported on 802.1X ports in single-host or multiple-hosts mode. You can configure any active VLAN except an RSPAN VLAN or a voice VLAN as an 802.1X guest VLAN. The guest VLAN feature is not supported on internal VLANs (routed ports) or trunk ports; it is supported only on access ports. For more information, see the “Configuring a Guest VLAN” section on page 10-19.10-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Understanding 802.1X Port-Based Authentication Using 802.1X with Per-User ACLs You can enable per-user access control lists (ACLs) to provide different levels of network access and service to an 802.1X-authenticated user. When the RADIUS server authenticates a user connected to an 802.1X port, it retrieves the ACL attributes based on the user identity and sends them to the switch. The switch applies the attributes to the 802.1X port for the duration of the user session. The switch removes the per-user ACL configuration when the session is over, if authentication fails, or if a link-down condition occurs. The switch does not save RADIUS-specified ACLs in the running configuration. When the port is unauthorized, the switch removes the ACL from the port. You can configure only one type of per-user ACLs on a Catalyst 3750 switch port: router ACLs or port ACLs. Router ACLs apply to Layer 3 interfaces, and port ACLs apply to Layer 2 interfaces. If a port is configured with a port-based ACL, the switch rejects any attempt to configure a router-based ACL on the same port. However, if a port is configured with a router-based ACL and then a port-based ACL, the port-based ACL overwrites the router ACL. To avoid configuration conflicts, you should carefully plan the user profiles stored on the RADIUS server. RADIUS supports per-user attributes, including vendor-specific attributes. These vendor-specific attributes (VSAs) are in octet-string format and are passed to the switch during the authentication process. The VSAs used for per-user ACLs are inacl# for the ingress direction and outacl# for the egress direction. MAC ACLs are supported only in the ingress direction. The Catalyst 3750 switch supports VSAs only in the ingress direction. It does not support port ACLs in the egress direction on Layer 2 interfaces. For more information, see Chapter 26, “Configuring Network Security with ACLs.” Use only the extended ACL syntax style to define the per-user configuration stored on the RADIUS server. When the definitions are passed from the RADIUS server, they are created by using the extended naming convention. However, if you use the Filter-Id attribute, it can point to a standard ACL. You can use the Filter-Id attribute to specify an inbound or outbound ACL that is already configured on the switch. The attribute contains the ACL number followed by .in for ingress filtering or .out for egress filtering. If the RADIUS server does not allow the .in or .out syntax, the access list is applied to the outbound ACL by default. Because of limited support of Cisco IOS access lists on the switch, the Filter-Id attribute is supported only for IP ACLs numbered 1 to 199 and 1300 to 2699 (IP standard and IP extended ACLs). Only one 802.1X-authenticated user is supported on a port. If the multiple-hosts mode is enabled on the port, the per-user ACL attribute is disabled for the associated port. The maximum size of the per-user ACL is 4000 ASCII characters. For examples of vendor-specific attributes, see the “Configuring the Switch to Use Vendor-Specific RADIUS Attributes” section on page 9-29. For more information about configuring ACLs, see Chapter 26, “Configuring Network Security with ACLs.” To configure per-user ACLs, you need to perform these tasks: • Enable AAA authentication. • Enable AAA authorization by using the network keyword to allow interface configuration from the RADIUS server. • Enable 802.1X. • Configure the user profile and VSAs on the RADIUS server. • Configure the 802.1X port for single-host mode.10-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication 802.1X and Switch Stacks If a switch is added to or removed from a switch stack, 802.1X authentication is not affected as long as the IP connectivity between the RADIUS server and the stack remains intact. This statement also applies if the stack master is removed from the switch stack. Note that if the stack master fails, a stack member becomes the new stack master by using the election process described in Chapter 5, “Managing Switch Stacks,” and the 802.1X authentication process continues as usual. If IP connectivity to the RADIUS server is interrupted because the switch that was connected to the server is removed or fails, these events occur: • Ports that are already authenticated and that do not have periodic re-authentication enabled remain in the authenticated state. Communication with the RADIUS server is not required. • Ports that are already authenticated and that have periodic re-authentication enabled (with the dot1x re-authentication global configuration command) fail the authentication process when the re-authentication occurs. Ports return to the unauthenticated state during the re-authentication process. Communication with the RADIUS server is required. For an ongoing authentication, the authentication fails immediately because there is no server connectivity. If the switch that failed comes up and rejoins the switch stack, the authentications might or might not fail depending on the boot-up time and whether the connectivity to the RADIUS server is re-established by the time the authentication is attempted. To avoid loss of connectivity to the RADIUS server, you should ensure that there is a redundant connection to it. For example, you can have a redundant connection to the stack master and another to a stack member, and if the stack master fails, the switch stack still has connectivity to the RADIUS server. Configuring 802.1X Authentication These sections describe how to configure 802.1X port-based authentication on your switch: • Default 802.1X Configuration, page 10-11 • 802.1X Configuration Guidelines, page 10-12 • Upgrading from a Previous Software Release, page 10-12 • Configuring 802.1X Authentication, page 10-13 (required) • Configuring the Switch-to-RADIUS-Server Communication, page 10-14 (required) • Configuring Periodic Re-Authentication, page 10-15 (optional) • Manually Re-Authenticating a Client Connected to a Port, page 10-16 (optional) • Changing the Quiet Period, page 10-16 (optional) • Changing the Switch-to-Client Retransmission Time, page 10-17 (optional) • Setting the Switch-to-Client Frame-Retransmission Number, page 10-17 (optional) • Configuring the Host Mode, page 10-18 (optional) • Configuring a Guest VLAN, page 10-19 (optional) • Resetting the 802.1X Configuration to the Default Values, page 10-20 (optional)10-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication Default 802.1X Configuration Table 10-1 shows the default 802.1X configuration. Table 10-1 Default 802.1X Configuration Feature Default Setting Authentication, authorization, and accounting (AAA) Disabled. RADIUS server • IP address • UDP authentication port • Key • None specified. • 1812. • None specified. Switch 802.1X enable state Disabled. Per-interface 802.1X enable state Disabled (force-authorized). The port sends and receives normal traffic without 802.1X-based authentication of the client. Periodic re-authentication Disabled. Number of seconds between re-authentication attempts 3600 seconds. Quiet period 60 seconds (number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client). Retransmission time 30 seconds (number of seconds that the switch should wait for a response to an EAP request/identity frame from the client before resending the request). Maximum retransmission number 2 times (number of times that the switch will send an EAP-request/identity frame before restarting the authentication process). Host mode Single-host mode. Guest VLAN None specified. Client timeout period 30 seconds (when relaying a request from the authentication server to the client, the amount of time the switch waits for a response before resending the request to the client.) Authentication server timeout period 30 seconds (when relaying a response from the client to the authentication server, the amount of time the switch waits for a reply before resending the response to the server. This setting is not configurable.)10-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication 802.1X Configuration Guidelines These are the 802.1X authentication configuration guidelines: • When 802.1X is enabled, ports are authenticated before any other Layer 2 or Layer 3 features are enabled. • The 802.1X protocol is supported on Layer 2 static-access ports, voice VLAN ports, and Layer 3 routed ports, but it is not supported on these port types: – Trunk port—If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, an error message appears, and the port mode is not changed. – Dynamic ports—A port in dynamic mode can negotiate with its neighbor to become a trunk port. If you try to enable 802.1X on a dynamic port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to dynamic, an error message appears, and the port mode is not changed. – Dynamic-access ports—If you try to enable 802.1X on a dynamic-access (VLAN Query Protocol [VQP]) port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is not changed. – EtherChannel port—Do not configure a port that is an active member of an EtherChannel as an 802.1X port. If 802.1X is enabled on a not-yet active port of an EtherChannel, the port does not join the EtherChannel. – Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) destination ports—You can enable 802.1X on a port that is a SPAN or RSPAN destination port. However, 802.1X is disabled until the port is removed as a SPAN or RSPAN destination port. You can enable 802.1X on a SPAN or RSPAN source port. • You can configure any VLAN except an RSPAN VLAN or a voice VLAN as an 802.1X guest VLAN. The guest VLAN feature is not supported on internal VLANs (routed ports) or trunk ports; it is supported only on access ports. • When 802.1X is enabled on a port, you cannot configure a port VLAN that is equal to a voice VLAN. • The 802.1X with VLAN assignment feature is not supported on trunk ports, dynamic ports, or with dynamic-access port assignment through a VMPS. Upgrading from a Previous Software Release In Cisco IOS Release 12.1(14)EA1, the implementation for 802.1X changed from the previous release. Some global configuration commands became interface configuration commands, and new commands were added. If you have 802.1X configured on the switch and you upgrade to Cisco IOS Release 12.1(14)EA1 or later, the configuration file will not contain the new commands, and 802.1X will not operate. After the upgrade is complete, make sure to globally enable 802.1X by using the dot1x system-auth-control global configuration command. If 802.1X was running in multiple-hosts mode on an interface in the previous release, make sure to reconfigure it by using the dot1x host-mode multi-host interface configuration command.10-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication Configuring 802.1X Authentication To configure 802.1X port-based authentication, you must enable AAA and specify the authentication method list. A method list describes the sequence and authentication methods to be queried to authenticate a user. The software uses the first method listed to authenticate users. If that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle, the authentication process stops, and no other authentication methods are attempted. To allow per-user ACLs or VLAN assignment, you must enable AAA authorization to configure the switch for all network-related service requests. Beginning in privileged EXEC mode, follow these steps to configure 802.1X port-based authentication. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 aaa new-model Enable AAA. Step 3 aaa authentication dot1x {default} method1 [method2...] Create an 802.1X authentication method list. To create a default list that is used when a named list is not specified in the authentication command, use the default keyword followed by the methods that are to be used in default situations. The default method list is automatically applied to all interfaces. Enter at least one of these keywords: • group radius—Use the list of all RADIUS servers for authentication. • none—Use no authentication. The client is automatically authenticated by the switch without using the information supplied by the client. Step 4 dot1x system-auth-control Enable 802.1X authentication globally on the switch. Step 5 aaa authorization network {default} group radius (Optional) Configure the switch for user RADIUS authorization for all network-related service requests, such as per-user ACLs or VLAN assignment. Note For per-user ACLs, single-host mode must be configured. This setting is the default. Step 6 interface interface-id Enter interface configuration mode, and specify the interface connected to the client that is to be enabled for 802.1X authentication. Step 7 dot1x port-control auto Enable 802.1X authentication on the interface. For feature interaction information, see the “802.1X Configuration Guidelines” section on page 10-12. Step 8 end Return to privileged EXEC mode. Step 9 show dot1x Verify your entries. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file.10-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication To disable AAA, use the no aaa new-model global configuration command. To disable 802.1X AAA authentication, use the no aaa authentication dot1x {default | list-name} global configuration command. To disable 802.1X AAA authorization, use the no aaa authorization global configuration command. To disable 802.1X authentication on the switch, use the no dot1x system-auth-control global configuration command. This example shows how to enable AAA and 802.1X on Fast Ethernet port 0/1 on stack member 2: Switch# configure terminal Switch(config)# aaa new-model Switch(config)# aaa authentication dot1x default group radius Switch(config)# dot1x system-auth-control Switch(config)# interface fastethernet2/0/1 Switch(config)# switchport mode access Switch(config-if)# dot1x port-control auto Switch(config-if)# end Configuring the Switch-to-RADIUS-Server Communication RADIUS security servers are identified by their host name or IP address, host name and specific UDP port numbers, or IP address and specific UDP port numbers. The combination of the IP address and UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, authentication—the second host entry configured acts as the fail-over backup to the first one. The RADIUS host entries are tried in the order that they were configured. Beginning in privileged EXEC mode, follow these steps to configure the RADIUS server parameters on the switch. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 radius-server host {hostname | ip-address} auth-port port-number key string Configure the RADIUS server parameters. For hostname | ip-address, specify the host name or IP address of the remote RADIUS server. For auth-port port-number, specify the UDP destination port for authentication requests. The default is 1812. The range is 0 to 65536. For key string, specify the authentication and encryption key used between the switch and the RADIUS daemon running on the RADIUS server. The key is a text string that must match the encryption key used on the RADIUS server. Note Always configure the key as the last item in the radius-server host command syntax because leading spaces are ignored, but spaces within and at the end of the key are used. If you use spaces in the key, do not enclose the key in quotation marks unless the quotation marks are part of the key. This key must match the encryption used on the RADIUS daemon. If you want to use multiple RADIUS servers, re-enter this command. Step 3 end Return to privileged EXEC mode.10-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication To delete the specified RADIUS server, use the no radius-server host {hostname | ip-address} global configuration command. This example shows how to specify the server with IP address 172.20.39.46 as the RADIUS server, to use port 1612 as the authorization port, and to set the encryption key to rad123, matching the key on the RADIUS server: Switch(config)# radius-server host 172.l20.39.46 auth-port 1612 key rad123 You can globally configure the timeout, retransmission, and encryption key values for all RADIUS servers by using the radius-server host global configuration command. If you want to configure these options on a per-server basis, use the radius-server timeout, radius-server retransmit, and the radius-server key global configuration commands. For more information, see the “Configuring Settings for All RADIUS Servers” section on page 9-29. You also need to configure some settings on the RADIUS server. These settings include the IP address of the switch and the key string to be shared by both the server and the switch. For more information, refer to the RADIUS server documentation. Configuring Periodic Re-Authentication You can enable periodic 802.1X client re-authentication and specify how often it occurs. If you do not specify a time period before enabling re-authentication, the number of seconds between re-authentication attempts is 3600. Beginning in privileged EXEC mode, follow these steps to enable periodic re-authentication of the client and to configure the number of seconds between re-authentication attempts. This procedure is optional. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 dot1x reauthentication Enable periodic re-authentication of the client, which is disabled by default. Step 4 dot1x timeout reauth-period seconds Set the number of seconds between re-authentication attempts. The range is 1 to 65535; the default is 3600 seconds. This command affects the behavior of the switch only if periodic re-authentication is enabled. Step 5 end Return to privileged EXEC mode. Step 6 show dot1x interface interface-id Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.10-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication To disable periodic re-authentication, use the no dot1x reauthentication interface configuration command.To return to the default number of seconds between re-authentication attempts, use the no dot1x timeout reauth-period interface configuration command. This example shows how to enable periodic re-authentication and set the number of seconds between re-authentication attempts to 4000: Switch(config-if)# dot1x reauthentication Switch(config-if)# dot1x timeout reauth-period 4000 Manually Re-Authenticating a Client Connected to a Port You can manually re-authenticate the client connected to a specific port at any time by entering the dot1x re-authenticate interface interface-id privileged EXEC command. This step is optional. If you want to enable or disable periodic re-authentication, see the “Configuring Periodic Re-Authentication” section on page 10-15. This example shows how to manually re-authenticate the client connected to Fast Ethernet port 0/1 on stack member 2: Switch# dot1x re-authenticate interface fastethernet2/0/1 Changing the Quiet Period When the switch cannot authenticate the client, the switch remains idle for a set period of time and then tries again. The idle time is determined by the quiet-period value. A failed authentication of the client might occur because the client provided an invalid password. You can provide a faster response time to the user by entering a smaller number than the default. Beginning in privileged EXEC mode, follow these steps to change the quiet period. This procedure is optional. To return to the default quiet time, use the no dot1x timeout quiet-period interface configuration command. This example shows how to set the quiet time on the switch to 30 seconds: Switch(config-if)# dot1x timeout quiet-period 30 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 dot1x timeout quiet-period seconds Set the number of seconds that the switch remains in the quiet state following a failed authentication exchange with the client. The range is 1 to 65535 seconds; the default is 60. Step 4 end Return to privileged EXEC mode. Step 5 show dot1x interface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.10-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication Changing the Switch-to-Client Retransmission Time The client responds to the EAP-request/identity frame from the switch with an EAP-response/identity frame. If the switch does not receive this response, it waits a set period of time (known as the retransmission time) and then resends the frame. Note You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers. Beginning in privileged EXEC mode, follow these steps to change the amount of time that the switch waits for client notification. This procedure is optional. To return to the default retransmission time, use the no dot1x timeout tx-period interface configuration command. This example shows how to set 60 as the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before resending the request: Switch(config-if)# dot1x timeout tx-period 60 Setting the Switch-to-Client Frame-Retransmission Number In addition to changing the switch-to-client retransmission time, you can change the number of times that the switch sends an EAP-request/identity frame (assuming no response is received) to the client before restarting the authentication process. Note You should change the default value of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients and authentication servers. Beginning in privileged EXEC mode, follow these steps to set the switch-to-client frame-retransmission number. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 dot1x timeout tx-period seconds Set the number of seconds that the switch waits for a response to an EAP-request/identity frame from the client before resending the request. The range is 1 to 65535 seconds; the default is 30. Step 4 end Return to privileged EXEC mode. Step 5 show dot1xinterface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.10-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication To return to the default retransmission number, use the no dot1x max-req interface configuration command. This example shows how to set 5 as the number of times that the switch sends an EAP-request/identity request before restarting the authentication process: Switch(config-if)# dot1x max-req 5 Configuring the Host Mode You can configure an 802.1X port for single-host or for multiple-hosts mode. In single-host mode, only one host is allowed on an 802.1X port. When the host is authenticated, the port is placed in the authorized state. When the host leaves the port, the port becomes unauthorized. Packets from hosts other than the authenticated one are dropped. You can attach multiple hosts to a single 802.1X-enabled port as shown in Figure 10-3 on page 10-5. In this mode, only one of the attached hosts must be successfully authorized for all hosts to be granted network access. If the port becomes unauthorized (re-authentication fails or an EAPOL-logoff message is received), all attached clients are denied access to the network. With the multiple-hosts mode enabled, you can use 802.1X to authenticate the port and port security to manage network access for all MAC addresses, including that of the client. Beginning in privileged EXEC mode, follow these steps to allow multiple hosts (clients) on an 802.1X-authorized port that has the dot1x port-control interface configuration command set to auto. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 dot1x max-req count Set the number of times that the switch sends an EAP-request/identity frame to the client before restarting the authentication process. The range is 1 to 10; the default is 2. Step 4 end Return to privileged EXEC mode. Step 5 show dot1x interface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to which multiple hosts are indirectly attached. Step 3 dot1x host-mode multi-host Allow multiple hosts (clients) on an 802.1X-authorized port. Make sure that the dot1x port-control interface configuration command set is set to auto for the specified interface. Step 4 end Return to privileged EXEC mode.10-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Configuring 802.1X Authentication To disable multiple hosts on the port, use the no dot1x host-mode multi-host interface configuration command. This example shows how to enable 802.1X on Fast Ethernet interface 0/1 of stack member 2 and to allow multiple hosts: Switch(config)# interface fastethernet2/0/1 Switch(config-if)# dot1x port-control auto Switch(config-if)# dot1x host-mode multi-host Configuring a Guest VLAN When you configure a guest VLAN, clients that are not 802.1X-capable are put into the guest VLAN when the server does not receive a response to its EAPOL request/identity frame. Clients that are 802.1X-capable but fail authentication are not granted access to the network. The switch supports guest VLANs in single-host or multiple-hosts mode. Beginning in privileged EXEC mode, follow these steps to configure a guest VLAN. This procedure is optional. To disable and remove the guest VLAN, use the no dot1x guest-vlan interface configuration command. The port returns to the unauthorized state. This example shows how to enable VLAN 2 as an 802.1X guest VLAN on Gigabit Ethernet interface 0/2 on stack member 2: Switch(config)# interface gigabitethernet2/0/2 Switch(config-if)# dot1x guest-vlan 2 Step 5 show dot1x interface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. For the supported interface types, see the “802.1X Configuration Guidelines” section on page 10-12. Step 3 dot1x guest-vlan vlan-id Specify an active VLAN as an 802.1X guest VLAN. The range is 1 to 4094. You can configure any active VLAN except an internal VLANs (routed port), an RSPAN VLAN, or a voice VLAN as an 802.1X guest VLAN. Step 4 end Return to privileged EXEC mode. Step 5 show dot1x interface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.10-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 10 Configuring 802.1X Port-Based Authentication Displaying 802.1X Statistics and Status Resetting the 802.1X Configuration to the Default Values Beginning in privileged EXEC mode, follow these steps to reset the 802.1X configuration to the default values. This procedure is optional. Displaying 802.1X Statistics and Status To display 802.1X statistics for all interfaces, use the show dot1x all statistics privileged EXEC command. To display 802.1X statistics for a specific interface, use the show dot1x statistics interface interface-id privileged EXEC command. To display the 802.1X administrative and operational status for the switch, use the show dot1x all privileged EXEC command. To display the 802.1X administrative and operational status for a specific interface, use the show dot1x interface interface-id privileged EXEC command. For detailed information about the fields in these displays, refer to the command reference for this release. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 dot1x default Reset the configurable 802.1X parameters to the default values. Step 4 end Return to privileged EXEC mode. Step 5 show dot1x interface interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.C H A P T E R 11-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 11 Configuring Interface Characteristics This chapter defines the types of interfaces on the Catalyst 3750switch and describes how to configure them. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. The chapter has these sections: • Understanding Interface Types, page 11-1 • Using Interface Configuration Mode, page 11-6 • Configuring Ethernet Interfaces, page 11-11 • Configuring Layer 3 Interfaces, page 11-18 • Configuring the System MTU, page 11-19 • Monitoring and Maintaining the Interfaces, page 11-21 Note For complete syntax and usage information for the commands used in this chapter, refer to the switch command reference for this release and the online Cisco IOS Interface Command Reference for Release 12.1. Understanding Interface Types This section describes the different types of interfaces supported by the switch with references to chapters that contain more detailed information about configuring these interface types. The rest of the chapter describes configuration procedures for physical interface characteristics. Note The stack ports on the rear of the switch are not Ethernet ports and cannot be configured. These sections are included: • Port-Based VLANs, page 11-2 • Switch Ports, page 11-2 • Routed Ports, page 11-3 • Switch Virtual Interfaces, page 11-4 • EtherChannel Port Groups, page 11-5 • Connecting Interfaces, page 11-511-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Understanding Interface Types Port-Based VLANs A VLAN is a switched network that is logically segmented by function, team, or application, without regard to the physical location of the users. For more information about VLANs, see Chapter 12, “Configuring VLANs.” Packets received on a port are forwarded only to ports that belong to the same VLAN as the receiving port. Network devices in different VLANs cannot communicate with one another without a Layer 3 device to route traffic between the VLANs. VLAN partitions provide hard firewalls for traffic in the VLAN, and each VLAN has its own MAC address table. A VLAN comes into existence when a local port is configured to be associated with the VLAN, when the VLAN Trunking Protocol (VTP) learns of its existence from a neighbor on a trunk, or when a user creates a VLAN. VLANs can be formed with ports across the stack. To configure normal-range VLANs (VLAN IDs 1 to 1005), use the vlan vlan-id global configuration command to enter config-vlan mode or the vlan database privileged EXEC command to enter VLAN database configuration mode. The VLAN configurations for VLAN IDs 1 to 1005 are saved in the VLAN database, which is downloaded to all switches in a stack. All switches in the stack build the same VLAN database. To configure extended-range VLANs (VLAN IDs 1006 to 4094), you must use config-vlan mode with VTP mode set to transparent. Extended-range VLANs are not added to the VLAN database. When VTP mode is transparent, the VTP and VLAN configuration is saved in the switch running configuration, and you can save it in the switch startup configuration file by entering the copy running-config startup-config privileged EXEC command. The running configuration and the saved configuration are the same for all switches in a stack. Add ports to a VLAN by using the switchport interface configuration commands: • Identify the interface. • For a trunk port, set trunk characteristics, and if desired, define the VLANs to which it can belong. • For an access port, set and define the VLAN to which it belongs. Switch Ports Switch ports are Layer 2-only interfaces associated with a physical port. Switch ports belong to one or more VLANs. A switch port can be an access port or a trunk port. You can configure a port as an access port or trunk port or let the Dynamic Trunking Protocol (DTP) operate on a per-port basis to determine switchport mode by negotiating with the port on the other end of the link. Switch ports are used for managing the physical interface and associated Layer 2 protocols and do not handle routing or bridging. Configure switch ports by using the switchport interface configuration commands. For detailed information about configuring access port and trunk port characteristics, see Chapter 12, “Configuring VLANs.” Access Ports An access port belongs to and carries the traffic of only one VLAN (unless it is configured as a voice VLAN port). Traffic is received and sent in native formats with no VLAN tagging. Traffic arriving on an access port is assumed to belong to the VLAN assigned to the port. If an access port receives a tagged packet (Inter-Switch Link [ISL] or 802.1Q tagged), the packet is dropped, and the source address is not learned.11-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Understanding Interface Types Two types of access ports are supported: • Static access ports are manually assigned to a VLAN. • VLAN membership of dynamic access ports is learned through incoming packets. By default, a dynamic access port is a member of no VLAN, and forwarding to and from the port is enabled only when the VLAN membership of the port is discovered. Dynamic access ports on the switch are assigned to a VLAN by a VLAN Membership Policy Server (VMPS). The VMPS can be a Catalyst 6000 series switch; the Catalyst 3750switch cannot be a VMPS server. You can also configure an access port with an attached Cisco IP Phone to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone. For more information about voice VLAN ports, see Chapter 14, “Configuring Voice VLAN.” Trunk Ports A trunk port carries the traffic of multiple VLANs and by default is a member of all VLANs in the VLAN database. Two types of trunk ports are supported: • In an ISL trunk port, all received packets are expected to be encapsulated with an ISL header, and all transmitted packets are sent with an ISL header. Native (non-tagged) frames received from an ISL trunk port are dropped. • An IEEE 802.1Q trunk port supports simultaneous tagged and untagged traffic. An 802.1Q trunk port is assigned a default Port VLAN ID (PVID), and all untagged traffic travels on the port default PVID. All untagged traffic and tagged traffic with a NULL VLAN ID are assumed to belong to the port default PVID. A packet with a VLAN ID equal to the outgoing port default PVID is sent untagged. All other traffic is sent with a VLAN tag. Although by default, a trunk port is a member of every VLAN known to the VTP, you can limit VLAN membership by configuring an allowed list of VLANs for each trunk port. The list of allowed VLANs does not affect any other port but the associated trunk port. By default, all possible VLANs (VLAN ID 1 to 4094) are in the allowed list. A trunk port can only become a member of a VLAN if VTP knows of the VLAN and the VLAN is in the enabled state. If VTP learns of a new, enabled VLAN and the VLAN is in the allowed list for a trunk port, the trunk port automatically becomes a member of that VLAN and traffic is forwarded to and from the trunk port for that VLAN. If VTP learns of a new, enabled VLAN that is not in the allowed list for a trunk port, the port does not become a member of the VLAN, and no traffic for the VLAN is forwarded to or from the port. For more information about trunk ports, see Chapter 12, “Configuring VLANs.” Routed Ports A routed port is a physical port that acts like a port on a router; it does not have to be connected to a router. A routed port is not associated with a particular VLAN, as is an access port. A routed port behaves like a regular router interface, except that it does not support VLAN subinterfaces. Routed ports can be configured with a Layer 3 routing protocol. A routed port is a Layer 3 interface only and does not support Layer 2 protocols, such as DTP and STP. Configure routed ports by putting the interface into Layer 3 mode with the no switchport interface configuration command. Then assign an IP address to the port, enable routing, and assign routing protocol characteristics by using the ip routing and router protocol global configuration commands. Caution Entering a no switchport interface configuration command shuts down the interface and then re-enables it, which might generate messages on the device to which the interface is connected. 11-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Understanding Interface Types The number of routed ports that you can configure is not limited by software. However, the interrelationship between this number and the number of other features being configured might impact CPU performance because of hardware limitations. See the “Configuring Layer 3 Interfaces” section on page 11-18 for information about what happens when hardware resource limitations are reached. For more information about IP unicast and multicast routing and routing protocols, see Chapter 29, “Configuring IP Unicast Routing” and Chapter 31, “Configuring IP Multicast Routing.” Note The standard multilayer software image (SMI) supports static routing and the Routing Information Protocol (RIP). For full Layer 3 routing or for fallback bridging, you must have the enhanced multilayer image (EMI) installed on the stack master. Switch Virtual Interfaces A switch virtual interface (SVI) represents a VLAN of switch ports as one interface to the routing or bridging function in the system. Only one SVI can be associated with a VLAN, but you need to configure an SVI for a VLAN only when you wish to route between VLANs, to fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. By default, an SVI is created for the default VLAN (VLAN 1) to permit remote switch administration. Additional SVIs must be explicitly configured. SVIs provide IP host connectivity only to the system; in Layer 3 mode, you can configure routing across SVIs. Although the switch stack supports a total or 1005 VLANs (and SVIs), the interrelationship between the number of SVIs and routed ports and the number of other features being configured might impact CPU performance because of hardware limitations. See the “Configuring Layer 3 Interfaces” section on page 11-18 for information about what happens when hardware resource limitations are reached. SVIs are created the first time that you enter the vlan interface configuration command for a VLAN interface. The VLAN corresponds to the VLAN tag associated with data frames on an ISL or 802.1Q encapsulated trunk or the VLAN ID configured for an access port. Configure a VLAN interface for each VLAN for which you want to route traffic, and assign it an IP address. For more information, see the “Manually Assigning IP Information” section on page 4-9. Note When you create an SVI, it does not become active until it is associated with a physical port. SVIs support routing protocols and bridging configurations. For more information about configuring IP routing, see Chapter 29, “Configuring IP Unicast Routing,” Chapter 31, “Configuring IP Multicast Routing,”and Chapter 33, “Configuring Fallback Bridging.” Note The SMI supports static routing and RIP; for more advanced routing or for fallback bridging, you must have the EMI installed on the stack master.11-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Understanding Interface Types EtherChannel Port Groups EtherChannel port groups provide the ability to treat multiple switch ports as one switch port. These port groups act as a single logical port for high-bandwidth connections between switches or between switches and servers. An EtherChannel balances the traffic load across the links in the channel. If a link within the EtherChannel fails, traffic previously carried over the failed link changes to the remaining links. You can group multiple trunk ports into one logical trunk port, group multiple access ports into one logical access port, or group multiple routed ports into one logical routed port. Most protocols operate over either single ports or aggregated switch ports and do not recognize the physical ports within the port group. Exceptions are the DTP, the Cisco Discovery Protocol (CDP), and the Port Aggregation Protocol (PAgP), which operate only on physical ports. When you configure an EtherChannel, you create a port-channel logical interface and assign an interface to the EtherChannel. For Layer 3 interfaces, you manually create the logical interface by using the interface port-channel global configuration command. Then you manually assign an interface to the EtherChannel by using the channel-group interface configuration command. For Layer 2 interfaces, use the channel-group interface configuration command to dynamically create the port-channel logical interface. This command binds the physical and logical ports together. For more information, see Chapter 28, “Configuring EtherChannels.” Connecting Interfaces Devices within a single VLAN can communicate directly through any switch. Ports in different VLANs cannot exchange data without going through a routing device. With a standard Layer 2 switch, ports in different VLANs have to exchange information through a router. In the configuration shown in Figure 11-1, when Host A in VLAN 20 sends data to Host B in VLAN 30, it must go from Host A to the switch, to the router, back to the switch, and then to Host B. Figure 11-1 Connecting VLANs with Layer 2 Switches By using the switch with routing enabled, when you configure VLAN 20 and VLAN 30 each with an SVI to which an IP address is assigned, packets can be sent from Host A to Host B directly through the switch with no need for an external router (Figure 11-2). Host A Switch Cisco router VLAN 20 Host B VLAN 30 4664711-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Using Interface Configuration Mode Figure 11-2 Connecting VLANs with the Catalyst 3750 Switch When the EMI is running on the stack master, the switch supports two methods of forwarding traffic between interfaces: routing and fallback bridging. If the SMI is on the stack master, only basic routing (static routing and RIP) is supported. Whenever possible, to maintain high performance, forwarding is done by the switch hardware. However, only IP version 4 packets with Ethernet II encapsulation can be routed in hardware. Non-IP traffic and traffic with other encapsulation methods can be fallback-bridged by hardware. • The routing function can be enabled on all SVIs and routed ports. The switch routes only IP traffic. When IP routing protocol parameters and address configuration are added to an SVI or routed port, any IP traffic received from these ports is routed. For more information, see Chapter 29, “Configuring IP Unicast Routing,” Chapter 31, “Configuring IP Multicast Routing,” and Chapter 32, “Configuring MSDP.” • Fallback bridging forwards traffic that the switch does not route or traffic belonging to a nonroutable protocol, such as DECnet. Fallback bridging connects multiple VLANs into one bridge domain by bridging between two or more SVIs or routed ports. When configuring fallback bridging, you assign SVIs or routed ports to bridge groups with each SVI or routed port assigned to only one bridge group. All interfaces in the same group belong to the same bridge domain. For more information, see Chapter 33, “Configuring Fallback Bridging.” Using Interface Configuration Mode The switch supports these interface types: • Physical ports—including switch ports and routed ports • VLANs—switch virtual interfaces • Port-channels—EtherChannel of interfaces You can also configure a range of interfaces (see the “Configuring a Range of Interfaces” section on page 11-8). To configure a physical interface (port), enter interface configuration mode, and specify the interface type, stack member number, module number, and switch port number. • Type—Fast Ethernet (fastethernet or fa) for 10/100 Mbps Ethernet or Gigabit Ethernet (gigabitethernet or gi) for 10/100/1000 Mbps Ethernet ports or small form-factor pluggable (SFP) Gigabit Ethernet interfaces. Si Host A 172.20.128.1 172.20.129.1 SVI 1 SVI 2 Catalyst 3750 switch with routing enabled VLAN 20 Host B VLAN 30 8321611-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Using Interface Configuration Mode • Stack member number—The number used to identify the switch within the stack. The switch number ranges from 1 to 9 and is assigned the first time the switch initializes. The default switch number, before it is integrated into a switch stack, is 1; when a switch has been assigned a stack member number, it keeps that number until another is assigned to it. You can use the switch port LEDs in Stack mode to identify the stack member number of a switch. Note For information about stack member numbers, see the “Stack Member Numbers” section on page 5-6. • Module number—The module or slot number on the switch (always 0 on the Catalyst 3750 switch). • Port number—The interface number on the switch. The port numbers always begin at 1, starting at the left when facing the front of the switch, for example, fastethernet 1/0/1, fastethernet 1/ 0/2. If there is more than one media type (for example, 10/100 ports and Gigabit Ethernet ports), the port number starts again with the second media: gigabitethernet1/0/1, gigabitethernet 1/0/2. You can identify physical interfaces by physically checking the interface location on the switch. You can also use the IOS show privileged EXEC commands to display information about a specific interface or all the interfaces on the switch. The remainder of this chapter primarily provides physical interface configuration procedures. These are examples of identifying interfaces: • To configure 10/100/1000 port 4 on a standalone switch, enter this command: Switch(config)# interface gigabitethernet1/0/4 • To configure 10/100 port 4 on stack member 3, enter this command: Switch(config)# interface fastethernet3/0/4 If the switch has SFP modules, the numbering of these ports depends on the type of other interfaces on the switch. If the port type changes from Fast Ethernet to Gigabit Ethernet (SFP), the port numbers begin again from 1; if the port type remains Gigabit Ethernet, the port numbers continue consecutively. • To configure the first SFP port on stack member 1 with 24 10/100/1000 ports, enter this command: Switch(config)# interface gigabitethernet1/0/25 • To configure the first SFP port on stack member 1 with 24 10/100 ports, enter this command: Switch(config)# interface gigabitethernet1/0/1 Procedures for Configuring Interfaces These general instructions apply to all interface configuration processes. Step 1 Enter the configure terminal command at the privileged EXEC prompt: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# Step 2 Enter the interface global configuration command. Identify the interface type, the switch number, and the number of the connector. In this example, Gigabit Ethernet interface 0/1 on switch 1 is selected: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# 11-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Using Interface Configuration Mode Note You do not need to add a space between the interface type and interface number. For example, in the preceding line, you can specify either gigabitethernet 1/0/1, gigabitethernet1/0/1, gi 1/0/1, or gi1/0/1. Step 3 Follow each interface command with the interface configuration commands that the interface requires. The commands that you enter define the protocols and applications that will run on the interface. The commands are collected and applied to the interface when you enter another interface command or enter end to return to privileged EXEC mode. You can also configure a range of interfaces by using the interface range or interface range macro global configuration commands. Interfaces configured in a range must be the same type and must be configured with the same feature options. Step 4 After you configure an interface, verify its status by using the show privileged EXEC commands listed in the “Monitoring and Maintaining the Interfaces” section on page 11-21. Enter the show interfaces privileged EXEC command to see a list of all interfaces on or configured for the switch. A report is provided for each interface that the device supports or for the specified interface. Configuring a Range of Interfaces You can use the interface range global configuration command to configure multiple interfaces with the same configuration parameters. When you enter the interface range configuration mode, all command parameters that you enter are attributed to all interfaces within that range until you exit this mode. Beginning in privileged EXEC mode, follow these steps to configure a range of interfaces with the same parameters: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface range {port-range | macro macro_name} Enter interface range configuration mode by entering the range of interfaces (VLANs or physical ports) to be configured. • You can use the interface range command to configure up to five port ranges or a previously defined macro. • The macro variable is explained in the “Configuring and Using Interface Range Macros” section on page 11-10. • In a comma-separated port-range, you must enter the interface type for each entry and enter spaces before and after the comma. • In a hyphen-separated port-range, you do not need to re-enter the interface type, but you must enter a space before the hyphen. Step 3 You can now use the normal configuration commands to apply the configuration parameters to all interfaces in the range. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces [interface-id] Verify the configuration of the interfaces in the range. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.11-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Using Interface Configuration Mode When using the interface range global configuration command, note these guidelines: • Valid entries for port-range: – vlan vlan-ID - vlan-ID, where VLAN ID is from 1 to 4094 – fastethernet switch/module/{first port} - {last port}, where switch is the switch number and the module is 0 – gigabitethernet switch/module/{first port} - {last port}, where switch is the switch number and the module is 0 – port-channel port-channel-number - port-channel-number, where port-channel-number is from 1 to 12 Note When you use the interface range command with port channels, the first and last port channel number must be active port channels. • You must add a space between the first interface number and the hyphen when using the interface range command. For example, the command interface range gigabitethernet 1/0/1 - 5 is a valid range; the command interface range gigabitethernet 1/0/1-5 is not a valid range. • The interface range command only works with VLAN interfaces that have been configured with the interface vlan command. The show running-config privileged EXEC command displays the configured VLAN interfaces. VLAN interfaces not displayed by the show running-config command cannot be used with the interface range command. • All interfaces defined as in a range must be the same type (all Fast Ethernet ports, all Gigabit Ethernet ports, all EtherChannel ports, or all VLANs), but you can enter multiple ranges in a command. This example shows how to use the interface range global configuration command to set the speed on 10/100/1000 interfaces 0/1 to 0/5 on switch 1 to 100 Mbps: Switch# configure terminal Switch(config)# interface range gigabitethernet1/0/1 - 5 Switch(config-if-range)# speed 100 This example shows how to use a comma to add different interface type strings to the range to enable Fast Ethernet interfaces in the range 0/1 to 0/3 on switch 1 and Gigabit Ethernet interfaces 0/1 and 0/2 on switch 2 to receive flow control pause frames: Switch# configure terminal Switch(config)# interface range fastethernet1/0/1 - 3 , gigabitethernet2/0/1 - 2 Switch(config-if-range)# flowcontrol receive on If you enter multiple configuration commands while you are in interface range mode, each command is executed as it is entered. The commands are not batched together and executed after you exit interface range mode. If you exit interface range configuration mode while the commands are being executed, some commands might not be executed on all interfaces in the range. Wait until the command prompt reappears before exiting interface range configuration mode.11-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Using Interface Configuration Mode Configuring and Using Interface Range Macros You can create an interface range macro to automatically select a range of interfaces for configuration. Before you can use the macro keyword in the interface range macro global configuration command string, you must use the define interface-range global configuration command to define the macro. Beginning in privileged EXEC mode, follow these steps to define an interface range macro: Use the no define interface-range macro_name global configuration command to delete a macro. When using the define interface-range global configuration command, note these guidelines: • Valid entries for interface-range: – vlan vlan-ID - vlan-ID, where VLAN ID is from 1 to 4094 – fastethernet switch/module/{first port} - {last port}, where switch is the switch number and the module is 0 – gigabitethernet switch/module/{first port} - {last port}, where switch is the switch number and the module is 0 – port-channel port-channel-number - port-channel-number, where port-channel-number is from 1 to12. Note When you use the interface ranges with port channels, the first and last port channel number must be active port channels. • You must add a space between the first interface number and the hyphen when entering an interface-range. For example, gigabitethernet 1/0/1 - 5 is a valid range; gigabitethernet 1/0/1-5 is not a valid range. • The VLAN interfaces must have been configured with the interface vlan command. The show running-config privileged EXEC command displays the configured VLAN interfaces. VLAN interfaces not displayed by the show running-config command cannot be used as interface-ranges. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 define interface-range macro_name interface-range Define the interface-range macro, and save it in NVRAM. • The macro_name is a 32-character maximum character string. • A macro can contain up to five comma-separated interface ranges. • Each interface-range must consist of the same port type. Step 3 interface range macro macro_name Select the interface range to be configured using the values saved in the interface-range macro called macro_name. You can now use the normal configuration commands to apply the configuration to all interfaces in the defined macro. Step 4 end Return to privileged EXEC mode. Step 5 show running-config | include define Show the defined interface range macro configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.11-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces • All interfaces defined as in a range must be the same type (all Fast Ethernet ports, all Gigabit Ethernet ports, all EtherChannel ports, or all VLANs), but you can combine multiple interface types in a macro. This example shows how to define an interface-range macro named enet_list to select Gigabit Ethernet ports 0/1 to 0/4 on switch 1 and to verify the macro configuration: Switch# configure terminal Switch(config)# define interface-range enet_list gigabitethernet1/0/1 - 4 Switch(config)# end Switch# show running-config | include define define interface-range enet_list GigabitEthernet1/0/1 - 4 This example shows how to create a multiple-interface macro named macro1: Switch# configure terminal Switch(config)# define interface-range macro1 gigabitethernet1/0/1 - 2, gigabitethernet2/0/5 - 7 Switch(config)# end This example shows how to enter interface range configuration mode for the interface-range macro enet_list: Switch# configure terminal Switch(config)# interface range macro enet_list Switch(config-if-range)# This example shows how to delete the interface-range macro enet_list and to verify that it was deleted. Switch# configure terminal Switch(config)# no define interface-range enet_list Switch(config)# end Switch# show run | include define Switch# Configuring Ethernet Interfaces These sections describe the default interface configuration and the optional features that you can configure on most physical interfaces: • Default Ethernet Interface Configuration, page 11-12 • Configuring Interface Speed and Duplex Mode, page 11-13 • Configuring IEEE 802.3X Flow Control, page 11-15 • Configuring Auto-MDIX on an Interface, page 11-16 • Adding a Description for an Interface, page 11-1711-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Default Ethernet Interface Configuration Table 11-1 shows the Ethernet interface default configuration, including some features that apply only to Layer 2 interfaces. For more details on the VLAN parameters listed in the table, see Chapter 12, “Configuring VLANs.” For details on controlling traffic to the port, see Chapter 19, “Configuring Port-Based Traffic Control.” Note To configure Layer 2 parameters, if the interface is in Layer 3 mode, you must enter the switchport interface configuration command without any parameters to put the interface into Layer 2 mode. This shuts down the interface and then re-enables it, which might generate messages on the device to which the interface is connected. Furthermore, when you use this command to put the interface into Layer 2 mode, you are deleting any Layer 3 characteristics configured on the interface. Table 11-1 Default Layer 2 Ethernet Interface Configuration Feature Default Setting Operating mode Layer 2 or switching mode (switchport command). Allowed VLAN range VLANs 1 – 4094. Default VLAN (for access ports) VLAN 1 (Layer 2 interfaces only). Native VLAN (for 802.1Q trunks) VLAN 1 (Layer 2 interfaces only). VLAN trunking Switchport mode dynamic auto (supports DTP) (Layer 2 interfaces only). Port enable state All ports are enabled. Port description None defined. Speed Autonegotiate. Duplex mode Autonegotiate. Flow control Flow control is set to receive: off. It is always off for sent packets. EtherChannel (PAgP) Disabled on all Ethernet ports. See Chapter 28, “Configuring EtherChannels.” Port blocking (unknown multicast and unknown unicast traffic) Disabled (not blocked) (Layer 2 interfaces only). See the “Configuring Port Blocking” section on page 19-5. Broadcast, multicast, and unicast storm control Disabled. See the “Default Storm Control Configuration” section on page 19-3. Protected port Disabled (Layer 2 interfaces only). See the “Configuring Protected Ports” section on page 19-4. Port security Disabled (Layer 2 interfaces only). See the “Default Port Security Configuration” section on page 19-9. L2 Port Fast Disabled. Auto-MDIX Disabled.11-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Configuring Interface Speed and Duplex Mode Ethernet interfaces on the switch operate at 10, 100, or 1000 Mbps and in either full- or half-duplex mode. In full-duplex mode, two stations can send and receive traffic at the same time. Normally, 10-Mbps ports operate in half-duplex mode, which means that stations can either receive or send traffic. Switch models include combinations of Fast Ethernet (10/100-Mbps) ports or Gigabit Ethernet (10/100/1000-Mbps) ports and small form-factor pluggable (SFP) module slots supporting Gigabit SFP modules. You can configure interface speed on Fast Ethernet (10/100-Mbps) and Gigabit Ethernet (10/100/1000-Mbps) interfaces. You can configure duplex mode to full, half, or autonegotiate on Fast Ethernet interfaces.You can configure Gigabit Ethernet interfaces to full-duplex mode or to autonegotiate; you cannot configure half-duplex mode on Gigabit Ethernet ports. Note You cannot configure speed or duplex mode on SFP ports, but you can configure speed to not negotiate (nonegotiate) if connected to a device that does not support autonegotiation. However, when a 1000BASE-T SFP module is in the SFP module port, you can configure speed as 10, 100, or 1000 Mbps, and you can configure duplex mode to auto or full. These sections describe how to configure the interface speed and duplex mode: • Configuration Guidelines, page 11-13 • Setting the Interface Speed and Duplex Parameters, page 11-14 Configuration Guidelines When configuring an interface speed and duplex mode, note these guidelines: • If both ends of the line support autonegotiation, we highly recommend the default setting of auto negotiation. • If one interface supports autonegotiation and the other end does not, configure duplex and speed on both interfaces; do not use the auto setting on the supported side. • For 10/100/1000 Mbps ports, if both the speed and duplex mode are set to specific values, autonegotiation is disabled. • For 10/100 Mbps ports, if both speed and duplex are set to specific values, the link operates at the negotiated speed and duplex value. • You cannot configure duplex mode on SFP module ports; they operate only in full-duplex mode. However, when a 1000BASE-T SFP module is inserted in an SFP module port, you can configure the duplex mode to full or auto and half-duplex mode is supported with the auto configuration. • You cannot configure speed on SFP module ports, except to nonegotiate. However, when a 1000BASE-T SFP module is in the SFP module port, the speed can be configured to 10, 100, 1000, or auto, but not nonegotiate. • When STP is enabled and a port is reconfigured, the switch can take up to 30 seconds to check for loops. The port LED is amber while STP reconfigures. Caution Changing the interface speed and duplex mode configuration might shut down and re-enable the interface during the reconfiguration.11-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Setting the Interface Speed and Duplex Parameters Beginning in privileged EXEC mode, follow these steps to set the speed and duplex mode for a physical interface: Use the no speed and no duplex interface configuration commands to return the interface to the default speed and duplex settings (autonegotiate). To return all interface settings to the defaults, use the default interface interface-id interface configuration command. This example shows how to set the interface speed to 10 Mbps and the duplex mode to half on FastEthernet interface 0/3 on switch 1: Switch# configure terminal Switch(config)# interface fasttethernet1/0/3 Switch(config-if)# speed 10 Switch(config-if)# duplex half Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode and the physical interface identification. Step 3 speed {10 | 100 | 1000 | auto | nonegotiate} Enter the appropriate speed parameter for the interface: • Enter 10, 100, or 1000 to set a specific speed for the interface. The 1000 keyword is available only for 10/100/1000 Mbps ports. • Enter auto to enable the interface to autonegotiate speed with the device connected to the interface. • The nonegotiate keyword is available only for SFP module ports. SFP module ports operate only at 1000 Mbps but can be configured to not negotiate if connected to a device that does not support autonegotiation. Note When a 1000BASE-T SFP module is in the SFP module port, the speed can be configured to 10, 100, 1000, or auto, but not nonegotiate. Step 4 duplex {auto | full | half} Enter the duplex parameter for the interface. You cannot configure Gigabit Ethernet interfaces to operate in half-duplex mode. This command is not available on SFP module ports unless a 1000BASE-T SFP module is inserted, when the mode can then be configured to auto or full. Step 5 end Return to privileged EXEC mode. Step 6 show interfaces interface-id Display the interface speed and duplex mode configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.11-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Configuring IEEE 802.3X Flow Control Flow control enables connected Ethernet ports to control traffic rates during congestion by allowing congested nodes to pause link operation at the other end. If one port experiences congestion and cannot receive any more traffic, it notifies the other port to stop sending until the condition clears by sending a pause frame. Upon receipt of a pause frame, the sending device stops sending any data packets, which prevents any loss of data packets during the congestion period. Note Catalyst 3750 ports are capable of receiving, but not sending, pause frames. Yo u u s e th e flowcontrol interface configuration command to set the interface’s ability to receive pause frames to on, off, or desired. The default state is off. When set to desired, an interface can operate with an attached device that is required to send flow-control packets or with an attached device that is not required to but can send flow-control packets. These rules apply to flow control settings on the device: • receive on (or desired): The port cannot send pause frames but can operate with an attached device that is required to or can send pause frames; the port can receive pause frames. • receive off: Flow control does not operate in either direction. In case of congestion, no indication is given to the link partner, and no pause frames are sent or received by either device. Note For details on the command settings and the resulting flow control resolution on local and remote ports, refer to the flowcontrol interface configuration command in the command reference for this release. Beginning in privileged EXEC mode, follow these steps to configure flow control on an interface: To disable flow control, use the flowcontrol receive off interface configuration command. This example shows how to turn on flow control on Gigabit Ethernet interface 0/1 on switch 1: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# flowcontrol receive on Switch(config-if)# end Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 interface interface-id Enter interface configuration mode and the physical interface to be configured. Step 3 flowcontrol {receive} {on | off | desired} Configure the flow control mode for the port. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id Verify the interface flow control settings. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.11-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Configuring Auto-MDIX on an Interface When automatic media dependent interface crossover (Auto-MDIX) is enabled on an interface, the interface automatically detects the required cable connection type (straight through or crossover) and configures the connection appropriately. When connecting switches without the Auto-MDIX feature, you must use straight-through cables to connect to devices such as servers, workstations, or routers and crossover cables to connect to other switches or repeaters. With Auto-MDIX enabled, you can use either type of cable to connect to other devices, and the interface automatically corrects for any incorrect cabling. For more information about cabling requirements, refer to the hardware installation guide. Auto-MDIX is disabled by default. When you enable Auto-MDIX, you must also set the speed and duplex on the interface to auto in order for the feature to operate correctly. Auto-MDIX is supported on all 10/100 and 10/100/1000 Mbps interfaces and on 10/100/1000 BASE-T/TX SFP interfaces. It is not supported on 1000 Base SX or LX SFP interfaces Table 11-2 shows the link states that results from auto-MDIX settings and correct and incorrect cabling. Beginning in privileged EXEC mode, follow these steps to configure Auto-MDIX on an interface: To disable Auto-MDIX, use the no mdix auto interface configuration command. This example shows how to enable Auto-MDIX on Gigabit Ethernet interface 0/1 on switch 1: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# speed auto Switch(config-if)# duplex auto Switch(config-if)# mdix auto Switch(config-if)# end Table 11-2 Link Conditions and Auto-MDIX Settings Local Side Auto-MDIX Remote Side Auto-MDIX With Correct Cabling With Incorrect Cabling On On Link up Link up On Off Link up Link up Off On Link up Link up Off Off Link up Link down Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 interface interface-id Enter interface configuration mode for the physical interface to be configured. Step 3 speed auto Configure the interface to autonegotiate speed with the connected device. Step 4 duplex auto Configure the interface to autonegotiate duplex mode with the connected device. Step 5 mdix auto Enable Auto-MDIX on the interface. Step 6 end Return to privileged EXEC mode. Step 7 show controllers ethernet-controller interface-id phy Verify the operational state of the Auto-MDIX feature on the interface. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.11-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Ethernet Interfaces Adding a Description for an Interface You can add a description about an interface to help you remember its function. The description appears in the output of these privileged EXEC commands: show configuration, show running-config, and show interfaces. Beginning in privileged EXEC mode, follow these steps to add a description for an interface: Use the no description interface configuration command to delete the description. This example shows how to add a description on Gigabit Ethernet interface 1/0/3 and to verify the description: Switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# description Connects to Marketing Switch(config-if)# end Switch# show interfaces gigabitethernet1/0/3 description Interface Status Protocol Description Gi1/0/3 admin down down Connects to Marketing Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the interface for which you are adding a description. Step 3 description string Add a description (up to 240 characters) for an interface. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id description or show running-config Verify your entry. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.11-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring Layer 3 Interfaces Configuring Layer 3 Interfaces The Catalyst 3750 switch supports these types of Layer 3 interfaces: • SVIs: You should configure SVIs for any VLANs for which you want to route traffic. SVIs are created when you enter a VLAN ID following the interface vlan global configuration command. To delete an SVI, use the no interface vlan global configuration command. Note When you create an SVI, it does not become active until it is associated with a physical port. For information about assigning Layer 2 ports to VLANs, see Chapter 12, “Configuring VLANs.” • Routed ports: Routed ports are physical ports configured to be in Layer 3 mode by using the no switchport interface configuration command. • Layer 3 EtherChannel ports: EtherChannel interfaces made up of routed ports. EtherChannel port interfaces are described in Chapter 28, “Configuring EtherChannels.” A Layer 3 switch can have an IP address assigned to each routed port and SVI. There is no defined limit to the number of SVIs and routed ports that can be configured in a switch stack. However, the interrelationship between the number of SVIs and routed ports and the number of other features being configured might have an impact on CPU usage because of hardware limitations. If the switch is using maximum hardware resources, attempts to create a routed port or SVI have these results: • If you try to create a new routed port, the switch generates a message that there are not enough resources to convert the interface to a routed port, and the interface remains as a switchport. • If you try to create an extended-range VLAN, an error message is generated, and the extended-range VLAN is rejected. • If the switch is notified by VLAN Trunking Protocol (VTP) of a new VLAN, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state. • If the switch attempts to boot up with a configuration that has more VLANs and routed ports than hardware can support, the VLANs are created, but the routed ports are shut down, and the switch sends a message that this was due to insufficient hardware resources. All Layer 3 interfaces require an IP address to route traffic. This procedure shows how to configure an interface as a Layer 3 interface and how to assign an IP address to an interface. Note If the physical port is in Layer 2 mode (the default), you must enter the no switchport interface configuration command to put the interface into Layer 3 mode. Entering a no switchport command disables and then re-enables the interface, which might generate messages on the device to which the interface is connected. 11-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring the System MTU Beginning in privileged EXEC mode, follow these steps to configure a Layer 3 interface: To remove an IP address from an interface, use the no ip address interface configuration command. This example shows how to configure an interface as a routed port and to assign it an IP address: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# no switchport Switch(config-if)# ip address 192.20.135.21 255.255.255.0 Switch(config-if)# no shutdown Configuring the System MTU The default maximum transmission unit (MTU) size for frames received and transmitted on all interfaces on the switch stack is 1500 bytes. You can increase the MTU size for all interfaces operating at 10 or 100 Mbps by using the system mtu global configuration command. You can increase the MTU size to support jumbo frames on all Gigabit Ethernet interfaces by using the system mtu jumbo global configuration command. Gigabit Ethernet ports are not affected by the system mtu command; 10/100 ports are not affected by the system jumbo mtu command. You cannot set the MTU size for an individual interface; you set it for all 10/100 or all Gigabit Ethernet interfaces on the switch stack. When you change the MTU size, you must reset the switch before the new configuration takes effect. The size of frames that can be received by the switch CPU is limited to 1500 bytes, no matter what value was entered with the system mtu or system mtu jumbo commands. Although frames that are forwarded or routed typically are not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control traffic, SNMP, Telnet, or routing protocols. Note If Gigabit Ethernet interfaces are configured to accept frames greater than the 10/100 interfaces, jumbo frames ingressing on a Gigabit Ethernet interface and egressing on a 10/100 interface are dropped. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface {{fastethernet | gigabitethernet} interface-id} | {vlan vlan-id} | {port-channel port-channel-number} Enter interface configuration mode, and enter the interface to be configured as a Layer 3 interface. Step 3 no switchport For physical ports only, enter Layer 3 mode. Step 4 ip address ip_address subnet_mask Configure the IP address and IP subnet. Step 5 no shutdown Enable the interface. Step 6 end Return to privileged EXEC mode. Step 7 show interfaces [interface-id] show ip interface [interface-id] show running-config interface [interface-id] Verify the configuration. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.11-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Configuring the System MTU Beginning in privileged EXEC mode, follow these steps to change MTU size for all 10/100 or Gigabit Ethernet interfaces: If you enter a value that is outside the allowed range for the specific type of interface, the value is not accepted. Once the switch reloads, you can verify your settings by entering the show system mtu privileged EXEC command. This example shows how to set the maximum packet size for a Gigabit Ethernet port to 1800 bytes: Switch(config)# system jumbo mtu 1800 Switch(config)# exit Switch# reload This example shows the response when you try to set Gigabit Ethernet interfaces to an out-of-range number: Switch(config)# system mtu jumbo 2500 ^ % Invalid input detected at '^' marker. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 system mtu bytes (Optional) Change the MTU size for all 10/100 or 10/100/1000 interfaces on the switch stack. The range is from 1500 to 1546 bytes; the default is 1500 bytes. Step 3 system mtu jumbo bytes (Optional) Change the MTU size for all Gigabit Ethernet interfaces on the switch stack. The range is from 1500 to 9000 bytes; the default is 1500 bytes. Step 4 end Return to privileged EXEC mode. Step 5 copy running-config startup-config Save your entries in the configuration file. Step 6 reload Reload the operating system.11-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Monitoring and Maintaining the Interfaces Monitoring and Maintaining the Interfaces You can perform the tasks in these sections to monitor and maintain interfaces: • Monitoring Interface Status, page 11-21 • Clearing and Resetting Interfaces and Counters, page 11-22 • Shutting Down and Restarting the Interface, page 11-22 Monitoring Interface Status Commands entered at the privileged EXEC prompt display information about the interface, including the versions of the software and the hardware, the configuration, and statistics about the interfaces. Table 11-3 lists some of these interface monitoring commands. (You can display the full list of show commands by using the show ? command at the privileged EXEC prompt.) These commands are fully described in the Cisco IOS Interface Command Reference for Release 12.1. Table 11-3 Show Commands for Interfaces Command Purpose show interfaces [interface-id] Display the status and configuration of all interfaces or a specific interface. show interfaces interface-id status [err-disabled] Display interface status or a list of interfaces in an error-disabled state. show interfaces [interface-id] switchport Display administrative and operational status of switching (nonrouting) ports. You can use this command to determine if a port is in routing or switching mode. show interfaces [interface-id] description Display the description configured on an interface or all interfaces and the interface status. show ip interface [interface-id] Display the usability status of all interfaces configured for IP routing or the specified interface. show running-config interface [interface-id] Display the running configuration in RAM for the interface. show version Display the hardware configuration, software version, the names and sources of configuration files, and the boot images. show controllers ethernet-controller interface-id phy Verify the operational state of the Auto-MDIX feature on the interface.11-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 11 Configuring Interface Characteristics Monitoring and Maintaining the Interfaces Clearing and Resetting Interfaces and Counters Table 11-4 lists the privileged EXEC mode clear commands that you can use to clear counters and reset interfaces. To clear the interface counters shown by the show interfaces privileged EXEC command, use the clear counters privileged EXEC command. The clear counters command clears all current interface counters from the interface unless optional arguments are specified to clear only a specific interface type from a specific interface number. Note The clear counters privileged EXEC command does not clear counters retrieved by using Simple Network Management Protocol (SNMP), but only those seen with the show interface privileged EXEC command. Shutting Down and Restarting the Interface Shutting down an interface disables all functions on the specified interface and marks the interface as unavailable on all monitoring command displays. This information is communicated to other network servers through all dynamic routing protocols. The interface is not mentioned in any routing updates. Beginning in privileged EXEC mode, follow these steps to shut down an interface: Use the no shutdown interface configuration command to restart the interface. To verify that an interface is disabled, enter the show interfaces privileged EXEC command. A disabled interface is shown as administratively down in the show interface command display. Table 11-4 Clear Commands for Interfaces Command Purpose clear counters [interface-id] Clear interface counters. clear interface interface-id Reset the hardware logic on an interface. clear line [number | console 0 | vty number] Reset the hardware logic on an asynchronous serial line. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface {vlan vlan-id} | {{fastethernet | gigabitethernet} interface-id} | {port-channel port-channel-number} Select the interface to be configured. Step 3 shutdown Shut down an interface. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entry.C H A P T E R 12-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 12 Configuring VLANs This chapter describes how to configure normal-range VLANs (VLAN IDs 1 to 1005) and extended-range VLANs (VLAN IDs 1006 to 4094) on the Catalyst 3750 switch. It includes information about VLAN membership modes, VLAN configuration modes, VLAN trunks, and dynamic VLAN assignment from a VLAN Membership Policy Server (VMPS). Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. The chapter includes these sections: • Understanding VLANs, page 12-1 • Configuring Normal-Range VLANs, page 12-4 • Configuring Extended-Range VLANs, page 12-12 • Displaying VLANs, page 12-16 • Configuring VLAN Trunks, page 12-16 • Configuring VMPS, page 12-28 Understanding VLANs A VLAN is a switched network that is logically segmented by function, project team, or application, without regard to the physical locations of the users. VLANs have the same attributes as physical LANs, but you can group end stations even if they are not physically located on the same LAN segment. Any switch port can belong to a VLAN, and unicast, broadcast, and multicast packets are forwarded and flooded only to end stations in the VLAN. Each VLAN is considered a logical network, and packets destined for stations that do not belong to the VLAN must be forwarded through a router or a switch supporting fallback bridging, as shown in Figure 12-1. VLANs can be formed with ports across the stack. Because a VLAN is considered a separate logical network, it contains its own bridge Management Information Base (MIB) information and can support its own implementation of spanning tree. See Chapter 15, “Configuring STP.” Note Before you create VLANs, you must decide whether to use VLAN Trunking Protocol (VTP) to maintain global VLAN configuration for your network. For more information on VTP, see Chapter 13, “Configuring VTP.”12-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Understanding VLANs Figure 12-1 shows an example of VLANs segmented into logically defined networks. Figure 12-1 VLANs as Logically Defined Networks VLANs are often associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. Interface VLAN membership on the switch is assigned manually on an interface-by-interface basis. When you assign switch interfaces to VLANs by using this method, it is known as interface-based, or static, VLAN membership. Traffic between VLANs must be routed or fallback bridged. The switch can route traffic between VLANs by using switch virtual interfaces (SVIs). An SVI must be explicitly configured and assigned an IP address to route traffic between VLANs. For more information, see the “Switch Virtual Interfaces” section on page 11-4 and the “Configuring Layer 3 Interfaces” section on page 11-18. Note If you plan to configure many VLANs on the switch and to not enable routing, you can use the sdm prefer vlan global configuration command to set the Switch Database Management (sdm) feature to the VLAN template, which configures system resources to support the maximum number of unicast MAC addresses. For more information on the SDM templates, see Chapter 8, “Configuring SDM Templates,” or refer to the sdm prefer command in the command reference for this release. Floor 1 Floor 2 Engineering VLAN Cisco router Fast Ethernet Floor 3 Marketing VLAN Accounting VLAN 1675112-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Understanding VLANs Supported VLANs The switch supports 1005 VLANs in VTP client, server, and transparent modes. VLANs are identified with a number from 1 to 4094. VLAN IDs 1002 through 1005 are reserved for Token Ring and FDDI VLANs. VTP only learns normal-range VLANs, with VLAN IDs 1 to 1005; VLAN IDs greater than 1005 are extended-range VLANs and are not stored in the VLAN database. The switch must be in VTP transparent mode when you create VLAN IDs from 1006 to 4094. Although the switch stack supports a total of 1005 (normal-range and extended-range) VLANs, the number of routed ports, SVIs, and other configured features affects the use of the switch hardware. The switch supports per-VLAN spanning-tree plus (PVST+) or rapid PVST+ with a maximum of 128 spanning-tree instances. One spanning-tree instance is allowed per VLAN. See the “Normal-Range VLAN Configuration Guidelines” section on page 12-6 for more information about the number of spanning-tree instances and the number of VLANs. The switch supports both Inter-Switch Link (ISL) and IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports. VLAN Port Membership Modes You configure a port to belong to a VLAN by assigning a membership mode that determines the kind of traffic the port carries and the number of VLANs to which it can belong. Table 12-1 lists the membership modes and membership and VTP characteristics. Table 12-1 Port Membership Modes Membership Mode VLAN Membership Characteristics VTP Characteristics Static-access A static-access port can belong to one VLAN and is manually assigned to that VLAN. For more information, see the “Assigning Static-Access Ports to a VLAN” section on page 12-11. VTP is not required. If you do not want VTP to globally propagate information, set the VTP mode to transparent to disable VTP. To participate in VTP, there must be at least one trunk port on the switch stack connected to a trunk port of a second switch or switch stack. Trunk (ISL or IEEE 802.1Q) A trunk port is a member of all VLANs by default, including extended-range VLANs, but membership can be limited by configuring the allowed-VLAN list. You can also modify the pruning-eligible list to block flooded traffic to VLANs on trunk ports that are included in the list. For information about configuring trunk ports, see the “Configuring an Ethernet Interface as a Trunk Port” section on page 12-19. VTP is recommended but not required. VTP maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP exchanges VLAN configuration messages with other switches over trunk links.12-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs For more detailed definitions of the modes and their functions, see Table 12-4 on page 12-18. When a port belongs to a VLAN, the switch learns and manages the addresses associated with the port on a per-VLAN basis. For more information, see the “Managing the MAC Address Table” section on page 7-22. Configuring Normal-Range VLANs Normal-range VLANs are VLANs with VLAN IDs 1 to 1005. If the switch is in VTP server or transparent mode, you can add, modify or remove configurations for VLANs 2 to 1001 in the VLAN database. (VLAN IDs 1 and 1002 to 1005 are automatically created and cannot be removed.) Note When the switch is in VTP transparent mode, you can also create extended-range VLANs (VLANs with IDs from 1006 to 4094), but these VLANs are not saved in the VLAN database. See the “Configuring Extended-Range VLANs” section on page 12-12. Configurations for VLAN IDs 1 to 1005 are written to the file vlan.dat (VLAN database), and you can display them by entering the show vlan privileged EXEC command. The vlan.dat file is stored in nonvolatile RAM (NVRAM) on the stack master. Stack members have a vlan.dat file that is consistent with the stack master. Caution You can cause inconsistency in the VLAN database if you attempt to manually delete the vlan.dat file. If you want to modify the VLAN configuration, use the commands described in these sections and in the command reference for this release. To change the VTP configuration, see Chapter 13, “Configuring VTP.” Dynamic access A dynamic-access port can belong to one VLAN (VLAN ID 1 to 4094) and is dynamically assigned by a VMPS. The VMPS can be a Catalyst 5000 or Catalyst 6000 series switch, for example, but never a Catalyst 3750 switch. The Catalyst 3750 switch is a VMPS client. You can have dynamic-access ports and trunk ports on the same switch, but you must connect the dynamic-access port to an end station or hub and not to another switch. For configuration information, see the “Configuring Dynamic-Access Ports on VMPS Clients” section on page 12-31. VTP is required. Configure the VMPS and the client with the same VTP domain name. To participate in VTP, there must be at least one trunk port on the switch stack connected to a trunk port of a second switch or switch stack. Voice VLAN A voice VLAN port is an access port attached to a Cisco IP Phone, configured to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone. For more information about voice VLAN ports, see Chapter 14, “Configuring Voice VLAN.” VTP is not required; it has no affect on voice VLAN. Table 12-1 Port Membership Modes (continued) Membership Mode VLAN Membership Characteristics VTP Characteristics12-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs You use the interface configuration mode to define the port membership mode and to add and remove ports from VLANs. The results of these commands are written to the running-configuration file, and you can display the file by entering the show running-config privileged EXEC command. You can set these parameters when you create a new normal-range VLAN or modify an existing VLAN in the VLAN database: • VLAN ID • VLAN name • VLAN type (Ethernet, Fiber Distributed Data Interface [FDDI], FDDI network entity title [NET], TrBRF, or TrCRF, Token Ring, Token Ring-Net) • VLAN state (active or suspended) • Maximum transmission unit (MTU) for the VLAN • Security Association Identifier (SAID) • Bridge identification number for TrBRF VLANs • Ring number for FDDI and TrCRF VLANs • Parent VLAN number for TrCRF VLANs • Spanning Tree Protocol (STP) type for TrCRF VLANs • VLAN number to use when translating from one VLAN type to another Note This section does not provide configuration details for most of these parameters. For complete information on the commands and parameters that control VLAN configuration, refer to the command reference for this release. This section includes information about these topics about normal-range VLANs: • Token Ring VLANs, page 12-5 • Normal-Range VLAN Configuration Guidelines, page 12-6 • VLAN Configuration Mode Options, page 12-6 • Saving VLAN Configuration, page 12-7 • Default Ethernet VLAN Configuration, page 12-8 • Creating or Modifying an Ethernet VLAN, page 12-8 • Deleting a VLAN, page 12-10 • Assigning Static-Access Ports to a VLAN, page 12-11 Token Ring VLANs Although the switch does not support Token Ring connections, a remote device such as a Catalyst 5000 series switch with Token Ring connections could be managed from one of the supported switches. Switches running VTP version 2 advertise information about these Token Ring VLANs: • Token Ring TrBRF VLANs • Token Ring TrCRF VLANs For more information on configuring Token Ring VLANs, refer to the Catalyst 5000 Series Software Configuration Guide.12-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs Normal-Range VLAN Configuration Guidelines Follow these guidelines when creating and modifying normal-range VLANs in your network: • The switch supports 1005 VLANs in VTP client, server, and transparent modes. • Normal-range VLANs are identified with a number between 1 and 1001. VLAN numbers 1002 through 1005 are reserved for Token Ring and FDDI VLANs. • VLAN configuration for VLANs 1 to 1005 are always saved in the VLAN database. If VTP mode is transparent, VTP and VLAN configuration is also saved in the switch running configuration file. • The switch also supports VLAN IDs 1006 through 4094 in VTP transparent mode (VTP disabled). These are extended-range VLANs and configuration options are limited. Extended-range VLANs are not saved in the VLAN database. See the “Configuring Extended-Range VLANs” section on page 12-12. • Before you can create a VLAN, the switch must be in VTP server mode or VTP transparent mode. If the switch is a VTP server, you must define a VTP domain or VTP will not function. • The switch does not support Token Ring or FDDI media. The switch does not forward FDDI, FDDI-Net, TrCRF, or TrBRF traffic, but it does propagate the VLAN configuration through VTP. • The switch supports 128 spanning-tree instances. If a switch has more active VLANs than supported spanning-tree instances, spanning tree can be enabled on 128 VLANs and is disabled on the remaining VLANs. If you have already used all available spanning-tree instances on a switch, adding another VLAN anywhere in the VTP domain creates a VLAN on that switch that is not running spanning-tree. If you have the default allowed list on the trunk ports of that switch (which is to allow all VLANs), the new VLAN is carried on all trunk ports. Depending on the topology of the network, this could create a loop in the new VLAN that would not be broken, particularly if there are several adjacent switches that all have run out of spanning-tree instances. You can prevent this possibility by setting allowed lists on the trunk ports of switches that have used up their allocation of spanning-tree instances. • When a switch in a stack learns a new VLAN or deletes or modifies an existing VLAN (either through VTP over network ports or through the CLI), the VLAN information is communicated to all stack members. • When a switch joins a stack or when stacks merge, VTP information (the vlan.dat file) on the new switches will be consistent with the stack master. VLAN Configuration Mode Options You can configure normal-range VLANs (with VLAN IDs 1 to 1005) by using these two configuration modes: • VLAN Configuration in config-vlan Mode, page 12-7 You access config-vlan mode by entering the vlan vlan-id global configuration command. • VLAN Configuration in VLAN Database Configuration Mode, page 12-7 You access VLAN database configuration mode by entering the vlan database privileged EXEC command.12-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs VLAN Configuration in config-vlan Mode To access config-vlan mode, enter the vlan global configuration command with a VLAN ID. Enter a new VLAN ID to create a VLAN, or enter an existing VLAN ID to modify the VLAN. You can use the default VLAN configuration (Table 12-2) or enter multiple commands to configure the VLAN. For more information about commands available in this mode, refer to the vlan global configuration command description in the command reference for this release. When you have finished the configuration, you must exit config-vlan mode for the configuration to take effect. To display the VLAN configuration, enter the show vlan privileged EXEC command. You must use this config-vlan mode when creating extended-range VLANs (VLAN IDs greater than 1005). See the “Configuring Extended-Range VLANs” section on page 12-12. VLAN Configuration in VLAN Database Configuration Mode To access VLAN database configuration mode, enter the vlan database privileged EXEC command. Then enter the vlan command with a new VLAN ID to create a VLAN, or enter an existing VLAN ID to modify the VLAN. You can use the default VLAN configuration (Table 12-2) or enter multiple commands to configure the VLAN. For more information about keywords available in this mode, refer to the vlan VLAN database configuration command description in the command reference for this release. When you have finished the configuration, you must enter apply or exit for the configuration to take effect. When you enter the exit command, it applies all commands and updates the VLAN database. VTP messages are sent to other switches in the VTP domain, and the privileged EXEC mode prompt appears. Saving VLAN Configuration The configurations of VLAN IDs 1 to 1005 are always saved in the VLAN database (vlan.dat file). If VTP mode is transparent, they are also saved in the switch running configuration file and you can enter the copy running-config startup-config privileged EXEC command to save the configuration in the startup configuration file. You can use the show running-config vlan privileged EXEC command to display the switch running configuration file. In a switch stack, the whole stack uses the same vlan.dat file and running configuration. To display the VLAN configuration, enter the show vlan privileged EXEC command. When you save VLAN and VTP information (including extended-range VLAN configuration information) in the startup configuration file and reboot the switch, the switch configuration is determined as follows: • If the VTP mode is transparent in the startup configuration, and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database. • If the VTP mode or domain name in the startup configuration does not match the VLAN database, the domain name and VTP mode and configuration for the first 1005 VLANs use the VLAN database information. • If VTP mode is server, the domain name and VLAN configuration for the first 1005 VLANs use the VLAN database information Caution If the VLAN database configuration is used at startup and the startup configuration file contains extended-range VLAN configuration, this information is lost when the system boots up. 12-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs Default Ethernet VLAN Configuration Table 12-2 shows the default configuration for Ethernet VLANs. Note The switch supports Ethernet interfaces exclusively. Because FDDI and Token Ring VLANs are not locally supported, you only configure FDDI and Token Ring media-specific characteristics for VTP global advertisements to other switches. Creating or Modifying an Ethernet VLAN Each Ethernet VLAN in the VLAN database has a unique, 4-digit ID that can be a number from 1 to 1001. VLAN IDs 1002 to 1005 are reserved for Token Ring and FDDI VLANs. To create a normal-range VLAN to be added to the VLAN database, assign a number and name to the VLAN. Note When the switch is in VTP transparent mode, you can assign VLAN IDs greater than 1006, but they are not added to the VLAN database. See the “Configuring Extended-Range VLANs” section on page 12-12. For the list of default parameters that are assigned when you add a VLAN, see the “Configuring Normal-Range VLANs” section on page 12-4. Table 12-2 Ethernet VLAN Defaults and Ranges Parameter Default Range VLAN ID 1 1 to 4094. Note Extended-range VLANs (VLAN IDs 1006 to 4094) are not saved in the VLAN database. VLAN name VLANxxxx, where xxxx represents four numeric digits (including leading zeros) equal to the VLAN ID number No range 802.10 SAID 100001 (100000 plus the VLAN ID) 1–4294967294 MTU size 1500 1500–18190 Translational bridge 1 0 0–1005 Translational bridge 2 0 0–1005 VLAN state active active, suspend Remote SPAN disabled enabled, disabled12-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs Beginning in privileged EXEC mode, follow these steps to use config-vlan mode to create or modify an Ethernet VLAN: To return the VLAN name to the default settings, use the no name, no mtu, or no remote-span config-vlan commands. This example shows how to use config-vlan mode to create Ethernet VLAN 20, name it test20, and add it to the VLAN database: Switch# configure terminal Switch(config)# vlan 20 Switch(config-vlan)# name test20 Switch(config-vlan)# end You can also create or modify Ethernet VLANs by using the VLAN database configuration mode. Note VLAN database configuration mode does not support RSPAN VLAN configuration or extended-range VLANs. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vlan vlan-id Enter a VLAN ID, and enter config-vlan mode. Enter a new VLAN ID to create a VLAN, or enter an existing VLAN ID to modify a VLAN. Note The available VLAN ID range for this command is 1 to 4094. For information about adding VLAN IDs greater than 1005 (extended-range VLANs), see the “Configuring Extended-Range VLANs” section on page 12-12. Step 3 name vlan-name (Optional) Enter a name for the VLAN. If no name is entered for the VLAN, the default is to append the vlan-id with leading zeros to the word VLAN. For example, VLAN0004 is a default VLAN name for VLAN 4. Step 4 mtu mtu-size (Optional) Change the MTU size (or other VLAN characteristic). Step 5 remote-span (Optional) Configure the VLAN as the RSPAN VLAN for a remote SPAN session. For more information on remote SPAN, see Chapter 22, “Configuring SPAN and RSPAN.” Step 6 end Return to privileged EXEC mode. Step 7 show vlan {name vlan-name | id vlan-id} Verify your entries. Step 8 copy running-config startup config (Optional) If the switch is in VTP transparent mode, the VLAN configuration is saved in the running configuration file as well as in the VLAN database. This saves the configuration in the switch startup configuration file. 12-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs Beginning in privileged EXEC mode, follow these steps to use VLAN database configuration mode to create or modify an Ethernet VLAN: To return the VLAN name to the default settings, use the no vlan vlan-id name or no vlan vlan-id mtu VLAN database configuration command. This example shows how to use VLAN configuration mode to create Ethernet VLAN 20, name it test20, and add it to the VLAN database: Switch# vlan database Switch(vlan)# vlan 20 name test20 Switch(vlan)# exit APPLY completed. Exiting.... Deleting a VLAN When you delete a VLAN from a switch that is in VTP server mode, the VLAN is removed from the VLAN database for all switches in the VTP domain. When you delete a VLAN from a switch that is in VTP transparent mode, the VLAN is deleted only on that specific switch stack. You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005. Caution When you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN. Command Purpose Step 1 vlan database Enter VLAN database configuration mode. Step 2 vlan vlan-id name vlan-name Add an Ethernet VLAN by assigning a number to it. The range is 1 to 1001. You can create or modify a range of consecutive VLANs by entering vlan first-vlan-id end last-vlan-id. Note When entering a VLAN ID in VLAN database configuration mode, do not enter leading zeros. If no name is entered for the VLAN, the default is to append the vlan-id with leading zeros to the word VLAN. For example, VLAN0004 is a default VLAN name for VLAN 4. Step 3 vlan vlan-id mtu mtu-size (Optional) To modify a VLAN, identify the VLAN and change a characteristic, such as the MTU size. Step 4 exit Update the VLAN database, propagate it throughout the administrative domain, and return to privileged EXEC mode. Step 5 show vlan {name vlan-name | id vlan-id} Verify your entries. Step 6 copy running-config startup config (Optional) If the switch is in VTP transparent mode, the VLAN configuration is saved in the running configuration file as well as in the VLAN database. This saves the configuration in the switch startup configuration file. 12-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Normal-Range VLANs Beginning in privileged EXEC mode, follow these steps to delete a VLAN on the switch by using global configuration mode: To delete a VLAN by using VLAN database configuration mode, use the vlan database privileged EXEC command to enter VLAN database configuration mode and the no vlan vlan-id VLAN database configuration command. Assigning Static-Access Ports to a VLAN You can assign a static-access port to a VLAN without having VTP globally propagate VLAN configuration information by disabling VTP (VTP transparent mode). If you are assigning a port on a cluster member switch to a VLAN, first use the rcommand privileged EXEC command to log in to the cluster member switch. Note If you assign an interface to a VLAN that does not exist, the new VLAN is created. (See the “Creating or Modifying an Ethernet VLAN” section on page 12-8.) Beginning in privileged EXEC mode, follow these steps to assign a port to a VLAN in the VLAN database: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no vlan vlan-id Remove the VLAN by entering the VLAN ID. Step 3 end Return to privileged EXEC mode. Step 4 show vlan brief Verify the VLAN removal. Step 5 copy running-config startup config (Optional) If the switch is in VTP transparent mode, the VLAN configuration is saved in the running configuration file as well as in the VLAN database. This saves the configuration in the switch startup configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 interface interface-id Enter the interface to be added to the VLAN. Step 3 switchport mode access Define the VLAN membership mode for the port (Layer 2 access port). Step 4 switchport access vlan vlan-id Assign the port to a VLAN. Valid VLAN IDs are 1 to 4094. Step 5 end Return to privileged EXEC mode. Step 6 show running-config interface interface-id Verify the VLAN membership mode of the interface. Step 7 show interfaces interface-id switchport Verify your entries in the Administrative Mode and the Access Mode VLAN fields of the display. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.12-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Extended-Range VLANs To return an interface to its default configuration, use the default interface interface-id interface configuration command. This example shows how to configure Gigabit Ethernet interface 0/1 on switch 2 as an access port in VLAN 2: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 2 Switch(config-if)# end Configuring Extended-Range VLANs When the switch is in VTP transparent mode (VTP disabled), you can create extended-range VLANs (in the range 1006 to 4094). Extended-range VLANs enable service providers to extend their infrastructure to a greater number of customers. The extended-range VLAN IDs are allowed for any switchport commands that allow VLAN IDs. You always use config-vlan mode (accessed by entering the vlan vlan-id global configuration command) to configure extended-range VLANs. The extended range is not supported in VLAN database configuration mode (accessed by entering the vlan database privileged EXEC command). Extended-range VLAN configurations are not stored in the VLAN database, but because VTP mode is transparent, they are stored in the switch running configuration file, and you can save the configuration in the startup configuration file by using the copy running-config startup-config privileged EXEC command. Note Although the switch supports 4094 VLAN IDs, see the “Supported VLANs” section on page 12-3 for the actual number of VLANs supported. This section includes this information about extended-range VLANs: • Default VLAN Configuration, page 12-12 • Extended-Range VLAN Configuration Guidelines, page 12-13 • Creating an Extended-Range VLAN, page 12-13 • Creating an Extended-Range VLAN with an Internal VLAN ID, page 12-15 Default VLAN Configuration See Table 12-2 on page 12-8 for the default configuration for Ethernet VLANs. You can change only the MTU size and remote SPAN configuration state on extended-range VLANs; all other characteristics must remain at the default state.12-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Extended-Range VLANs Extended-Range VLAN Configuration Guidelines Follow these guidelines when creating extended-range VLANs: • To add an extended-range VLAN, you must use the vlan vlan-id global configuration command and access config-vlan mode. You cannot add extended-range VLANs in VLAN database configuration mode (accessed by entering the vlan database privileged EXEC command). • VLAN IDs in the extended range are not saved in the VLAN database and are not recognized by VTP. • You cannot include extended-range VLANs in the pruning eligible range. • The switch must be in VTP transparent mode when you create extended-range VLANs. If VTP mode is server or client, an error message is generated, and the extended-range VLAN is rejected. • You can set the VTP mode to transparent in global configuration mode or in VLAN database configuration mode. See the “Disabling VTP (VTP Transparent Mode)” section on page 13-12. You should save this configuration to the startup configuration so that the switch boots up in VTP transparent mode. Otherwise, you lose the extended-range VLAN configuration if the switch resets. • STP is enabled by default on extended-range VLANs, but you can disable it by using the no spanning-tree vlan vlan-id global configuration command. When the maximum number of spanning-tree instances (128) are on the switch, spanning tree is disabled on any newly created VLANs. • Each routed port on the switch creates an internal VLAN for its use. These internal VLANs use extended-range VLAN numbers, and the internal VLAN ID cannot be used for an extended-range VLAN. If you try to create an extended-range VLAN with a VLAN ID that is already allocated as an internal VLAN, an error message is generated, and the command is rejected. – Because internal VLAN IDs are in the lower part of the extended range, we recommend that you create extended-range VLANs beginning from the highest number (4094) and moving to the lowest (1006) to reduce the possibility of using an internal VLAN ID. – Before configuring extended-range VLANs, enter the show vlan internal usage privileged EXEC command to see which VLANs have been allocated as internal VLANs. – If necessary, you can shut down the routed port assigned to the internal VLAN, which frees up the internal VLAN, and then create the extended-range VLAN and re-enable the port, which then uses another VLAN as its internal VLAN. See the “Creating an Extended-Range VLAN with an Internal VLAN ID” section on page 12-15. • Although the switch stack supports a total of 1005 (normal-range and extended-range) VLANs, the number of routed ports, SVIs, and other configured features affects the use of the switch hardware. If you try to create an extended-range VLAN and there are not enough hardware resources available, an error message is generated, and the extended-range VLAN is rejected. • In a switch stack, the whole stack uses the same running configuration and saved configuration, and extended-range VLAN information is shared across the stack. Creating an Extended-Range VLAN You create an extended-range VLAN in global configuration mode by entering the vlan global configuration command with a VLAN ID from 1006 to 4094. This command accesses the config-vlan mode. The extended-range VLAN has the default Ethernet VLAN characteristics (see Table 12-2) and the MTU size and RSPAN configuration are the only parameters you can change. Refer to the description of the vlan global configuration command in the command reference for defaults of all parameters. If 12-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Extended-Range VLANs you enter an extended-range VLAN ID when the switch is not in VTP transparent mode, an error message is generated when you exit from config-vlan mode, and the extended-range VLAN is not created. Extended-range VLANs are not saved in the VLAN database; they are saved in the switch running configuration file. You can save the extended-range VLAN configuration in the switch startup configuration file by using the copy running-config startup-config privileged EXEC command. Note Before you create an extended-range VLAN, you can verify that the VLAN ID is not used internally by entering the show vlan internal usage privileged EXEC command. If the VLAN ID is used internally and you want to free it up, go to the“Creating an Extended-Range VLAN with an Internal VLAN ID” section on page 12-15 before creating the extended-range VLAN. Beginning in privileged EXEC mode, follow these steps to create an extended-range VLAN: To delete an extended-range VLAN, use the no vlan vlan-id global configuration command. The procedure for assigning static-access ports to an extended-range VLAN is the same as for normal-range VLANs. See the “Assigning Static-Access Ports to a VLAN” section on page 12-11. This example shows how to create a new extended-range VLAN with all default characteristics, enter config-vlan mode, and save the new VLAN in the switch startup configuration file: Switch(config)# vtp mode transparent Switch(config)# vlan 2000 Switch(config-vlan)# end Switch# copy running-config startup config Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp mode transparent Configure the switch for VTP transparent mode, disabling VTP. Step 3 vlan vlan-id Enter an extended-range VLAN ID and enter config-vlan mode. The range is 1006 to 4094. Step 4 mtu mtu-size (Optional) Modify the VLAN by changing the MTU size. Note Although all VLAN commands appear in the CLI help in config-vlan mode, only the mtu mtu-size and remote-span commands are supported for extended-range VLANs. Step 5 remote-span (Optional) Configure the VLAN as the RSPAN VLAN. See the “Configuring a VLAN as an RSPAN VLAN” section on page 22-18. Step 6 end Return to privileged EXEC mode. Step 7 show vlan id vlan-id Verify that the VLAN has been created. Step 8 copy running-config startup config Save your entries in the switch startup configuration file. To save extended-range VLAN configurations, you need to save the VTP transparent mode configuration and the extended-range VLAN configuration in the switch startup configuration file. Otherwise, if the switch resets, it will default to VTP server mode, and the extended-range VLAN IDs will not be saved.12-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring Extended-Range VLANs Creating an Extended-Range VLAN with an Internal VLAN ID If you enter an extended-range VLAN ID that is already assigned to an internal VLAN, an error message is generated, and the extended-range VLAN is rejected. To manually free an internal VLAN ID, you must temporarily shut down the routed port that is using the internal VLAN ID. Beginning in privileged EXEC mode, follow these steps to release a VLAN ID that is assigned to an internal VLAN and to create an extended-range VLAN with that ID: Command Purpose Step 1 show vlan internal usage Display the VLAN IDs being used internally by the switch. If the VLAN ID that you want to use is an internal VLAN, the display shows the routed port that is using the VLAN ID. Enter that port number in Step 3. Step 2 configure terminal Enter global configuration mode. Step 3 interface interface-id Enter the interface ID for the routed port that is using the VLAN ID. Step 4 shutdown Shut down the port to free the internal VLAN ID. Step 5 exit Return to global configuration mode. Step 6 vtp mode transparent Set the VTP mode to transparent for creating extended-range VLANs. Step 7 vlan vlan-id Enter the new extended-range VLAN ID, and enter config-vlan mode. Step 8 exit Exit from config-vlan mode, and return to global configuration mode. Step 9 interface interface-id Enter the interface ID for the routed port that you shut down in Step 4. Step 10 no shutdown Re-enable the routed port. It will be assigned a new internal VLAN ID. Step 11 end Return to privileged EXEC mode. Step 12 copy running-config startup config Save your entries in the switch startup configuration file. To save an extended-range VLAN configuration, you need to save the VTP transparent mode configuration and the extended-range VLAN configuration in the switch startup configuration file. Otherwise, if the switch resets, it will default to VTP server mode, and the extended-range VLAN IDs will not be saved.12-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Displaying VLANs Displaying VLANs Use the show vlan privileged EXEC command to display a list of all VLANs on the switch, including extended-range VLANs. The display includes VLAN status, ports, and configuration information. To view normal-range VLANs in the VLAN database (1 to 1005), use the show VLAN database configuration command (accessed by entering the vlan database privileged EXEC command). For a list of the VLAN IDs on the switch, use the show running-config vlan privileged EXEC command, optionally entering a VLAN ID range. Table 12-3 lists the commands for monitoring VLANs. For more details about the show command options and explanations of output fields, refer to the command reference for this release. Configuring VLAN Trunks These sections describe how VLAN trunks function on the switch: • Trunking Overview, page 12-16 • Encapsulation Types, page 12-18 • Default Layer 2 Ethernet Interface VLAN Configuration, page 12-19 • Configuring an Ethernet Interface as a Trunk Port, page 12-19 • Configuring Trunk Ports for Load Sharing, page 12-24 Trunking Overview A trunk is a point-to-point link between one or more Ethernet switch interfaces and another networking device such as a router or a switch. Ethernet trunks carry the traffic of multiple VLANs over a single link, and you can extend the VLANs across an entire network. Two trunking encapsulations are available on all Ethernet interfaces: • Inter-Switch Link (ISL)—ISL is Cisco-proprietary trunking encapsulation. • 802.1Q—802.1Q is industry-standard trunking encapsulation. Table 12-3 VLAN Monitoring Commands Command Command Mode Purpose show VLAN database configuration Display status of VLANs in the VLAN database. show current [vlan-id] VLAN database configuration Display status of all or the specified VLAN in the VLAN database. show interfaces [vlan vlan-id] Privileged EXEC Display characteristics for all interfaces or for the specified VLAN configured on the switch. show running-config vlan Privileged EXEC Display all or a range of VLANs on the switch. show vlan [id vlan-id] Privileged EXEC Display parameters for all VLANs or the specified VLAN on the switch.12-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Figure 12-2 shows a network of switches that are connected by ISL trunks. Figure 12-2 Switches in an ISL Trunking Environment You can configure a trunk on a single Ethernet interface or on an EtherChannel bundle. For more information about EtherChannel, see Chapter 28, “Configuring EtherChannels.” Ethernet trunk interfaces support different trunking modes (see Table 12-4). You can set an interface as trunking or nontrunking or to negotiate trunking with the neighboring interface. To autonegotiate trunking, the interfaces must be in the same VTP domain. Trunk negotiation is managed by the Dynamic Trunking Protocol (DTP), which is a Point-to-Point Protocol. However, some internetworking devices might forward DTP frames improperly, which could cause misconfigurations. To avoid this, you should configure interfaces connected to devices that do not support DTP to not forward DTP frames, that is, to turn off DTP. • If you do not intend to trunk across those links, use the switchport mode access interface configuration command to disable trunking. • To enable trunking to a device that does not support DTP, use the switchport mode trunk and switchport nonegotiate interface configuration commands to cause the interface to become a trunk but to not generate DTP frames. Use the switchport trunk encapsulation isl or switchport trunk encapsulation dot1q interface to select the encapsulation type on the trunk port. You can also specify on DTP interfaces whether the trunk uses ISL or 802.1Q encapsulation or if the encapsulation type is autonegotiated. The DTP supports autonegotiation of both ISL and 802.1Q trunks. Catalyst 6000 ser ies swi tch Swi tch Swi tch Swi tch Swi tch VLAN2 VLAN1 VLAN3 VLAN1 VLAN2 VLAN3 ISL t runk ISL t runk ISL t runk ISL t runk 4582812-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Encapsulation Types Table 12-5 lists the Ethernet trunk encapsulation types and keywords. Note The switch does not support Layer 3 trunks; you cannot configure subinterfaces or use the encapsulation keyword on Layer 3 interfaces. The switch does support Layer 2 trunks and Layer 3 VLAN interfaces, which provide equivalent capabilities. The trunking mode, the trunk encapsulation type, and the hardware capabilities of the two connected interfaces determine whether a link becomes an ISL or 802.1Q trunk. Table 12-4 Layer 2 Interface Modes Mode Function switchport mode access Puts the interface (access port) into permanent nontrunking mode and negotiates to convert the link into a nontrunk link. The interface becomes a nontrunk interface regardless of whether or not the neighboring interface is a trunk interface. switchport mode dynamic auto Makes the interface able to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk or desirable mode. The default switchport mode for all Ethernet interfaces is dynamic auto. switchport mode dynamic desirable Makes the interface actively attempt to convert the link to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode. switchport mode trunk Puts the interface into permanent trunking mode and negotiates to convert the neighboring link into a trunk link. The interface becomes a trunk interface even if the neighboring interface is not a trunk interface. switchport nonegotiate Prevents the interface from generating DTP frames. You can use this command only when the interface switchport mode is access or trunk. You must manually configure the neighboring interface as a trunk interface to establish a trunk link. Table 12-5 Ethernet Trunk Encapsulation Types Encapsulation Function switchport trunk encapsulation isl Specifies ISL encapsulation on the trunk link. switchport trunk encapsulation dot1q Specifies 802.1Q encapsulation on the trunk link. switchport trunk encapsulation negotiate Specifies that the interface negotiate with the neighboring interface to become an ISL (preferred) or 802.1Q trunk, depending on the configuration and capabilities of the neighboring interface. This is the default for the switch.12-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks 802.1Q Configuration Considerations 802.1Q trunks impose these limitations on the trunking strategy for a network: • In a network of Cisco switches connected through 802.1Q trunks, the switches maintain one instance of spanning tree for each VLAN allowed on the trunks. Non-Cisco devices might support one spanning-tree instance for all VLANs. When you connect a Cisco switch to a non-Cisco device through an 802.1Q trunk, the Cisco switch combines the spanning-tree instance of the VLAN of the trunk with the spanning-tree instance of the non-Cisco 802.1Q switch. However, spanning-tree information for each VLAN is maintained by Cisco switches separated by a cloud of non-Cisco 802.1Q switches. The non-Cisco 802.1Q cloud separating the Cisco switches is treated as a single trunk link between the switches. • Make sure the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the native VLAN on one end of the trunk is different from the native VLAN on the other end, spanning-tree loops might result. • Disabling spanning tree on the native VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can potentially cause spanning-tree loops. We recommend that you leave spanning tree enabled on the native VLAN of an 802.1Q trunk or disable spanning tree on every VLAN in the network. Make sure your network is loop-free before disabling spanning tree. Default Layer 2 Ethernet Interface VLAN Configuration Table 12-6 shows the default Layer 2 Ethernet interface VLAN configuration. Configuring an Ethernet Interface as a Trunk Port Because trunk ports send and receive VTP advertisements, to use VTP you must ensure that at least one trunk port is configured on the switch and that this trunk port is connected to the trunk port of a second switch. Otherwise, the switch cannot receive any VTP advertisements. This section includes these procedures for configuring an Ethernet interface as a trunk port on the switch: • Interaction with Other Features, page 12-20 • Defining the Allowed VLANs on a Trunk, page 12-21 • Changing the Pruning-Eligible List, page 12-23 • Configuring the Native VLAN for Untagged Traffic, page 12-23 Table 12-6 Default Layer 2 Ethernet Interface VLAN Configuration Feature Default Setting Interface mode switchport mode dynamic auto Trunk encapsulation switchport trunk encapsulation negotiate Allowed VLAN range VLANs 1 to 4094 VLAN range eligible for pruning VLANs 2 to 1001 Default VLAN (for access ports) VLAN 1 Native VLAN (for 802.1Q trunks) VLAN 112-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Note By default, an interface is in Layer 2 mode. The default mode for Layer 2 interfaces is switchport mode dynamic auto. If the neighboring interface supports trunking and is configured to allow trunking, the link is a Layer 2 trunk or, if the interface is in Layer 3 mode, it becomes a Layer 2 trunk when you enter the switchport interface configuration command. By default, trunks negotiate encapsulation. If the neighboring interface supports ISL and 802.1Q encapsulation and both interfaces are set to negotiate the encapsulation type, the trunk uses ISL encapsulation. Interaction with Other Features Trunking interacts with other features in these ways: • A trunk port cannot be a secure port. • Trunk ports can be grouped into EtherChannel port groups, but all trunks in the group must have the same configuration. When a group is first created, all ports follow the parameters set for the first port to be added to the group. If you change the configuration of one of these parameters, the switch propagates the setting you entered to all ports in the group: – allowed-VLAN list – STP port priority for each VLAN – STP Port Fast setting – trunk status: if one port in a port group ceases to be a trunk, all ports cease to be trunks. • If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, the port mode is not changed. • A port in dynamic mode can negotiate with its neighbor to become a trunk port. If you try to enable 802.1X on a dynamic port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to dynamic, the port mode is not changed. Configuring a Trunk Port Beginning in privileged EXEC mode, follow these steps to configure a port as an ISL or 802.1Q trunk port: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter the interface configuration mode and the port to be configured for trunking. Step 3 switchport trunk encapsulation {isl | dot1q | negotiate} Configure the port to support ISL or 802.1Q encapsulation or to negotiate (the default) with the neighboring interface for encapsulation type. You must configure each end of the link with the same encapsulation type.12-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks To return an interface to its default configuration, use the default interface interface-id interface configuration command. To reset all trunking characteristics of a trunking interface to the defaults, use the no switchport trunk interface configuration command. To disable trunking, use the switchport mode access interface configuration command to configure the port as a static-access port. This example shows how to configure the Gigabit Ethernet interface 0/4 on switch 1 as an 802.1Q trunk. The example assumes that the neighbor interface is configured to support 802.1Q trunking. Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface gigabitethernet1/0/4 Switch(config-if)# switchport mode dynamic desirable Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# end Defining the Allowed VLANs on a Trunk By default, a trunk port sends traffic to and receives traffic from all VLANs. All VLAN IDs, 1 to 4094, are allowed on each trunk. However, you can remove VLANs from the allowed list, preventing traffic from those VLANs from passing over the trunk. To restrict the traffic a trunk carries, use the switchport trunk allowed vlan remove vlan-list interface configuration command to remove specific VLANs from the allowed list. Note VLAN 1 is the default VLAN on all trunk ports in all Cisco switches, and it has previously been a requirement that VLAN 1 always be enabled on every trunk link. You can use the VLAN 1 minimization feature to disable VLAN 1 on any individual VLAN trunk link so that no user traffic (including spanning tree advertisements) is sent or received on VLAN 1. Step 4 switchport mode {dynamic {auto | desirable} | trunk} Configure the interface as a Layer 2 trunk (required only if the interface is a Layer 2 access port or to specify the trunking mode). • dynamic auto—Set the interface to a trunk link if the neighboring interface is set to trunk or desirable mode. This is the default. • dynamic desirable—Set the interface to a trunk link if the neighboring interface is set to trunk, desirable, or auto mode. • trunk—Set the interface in permanent trunking mode and negotiate to convert the link to a trunk link even if the neighboring interface is not a trunk interface. Step 5 switchport access vlan vlan-id (Optional) Specify the default VLAN, which is used if the interface stops trunking. Step 6 switchport trunk native vlan vlan-id Specify the native VLAN for 802.1Q trunks. Step 7 end Return to privileged EXEC mode. Step 8 show interfaces interface-id switchport Display the switchport configuration of the interface in the Administrative Mode and the Administrative Trunking Encapsulation fields of the display. Step 9 show interfaces interface-id trunk Display the trunk configuration of the interface. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose12-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks To reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any individual VLAN trunk port by removing VLAN 1 from the allowed list. When you remove VLAN 1 from a trunk port, the interface continues to sent and receive management traffic, for example, Cisco Discovery Protocol (CDP), Port Aggregation Protocol (PAgP), Link Aggregation Control Protocol (LACP), Dynamic Trunking Protocol (DTP), and VLAN Trunking Protocol (VTP) in VLAN 1. If a trunk port with VLAN 1 disabled is converted to a nontrunk port, it is added to the access VLAN. If the access VLAN is set to 1, the port will be added to VLAN 1, regardless of the switchport trunk allowed setting. The same is true for any VLAN that has been disabled on the port. A trunk port can become a member of a VLAN if the VLAN is enabled, if VTP knows of the VLAN, and if the VLAN is in the allowed list for the port. When VTP detects a newly enabled VLAN and the VLAN is in the allowed list for a trunk port, the trunk port automatically becomes a member of the enabled VLAN. When VTP detects a new VLAN and the VLAN is not in the allowed list for a trunk port, the trunk port does not become a member of the new VLAN. Beginning in privileged EXEC mode, follow these steps to modify the allowed list of an ISL or 802.1Q trunk: To return to the default allowed VLAN list of all VLANs, use the no switchport trunk allowed vlan interface configuration command. This example shows how to remove VLAN 2 from the allowed VLAN list on an interface: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport trunk allowed vlan remove 2 Switch(config-if)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode and the port to be configured. Step 3 switchport mode trunk Configure the interface as a VLAN trunk port. Step 4 switchport trunk allowed vlan {add | all | except | remove} vlan-list (Optional) Configure the list of VLANs allowed on the trunk. For explanations about using the add, all, except, and remove keywords, refer to the command reference for this release. The vlan-list parameter is either a single VLAN number from 1 to 4094 or a range of VLANs described by two VLAN numbers, the lower one first, separated by a hyphen. Do not enter any spaces between comma-separated VLAN parameters or in hyphen-specified ranges. All VLANs are allowed by default. Step 5 end Return to privileged EXEC mode. Step 6 show interfaces interface-id switchport Verify your entries in the Trunking VLANs Enabled field of the display. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.12-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Changing the Pruning-Eligible List The pruning-eligible list applies only to trunk ports. Each trunk port has its own eligibility list. VTP pruning must be enabled for this procedure to take effect. The “Enabling VTP Pruning” section on page 13-14 describes how to enable VTP pruning. Beginning in privileged EXEC mode, follow these steps to remove VLANs from the pruning-eligible list on a trunk port: To return to the default pruning-eligible list of all VLANs, use the no switchport trunk pruning vlan interface configuration command. Configuring the Native VLAN for Untagged Traffic A trunk port configured with 802.1Q tagging can receive both tagged and untagged traffic. By default, the switch forwards untagged traffic in the native VLAN configured for the port. The native VLAN is VLAN 1 by default. Note The native VLAN can be assigned any VLAN ID. For information about 802.1Q configuration issues, see the “802.1Q Configuration Considerations” section on page 12-19. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and select the trunk port for which VLANs should be pruned. Step 3 switchport trunk pruning vlan {add | except | none | remove} vlan-list [,vlan[,vlan[,,,]] Configure the list of VLANs allowed to be pruned from the trunk. (See the “VTP Pruning” section on page 13-4). For explanations about using the add, except, none, and remove keywords, refer to the command reference for this release. Separate nonconsecutive VLAN IDs with a comma and no spaces; use a hyphen to designate a range of IDs. Valid IDs are from 2 to 1001. Extended-range VLANs (VLAN IDs 1006 to 4094) cannot be pruned. VLANs that are pruning-ineligible receive flooded traffic. The default list of VLANs allowed to be pruned contains VLANs 2 to 1001. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id switchport Verify your entries in the Pruning VLANs Enabled field of the display. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.12-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Beginning in privileged EXEC mode, follow these steps to configure the native VLAN on an 802.1Q trunk: To return to the default native VLAN, VLAN 1, use the no switchport trunk native vlan interface configuration command. If a packet has a VLAN ID that is the same as the outgoing port native VLAN ID, the packet is sent untagged; otherwise, the switch sends the packet with a tag. Configuring Trunk Ports for Load Sharing Load sharing divides the bandwidth supplied by parallel trunks connecting switches. To avoid loops, STP normally blocks all but one parallel link between switches. Using load sharing, you divide the traffic between the links according to which VLAN the traffic belongs. You configure load sharing on trunk ports by using STP port priorities or STP path costs. For load sharing using STP port priorities, both load-sharing links must be connected to the same switch. For load sharing using STP path costs, each load-sharing link can be connected to the same switch or to two different switches. For more information about STP, see Chapter 15, “Configuring STP.” Load Sharing Using STP Port Priorities When two ports on the same switch form a loop, the STP port priority setting determines which port is enabled and which port is in a blocking state. You can set the priorities on a parallel trunk port so that the port carries all the traffic for a given VLAN. The trunk port with the higher priority (lower values) for a VLAN is forwarding traffic for that VLAN. The trunk port with the lower priority (higher values) for the same VLAN remains in a blocking state for that VLAN. One trunk port sends or receives all traffic for the VLAN. Figure 12-3 shows two trunks connecting supported switches. In this example, the switches are configured as follows: • VLANs 8 through 10 are assigned a port priority of 16 on Trunk 1. • VLANs 3 through 6 retain the default port priority of 128 on Trunk 1. • VLANs 3 through 6 are assigned a port priority of 16 on Trunk 2. • VLANs 8 through 10 retain the default port priority of 128 on Trunk 2. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and define the interface that is configured as the 802.1Q trunk. Step 3 switchport trunk native vlan vlan-id Configure the VLAN that is sending and receiving untagged traffic on the trunk port. For vlan-id, the range is 1 to 4094. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id switchport Verify your entries in the Trunking Native Mode VLAN field. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.12-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks In this way, Trunk 1 carries traffic for VLANs 8 through 10, and Trunk 2 carries traffic for VLANs 3 through 6. If the active trunk fails, the trunk with the lower priority takes over and carries the traffic for all of the VLANs. No duplication of traffic occurs over any trunk port. Figure 12-3 Load Sharing by Using STP Port Priorities Note If your switch is a member of a switch stack, you must use the spanning-tree [vlan vlan-id] cost cost interface configuration command instead of the spanning-tree [vlan vlan-id] port-priority priority interface configuration command to select an interface to put in the forwarding state. Assign lower cost values to interfaces that you want selected first and higher cost values that you want selected last. For more information, see the “Load Sharing Using STP Path Cost” section on page 12-26. Beginning in privileged EXEC mode, follow these steps to configure the network shown in Figure 12-3. 93371 Catalyst 3750 switch B Trunk 2 VLANs 3 – 6 (priority 16) VLANs 8 – 10 (priority 128) Trunk 1 VLANs 8 – 10 (priority 16) VLANs 3 – 6 (priority 128) Catalyst 3750 switch A Command Purpose Step 1 configure terminal Enter global configuration mode on Switch A. Step 2 vtp domain domain-name Configure a VTP administrative domain. The domain name can be from 1 to 32 characters. Step 3 vtp mode server Configure Switch A as the VTP server. Step 4 end Return to privileged EXEC mode. Step 5 show vtp status Verify the VTP configuration on both Switch A and Switch B. In the display, check the VTP Operating Mode and the VTP Domain Name fields. Step 6 show vlan Verify that the VLANs exist in the database on Switch A. Step 7 configure terminal Enter global configuration mode. Step 8 interface gigabitethernet1/ 0/1 Enter interface configuration mode, and define Gigabit Ethernet port 0/1 on stack member 1as the interface to be configured as a trunk. Step 9 switchport trunk encapsulation {isl | dot1q | negotiate} Configure the port to support ISL or 802.1Q encapsulation or to negotiate with the neighboring interface. You must configure each end of the link with the same encapsulation type. Step 10 switchport mode trunk Configure the port as a trunk port.12-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Load Sharing Using STP Path Cost You can configure parallel trunks to share VLAN traffic by setting different path costs on a trunk and associating the path costs with different sets of VLANs, blocking different ports for different VLANs. The VLANs keep the traffic separate and maintain redundancy in the event of a lost link. In Figure 12-4, Trunk ports 1 and 2 are configured as 100BASE-T ports. These VLAN path costs are assigned: • VLANs 2 through 4 are assigned a path cost of 30 on Trunk port 1. • VLANs 8 through 10 retain the default 100BASE-T path cost on Trunk port 1 of 19. • VLANs 8 through 10 are assigned a path cost of 30 on Trunk port 2. • VLANs 2 through 4 retain the default 100BASE-T path cost on Trunk port 2 of 19. Step 11 end Return to privileged EXEC mode. Step 12 show interfaces gigabitethernet1/ 0/1 switchport Verify the VLAN configuration. Step 13 Repeat Steps 7 through 11 on Switch A for a second interface in the switch stack. Step 14 Repeat Steps 7 through 11 on Switch B to configure the trunk ports that connect to the trunk ports configured on Switch A. Step 15 show vlan When the trunk links come up, VTP passes the VTP and VLAN information to Switch B. Verify that Switch B has learned the VLAN configuration. Step 16 configure terminal Enter global configuration mode on Switch A. Step 17 interface gigabitethernet1/ 0/1 Enter interface configuration mode, and define the interface to set the STP port priority. Step 18 spanning-tree vlan 8-10 port-priority 16 Assign the port priority of 10 for VLANs 8 through 10. Step 19 exit Return to global configuration mode. Step 20 interface gigabitethernet1/0/2 Enter interface configuration mode, and define the interface to set the STP port priority. Step 21 spanning-tree vlan 3-6 port-priority 16 Assign the port priority of 10 for VLANs 3 through 6. Step 22 end Return to privileged EXEC mode. Step 23 show running-config Verify your entries. Step 24 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose12-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VLAN Trunks Figure 12-4 Load-Sharing Trunks with Traffic Distributed by Path Cost Beginning in privileged EXEC mode, follow these steps to configure the network shown in Figure 12-4: 89239 Catalyst 3750 switch A Catalyst 3750 switch B Trunk port 2 VLANs 8 – 10 (path cost 30) VLANs 2 – 4 (path cost 19) Trunk port 1 VLANs 2 – 4 (path cost 30) VLANs 8 – 10 (path cost 19) Command Purpose Step 1 configure terminal Enter global configuration mode on Switch A. Step 2 interface gigabitethernet1/0/1 Enter interface configuration mode, and define Gigabit Ethernet port 0/1 on stack member 1 as the interface to be configured as a trunk. Step 3 switchport trunk encapsulation {isl | dot1q | negotiate} Configure the port to support ISL or 802.1Q encapsulation. You must configure each end of the link with the same encapsulation type. Step 4 switchport mode trunk Configure the port as a trunk port. The trunk defaults to ISL trunking. Step 5 exit Return to global configuration mode. Step 6 Repeat Steps 2 through 4 on a second interface in the Switch A stack. Step 7 end Return to privileged EXEC mode. Step 8 show running-config Verify your entries. In the display, make sure that the interfaces configures in Steps 2 and 6 are configured as trunk ports. Step 9 show vlan When the trunk links come up, Switch A receives the VTP information from the other switches. Verify that Switch A has learned the VLAN configuration. Step 10 configure terminal Enter global configuration mode. Step 11 interface gigabitethernet1/0/1 Enter interface configuration mode, and define Gigabit Ethernet port 0/1 on stack member 1 as the interface on which to set the STP cost. Step 12 spanning-tree vlan 2-4 cost 30 Set the spanning-tree path cost to 30 for VLANs 2 through 4. Step 13 end Return to global configuration mode. Step 14 Repeat Steps 9 through 11 on the other configured trunk interface on Switch A, and set the spanning-tree path cost to 30 for VLANs 8, 9, and 10. Step 15 exit Return to privileged EXEC mode.12-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS Configuring VMPS The VLAN Query Protocol (VQP) is used to support dynamic-access ports, which are not permanently assigned to a VLAN, but given VLAN assignments based on the MAC source addresses seen on the port. Each time an unknown MAC address is seen, the switch sends a VQP query to a remote VMPS; the query includes the newly seen MAC address and the port on which it was seen. The VMPS responds with a VLAN assignment for the port. The switch cannot be a VMPS server but can act as a client to the VMPS and communicate with it through VQP. This section includes this information about configuring VMPS: • “Understanding VMPS” section on page 12-28 • “Default VMPS Client Configuration” section on page 12-29 • “VMPS Configuration Guidelines” section on page 12-30 • “Configuring the VMPS Client” section on page 12-30 • “Monitoring the VMPS” section on page 12-33 • “Troubleshooting Dynamic-Access Port VLAN Membership” section on page 12-33 • “VMPS Configuration Example” section on page 12-34 Understanding VMPS Each time the client switch receives the MAC address of a new host, it sends a VQP query to the VMPS. When the VMPS receives this query, it searches its database for a MAC-address-to-VLAN mapping. The server response is based on this mapping and whether or not the server is in open or secure mode. In secure mode, the server shuts down the port when an illegal host is detected. In open mode, the server simply denies the host access to the port. If the port is currently unassigned (that is, it does not yet have a VLAN assignment), the VMPS provides one of these responses: • If the host is allowed on the port, the VMPS sends the client a vlan-assignment response containing the assigned VLAN name and allowing access to the host. • If the host is not allowed on the port and the VMPS is in open mode, the VMPS sends an access-denied response. • If the VLAN is not allowed on the port and the VMPS is in secure mode, the VMPS sends a port-shutdown response. If the port already has a VLAN assignment, the VMPS provides one of these responses: • If the VLAN in the database matches the current VLAN on the port, the VMPS sends an success response, allowing access to the host. • If the VLAN in the database does not match the current VLAN on the port and active hosts exist on the port, the VMPS sends an access-denied or a port-shutdown response, depending on the secure mode of the VMPS. Step 16 show running-config Verify your entries. In the display, verify that the path costs are set correctly for both trunk interfaces. Step 17 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose12-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS If the switch receives an access-denied response from the VMPS, it continues to block traffic to and from the host MAC address. The switch continues to monitor the packets directed to the port and sends a query to the VMPS when it identifies a new host address. If the switch receives a port-shutdown response from the VMPS, it disables the port. The port must be manually re-enabled by using the CLI, CMS, or SNMP. Dynamic-Access Port VLAN Membership A dynamic-access port can belong to only one VLAN with an ID from 1 to 4094. When the link comes up, the switch does not forward traffic to or from this port until the VMPS provides the VLAN assignment. The VMPS receives the source MAC address from the first packet of a new host connected to the dynamic-access port and attempts to match the MAC address to a VLAN in the VMPS database. If there is a match, the VMPS sends the VLAN number for that port. If the client switch was not previously configured, it uses the domain name from the first VTP packet it receives on its trunk port from the VMPS. If the client switch was previously configured, it includes its domain name in the query packet to the VMPS to obtain its VLAN number. The VMPS verifies that the domain name in the packet matches its own domain name before accepting the request and responds to the client with the assigned VLAN number for the client. If there is no match, the VMPS either denies the request or shuts down the port (depending on the VMPS secure mode setting). Multiple hosts (MAC addresses) can be active on a dynamic-access port if they are all in the same VLAN; however, the VMPS shuts down a dynamic-access port if more than 20 hosts are active on the port. If the link goes down on a dynamic-access port, the port returns to an isolated state and does not belong to a VLAN. Any hosts that come online through the port are checked again through the VQP with the VMPS before the port is assigned to a VLAN. Dynamic-access ports can be used for direct host connections, or they can connect to a network. A maximum of 20 MAC addresses are allowed per port on the switch. A dynamic-access port can belong to only one VLAN at a time, but the VLAN can change over time, depending on the MAC addresses seen. Default VMPS Client Configuration Table 12-7 shows the default VMPS and dynamic-access port configuration on client switches. Table 12-7 Default VMPS Client and Dynamic-Access Port Configuration Feature Default Setting VMPS domain server None VMPS reconfirm interval 60 minutes VMPS server retry count 3 Dynamic-access ports None configured12-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS VMPS Configuration Guidelines These guidelines and restrictions apply to dynamic-access port VLAN membership: • You should configure the VMPS before you configure ports as dynamic-access ports. • When you configure a port as a dynamic-access port, the spanning-tree Port Fast feature is automatically enabled for that port. The Port Fast mode accelerates the process of bringing the port into the forwarding state. • 802.1X ports cannot be configured as dynamic-access ports. If you try to enable 802.1X on a dynamic-access (VQP) port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to dynamic VLAN assignment, an error message appears, and the VLAN configuration is not changed. • Trunk ports cannot be dynamic-access ports, but you can enter the switchport access vlan dynamic interface configuration command for a trunk port. In this case, the switch retains the setting and applies it if the port is later configured as an access port. You must turn off trunking on the port before the dynamic-access setting takes effect. • Dynamic-access ports cannot be monitor ports. • Secure ports cannot be dynamic-access ports. You must disable port security on a port before it becomes dynamic. • Dynamic-access ports cannot be members of an EtherChannel group. • Port channels cannot be configured as dynamic-access ports. • A dynamic-access port can participate in fallback bridging. • The VTP management domain of the VMPS client and the VMPS server must be the same. • The VLAN configured on the VMPS server should not be a voice VLAN. Configuring the VMPS Client You configure dynamic VLANs by using the VMPS (server). The switch can be a VMPS client; it cannot be a VMPS server. Entering the IP Address of the VMPS You must first enter the IP address of the server to configure the switch as a client. Note If the VMPS is being defined for a cluster of switches, enter the address on the command switch. Beginning in privileged EXEC mode, follow these steps to enter the IP address of the VMPS: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vmps server ipaddress primary Enter the IP address of the switch acting as the primary VMPS server.12-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS Note You must have IP connectivity to the VMPS for dynamic-access ports to work. You can test for IP connectivity by pinging the IP address of the VMPS and verifying that you get a response. Configuring Dynamic-Access Ports on VMPS Clients If you are configuring a port on a cluster member switch as a dynamic-access port, first use the rcommand privileged EXEC command to log into the cluster member switch. Caution Dynamic-access port VLAN membership is for end stations or hubs connected to end stations. Connecting dynamic-access ports to other switches can cause a loss of connectivity. Beginning in privileged EXEC mode, follow these steps to configure a dynamic-access port on a VMPS client switch: To return an interface to its default configuration, use the default interface interface-id interface configuration command. To return an interface to its default switchport mode (dynamic auto), use the no switchport mode interface configuration command. To reset the access mode to the default VLAN for the switch, use the no switchport access vlan interface configuration command. Step 3 vmps server ipaddress (Optional) Enter the IP address of the switch acting as a secondary VMPS server. You can enter up to three secondary server addresses. Step 4 end Return to privileged EXEC mode. Step 5 show vmps Verify your entries in the VMPS Domain Server field of the display. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode for the switch port that is connected to the end station. Step 3 switchport mode access Set the port to access mode. Step 4 switchport access vlan dynamic Configure the port as eligible for dynamic VLAN membership. The dynamic-access port must be connected to an end station. Step 5 end Return to privileged EXEC mode. Step 6 show interfaces interface-id switchport Verify your entries in the Operational Mode field of the display. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.12-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS Reconfirming VLAN Memberships Beginning in privileged EXEC mode, follow these steps to confirm the dynamic-access port VLAN membership assignments that the switch has received from the VMPS: Changing the Reconfirmation Interval VMPS clients periodically reconfirm the VLAN membership information received from the VMPS. You can set the number of minutes after which reconfirmation occurs. If you are configuring a member switch in a cluster, this parameter must be equal to or greater than the reconfirmation setting on the command switch. You must also first use the rcommand privileged EXEC command to log into the member switch. Beginning in privileged EXEC mode, follow these steps to change the reconfirmation interval: To return the switch to its default setting, use the no vmps reconfirm global configuration command. Changing the Retry Count Beginning in privileged EXEC mode, follow these steps to change the number of times that the switch attempts to contact the VMPS before querying the next server: To return the switch to its default setting, use the no vmps retry global configuration command. Command Purpose Step 1 vmps reconfirm Reconfirm dynamic-access port VLAN membership. Step 2 show vmps Verify the dynamic VLAN reconfirmation status. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vmps reconfirm minutes Enter the number of minutes between reconfirmations of the dynamic VLAN membership. The range is from 1 to 120. The default is 60 minutes. Step 3 end Return to privileged EXEC mode. Step 4 show vmps Verify the dynamic VLAN reconfirmation status in the Reconfirm Interval field of the display. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vmps retry count Change the retry count. The retry range is from 1 to 10; the default is 3. Step 3 end Return to privileged EXEC mode. Step 4 show vmps Verify your entry in the Server Retry Count field of the display. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.12-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS Monitoring the VMPS You can display information about the VMPS by using the show vmps privileged EXEC command. The switch displays this information about the VMPS: • VMPS VQP Version—the version of VQP used to communicate with the VMPS. The switch queries the VMPS that is using VQP version 1. • Reconfirm Interval—the number of minutes the switch waits before reconfirming the VLAN-to-MAC-address assignments. • Server Retry Count—the number of times VQP resends a query to the VMPS. If no response is received after this many tries, the switch starts to query the secondary VMPS. • VMPS domain server—the IP address of the configured VLAN membership policy servers. The switch sends queries to the one marked current. The one marked primary is the primary server. • VMPS Action—the result of the most recent reconfirmation attempt. A reconfirmation attempt can occur automatically when the reconfirmation interval expired, or you can force it by entering the vmps reconfirm privileged EXEC command or its CMS or SNMP equivalent This is an example of output for the show vmps privileged EXEC command: Switch# show vmps VQP Client Status: -------------------- VMPS VQP Version: 1 Reconfirm Interval: 60 min Server Retry Count: 3 VMPS domain server: 172.20.128.86 (primary, current) 172.20.128.87 Reconfirmation status --------------------- VMPS Action: other Troubleshooting Dynamic-Access Port VLAN Membership The VMPS shuts down a dynamic-access port under these conditions: • The VMPS is in secure mode, and it does not allow the host to connect to the port. The VMPS shuts down the port to prevent the host from connecting to the network. • More than 20 active hosts reside on a dynamic-access port. To re-enable a disabled dynamic-access port, enter the shutdown interface configuration command followed by the no shutdown interface configuration command.12-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 12 Configuring VLANs Configuring VMPS VMPS Configuration Example Figure 12-5 shows a network with a VMPS server switch and VMPS client switches with dynamic-access ports. In this example, these assumptions apply: • The VMPS server and the VMPS client are separate switches. • The Catalyst 6000 series Switch A is the primary VMPS server. • The Catalyst 6000 series Switch F is the secondary VMPS server. • End stations are connected to the clients, Switch B and Switch E. • The database configuration file is stored on the TFTP server with the IP address 172.20.22.7. Figure 12-5 Dynamic Port VLAN Membership Configuration Primary VMPS Server 1 Catalyst 6000 series Secondary VMPS Server 3 172.20.26.150 Catalyst 6000 series Switch A Stackwise port connections Switch 1 Switch 2 Switch 3 Switch F Switch C Switch D Switch E Ethernet segment (Trunk link) 172.20.26.156 172.20.26.157 172.20.26.158 172.20.26.159 Catalyst 3750 switch client End station 2 End station 1 TFTP server Dynamic-access port 172.20.22.7 86836 Trunk port Trunk port Router Catalyst 3750 switch stack B as clientC H A P T E R 13-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 13 Configuring VTP This chapter describes how to use the VLAN Trunking Protocol (VTP) and the VLAN database for managing VLANs with the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. The chapter includes these sections: • Understanding VTP, page 13-1 • Configuring VTP, page 13-6 • Monitoring VTP, page 13-16 Understanding VTP VTP is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP minimizes misconfigurations and configuration inconsistencies that can cause several problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations. Before you create VLANs, you must decide whether to use VTP in your network. Using VTP, you can make configuration changes centrally on one or more switches and have those changes automatically communicated to all the other switches in the network. Without VTP, you cannot send information about VLANs to other switches. VTP is designed to work in an environment where updates are made on a single switch and are sent through VTP to other switches in the domain. It does not work well in a situation where multiple updates to the VLAN database occur simultaneously on switches in the same domain, which would result in an inconsistency in the VLAN database. VTP functionality is supported across the stack, and all switches in the stack maintain the same VLAN and VTP configuration inherited from the stack master. When a switch learns of a new VLAN through VTP messages or when a new VLAN is configured by the user, the new VLAN information is communicated to all switches in the stack. When a switch joins the stack or when stacks merge, the new switches get VTP information from the stack master.13-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Understanding VTP The switch supports 1005 VLANs, but the number of routed ports, SVIs, and other configured features affects the usage of the switch hardware. If the switch is notified by VTP of a new VLAN and the switch is already using the maximum available hardware resources, it sends a message that there are not enough hardware resources available and shuts down the VLAN. The output of the show vlan user EXEC command shows the VLAN in a suspended state. VTP only learns about normal-range VLANs (VLAN IDs 1 to 1005). Extended-range VLANs (VLAN IDs greater than 1005) are not supported by VTP or stored in the VTP VLAN database. This section contains information about these VTP parameters and characteristics. • The VTP Domain, page 13-2 • VTP Modes, page 13-3 • VTP Advertisements, page 13-3 • VTP Version 2, page 13-4 • VTP Pruning, page 13-4 • VTP and Switch Stacks, page 13-6 The VTP Domain A VTP domain (also called a VLAN management domain) consists of one switch or several interconnected switches or switch stacks under the same administrative responsibility sharing the same VTP domain name. A switch can be in only one VTP domain.You make global VLAN configuration changes for the domain by using the command-line interface (CLI), Cluster Management Suite (CMS) software, or Simple Network Management Protocol (SNMP). By default, the switch is in VTP no-management-domain state until it receives an advertisement for a domain over a trunk link (a link that carries the traffic of multiple VLANs) or until you configure a domain name. Until the management domain name is specified or learned, you cannot create or modify VLANs on a VTP server, and VLAN information is not propagated over the network. If the switch receives a VTP advertisement over a trunk link, it inherits the management domain name and the VTP configuration revision number. The switch then ignores advertisements with a different domain name or an earlier configuration revision number. Caution Before adding a VTP client switch to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other switches in the VTP domain. Switches in a VTP domain always use the VLAN configuration of the switch with the highest VTP configuration revision number. If you add a switch that has a revision number higher than the revision number in the VTP domain, it can erase all VLAN information from the VTP server and VTP domain. See the “Adding a VTP Client Switch to a VTP Domain” section on page 13-15 for the procedure for verifying and resetting the VTP configuration revision number. When you make a change to the VLAN configuration on a VTP server, the change is propagated to all switches in the VTP domain. VTP advertisements are sent over all IEEE trunk connections, including Inter-Switch Link (ISL) and IEEE 802.1Q. VTP dynamically maps VLANs with unique names and internal index associates across multiple LAN types. Mapping eliminates excessive device administration required from network administrators.13-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Understanding VTP If you configure a switch for VTP transparent mode, you can create and modify VLANs, but the changes are not sent to other switches in the domain, and they affect only the individual switch. However, configuration changes made when the switch is in this mode are saved in the switch running configuration and can be saved to the switch startup configuration file. For domain name and password configuration guidelines, see the “VTP Configuration Guidelines” section on page 13-8. VTP Modes You can configure a supported switch stack to be in one of the VTP modes listed in Table 13-1. VTP Advertisements Each switch in the VTP domain sends periodic global configuration advertisements from each trunk port to a reserved multicast address. Neighboring switches receive these advertisements and update their VTP and VLAN configurations as necessary. Note Because trunk ports send and receive VTP advertisements, you must ensure that at least one trunk port is configured on the switch stack and that this trunk port is connected to the trunk port of another switch. Otherwise, the switch cannot receive any VTP advertisements. For more information on trunk ports, see the “Configuring VLAN Trunks” section on page 12-16. Table 13-1 VTP Modes VTP Mode Description VTP server In VTP server mode, you can create, modify, and delete VLANs, and specify other configuration parameters (such as the VTP version) for the entire VTP domain. VTP servers advertise their VLAN configurations to other switches in the same VTP domain and synchronize their VLAN configurations with other switches based on advertisements received over trunk links. In VTP server mode, VLAN configurations are saved in nonvolatile RAM (NVRAM). VTP server is the default mode. VTP client A VTP client behaves like a VTP server and transmits and receives VTP updates on its trunks, but you cannot create, change, or delete VLANs on a VTP client. VLANs are configured on another switch in the domain that is in server mode. In VTP client mode, VLAN configurations are not saved in NVRAM. VTP transparent VTP transparent switches do not participate in VTP. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, in VTP version 2, transparent switches do forward VTP advertisements that they receive from other switches from their trunk interfaces. You can create, modify, and delete VLANs on a switch in VTP transparent mode. The switch must be in VTP transparent mode when you create extended-range VLANs. See the “Configuring Extended-Range VLANs” section on page 12-12. When the switch is in VTP transparent mode, the VTP and VLAN configurations are saved in NVRAM, but they are not advertised to other switches. In this mode, VTP mode and domain name are saved in the switch running configuration and you can save this information in the switch startup configuration file by entering the copy running-config startup-config privileged EXEC command. The running configuration and the saved configuration are the same for all switches in a stack.13-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Understanding VTP VTP advertisements distribute this global domain information: • VTP domain name • VTP configuration revision number • Update identity and update timestamp • MD5 digest VLAN configuration, including maximum transmission unit (MTU) size for each VLAN. • Frame format VTP advertisements distribute this VLAN information for each configured VLAN: • VLAN IDs (ISL and 802.1Q) • VLAN name • VLAN type • VLAN state • Additional VLAN configuration information specific to the VLAN type VTP Version 2 If you use VTP in your network, you must decide whether to use version 1 or version 2. By default, VTP operates in version 1. VTP version 2 supports these features not supported in version 1: • Token Ring support—VTP version 2 supports Token Ring Bridge Relay Function (TrBRF) and Token Ring Concentrator Relay Function (TrCRF) VLANs. For more information about Token Ring VLANs, see the “Configuring Normal-Range VLANs” section on page 12-4. • Unrecognized Type-Length-Value (TLV) support—A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in NVRAM when the switch is operating in VTP server mode. • Version-Dependent Transparent Mode—In VTP version 1, a VTP transparent switch inspects VTP messages for the domain name and version and forwards a message only if the version and domain name match. Because VTP version 2 supports only one domain, it forwards VTP messages in transparent mode without inspecting the version and domain name. • Consistency Checks—In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI, the Cluster Management Software (CMS), or SNMP. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from NVRAM. If the MD5 digest on a received VTP message is correct, its information is accepted. VTP Pruning VTP pruning increases network available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to reach the destination devices. Without VTP pruning, a switch floods broadcast, multicast, and unknown unicast traffic across all trunk links within a VTP domain even though receiving switches might discard them. VTP pruning is disabled by default.13-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Understanding VTP VTP pruning blocks unneeded flooded traffic to VLANs on trunk ports that are included in the pruning-eligible list. Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning eligible switch trunk ports. If the VLANs are configured as pruning-ineligible, the flooding continues. VTP pruning is supported with VTP version 1 and version 2. Figure 13-1 shows a switched network without VTP pruning enabled. Port 1 on Switch A and Port 2 on Switch D are assigned to the Red VLAN. If a broadcast is sent from the host connected to Switch A, Switch A floods the broadcast and every switch in the network receives it, even though Switches C, E, and F have no ports in the Red VLAN. Figure 13-1 Flooding Traffic without VTP Pruning Figure 13-2 shows a switched network with VTP pruning enabled. The broadcast traffic from Switch A is not forwarded to Switches C, E, and F because traffic for the Red VLAN has been pruned on the links shown (Port 5 on Switch B and Port 4 on Switch D). Figure 13-2 Optimized Flooded Traffic with VTP Pruning Switch D Switch E Switch F Switch A Switch C Switch B Port 1 Port 2 Red VLAN 89240 Switch D Switch E Switch F Switch A Switch C Switch B Port 1 Port 2 Red VLAN 89241 Port 4 Flooded traffic is pruned. Port 5 Flooded traffic is pruned.13-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Enabling VTP pruning on a VTP server enables pruning for the entire management domain. Making VLANs pruning-eligible or pruning-ineligible affects pruning eligibility for those VLANs on that trunk only (not on all switches in the VTP domain). See the “Enabling VTP Pruning” section on page 13-14. VTP pruning takes effect several seconds after you enable it. VTP pruning does not prune traffic from VLANs that are pruning-ineligible. VLAN 1 and VLANs 1002 to 1005 are always pruning-ineligible; traffic from these VLANs cannot be pruned. Extended-range VLANs (VLAN IDs higher than 1005) are also pruning-ineligible. VTP pruning is not designed to function in VTP transparent mode. If one or more switches in the network are in VTP transparent mode, you should do one of these: • Turn off VTP pruning in the entire network. • Turn off VTP pruning by making all VLANs on the trunk of the switch upstream to the VTP transparent switch pruning ineligible. To configure VTP pruning on an interface, use the switchport trunk pruning vlan interface configuration command (see the “Changing the Pruning-Eligible List” section on page 12-23). VTP pruning operates when an interface is trunking. You can set VLAN pruning-eligibility, whether or not VTP pruning is enabled for the VTP domain, whether or not any given VLAN exists, and whether or not the interface is currently trunking. VTP and Switch Stacks VTP configuration is the same in all members of a switch stack. When the switch stack is in VTP server or client mode, all switches in the stack carry the same VTP configuration. When VTP mode is transparent, the stack is not taking part in VTP. • When a switch joins the stack, it inherits the VTP and VLAN properties of the stack master. • All VTP updates are carried across the stack. • When VTP mode is changed in a switch in the stack, the other switches in the stack also change VTP mode, and the switch VLAN database remains consistent. For more information about the switch stack, see Chapter 5, “Managing Switch Stacks.” Configuring VTP This section includes guidelines and procedures for configuring VTP. These sections are included: • Default VTP Configuration, page 13-7 • VTP Configuration Options, page 13-7 • VTP Configuration Guidelines, page 13-8 • Configuring a VTP Server, page 13-9 • Configuring a VTP Client, page 13-11 • Disabling VTP (VTP Transparent Mode), page 13-12 • Enabling VTP Version 2, page 13-13 • Enabling VTP Pruning, page 13-14 • Adding a VTP Client Switch to a VTP Domain, page 13-1513-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Default VTP Configuration Table 13-2 shows the default VTP configuration. VTP Configuration Options You can configure VTP by using these configuration modes. • VTP Configuration in Global Configuration Mode, page 13-7 • VTP Configuration in VLAN Database Configuration Mode, page 13-8 You access VLAN database configuration mode by entering the vlan database privileged EXEC command. For detailed information about vtp commands, refer to the command reference for this release. VTP Configuration in Global Configuration Mode You can use the vtp global configuration command to set the VTP password, the version, the VTP file name, the interface providing updated VTP information, the domain name, and the mode, and to disable or enable pruning. For more information about available keywords, refer to the command descriptions in the command reference for this release. The VTP information is saved in the VTP VLAN database. When VTP mode is transparent, the VTP domain name and mode are also saved in the switch running configuration file, and you can save it in the switch startup configuration file by entering the copy running-config startup-config privileged EXEC command. You must use this command if you want to save VTP mode as transparent, even if the switch resets. When you save VTP information in the switch startup configuration file and reboot the switch, the switch configuration is determined as follows: • If the VTP mode is transparent in the startup configuration and the VLAN database and the VTP domain name from the VLAN database matches that in the startup configuration file, the VLAN database is ignored (cleared), and the VTP and VLAN configurations in the startup configuration file are used. The VLAN database revision number remains unchanged in the VLAN database. • If the VTP mode or domain name in the startup configuration do not match the VLAN database, the domain name and VTP mode and configuration for the first 1005 VLANs use the VLAN database information. Table 13-2 Default VTP Configuration Feature Default Setting VTP domain name Null. VTP mode Server. VTP version Version 1 (version 2 is disabled). VTP password None. VTP pruning Disabled.13-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP VTP Configuration in VLAN Database Configuration Mode You can configure all VTP parameters in VLAN database configuration mode, which you access by entering the vlan database privileged EXEC command. For more information about available keywords, refer to the vtp VLAN database configuration command description in the command reference for this release. When you enter the exit command in VLAN database configuration mode, it applies all the commands that you entered and updates the VLAN database. VTP messages are sent to other switches in the VTP domain, and the privileged EXEC mode prompt appears. If VTP mode is transparent, the domain name and the mode (transparent) are saved in the switch running configuration, and you can save this information in the switch startup configuration file by entering the copy running-config startup-config privileged EXEC command. VTP Configuration Guidelines These sections describe guidelines you should follow when implementing VTP in your network. Domain Names When configuring VTP for the first time, you must always assign a domain name. You must configure all switches in the VTP domain with the same domain name. Switches in VTP transparent mode do not exchange VTP messages with other switches, and you do not need to configure a VTP domain name for them. Note If NVRAM and DRAM storage is sufficient, all switches in a VTP domain should be in VTP server mode. Caution Do not configure a VTP domain if all switches are operating in VTP client mode. If you configure the domain, it is impossible to make changes to the VLAN configuration of that domain. Make sure that you configure at least one switch in the VTP domain for VTP server mode. Passwords You can configure a password for the VTP domain, but it is not required. If you do configure a domain password, all domain switches must share the same password and you must configure the password on each switch in the management domain. Switches without a password or with the wrong password reject VTP advertisements. If you configure a VTP password for a domain, a switch that is booted without a VTP configuration does not accept VTP advertisements until you configure it with the correct password. After the configuration, the switch accepts the next VTP advertisement that uses the same password and domain name in the advertisement. If you are adding a new switch to an existing network with VTP capability, the new switch learns the domain name only after the applicable password has been configured on it. Caution When you configure a VTP domain password, the management domain does not function properly if you do not assign a management domain password to each switch in the domain.13-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP VTP Version Follow these guidelines when deciding which VTP version to implement: • All switches in a VTP domain must run the same VTP version. • A VTP version 2-capable switch can operate in the same VTP domain as a switch running VTP version 1 if version 2 is disabled on the version 2-capable switch (version 2 is disabled by default). • Do not enable VTP version 2 on a switch unless all of the switches in the same VTP domain are version-2-capable. When you enable version 2 on a switch, all of the version-2-capable switches in the domain enable version 2. If there is a version 1-only switch, it does not exchange VTP information with switches with version 2 enabled. • If there are TrBRF and TrCRF Token Ring networks in your environment, you must enable VTP version 2 for Token Ring VLAN switching to function properly. To run Token Ring and Token Ring-Net, disable VTP version 2. Configuration Requirements When you configure VTP, you must configure a trunk port on the switch stack so that the switch can send and receive VTP advertisements to and from other switches in the domain. For more information, see the “Configuring VLAN Trunks” section on page 12-16. If you are configuring VTP on a cluster member switch to a VLAN, use the rcommand privileged EXEC command to log into the member switch. For more information about the command, refer to the command reference for this release. If you are configuring extended-range VLANs on the switch, the switch must be in VTP transparent mode. Configuring a VTP Server When a switch is in VTP server mode, you can change the VLAN configuration and have it propagated throughout the network. Note If extended-range VLANs are configured on the switch, you cannot change VTP mode to server. You receive an error message, and the configuration is not allowed. Beginning in privileged EXEC mode, follow these steps to configure the switch as a VTP server: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp mode server Configure the switch for VTP server mode (the default). Step 3 vtp domain domain-name Configure the VTP administrative-domain name. The name can be from 1 to 32 characters. All switches operating in VTP server or client mode under the same administrative responsibility must be configured with the same domain name.13-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP When you configure a domain name, it cannot be removed; you can only reassign a switch to a different domain. To return the switch to a no-password state, use the no vtp password global configuration command. This example shows how to use global configuration mode to configure the switch as a VTP server with the domain name eng_group and the password mypassword: Switch# config terminal Switch(config)# vtp mode server Switch(config)# vtp domain eng_group Switch(config)# vtp password mypassword Switch(config)# end You can also use VLAN database configuration mode to configure VTP parameters. Beginning in privileged EXEC mode, follow these steps to use VLAN database configuration mode to configure the switch as a VTP server: When you configure a domain name, it cannot be removed; you can only reassign a switch to a different domain. To return the switch to a no-password state, use the no vtp password VLAN database configuration command. Step 4 vtp password password (Optional) Set the password for the VTP domain. The password can be from 8 to 64 characters. If you configure a VTP password, the VTP domain does not function properly if you do not assign the same password to each switch in the domain. Step 5 end Return to privileged EXEC mode. Step 6 show vtp status Verify your entries in the VTP Operating Mode and the VTP Domain Name fields of the display. Command Purpose Command Purpose Step 1 vlan database Enter VLAN database configuration mode. Step 2 vtp server Configure the switch for VTP server mode (the default). Step 3 vtp domain domain-name Configure a VTP administrative-domain name. The name can be from 1 to 32 characters. All switches operating in VTP server or client mode under the same administrative responsibility must be configured with the same domain name. Step 4 vtp password password (Optional) Set a password for the VTP domain. The password can be from 8 to 64 characters. If you configure a VTP password, the VTP domain does not function properly if you do not assign the same password to each switch in the domain. Step 5 exit Update the VLAN database, propagate it throughout the administrative domain, and return to privileged EXEC mode. Step 6 show vtp status Verify your entries in the VTP Operating Mode and the VTP Domain Name fields of the display.13-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP This example shows how to use VLAN database configuration mode to configure the switch as a VTP server with the domain name eng_group and the password mypassword: Switch# vlan database Switch(vlan)# vtp server Switch(vlan)# vtp domain eng_group Switch(vlan)# vtp password mypassword Switch(vlan)# exit APPLY completed. Exiting.... Switch# Configuring a VTP Client When a switch is in VTP client mode, you cannot change its VLAN configuration. The client switch receives VTP updates from a VTP server in the VTP domain and then modifies its configuration accordingly. Note If extended-range VLANs are configured on the switch stack, you cannot change VTP mode to client. You receive an error message, and the configuration is not allowed. Caution If all switches are operating in VTP client mode, do not configure a VTP domain name. If you do, it is impossible to make changes to the VLAN configuration of that domain. Therefore, make sure you configure at least one switch as a VTP server. Beginning in privileged EXEC mode, follow these steps to configure the switch as a VTP client: Use the no vtp mode global configuration command to return the switch to VTP server mode. To return the switch to a no-password state, use the no vtp password privileged EXEC command. When you configure a domain name, it cannot be removed; you can only reassign a switch to a different domain. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp mode client Configure the switch for VTP client mode. The default setting is VTP server. Step 3 vtp domain domain-name (Optional) Enter the VTP administrative-domain name. The name can be from 1 to 32 characters. This should be the same domain name as the VTP server. All switches operating in VTP server or client mode under the same administrative responsibility must be configured with the same domain name. Step 4 vtp password password (Optional) Enter the password for the VTP domain. Step 5 end Return to privileged EXEC mode. Step 6 show vtp status Verify your entries in the VTP Operating Mode and the VTP Domain Name fields of the display.13-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Note You can also configure a VTP client by using the vlan database privileged EXEC command to enter VLAN database configuration mode and entering the vtp client command, similar to the second procedure under “Configuring a VTP Server” section on page 13-9. Use the no vtp client VLAN database configuration command to return the switch to VTP server mode or the no vtp password VLAN database configuration command to return the switch to a no-password state. When you configure a domain name, it cannot be removed; you can only reassign a switch to a different domain. Disabling VTP (VTP Transparent Mode) When you configure the switch for VTP transparent mode, you disable VTP on the switch. The switch does not send VTP updates and does not act on VTP updates received from other switches. However, a VTP transparent switch running VTP version 2 does forward received VTP advertisements on all of its trunk links. Note Before you create extended-range VLANs (VLAN IDs 1006 to 4094), you must set VTP mode to transparent by using the vtp mode transparent global configuration command. Save this configuration to the startup configuration so that the switch boots up in VTP transparent mode. Otherwise, you lose the extended-range VLAN configuration if the switch resets and boots up in VTP server mode (the default). Beginning in privileged EXEC mode, follow these steps to configure VTP transparent mode and save the VTP configuration in the switch startup configuration file: To return the switch to VTP server mode, use the no vtp mode global configuration command. Note If extended-range VLANs are configured on the switch stack, you cannot change the VTP mode to server. You receive an error message, and the configuration is not allowed. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp mode transparent Configure the switch for VTP transparent mode (disable VTP). Step 3 end Return to privileged EXEC mode. Step 4 show vtp status Verify your entries in the VTP Operating Mode and the VTP Domain Name fields of the display. Step 5 copy running-config startup-config (Optional) Save the configuration in the startup configuration file. Note Only VTP mode and domain name are saved in the switch running configuration and can be copied to the startup configuration file.13-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Note You can also configure VTP transparent mode by using the vlan database privileged EXEC command to enter VLAN database configuration mode and by entering the vtp transparent command, similar to the second procedure under the “Configuring a VTP Server” section on page 13-9. Use the no vtp transparent VLAN database configuration command to return the switch to VTP server mode. If extended-range VLANs are configured on the switch, you cannot change VTP mode to server. You receive an error message, and the configuration is not allowed. Enabling VTP Version 2 VTP version 2 is disabled by default on VTP version 2-capable switches. When you enable VTP version 2 on a switch, every VTP version 2-capable switch in the VTP domain enables version 2. You can only configure the version on switches in VTP server or transparent mode. Caution VTP version 1 and VTP version 2 are not interoperable on switches in the same VTP domain. Every switch in the VTP domain must use the same VTP version. Do not enable VTP version 2 unless every switch in the VTP domain supports version 2. Note In TrCRF and TrBRF Token ring environments, you must enable VTP version 2 for Token Ring VLAN switching to function properly. For Token Ring and Token Ring-Net media, VTP version 2 must be disabled. For more information on VTP version configuration guidelines, see the “VTP Version” section on page 13-9. Beginning in privileged EXEC mode, follow these steps to enable VTP version 2: To disable VTP version 2, use the no vtp version global configuration command. Note You can also enable VTP version 2 by using the vlan database privileged EXEC command to enter VLAN database configuration mode and entering the vtp v2-mode VLAN database configuration command. To disable VTP version 2, use the no vtp v2-mode VLAN database configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp version 2 Enable VTP version 2 on the switch. VTP version 2 is disabled by default on VTP version 2-capable switches. Step 3 end Return to privileged EXEC mode. Step 4 show vtp status Verify that VTP version 2 is enabled in the VTP V2 Mode field of the display.13-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Enabling VTP Pruning Pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the destination devices. You can only enable VTP pruning on a switch in VTP server mode. Beginning in privileged EXEC mode, follow these steps to enable VTP pruning in the VTP domain: To disable VTP pruning, use the no vtp pruning global configuration command. Note You can also enable VTP pruning by using the vlan database privileged EXEC command to enter VLAN database configuration mode and entering the vtp pruning VLAN database configuration command. To disable VTP pruning, use the no vtp pruning VLAN database configuration command. You can also enable VTP version 2 by using the vtp pruning privileged EXEC command. However, this command will not be available in future releases. Pruning is supported with VTP version 1 and version 2. If you enable pruning on the VTP server, it is enabled for the entire VTP domain. Only VLANs included in the pruning-eligible list can be pruned. By default, VLANs 2 through 1001 are pruning eligible on trunk ports. Reserved VLANs and extended-range VLANs cannot be pruned. To change the pruning-eligible VLANs, see the “Changing the Pruning-Eligible List” section on page 12-23. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vtp pruning Enable pruning in the VTP administrative domain. By default, pruning is disabled. You need to enable pruning on only one switch in VTP server mode. Step 3 end Return to privileged EXEC mode. Step 4 show vtp status Verify your entries in the VTP Pruning Mode field of the display.13-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Configuring VTP Adding a VTP Client Switch to a VTP Domain Before adding a VTP client to a VTP domain, always verify that its VTP configuration revision number is lower than the configuration revision number of the other switches in the VTP domain. Switches in a VTP domain always use the VLAN configuration of the switch with the highest VTP configuration revision number. If you add a switch that has a revision number higher than the revision number in the VTP domain, it can erase all VLAN information from the VTP server and VTP domain. Beginning in privileged EXEC mode, follow these steps to verify and reset the VTP configuration revision number on a switch before adding it to a VTP domain: You can also change the VTP domain name by entering the vlan database privileged EXEC command to enter VLAN database configuration mode and by entering the vtp domain domain-name command. In this mode, you must enter the exit command to update VLAN information and return to privileged EXEC mode. After resetting the configuration revision number, add the switch to the VTP domain. Note You can use the vtp mode transparent global configuration command or the vtp transparent VLAN database configuration command to disable VTP on the switch, and then change its VLAN information without affecting the other switches in the VTP domain. Command Purpose Step 1 show vtp status Check the VTP configuration revision number. If the number is 0, add the switch to the VTP domain. If the number is greater than 0, follow these steps: a. Write down the domain name. b. Write down the configuration revision number. c. Continue with the next steps to reset the switch configuration revision number. Step 2 configure terminal Enter global configuration mode. Step 3 vtp domain domain-name Change the domain name from the original one displayed in Step 1 to a new name. Step 4 end The VLAN information on the switch is updated and the configuration revision number is reset to 0. You return to privileged EXEC mode. Step 5 show vtp status Verify that the configuration revision number has been reset to 0. Step 6 configure terminal Enter global configuration mode. Step 7 vtp domain domain-name Enter the original domain name on the switch. Step 8 end The VLAN information on the switch is updated, and you return to privileged EXEC mode. Step 9 show vtp status (Optional) Verify that the domain name is the same as in Step 1 and that the configuration revision number is 0.13-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 13 Configuring VTP Monitoring VTP Monitoring VTP You monitor VTP by displaying VTP configuration information: the domain name, the current VTP revision, and the number of VLANs. You can also display statistics about the advertisements sent and received by the switch. Table 13-3 shows the privileged EXEC commands for monitoring VTP activity. Table 13-3 VTP Monitoring Commands Command Purpose show vtp status Display the VTP switch configuration information. show vtp counters Display counters about VTP messages that have been sent and received.C H A P T E R 14-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 14 Configuring Voice VLAN This chapter describes how to configure the voice VLAN feature on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Voice VLAN is referred to as an auxiliary VLAN in some Catalyst 6000 family switch documentation. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding Voice VLAN, page 14-1 • Configuring Voice VLAN, page 14-3 • Displaying Voice VLAN, page 14-6 Understanding Voice VLAN The voice VLAN feature enables access ports to carry IP voice traffic from an IP phone. When the switch is connected to a Cisco 7960 IP Phone, the IP Phone sends voice traffic with Layer 3 IP precedence and Layer 2 class of service (CoS) values, which are both set to 5 by default. Because the sound quality of an IP phone call can deteriorate if the data is unevenly sent, the switch supports quality of service (QoS) based on IEEE 802.1P CoS. QoS uses classification and scheduling to send network traffic from the switch in a predictable manner. For more information on QoS, see Chapter 27, “Configuring QoS.” The Cisco 7960 IP Phone is a configurable device, and you can configure it to forward traffic with an 802.1P priority. You can configure the switch to trust or override the traffic priority assigned by an IP Phone. The Cisco IP Phone contains an integrated three-port 10/100 switch as shown in Figure 14-1. The ports provide dedicated connections to these devices: • Port 1 connects to the switch or other voice-over-IP (VoIP) device. • Port 2 is an internal 10/100 interface that carries the IP phone traffic. • Port 3 (access port) connects to a PC or other device. Figure 14-1 shows one way to connect a Cisco 7960 IP Phone.14-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 14 Configuring Voice VLAN Understanding Voice VLAN Figure 14-1 Cisco 7960 IP Phone Connected to a Switch Cisco IP Phone Voice Traffic You can configure an access port with an attached Cisco IP Phone to use one VLAN for voice traffic and another VLAN for data traffic from a device attached to the phone. You can configure access ports on the switch to send Cisco Discovery Protocol (CDP) packets that instruct an attached Cisco IP Phone to send voice traffic to the switch in any of these ways: • In the voice VLAN tagged with a Layer 2 CoS priority value • In the access VLAN tagged with a Layer 2 CoS priority value • In the access VLAN, untagged (no Layer 2 CoS priority value) Note In all configurations, the voice traffic carries a Layer 3 IP precedence value (the default is 5 for voice traffic and 3 for voice control traffic). Cisco IP Phone Data Traffic The switch can also process tagged data traffic (traffic in 802.1Q or 802.1P frame types) from the device attached to the access port on the Cisco IP Phone (see Figure 14-1). You can configure Layer 2 access ports on the switch to send CDP packets that instruct the attached Cisco IP Phone to configure the IP phone access port in one of these modes: • In trusted mode, all traffic received through the access port on the Cisco IP Phone passes through the IP phone unchanged. • In untrusted mode, all traffic in 802.1Q or 802.1P frames received through the access port on the IP phone receive a configured Layer 2 CoS value. The default Layer 2 CoS value is 0. Untrusted mode is the default. Note Untagged traffic from the device attached to the Cisco IP Phone passes through the IP phone unchanged, regardless of the trust state of the access port on the IP phone. 3-port switch P1 P3 P2 Access port Cisco IP Phone 7960 PC Catalyst 3750 switch 86701 Phone ASIC14-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 14 Configuring Voice VLAN Configuring Voice VLAN Configuring Voice VLAN This section describes how to configure voice VLAN on access ports. This section contains this configuration information: • Default Voice VLAN Configuration, page 14-3 • Voice VLAN Configuration Guidelines, page 14-3 • Configuring a Port Connected to a Cisco 7960 IP Phone, page 14-4 Default Voice VLAN Configuration The voice VLAN feature is disabled by default. When the voice VLAN feature is enabled, all untagged traffic is sent according to the default CoS priority of the port. The CoS value is not trusted for 802.1P or 802.1Q tagged traffic. Voice VLAN Configuration Guidelines These are the voice VLAN configuration guidelines: • You should configure voice VLAN on switch access ports; voice VLAN is not supported on trunk ports. You can only configure a voice VLAN on Layer 2 ports. Note Voice VLAN is only supported on access ports and not on trunk ports, even though the configuration is allowed. • Before you enable voice VLAN, we recommend that you enable QoS on the switch by entering the mls qos global configuration command and configure the port trust state to trust by entering the mls qos trust cos interface configuration command. If you use the auto-QoS feature, these settings are automatically configured. For more information, see Chapter 27, “Configuring QoS.” • You must enable CDP on the switch port connected to the Cisco IP Phone to send configuration to the Cisco IP Phone. (CDP is enabled by default globally and on all switch interfaces.) • The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled. • If the Cisco IP Phone and a device attached to the Cisco IP Phone are in the same VLAN, they must be in the same IP subnet. These conditions indicate that they are in the same VLAN: – They both use 802.1p or untagged frames. – The Cisco IP Phone uses 802.1p frames and the device uses untagged frames. – The Cisco IP Phone uses untagged frames and the device uses 802.1p frames. – The Cisco IP Phone uses 802.1Q frames and the voice VLAN is the same as the access VLAN. • The Cisco IP Phone and a device attached to the phone cannot communicate if they are in the same VLAN and subnet but use different frame types because traffic in the same subnet is not routed (routing would eliminate the frame type difference). • You cannot configure static secure MAC addresses in the voice VLAN.14-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 14 Configuring Voice VLAN Configuring Voice VLAN • Voice VLAN ports can also be these port types: – Dynamic access port. See the “Configuring Dynamic-Access Ports on VMPS Clients” section on page 12-31 for more information. – 802.1X authenticated port. See the “Configuring 802.1X Authentication” section on page 10-13 for more information. – Protected port. See the “Configuring Protected Ports” section on page 19-4 for more information. – A source or destination port for a SPAN or RSPAN session. – Secure port. See the “Configuring Port Security” section on page 19-7 for more information. Note When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to two plus the maximum number of secure addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the IP phone requires up to two MAC addresses. The IP phone address is learned on the voice VLAN and might also be learned on the access VLAN. Connecting a PC to the IP phone requires additional MAC addresses. Configuring a Port Connected to a Cisco 7960 IP Phone Because a Cisco 7960 IP Phone also supports a connection to a PC or other device, a port connecting the switch to a Cisco IP Phone can carry mixed traffic. You can configure a port to determine how the IP phone carries voice traffic and data traffic. This section includes these topics: • Configuring IP Phone Voice Traffic, page 14-4 • Configuring the Priority of Incoming Data Frames, page 14-5 Configuring IP Phone Voice Traffic You can configure a port connected to the Cisco IP Phone to send CDP packets to the phone to configure the way in which the phone sends voice traffic. The phone can carry voice traffic in 802.1Q frames for a specified voice VLAN with a Layer 2 CoS value. It can use 802.1P priority tagging to give voice traffic a higher priority and forward all voice traffic through the native (access) VLAN. The IP phone can also send untagged voice traffic or use its own configuration to send voice traffic in the access VLAN. In all configurations, the voice traffic carries a Layer 3 IP precedence value (the default is 5). Beginning in privileged EXEC mode, follow these steps to configure voice traffic on a port: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface connected to the IP phone. Step 3 mls qos trust cos Configure the interface to classify ingress traffic packets by using the packet CoS value. For untagged packets, the port default CoS value is used. Note Before configuring the port trust state, you must first globally enable QoS by using the mls qos global configuration command.14-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 14 Configuring Voice VLAN Configuring Voice VLAN To return the port to its default setting, use the no switchport voice vlan interface configuration command. Configuring the Priority of Incoming Data Frames You can connect a PC or other data device to a Cisco IP Phone port. To process tagged data traffic (in 802.1Q or 802.1P frames), you can configure the switch to send CDP packets to instruct the IP phone how to send data packets from the device attached to the access port on the Cisco IP Phone. The PC can generate packets with an assigned CoS value. You can configure the Cisco IP Phone to not change (trust) or to override (not trust) the priority of frames arriving on the IP phone port from connected devices. Beginning in privileged EXEC mode, follow these steps to set the priority of data traffic received from the nonvoice port on the Cisco IP Phone: Step 4 switchport voice vlan {vlan-id | dot1p | none | untagged} Configure how the Cisco IP Phone carries voice traffic: • vlan-id—Configure the Cisco IP Phone to forward all voice traffic through the specified VLAN. By default, the Cisco IP Phone forwards the voice traffic with an 802.1Q priority of 5. Valid VLAN IDs are from 1 to 4094. • dot1p—Configure the Cisco IP Phone to use 802.1P priority tagging for voice traffic and to use the default native VLAN (VLAN 0) to carry all traffic. By default, the Cisco IP Phone forwards the voice traffic with an 802.1P priority of 5. • none—Allow the IP phone to use its own configuration to send untagged voice traffic. • untagged—Configure the phone to send untagged voice traffic. Step 5 end Return to privileged EXEC mode. Step 6 show interfaces interface-id switchport or show running-config interface interface-id Verify your voice VLAN entries. Verify your QoS and voice VLAN entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface connected to the IP phone. Step 3 switchport priority extend {cos value | trust} Set the priority of data traffic received from the IP phone access port: • cos value—Configure the IP phone to override the priority received from the PC or the attached device with the specified CoS value. The value is a number from 0 to 7, with 7 as the highest priority. The default priority is cos 0. • trust—Configure the IP phone access port to trust the priority received from the PC or the attached device.14-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 14 Configuring Voice VLAN Displaying Voice VLAN To return the port to its default setting, use the no switchport priority extend interface configuration command. Displaying Voice VLAN To display voice VLAN configuration for an interface, use the show interfaces interface-id switchport privileged EXEC command. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id switchport Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command PurposeC H A P T E R 15-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 15 Configuring STP This chapter describes how to configure the Spanning Tree Protocol (STP) on port-based VLANs on the Catalyst 3750 switch. The switch uses the per-VLAN spanning-tree plus (PVST+) protocol based on the IEEE 802.1D standard and Cisco proprietary extensions, or it can use the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol based on the IEEE 802.1W standard. A switch stack appears as a single spanning-tree node to the rest of the network, and all stack members use the same bridge ID. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. For information about the Multiple Spanning Tree Protocol (MSTP) and how to map multiple VLANs to the same spanning-tree instance, see Chapter 16, “Configuring MSTP.” For information about other spanning-tree features such as Port Fast, UplinkFast, root guard, and so forth, see Chapter 17, “Configuring Optional Spanning-Tree Features.” Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding Spanning-Tree Features, page 15-1 • Configuring Spanning-Tree Features, page 15-13 • Displaying the Spanning-Tree Status, page 15-24 Understanding Spanning-Tree Features These sections describe how basic spanning-tree features work: • STP Overview, page 15-2 • Spanning-Tree Topology and BPDUs, page 15-3 • Bridge ID, Switch Priority, and Extended System ID, page 15-4 • Spanning-Tree Interface States, page 15-5 • How a Switch or Port Becomes the Root Switch or Root Port, page 15-8 • Spanning Tree and Redundant Connectivity, page 15-8 • Spanning-Tree Address Management, page 15-9 • Accelerated Aging to Retain Connectivity, page 15-9 • Spanning-Tree Modes and Protocols, page 15-1015-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features • Supported Spanning-Tree Instances, page 15-10 • Spanning-Tree Interoperability and Backward Compatibility, page 15-11 • STP and IEEE 802.1Q Trunks, page 15-11 • VLAN-Bridge Spanning Tree, page 15-12 • Spanning Tree and Switch Stacks, page 15-12 For configuration information, see the “Configuring Spanning-Tree Features” section on page 15-13. For information about optional spanning-tree features, see Chapter 17, “Configuring Optional Spanning-Tree Features.” STP Overview STP is a Layer 2 link management protocol that provides path redundancy while preventing loops in the network. For a Layer 2 Ethernet network to function properly, only one active path can exist between any two stations. Multiple active paths among end stations cause loops in the network. If a loop exists in the network, end stations might receive duplicate messages. Switches might also learn end-station MAC addresses on multiple Layer 2 interfaces. These conditions result in an unstable network. Spanning-tree operation is transparent to end stations, which cannot detect whether they are connected to a single LAN segment or a switched LAN of multiple segments. The STP uses a spanning-tree algorithm to select one switch of a redundantly connected network as the root of the spanning tree. The algorithm calculates the best loop-free path through a switched Layer 2 network by assigning a role to each port based on the role of the port in the active topology: • Root—A forwarding port elected for the spanning-tree topology • Designated—A forwarding port elected for every switched LAN segment • Alternate—A blocked port providing an alternate path to the root port in the spanning tree • Backup—A blocked port in a loopback configuration Switches that have ports with these assigned roles are called root or designated switches. Spanning tree forces redundant data paths into a standby (blocked) state. If a network segment in the spanning tree fails and a redundant path exists, the spanning-tree algorithm recalculates the spanning-tree topology and activates the standby path. Switches send and receive spanning-tree frames, called bridge protocol data units (BPDUs), at regular intervals. The switches do not forward these frames but use them to construct a loop-free path. BPDUs contain information about the sending switch and its ports, including switch and MAC addresses, switch priority, port priority, and path cost. Spanning tree uses this information to elect the root switch and root port for the switched network and the root port and designated port for each switched segment. When two interfaces on a switch are part of a loop, the spanning-tree port priority and path cost settings determine which interface is put in the forwarding state and which is put in the blocking state. The spanning-tree port priority value represents the location of an interface in the network topology and how well it is located to pass traffic. The path cost value represents the media speed. 15-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Spanning-Tree Topology and BPDUs The stable, active spanning-tree topology of a switched network is determined by these elements: • The unique bridge ID (switch priority and MAC address) associated with each VLAN on each switch. In a switch stack, all switches use the same bridge ID for a given spanning-tree instance. • The spanning-tree path cost to the root switch. • The port identifier (port priority and MAC address) associated with each Layer 2 interface. When the switches in a network are powered up, each functions as the root switch. Each switch sends a configuration BPDU through all of its ports. The BPDUs communicate and compute the spanning-tree topology. Each configuration BPDU contains this information: • The unique bridge ID of the switch that the sending switch identifies as the root switch • The spanning-tree path cost to the root • The bridge ID of the sending switch • Message age • The identifier of the sending interface • Values for the hello, forward delay, and max-age protocol timers When a switch receives a configuration BPDU that contains superior information (lower bridge ID, lower path cost, and so forth), it stores the information for that port. If this BPDU is received on the root port of the switch, the switch also forwards it with an updated message to all attached LANs for which it is the designated switch. If a switch receives a configuration BPDU that contains inferior information to that currently stored for that port, it discards the BPDU. If the switch is a designated switch for the LAN from which the inferior BPDU was received, it sends that LAN a BPDU containing the up-to-date information stored for that port. In this way, inferior information is discarded, and superior information is propagated on the network. A BPDU exchange results in these actions: • One switch in the network is elected as the root switch (the logical center of the spanning-tree topology in a switched network). In a switch stack, one stack member is elected as the stack root switch. The stack root switch contains the outgoing root port (Switch 1), as shown in Figure 15-1 on page 15-4. For each VLAN, the switch with the highest switch priority (the lowest numerical priority value) is elected as the root switch. If all switches are configured with the default priority (32768), the switch with the lowest MAC address in the VLAN becomes the root switch. The switch priority value occupies the most significant bits of the bridge ID, as shown in Table 15-1 on page 15-5. • A root port is selected for each switch (except the root switch). This port provides the best path (lowest cost) when the switch forwards packets to the root switch. When selecting the root port on a switch stack, spanning tree follows this sequence: – Selects the lowest root bridge ID – Selects the lowest path cost to the root switch – Selects the lowest designated bridge ID – Selects the lowest designated path cost – Selects the lowest port ID15-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Only one outgoing port on the stack root switch is selected as the root port. The remaining switches in the stack become its designated switches (Switch 2 and Switch 3) as shown in Figure 15-1 on page 15-4. • The shortest distance to the root switch is calculated for each switch based on the path cost. • A designated switch for each LAN segment is selected. The designated switch incurs the lowest path cost when forwarding packets from that LAN to the root switch. The port through which the designated switch is attached to the LAN is called the designated port. Figure 15-1 Spanning-Tree Port States in a Switch Stack All paths that are not needed to reach the root switch from anywhere in the switched network are placed in the spanning-tree blocking mode. Bridge ID, Switch Priority, and Extended System ID The IEEE 802.1D standard requires that each switch has an unique bridge identifier (bridge ID), which determines the selection of the root switch. Because each VLAN is considered as a different logical bridge with PVST+ and rapid PVST+, the same switch must have as many different bridge IDs as VLANs configured on it. Each VLAN on the switch has a unique 8-byte bridge ID. The two most-significant bytes are used for the switch priority, and the remaining six bytes are derived from the switch MAC address. The Catalyst 3750 switch supports the 802.1T spanning-tree extensions, and some of the bits previously used for the switch priority are now used as the VLAN identifier. The result is that fewer MAC addresses are reserved for the switch, and a larger range of VLAN IDs can be supported, all while maintaining the Switch 1 Catalyst 3750 switch stack DP Outgoing RP Switch 2 StackWise RP port connections BP DP Switch 3 Switch A Switch B RP DP Spanning-tree root DP RP RP = root port DP = designated port BP = blocked port 8649115-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features uniqueness of the bridge ID. As shown in Table 15-1, the two bytes previously used for the switch priority are reallocated into a 4-bit priority value and a 12-bit extended system ID value equal to the VLAN ID. Spanning tree uses the extended system ID, the switch priority, and the allocated spanning-tree MAC address to make the bridge ID unique for each VLAN. Because the switch stack appears as a single switch to the rest of the network, all switches in the stack use the same bridge ID for a given spanning tree. If the stack master fails, the stack members recalculate their bridge IDs of all running spanning trees based on the new MAC address of the new stack master. Support for the extended system ID affects how you manually configure the root switch, the secondary root switch, and the switch priority of a VLAN. For example, when you change the switch priority value, you change the probability that the switch will be elected as the root switch. Configuring a higher value decreases the probability; a lower value increases the probability. For more information, see the “Configuring the Root Switch” section on page 15-16, the “Configuring a Secondary Root Switch” section on page 15-18, and the “Configuring the Switch Priority of a VLAN” section on page 15-21. Spanning-Tree Interface States Propagation delays can occur when protocol information passes through a switched LAN. As a result, topology changes can take place at different times and at different places in a switched network. When an interface transitions directly from nonparticipation in the spanning-tree topology to the forwarding state, it can create temporary data loops. Interfaces must wait for new topology information to propagate through the switched LAN before starting to forward frames. They must allow the frame lifetime to expire for forwarded frames that have used the old topology. Each Layer 2 interface on a switch using spanning tree exists in one of these states: • Blocking—The interface does not participate in frame forwarding. • Listening—The first transitional state after the blocking state when the spanning tree determines that the interface should participate in frame forwarding. • Learning—The interface prepares to participate in frame forwarding. • Forwarding—The interface forwards frames. • Disabled—The interface is not participating in spanning tree because of a shutdown port, no link on the port, or no spanning-tree instance running on the port. An interface moves through these states: • From initialization to blocking • From blocking to listening or to disabled • From listening to learning or to disabled • From learning to forwarding or to disabled • From forwarding to disabled Table 15-1 Switch Priority Value and Extended System ID Switch Priority Value Extended System ID (Set Equal to the VLAN ID) Bit 16 Bit 15 Bit 14 Bit 13 Bit 12 Bit 11 Bit 10 Bit 9 Bit 8 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 32768 16384 8192 4096 2048 1024 512 256 128 64 32 16 8 4 2 115-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Figure 15-2 illustrates how an interface moves through the states. Figure 15-2 Spanning-Tree Interface States When you power up the switch, spanning tree is enabled by default, and every interface in the switch, VLAN, or network goes through the blocking state and the transitory states of listening and learning. Spanning tree stabilizes each interface at the forwarding or blocking state. When the spanning-tree algorithm places a Layer 2 interface in the forwarding state, this process occurs: 1. The interface is in the listening state while spanning tree waits for protocol information to transition the interface to the blocking state. 2. While spanning tree waits the forward-delay timer to expire, it moves the interface to the learning state and resets the forward-delay timer. 3. In the learning state, the interface continues to block frame forwarding as the switch learns end-station location information for the forwarding database. 4. When the forward-delay timer expires, spanning tree moves the interface to the forwarding state, where both learning and frame forwarding are enabled. Blocking State A Layer 2 interface in the blocking state does not participate in frame forwarding. After initialization, a BPDU is sent to each switch interface. A switch initially functions as the root until it exchanges BPDUs with other switches. This exchange establishes which switch in the network is the root or root switch. If there is only one switch in the network, no exchange occurs, the forward-delay timer expires, and the interfaces moves to the listening state. An interface always enters the blocking state after switch initialization. An interface in the blocking state performs these functions: • Discards frames received on the port • Discards frames switched from another interface for forwarding • Does not learn addresses • Receives BPDUs Power-on initialization Blocking state 43569 Listening state Disabled state Learning state Forwarding state15-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Listening State The listening state is the first state a Layer 2 interface enters after the blocking state. The interface enters this state when the spanning tree determines that the interface should participate in frame forwarding. An interface in the listening state performs these functions: • Discards frames received on the port • Discards frames switched from another interface for forwarding • Does not learn addresses • Receives BPDUs Learning State A Layer 2 interface in the learning state prepares to participate in frame forwarding. The interface enters the learning state from the listening state. An interface in the learning state performs these functions: • Discards frames received on the port • Discards frames switched from another interface for forwarding • Learns addresses • Receives BPDUs Forwarding State A Layer 2 interface in the forwarding state forwards frames. The interface enters the forwarding state from the learning state. An interface in the forwarding state performs these functions: • Receives and forwards frames received on the port • Forwards frames switched from another port • Learns addresses • Receives BPDUs Disabled State A Layer 2 interface in the disabled state does not participate in frame forwarding or in the spanning tree. An interface in the disabled state is nonoperational. A disabled interface performs these functions: • Discards frames received on the port • Discards frames switched from another interface for forwarding • Does not learn addresses • Does not receive BPDUs15-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features How a Switch or Port Becomes the Root Switch or Root Port If all switches in a network are enabled with default spanning-tree settings, the switch with the lowest MAC address becomes the root switch. In Figure 15-3, Switch A is elected as the root switch because the switch priority of all the switches is set to the default (32768) and Switch A has the lowest MAC address. However, because of traffic patterns, number of forwarding interfaces, or link types, Switch A might not be the ideal root switch. By increasing the priority (lowering the numerical value) of the ideal switch so that it becomes the root switch, you force a spanning-tree recalculation to form a new topology with the ideal switch as the root. Figure 15-3 Spanning-Tree Topology When the spanning-tree topology is calculated based on default parameters, the path between source and destination end stations in a switched network might not be ideal. For instance, connecting higher-speed links to an interface that has a higher number than the root port can cause a root-port change. The goal is to make the fastest link the root port. For example, assume that one port on Switch B is a Gigabit Ethernet link and that another port on Switch B (a 10/100 link) is the root port. Network traffic might be more efficient over the Gigabit Ethernet link. By changing the spanning-tree port priority on the Gigabit Ethernet interface to a higher priority (lower numerical value) than the root port, the Gigabit Ethernet interface becomes the new root port. Spanning Tree and Redundant Connectivity You can create a redundant backbone with spanning tree by connecting two switch interfaces to another device or to two different devices, as shown in Figure 15-4. Spanning tree automatically disables one interface but enables it if the other one fails. If one link is high-speed and the other is low-speed, the low-speed link is always disabled. If the speeds are the same, the port priority and port ID are added together, and spanning tree disables the link with the lowest value. 86475 DP DP RP RP DP DP RP = Root Port DP = Designated Port DP RP A D B C15-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Figure 15-4 Spanning Tree and Redundant Connectivity You can also create redundant links between switches by using EtherChannel groups. For more information, see the Chapter 28, “Configuring EtherChannels.” Spanning-Tree Address Management IEEE 802.1D specifies 17 multicast addresses, ranging from 0x00180C2000000 to 0x0180C2000010, to be used by different bridge protocols. These addresses are static addresses that cannot be removed. Regardless of the spanning-tree state, each switch in the stack receives but does not forward packets destined for addresses between 0x0180C2000000 and 0x0180C200000F. If spanning tree is enabled, the CPU on each switch in the stack receives packets destined for 0x0180C2000000 and 0x0180C2000010. If spanning tree is disabled, each switch in the stack forwards those packets as unknown multicast addresses. Accelerated Aging to Retain Connectivity The default for aging dynamic addresses is 5 minutes, the default setting of the mac-address-table aging-time global configuration command. However, a spanning-tree reconfiguration can cause many station locations to change. Because these stations could be unreachable for 5 minutes or more during a reconfiguration, the address-aging time is accelerated so that station addresses can be dropped from the address table and then relearned. The accelerated aging is the same as the forward-delay parameter value (spanning-tree vlan vlan-id forward-time seconds global configuration command) when the spanning tree reconfigures. Because each VLAN is a separate spanning-tree instance, the switch accelerates aging on a per-VLAN basis. A spanning-tree reconfiguration on one VLAN can cause the dynamic addresses learned on that VLAN to be subject to accelerated aging. Dynamic addresses on other VLANs can be unaffected and remain subject to the aging interval entered for the switch. Catalyst 3750 switch Workstations Catalyst 3750 switch Catalyst 3750 switch Switch A Switch B Active link Blocked link Switch C 8647615-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Spanning-Tree Modes and Protocols The switch supports these spanning-tree modes and protocols: PVST+—This spanning-tree mode is based on the IEEE 802.1D standard and Cisco proprietary extensions. It is the default spanning-tree mode used on all Ethernet, Fast Ethernet, and Gigabit Ethernet port-based VLANs. The PVST+ runs on each VLAN on the switch up to the maximum supported, ensuring that each has a loop-free path through the network. The PVST+ provides Layer 2 load balancing for the VLAN on which it runs. You can create different logical topologies by using the VLANs on your network to ensure that all of your links are used but that no one link is oversubscribed. Each instance of PVST+ on a VLAN has a single root switch. This root switch propagates the spanning-tree information associated with that VLAN to all other switches in the network. Because each switch has the same information about the network, this process ensures that the network topology is maintained. • Rapid PVST+—This spanning-tree mode is the same as PVST+ except that is uses a rapid convergence based on the IEEE 802.1W standard. To provide rapid convergence, the rapid PVST+ immediately deletes dynamically learned MAC address entries on a per-port basis upon receiving a topology change. By contrast, PVST+ uses a short aging time for dynamically learned MAC address entries. The rapid PVST+ uses the same configuration as PVST+ (except where noted), and the switch needs only minimal extra configuration. The benefit of rapid PVST+ is that you can migrate a large PVST+ install base to rapid PVST+ without having to learn the complexities of the MSTP configuration and without having to reprovision your network. In rapid-PVST+ mode, each VLAN runs its own spanning-tree instance up to the maximum supported. • MSTP—This spanning-tree mode is based on the IEEE 802.1S standard. You can map multiple VLANs to the same spanning-tree instance, which reduces the number of spanning-tree instances required to support a large number of VLANs. The MSTP runs on top of the RSTP (based on IEEE 802.1W), which provides for rapid convergence of the spanning tree by eliminating the forward delay and by quickly transitioning root ports and designated ports to the forwarding state. In a switch stack, the cross-stack rapid transition (CSRT) feature performs the same function as RSTP. You cannot run MSTP without RSTP or CSRT. The most common initial deployment of MSTP is in the backbone and distribution layers of a Layer 2 switched network. For more information, see Chapter 16, “Configuring MSTP.” For information about the number of supported spanning-tree instances, see the next section. Supported Spanning-Tree Instances In PVST+ or rapid-PVST+ mode, the switch stack supports up to 128 spanning-tree instances. In MSTP mode, the switch stack supports up to 16 MST instances. The number of VLANs that can be mapped to a particular MST instance is unlimited. For information about how spanning tree interoperates with the VLAN Trunking Protocol (VTP), see the “Spanning-Tree Configuration Guidelines” section on page 15-14.15-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features Spanning-Tree Interoperability and Backward Compatibility Table 15-2 lists the interoperability and compatibility among the supported spanning-tree modes in a network. In a mixed MSTP and PVST+ network, the common spanning-tree (CST) root must be inside the MST backbone, and a PVST+ switch cannot connect to multiple MST regions. When a network contains switches running rapid PVST+ and switches running PVST+, we recommend that the rapid-PVST+ switches and PVST+ switches be configured for different spanning-tree instances. In the rapid-PVST+ spanning-tree instances, the root switch must be a rapid-PVST+ switch. In the PVST+ instances, the root switch must be a PVST+ switch. The PVST+ switches should be at the edge of the network. All stack members run the same version of spanning tree (all PVST+, all rapid PVST+, or all MSTP). STP and IEEE 802.1Q Trunks The IEEE 802.1Q standard for VLAN trunks imposes some limitations on the spanning-tree strategy for a network. The standard requires only one spanning-tree instance for all VLANs allowed on the trunks. However, in a network of Cisco switches connected through 802.1Q trunks, the switches maintain one spanning-tree instance for each VLAN allowed on the trunks. When you connect a Cisco switch to a non-Cisco device through an 802.1Q trunk, the Cisco switch uses PVST+ to provide spanning-tree interoperability. If rapid PVST+ is enabled, the switch uses it instead of PVST+. The switch combines the spanning-tree instance of the 802.1Q VLAN of the trunk with the spanning-tree instance of the non-Cisco 802.1Q switch. However, all PVST+ or rapid-PVST+ information is maintained by Cisco switches separated by a cloud of non-Cisco 802.1Q switches. The non-Cisco 802.1Q cloud separating the Cisco switches is treated as a single trunk link between the switches. PVST+ is automatically enabled on 802.1Q trunks, and no user configuration is required. The external spanning-tree behavior on access ports and Inter-Switch Link (ISL) trunk ports is not affected by PVST+. For more information on 802.1Q trunks, see Chapter 12, “Configuring VLANs.” Table 15-2 PVST+, MSTP, and Rapid-PVST+ Interoperability PVST+ MSTP Rapid PVST+ PVST+ Yes Yes (with restrictions) Yes (reverts to PVST+) MSTP Yes (with restrictions) Yes Yes (reverts to PVST+) Rapid PVST+ Yes (reverts to PVST+) Yes (reverts to PVST+) Yes15-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Understanding Spanning-Tree Features VLAN-Bridge Spanning Tree Cisco VLAN-bridge spanning tree is used with the fallback bridging feature (bridge groups), which forwards non-IP protocols such as DECnet between two or more VLAN bridge domains or routed ports. The VLAN-bridge spanning tree allows the bridge groups to form a spanning tree on top of the individual VLAN spanning trees to prevent loops from forming if there are multiple connections among VLANs. It also prevents the individual spanning trees from the VLANs being bridged from collapsing into a single spanning tree. To support VLAN-bridge spanning tree, some of the spanning-tree timers are increased. To use the fallback bridging feature, you must have the enhanced multilayer software image installed on your switch. For more information, see Chapter 33, “Configuring Fallback Bridging.” Spanning Tree and Switch Stacks These statements are true when the switch stack is operating in PVST+ or rapid-PVST+ mode: • A switch stack appears as a single spanning-tree node to the rest of the network, and all stack members use the same bridge ID for a given spanning tree. The bridge ID is derived from the MAC address of the stack master. • When a new switch joins the stack, it sets its bridge ID to the stack-master bridge ID. If the newly added switch has the lowest ID and if the root path cost is the same among all stack members, the newly added switch becomes the stack root. • When a stack member leaves the stack, spanning-tree reconvergence occurs within the stack (and possibly outside the stack). The remaining stack member with the lowest stack port ID becomes the stack root. • If the stack master fails or leaves the stack, the stack members elect a new stack master, and all stack members change their bridge IDs of the spanning trees to the new master bridge ID. • If the switch stack is the spanning-tree root and the stack master fails or leaves the stack, the stack members elect a new stack master, and a spanning-tree reconvergence occurs. • If a neighboring switch external to the switch stack fails or is powered down, normal spanning-tree processing occurs. Spanning-tree reconvergence might occur as a result of losing a switch in the active topology. • If a new switch external to the switch stack is added to the network, normal spanning-tree processing occurs. Spanning-tree reconvergence might occur as a result of adding a switch in the network. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.”15-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Configuring Spanning-Tree Features These sections describe how to configure spanning-tree features: • Default Spanning-Tree Configuration, page 15-13 • Spanning-Tree Configuration Guidelines, page 15-14 • Changing the Spanning-Tree Mode, page 15-15 (required) • Disabling Spanning Tree, page 15-16 (optional) • Configuring the Root Switch, page 15-16 (optional) • Configuring a Secondary Root Switch, page 15-18 (optional) • Configuring Port Priority, page 15-19 (optional) • Configuring Path Cost, page 15-20 (optional) • Configuring the Switch Priority of a VLAN, page 15-21 (optional) • Configuring Spanning-Tree Timers, page 15-22 (optional) Default Spanning-Tree Configuration Table 15-3 shows the default spanning-tree configuration. Table 15-3 Default Spanning-Tree Configuration Feature Default Setting Enable state Enabled on VLAN 1. For more information, see the “Supported Spanning-Tree Instances” section on page 15-10. Spanning-tree mode PVST+. (Rapid PVST+ and MSTP are disabled.) Switch priority 32768. Spanning-tree port priority (configurable on a per-interface basis) 128. Spanning-tree port cost (configurable on a per-interface basis) 1000 Mbps: 4. 100 Mbps: 19. 10 Mbps: 100. Spanning-tree VLAN port priority (configurable on a per-VLAN basis) 128. Spanning-tree VLAN port cost (configurable on a per-VLAN basis) 1000 Mbps: 4. 100 Mbps: 19. 10 Mbps: 100. Spanning-tree timers Hello time: 2 seconds. Forward-delay time: 15 seconds. Maximum-aging time: 20 seconds.15-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Spanning-Tree Configuration Guidelines Each stack member runs its own spanning tree, and the entire stack appears as a single switch to the rest of the network. If more VLANs are defined in the VTP than there are spanning-tree instances, you can enable PVST+ or rapid PVST+ on only 128 VLANs on each switch stack. The remaining VLANs operate with spanning tree disabled. However, you can map multiple VLANs to the same spanning-tree instances by using MSTP. For more information, see Chapter 16, “Configuring MSTP.” If 128 instances of spanning tree are already in use, you can disable spanning tree on one of the VLANs and then enable it on the VLAN where you want it to run. Use the no spanning-tree vlan vlan-id global configuration command to disable spanning tree on a specific VLAN, and use the spanning-tree vlan vlan-id global configuration command to enable spanning tree on the desired VLAN. Caution Switches that are not running spanning tree still forward BPDUs that they receive so that the other switches on the VLAN that have a running spanning-tree instance can break loops. Therefore, spanning tree must be running on enough switches to break all the loops in the network; for example, at least one switch on each loop in the VLAN must be running spanning tree. It is not absolutely necessary to run spanning tree on all switches in the VLAN. However, if you are running spanning tree only on a minimal set of switches, an incautious change to the network that introduces another loop into the VLAN can result in a broadcast storm. Note If you have already used all available spanning-tree instances on your switch, adding another VLAN anywhere in the VTP domain creates a VLAN that is not running spanning tree on that switch. If you have the default allowed list on the trunk ports of that switch, the new VLAN is carried on all trunk ports. Depending on the topology of the network, this could create a loop in the new VLAN that will not be broken, particularly if there are several adjacent switches that have all run out of spanning-tree instances. You can prevent this possibility by setting up allowed lists on the trunk ports of switches that have used up their allocation of spanning-tree instances. Setting up allowed lists is not necessary in many cases and can make it more labor-intensive to add another VLAN to the network. Spanning-tree commands determine the configuration of VLAN spanning-tree instances. You create a spanning-tree instance when you assign an interface to a VLAN. The spanning-tree instance is removed when the last interface is moved to another VLAN. You can configure switch and port parameters before a spanning-tree instance is created; these parameters are applied when the spanning-tree instance is created. The switch supports PVST+, rapid PVST+, and MSTP, but only one version can be active at any time. (For example, all VLANs run PVST+, all VLANs run rapid PVST+, or all VLANs run MSTP.) All stack members run the same version of spanning tree. For information about the different spanning-tree modes and how they interoperate, see the “Spanning-Tree Interoperability and Backward Compatibility” section on page 15-11. The UplinkFast, BackboneFast, and cross-stack UplinkFast features are not supported with the rapid PVST+. 15-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Changing the Spanning-Tree Mode The switch supports three spanning-tree modes: PVST+, rapid PVST+, or MSTP. By default, the switch runs the PVST+ protocol. Beginning in privileged EXEC mode, follow these steps to change the spanning-tree mode. If you want to enable a mode that is different from the default mode, this procedure is required. To return to the default setting, use the no spanning-tree mode global configuration command. To return the port to its default setting, use the no spanning-tree link-type interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mode {pvst | mst | rapid-pvst} Configure a spanning-tree mode. All stack members run the same version of spanning-tree. • Select pvst to enable PVST+ (the default setting). • Select mst to enable MSTP (and RSTP). For more configuration steps, see Chapter 16, “Configuring MSTP.” • Select rapid-pvst to enable rapid PVST+. Step 3 interface interface-id (Recommended for rapid-PVST+ mode only) Enter interface configuration mode, and specify an interface to configure. Valid interfaces include physical ports, VLANs, and port channels. The VLAN ID range is 1 to 4094. The port-channel range is 1 to 12. Step 4 spanning-tree link-type point-to-point (Recommended for rapid-PVST+ mode only) Specify that the link type for this port is point-to-point. If you connect this port (local port) to a remote port through a point-to-point link and the local port becomes a designated port, the switch negotiates with the remote port and rapidly transitions the local port to the forwarding state. Step 5 end Return to privileged EXEC mode. Step 6 clear spanning-tree detected-protocols (Recommended for rapid-PVST+ mode only) If any port on the switch is connected to a port on a legacy 802.1D switch, restart the protocol migration process on the entire switch. This step is optional if the designated switch determines that this switch is running rapid PVST+. Step 7 show spanning-tree summary and show spanning-tree interface interface-id Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.15-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Disabling Spanning Tree Spanning tree is enabled by default on VLAN 1 and on all newly created VLANs up to the spanning-tree limit specified in the “Supported Spanning-Tree Instances” section on page 15-10. Disable spanning tree only if you are sure there are no loops in the network topology. Caution When spanning tree is disabled and loops are present in the topology, excessive traffic and indefinite packet duplication can drastically reduce network performance. Beginning in privileged EXEC mode, follow these steps to disable spanning-tree on a per-VLAN basis. This procedure is optional. To re-enable spanning-tree, use the spanning-tree vlan vlan-id global configuration command. Configuring the Root Switch The switch maintains a separate spanning-tree instance for each active VLAN configured on it. A bridge ID, consisting of the switch priority and the switch MAC address, is associated with each instance. For each VLAN, the switch with the lowest bridge ID becomes the root switch for that VLAN. To configure a switch to become the root for the specified VLAN, use the spanning-tree vlan vlan-id root global configuration command to modify the switch priority from the default value (32768) to a significantly lower value. When you enter this command, the software checks the switch priority of the root switches for each VLAN. Because of the extended system ID support, the switch sets its own priority for the specified VLAN to 24576 if this value will cause this switch to become the root for the specified VLAN. If any root switch for the specified VLAN has a switch priority lower than 24576, the switch sets its own priority for the specified VLAN to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value as shown in Table 15-1 on page 15-5.) Note The spanning-tree vlan vlan-id root global configuration command fails if the value necessary to be the root switch is less than 1. Note If your network consists of switches that both do and do not support the extended system ID, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches running older software. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no spanning-tree vlan vlan-id For vlan-id, the range is 1 to 4094. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree vlan vlan-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Note The root switch for each spanning-tree instance should be a backbone or distribution switch. Do not configure an access switch as the spanning-tree primary root. Use the diameter keyword to specify the Layer 2 network diameter (that is, the maximum number of switch hops between any two end stations in the Layer 2 network). When you specify the network diameter, the switch automatically sets an optimal hello time, forward-delay time, and maximum-age time for a network of that diameter, which can significantly reduce the convergence time. You can use the hello keyword to override the automatically calculated hello time. Note After configuring the switch as the root switch, we recommend that you avoid manually configuring the hello time, forward-delay time, and maximum-age time through the spanning-tree vlan vlan-id hello-time, spanning-tree vlan vlan-id forward-time, and the spanning-tree vlan vlan-id max-age global configuration commands. Beginning in privileged EXEC mode, follow these steps to configure a switch to become the root for the specified VLAN. This procedure is optional. To return to the default setting, use the no spanning-tree vlan vlan-id root global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id root primary [diameter net-diameter [hello-time seconds]] Configure a switch to become the root for the specified VLAN. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • (Optional) For diameter net-diameter, specify the maximum number of switches between any two end stations. The range is 2 to 7. • (Optional) For hello-time seconds, specify the interval in seconds between the generation of configuration messages by the root switch. The range is 1 to 10; the default is 2. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree detail Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Configuring a Secondary Root Switch When you configure a Catalyst 3750 switch as the secondary root, the switch priority is modified from the default value (32768) to 28672. The switch is then likely to become the root switch for the specified VLAN if the primary root switch fails. This is assuming that the other network switches use the default switch priority of 32768 and therefore are unlikely to become the root switch. You can execute this command on more than one switch to configure multiple backup root switches. Use the same network diameter and hello-time values that you used when you configured the primary root switch with the spanning-tree vlan vlan-id root primary global configuration command. Beginning in privileged EXEC mode, follow these steps to configure a switch to become the secondary root for the specified VLAN. This procedure is optional. To return to the default setting, use the no spanning-tree vlan vlan-id root global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id root secondary [diameter net-diameter [hello-time seconds]] Configure a switch to become the secondary root for the specified VLAN. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • (Optional) For diameter net-diameter, specify the maximum number of switches between any two end stations. The range is 2 to 7. • (Optional) For hello-time seconds, specify the interval in seconds between the generation of configuration messages by the root switch. The range is 1 to 10; the default is 2. Use the same network diameter and hello-time values that you used when configuring the primary root switch. See the “Configuring the Root Switch” section on page 15-16. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree detail Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Configuring Port Priority If a loop occurs, spanning tree uses the port priority when selecting an interface to put into the forwarding state. You can assign higher priority values (lower numerical values) to interfaces that you want selected first and lower priority values (higher numerical values) that you want selected last. If all interfaces have the same priority value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks the other interfaces. Note If your switch is a member of a switch stack, you must use the spanning-tree [vlan vlan-id] cost cost interface configuration command instead of the spanning-tree [vlan vlan-id] port-priority priority interface configuration command to select an interface to put in the forwarding state. Assign lower cost values to interfaces that you want selected first and higher cost values that you want selected last. For more information, see the “Configuring Path Cost” section on page 15-20. Beginning in privileged EXEC mode, follow these steps to configure the port priority of an interface. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Step 3 spanning-tree port-priority priority Configure the port priority for an interface. For priority, the range is 0 to 240, in increments of 16; the default is 128. Valid values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority. Step 4 spanning-tree vlan vlan-id port-priority priority Configure the port priority for a VLAN. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For priority, the range is 0 to 240, in increments of 16; the default is 128. Valid values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. The lower the number, the higher the priority. Step 5 end Return to privileged EXEC mode. Step 6 show spanning-tree interface interface-id or show spanning-tree vlan vlan-id Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.15-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Note The show spanning-tree interface interface-id privileged EXEC command displays information only if the port is in a link-up operative state. Otherwise, you can use the show running-config interface privileged EXEC command to confirm the configuration. To return to the default setting, use the no spanning-tree [vlan vlan-id] port-priority interface configuration command. For information on how to configure load sharing on trunk ports by using spanning-tree port priorities, see the “Configuring Trunk Ports for Load Sharing” section on page 12-24. Configuring Path Cost The spanning-tree path cost default value is derived from the media speed of an interface. If a loop occurs, spanning tree uses cost when selecting an interface to put in the forwarding state. You can assign lower cost values to interfaces that you want selected first and higher cost values that you want selected last. If all interfaces have the same cost value, spanning tree puts the interface with the lowest interface number in the forwarding state and blocks the other interfaces. Beginning in privileged EXEC mode, follow these steps to configure the cost of an interface. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Step 3 spanning-tree cost cost Configure the cost for an interface. If a loop occurs, spanning tree uses the path cost when selecting an interface to place into the forwarding state. A lower path cost represents higher-speed transmission. For cost, the range is 1 to 200000000; the default value is derived from the media speed of the interface. Step 4 spanning-tree vlan vlan-id cost cost Configure the cost for a VLAN. If a loop occurs, spanning tree uses the path cost when selecting an interface to place into the forwarding state. A lower path cost represents higher-speed transmission. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For cost, the range is 1 to 200000000; the default value is derived from the media speed of the interface. Step 5 end Return to privileged EXEC mode.15-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Note The show spanning-tree interface interface-id privileged EXEC command displays information only for ports that are in a link-up operative state. Otherwise, you can use the show running-config privileged EXEC command to confirm the configuration. To return to the default setting, use the no spanning-tree [vlan vlan-id] cost interface configuration command. For information on how to configure load sharing on trunk ports by using spanning-tree path costs, see the “Configuring Trunk Ports for Load Sharing” section on page 12-24. Configuring the Switch Priority of a VLAN You can configure the switch priority and make it more likely that a standalone switch or a switch in the stack will be chosen as the root switch. Note Exercise care when using this command. For most situations, we recommend that you use the spanning-tree vlan vlan-id root primary and the spanning-tree vlan vlan-id root secondary global configuration commands to modify the switch priority. Beginning in privileged EXEC mode, follow these steps to configure the switch priority of a VLAN. This procedure is optional. Step 6 show spanning-tree interface interface-id or show spanning-tree vlan vlan-id Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id priority priority Configure the switch priority of a VLAN. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For priority, the range is 0 to 61440 in increments of 4096; the default is 32768. The lower the number, the more likely the switch will be chosen as the root switch. Valid priority values are 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree vlan vlan-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features To return to the default setting, use the no spanning-tree vlan vlan-id priority global configuration command. Configuring Spanning-Tree Timers Table 15-4 describes the timers that affect the entire spanning-tree performance. The sections that follow provide the configuration steps. Configuring the Hello Time You can configure the interval between the generation of configuration messages by the root switch by changing the hello time. Note Exercise care when using this command. For most situations, we recommend that you use the spanning-tree vlan vlan-id root primary and the spanning-tree vlan vlan-id root secondary global configuration commands to modify the hello time. Beginning in privileged EXEC mode, follow these steps to configure the hello time of a VLAN. This procedure is optional. To return to the default setting, use the no spanning-tree vlan vlan-id hello-time global configuration command. Table 15-4 Spanning-Tree Timers Variable Description Hello timer Determines how often the switch broadcasts hello messages to other switches. Forward-delay timer Determines how long each of the listening and learning states last before the interface begins forwarding. Maximum-age timer Determines the amount of time the switch stores protocol information received on an interface. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id hello-time seconds Configure the hello time of a VLAN. The hello time is the interval between the generation of configuration messages by the root switch. These messages mean that the switch is alive. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For seconds, the range is 1 to 10; the default is 2. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree vlan vlan-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Configuring Spanning-Tree Features Configuring the Forwarding-Delay Time for a VLAN Beginning in privileged EXEC mode, follow these steps to configure the forwarding-delay time for a VLAN. This procedure is optional. To return to the default setting, use the no spanning-tree vlan vlan-id forward-time global configuration command. Configuring the Maximum-Aging Time for a VLAN Beginning in privileged EXEC mode, follow these steps to configure the maximum-aging time for a VLAN. This procedure is optional. To return to the default setting, use the no spanning-tree vlan vlan-id max-age global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id forward-time seconds Configure the forward time of a VLAN. The forward delay is the number of seconds a port waits before changing from its spanning-tree learning and listening states to the forwarding state. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For seconds, the range is 4 to 30; the default is 15. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree vlan vlan-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree vlan vlan-id max-age seconds Configure the maximum-aging time of a VLAN. The maximum-aging time is the number of seconds a switch waits without receiving spanning-tree configuration messages before attempting a reconfiguration. • For vlan-id, you can specify a single VLAN identified by VLAN ID number, a range of VLANs separated by a hyphen, or a series of VLANs separated by a comma. The range is 1 to 4094. • For seconds, the range is 6 to 40; the default is 20. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree vlan vlan-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.15-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 15 Configuring STP Displaying the Spanning-Tree Status Displaying the Spanning-Tree Status To display the spanning-tree status, use one or more of the privileged EXEC commands in Table 15-5: You can clear spanning-tree counters by using the clear spanning-tree [interface interface-id] privileged EXEC command. For information about other keywords for the show spanning-tree privileged EXEC command, refer to the command reference for this release. Table 15-5 Commands for Displaying Spanning-Tree Status Command Purpose show spanning-tree active Displays spanning-tree information on active interfaces only. show spanning-tree detail Displays a detailed summary of interface information. show spanning-tree interface interface-id Displays spanning-tree information for the specified interface. show spanning-tree summary [totals] Displays a summary of port states or displays the total lines of the STP state section.C H A P T E R 16-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 16 Configuring MSTP This chapter describes how to configure the Cisco implementation of the IEEE 802.1S Multiple STP (MSTP) on the Catalyst 3750 switch. The MSTP enables multiple VLANs to be mapped to the same spanning-tree instance, thereby reducing the number of spanning-tree instances needed to support a large number of VLANs. The MSTP provides for multiple forwarding paths for data traffic and enables load balancing. It improves the fault tolerance of the network because a failure in one instance (forwarding path) does not affect other instances (forwarding paths). The most common initial deployment of MSTP is in the backbone and distribution layers of a Layer 2 switched network; this deployment provides the highly-available network required in a service-provider environment. When the switch is in the multiple spanning-tree (MST) mode, the Rapid Spanning Tree Protocol (RSTP), which is based on IEEE 802.1W, is automatically enabled. The RSTP provides rapid convergence of the spanning tree through explicit handshaking that eliminates the IEEE 802.1D forwarding delay and quickly transitions root ports and designated ports to the forwarding state. Both MSTP and RSTP improve the spanning-tree operation and maintain backward compatibility with equipment that is based on the (original) 802.1D spanning tree, with existing Cisco-proprietary Multiple Instance STP (MISTP), and with existing Cisco per-VLAN spanning-tree plus (PVST+) and rapid per-VLAN spanning-tree plus (rapid PVST+). For information about PVST+ and rapid PVST+, see Chapter 15, “Configuring STP.” For information about other spanning-tree features such as Port Fast, UplinkFast, root guard, and so forth, see Chapter 17, “Configuring Optional Spanning-Tree Features.” A switch stack appears as a single spanning-tree node to the rest of the network, and all stack members use the same bridge ID. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding MSTP, page 16-2 • Understanding RSTP, page 16-7 • Configuring MSTP Features, page 16-12 • Displaying the MST Configuration and Status, page 16-2416-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding MSTP Understanding MSTP MSTP, which uses RSTP for rapid convergence, enables VLANs to be grouped into a spanning-tree instance, with each instance having a spanning-tree topology independent of other spanning-tree instances. This architecture provides multiple forwarding paths for data traffic, enables load balancing, and reduces the number of spanning-tree instances required to support a large number of VLANs. These sections describe how the MSTP works: • Multiple Spanning-Tree Regions, page 16-2 • IST, CIST, and CST, page 16-3 • Hop Count, page 16-5 • Boundary Ports, page 16-5 • “MSTP and Switch Stacks” section on page 16-6 • “Interoperability with 802.1D STP” section on page 16-6 For configuration information, see the “Configuring MSTP Features” section on page 16-12. Multiple Spanning-Tree Regions For switches to participate in multiple spanning-tree (MST) instances, you must consistently configure the switches with the same MST configuration information. A collection of interconnected switches that have the same MST configuration comprises an MST region as shown in Figure 16-1 on page 16-4. The MST configuration determines to which MST region each switch belongs. The configuration includes the name of the region, the revision number, and the MST VLAN-to-instance assignment map. You configure the switch for a region by using the spanning-tree mst configuration global configuration command, after which the switch enters the MST configuration mode. From this mode, you can map VLANs to an MST instance by using the instance MST configuration command, specify the region name by using the name MST configuration command, and set the revision number by using the revision MST configuration command. A region can have one member or multiple members with the same MST configuration; each member must be capable of processing RSTP bridge protocol data units (BPDUs). There is no limit to the number of MST regions in a network, but each region can support up to 16 spanning-tree instances. You can assign a VLAN to only one spanning-tree instance at a time.16-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding MSTP IST, CIST, and CST Unlike PVST+ and rapid PVST+ in which all the spanning-tree instances are independent, the MSTP establishes and maintains two types of spanning trees: • An internal spanning tree (IST), which is the spanning tree that runs in an MST region. Within each MST region, the MSTP maintains multiple spanning-tree instances. Instance 0 is a special instance for a region, known as the internal spanning tree (IST). All other MST instances are numbered from 1 to 15. The IST is the only spanning-tree instance that sends and receives BPDUs; all of the other spanning-tree instance information is contained in M-records, which are encapsulated within MSTP BPDUs. Because the MSTP BPDU carries information for all instances, the number of BPDUs that need to be processed by a switch to support multiple spanning-tree instances is significantly reduced. All MST instances within the same region share the same protocol timers, but each MST instance has its own topology parameters, such as root switch ID, root path cost, and so forth. By default, all VLANs are assigned to the IST. An MST instance is local to the region; for example, MST instance 1 in region A is independent of MST instance 1 in region B, even if regions A and B are interconnected. • A common and internal spanning tree (CIST), which is a collection of the ISTs in each MST region, and the common spanning tree (CST) that interconnects the MST regions and single spanning trees. The spanning tree computed in a region appears as a subtree in the CST that encompasses the entire switched domain. The CIST is formed as a result of the spanning-tree algorithm running between switches that support the 802.1W, 802.1S, and 802.1D protocols. The CIST inside an MST region is the same as the CST outside a region. For more information, see the “Operations Within an MST Region” section on page 16-3 and the “Operations Between MST Regions” section on page 16-4. Operations Within an MST Region The IST connects all the MSTP switches in a region. When the IST converges, the root of the IST becomes the IST master (shown in Figure 16-1 on page 16-4), which is the switch within the region with the lowest bridge ID and path cost to the CST root. The IST master also is the CST root if there is only one region within the network. If the CST root is outside the region, one of the MSTP switches at the boundary of the region is selected as the IST master. When an MSTP switch initializes, it sends BPDUs claiming itself as the root of the CST and the IST master, with both of the path costs to the CST root and to the IST master set to zero. The switch also initializes all of its MST instances and claims to be the root for all of them. If the switch receives superior MST root information (lower bridge ID, lower path cost, and so forth) than currently stored for the port, it relinquishes its claim as the IST master. During initialization, a region might have many subregions, each with its own IST master. As switches receive superior IST information, they leave their old subregions and join the new subregion that might contain the true IST master. Thus all subregions shrink, except for the one that contains the true IST master. For correct operation, all switches in the MST region must agree on the same IST master. Therefore, any two switches in the region synchronize their port roles for an MST instance only if they converge to a common IST master. 16-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding MSTP Operations Between MST Regions If there are multiple regions or legacy 802.1D switches within the network, MSTP establishes and maintains the CST, which includes all MST regions and all legacy STP switches in the network. The MST instances combine with the IST at the boundary of the region to become the CST. The IST connects all the MSTP switches in the region and appears as a subtree in the CST that encompasses the entire switched domain, with the root of the subtree being the IST master. The MST region appears as a virtual switch to adjacent STP switches and MST regions. Figure 16-1 shows a network with three MST regions and a legacy 802.1D switch (D). The IST master for region 1 (A) is also the CST root. The IST master for region 2 (B) and the IST master for region 3 (C) are the roots for their respective subtrees within the CST. The RSTP runs in all regions. Figure 16-1 MST Regions, IST Masters, and the CST Root Figure 16-1 does not show additional MST instances for each region. Note that the topology of MST instances can be different from that of the IST for the same region. Only the CST instance sends and receives BPDUs, and MST instances add their spanning-tree information into the BPDUs to interact with neighboring switches and compute the final spanning-tree topology. Because of this, the spanning-tree parameters related to BPDU transmission (for example, hello time, forward time, max-age, and max-hops) are configured only on the CST instance but affect all MST instances. Parameters related to the spanning-tree topology (for example, switch priority, port VLAN cost, port VLAN priority) can be configured on both the CST instance and the MST instance. MSTP switches use version 3 RSTP BPDUs or 802.1D STP BPDUs to communicate with legacy 802.1D switches. MSTP switches use MSTP BPDUs to communicate with MSTP switches. IST master and CST root IST master IST master A MST Region 1 D Legacy 802.1D B MST Region 2 MST Region 3 C 8876216-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding MSTP Hop Count The IST and MST instances do not use the message-age and maximum-age information in the configuration BPDU to compute the spanning-tree topology. Instead, they use the path cost to the root and a hop-count mechanism similar to the IP time-to-live (TTL) mechanism. By using the spanning-tree mst max-hops global configuration command, you can configure the maximum hops inside the region and apply it to the IST and all MST instances in that region. The hop count achieves the same result as the message-age information (determines when to trigger a reconfiguration). The root switch of the instance always sends a BPDU (or M-record) with a cost of 0 and the hop count set to the maximum value. When a switch receives this BPDU, it decrements the received remaining hop count by one and propagates this value as the remaining hop count in the BPDUs it generates. When the count reaches zero, the switch discards the BPDU and ages the information held for the port. The message-age and maximum-age information in the RSTP portion of the BPDU remain the same throughout the region, and the same values are propagated by the region’s designated ports at the boundary. Boundary Ports A boundary port is a port that connects an MST region to a single spanning-tree region running RSTP, to a single spanning-tree region running PVST+ or rapid PVST+, or to another MST region with a different MST configuration. A boundary port also connects to a LAN, the designated switch of which is either a single spanning-tree switch or a switch with a different MST configuration. At the boundary, the roles of the MST ports do not matter, and their state is forced to be the same as the IST port state (MST ports at the boundary are in the forwarding state only when the IST port is forwarding). An IST port at the boundary can have any port role except a backup port role. On a shared boundary link, the MST ports wait in the blocking state for the forward-delay time to expire before transitioning to the learning state. The MST ports wait another forward-delay time before transitioning to the forwarding state. If the boundary port is on a point-to-point link and it is the IST root port, the MST ports transition to the forwarding state as soon as the IST port transitions to the forwarding state. If the IST port is a designated port on a point-to-point link and if the IST port transitions to the forwarding state because of an agreement received from its peer port, the MST ports also immediately transition to the forwarding state. If a boundary port transitions to the forwarding state in an IST instance, it is forwarding in all MST instances, and a topology change is triggered. If a boundary port with the IST root or designated port role receives a topology change notice external to the MST cloud, the MSTP switch triggers a topology change in the IST instance and in all the MST instances active on that port.16-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding MSTP MSTP and Switch Stacks A switch stack appears as a single spanning-tree node to the rest of the network, and all stack members use the same bridge ID for a given spanning tree. The bridge ID is derived from the MAC address of the stack master. If a switch that does not support MSTP is added to a switch stack that does support MSTP or the reverse, the switch is put into a version mismatch state. If possible, the switch is automatically upgraded or downgraded to the same version of software that is running on the switch stack. When a new switch joins the stack, it sets its bridge ID to the stack master bridge ID. If the newly added switch has the lowest ID and if the root path cost is the same among all stack members, the newly added switch becomes the stack root. A topology change occurs if the newly added switch contains a better root port for the switch stack or a better designated port for the LAN connected to the stack. The newly added switch causes a topology change in the network if another switch connected to the newly added switch changes its root port or designated ports. When a stack member leaves the stack, spanning-tree reconvergence occurs within the stack (and possibly outside the stack). The remaining stack member with the lowest stack port ID becomes the stack root. If the stack master fails or leaves the stack, the stack members elect a new stack master, and all stack members change their bridge IDs of the spanning trees to the new master bridge ID. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.” Interoperability with 802.1D STP A switch running MSTP supports a built-in protocol migration mechanism that enables it to interoperate with legacy 802.1D switches. If this switch receives a legacy 802.1D configuration BPDU (a BPDU with the protocol version set to 0), it sends only 802.1D BPDUs on that port. An MSTP switch also can detect that a port is at the boundary of a region when it receives a legacy BPDU, an MSTP BPDU (version 3) associated with a different region, or an RSTP BPDU (version 2). However, the switch does not automatically revert to the MSTP mode if it no longer receives 802.1D BPDUs because it cannot determine whether the legacy switch has been removed from the link unless the legacy switch is the designated switch. Also, a switch might continue to assign a boundary role to a port when the switch to which this switch is connected has joined the region. To restart the protocol migration process (force the renegotiation with neighboring switches), use the clear spanning-tree detected-protocols privileged EXEC command. If all the legacy switches on the link are RSTP switches, they can process MSTP BPDUs as if they are RSTP BPDUs. Therefore, MSTP switches send either a version 0 configuration and TCN BPDUs or version 3 MSTP BPDUs on a boundary port. A boundary port connects to a LAN, the designated switch of which is either a single spanning-tree switch or a switch with a different MST configuration.16-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding RSTP Understanding RSTP The RSTP takes advantage of point-to-point wiring and provides rapid convergence of the spanning tree. Reconfiguration of the spanning tree can occur in less than 1 second (in contrast to 50 seconds with the default settings in the 802.1D spanning tree), which is critical for networks carrying delay-sensitive traffic such as voice and video. These section describes how the RSTP works: • Port Roles and the Active Topology, page 16-7 • Rapid Convergence, page 16-8 • Synchronization of Port Roles, page 16-9 • Bridge Protocol Data Unit Format and Processing, page 16-10 For configuration information, see the “Configuring MSTP Features” section on page 16-12. Port Roles and the Active Topology The RSTP provides rapid convergence of the spanning tree by assigning port roles and by determining the active topology. The RSTP builds upon the IEEE 802.1D STP to select the switch with the highest switch priority (lowest numerical priority value) as the root switch as described in the “Spanning-Tree Topology and BPDUs” section on page 15-3. Then the RSTP assigns one of these port roles to individual ports: • Root port—Provides the best path (lowest cost) when the switch forwards packets to the root switch. • Designated port—Connects to the designated switch, which incurs the lowest path cost when forwarding packets from that LAN to the root switch. The port through which the designated switch is attached to the LAN is called the designated port. • Alternate port—Offers an alternate path toward the root switch to that provided by the current root port. • Backup port—Acts as a backup for the path provided by a designated port toward the leaves of the spanning tree. A backup port can exist only when two ports are connected together in a loopback by a point-to-point link or when a switch has two or more connections to a shared LAN segment. • Disabled port—Has no role within the operation of the spanning tree. A port with the root or a designated port role is included in the active topology. A port with the alternate or backup port role is excluded from the active topology. In a stable topology with consistent port roles throughout the network, the RSTP ensures that every root port and designated port immediately transition to the forwarding state while all alternate and backup ports are always in the discarding state (equivalent to blocking in 802.1D). The port state controls the operation of the forwarding and learning processes. Table 16-1 provides a comparison of 802.1D and RSTP port states.16-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding RSTP To be consistent with Cisco STP implementations, this guide documents the port state as blocking instead of discarding. Designated ports start in the listening state. Rapid Convergence The RSTP provides for rapid recovery of connectivity following the failure of a switch, a switch port, or a LAN. It provides rapid convergence for edge ports, new root ports, and ports connected through point-to-point links as follows: • Edge ports—If you configure a port as an edge port on an RSTP switch by using the spanning-tree portfast interface configuration command, the edge port immediately transitions to the forwarding state. An edge port is the same as a Port Fast-enabled port, and you should enable it only on ports that connect to a single end station. • Root ports—If the RSTP selects a new root port, it blocks the old root port and immediately transitions the new root port to the forwarding state. • Point-to-point links—If you connect a port to another port through a point-to-point link and the local port becomes a designated port, it negotiates a rapid transition with the other port by using the proposal-agreement handshake to ensure a loop-free topology. As shown in Figure 16-2, Switch A is connected to Switch B through a point-to-point link, and all of the ports are in the blocking state. Assume that the priority of Switch A is a smaller numerical value than the priority of Switch B. Switch A sends a proposal message (a configuration BPDU with the proposal flag set) to Switch B, proposing itself as the designated switch. After receiving the proposal message, Switch B selects as its new root port the port from which the proposal message was received, forces all nonedge ports to the blocking state, and sends an agreement message (a BPDU with the agreement flag set) through its new root port. After receiving Switch B’s agreement message, Switch A also immediately transitions its designated port to the forwarding state. No loops in the network are formed because Switch B blocked all of its nonedge ports and because there is a point-to-point link between Switches A and B. When Switch C is connected to Switch B, a similar set of handshaking messages are exchanged. Switch C selects the port connected to Switch B as its root port, and both ends immediately transition to the forwarding state. With each iteration of this handshaking process, one more switch joins the active topology. As the network converges, this proposal-agreement handshaking progresses from the root toward the leaves of the spanning tree. Table 16-1 Port State Comparison Operational Status STP Port State (802.1D) RSTP Port State Is Port Included in the Active Topology? Enabled Blocking Discarding No Enabled Listening Discarding No Enabled Learning Learning Yes Enabled Forwarding Forwarding Yes Disabled Disabled Discarding No16-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding RSTP In a switch stack, the cross-stack rapid transition (CSRT) feature ensures that a stack member receives acknowledgments from all stack members during the proposal-agreement handshaking before moving the port to the forwarding state. CSRT is automatically enabled when the switch is in MST mode. The switch determines the link type from the port duplex mode: a full-duplex port is considered to have a point-to-point connection; a half-duplex port is considered to have a shared connection. You can override the default setting that is determined by the duplex setting by using the spanning-tree link-type interface configuration command. Figure 16-2 Proposal and Agreement Handshaking for Rapid Convergence Synchronization of Port Roles When the switch receives a proposal message on one of its ports and that port is selected as the new root port, the RSTP forces all other ports to synchronize with the new root information. The switch is synchronized with superior root information received on the root port if all other ports are synchronized. An individual port on the switch is synchronized if • That port is in the blocking state. • It is an edge port (a port configured to be at the edge of the network). If a designated port is in the forwarding state and is not configured as an edge port, it transitions to the blocking state when the RSTP forces it to synchronize with new root information. In general, when the RSTP forces a port to synchronize with root information and the port does not satisfy any of the above conditions, its port state is set to blocking. After ensuring all of the ports are synchronized, the switch sends an agreement message to the designated switch corresponding to its root port. When the switches connected by a point-to-point link are in agreement about their port roles, the RSTP immediately transitions the port states to forwarding. The sequence of events is shown in Figure 16-3. Proposal Switch A Switch B F F DP RP F F DP RP F F DP RP F F DP RP Switch C 88760 Root Agreement Designated switch Root Designated switch Proposal Root Designated switch Agreement DP = designated port RP = root port F = forwarding16-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding RSTP Figure 16-3 Sequence of Events During Rapid Convergence Bridge Protocol Data Unit Format and Processing The RSTP BPDU format is the same as the IEEE 802.1D BPDU format except that the protocol version is set to 2. A new one-byte version 1 Length field is set to zero, which means that no version 1 protocol information is present. Table 16-2 shows the RSTP flag fields. The sending switch sets the proposal flag in the RSTP BPDU to propose itself as the designated switch on that LAN. The port role in the proposal message is always set to the designated port. The sending switch sets the agreement flag in the RSTP BPDU to accept the previous proposal. The port role in the agreement message is always set to the root port. 2. Block 9. Forward 4. Agreement 1. Proposal 6. Proposal Root port Designated port 8. Agreement 10. Agreement Edge port 7. Proposal 5. Forward 3. Block 11. Forward 88761 Table 16-2 RSTP BPDU Flags Bit Function 0 Topology change (TC) 1 Proposal 2–3: 00 01 10 11 Port role: Unknown Alternate port Root port Designated port 4 Learning 5 Forwarding 6 Agreement 7 Topology change acknowledgement (TCA)16-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Understanding RSTP The RSTP does not have a separate topology change notification (TCN) BPDU. It uses the topology change (TC) flag to show the topology changes. However, for interoperability with 802.1D switches, the RSTP switch processes and generates TCN BPDUs. The learning and forwarding flags are set according to the state of the sending port. Processing Superior BPDU Information If a port receives superior root information (lower bridge ID, lower path cost, and so forth) than currently stored for the port, the RSTP triggers a reconfiguration. If the port is proposed and is selected as the new root port, RSTP forces all the other ports to synchronize. If the BPDU received is an RSTP BPDU with the proposal flag set, the switch sends an agreement message after all of the other ports are synchronized. If the BPDU is an 802.1D BPDU, the switch does not set the proposal flag and starts the forward-delay timer for the port. The new root port requires twice the forward-delay time to transition to the forwarding state. If the superior information received on the port causes the port to become a backup or alternate port, RSTP sets the port to the blocking state but does not send the agreement message. The designated port continues sending BPDUs with the proposal flag set until the forward-delay timer expires, at which time the port transitions to the forwarding state. Processing Inferior BPDU Information If a designated port receives an inferior BPDU (higher bridge ID, higher path cost, and so forth than currently stored for the port) with a designated port role, it immediately replies with its own information. Topology Changes This section describes the differences between the RSTP and the 802.1D in handling spanning-tree topology changes. • Detection—Unlike 802.1D in which any transition between the blocking and the forwarding state causes a topology change, only transitions from the blocking to the forwarding state cause a topology change with RSTP (only an increase in connectivity is considered a topology change). State changes on an edge port do not cause a topology change. When an RSTP switch detects a topology change, it flushes the learned information on all of its nonedge ports except on those from which it received the TC notification. • Notification—Unlike 802.1D, which uses TCN BPDUs, the RSTP does not use them. However, for 802.1D interoperability, an RSTP switch processes and generates TCN BPDUs. • Acknowledgement—When an RSTP switch receives a TCN message on a designated port from an 802.1D switch, it replies with an 802.1D configuration BPDU with the TCA bit set. However, if the TC-while timer (the same as the topology-change timer in 802.1D) is active on a root port connected to an 802.1D switch and a configuration BPDU with the TCA bit set is received, the TC-while timer is reset. This behavior is only required to support 802.1D switches. The RSTP BPDUs never have the TCA bit set.16-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features • Propagation—When an RSTP switch receives a TC message from another switch through a designated or root port, it propagates the change to all of its nonedge, designated ports and to the root port (excluding the port on which it is received). The switch starts the TC-while timer for all such ports and flushes the information learned on them. • Protocol migration—For backward compatibility with 802.1D switches, RSTP selectively sends 802.1D configuration BPDUs and TCN BPDUs on a per-port basis. When a port is initialized, the migrate-delay timer is started (specifies the minimum time during which RSTP BPDUs are sent), and RSTP BPDUs are sent. While this timer is active, the switch processes all BPDUs received on that port and ignores the protocol type. If the switch receives an 802.1D BPDU after the port’s migration-delay timer has expired, it assumes that it is connected to an 802.1D switch and starts using only 802.1D BPDUs. However, if the RSTP switch is using 802.1D BPDUs on a port and receives an RSTP BPDU after the timer has expired, it restarts the timer and starts using RSTP BPDUs on that port. Configuring MSTP Features These sections describe how to configure basic MSTP features: • Default MSTP Configuration, page 16-13 • MSTP Configuration Guidelines, page 16-13 • Specifying the MST Region Configuration and Enabling MSTP, page 16-14 (required) • Configuring the Root Switch, page 16-15 (optional) • Configuring a Secondary Root Switch, page 16-17 (optional) • Configuring Port Priority, page 16-18 (optional) • Configuring Path Cost, page 16-19 (optional) • Configuring the Switch Priority, page 16-20 (optional) • Configuring the Hello Time, page 16-20 (optional) • Configuring the Forwarding-Delay Time, page 16-21 (optional) • Configuring the Maximum-Aging Time, page 16-22 (optional) • Configuring the Maximum-Hop Count, page 16-22 (optional) • Specifying the Link Type to Ensure Rapid Transitions, page 16-23 (optional) • Restarting the Protocol Migration Process, page 16-23 (optional)16-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features Default MSTP Configuration Table 16-3 shows the default MSTP configuration. For information about the supported number of spanning-tree instances, see the “Supported Spanning-Tree Instances” section on page 15-10. MSTP Configuration Guidelines These are the configuration guidelines for MSTP: • When you enable MST by using the spanning-tree mode mst global configuration command, RSTP is automatically enabled. • For two or more stacked switches to be in the same MST region, they must have the same VLAN-to-instance map, the same configuration revision number, and the same name. • The switch stack supports up to 16 MST instances. The number of VLANs that can be mapped to a particular MST instance is unlimited. • The UplinkFast, BackboneFast, and cross-stack UplinkFast features are not supported with the MSTP. • PVST+, rapid PVST+, and MSTP are supported, but only one version can be active at any time. (For example, all VLANs run PVST+, all VLANs run rapid PVST+, or all VLANs run MSTP.) For more information, see the “Spanning-Tree Interoperability and Backward Compatibility” section on page 15-11. For information on the recommended trunk port configuration, see the “Interaction with Other Features” section on page 12-20. • All stack members run the same version of spanning tree (all PVST+, rapid PVST+, or MSTP). For more information, see the “Spanning-Tree Interoperability and Backward Compatibility” section on page 15-11. • VTP propagation of the MST configuration is not supported. However, you can manually configure the MST configuration (region name, revision number, and VLAN-to-instance mapping) on each switch within the MST region by using the command-line interface (CLI) or through the SNMP support. Table 16-3 Default MSTP Configuration Feature Default Setting Spanning-tree mode PVST+ (Rapid PVST+ and MSTP are disabled). Switch priority (configurable on a per-CIST interface basis) 32768. Spanning-tree port priority (configurable on a per-CIST interface basis) 128. Spanning-tree port cost (configurable on a per-CIST interface basis) 1000 Mbps: 4. 100 Mbps: 19. 10 Mbps: 100. Hello time 2 seconds. Forward-delay time 15 seconds. Maximum-aging time 20 seconds. Maximum hop count 20 hops.16-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features • For load balancing across redundant paths in the network to work, all VLAN-to-instance mapping assignments must match; otherwise, all traffic flows on a single link. You can achieve load balancing across a switch stack by manually configuring the path cost. • All MST boundary ports must be forwarding for load balancing between a PVST+ and an MST cloud or between a rapid-PVST+ and an MST cloud. For this to occur, the IST master of the MST cloud should also be the root of the CST. If the MST cloud consists of multiple MST regions, one of the MST regions must contain the CST root, and all of the other MST regions must have a better path to the root contained within the MST cloud than a path through the PVST+ or rapid-PVST+ cloud. You might have to manually configure the switches in the clouds. • Partitioning the network into a large number of regions is not recommended. However, if this situation is unavoidable, we recommend that you partition the switched LAN into smaller LANs interconnected by routers or non-Layer 2 devices. Specifying the MST Region Configuration and Enabling MSTP For two or more switches to be in the same MST region, they must have the same VLAN-to-instance mapping, the same configuration revision number, and the same name. A region can have one member or multiple members with the same MST configuration; each member must be capable of processing RSTP BPDUs. There is no limit to the number of MST regions in a network, but each region can support up to 16 spanning-tree instances. You can assign a VLAN to only one spanning-tree instance at a time. Beginning in privileged EXEC mode, follow these steps to specify the MST region configuration and enable MSTP. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst configuration Enter MST configuration mode. Step 3 instance instance-id vlan vlan-range Map VLANs to an MST instance. • For instance-id, the range is 1 to 15. • For vlan vlan-range, the range is 1 to 4094. When you map VLANs to an MST instance, the mapping is incremental, and the VLANs specified in the command are added to or removed from the VLANs that were previously mapped. To specify a VLAN range, use a hyphen; for example, instance 1 vlan 1-63 maps VLANs 1 through 63 to MST instance 1. To specify a VLAN series, use a comma; for example, instance 1 vlan 10, 20, 30 maps VLANs 10, 20, and 30 to MST instance 1. Step 4 name name Specify the configuration name. The name string has a maximum length of 32 characters and is case sensitive. Step 5 revision version Specify the configuration revision number. The range is 0 to 65535. Step 6 show pending Verify your configuration by displaying the pending configuration. Step 7 exit Apply all changes, and return to global configuration mode.16-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features To return to the default MST region configuration, use the no spanning-tree mst configuration global configuration command. To return to the default VLAN-to-instance map, use the no instance instance-id [vlan vlan-range] MST configuration command. To return to the default name, use the no name MST configuration command. To return to the default revision number, use the no revision MST configuration command. To re-enable PVST+, use the no spanning-tree mode or the spanning-tree mode pvst global configuration command. This example shows how to enter MST configuration mode, map VLANs 10 to 20 to MST instance 1, name the region region1, set the configuration revision to 1, display the pending configuration, apply the changes, and return to global configuration mode: Switch(config)# spanning-tree mst configuration Switch(config-mst)# instance 1 vlan 10-20 Switch(config-mst)# name region1 Switch(config-mst)# revision 1 Switch(config-mst)# show pending Pending MST configuration Name [region1] Revision 1 Instance Vlans Mapped -------- --------------------- 0 1-9,21-4094 1 10-20 ------------------------------- Switch(config-mst)# exit Switch(config)# Configuring the Root Switch The switch maintains a spanning-tree instance for the group of VLANs mapped to it. A bridge ID, consisting of the switch priority and the switch MAC address, is associated with each instance. For a group of VLANs, the switch with the lowest bridge ID becomes the root switch. To configure a switch to become the root, use the spanning-tree mst instance-id root global configuration command to modify the switch priority from the default value (32768) to a significantly lower value so that the switch becomes the root switch for the specified spanning-tree instance. When you enter this command, the switch checks the switch priorities of the root switches. Because of the extended system ID support, the switch sets its own priority for the specified instance to 24576 if this value will cause this switch to become the root for the specified spanning-tree instance. Step 8 spanning-tree mode mst Enable MSTP. RSTP is also enabled. Caution Changing spanning-tree modes can disrupt traffic because all spanning-tree instances are stopped for the previous mode and restarted in the new mode. You cannot run both MSTP and PVST+ or both MSTP and rapid PVST+ at the same time. Step 9 end Return to privileged EXEC mode. Step 10 show running-config Verify your entries. Step 11 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose16-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features If any root switch for the specified instance has a switch priority lower than 24576, the switch sets its own priority to 4096 less than the lowest switch priority. (4096 is the value of the least-significant bit of a 4-bit switch priority value as shown in Table 15-1 on page 15-5.) Note Catalyst 3750 switches running software earlier than Cisco IOS Release 12.1(14)EA1 do not support the MSTP. Note If your network consists of switches that both do and do not support the extended system ID, it is unlikely that the switch with the extended system ID support will become the root switch. The extended system ID increases the switch priority value every time the VLAN number is greater than the priority of the connected switches running older software. Note The root switch for each spanning-tree instance should be a backbone or distribution switch. Do not configure an access switch as the spanning-tree primary root. Use the diameter keyword, which is available only for MST instance 0, to specify the Layer 2 network diameter (that is, the maximum number of switch hops between any two end stations in the Layer 2 network). When you specify the network diameter, the switch automatically sets an optimal hello time, forward-delay time, and maximum-age time for a network of that diameter, which can significantly reduce the convergence time. You can use the hello keyword to override the automatically calculated hello time. Note After configuring the switch as the root switch, we recommend that you avoid manually configuring the hello time, forward-delay time, and maximum-age time through the spanning-tree mst hello-time, spanning-tree mst forward-time, and the spanning-tree mst max-age global configuration commands. Beginning in privileged EXEC mode, follow these steps to configure a switch as the root switch. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst instance-id root primary [diameter net-diameter [hello-time seconds]] Configure a switch as the root switch. • For instance-id, you can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. • (Optional) For diameter net-diameter, specify the maximum number of switches between any two end stations. The range is 2 to 7. This keyword is available only for MST instance 0. • (Optional) For hello-time seconds, specify the interval in seconds between the generation of configuration messages by the root switch. The range is 1 to 10 seconds; the default is 2 seconds.16-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features To return the switch to its default setting, use the no spanning-tree mst instance-id root global configuration command. Configuring a Secondary Root Switch When you configure a Catalyst 3750 switch with the extended system ID support as the secondary root, the switch priority is modified from the default value (32768) to 28672. The switch is then likely to become the root switch for the specified instance if the primary root switch fails. This is assuming that the other network switches use the default switch priority of 32768 and therefore are unlikely to become the root switch. You can execute this command on more than one switch to configure multiple backup root switches. Use the same network diameter and hello-time values that you used when you configured the primary root switch with the spanning-tree mst instance-id root primary global configuration command. Beginning in privileged EXEC mode, follow these steps to configure a switch as the secondary root switch. This procedure is optional. To return the switch to its default setting, use the no spanning-tree mst instance-id root global configuration command. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst instance-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst instance-id root secondary [diameter net-diameter [hello-time seconds]] Configure a switch as the secondary root switch. • For instance-id, you can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. • (Optional) For diameter net-diameter, specify the maximum number of switches between any two end stations. The range is 2 to 7. This keyword is available only for MST instance 0. • (Optional) For hello-time seconds, specify the interval in seconds between the generation of configuration messages by the root switch. The range is 1 to 10 seconds; the default is 2 seconds. Use the same network diameter and hello-time values that you used when configuring the primary root switch. See the “Configuring the Root Switch” section on page 16-15. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst instance-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.16-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features Configuring Port Priority If a loop occurs, the MSTP uses the port priority when selecting an interface to put into the forwarding state. You can assign higher priority values (lower numerical values) to interfaces that you want selected first and lower priority values (higher numerical values) that you want selected last. If all interfaces have the same priority value, the MSTP puts the interface with the lowest interface number in the forwarding state and blocks the other interfaces. Note If your switch is a member of a switch stack, you must use the spanning-tree mst [instance-id] cost cost interface configuration command instead of the spanning-tree mst [instance-id] port-priority priority interface configuration command to select an interface to put in the forwarding state. Assign lower cost values to interfaces that you want selected first and higher cost values to interfaces that you want selected last. For more information, see the “Configuring Path Cost” section on page 16-19. Beginning in privileged EXEC mode, follow these steps to configure the MSTP port priority of an interface. This procedure is optional. Note The show spanning-tree mst interface interface-id privileged EXEC command displays information only if the port is in a link-up operative state. Otherwise, you can use the show running-config interface privileged EXEC command to confirm the configuration. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Valid interfaces include physical interfaces and port-channel logical interfaces. The port-channel range is 1 to 12. Step 3 spanning-tree mst instance-id port-priority priority Configure the port priority. • For instance-id, you can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. • For priority, the range is 0 to 240 in increments of 16. The default is 128. The lower the number, the higher the priority. The priority values are 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240. All other values are rejected. Step 4 end Return to privileged EXEC mode. Step 5 show spanning-tree mst interface interface-id or show spanning-tree mst instance-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.16-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features To return the interface to its default setting, use the no spanning-tree mst instance-id port-priority interface configuration command. Configuring Path Cost The MSTP path cost default value is derived from the media speed of an interface. If a loop occurs, the MSTP uses cost when selecting an interface to put in the forwarding state. You can assign lower cost values to interfaces that you want selected first and higher cost values that you want selected last. If all interfaces have the same cost value, the MSTP puts the interface with the lowest interface number in the forwarding state and blocks the other interfaces. Beginning in privileged EXEC mode, follow these steps to configure the MSTP cost of an interface. This procedure is optional. Note The show spanning-tree mst interface interface-id privileged EXEC command displays information only for ports that are in a link-up operative state. Otherwise, you can use the show running-config privileged EXEC command to confirm the configuration. To return the interface to its default setting, use the no spanning-tree mst instance-id cost interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Valid interfaces include physical interfaces and port-channel logical interfaces. The port-channel range is 1 to 12. Step 3 spanning-tree mst instance-id cost cost Configure the cost. If a loop occurs, the MSTP uses the path cost when selecting an interface to place into the forwarding state. A lower path cost represents higher-speed transmission. • For instance-id, you can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. • For cost, the range is 1 to 200000000; the default value is derived from the media speed of the interface. Step 4 end Return to privileged EXEC mode. Step 5 show spanning-tree mst interface interface-id or show spanning-tree mst instance-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.16-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features Configuring the Switch Priority You can configure the switch priority and make it more likely that a standalone switch or a switch in the stack will be chosen as the root switch. Note Exercise care when using this command. For most situations, we recommend that you use the spanning-tree mst instance-id root primary and the spanning-tree mst instance-id root secondary global configuration commands to modify the switch priority. Beginning in privileged EXEC mode, follow these steps to configure the switch priority. This procedure is optional. To return the switch to its default setting, use the no spanning-tree mst instance-id priority global configuration command. Configuring the Hello Time You can configure the interval between the generation of configuration messages by the root switch by changing the hello time. Note Exercise care when using this command. For most situations, we recommend that you use the spanning-tree mst instance-id root primary and the spanning-tree mst instance-id root secondary global configuration commands to modify the hello time. Beginning in privileged EXEC mode, follow these steps to configure the hello time for all MST instances. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst instance-id priority priority Configure the switch priority. • For instance-id, you can specify a single instance, a range of instances separated by a hyphen, or a series of instances separated by a comma. The range is 0 to 15. • For priority, the range is 0 to 61440 in increments of 4096; the default is 32768. The lower the number, the more likely the switch will be chosen as the root switch. Priority values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440. All other values are rejected. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst instance-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.16-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features To return the switch to its default setting, use the no spanning-tree mst hello-time global configuration command. Configuring the Forwarding-Delay Time Beginning in privileged EXEC mode, follow these steps to configure the forwarding-delay time for all MST instances. This procedure is optional. To return the switch to its default setting, use the no spanning-tree mst forward-time global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst hello-time seconds Configure the hello time for all MST instances. The hello time is the interval between the generation of configuration messages by the root switch. These messages mean that the switch is alive. For seconds, the range is 1 to 10; the default is 2. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst forward-time seconds Configure the forward time for all MST instances. The forward delay is the number of seconds a port waits before changing from its spanning-tree learning and listening states to the forwarding state. For seconds, the range is 4 to 30; the default is 15. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.16-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features Configuring the Maximum-Aging Time Beginning in privileged EXEC mode, follow these steps to configure the maximum-aging time for all MST instances. This procedure is optional. To return the switch to its default setting, use the no spanning-tree mst max-age global configuration command. Configuring the Maximum-Hop Count Beginning in privileged EXEC mode, follow these steps to configure the maximum-hop count for all MST instances. This procedure is optional. To return the switch to its default setting, use the no spanning-tree mst max-hops global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst max-age seconds Configure the maximum-aging time for all MST instances. The maximum-aging time is the number of seconds a switch waits without receiving spanning-tree configuration messages before attempting a reconfiguration. For seconds, the range is 6 to 40; the default is 20. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree mst max-hops hop-count Specify the number of hops in a region before the BPDU is discarded, and the information held for a port is aged. For hop-count, the range is 1 to 40; the default is 20. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.16-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Configuring MSTP Features Specifying the Link Type to Ensure Rapid Transitions If you connect a port to another port through a point-to-point link and the local port becomes a designated port, the RSTP negotiates a rapid transition with the other port by using the proposal-agreement handshake to ensure a loop-free topology as described in the “Rapid Convergence” section on page 16-8. By default, the link type is determined from the duplex mode of the interface: a full-duplex port is considered to have a point-to-point connection; a half-duplex port is considered to have a shared connection. If you have a half-duplex link physically connected point-to-point to a single port on a remote switch running MSTP, you can override the default setting of the link type and enable rapid transitions to the forwarding state. Beginning in privileged EXEC mode, follow these steps to override the default link-type setting. This procedure is optional. To return the port to its default setting, use the no spanning-tree link-type interface configuration command. Restarting the Protocol Migration Process A switch running MSTP supports a built-in protocol migration mechanism that enables it to interoperate with legacy 802.1D switches. If this switch receives a legacy 802.1D configuration BPDU (a BPDU with the protocol version set to 0), it sends only 802.1D BPDUs on that port. An MSTP switch also can detect that a port is at the boundary of a region when it receives a legacy BPDU, an MST BPDU (version 3) associated with a different region, or an RST BPDU (version 2). However, the switch does not automatically revert to the MSTP mode if it no longer receives 802.1D BPDUs because it cannot determine whether the legacy switch has been removed from the link unless the legacy switch is the designated switch. A switch also might continue to assign a boundary role to a port when the switch to which it is connected has joined the region. To restart the protocol migration process (force the renegotiation with neighboring switches) on the switch, use the clear spanning-tree detected-protocols privileged EXEC command. To restart the protocol migration process on a specific interface, use the clear spanning-tree detected-protocols interface interface-id privileged EXEC command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 1 interface interface-id Enter interface configuration mode, and specify the interface to configure. Valid interfaces include physical interface, VLANs, and port-channel logical interfaces. The VLAN ID range is 1 to 4094. The port-channel range is 1 to 12. Step 2 spanning-tree link-type point-to-point Specify that the link type of a port is point-to-point. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree mst interface interface-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.16-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 16 Configuring MSTP Displaying the MST Configuration and Status Displaying the MST Configuration and Status To display the spanning-tree status, use one or more of the privileged EXEC commands in Table 16-4: For information about other keywords for the show spanning-tree privileged EXEC command, refer to the command reference for this release. Table 16-4 Commands for Displaying MST Status Command Purpose show spanning-tree mst configuration Displays the MST region configuration. show spanning-tree mst instance-id Displays MST information for the specified instance. show spanning-tree mst interface interface-id Displays MST information for the specified interface.C H A P T E R 17-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 17 Configuring Optional Spanning-Tree Features This chapter describes how to configure optional spanning-tree features on the Catalyst 3750 switch. You can configure all of these features when your switch is running the per-VLAN spanning-tree plus (PVST+). You can configure only the noted features when your switch stack is running the Multiple Spanning Tree Protocol (MSTP) or the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. For information on configuring the PVST+ and rapid PVST+, see Chapter 15, “Configuring STP.” For information about the Multiple Spanning Tree Protocol (MSTP) and how to map multiple VLANs to the same spanning-tree instance, see Chapter 16, “Configuring MSTP.” Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding Optional Spanning-Tree Features, page 17-1 • Configuring Optional Spanning-Tree Features, page 17-12 • Displaying the Spanning-Tree Status, page 17-19 Understanding Optional Spanning-Tree Features These sections describe how the optional spanning-tree features work: • Understanding Port Fast, page 17-2 • Understanding BPDU Guard, page 17-3 • Understanding BPDU Filtering, page 17-3 • Understanding UplinkFast, page 17-4 • Understanding Cross-Stack UplinkFast, page 17-5 • Understanding BackboneFast, page 17-8 • Understanding Root Guard, page 17-10 • Understanding Loop Guard, page 17-1117-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Understanding Port Fast Port Fast immediately brings an interface configured as an access or trunk port to the forwarding state from a blocking state, bypassing the listening and learning states. You can use Port Fast on ports connected to a single workstation or server, as shown in Figure 17-1, to allow those devices to immediately connect to the network, rather than waiting for the spanning tree to converge. Ports connected to a single workstation or server should not receive bridge protocol data units (BPDUs). A port with Port Fast enabled goes through the normal cycle of spanning-tree status changes when the switch is restarted. Note Because the purpose of Port Fast is to minimize the time ports must wait for spanning-tree to converge, it is effective only when used on ports connected to end stations. If you enable Port Fast on a port connecting to another switch, you risk creating a spanning-tree loop. If your switch is running PVST+, rapid PVST+, or MSTP, you can enable this feature by using the spanning-tree portfast interface configuration or the spanning-tree portfast default global configuration command. Figure 17-1 Port Fast-Enabled Ports Catalyst 6000 series switch Catalyst 3750 switch Catalyst 3750 switch Workstations Workstations Server Por t Por t Fast-enabled port Fast-enabled ports Catalyst 3750 switch 8647717-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Understanding BPDU Guard The BPDU guard feature can be globally enabled on the switch or can be enabled per interface, but the feature operates with some differences. At the global level, you enable BPDU guard on Port Fast-enabled ports by using the spanning-tree portfast bpduguard default global configuration command. Spanning tree shuts down ports that are in a Port Fast-operational state. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. At the interface level, you enable BPDU guard on any port by using the spanning-tree bpduguard enable interface configuration command without also enabling the Port Fast feature. When the port receives a BPDU, it is put in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree. If your switch is running PVST+, rapid PVST+, or MSTP, you can enable the BPDU guard feature for the entire switch or for an interface. Understanding BPDU Filtering The BPDU filtering feature can be globally enabled on the switch or can be enabled per interface, but the feature operates with some differences. At the global level, you can enable BPDU filtering on Port Fast-enabled ports by using the spanning-tree portfast bpdufilter default global configuration command. This command prevents ports that are in a Port Fast-operational state from sending or receiving BPDUs. The ports still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to these ports do not receive BPDUs. If a BPDU is received on a Port Fast-enabled port, the port loses its Port Fast-operational status, and BPDU filtering is disabled. At the interface level, you can enable BPDU filtering on any port by using the spanning-tree bpdufilter enable interface configuration command without also enabling the Port Fast feature. This command prevents the port from sending or receiving BPDUs. Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops. If your switch is running PVST+, rapid PVST+, or MSTP, you can enable the BPDU filtering feature for the entire switch or for an interface.17-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Understanding UplinkFast Switches in hierarchical networks can be grouped into backbone switches, distribution switches, and access switches. Figure 17-2 shows a complex network where distribution switches and access switches each have at least one redundant link that spanning tree blocks to prevent loops. Figure 17-2 Switches in a Hierarchical Network If a switch looses connectivity, it begins using the alternate paths as soon as the spanning tree selects a new root port. By enabling UplinkFast with the spanning-tree uplinkfast global configuration command, you can accelerate the choice of a new root port when a link or switch fails or when the spanning tree reconfigures itself. The root port transitions to the forwarding state immediately without going through the listening and learning states, as it would with the normal spanning-tree procedures. The UplinkFast feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP because these protocols use fast convergence and take precedence over UplinkFast. When the spanning tree reconfigures the new root port, other interfaces flood the network with multicast packets, one for each address that was learned on the interface. You can limit these bursts of multicast traffic by reducing the max-update-rate parameter (the default for this parameter is 150 packets per second). However, if you enter zero, station-learning frames are not generated, so the spanning-tree topology converges more slowly after a loss of connectivity. Note UplinkFast is most useful in wiring-closet switches at the access or edge of the network. It is not appropriate for backbone devices. This feature might not be useful for other types of applications. UplinkFast provides fast convergence after a direct link failure and achieves load balancing between redundant Layer 2 links using uplink groups. An uplink group is a set of Layer 2 interfaces (per VLAN), only one of which is forwarding at any given time. Specifically, an uplink group consists of the root port (which is forwarding) and a set of blocked ports, except for self-looping ports. The uplink group provides an alternate path in case the currently forwarding link fails. 2950 2950 2970 2970 Active link Blocked link Root bridge Backbone switches Distribution switches Access switches 90560 Catalyst 3550 switches Catalyst 3750 switches17-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Figure 17-3 shows an example topology with no link failures. Switch A, the root switch, is connected directly to Switch B over link L1 and to Switch C over link L2. The Layer 2 interface on Switch C that is connected directly to Switch B is in a blocking state. Figure 17-3 UplinkFast Example Before Direct Link Failure If Switch C detects a link failure on the currently active link L2 on the root port (a direct link failure), UplinkFast unblocks the blocked port on Switch C and transitions it to the forwarding state without going through the listening and learning states, as shown in Figure 17-4. This change takes approximately 1 to 5 seconds. Figure 17-4 UplinkFast Example After Direct Link Failure Understanding Cross-Stack UplinkFast For Catalyst 3750 switches, the UplinkFast feature is the cross-stack UplinkFast feature. Cross-stack UplinkFast (CSUF) provides a fast spanning-tree transition (fast convergence in less than 1 second under normal network conditions) across a switch stack. During the fast transition, an alternate redundant link on the switch stack is placed in the forwarding state without causing temporary spanning-tree loops or loss of connectivity to the backbone. With this feature, you can have a redundant and resilient network in some configurations. CSUF is automatically enabled when you enable the UplinkFast feature by using the spanning-tree uplinkfast global configuration command. The CSUF feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP. CSUF might not provide a fast transition all the time; in these cases, the normal spanning-tree transition occurs, completing in 30 to 40 seconds. For more information, see the “Events that Cause Fast Convergence” section on page 17-7. L1 L2 L3 Switch C Switch A (Root) Switch B Blocked port 43575 L1 L2 L3 Switch C Switch A (Root) Switch B UplinkFast transitions port directly to forwarding state. Link failure 4357617-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features How CSUF Works CSUF ensures that one link in the stack is elected as the path to the root. As shown in Figure 17-5, the stack-root port on Switch 1 provides the path to the root of the spanning tree. The alternate stack-root ports on Switches 2 and 3 can provide an alternate path to the spanning-tree root if the current stack-root switch fails or if its link to the spanning-tree root fails. Link 1, the root link, is in the spanning-tree forwarding state. Links 2 and 3 are alternate redundant links that are in the spanning-tree blocking state. If Switch 1 fails, if its stack-root port fails, or if Link 1 fails, CSUF selects either the alternate stack-root port on Switch 2 or Switch 3 and puts it into the forwarding state in less than 1 second. Figure 17-5 Cross-Stack UplinkFast Topology When certain link loss or spanning-tree events occur (described in “Events that Cause Fast Convergence” section on page 17-7), the Fast Uplink Transition Protocol uses the neighbor list to send fast-transition requests to stack members. The switch sending the fast-transition request needs to do a fast transition to the forwarding state of a port that it has chosen as the root port, and it must obtain an acknowledgement from each stack switch before performing the fast transition. Switch 1 Spanningtree root Backbone Catalyst 3750 switch stack StackWise port connections 86479 Switch 2 StackWise port connections Forward Link 1 (Root link) Link 2 (Alternate redundant link) Link 3 (Alternate redundant link) 100 or 1000 Mbps 100 or 1000 Mbps 100 or 1000 Mbps Forward Forward Switch 3 StackWise port connections Stack-root port Alternate stackroot port Alternate stackroot port17-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Each switch in the stack determines if the sending switch is a better choice than itself to be the stack root of this spanning-tree instance by comparing the root, cost, and bridge ID. If the sending switch is the best choice as the stack root, each switch in the stack returns an acknowledgement; otherwise, it sends a fast-transition request. The sending switch then has not received acknowledgements from all stack switches. When acknowledgements are received from all stack switches, the Fast Uplink Transition Protocol on the sending switch immediately transitions its alternate stack-root port to the forwarding state. If acknowledgements from all stack switches are not obtained by the sending switch, the normal spanning-tree transitions (blocking, listening, learning, and forwarding) take place, and the spanning-tree topology converges at its normal rate (2 * forward-delay time + max-age time). The Fast Uplink Transition Protocol is implemented on a per-VLAN basis and affects only one spanning-tree instance at a time. Events that Cause Fast Convergence Depending on the network event or failure, the CSUF fast convergence might or might not occur. Fast convergence (less than 1 second under normal network conditions) occurs under these circumstances: • The stack-root port link fails. If two switches in the stack have alternate paths to the root, only one of the switches performs the fast transition. • The failed link, which connects the stack root to the spanning-tree root, recovers. • A network reconfiguration causes a new stack-root switch to be selected. • A network reconfiguration causes a new port on the current stack-root switch to be chosen as the stack-root port. Note The fast transition might not occur if multiple events occur simultaneously. For example, if a stack member is powered off, and at the same time, the link connecting the stack root to the spanning-tree root comes back up, the normal spanning-tree convergence occurs. Normal spanning-tree convergence (30 to 40 seconds) occurs under these conditions: • The stack-root switch is powered off, or the software failed. • The stack-root switch, which was powered off or failed, is powered on. • A new switch, which might become the stack root, is added to the stack.17-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Understanding BackboneFast BackboneFast detects indirect failures in the core of the backbone. BackboneFast is a complementary technology to the UplinkFast feature, which responds to failures on links directly connected to access switches. BackboneFast optimizes the maximum-age timer, which determines the amount of time the switch stores protocol information received on an interface. When a switch receives an inferior BPDU from the designated port of another switch, the BPDU is a signal that the other switch might have lost its path to the root, and BackboneFast tries to find an alternate path to the root. The BackboneFast feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP. BackboneFast, which is enabled by using the spanning-tree backbonefast global configuration command, starts when a root port or blocked port on a switch receives inferior BPDUs from its designated switch. An inferior BPDU identifies a switch that declares itself as both the root bridge and the designated switch. When a switch receives an inferior BPDU, it means that a link to which the switch is not directly connected (an indirect link) has failed (that is, the designated switch has lost its connection to the root switch). Under spanning-tree rules, the switch ignores inferior BPDUs for the configured maximum aging time specified by the spanning-tree vlan vlan-id max-age global configuration command. The switch tries to determine if it has an alternate path to the root switch. If the inferior BPDU arrives on a blocked port, the root port and other blocked ports on the switch become alternate paths to the root switch. (Self-looped ports are not considered alternate paths to the root switch.) If the inferior BPDU arrives on the root port, all blocked ports become alternate paths to the root switch. If the inferior BPDU arrives on the root port and there are no blocked ports, the switch assumes that it has lost connectivity to the root switch, causes the maximum aging time on the root port to expire, and becomes the root switch according to normal spanning-tree rules. If the switch has alternate paths to the root switch, it uses these alternate paths to send a root link query (RLQ) request. The switch sends the RLQ request on all alternate paths to determine if any stack member has an alternate root to the root switch and waits for an RLQ reply from other switches in the network and in the stack. When a stack member receives an RLQ reply from a nonstack member on a blocked port and the reply is destined for another nonstacked switch, it forwards the reply packet, regardless of the spanning-tree port state. When a stack member receives an RLQ reply from a nonstack member and the response is destined for the stack, the stack member forwards the reply so that all the other stack members receive it. If the switch determines that it still has an alternate path to the root, it expires the maximum aging time on the port that received the inferior BPDU. If all the alternate paths to the root switch indicate that the switch has lost connectivity to the root switch, the switch expires the maximum aging time on the port that received the RLQ reply. If one or more alternate paths can still connect to the root switch, the switch makes all ports on which it received an inferior BPDU its designated ports and moves them from the blocking state (if they were in the blocking state), through the listening and learning states, and into the forwarding state.17-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Figure 17-6 shows an example topology with no link failures. Switch A, the root switch, connects directly to Switch B over link L1 and to Switch C over link L2. The Layer 2 interface on Switch C that connects directly to Switch B is in the blocking state. Figure 17-6 BackboneFast Example Before Indirect Link Failure If link L1 fails as shown in Figure 17-7, Switch C cannot detect this failure because it is not connected directly to link L1. However, because Switch B is directly connected to the root switch over L1, it detects the failure, elects itself the root, and begins sending BPDUs to Switch C, identifying itself as the root. When Switch C receives the inferior BPDUs from Switch B, Switch C assumes that an indirect failure has occurred. At that point, BackboneFast allows the blocked port on Switch C to move immediately to the listening state without waiting for the maximum aging time for the port to expire. BackboneFast then transitions the Layer 2 interface on Switch C to the forwarding state, providing a path from Switch B to Switch A. This switchover takes approximately 30 seconds, twice the Forward Delay time if the default Forward Delay time of 15 seconds is set. Figure 17-7 shows how BackboneFast reconfigures the topology to account for the failure of link L1. Figure 17-7 BackboneFast Example After Indirect Link Failure If a new switch is introduced into a shared-medium topology as shown in Figure 17-8, BackboneFast is not activated because the inferior BPDUs did not come from the recognized designated switch (Switch B). The new switch begins sending inferior BPDUs that indicate it is the root switch. However, the other switches ignore these inferior BPDUs, and the new switch learns that Switch B is the designated switch to Switch A, the root switch. L1 L2 L3 Switch C Switch A (Root) Switch B Blocked port 44963 L1 L2 L3 Switch C Switch A (Root) Switch B Link failure 44964 BackboneFast changes port through listening and learning states to forwarding state.17-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Figure 17-8 Adding a Switch in a Shared-Medium Topology Understanding Root Guard The Layer 2 network of a service provider (SP) can include many connections to switches that are not owned by the SP. In such a topology, the spanning tree can reconfigure itself and select a customer switch as the root switch, as shown in Figure 17-9. You can avoid this situation by enabling root guard on SP switch interfaces that connect to switches in your customer’s network. If spanning-tree calculations cause an interface in the customer network to be selected as the root port, root guard then places the interface in the root-inconsistent (blocked) state to prevent the customer’s switch from becoming the root switch or being in the path to the root. If a switch outside the SP network becomes the root switch, the interface is blocked (root-inconsistent state), and spanning tree selects a new root switch. The customer’s switch does not become the root switch and is not in the path to the root. If the switch is operating in multiple spanning-tree (MST) mode, root guard forces the port to be a designated port. If a boundary port is blocked in an internal spanning-tree (IST) instance because of root guard, the port also is blocked in all MST instances. A boundary port is a port that connects to a LAN, the designated switch of which is either an 802.1D switch or a switch with a different MST region configuration. Root guard enabled on an interface applies to all the VLANs to which the interface belongs. VLANs can be grouped and mapped to an MST instance. If your switch is running PVST+, rapid PVST+, or MSTP, you can enable this feature by using the spanning-tree guard root interface configuration command. Caution Misuse of the root-guard feature can cause a loss of connectivity. Switch A (Root) Switch C Switch B (Designated bridge) Added switch 44965 Blocked port17-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Figure 17-9 Root Guard in a Service-Provider Network Understanding Loop Guard You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. This feature is most effective when it is enabled on the entire switched network. Loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports. If your switch is running PVST+, rapid PVST+, or MSTP, you can enable this feature by using the spanning-tree loopguard default global configuration command. When the switch is operating in PVST+ or rapid-PVST+ mode, loop guard prevents alternate and root ports from becoming designated ports, and spanning tree does not send BPDUs on root or alternate ports. When the switch is operating in MST mode, BPDUs are not sent on nonboundary ports only if the port is blocked by loop guard in all MST instances. On a boundary port, loop guard blocks the port in all MST instances. Customer network Potential spanning-tree root without root guard enabled Enable the root-guard feature on these interfaces to prevent switches in the customer network from becoming the root switch or being in the path to the root. Desired root switch Catalyst 3750 switches Service-provider network 8648017-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features These sections describe how to configure optional spanning-tree features: • Default Optional Spanning-Tree Configuration, page 17-12 • Optional Spanning-Tree Configuration Guidelines, page 17-12 • Enabling Port Fast, page 17-13 (optional) • Enabling BPDU Guard, page 17-14 (optional) • Enabling BPDU Filtering, page 17-15 (optional) • Enabling UplinkFast for Use with Redundant Links, page 17-16 (optional) • Enabling Cross-Stack UplinkFast, page 17-17 (optional) • Enabling BackboneFast, page 17-17 (optional) • Enabling Root Guard, page 17-18 (optional) • Enabling Loop Guard, page 17-18 (optional) Default Optional Spanning-Tree Configuration Table 17-1 shows the default optional spanning-tree configuration. Optional Spanning-Tree Configuration Guidelines The UplinkFast, BackboneFast, and cross-stack UplinkFast features are not supported with the rapid PVST+ or the MSTP. Table 17-1 Default Optional Spanning-Tree Configuration Feature Default Setting Port Fast, BPDU filtering, BPDU guard Globally disabled (unless they are individually configured per interface). UplinkFast Globally disabled. (On Catalyst 3750 switches, the UplinkFast feature is the CSUF feature.) BackboneFast Globally disabled. Root guard Disabled on all interfaces. Loop guard Disabled on all interfaces.17-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling Port Fast A port with the Port Fast feature enabled is moved directly to the spanning-tree forwarding state without waiting for the standard forward-time delay. Caution Use Port Fast only when connecting a single end station to an access or trunk port. Enabling this feature on a port connected to a switch or hub could prevent spanning tree from detecting and disabling loops in your network, which could cause broadcast storms and address-learning problems. If you enable the voice VLAN feature, the Port Fast feature is automatically enabled. When you disable voice VLAN, the Port Fast feature is not automatically disabled. For more information, see Chapter 14, “Configuring Voice VLAN.” You can enable this feature if your switch is running PVST+, rapid PVST+, or MSTP. Beginning in privileged EXEC mode, follow these steps to enable Port Fast. This procedure is optional. Note You can use the spanning-tree portfast default global configuration command to globally enable the Port Fast feature on all nontrunking ports. To disable the Port Fast feature, use the spanning-tree portfast disable interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Step 3 spanning-tree portfast [trunk] Enable Port Fast on an access port connected to a single workstation or server. By specifying the trunk keyword, you can enable Port Fast on a trunk port. Caution Make sure that there are no loops in the network between the trunk port and the workstation or server before you enable Port Fast on a trunk port. By default, Port Fast is disabled on all ports. Step 4 end Return to privileged EXEC mode. Step 5 show spanning-tree interface interface-id portfast Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.17-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling BPDU Guard When you globally enable BPDU guard on ports that are Port Fast-enabled (the ports are in a Port Fast-operational state), spanning tree shuts down Port Fast-enabled ports that receive BPDUs. In a valid configuration, Port Fast-enabled ports do not receive BPDUs. Receiving a BPDU on a Port Fast-enabled port signals an invalid configuration, such as the connection of an unauthorized device, and the BPDU guard feature puts the port in the error-disabled state. The BPDU guard feature provides a secure response to invalid configurations because you must manually put the port back in service. Use the BPDU guard feature in a service-provider network to prevent an access port from participating in the spanning tree. Caution Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. You also can use the spanning-tree bpduguard enable interface configuration command to enable BPDU guard on any port without also enabling the Port Fast feature. When the port receives a BPDU, it is put in the error-disabled state. You can enable the BPDU guard feature if your switch is running PVST+, rapid PVST+, or MSTP. Beginning in privileged EXEC mode, follow these steps to globally enable the BPDU guard feature. This procedure is optional. To disable BPDU guard, use the no spanning-tree portfast bpduguard default global configuration command. You can override the setting of the no spanning-tree portfast bpduguard default global configuration command by using the spanning-tree bpduguard enable interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree portfast bpduguard default Globally enable BPDU guard. By default, BPDU guard is disabled. Step 3 interface interface-id Enter interface configuration mode, and specify the interface connected to an end station. Step 4 spanning-tree portfast Enable the Port Fast feature. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.17-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling BPDU Filtering When you globally enable BPDU filtering on Port Fast-enabled ports, it prevents ports that are in a Port Fast-operational state from sending or receiving BPDUs. The ports still send a few BPDUs at link-up before the switch begins to filter outbound BPDUs. You should globally enable BPDU filtering on a switch so that hosts connected to these ports do not receive BPDUs. If a BPDU is received on a Port Fast-enabled port, the port loses its Port Fast-operational status, and BPDU filtering is disabled. Caution Configure Port Fast only on ports that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt switch and network operation. You can also use the spanning-tree bpdufilter enable interface configuration command to enable BPDU filtering on any port without also enabling the Port Fast feature. This command prevents the port from sending or receiving BPDUs. Caution Enabling BPDU filtering on an interface is the same as disabling spanning tree on it and can result in spanning-tree loops. You can enable the BPDU filtering feature if your switch is running PVST+, rapid PVST+, or MSTP. Beginning in privileged EXEC mode, follow these steps to globally enable the BPDU filtering feature. This procedure is optional. To disable BPDU filtering, use the no spanning-tree portfast bpdufilter default global configuration command. You can override the setting of the no spanning-tree portfast bpdufilter default global configuration command by using the spanning-tree bpdufilter enable interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree portfast bpdufilter default Globally enable BPDU filtering. By default, BPDU filtering is disabled. Step 3 interface interface-id Enter interface configuration mode, and specify the interface connected to an end station. Step 4 spanning-tree portfast Enable the Port Fast feature. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.17-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling UplinkFast for Use with Redundant Links UplinkFast cannot be enabled on VLANs that have been configured with a switch priority. To enable UplinkFast on a VLAN with switch priority configured, first restore the switch priority on the VLAN to the default value by using the no spanning-tree vlan vlan-id priority global configuration command. Note When you enable UplinkFast, it affects all VLANs on the switch stack. You cannot configure UplinkFast on an individual VLAN. The UplinkFast feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP. Beginning in privileged EXEC mode, follow these steps to enable UplinkFast and CSUF. This procedure is optional. When UplinkFast is enabled, the switch priority of all VLANs is set to 49152. If you change the path cost to a value less than 3000 and you enable UplinkFast or UplinkFast is already enabled, the path cost of all interfaces and VLAN trunks is increased by 3000 (if you change the path cost to 3000 or above, the path cost is not altered). The changes to the switch priority and the path cost reduce the chance that a switch will become the root switch. When UplinkFast is disabled, the switch priorities of all VLANs and path costs of all interfaces are set to default values if you did not modify them from their defaults. To return the update packet rate to the default setting, use the no spanning-tree uplinkfast max-update-rate global configuration command. To disable UplinkFast, use the no spanning-tree uplinkfast command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree uplinkfast [max-update-rate pkts-per-second] Enable UplinkFast. (Optional) For pkts-per-second, the range is 0 to 32000 packets per second; the default is 150. If you set the rate to 0, station-learning frames are not generated, and the spanning-tree topology converges more slowly after a loss of connectivity. When you enter this command, CSUF also is enabled on all nonstack port interfaces. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree summary Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.17-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling Cross-Stack UplinkFast When you enable or disable the UplinkFast feature by using the spanning-tree uplinkfast global configuration command, CSUF is automatically globally enabled or disabled on nonstack port interfaces. For more information, see the “Enabling UplinkFast for Use with Redundant Links” section on page 17-16. The CSUF feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP. To disable UplinkFast on the switch and all its VLANs, use the no spanning-tree uplinkfast global configuration command. Enabling BackboneFast You can enable BackboneFast to detect indirect link failures and to start the spanning-tree reconfiguration sooner. Note If you use BackboneFast, you must enable it on all switches in the network. BackboneFast is not supported on Token Ring VLANs. This feature is supported for use with third-party switches. The BackboneFast feature is supported only when the switch is running PVST+. It is not supported when the switch is running rapid PVST+ or MSTP. Beginning in privileged EXEC mode, follow these steps to enable BackboneFast. This procedure is optional. To disable the BackboneFast feature, use the no spanning-tree backbonefast global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 spanning-tree backbonefast Enable BackboneFast. Step 3 end Return to privileged EXEC mode. Step 4 show spanning-tree summary Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.17-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Configuring Optional Spanning-Tree Features Enabling Root Guard Root guard enabled on an interface applies to all the VLANs to which the interface belongs. Do not enable the root guard on interfaces to be used by the UplinkFast feature. With UplinkFast, the backup interfaces (in the blocked state) replace the root port in the case of a failure. However, if root guard is also enabled, all the backup interfaces used by the UplinkFast feature are placed in the root-inconsistent state (blocked) and are prevented from reaching the forwarding state. Note You cannot enable both root guard and loop guard at the same time. You can enable this feature if your switch is running PVST+, rapid PVST+, or MSTP. Beginning in privileged EXEC mode, follow these steps to enable root guard on an interface. This procedure is optional. To disable root guard, use the no spanning-tree guard interface configuration command. Enabling Loop Guard You can use loop guard to prevent alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link. This feature is most effective when it is configured on the entire switched network. Loop guard operates only on ports that are considered point-to-point by the spanning tree. Note You cannot enable both loop guard and root guard at the same time. You can enable this feature if your switch is running PVST+, rapid PVST+, or MSTP. Beginning in privileged EXEC mode, follow these steps to enable loop guard. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify an interface to configure. Step 3 spanning-tree guard root Enable root guard on the interface. By default, root guard is disabled on all interfaces. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 show spanning-tree active or show spanning-tree mst Determine which ports are alternate or root ports. Step 2 configure terminal Enter global configuration mode.17-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Displaying the Spanning-Tree Status To globally disable loop guard, use the no spanning-tree loopguard default global configuration command. You can override the setting of the no spanning-tree loopguard default global configuration command by using the spanning-tree guard loop interface configuration command. Displaying the Spanning-Tree Status To display the spanning-tree status, use one or more of the privileged EXEC commands in Table 17-2: You can clear spanning-tree counters by using the clear spanning-tree [interface interface-id] privileged EXEC command. For information about other keywords for the show spanning-tree privileged EXEC command, refer to the command reference for this release. Step 3 spanning-tree loopguard default Enable loop guard. By default, loop guard is disabled. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Table 17-2 Commands for Displaying the Spanning-Tree Status Command Purpose show spanning-tree active Displays spanning-tree information on active interfaces only. show spanning-tree detail Displays a detailed summary of interface information. show spanning-tree interface interface-id Displays spanning-tree information for the specified interface. show spanning-tree mst interface interface-id Displays MST information for the specified interface. show spanning-tree summary [totals] Displays a summary of port states or displays the total lines of the spanning-tree state section.17-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 17 Configuring Optional Spanning-Tree Features Displaying the Spanning-Tree StatusC H A P T E R 18-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 18 Configuring IGMP Snooping and MVR This chapter describes how to configure Internet Group Management Protocol (IGMP) snooping on the Catalyst 3750 switch, including an application of local IGMP snooping, Multicast VLAN Registration (MVR). It also includes procedures for controlling multicast group membership by using IGMP filtering. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the switch command reference for this release and the Cisco IOS Release Network Protocols Command Reference, Part 1, for Release 12.1. This chapter consists of these sections: • Understanding IGMP Snooping, page 18-2 • Configuring IGMP Snooping, page 18-5 • Displaying IGMP Snooping Information, page 18-10 • Understanding Multicast VLAN Registration, page 18-12 • Configuring MVR, page 18-14 • Displaying MVR Information, page 18-18 • Configuring IGMP Filtering, page 18-19 • Displaying IGMP Filtering Configuration, page 18-22 Note You can either manage IP multicast group addresses through features such as IGMP snooping and MVR, or you can use static IP addresses. 18-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Understanding IGMP Snooping Understanding IGMP Snooping Layer 2 switches can use IGMP snooping to constrain the flooding of multicast traffic by dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded to only those interfaces associated with IP multicast devices. As the name implies, IGMP snooping requires the LAN switch to snoop on the IGMP transmissions between the host and the router and to keep track of multicast groups and member ports. When the switch receives an IGMP report from a host for a particular multicast group, the switch adds the host port number to the forwarding table entry; when it receives an IGMP Leave Group message from a host, it removes the host port from the table entry. It also periodically deletes entries if it does not receive IGMP membership reports from the multicast clients. Note For more information on IP multicast and IGMP, refer to RFC 1112 and RFC 2236. The multicast router (which could be a Catalyst 3750 switch with the enhanced multilayer image on the stack master) sends out periodic general queries to all VLANs. All hosts interested in this multicast traffic send join requests and are added to the forwarding table entry. The switch creates one entry per VLAN in the IGMP snooping IP multicast forwarding table for each group from which it receives an IGMP join request. The Catalyst 3750 switch supports IP multicast group-based bridging, rather than MAC-addressed based groups. With multicast MAC address-based groups, if an IP address being configured translates (aliases) to a previously configured MAC address or to any reserved multicast MAC addresses (in the range 224.0.0.xxx), the command fails. Because the Catalyst 3750 switch uses IP multicast groups, there are no address aliasing issues. The IP multicast groups learned through IGMP snooping are dynamic. However, you can statically configure multicast groups by using the ip igmp snooping vlan vlan-id static ip_address interface interface-id global configuration command. If you specify group membership for a multicast group address statically, your setting supersedes any automatic manipulation by IGMP snooping. Multicast group membership lists can consist of both user-defined and IGMP snooping-learned settings. If a port spanning-tree, a port group, or a VLAN ID change occurs, the IGMP snooping-learned multicast groups from this port on the VLAN are deleted. These sections describe characteristics of IGMP snooping on the switch and switch stack: • Joining a Multicast Group, page 18-2 • Leaving a Multicast Group, page 18-4 • Immediate-Leave Processing, page 18-4 • IGMP Snooping and Switch Stacks, page 18-5 Joining a Multicast Group When a host connected to the switch wants to join an IP multicast group, if it is an IGMP version 2 client, it sends an unsolicited IGMP join message, specifying the IP multicast group to join. Alternatively, when the switch receives a general query from the router, it forwards the query to all ports in the VLAN. IGMP version 1 or version 2 hosts wanting to join the multicast group respond by sending a join message to the switch. The switch CPU creates a multicast forwarding-table entry for the group if it is not already present. The CPU also adds the interface where the join message was received to the forwarding-table entry. The host associated with that interface receives multicast traffic for that multicast group. See Figure 18-1.18-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Understanding IGMP Snooping Figure 18-1 Initial IGMP Join Message Router A sends a general query to the switch, which forwards the query to ports 2 through 5, all members of the same VLAN. Host 1 wants to join multicast group 224.1.2.3 and multicasts an IGMP membership report (IGMP join message) to the group. When the CPU receives the IGMP report multicast by Host 1, the CPU uses the information in the IGMP report to set up a forwarding-table entry, as shown in Table 18-1, that includes the port numbers connected to Host 1and the router. The switch hardware can distinguish IGMP information packets from other packets for the multicast group. The information in the table tells the switching engine to send frames addressed to the 224.1.2.3 multicast IP address that are not IGMP packets to the router and to the host that has joined the group. If another host (for example, Host 4) sends an unsolicited IGMP join message for the same group (Figure 18-2), the CPU receives that message and adds the port number of Host 4 to the forwarding table as shown in Table 18-2. Note that because the forwarding table directs IGMP messages to only the CPU, the message is not flooded to other ports on the switch. Any known multicast traffic is forwarded to the group and not to the CPU. Forwarding table CPU Host 1 Host 2 Host 3 Host 4 Router A IGMP report 224.1.2.3 VLAN Switching engine Catalyst 3750 1 0 2 3 4 5 86837 Table 18-1 IGMP Snooping Forwarding Table Destination Address Type of Packet Ports 224.1.2.3 IGMP 1, 2 18-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Understanding IGMP Snooping Figure 18-2 Second Host Joining a Multicast Group Leaving a Multicast Group The router sends periodic multicast general queries, and the switch forwards these queries through all ports in the VLAN. Interested hosts respond to the queries. If at least one host in the VLAN wishes to receive multicast traffic, the router continues forwarding the multicast traffic to the VLAN. The switch forwards multicast group traffic only to those hosts listed in the forwarding table for that IP multicast group maintained by IGMP snooping. When hosts want to leave a multicast group, they can silently leave or they can send a leave message. When the switch receives a leave message from a host, it sends out a MAC-based general query to determine if any other devices connected to that interface are interested in traffic for the specific multicast group. The switch then updates the forwarding table for that MAC group so that only those hosts interested in receiving multicast traffic for the group are listed in the forwarding table. If the router receives no reports from a VLAN, it removes the group for the VLAN from its IGMP cache. Immediate-Leave Processing The switch uses IGMP snooping Immediate-Leave processing to remove from the forwarding table an interface that sends a leave message without the switch sending MAC-based general queries to the interface. The VLAN interface is pruned from the multicast tree for the multicast group specified in the original leave message. Immediate-Leave processing ensures optimal bandwidth management for all hosts on a switched network, even when multiple multicast groups are simultaneously in use. Table 18-2 Updated IGMP Snooping Forwarding Table Destination Address Type of Packet Ports 224.1.2.3 IGMP 1, 2, 5 Forwarding table CPU Host 1 Host 2 Host 3 Host 4 Router A VLAN 1 0 2 3 4 5 86838 Switching engine Catalyst 375018-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Note You should only use the Immediate-Leave processing feature on VLANs where a single host is connected to each port. If Immediate Leave is enabled in VLANs where more than one host is connected to a port, some hosts might be inadvertently dropped. Immediate Leave is only supported with IGMP version 2 hosts. IGMP Snooping and Switch Stacks IGMP snooping functions across the switch stack; that is, IGMP control information obtained from one switch is distributed to all switches in the stack. (See Chapter 5, “Managing Switch Stacks,” for more information about switch stacks.) Regardless of the stack member through which IGMP multicast data enters the stack, the data reaches the hosts that have registered for that group. If a switch in the stack fails or is removed from the stack, only the members of the multicast group that are on that switch will not receive the multicast data. All other members of a multicast group on other switches in the stack continue to receive multicast data streams. However, multicast groups that are common for both Layer 2 and Layer 3 (IP multicast routing) might take longer to converge if the stack master is removed. Configuring IGMP Snooping IGMP snooping allows switches to examine IGMP packets and make forwarding decisions based on their content. These sections describe how to configure IGMP snooping: • Default IGMP Snooping Configuration, page 18-5 • Enabling or Disabling IGMP Snooping, page 18-6 • Setting the Snooping Method, page 18-6 • Configuring a Multicast Router Port, page 18-8 • Configuring a Host Statically to Join a Group, page 18-9 • Enabling IGMP Immediate-Leave Processing, page 18-9 Default IGMP Snooping Configuration Table 18-3 shows the default IGMP snooping configuration. Table 18-3 Default IGMP Snooping Configuration Feature Default Setting IGMP snooping Enabled globally and per VLAN Multicast routers None configured Multicast router learning (snooping) method PIM-DVMRP IGMP snooping Immediate Leave Disabled Static groups None configured18-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Enabling or Disabling IGMP Snooping By default, IGMP snooping is globally enabled on the switch. When globally enabled or disabled, it is also enabled or disabled in all existing VLAN interfaces. IGMP snooping is by default enabled on all VLANs, but can be enabled and disabled on a per-VLAN basis. Global IGMP snooping overrides the VLAN IGMP snooping. If global snooping is disabled, you cannot enable VLAN snooping. If global snooping is enabled, you can enable or disable VLAN snooping. Beginning in privileged EXEC mode, follow these steps to globally enable IGMP snooping on the switch: To globally disable IGMP snooping on all VLAN interfaces, use the no ip igmp snooping global configuration command. Beginning in privileged EXEC mode, follow these steps to enable IGMP snooping on a VLAN interface: To disable IGMP snooping on a VLAN interface, use the no ip igmp snooping vlan vlan-id global configuration command for the specified VLAN number. Setting the Snooping Method Multicast-capable router ports are added to the forwarding table for every Layer 2 multicast entry. The switch learns of such ports through one of these methods: • Snooping on IGMP queries, Protocol Independent Multicast (PIM) packets, and Distance Vector Multicast Routing Protocol (DVMRP) packets • Listening to Cisco Group Management Protocol (CGMP) packets from other routers • Statically connecting to a multicast router port with the ip igmp snooping mrouter global configuration command Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip igmp snooping Globally enable IGMP snooping in all existing VLAN interfaces. Step 3 end Return to privileged EXEC mode. Step 4 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip igmp snooping vlan vlan-id Enable IGMP snooping on the VLAN interface.The VLAN ID range is 1 to 4094. Note IGMP snooping must be globally enabled before you can enable VLAN snooping. Step 3 end Return to privileged EXEC mode. Step 4 copy running-config startup-config (Optional) Save your entries in the configuration file.18-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Snooping You can configure the switch either to snoop on IGMP queries and PIM/DVMRP packets or to listen to CGMP self-join or proxy-join packets. By default, the switch snoops on PIM/DVMRP packets on all VLANs. To learn of multicast router ports through only CGMP packets, use the ip igmp snooping vlan vlan-id mrouter learn cgmp global configuration command. When this command is entered, the router listens to only CGMP self-join and CGMP proxy-join packets and no other CGMP packets. To learn of multicast router ports through only PIM-DVMRP packets, use the ip igmp snooping vlan vlan-id mrouter learn pim-dvmrp global configuration command. Note If you want to use CGMP as the learning method and no multicast routers in the VLAN are CGMP proxy-enabled, you must enter the ip cgmp router-only command to dynamically access the router. For more information, see Chapter 31, “Configuring IP Multicast Routing.” Beginning in privileged EXEC mode, follow these steps to alter the method in which a VLAN interface dynamically accesses a multicast router: This example shows how to configure IGMP snooping to use CGMP packets as the learning method and verify the configuration: Switch# configure terminal Switch(config)# ip igmp snooping vlan 1 mrouter learn cgmp Switch(config)# end Switch# show ip igmp snooping vlan 1 vlan 1 ---------- IGMP snooping is globally enabled IGMP snooping is enabled on this Vlan IGMP snooping immediate-leave is disabled on this Vlan IGMP snooping mrouter learn mode is cgmp on this Vlan IGMP snooping is running in IGMP_ONLY mode on this Vlan To return to the default learning method, use the no ip igmp snooping vlan vlan-id mrouter learn cgmp global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip igmp snooping vlan vlan-id mrouter learn {cgmp | pim-dvmrp} Enable IGMP snooping on a VLAN.The VLAN ID range is 1 to 4094. Specify the multicast router learning method: • cgmp—Listen for CGMP packets. This method is useful for reducing control traffic. • pim-dvmrp—Snoop on IGMP queries and PIM-DVMRP packets. This is the default. Step 3 end Return to privileged EXEC mode. Step 4 show ip igmp snooping Verify the configuration. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.18-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Configuring a Multicast Router Port To add a multicast router port (add a static connection to a multicast router), use the ip igmp snooping vlan mrouter global configuration command on the switch. Note Static connections to multicast routers are supported only on switch ports. Beginning in privileged EXEC mode, follow these steps to enable a static connection to a multicast router: To remove a multicast router port from the VLAN, use the no ip igmp snooping vlan vlan-id mrouter interface interface-id global configuration command. This example shows how to enable a static connection to a multicast router and verify the configuration: Switch# configure terminal Switch(config)# ip igmp snooping vlan 200 mrouter interface gigabitethernet1/0/2 Switch(config)# end Switch# show ip igmp snooping mrouter vlan 200 Vlan ports -----+---------------------------------------- 200 Gi1/0/2(static) Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip igmp snooping vlan vlan-id mrouter interface interface-id Specify the multicast router VLAN ID and specify the interface to the multicast router. • The VLAN ID range is 1 to 4094. • The interface can be a physical interface or a port channel. The port channel range is 1 to 12. Step 3 end Return to privileged EXEC mode. Step 4 show ip igmp snooping mrouter [vlan vlan-id] Verify that IGMP snooping is enabled on the VLAN interface. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.18-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Configuring a Host Statically to Join a Group Hosts or Layer 2 ports normally join multicast groups dynamically, but you can also statically configure a host on an interface. Beginning in privileged EXEC mode, follow these steps to add a Layer 2 port as a member of a multicast group: To remove the Layer 2 port from the multicast group, use the no ip igmp snooping vlan vlan-id static mac-address interface interface-id global configuration command. This example shows how to statically configure a host on an interface and verify the configuration: Switch# configure terminal Switch(config)# ip igmp snooping vlan 1 static 224.1.2.3 interface gigabitethernet1/0/1 Switch(config)# end Switch# show ip igmp snooping multicast Vlan Group Address Type Ports ---- ------------- ---- ----- 1 224.1.2.3 USER Gi1/0/1 Enabling IGMP Immediate-Leave Processing When you enable IGMP Immediate-Leave processing, the switch immediately removes a port when it detects an IGMP version 2 leave message on that port. You should use the Immediate-Leave feature only when there is a single receiver present on every port in the VLAN. Note Immediate Leave is supported with only IGMP version 2 hosts. Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 ip igmp snooping vlan vlan-id static ip_address interface interface-id Statically configure a Layer 2 port as a member of a multicast group: • vlan-id is the multicast group VLAN ID. • ip-address is the group IP address. • interface-id is the member port. It can be a physical interface or port channel (1 to 12). Step 3 end Return to privileged EXEC mode. Step 4 show ip igmp snooping multicast Verify the member port and the IP address. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.18-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Displaying IGMP Snooping Information Beginning in privileged EXEC mode, follow these steps to enable IGMP Immediate-Leave processing: To disable IGMP Immediate-Leave on a VLAN, use the no ip igmp snooping vlan vlan-id immediate-leave global configuration command. This example shows how to enable IGMP immediate-leave processing on VLAN 130: Switch# configure terminal Switch(config)# ip igmp snooping vlan 130 immediate-leave Switch(config)# end Displaying IGMP Snooping Information You can display IGMP snooping information for dynamically learned and statically configured router ports and VLAN interfaces. You can also display MAC address multicast entries for a VLAN configured for IGMP snooping. To display IGMP snooping information, use one or more of the privileged EXEC commands in Table 18-4. Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 ip igmp snooping vlan vlan-id immediate-leave Enable IGMP Immediate-Leave processing on the VLAN interface. Step 3 end Return to privileged EXEC mode. Step 4 show ip igmp snooping vlan vlan-id Verify that Immediate Leave is enabled on the VLAN. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Table 18-4 Commands for Displaying IGMP Snooping Information Command Purpose show ip igmp snooping [vlan vlan-id] Display the snooping configuration information for all VLANs on the switch or for a specified VLAN. (Optional) Enter vlan vlan-id to display information for a single VLAN. show ip igmp snooping multicast [count | dynamic [count | group ip_address] | group ip_address | user [count | group ip_address]] Display multicast table information for the switch or about a specific parameter: • count—Display the total number of entries for the specified command options instead of the actual entries. • dynamic— Display entries learned through IGMP snooping. • group ip_address—Display characteristics of the multicast group with the specified group IP address. • user—Display only the user-configured multicast entries.18-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Displaying IGMP Snooping Information For more information about the keywords and options in these commands, refer to the command reference for this release. show ip igmp snooping multicast vlan vlan-id [count | dynamic [count | group ip_address] | group ip_address | user [count | group ip_address]] Display multicast table information for a multicast VLAN or about a specific parameter for the VLAN: • count—Display the total number of entries for the specified command options instead of the actual entries. • dynamic— Display entries learned through IGMP snooping. • group ip_address—Display characteristics of the multicast group with the specified group IP address. • user—Display only the user-configured multicast entries. show ip igmp snooping mrouter [vlan vlan-id] Display information on dynamically learned and manually configured multicast router interfaces. Note When you enable IGMP snooping, the switch automatically learns the interface to which a multicast router is connected. These are dynamically learned interfaces. (Optional) Enter vlan vlan-id to display information for a single VLAN. Table 18-4 Commands for Displaying IGMP Snooping Information (continued) Command Purpose18-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Understanding Multicast VLAN Registration Understanding Multicast VLAN Registration Multicast VLAN Registration (MVR) is designed for applications using wide-scale deployment of multicast traffic across an Ethernet ring-based service provider network (for example, the broadcast of multiple television channels over a service-provider network). MVR allows a subscriber on a port to subscribe and unsubscribe to a multicast stream on the network-wide multicast VLAN. It allows the single multicast VLAN to be shared in the network while subscribers remain in separate VLANs. MVR provides the ability to continuously send multicast streams in the multicast VLAN, but to isolate the streams from the subscriber VLANs for bandwidth and security reasons. MVR assumes that subscriber ports subscribe and unsubscribe (join and leave) these multicast streams by sending out IGMP join and leave messages. These messages can originate from an IGMP version-2-compatible host with an Ethernet connection. Although MVR operates on the underlying mechanism of IGMP snooping, the two features operate independently of each other. One can be enabled or disabled without affecting the behavior of the other feature. However, if IGMP snooping and MVR are both enabled, MVR reacts only to join and leave messages from multicast groups configured under MVR. Join and leave messages from all other multicast groups are managed by IGMP snooping. The switch CPU identifies the MVR IP multicast streams and their associated IP multicast group in the switch forwarding table, intercepts the IGMP messages, and modifies the forwarding table to include or remove the subscriber as a receiver of the multicast stream, even though the receivers might be in a different VLAN from the source. This forwarding behavior selectively allows traffic to cross between different VLANs. You can set the switch for compatible or dynamic mode of MVR operation. • In compatible mode, multicast data received by MVR hosts is forwarded to all MVR data ports, regardless of MVR host membership on those ports. The multicast data is forwarded only to those receiver ports which MVR hosts have explicitly joined, either by IGMP reports or by MVR static configuration. Also, IGMP reports received from MVR hosts are never forwarded out of MVR data ports that were configured in the switch. • In dynamic mode, multicast data received by MVR hosts on the switch is forwarded from only those MVR data and client ports that the MVR hosts have explicitly joined, either by IGMP reports or by MVR static configuration. Any IGMP reports received from MVR hosts are also forwarded from all the MVR data ports in the switch. This eliminates using unnecessary bandwidth on MVR data port links, which occurs when the switch runs in compatible mode. Only Layer 2 ports take part in MVR. You must configure ports as MVR receiver ports. Only one MVR multicast VLAN per switch stack is supported. Receiver ports and source ports can be on different switches in a switch stack. Multicast data sent on the multicast VLAN is forwarded to all MVR receiver ports across the stack.When a new switch is added to a stack, by default it has no receiver ports. If a switch fails or is removed from the stack, only those receiver ports belonging to that switch will not receive the multicast data. All other receiver ports on other switches continue to receive the multicast data.18-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Understanding Multicast VLAN Registration Using MVR in a Multicast Television Application In a multicast television application, a PC or a television with a set-top box can receive the multicast stream. Multiple set-top boxes or PCs can be connected to one subscriber port, which is a switch port configured as an MVR receiver port. Figure 18-3 is an example configuration. DHCP assigns an IP address to the set-top box or the PC. When a subscriber selects a channel, the set-top box or PC sends an IGMP report to the S1 switch to join the appropriate multicast. If the IGMP report matches one of the configured IP multicast group addresses, the switch CPU modifies the hardware address table to include this receiver port and VLAN as a forwarding destination of the specified multicast stream when it is received from the multicast VLAN. Uplink ports that send and receive multicast data to and from the multicast VLAN are called MVR source ports. Figure 18-3 Multicast VLAN Registration Example SP1 Multicast data Multicast data Customer premises Multicast VLAN SP SP RP = Receiver Port SP = Source Port Note: All source ports belong to the multicast VLAN. Hub TV data Set-top box Set-top box TV TV PC SP SP SP SP IGMP join Cisco router Multicast server Catalyst 3750 switch Other Catalyst switch Other Catalyst switch Catalyst 3750 switch SP2 RP1 RP2 RP3 RP4 RP5 RP6 RP7 86700 S118-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring MVR When a subscriber changes channels or turns off the television, the set-top box sends an IGMP leave message for the multicast stream. The switch CPU sends a MAC-based general query through the receiver port VLAN. If there is another set-top box in the VLAN still subscribing to this group, that set-top box must respond within the maximum response time specified in the query. If the CPU does not receive a response, it eliminates the receiver port as a forwarding destination for this group. If the Immediate-Leave feature is enabled on a receiver port, the port leaves a multicast group more quickly. Without Immediate Leave, when the switch receives an IGMP leave message from a subscriber on a receiver port, it sends out an IGMP query on that port and waits for IGMP group membership reports. If no reports are received in a configured time period, the receiver port is removed from multicast group membership. With Immediate Leave, an IGMP query is not sent from the receiver port on which the IGMP leave was received. As soon as the leave message is received, the receiver port is removed from multicast group membership, which speeds up leave latency. Enable the Immediate Leave feature only on receiver ports to which a single receiver device is connected. MVR eliminates the need to duplicate television-channel multicast traffic for subscribers in each VLAN. Multicast traffic for all channels is only sent around the VLAN trunk once—only on the multicast VLAN. The IGMP leave and join messages are in the VLAN to which the subscriber port is assigned. These messages dynamically register for streams of multicast traffic in the multicast VLAN on the Layer 3 device. The access layer switch (S1 switch) modifies the forwarding behavior to allow the traffic to be forwarded from the multicast VLAN to the subscriber port in a different VLAN, selectively allowing traffic to cross between two VLANs. IGMP reports are sent to the same IP multicast group address as the multicast data. The S1 CPU must capture all IGMP join and leave messages from receiver ports and forward them to the multicast VLAN of the source (uplink) port, based on the MVR mode. Configuring MVR These sections include basic MVR configuration information: • Default MVR Configuration, page 18-15 • MVR Configuration Guidelines and Limitations, page 18-15 • Configuring MVR Global Parameters, page 18-15 • Configuring MVR Interfaces, page 18-1718-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring MVR Default MVR Configuration Table 18-5 shows the default MVR configuration. MVR Configuration Guidelines and Limitations Follow these guidelines when configuring MVR: • Receiver ports can only be access ports; they cannot be trunk ports. Receiver ports on a switch can be in different VLANs, but should not belong to the multicast VLAN. • The maximum number of multicast entries (MVR group addresses) that can be configured on a switch (that is, the maximum number of television channels that can be received) is 256. • MVR multicast data received in the source VLAN and leaving from receiver ports has its time-to-live (TTL) decremented by 1 in the Catalyst 3750 switch. • Because MVR on the Catalyst 3750 switch uses IP multicast addresses instead of MAC multicast addresses, aliased IP multicast addresses are allowed on the switch. However, if the switch is interoperating with Catalyst 3550 or Catalyst 3500 XL switches, you should not configure IP addresses that alias between themselves or with the reserved IP multicast addresses (in the range 224.0.0.xxx). • MVR is not supported when multicast routing is enabled on a switch. If you enable multicast routing and a multicast routing protocol while MVR is enabled, MVR is disabled, and you receive a warning message. If you try to enable MVR while multicast routing and a multicast routing protocol are enabled, the operation to enable MVR is cancelled, and you receive an error message. • MVR can coexist with IGMP snooping on a switch. • MVR data received on an MVR receiver port is not forwarded to MVR source ports. Configuring MVR Global Parameters You do not need to set the optional MVR parameters if you choose to use the default settings. If you do want to change the default parameters (except for the MVR VLAN), you must first enable MVR. Note For complete syntax and usage information for the commands used in this section, refer to the command reference for this release. Table 18-5 Default MVR Configuration Feature Default Setting MVR Disabled globally and per interface Multicast addresses None configured Query response time 0.5 second Multicast VLAN VLAN 1 Mode Compatible Interface (per port) default Neither a receiver nor a source port Immediate Leave Disabled on all ports18-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring MVR Beginning in privileged EXEC mode, follow these steps to configure MVR parameters: To return the switch to its default settings, use the no mvr [mode | group ip-address | querytime | vlan] global configuration commands. This example shows how to enable MVR, configure the group address, set the query time to 1 second (10 tenths), specify the MVR multicast VLAN as VLAN 22, and set the MVR mode as dynamic: Switch(config)# mvr Switch(config)# mvr group 228.1.23.4 Switch(config)# mvr querytime 10 Switch(config)# mvr vlan 22 Switch(config)# mvr mode dynamic Switch(config)# end You can use the show mvr members privileged EXEC command to verify the MVR multicast group addresses on the switch. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mvr Enable MVR on the switch. Step 3 mvr group ip-address [count] Configure an IP multicast address on the switch or use the count parameter to configure a contiguous series of MVR group addresses (the range for count is 1 to 256; the default is 1). Any multicast data sent to this address is sent to all source ports on the switch and all receiver ports that have elected to receive data on that multicast address. Each multicast address would correspond to one television channel. Step 4 mvr querytime value (Optional) Define the maximum time to wait for IGMP report memberships on a receiver port before removing the port from multicast group membership. The value is in units of tenths of a second. The range is from 1 to 100 and the default is 5 tenths or one-half second. Step 5 mvr vlan vlan-id (Optional) Specify the VLAN in which multicast data is received; all source ports must belong to this VLAN. The VLAN range is 1 to 4094. The default is VLAN 1. Step 6 mvr mode {dynamic | compatible} (Optional) Specify the MVR mode of operation: • dynamic—Allows dynamic MVR membership on source ports. • compatible—Is compatible with Catalyst 3500 XL and Catalyst 2900 XL switches and does not support IGMP dynamic joins on source ports. The default is compatible mode. Step 7 end Return to privileged EXEC mode. Step 8 show mvr or show mvr members Verify the configuration. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.18-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring MVR Configuring MVR Interfaces Beginning in privileged EXEC mode, follow these steps to configure Layer 2 MVR interfaces: To return the interface to its default settings, use the no mvr [type | immediate | vlan vlan-id | group] interface configuration commands. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mvr Enable MVR on the switch. Step 3 interface interface-id Enter interface configuration mode, and enter the type and number of the Layer 2 port to configure. Step 4 mvr type {source | receiver} Configure an MVR port as one of these: • source—Configure uplink ports that receive and send multicast data as source ports. Subscribers cannot be directly connected to source ports. All source ports on a switch belong to the single multicast VLAN. • receiver—Configure a port as a receiver port if it is a subscriber port and should only receive multicast data. It does not receive data unless it becomes a member of the multicast group, either statically or by using IGMP leave and join messages. Receiver ports cannot belong to the multicast VLAN. The default configuration is as a non-MVR port. If you attempt to configure a non-MVR port with MVR characteristics, the operation fails. Step 5 mvr vlan vlan-id group [ip-address] (Optional) Statically configure a port to receive multicast traffic sent to the multicast VLAN and the IP multicast address. A port statically configured as a member of a group remains a member of the group until statically removed. Note In compatible mode, this command applies to only receiver ports. In dynamic mode, it applies to receiver ports and source ports. Receiver ports can also dynamically join multicast groups by using IGMP join and leave messages. Step 6 mvr immediate (Optional) Enable the Immediate Leave feature of MVR on the port. Note This command applies to only receiver ports and should only be enabled on receiver ports to which a single receiver device is connected. Step 7 end Return to privileged EXEC mode. Step 8 show mvr show mvr interface or show mvr members Verify the configuration. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.18-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Displaying MVR Information This example shows how to configure Gigabit Ethernet port 1/0/3 as a receiver port, statically configure the port to receive multicast traffic sent to the multicast group address, configure Immediate Leave on the interface, and verify the results. Switch(config)# mvr Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# mvr type receiver Switch(config-if)# mvr vlan 22 group 228.1.23.4 Switch(config-if)# mvr immediate Switch(config)# end Switch# show mvr interface Port Type Status Immediate Leave ---- ---- ------- --------------- Gi1/0/3 RECEIVER ACTIVE/DOWN ENABLED Displaying MVR Information You can display MVR information for the switch or for a specified interface. Beginning in privileged EXEC mode, use the commands in Table 18-6 to display MVR configuration: Table 18-6 Commands for Displaying MVR Information show mvr Displays MVR status and values for the switch—whether MVR is enabled or disabled, the multicast VLAN, the maximum (256) and current (0 through 256) number of multicast groups, the query response time, and the MVR mode. show mvr interface [interface-id] [members [vlan vlan-id]] Displays all MVR interfaces and their MVR configurations. When a specific interface is entered, displays this information: • Type—Receiver or Source • Status—One of these: – Active means the port is part of a VLAN. – Up/Down means that the port is forwarding or nonforwarding. – Inactive means that the port is not part of any VLAN. • Immediate Leave—Enabled or Disabled If the members keyword is entered, displays all multicast group members on this port or, if a VLAN identification is entered, all multicast group members on the VLAN. The VLAN ID range is 1 to 4094; do not enter leading zeros. show mvr members [ip-address] Displays all receiver and source ports that are members of any IP multicast group or the specified IP multicast group IP address. 18-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Filtering Configuring IGMP Filtering In some environments, for example metropolitan or multiple-dwelling unit (MDU) installations, an administrator might want to control the set of multicast groups to which a user on a switch port can belong. This allows the administrator to control the distribution of multicast services, such as IP/TV, based on some type of subscription or service plan. With the IGMP filtering feature, you can filter multicast joins on a per-port basis by configuring IP multicast profiles and associating them with individual switch ports. An IGMP profile can contain one or more multicast groups and specifies whether access to the group is permitted or denied. If an IGMP profile denying access to a multicast group is applied to a switch port, the IGMP join report requesting the stream of IP multicast traffic is dropped, and the port is not allowed to receive IP multicast traffic from that group. If the filtering action permits access to the multicast group, the IGMP report from the port is forwarded for normal processing. IGMP filtering controls only group specific query and membership reports, including join and leave reports. It does not control general IGMP queries. IGMP filtering has no relationship with the function that directs the forwarding of IP multicast traffic. The filtering feature operates in the same manner whether CGMP or MVR is used to forward the multicast traffic. IGMP filtering is only applicable to dynamic learning of IP multicast group addresses; not static configuration. You can also set the maximum number of IGMP groups that a Layer 2 interface can join. Default IGMP Filtering Configuration Table 18-7 shows the default IGMP filtering configuration. Configuring IGMP Profiles To configure an IGMP profile, use the ip igmp profile global configuration command with a profile number to create an IGMP profile and to enter IGMP profile configuration mode. From this mode, you can specify the parameters of the IGMP profile to be used for filtering IGMP join requests from a port. When you are in IGMP profile configuration mode, you can create the profile by using these commands: • deny: Specifies that matching addresses are denied; this is the default condition. • exit: Exits from igmp-profile configuration mode. • no: Negates a command or sets its defaults. • permit: Specifies that matching addresses are permitted. • range: Specifies a range of IP addresses for the profile. You can enter a single IP address or a range with a start and an end address. Table 18-7 Default IGMP Filtering Configuration Feature Default Setting IGMP filters None applied IGMP Maximum number of IGMP groups No maximum set IGMP profiles None defined IGMP profile action Deny the range addresses18-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Filtering The default is for the switch to have no IGMP profiles configured. When a profile is configured, if neither the permit nor deny keyword is included, the default is to deny access to the range of IP addresses. Beginning in privileged EXEC mode, follow these steps to create an IGMP profile: To delete a profile, use the no ip igmp profile profile number global configuration command. To delete an IP multicast address or range of IP multicast addresses, use the no range ip multicast address IGMP profile configuration command. This example shows how to create IGMP profile 4 allowing access to the single IP multicast address and how to verify the configuration. If the action was to deny (the default), it would not appear in the show ip igmp profile output display. Switch(config)# ip igmp profile 4 Switch(config-igmp-profile)# permit Switch(config-igmp-profile)# range 229.9.9.0 Switch(config-igmp-profile)# end Switch# show ip igmp profile 4 IGMP Profile 4 permit range 229.9.9.0 229.9.9.0 Applying IGMP Profiles To control access as defined in an IGMP profile, use the ip igmp filter interface configuration command to apply the profile to the appropriate interfaces. You can apply IGMP profiles to layer 2 access ports only; you cannot apply IGMP profiles to routed ports or SVIs. You cannot apply profiles to ports that belong to an EtherChannel port group. You can apply a profile to multiple interfaces, but each interface can only have one profile applied to it. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip igmp profile profile number Enter IGMP profile configuration mode, and assign a number to the profile you are configuring. The range is from 1 to 4294967295. Step 3 permit | deny (Optional) Set the action to permit or deny access to the IP multicast address. If no action is configured, the default for the profile is to deny access. Step 4 range ip multicast address Enter the IP multicast address or range of IP multicast addresses to which access is being controlled. If entering a range, enter the low IP multicast address, a space, and the high IP multicast address. You can use the range command multiple times to enter multiple addresses or ranges of addresses. Step 5 end Return to privileged EXEC mode. Step 6 show ip igmp profile profile number Verify the profile configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.18-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Configuring IGMP Filtering Beginning in privileged EXEC mode, follow these steps to apply an IGMP profile to a switch port: To remove a profile from an interface, use the no ip igmp filter profile number interface configuration command. This example shows how to apply IGMP profile 4 to an interface: Switch(config)# interface gigabitthernet1/0/12 Switch(config-if)# ip igmp filter 4 Switch(config-if)# end Setting the Maximum Number of IGMP Groups You can set the maximum number of IGMP groups that a Layer 2 interface can join by using the ip igmp mac-groups interface configuration command. Use the no form of this command to set the maximum back to the default, which is no limit. This restriction can be applied to Layer 2 ports only; you cannot set a maximum number of IGMP groups on routed ports or SVIs. You also cannot use this command on ports that belong to an EtherChannel port group. Beginning in privileged EXEC mode, follow these steps to apply an IGMP profile to a switch port: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the physical interface to configure. The interface must be a Layer 2 port that does not belong to an EtherChannel port group. Step 3 ip igmp filter profile number Apply the specified IGMP profile to the interface. The profile number can be from 1 to 4294967295. Step 4 end Return to privileged EXEC mode. Step 5 show running-config interface interface-id Verify the configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the physical interface to configure. The interface must be a Layer 2 port that does not belong to an EtherChannel group. Step 3 ip igmp max-groups number Set the maximum number of IGMP groups that the interface can join. The range is from 0 to 4294967294. The default is to have no maximum set. Step 4 end Return to privileged EXEC mode. Step 5 show running-config interface interface-id Verify the configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.18-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 18 Configuring IGMP Snooping and MVR Displaying IGMP Filtering Configuration To remove the maximum group limitation and return to the default of no maximum, use the no ip igmp max-groups interface configuration command. This example shows how to limit the number of IGMP groups that an interface can join to 25. Switch(config)# interface gigabitethernet1/0/12 Switch(config-if)# ip igmp max-groups 25 Switch(config-if)# end Displaying IGMP Filtering Configuration You can display IGMP profile characteristics, and you can display the IGMP profile and maximum group configuration for all interfaces on the switch or for a specified interface. Use the privileged EXEC commands in Table 18-8 to display IGMP filtering configuration: Table 18-8 Commands for Displaying IGMP Filtering Configuration show ip igmp profile [profile number] Displays the specified IGMP profile or all IGMP profiles defined on the switch. show running-config [interface interface-id] Displays the configuration of the specified interface or all interfaces on the switch, including (if configured) the maximum number of IGMP groups to which an interface can belong and the IGMP profile applied to the interface.C H A P T E R 19-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 19 Configuring Port-Based Traffic Control This chapter describes how to configure the port-based traffic control features on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Configuring Storm Control, page 19-1 • Configuring Protected Ports, page 19-4 • Configuring Port Blocking, page 19-5 • Configuring Port Security, page 19-7 • Displaying Port-Based Traffic Control Settings, page 19-15 Configuring Storm Control These sections include storm control configuration information and procedures: • Understanding Storm Control, page 19-1 • Default Storm Control Configuration, page 19-3 • Enabling Storm Control, page 19-3 Understanding Storm Control Storm control prevents switchports on a LAN from being disrupted by a broadcast, multicast, or unicast storm on one of the physical interfaces. A LAN storm occurs when packets flood the LAN, creating excessive traffic and degrading network performance. Errors in the protocol-stack implementation or in the network configuration can cause a storm. Storm control (or traffic suppression) monitors incoming traffic statistics over a time period and compares the measurement with a predefined suppression level threshold. The threshold represents the percentage of the total available bandwidth of the port. The switch supports separate storm control thresholds for broadcast, multicast, and unicast traffic. If the threshold of a traffic type is reached, further traffic of that type is suppressed until the incoming traffic falls below the threshold level. 19-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Storm Control Note When the storm control threshold for multicast traffic is reached, all multicast traffic except control traffic, such as bridge protocol data unit (BDPU) and Cisco Discovery Protocol (CDP) frames, are blocked. However, the switch does not differentiate between routing updates, such as OSPF, and regular multicast data traffic, so both types of traffic are blocked. When storm control is enabled, the switch monitors packets passing from an interface to the switching bus and determines if the packet is unicast, multicast, or broadcast. The switch monitors the number of broadcast, multicast, or unicast packets received within a 200-millisecond time interval, and when a threshold for one type of traffic is reached, that type of traffic is dropped. This threshold is specified as a percentage of total available bandwidth that can be used by broadcast (multicast or unicast) traffic. The graph in Figure 19-1 shows broadcast traffic patterns on an interface over a given period of time. The example can also be applied to multicast and unicast traffic. In this example, the broadcast traffic being forwarded exceeded the configured threshold between time intervals T1 and T2 and between T4 and T5. When the amount of specified traffic exceeds the threshold, all traffic of that kind is dropped for the next time period. Therefore, broadcast traffic is blocked during the intervals following T2 and T5. At the next time interval (for example, T3), if broadcast traffic does not exceed the threshold, it is again forwarded. Figure 19-1 Broadcast Storm Control Example The combination of the storm-control suppression level and the 200-millisecond time interval control the way the storm control algorithm works. A higher threshold allows more packets to pass through. A threshold value of 100 percent means that no limit is placed on the traffic. A value of 0.0 means that all broadcast, multicast, or unicast traffic on that port is blocked. Note Because packets do not arrive at uniform intervals, the 200-millisecond time interval during which traffic activity is measured can affect the behavior of storm control. The switch continues to monitor traffic on the port, and when the utilization level is below the threshold level, the type of traffic that was dropped is forwarded again. You use the storm-control interface configuration commands to set the threshold value for each traffic type. Total number of broadcast packets or bytes Forwarded traffic 0 T1 Threshold T2 T4 T5 T3 Time 46651 Blocked traffic19-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Storm Control Note Although visible in the command-line interface (CLI) online help, the switchport broadcast, switchport multicast, and switchport unicast interface configuration commands for setting suppression levels are not available. These commands are obsolete, replaced by the storm-control interface configuration commands. Default Storm Control Configuration By default, unicast, broadcast, and multicast storm control is disabled on the switch interfaces; that is, the suppression level is 100 percent. Enabling Storm Control You enable storm control on an interface and enter the percentage of total available bandwidth that you want to be used by a particular type of traffic; entering 100 percent allows all traffic. However, because of hardware limitations and the way in which packets of different sizes are counted, threshold percentages are approximations. Depending on the sizes of the packets making up the incoming traffic, the actual enforced threshold might differ from the configured level by several percentage points. Note Storm control is supported only on physical interfaces; it is not supported on EtherChannel port channels even though the command is available in the CLI. Beginning in privileged EXEC mode, follow these steps to enable a particular type of storm control: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the type and number of the physical interface to configure, for example gigabitethernet1/0/1. Step 3 storm-control broadcast level level [.level] Specify the broadcast traffic suppression level for an interface as a percentage of total bandwidth. The level can be from 1 to 100; the optional fraction of a level can be from 0 to 99. A threshold value of 100 percent means that no limit is placed on broadcast traffic. A value of 0.0 means that all broadcast traffic on that port is blocked. Step 4 storm-control multicast level level [.level] Specify the multicast traffic suppression level for an interface as a percentage of total bandwidth. The level can be from 1 to 100; the optional fraction of a level can be from 0 to 99. A threshold value of 100 percent means that no limit is placed on broadcast traffic. A value of 0.0 means that all multicast traffic on that port is blocked. Step 5 storm-control unicast level level [.level] Specify the unicast traffic suppression level for an interface as a percentage of total bandwidth. The level can be from 1 to 100; the optional fraction of a level can be from 0 to 99. A threshold value of 100 percent means that no limit is placed on broadcast traffic. A value of 0.0 means that all unicast traffic on that port is blocked. Step 6 end Return to privileged EXEC mode.19-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Protected Ports To disable storm control, use the no storm-control broadcast level, no storm-control multicast level, or no storm-control unicast level interface configuration commands. This example shows how to set the multicast storm control level at 70.5 percent on Gigabit Ethernet interface 0/17 on switch 2 and verify the configuration: Switch# configure terminal Switch(config)# interface gigabitethernet2/0/17 Switch(config-if)# storm-control multicast level 70.5 Switch(config-if)# end Switch# show storm-control gigabitethernet2/0/17 multicast Interface Filter State Level Current --------- ------------- ------- ------- Gi2/0/17 Forwarding 70.50% 0.00% This example shows how to disable the multicast storm control on Gigabit Ethernet interface 0/17 on switch 2 and verify the configuration: Switch# configure terminal Switch(config)# interface gigabitethernet2/0/17 Switch(config-if)# no storm-control multicast level Switch(config-if)# end Switch# show storm-control gigabitethernet2/0/17 multicast Interface Filter State Level Current --------- ------------- ------- ------- Gi2/0/17 inactive 100.00% N/A Configuring Protected Ports Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch. Protected ports have these features: • A protected port does not forward any traffic (unicast, multicast, or broadcast) to any other port that is also a protected port. Traffic cannot be forwarded between protected ports at Layer 2; all traffic passing between protected ports must be forwarded through a Layer 3 device. • Forwarding behavior between a protected port and a nonprotected port proceeds as usual. Because a switch stack represents a single logical switch, Layer 2 traffic is not forwarded between any protected ports in the switch stack, whether they are on the same or different switches in the stack. Default Protected Port Configuration The default is to have no protected ports defined. Step 7 show storm-control [interface-id] [broadcast | multicast | unicast] Verify the storm control suppression levels set on the interface for the specified traffic type. If you do not enter a traffic type, broadcast storm control settings are displayed. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose19-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Blocking Protected Port Configuration Guidelines You can configure protected ports on a physical interface (for example, Gigabit Ethernet1/ 0/1) or an EtherChannel group (for example, port-channel 5). When you enable protected ports for a port channel, it is enabled for all ports in the port-channel group. Configuring a Protected Port Beginning in privileged EXEC mode, follow these steps to define a port as a protected port: To disable protected port, use the no switchport protected interface configuration command. This example shows how to configure Gigabit Ethernet interface 0/1 on switch 1 as a protected port: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport protected Switch(config-if)# end Configuring Port Blocking By default, the switch floods packets with unknown destination MAC addresses out of all ports. If unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can block a port (protected or nonprotected) from flooding unknown unicast or multicast packets to other ports. Default Port Blocking Configuration The default is to not block flooding of unknown multicast and unicast traffic out of a port, but to flood these packets to all ports. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the type and number of the interface to configure, for example gigabitethernet1/0/1. Step 3 switchport protected Configure the interface to be a protected port. Step 4 end Return to privileged EXEC mode. Step 5 show interfaces interface-id switchport Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.19-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Blocking Blocking Flooded Traffic on an Interface Note The interface can be a physical interface (for example, Gigabit Ethernet 1/0/1) or an EtherChannel group (for example, port-channel 5). When you block multicast or unicast traffic for a port channel, it is blocked on all ports in the port channel group. Beginning in privileged EXEC mode, follow these steps to disable the flooding of multicast and unicast packets out of an interface: To return the interface to the default condition where no traffic is blocked and normal forwarding occurs on the port, use the no switchport block {multicast | unicast} interface configuration commands. This example shows how to block unicast and multicast flooding on Gigabit Ethernet interface 0/1 on switch 1: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport block multicast Switch(config-if)# switchport block unicast Switch(config-if)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the type and number of the interface to configure, for example gigabitethernet1/0/1. Step 3 switchport block multicast Block unknown multicast forwarding out of the port. Step 4 switchport block unicast Block unknown unicast forwarding out of the port. Step 5 end Return to privileged EXEC mode. Step 6 show interfaces interface-id switchport Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.19-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security Configuring Port Security You can use the port security feature to restrict input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a station attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. Also, if a station with a secure MAC address configured or learned on one secure port attempts to access another secure port, a violation is flagged. These sections include port security configuration information and procedures: • Understanding Port Security, page 19-7 • Default Port Security Configuration, page 19-9 • Configuration Guidelines, page 19-9 • Enabling and Configuring Port Security, page 19-10 • Enabling and Configuring Port Security Aging, page 19-13 • Port Security and Switch Stacks, page 19-14 Understanding Port Security This section contains information about these topics: • Secure MAC Addresses, page 19-7 • Security Violations, page 19-8 Secure MAC Addresses You configure the maximum number of secure addresses allowed on a port by using the switchport port-security maximum value interface configuration command. Note If you try to set the maximum value to a number less than the number of secure addresses already configured on an interface, the command is rejected. The switch supports these types of secure MAC addresses: • Static secure MAC addresses—These are manually configured by using the switchport port-security mac-address mac-address interface configuration command, stored in the address table, and added to the switch running configuration. • Dynamic secure MAC addresses—These are dynamically configured, stored only in the address table, and removed when the switch restarts. • Sticky secure MAC addresses—These can be dynamically learned or manually configured, stored in the address table, and added to the running configuration. If these addresses are saved in the configuration file, when the switch restarts, the interface does not need to dynamically reconfigure them. 19-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, enter the switchport port-security mac-address sticky interface configuration command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses. All sticky secure MAC addresses are added to the running configuration. The sticky secure MAC addresses do not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you save the sticky secure MAC addresses in the configuration file, when the switch restarts, the interface does not need to relearn these addresses. If you do not save the sticky secure addresses, they are lost. If sticky learning is disabled, the sticky secure MAC addresses are converted to dynamic secure addresses and are removed from the running configuration. The maximum number of secure MAC addresses that you can configure on a switch stack is determined by the maximum number of available MAC addresses allowed in the system. This number is determined by the active Switch Database Management (SDM) template. See Chapter 8, “Configuring SDM Templates.” This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. Security Violations It is a security violation when one of these situations occurs: • The maximum number of secure MAC addresses have been added to the address table, and a station whose MAC address is not in the address table attempts to access the interface. • An address learned or configured on one secure interface is seen on another secure interface in the same VLAN. You can configure the interface for one of three violation modes, based on the action to be taken if a violation occurs: • protect—when the number of secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. Note We do not recommend configuring the protect violation mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit. • restrict—when the number of secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. In this mode, you are notified that a security violation has occurred. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. • shutdown—a port security violation causes the interface to become error-disabled and to shut down immediately, and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands. This is the default mode.19-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security Table 19-1 shows the violation mode and the actions taken when you configure an interface for port security. Default Port Security Configuration Table 19-2 shows the default port security configuration for an interface. Configuration Guidelines Follow these guidelines when configuring port security: • Port security can only be configured on static access ports or trunk ports. A secure port cannot be a dynamic access port. • A secure port cannot be a destination port for Switched Port Analyzer (SPAN). • A secure port cannot belong to a Fast EtherChannel or a Gigabit EtherChannel port group. • You cannot configure static secure or sticky secure MAC addresses in the voice VLAN. Note Voice VLAN is only supported on access ports and not on trunk ports, even though the configuration is allowed. Table 19-1 Security Violation Mode Actions Violation Mode Traffic is forwarded 1 1. Packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses. Sends SNMP trap Sends syslog message Displays error message 2 2. The switch returns an error message if you manually configure an address that would cause a security violation. Violation counter increments Shuts down port protect No No No No No No r es tr ict No Yes Yes No Yes No shutdown No Yes Yes No Yes Yes Table 19-2 Default Port Security Configuration Feature Default Setting Port security Disabled on a port. Sticky address learning Disabled. Maximum number of secure MAC addresses per port 1. Violation mode Shutdown. The port shuts down when the maximum number of secure MAC addresses is exceeded. Port security aging Disabled. Aging time is 0. Static aging is disabled. Type is absolute.19-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security • When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to two plus the maximum number of secure addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the IP phone requires up to two MAC addresses. The IP phone address is learned on the voice VLAN and might also be learned on the access VLAN. Connecting a PC to the IP phone requires additional MAC addresses. • If any type of port security is enabled on the access VLAN, dynamic port security is automatically enabled on the voice VLAN. You cannot configure port security on a per-VLAN basis. • When a voice VLAN is configured on a secure port that is also configured as a sticky secure port, all addresses on the voice VLAN are learned as dynamic secure addresses, and all addresses seen on the access VLAN to which the port belongs are learned as sticky secure addresses. • When you enter a maximum secure address value for an interface, and the new value is greater than the previous value, the new value overwrites the previously configured value. If the new value is less than the previous value and the number of configured secure addresses on the interface exceeds the new value, the command is rejected. • The switch does not support port security aging of sticky secure MAC addresses. Enabling and Configuring Port Security Beginning in privileged EXEC mode, follow these steps to restrict input to an interface by limiting and identifying MAC addresses of the stations allowed to access the port: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the physical interface to configure, for example gigabitethernet1/0/1. Step 3 switchport mode {access | trunk} Set the interface switchport mode as access or trunk; an interface in the default mode (dynamic auto) cannot be configured as a secure port. Step 4 switchport port-security Enable port security on the interface. Step 5 switchport port-security maximum value [vlan [vlan-list]] (Optional) Set the maximum number of secure MAC addresses for the interface. The maximum number of secure MAC addresses that you can configure on a switch stack is determined by the maximum number of available MAC addresses allowed in the system. This number is determined by the active Switch Database Management (SDM) template. See Chapter 8, “Configuring SDM Templates.” This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces. (Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used. • vlan—set a per-VLAN maximum value. • vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen, or a series of VLANs separated by commas. For non-specified VLANs, the per-VLAN maximum value is used. 19-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security Step 6 switchport port-security violation {protect | restrict | shutdown} (Optional) Set the violation mode, the action to be taken when a security violation is detected, as one of these: • protect—When the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred. Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit. • restrict—When the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. • shutdown—The interface is error-disabled when a violation occurs, and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. Note When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shutdown interface configuration commands. Step 7 switchport port-security mac-address mac-address [vlan vlan-id] (Optional) Enter a secure MAC address for the interface. You can use this command to enter the maximum number of secure MAC addresses. If you configure fewer secure MAC addresses than the maximum, the remaining MAC addresses are dynamically learned. (Optional) On a trunk port, you can specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used. Note If you enable sticky learning after you enter this command, the secure addresses that were dynamically learned are converted to sticky secure MAC addresses and are added to the running configuration. Step 8 switchport port-security mac-address sticky (Optional) Enable stick learning on the interface. Step 9 switchport port-security mac-address sticky mac-address (Optional) Enter a sticky secure MAC address, repeating the command as many times as necessary. If you configure fewer secure MAC addresses than the maximum, the remaining MAC addresses are dynamically learned, are converted to sticky secure MAC addresses, and are added to the running configuration. Note If you do not enable sticky learning before this command is entered, an error message appears, and you cannot enter a sticky secure MAC address. Step 10 end Return to privileged EXEC mode. Command Purpose19-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security To return the interface to the default condition as not a secure port, use the no switchport port-security interface configuration command. If you enter this command when sticky learning is enabled, the sticky secure addresses remain part of the running configuration but are removed from the address table. All addresses are now dynamically learned. To return the interface to the default number of secure MAC addresses, use the no switchport port-security maximum value interface configuration command. To return the violation mode to the default condition (shutdown mode), use the no switchport port-security violation {protocol | restrict} interface configuration command. To disable sticky learning on an interface, use the no switchport port-security mac-address sticky interface configuration command. The interface converts the sticky secure MAC addresses to dynamic secure addresses. However, if you have previously saved the configuration with the sticky MAC addresses, you should save the configuration again after entering the no switchport port-security mac-address sticky command, or the sticky addresses will be restored if the switch reboots. To delete a specific secure MAC address from the address table, use the no switchport port-security mac-address mac-address interface configuration command. To delete all dynamic secure addresses on an interface from the address table, enter the no switchport port-security interface configuration command followed by the switchport port-security command (to re-enable port security on the interface). If you use the no switchport port-security mac-address sticky interface configuration command to convert sticky secure MAC addresses to dynamic secure MAC addresses before entering the no switchport port-security command, all secure addresses on the interface except those that were manually configured are deleted. You must specifically delete configured secure MAC addresses from the address table by using the no switchport port-security mac-address mac-address interface configuration command. This example shows how to enable port security on Gigabit Ethernet port 0/1 on switch 1 and to set the maximum number of secure addresses to 50. The violation mode is the default, no static secure MAC addresses are configured, and sticky learning is enabled. Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security maximum 50 Switch(config-if)# switchport port-security mac-address sticky This example shows how to configure a static secure MAC address on VLAN 3 on Gigabit Ethernet port 0/12 of switch 1: Switch(config)# interface gigabitethernet1/0/12 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport port-security Switch(config-if)# switchport port-security mac-address 0000.02000.0004 vlan 3 Step 11 show port-security Verify your entries. Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose19-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security Enabling and Configuring Port Security Aging You can use port security aging to set the aging time for all secure addresses on a port. Two types of aging are supported per port: • Absolute—The secure addresses on the port are deleted after the specified aging time. • Inactivity—The secure addresses on the port are deleted only if the secure addresses are inactive for the specified aging time. Use this feature to remove and add devices on a secure port without manually deleting the existing secure MAC addresses and to still limit the number of secure addresses on a port. You can enable or disable the aging of secure addresses on a per-port basis. Beginning in privileged EXEC mode, follow these steps to configure port security aging: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode for the port on which you want to enable port security aging. Step 3 switchport port-security aging {static | time time | type {absolute | inactivity}} Enable or disable static aging for the secure port, or set the aging time or type. Note The switch does not support port security aging of sticky secure addresses. Enter static to enable aging for statically configured secure addresses on this port. For time, specify the aging time for this port. The valid range is from 0 to 1440 minutes. If the time is equal to 0, aging is disabled for this port. For type, select one of these keywords: • absolute—Sets the aging type as absolute aging. All the secure addresses on this port age out exactly after the time (minutes) specified lapses and are removed from the secure address list. • inactivity—Sets the aging type as inactivity aging. The secure addresses on this port age out only if there is no data traffic from the secure source addresses for the specified time period. Step 4 end Return to privileged EXEC mode. Step 5 show port-security [interface interface-id] [address] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.19-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Configuring Port Security To disable port security aging for all secure addresses on a port, use the no switchport port-security aging time interface configuration command. To disable aging for only statically configured secure addresses, use the no switchport port-security aging static interface configuration command. This example shows how to set the aging time as 2 hours for the secure addresses on Gigabit Ethernet interface 0/1 on switch 1: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# switchport port-security aging time 120 This example shows how to set the aging time as 2 minutes for the inactivity aging type with aging enabled for the configured secure addresses on the interface: Switch(config-if)# switchport port-security aging time 2 Switch(config-if)# switchport port-security aging type inactivity Switch(config-if)# switchport port-security aging static You can verify the previous commands by entering the show port-security interface interface-id privileged EXEC command. Port Security and Switch Stacks When a switch joins a stack, the new switch will get the configured secure addresses. All dynamic secure addresses are downloaded by the new stack member from the other stack members. When a switch (either the stack master or a stack member) leaves the stack, the remaining stack members are notified, and the secure MAC addresses configured or learned by that switch are deleted from the secure MAC address table. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.”19-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Displaying Port-Based Traffic Control Settings Displaying Port-Based Traffic Control Settings The show interfaces interface-id switchport privileged EXEC command displays (among other characteristics) the interface traffic suppression and control configuration. The show interfaces counters privileged EXEC commands display the count of discarded packets. The show storm-control and show port-security privileged EXEC commands display those features. To display traffic control information, use one or more of the privileged EXEC commands in Table 19-3. Table 19-3 Commands for Displaying Traffic Control Status and Configuration Command Purpose show interfaces [interface-id] switchport Displays the administrative and operational status of all switching (nonrouting) ports or the specified port, including port blocking and port protection settings. show storm-control [interface-id] [broadcast | multicast | unicast] Displays storm control suppression levels set on all interfaces or the specified interface for the specified traffic type or for broadcast traffic if no traffic type is entered. show interfaces [interface-id] counters broadcast Displays the storm-control broadcast suppression discard counter with the number of packets discarded for all interfaces or the specified interface. show interfaces [interface-id] counters multicast Displays the storm-control multicast suppression discard counter with the number of packets discarded for all interfaces or the specified interface. show interfaces [interface-id] counters unicast Displays the storm-control unicast suppression discard counter with the number of packets discarded for all interfaces or the specified interface. show port-security [interface interface-id] Displays port security settings for the switch or for the specified interface, including the maximum allowed number of secure MAC addresses for each interface, the number of secure MAC addresses on the interface, the number of security violations that have occurred, and the violation mode. show port-security [interface interface-id] address Displays all secure MAC addresses configured on all switch interfaces or on a specified interface with aging information for each address. show port-security interface interface-id vlan Displays the number of secure MAC addresses configured per VLAN on the specified interface. 19-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 19 Configuring Port-Based Traffic Control Displaying Port-Based Traffic Control SettingsC H A P T E R 20-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 20 Configuring CDP This chapter describes how to configure Cisco Discovery Protocol (CDP) on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release and the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This chapter consists of these sections: • Understanding CDP, page 20-1 • Configuring CDP, page 20-2 • Monitoring and Maintaining CDP, page 20-5 Understanding CDP CDP is a device discovery protocol that runs over Layer 2 (the data link layer) on all Cisco-manufactured devices (routers, bridges, access servers, and switches) and allows network management applications to discover Cisco devices that are neighbors of already known devices. With CDP, network management applications can learn the device type and the Simple Network Management Protocol (SNMP) agent address of neighboring devices running lower-layer, transparent protocols. This feature enables applications to send SNMP queries to neighboring devices. CDP runs on all media that support Subnetwork Access Protocol (SNAP). Because CDP runs over the data-link layer only, two systems that support different network-layer protocols can learn about each other. Each CDP-configured device sends periodic messages to a multicast address, advertising at least one address at which it can receive SNMP messages. The advertisements also contain time-to-live, or holdtime information, which is the length of time a receiving device holds CDP information before discarding it. Each device also listens to the messages sent by other devices to learn about neighboring devices. On the switch, CDP enables the Cluster Management Suite to display a graphical view of the network. The switch uses CDP to find cluster candidates and maintain information about cluster members and other devices up to three cluster-enabled devices away from the command switch by default. The switch supports CDP version 2.20-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 20 Configuring CDP Configuring CDP CDP and Switch Stacks A switch stack appears as a single switch in the network. Therefore, CDP discovers the switch stack, not the individual stack members. The switch stack sends CDP messages to neighboring network devices when there are changes to the switch stack membership, such as stack members being added or removed. Configuring CDP These sections include CDP configuration information and procedures: • Default CDP Configuration, page 20-2 • Configuring the CDP Characteristics, page 20-2 • Disabling and Enabling CDP, page 20-3 • Disabling and Enabling CDP on an Interface, page 20-4 Default CDP Configuration Table 20-1 shows the default CDP configuration. Configuring the CDP Characteristics You can configure the frequency of CDP updates, the amount of time to hold the information before discarding it, and whether or not to send version-2 advertisements. Beginning in privileged EXEC mode, follow these steps to configure the CDP timer, holdtime, and advertisement type. Note Steps 2 through 4 are all optional and can be performed in any order. Table 20-1 Default CDP Configuration Feature Default Setting CDP global state Enabled CDP interface state Enabled CDP timer (packet update frequency) 60 seconds CDP holdtime (before discarding) 180 seconds CDP version-2 advertisements Enabled Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 cdp timer seconds (Optional) Set the transmission frequency of CDP updates in seconds. The range is from 5 to 254; the default is 60 seconds.20-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 20 Configuring CDP Configuring CDP Use the no form of the CDP commands to return to the default settings. This example shows how to configure and verify CDP characteristics. Switch# configure terminal Switch(config)# cdp timer 50 Switch(config)# cdp holdtime 120 Switch(config)# cdp advertise-v2 Switch(config)# end Switch# show cdp Global CDP information: Sending CDP packets every 50 seconds Sending a holdtime value of 120 seconds Sending CDPv2 advertisements is enabled For additional CDP show commands, see the “Monitoring and Maintaining CDP” section on page 20-5. Disabling and Enabling CDP CDP is enabled by default. Note Switch clusters and other Cisco devices (such as Cisco IP Phones) regularly exchange CDP messages. Disabling CDP can interrupt cluster discovery and device connectivity. For more information, see Chapter 6, “Clustering Switches.” Beginning in privileged EXEC mode, follow these steps to disable the CDP device discovery capability: Step 3 cdp holdtime seconds (Optional) Specify the amount of time a receiving device should hold the information sent by your device before discarding it. The range is from 10 to 255 seconds; the default is 180 seconds. Step 4 cdp advertise-v2 (Optional) Configure CDP to send version-2 advertisements. This is the default state. Step 5 end Return to privileged EXEC mode. Step 6 show cdp Verify configuration by displaying global information about CDP on the device. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no cdp run Disable CDP. Step 3 end Return to privileged EXEC mode.20-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 20 Configuring CDP Configuring CDP Beginning in privileged EXEC mode, follow these steps to enable CDP when it has been disabled: This example shows how to enable CDP if it has been disabled. Switch# configure terminal Switch(config)# cdp run Switch(config)# end Disabling and Enabling CDP on an Interface CDP is enabled by default on all supported interfaces to send and receive CDP information. Beginning in privileged EXEC mode, follow these steps to disable CDP on an interface: Beginning in privileged EXEC mode, follow these steps to enable CDP on an interface when it has been disabled: This example shows how to enable CDP on an interface when it has been disabled. Switch# configure terminal Switch(config)# interface gigabitethernet1/0/5 Switch(config-if)# cdp enable Switch(config-if)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 cdp run Enable CDP after disabling it. Step 3 end Return to privileged EXEC mode. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the interface on which you are disabling CDP. Step 3 no cdp enable Disable CDP on an interface. Step 4 end Return to privileged EXEC mode. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the interface on which you are enabling CDP. Step 3 cdp enable Enable CDP on an interface after disabling it. Step 4 end Return to privileged EXEC mode. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.20-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 20 Configuring CDP Monitoring and Maintaining CDP Monitoring and Maintaining CDP To monitor and maintain CDP on your device, perform one or more of these tasks, beginning in privileged EXEC mode. This is an example of the output from the show cdp privileged EXEC commands: Switch# show cdp Global CDP information: Sending CDP packets every 50 seconds Sending a holdtime value of 120 seconds Sending CDPv2 advertisements is enabled Command Description clear cdp counters Reset the traffic counters to zero. clear cdp table Delete the CDP table of information about neighbors. show cdp Display global information, such as frequency of transmissions and the holdtime for packets being sent. show cdp entry entry-name [protocol | version] Display information about a specific neighbor. You can enter an asterisk (*) to display all CDP neighbors, or you can enter the name of the neighbor about which you want information. You can also limit the display to information about the protocols enabled on the specified neighbor or information about the version of software running on the device. show cdp interface [type number] Display information about interfaces where CDP is enabled. You can limit the display to the type of interface or the number of the interface about which you want information (for example, entering gigabitethernet 1/0/1 displays information only about Gigabit Ethernet port 1). show cdp neighbors [type number] [detail] Display information about neighbors, including device type, interface type and number, holdtime settings, capabilities, platform, and port ID. You can limit the display to neighbors on a specific type or number of interface or expand the display to provide more detailed information. show cdp traffic Display CDP counters, including the number of packets sent and received and checksum errors.20-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 20 Configuring CDP Monitoring and Maintaining CDPC H A P T E R 21-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 21 Configuring UDLD This chapter describes how to configure the UniDirectional Link Detection (UDLD) protocol on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding UDLD, page 21-1 • Configuring UDLD, page 21-3 • Displaying UDLD Status, page 21-5 Understanding UDLD UDLD is a Layer 2 protocol that enables devices connected through fiber-optic or twisted-pair Ethernet cables to monitor the physical configuration of the cables and detect when a unidirectional link exists. All connected devices must support UDLD for the protocol to successfully identify and disable unidirectional links. When UDLD detects a unidirectional link, it administratively shuts down the affected port and alerts you. Unidirectional links can cause a variety of problems, including spanning-tree topology loops. UDLD works with the Layer 1 mechanisms to determine the physical status of a link. At Layer 1, autonegotiation takes care of physical signaling and fault detection. UDLD performs tasks that autonegotiation cannot perform, such as detecting the identities of neighbors and disabling misconnected interfaces that are down. When you enable both autonegotiation and UDLD, Layer 1 and Layer 2 detections work together to prevent physical and logical unidirectional connections and the malfunctioning of other protocols. A unidirectional link occurs whenever traffic sent by the local device is received by the neighbor but traffic from the neighbor is not received by the local device. If one of the fiber strands in a pair is disconnected, as long as autonegotiation is active, the link does not stay up. In this case, the logical link is undetermined, and UDLD does not take any action. If both fibers are working normally from a Layer 1 perspective, UDLD at Layer 2 determines whether those fibers are connected correctly and whether traffic is flowing bidirectionally between the correct neighbors. This check cannot be performed by autonegotiation because autonegotiation operates at Layer 1. 21-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 21 Configuring UDLD Understanding UDLD UDLD operates by using two mechanisms: • Neighbor database maintenance UDLD learns about other UDLD-capable neighbors by periodically sending a hello packet (also called an advertisement or probe) on every active interface to keep each device informed about its neighbors. When the switch receives a hello message, it caches the information until the age time (hold time or time-to-live) expires. If the switch receives a new hello message before an older cache entry ages, the switch replaces the older entry with the new one. Whenever an interface is disabled and UDLD is running, whenever UDLD is disabled on an interface, or whenever the switch is reset, UDLD clears all existing cache entries for the interfaces affected by the configuration change. UDLD sends at least one message to inform the neighbors to flush the part of their caches affected by the status change. The message is intended to keep the caches synchronized. • Event-driven detection and echoing UDLD relies on echoing as its detection mechanism. Whenever a UDLD device learns about a new neighbor or receives a resynchronization request from an out-of-sync neighbor, it restarts the detection window on its side of the connection and sends echo messages in reply. Because this behavior is the same on all UDLD neighbors, the sender of the echoes expects to receive an echo in reply. If the detection window ends and no valid reply message is received, the link is considered unidirectional, and the interface is disabled. Figure 21-1 shows an example of a unidirectional link condition. Figure 21-1 UDLD Detection of a Unidirectional Link TX TX RX RX Switch A Switch B Switch B successfully receives traffic from Switch A on this port. However, Switch A does not receive traffic from Switch B on the same port. UDLD detects the problem and disables the port. 4358321-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 21 Configuring UDLD Configuring UDLD Configuring UDLD This section describes how to configure UDLD on your switch. It contains this configuration information: • Default UDLD Configuration, page 21-3 • Enabling UDLD Globally, page 21-4 • Enabling UDLD on an Interface, page 21-4 • Resetting an Interface Disabled by UDLD, page 21-5 Default UDLD Configuration Table 21-1 shows the default UDLD configuration. UDLD is not supported on ATM interfaces. A UDLD-capable interface also cannot detect a unidirectional link if it is connected to a UDLD-incapable port of another switch. Table 21-1 Default UDLD Configuration Feature Default Setting UDLD global enable state Globally disabled UDLD per-interface enable state for fiber-optic media Disabled on all Ethernet fiber-optic interfaces UDLD per-interface enable state for twisted-pair (copper) media Disabled on all Ethernet 10/100 and 1000BASE-TX interfaces UDLD aggressive mode Disabled21-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 21 Configuring UDLD Configuring UDLD Enabling UDLD Globally Beginning in privileged EXEC mode, follow these steps to enable UDLD in the aggressive or normal mode and to set the configurable message timer on all fiber-optic interfaces on the switch and all members in the switch stack: To disable UDLD globally, use the no udld enable global configuration command to disable normal mode UDLD on all fiber-optic ports. Use the no udld aggressive global configuration command to disable aggressive mode UDLD on all fiber-optic ports. Enabling UDLD on an Interface Beginning in privileged EXEC mode, follow these steps either to enable UDLD in the aggressive or normal mode or to disable UDLD on an interface: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 udld {aggressive | enable | message time message-timer-interval} Specify the UDLD mode of operation: • aggressive—Enables UDLD in aggressive mode on all fiber-optic interfaces. For details on the usage guidelines for the aggressive mode, refer to the command reference guide. • enable—Enables UDLD in normal mode on all fiber-optic interfaces on the switch. UDLD is disabled by default. An individual interface configuration overrides the setting of the udld enable global configuration command. • message time message-timer-interval—Configures the period of time between UDLD probe messages on ports that are in the advertisement phase and are determined to be bidirectional. The range is from 7 to 90 seconds. Note The global UDLD setting is automatically applied to switches that join the switch stack. Note This command affects fiber-optic interfaces only. Use the udld interface configuration command to enable UDLD on other interface types. For more information, see the “Enabling UDLD on an Interface” section on page 21-4. Step 3 end Return to privileged EXEC mode. Step 4 show udld Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be enabled for UDLD.21-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 21 Configuring UDLD Displaying UDLD Status Resetting an Interface Disabled by UDLD Beginning in privileged EXEC mode, follow these steps to reset all interfaces disabled by UDLD: You can also bring up the interface by using these commands: • The shutdown interface configuration command followed by the no shutdown interface configuration command restarts the disabled interface. • The no udld enable global configuration command followed by the udld enable global configuration command re-enables the disabled interfaces. • The udld port disable interface configuration command followed by the udld port interface configuration command re-enables the disabled fiber-optic interface. Displaying UDLD Status To display the UDLD status for the specified interface or for all interfaces, use the show udld [interface-id] privileged EXEC command. For detailed information about the fields in the display, refer to the command reference for this release. Step 3 udld port {aggressive | disable} UDLD is disabled by default. • udld port—Enables UDLD on the specified interface. • udld port aggressive—Enables UDLD in aggressive mode on the specified interface. For details on the usage guidelines for the aggressive mode, refer to the command reference guide. • udld port disable—Disables UDLD on the specified fiber-optic interface. This command overrides the UDLD global setting and is available only on fiber-optic interfaces. Note When a switch joins a switch stack, it retains its interface-specific UDLD settings. Step 4 end Return to privileged EXEC mode. Step 5 show udld interface-id Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 udld reset Reset all interfaces disabled by UDLD. Step 2 show udld Verify your entries.21-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 21 Configuring UDLD Displaying UDLD StatusC H A P T E R 22-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 22 Configuring SPAN and RSPAN This chapter describes how to configure Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding SPAN and RSPAN, page 22-1 • Configuring SPAN and RSPAN, page 22-10 • Displaying SPAN and RSPAN Status, page 22-24 Understanding SPAN and RSPAN You can analyze network traffic passing through ports or VLANs by using SPAN or RSPAN to send a copy of the traffic to another port on the switch or on another switch that has been connected to a network analyzer or other monitoring or security device. SPAN copies (or mirrors) traffic received or sent (or both) on source ports or source VLANs to a destination port for analysis. SPAN does not affect the switching of network traffic on the source ports or VLANs. You must dedicate the destination port for SPAN use. Except for traffic that is required for the SPAN or RSPAN session, destination ports do not receive or forward traffic. Only traffic that enters or leaves source ports or traffic that enters or leaves source VLANs can be monitored by using SPAN; traffic routed to a source VLAN cannot be monitored. For example, if incoming traffic is being monitored, traffic that gets routed from another VLAN to the source VLAN cannot be monitored; however, traffic that is received on the source VLAN and routed to another VLAN can be monitored. You can use the SPAN or RSPAN destination port to inject traffic from a network security device. For example, if you connect a Cisco Intrusion Detection System (IDS) sensor appliance to a destination port, the IDS device can send TCP reset packets to close down the TCP session of a suspected attacker. 22-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN This section includes these topics: • Local SPAN, page 22-2 • Remote SPAN, page 22-3 • SPAN and RSPAN Concepts and Terminology, page 22-4 • SPAN and RSPAN Interaction with Other Features, page 22-9 • SPAN and RSPAN and Switch Stacks, page 22-10 Local SPAN Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and destination ports reside in the same switch or switch stack. Local SPAN copies traffic from one or more source ports in any VLAN or from one or more VLANs to a destination port for analysis. For example, in Figure 22-1, all traffic on port 5 (the source port) is mirrored to port 10 (the destination port). A network analyzer on port 10 receives all network traffic from port 5 without being physically attached to port 5. Figure 22-1 Example of Local SPAN Configuration on a Single Switch Figure 22-2 is an example of a local SPAN in a switch stack, where the source and destination ports reside on different stack members. 1 2 3 4 5 6 7 8 9 10 11 12 Port 5 traffic mirrored on Port 10 3 2 1 4 5 6 7 8 9 11 12 10 Network analyzer Catalyst 3750 standalone switch 8670222-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Figure 22-2 Example of Local SPAN Configuration on a Switch Stack Remote SPAN RSPAN supports source ports, source VLANs, and destination ports on different switches (or different switch stacks), enabling remote monitoring of multiple switches across your network as shown in Figure 22-3. The traffic for each RSPAN session is carried over a user-specified RSPAN VLAN that is dedicated for that RSPAN session in all participating switches. The RSPAN traffic from the source ports or VLANs is copied into the RSPAN VLAN and forwarded over trunk ports carrying the RSPAN VLAN to a destination session monitoring the RSPAN VLAN. Each RSPAN source switch must have either ports or VLANs as RSPAN sources. The destination is always a physical port. Switch 1 1/0/4 2/0/15 Switch 2 Network analyzer Switch 3 Catalyst 3750 switch stack 86703 Stackwise port connections Port 4 on switch 1 in the stack mirrored on port 15 on switch 2 Port 4 on switch 1 in the stack mirrored on port 15 on switch 2 mirrored on port 15 on switch 222-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Figure 22-3 Example of RSPAN Configuration SPAN and RSPAN Concepts and Terminology This section describes concepts and terminology associated with SPAN and RSPAN configuration. SPAN Sessions SPAN sessions (local or remote) allow you to monitor traffic on one or more ports, or one or more VLANs, and send the monitored traffic to one or more destination ports. A local SPAN session is an association of a destination port with source ports or source VLANs, all on a single network device. Local SPAN does not have separate source and destination sessions. Local SPAN sessions gather a set of ingress and egress packets specified by the user and form them into a stream of SPAN data, which is directed to the destination port. RSPAN consists of at least one RSPAN source session, an RSPAN VLAN, and at least one RSPAN destination session. You separately configure RSPAN source sessions and RSPAN destination sessions on different network devices. To configure an RSPAN source session on a device, you associate a set of source ports or source VLANs with an RSPAN VLAN. The output of this session is the stream of SPAN packets that are sent to the RSPAN VLAN. To configure an RSPAN destination session on another device, you associate the destination port with the RSPAN VLAN. The destination session collects all RSPAN VLAN traffic and sends it out the RSPAN destination port. RSPAN VLAN RSPAN source ports RSPAN source ports RSPAN destination ports RSPAN source session B Intermediate switches must support RSPAN VLAN Catalyst 3750 switch RSPAN destination session Catalyst 3750 switch RSPAN source session A Catalyst 3750 switch 8676622-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN An RSPAN source session is very similar to a local SPAN session, except for where the packet stream is directed. In an RSPAN source session, SPAN packets are relabeled with the RSPAN VLAN ID and directed over normal trunk ports to the destination switch. An RSPAN destination session takes all packets received on the RSPAN VLAN, strips off the VLAN tagging, and presents them on the destination port. Its purpose is to present a copy of all RSPAN VLAN packets (except Layer 2 control packets) to the user for analysis. There can be more than one source session and more than one destination session active in the same RSPAN VLAN. There can also be intermediate switches separating the RSPAN source and destination sessions. These switches need not be capable of running RSPAN, but they must handle the requirements of the RSPAN VLAN (see the “RSPAN VLAN” section on page 22-9). Traffic monitoring in a SPAN session has these restrictions: • Sources can be ports or VLANs, but you cannot mix source ports and source VLANs in the same session. • The switch supports up to two source sessions; you can run both a local SPAN and an RSPAN source session in the same switch stack. The switch stack supports a total of 66 source and RSPAN destination sessions. • You can have multiple destination ports in a SPAN session, but no more than 64 destination ports per switch stack. • You can configure two separate SPAN or RSPAN source sessions with separate or overlapping sets of SPAN source ports and VLANs. Both switched and routed ports can be configured as SPAN sources and destinations. • SPAN sessions do not interfere with the normal operation of the switch. However, an oversubscribed SPAN destination, for example, a 10-Mbps port monitoring a 100-Mbps port, can result in dropped or lost packets. • When RSPAN is enabled, each packet being monitored is transmitted twice, once as normal traffic and once as a monitored packet. Therefore monitoring a large number of ports or VLANs could potentially generate large amounts of network traffic. • You can configure SPAN sessions on disabled ports; however, a SPAN session does not become active unless you enable the destination port and at least one source port or VLAN for that session. • The switch does not support a combination of local SPAN and RSPAN in a single session. That is, an RSPAN source session cannot have a local destination port, an RSPAN destination session cannot have a local source port, and an RSPAN destination session and an RSPAN source session that are using the same RSPAN VLAN cannot run on the same switch stack. Monitored Traffic SPAN sessions can monitor these traffic types: • Receive (Rx) SPAN—The goal of receive (or ingress) SPAN is to monitor as much as possible all the packets received by the source interface or VLAN before any modification or processing is performed by the switch. A copy of each packet received by the source is sent to the destination port for that SPAN session. Packets that are modified because of routing or quality of service (QoS)—for example, modified Differentiated Services Code Point (DSCP)—are copied before modification. Features that can cause a packet to be dropped during receive processing have no effect on ingress SPAN; the destination port receives a copy of the packet even if the actual incoming packet is dropped. These features include IP standard and extended input access control lists (ACLs), ingress QoS policing, VLAN ACLs and egress QoS policing. 22-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN • Transmit (Tx) SPAN—The goal of transmit (or egress) SPAN is to monitor as much as possible all the packets sent by the source interface after all modification and processing is performed by the switch. A copy of each packet sent by the source is sent to the destination port for that SPAN session. The copy is provided after the packet is modified. Packets that are modified because of routing—for example, with modified time-to-live (TTL), MAC-address, or QoS values—are duplicated (with the modifications) at the destination port. Features that can cause a packet to be dropped during transmit processing also affect the duplicated copy for SPAN. These features include IP standard and extended output ACLs and egress QoS policing. • Both—In a SPAN session, you can also monitor a port or VLAN for both received and sent packets. This is the default. The default configuration for local SPAN session ports is to send all packets untagged. SPAN also does not normally monitor bridge protocol data unit (BPDU) packets and Layer 2 protocols, such as Cisco Discovery Protocol (CDP), VLAN Trunk Protocol (VTP), Dynamic Trunking Protocol (DTP), Spanning Tree Protocol (STP), and Port Aggregation Protocol (PAgP). However, when you enter the encapsulation replicate keywords when configuring a destination port, these changes occur: • Packets are sent on the destination port with the same encapsulation—untagged, IEEE 802.1Q, or Inter-Switch Link (ISL)—that they had on the source port. • Packets of all types, including BPDU and Layer 2 protocol packets are monitored. Therefore, a local SPAN session with encapsulation replicate enabled can have a mixture of untagged, 802.1Q, and ISL tagged packets appear on the destination port. Switch congestion can cause packets to be dropped at ingress source ports, egress source ports, or SPAN destination ports. In general, these characteristics are independent of one another. For example: • A packet might be forwarded normally but dropped from monitoring due to an oversubscribed SPAN destination port. • An ingress packet might be dropped from normal forwarding, but still appear on the SPAN destination port. • An egress packet dropped because of switch congestion is also dropped from egress SPAN. In some SPAN configurations, multiple copies of the same source packet are sent to the SPAN destination port. For example, a bidirectional (both Rx and Tx) SPAN session is configured for the Rx monitor on port A and Tx monitor on port B. If a packet enters the switch through port A and is switched to port B, both incoming and outgoing packets are sent to the destination port. Both packets are the same (unless a Layer-3 rewrite occurs, in which case the packets are different because of the packet modification). Source Ports A source port (also called a monitored port) is a switched or routed port that you monitor for network traffic analysis. In a local SPAN session or RSPAN source session, you can monitor source ports or VLANs for traffic in one or both directions. The switch supports any number of source ports (up to the maximum number of available ports on the switch) and any number of source VLANs (up to the maximum number of VLANs supported). However, the switch supports a maximum of two sessions (local or RSPAN) with source ports or VLANs and you cannot mix ports and VLANs in a single session. A source port has these characteristics: • It can be monitored in multiple SPAN sessions. • Each source port can be configured with a direction (ingress, egress, or both) to monitor. 22-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN • It can be any port type (for example, EtherChannel, Fast Ethernet, Gigabit Ethernet, and so forth). • For EtherChannel sources, you can monitor traffic for the entire EtherChannel or individually on a physical port as it participates in the port channel. • It can be an access port, trunk port, routed port, or voice VLAN port. • It cannot be a destination port. • Source ports can be in the same or different VLANs. • You can monitor multiple source ports in a single session. Source VLANs VLAN-based SPAN (VSPAN) is the monitoring of the network traffic in one or more VLANs. The SPAN or RSPAN source interface in VSPAN is a VLAN ID and traffic is monitored on all the ports for that VLAN. VSPAN has these characteristics: • All active ports in the source VLAN are included as source ports and can be monitored in either or both directions. • On a given port, only traffic on the monitored VLAN is sent to the destination port. • If a destination port belongs to a source VLAN, it is excluded from the source list and is not monitored. • If ports are added to or removed from the source VLANs, the traffic on the source VLAN received by those ports is added to or removed from the sources being monitored. • You cannot use filter VLANs in the same session with VLAN sources. • You can monitor only Ethernet VLANs. VLAN Filtering When you monitor a trunk port as a source port, by default, all VLANs active on the trunk are monitored. You can limit SPAN traffic monitoring on trunk source ports to specific VLANs by using VLAN filtering. • VLAN filtering applies only to trunk ports or to voice VLAN ports. • VLAN filtering applies only to port-based sessions and is not allowed in sessions with VLAN sources. • When a VLAN filter list is specified, only those VLANs in the list are monitored on trunk ports or on voice VLAN access ports. • SPAN traffic coming from other port types is not affected by VLAN filtering; that is, all VLANs are allowed on other ports. • VLAN filtering affects only traffic forwarded to the destination SPAN port and does not affect the switching of normal traffic. 22-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Destination Port Each local SPAN session or RSPAN destination session must have a destination port (also called a monitoring port) that receives a copy of traffic from the source ports or VLANs and sends the SPAN packets to the user, usually a network analyzer. A destination port has these characteristics: • For a local SPAN session, the destination port must reside on the same switch stack as the source port. For an RSPAN session, it is located on the switch containing the RSPAN destination session. There is no destination port on a switch or switch stack running only an RSPAN source session. • When a port is configured as a SPAN destination port, the configuration overwrites the original port configuration. When the SPAN destination configuration is removed, the port reverts to its previous configuration. If a configuration change is made to the port while it is acting as a SPAN destination port, the change does not take effect until the SPAN destination configuration had been removed. • If the port was in an EtherChannel group, it is removed from the group while it is a destination port. If it was a routed port, it is no longer a routed port. • It can be any Ethernet physical port. • It cannot be a secure port. • It cannot be a source port. • It cannot be an EtherChannel group or a VLAN. • It can participate in only one SPAN session at a time (a destination port in one SPAN session cannot be a destination port for a second SPAN session). • When it is active, incoming traffic is disabled. The port does not transmit any traffic except that required for the SPAN session. Incoming traffic is never learned or forwarded on a destination port. • If ingress traffic forwarding is enabled for a network security device, the destination port forwards traffic at Layer 2. • It does not participate in any of the Layer 2 protocols (STP, VTP, CDP, DTP, PagP). • A destination port that belongs to a source VLAN of any SPAN session is excluded from the source list and is not monitored. • The maximum number of destination ports in a switch stack is 64. Local SPAN and RSPAN destination ports behave differently regarding VLAN tagging and encapsulation: • For local SPAN, if the encapsulation replicate keywords are specified for the destination port, these packets appear with the original encapsulation (untagged, ISL, or 802.1Q). If these keywords are not specified, packets appear in the untagged format. Therefore, the output of a local SPAN session with encapsulation replicate enabled can contain a mixture of untagged, 802.1Q, or ISL tagged packets. • For RSPAN, the original VLAN ID is lost because it is overwritten by the RSPAN VLAN identification. Therefore, all packets appear on the destination port as untagged. 22-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Understanding SPAN and RSPAN RSPAN VLAN The RSPAN VLAN carries SPAN traffic between RSPAN source and destination sessions. It has these special characteristics: • All traffic in the RSPAN VLAN is always flooded. • No MAC address learning occurs on the RSPAN VLAN. • RSPAN VLAN traffic only flows on trunk ports. • RSPAN VLANs must be configured in VLAN configuration mode by using the remote-span VLAN configuration mode command. • STP can run on RSPAN VLAN trunks but not on SPAN destination ports. For VLANs 1 to 1005 that are visible to VLAN Trunking Protocol (VTP), the VLAN ID and its associated RSPAN characteristic are propagated by VTP. If you assign an RSPAN VLAN ID in the extended VLAN range (1006 to 4094), you must manually configure all intermediate switches. It is normal to have multiple RSPAN VLANs in a network at the same time with each RSPAN VLAN defining a network-wide RSPAN session. That is, multiple RSPAN source sessions anywhere in the network can contribute packets to the RSPAN session. It is also possible to have multiple RSPAN destination sessions throughout the network, monitoring the same RSPAN VLAN and presenting traffic to the user. The RSPAN VLAN ID separates the sessions. SPAN and RSPAN Interaction with Other Features SPAN interacts with these features: • Routing—SPAN does not monitor routed traffic. VSPAN only monitors traffic that enters or exits the switch, not traffic that is routed between VLANs. For example, if a VLAN is being Rx-monitored and the switch routes traffic from another VLAN to the monitored VLAN, that traffic is not monitored and not received on the SPAN destination port. • Spanning Tree Protocol (STP)—A destination port does not participate in STP while its SPAN or RSPAN session is active. The destination port can participate in STP after the SPAN or RSPAN session is disabled. On a source port, SPAN does not affect the STP status. STP can be active on trunk ports carrying an RSPAN VLAN. • Cisco Discovery Protocol (CDP)—A SPAN destination port does not participate in CDP while the SPAN session is active. After the SPAN session is disabled, the port again participates in CDP. • VLAN Trunking Protocol (VTP)—You can use VTP to prune an RSPAN VLAN between switches. • VLAN and trunking—You can modify VLAN membership or trunk settings for source or destination ports at any time. However, changes in VLAN membership or trunk settings for a destination port do not take effect until you remove the SPAN destination configuration. Changes in VLAN membership or trunk settings for a source port immediately take effect, and the respective SPAN sessions automatically adjust accordingly. • EtherChannel—You can configure an EtherChannel group as a source port but not as a SPAN destination port. When a group is configured as a SPAN source, the entire group is monitored. If a physical port is added to a monitored EtherChannel group, the new port is added to the SPAN source port list. If a port is removed from a monitored EtherChannel group, it is automatically removed from the source port list. If the port is the only port in the EtherChannel group, because there are no longer any ports in the group, there is no data to monitor. 22-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN A physical port that belongs to an EtherChannel group can be configured as a SPAN source port and still be a part of the EtherChannel. In this case, data from the physical port is monitored as it participates in the EtherChannel. However, if a physical port that belongs to an EtherChannel group is configured as a SPAN destination, it is removed from the group. After the port is removed from the SPAN session, it rejoins the EtherChannel group. Ports removed from an EtherChannel group remain members of the group, but they are in the inactive or standalone state. If a physical port that belongs to an EtherChannel group is a destination port and the EtherChannel group is a source, the port is removed from the EtherChannel group and from the list of monitored ports. • Multicast traffic can be monitored. For egress and ingress port monitoring, only a single unedited packet is sent to the SPAN destination port. It does not reflect the number of times the multicast packet is sent. • A secure port cannot be a SPAN destination port. For SPAN sessions, do not enable port security on ports with monitored egress when ingress forwarding is enabled on the destination port. For RSPAN source sessions, do not enable port security on any ports with monitored egress. • An 802.1X port can be a SPAN source port. You can enable 802.1X on a port that is a SPAN destination port; however, 802.1X is disabled until the port is removed as a SPAN destination. For SPAN sessions, do not enable 802.1X on ports with monitored egress when ingress forwarding is enabled on the destination port. For RSPAN source sessions, do not enable 802.1X on any ports that are egress monitored. SPAN and RSPAN and Switch Stacks Because the stack of switches is treated as one logical switch, local SPAN source ports and destination ports can be in different switches in the stack. Therefore, the addition or deletion of switches in the stack can affect a local SPAN session, as well as an RSPAN source or destination session. An active session can become inactive when a switch is removed from the stack or an inactive session can become active when a switch is added to the stack. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.” Configuring SPAN and RSPAN This section describes how to configure SPAN on your switch. It contains this configuration information: • Default SPAN and RSPAN Configuration, page 22-11 • Configuring Local SPAN, page 22-11 • Configuring RSPAN, page 22-1722-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN Default SPAN and RSPAN Configuration Table 22-1 shows the default SPAN and RSPAN configuration. Configuring Local SPAN This section describes how to configure Local SPAN on your switch. It contains this configuration information: • SPAN Configuration Guidelines, page 22-11 • Creating a Local SPAN Session, page 22-12 • Creating a Local SPAN Session and Configuring Ingress Traffic, page 22-14 • Specifying VLANs to Filter, page 22-16 SPAN Configuration Guidelines Follow these guidelines when configuring SPAN: • You can configure a total of two local SPAN sessions or RSPAN source sessions on each switch stack. You can have a total of 66 SPAN sessions (local, RSPAN source, and RSPAN destination) on a switch stack. • For SPAN sources, you can monitor traffic for a single port or VLAN or a series or range of ports or VLANs for each session. You cannot mix source ports and source VLANs within a single SPAN session. • The destination port cannot be a source port; a source port cannot be a destination port. • You cannot have two SPAN sessions using the same destination port. • When you configure a switch port as a SPAN destination port, it is no longer a normal switch port; only monitored traffic passes through the SPAN destination port. • Entering SPAN configuration commands does not remove previously configured SPAN parameters. Yo u mu s t en te r th e no monitor session {session_number | all | local | remote} global configuration command to delete configured SPAN parameters. • For local SPAN, outgoing packets through the SPAN destination port carry the original encapsulation headers—untagged, ISL, or IEEE 802.1Q— if the encapsulation replicate keywords are specified. If the keywords are not specified, the packets are sent in native form. For RSPAN destination ports, outgoing packets are not tagged. Table 22-1 Default SPAN and RSPAN Configuration Feature Default Setting SPAN state (SPAN and RSPAN) Disabled. Source port traffic to monitor Both received and sent traffic (both). Encapsulation type (destination port) Native form (untagged packets). Ingress forwarding (destination port) Disabled VLAN filtering On a trunk interface used as a source port, all VLANs are monitored. RSPAN VLANs None configured.22-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN • You can configure a disabled port to be a source or destination port, but the SPAN function does not start until the destination port and at least one source port or source VLAN are enabled. • You can limit SPAN traffic to specific VLANs by using the filter vlan keyword. If a trunk port is being monitored, only traffic on the VLANs specified with this keyword is monitored. By default, all VLANs are monitored on a trunk port. • You cannot mix source VLANs and filter VLANs within a single SPAN session. Creating a Local SPAN Session Beginning in privileged EXEC mode, follow these steps to create a SPAN session and specify the source (monitored) ports or VLANs and the destination (monitoring) ports: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing SPAN configuration for the session. For session_number, the range is from 1 to 66. Specify all to remove all SPAN sessions, local to remove all local sessions, or remote to remove all remote SPAN sessions. Step 3 monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx] Specify the SPAN session and the source port (monitored port). For session_number, the range is from 1 to 66. For interface-id, specify the source port or source VLAN to monitor. • For source interface-id, specify the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Valid port channel numbers are 1 to 12. • For vlan-id, specify the source VLAN to monitor. The range is 1 to 4094 (excluding the RSPAN VLAN). Note A single session can include multiple sources (ports or VLANs), defined in a series of commands, but you cannot combine source ports and source VLANs in one session. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. (Optional) Specify the direction of traffic to monitor. If you do not specify a traffic direction, the SPAN monitors both sent and received traffic. • both—Monitor both received and sent traffic. This is the default. • rx—Monitor received traffic. • tx—Monitor sent traffic. Note You can use the monitor session session_number source command multiple times to configure multiple source ports.22-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN To delete a SPAN session, use the no monitor session session_number global configuration command. To remove a source or destination port or VLAN from the SPAN session, use the no monitor session session_number source {interface interface-id | vlan vlan-id} global configuration command or the no monitor session session_number destination interface interface-id global configuration command. For destination interfaces, the encapsulation replicate keywords are ignored with the no form of the command. This example shows how to set up SPAN session 1, for monitoring source port traffic to a destination port. First, any existing SPAN configuration for session 1 is deleted, and then bidirectional traffic is mirrored from source Gigabit Ethernet port 0/1 to destination Gigabit Ethernet port 0/10 on switch 1, retaining the encapsulation method. Switch(config)# no monitor session 1 Switch(config)# monitor session 1 source interface gigabitethernet1/0/1 Switch(config)# monitor session 1 destination interface gigabitethernet1/0/10 encapsulation replicate Switch(config)# end This example shows how to remove port 0/1 on switch 1 as a SPAN source for SPAN session 1: Switch(config)# no monitor session 1 source interface gigabitethernet1/0/1 Switch(config)# end This example shows how to disable received traffic monitoring on port 0/1 on switch 1, which was configured for bidirectional monitoring: Switch(config)# no monitor session 1 source interface gigabitethernet1/0/1 rx Step 4 monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]} Specify the SPAN session and the destination port (monitoring port). For session_number, specify the session number entered in step 3. Note For local SPAN, you must use the same session number for the source and destination interfaces. For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. (Optional) Enter encapsulation replicate to specify that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged). Note You can use monitor session session_number destination command multiple times to configure multiple destination ports. Step 5 end Return to privileged EXEC mode. Step 6 show monitor [session session_number] show running-config Verify the configuration. Step 7 copy running-config startup-config (Optional) Save the configuration in the configuration file. Command Purpose22-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN The monitoring of traffic received on port 0/1 is disabled, but traffic sent from this port continues to be monitored. This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor received traffic on all ports belonging to VLANs 1 through 3, and send it to destination Gigabit Ethernet port 0/2 on switch 1. The configuration is then modified to also monitor all traffic on all ports belonging to VLAN 10. Switch(config)# no monitor session 2 Switch(config)# monitor session 2 source vlan 1 - 3 rx Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 Switch(config)# monitor session 2 source vlan 10 Switch(config)# end Creating a Local SPAN Session and Configuring Ingress Traffic Beginning in privileged EXEC mode, follow these steps to create a SPAN session, to specify the source ports or VLANs and the destination ports, and to enable ingress traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance). Note Refer to the “Creating a Local SPAN Session” section on page 22-12 for details about the keywords not related to ingress traffic. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing SPAN configuration for the session. Step 3 monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx] Specify the SPAN session and the source port (monitored port). 22-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN To delete a SPAN session, use the no monitor session session_number global configuration command. To remove a source or destination port or VLAN from the SPAN session, use the no monitor session session_number source {interface interface-id | vlan vlan-id} global configuration command or the no monitor session session_number destination interface interface-id global configuration command. For destination interfaces, the encapsulation and ingress options are ignored with the no form of the command. This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor received traffic on all source Gigabit Ethernet source port 0/1 on switch 1, and send it to destination Gigabit Ethernet port 0/2 on switch 1 with the same egress encapsulation type as the source port, and enable ingress forwarding with 802.1Q encapsulation and VLAN 6 as the default ingress VLAN. Switch(config)# no monitor session 2 Switch(config)# monitor session 2 source gigabitethernet1/0/2 rx Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 encapsulation replicate ingress dot1q vlan 6 Switch(config)# end Step 4 monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate] [ingress {dot1q vlan vlan-id | isl | untagged vlan vlan-id | vlan vlan-id}]} Specify the SPAN session, the destination port, the packet encapsulation, and the ingress VLAN and encapsulation. For session_number, specify the session number entered in step 3. For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma or hyphen. (Optional) Enter encapsulation replicate to specify that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged). Enter ingress with keywords to enable ingress traffic forwarding on the destination port and specify the encapsulation type: • dot1q vlan vlan-id—Forward ingress packets with 802.1Q encapsulation with the specified VLAN as the default VLAN. • isl—Forward ingress packets with ISL encapsulation. • untagged vlan vlan-id or vlan vlan-id—Forward ingress packets with untagged encapsulation type with the specified VLAN as the default VLAN. Step 5 end Return to privileged EXEC mode. Step 6 show monitor [session session_number] show running-config Verify the configuration. Step 7 copy running-config startup-config (Optional) Save the configuration in the configuration file. Command Purpose22-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN Specifying VLANs to Filter Beginning in privileged EXEC mode, follow these steps to limit SPAN source traffic to specific VLANs: To monitor all VLANs on the trunk port, use the no monitor session session_number filter global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing SPAN configuration for the session. For session_number, the range is from 1 to 66. Specify all to remove all SPAN sessions, local to remove all local sessions, or remote to remove all remote SPAN sessions. Step 3 monitor session session_number source interface interface-id Specify the characteristics of the source port (monitored port) and SPAN session. For session_number, the range is from 1 to 66. For interface-id, specify the source port to monitor. The interface specified must already be configured as a trunk port. Step 4 monitor session session_number filter vlan vlan-id [, | -] Limit the SPAN source traffic to specific VLANs. For session_number, enter the session number specified in Step 3. For vlan-id, the range is 1 to 4094. (Optional) Use a comma (,) to specify a series of VLANs, or use a hyphen (-) to specify a range of VLANs. Enter a space before and after the comma; enter a space before and after the hyphen. Step 5 monitor session session_number destination {interface interface-id [, | -] [encapsulation replicate]} Specify the SPAN session and the destination port (monitoring port). For session_number, specify the session number entered in step 3. For interface-id, specify the destination port. The destination interface must be a physical port; it cannot be an EtherChannel, and it cannot be a VLAN. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. (Optional) Enter encapsulation replicate to specify that the destination interface replicates the source interface encapsulation method. If not selected, the default is to send packets in native form (untagged). Step 6 end Return to privileged EXEC mode. Step 7 show monitor [session session_number] show running-config Verify the configuration. Step 8 copy running-config startup-config (Optional) Save the configuration in the configuration file.22-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN This example shows how to remove any existing configuration on SPAN session 2, configure SPAN session 2 to monitor traffic received on Gigabit Ethernet trunk port 0/4 on switch 1, and send traffic for only VLANs 1 through 5 and 9 to destination Gigabit Ethernet port 0/8 on switch 1. Switch(config)# no monitor session 2 Switch(config)# monitor session 2 source interface gigabitethernet1/0/4 rx Switch(config)# monitor session 2 filter vlan 1 - 5 , 9 Switch(config)# monitor session 2 destination interface gigabitethernet1/0/8 Switch(config)# end Configuring RSPAN This section describes how to configure RSPAN on your switch. It contains this configuration information: • RSPAN Configuration Guidelines, page 22-17 • Configuring a VLAN as an RSPAN VLAN, page 22-18 • Creating an RSPAN Source Session, page 22-19 • Creating an RSPAN Destination Session, page 22-20 • Creating an RSPAN Destination Session, page 22-20 • Specifying VLANs to Filter, page 22-23 RSPAN Configuration Guidelines Follow these guidelines when configuring RSPAN: • All the items in the “SPAN Configuration Guidelines” section on page 22-11 apply to RSPAN. • As RSPAN VLANs have special properties, you should reserve a few VLANs across your network for use as RSPAN VLANs; do not assign access ports to these VLANs. • You can apply an output access control list (ACL) to RSPAN traffic to selectively filter or monitor specific packets. Specify these ACLs on the RSPAN VLAN in the RSPAN source switches. • For RSPAN configuration, you can distribute the source ports and the destination ports across multiple switches in your network. • RSPAN does not support BPDU packet monitoring or other Layer 2 switch protocols. • The RSPAN VLAN is configured only on trunk ports and not on access ports. To avoid unwanted traffic in RSPAN VLANs, make sure that the VLAN remote-span feature is supported in all the participating switches. • Access ports (including voice VLAN ports) on the RSPAN VLAN are put in the inactive state. • RSPAN VLANs are included as sources for port-based RSPAN sessions when source trunk ports have active RSPAN VLANs. RSPAN VLANs can also be sources in SPAN sessions. However, since the switch does not monitor spanned traffic, it does not support egress spanning of packets on any RSPAN VLAN identified as the destination of an RSPAN source session on the switch. • You can configure any VLAN as an RSPAN VLAN as long as these conditions are met: – The same RSPAN VLAN is used for an RSPAN session in all the switches. – All participating switches support RSPAN.22-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN • We recommend that you configure an RSPAN VLAN before you configure an RSPAN source or a destination session. • If you enable VTP and VTP pruning, RSPAN traffic is pruned in the trunks to prevent the unwanted flooding of RSPAN traffic across the network for VLAN IDs that are lower than 1005. Configuring a VLAN as an RSPAN VLAN First create a new VLAN to be the RSPAN VLAN for the RSPAN session. You must create the RSPAN VLAN in all switches that will participate in RSPAN. If the RSPAN VLAN-ID is in the normal range (lower than 1005) and VTP is enabled in the network, you can create the RSPAN VLAN in one switch, and VTP propagates it to the other switches in the VTP domain. For extended-range VLANs (greater than 1005), you must configure RSPAN VLAN on both source and destination switches and any intermediate switches. Use VTP pruning to get an efficient flow of RSPAN traffic, or manually delete the RSPAN VLAN from all trunks that do not need to carry the RSPAN traffic. Beginning in privileged EXEC mode, follow these steps to create an RSPAN VLAN: To remove the remote SPAN characteristic from a VLAN and convert it back to a normal VLAN, use the no remote-span VLAN configuration command. This example shows how to create RSPAN VLAN 901. Switch(config)# vlan 901 Switch(config-vlan)# remote span Switch(config-vlan)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vlan vlan-id Enter a VLAN ID to create a VLAN, or enter the VLAN ID of an existing VLAN, and enter VLAN configuration mode. The range is from 2 to 1001 and from 1006 to 4094. Note The RSPAN VLAN cannot be VLAN 1 (the default VLAN) or VLAN IDs 1002 through 1005 (reserved for Token Ring and FDDI VLANs). Step 3 remote-span Configure the VLAN as an RSPAN VLAN. Step 4 end Return to privileged EXEC mode. Step 5 copy running-config startup-config (Optional) Save the configuration in the configuration file.22-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN Creating an RSPAN Source Session Beginning in privileged EXEC mode, follow these steps to start an RSPAN source session and to specify the monitored source and the destination RSPAN VLAN: To delete a SPAN session, use the no monitor session session_number global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing RSPAN configuration for the session. For session_number, the range is from 1 to 66. Specify all to remove all RSPAN sessions, local to remove all local sessions, or remote to remove all remote SPAN sessions. Step 3 monitor session session_number source {interface interface-id | vlan vlan-id} [, | -] [both | rx | tx] Specify the RSPAN session and the source port (monitored port). For session_number, the range is from 1 to 66. Enter a source port or source VLAN for the RSPAN session: • For interface-id, specify the source port to monitor. Valid interfaces include physical interfaces and port-channel logical interfaces (port-channel port-channel-number). Valid port channel numbers are 1 to 12. • For vlan-id, specify the source VLAN to monitor. The range is 1 to 4094 (excluding the RSPAN VLAN). Note A single session can include multiple sources (ports or VLANs), defined in a series of commands, but you cannot combine source ports and source VLANs in one session. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. (Optional) Specify the direction of traffic to monitor. If you do not specify a traffic direction, the source interface sends both sent and received traffic. • both—Monitor both received and sent traffic. • rx—Monitor received traffic. • tx—Monitor sent traffic. Step 4 monitor session session_number destination remote vlan vlan-id Specify the RSPAN session and the destination RSPAN VLAN. For session_number, enter the number defined in Step 3. For vlan-id, specify the source RSPAN VLAN to monitor. Step 5 end Return to privileged EXEC mode. Step 6 show monitor [session session_number] show running-config Verify the configuration. Step 7 copy running-config startup-config (Optional) Save the configuration in the configuration file.22-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN To remove a source port or VLAN from the SPAN session, use the no monitor session session_number source {interface interface-id | vlan vlan-id} global configuration command. To remove the RSPAN VLAN from the session, use the no monitor session session_number destination remote vlan vlan-id. This example shows how to remove any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination as RSPAN VLAN 901. Switch(config)# no monitor session 1 Switch(config)# monitor session 1 source interface gigabitethernet1/0/10 tx Switch(config)# monitor session 1 source interface gigabitethernet1/0/2 rx Switch(config)# monitor session 1 source interface gigabitethernet2/0/3 Switch(config)# monitor session 1 source interface port-channel 12 Switch(config)# monitor session 1 destination remote vlan 901 Switch(config)# end Creating an RSPAN Destination Session You configure the RSPAN destination session on a different switch or switch stack; that is, not the switch or switch stack on which the source session was configured. Beginning in privileged EXEC mode, follow these steps to define the RSPAN VLAN on that switch, to create an RSPAN destination session, and to specify the source RSPAN VLAN and the destination port: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vlan vlan-id Enter the VLAN ID of the RSPAN VLAN created from the source switch, and enter VLAN configuration mode. Note If both switches are participating in VTP and the RSPAN VLAN ID is from 2 to 1005, Steps 2 through 4 are not required because the RSPAN VLAN ID is propagated through the VTP network. Step 3 remote-span Identify the VLAN as the RSPAN VLAN. Step 4 exit Return to global configuration mode. Step 5 no monitor session {session_number | all | local | remote} Remove any existing RSPAN configuration for the session. For session_number, the range is from 1 to 66. Specify all to remove all RSPAN sessions, local to remove all local sessions, or remote to remove all remote SPAN sessions. Step 6 monitor session session_number source remote vlan vlan-id Specify the RSPAN session and the source RSPAN VLAN. For session_number, the range is from 1 to 66. For vlan-id, specify the source RSPAN VLAN to monitor.22-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN To delete a SPAN session, use the no monitor session session_number global configuration command. To remove a destination port from the SPAN session, use the no monitor session session_number destination interface interface-id global configuration command. To remove the RSPAN VLAN from the session, use the no monitor session session_number source remote vlan vlan-id. This example shows how to configure VLAN 901 as the source remote VLAN and port 0/5 on switch 2 as the destination interface: Switch(config)# monitor session 1 source remote vlan 901 Switch(config)# monitor session 1 destination interface gigabitethernet2/0/5 Switch(config)# end Creating an RSPAN Destination Session and Configuring Ingress Traffic Beginning in privileged EXEC mode, follow these steps to create an RSPAN destination session, to specify the source RSPAN VLAN and the destination port, and to enable ingress traffic on the destination port for a network security device (such as a Cisco IDS Sensor Appliance). Note Refer to the “Creating an RSPAN Destination Session” section on page 22-20 for details about the keywords not related to ingress traffic. This procedure assumes the RSPAN VLAN has already been configured. Step 7 monitor session session_number destination interface interface-id Specify the RSPAN session and the destination interface. For session_number, enter the number defined in Step 6. Note In an RSPAN destination session, you must use the same session number for the source RSPAN VLAN and the destination port. For interface-id, specify the destination interface. The destination interface must be a physical interface. Note Though visible in the command-line help string, encapsulation replicate is not supported for RSPAN. The original VLAN ID is overwritten by the RSPAN VLAN ID, and all packets appear on the destination port as untagged. Step 8 end Return to privileged EXEC mode. Step 9 show monitor [session session_number] show running-config Verify the configuration. Step 10 copy running-config startup-config (Optional) Save the configuration in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing SPAN configuration for the session.22-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN To delete an RSPAN session, use the no monitor session session_number global configuration command. To remove a destination port from the RSPAN session, use the no monitor session session_number destination interface interface-id global configuration command. The ingress options are ignored with the no form of the command. This example shows how to configure VLAN 901 as the source remote VLAN in RSPAN session 2, to configure Gigabit Ethernet source port 0/2 on switch 1 as the destination interface, and to enable ingress forwarding on the interface with VLAN 6 as the default ingress VLAN. Switch(config)# monitor session 2 source remote vlan 901 Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6 Switch(config)# end Step 3 monitor session session_number source remote vlan vlan-id Specify the RSPAN session and the source RSPAN VLAN. For session_number, the range is from 1 to 66. For vlan-id, specify the source RSPAN VLAN to monitor. Step 4 monitor session session_number destination {interface interface-id [, | -] [ingress {dot1q vlan vlan-id | isl | untagged vlan vlan-id | vlan vlan-id}]} Specify the SPAN session, the destination port, the packet encapsulation, and the ingress VLAN and encapsulation. For session_number, enter the number defined in Step 4. Note In an RSPAN destination session, you must use the same session number for the source RSPAN VLAN and the destination port. For interface-id, specify the destination interface. The destination interface must be a physical interface. Note Though visible in the command-line help string, encapsulation replicate is not supported for RSPAN. The original VLAN ID is overwritten by the RSPAN VLAN ID, and all packets appear on the destination port as untagged. (Optional) [, | -] Specify a series or range of interfaces. Enter a space before and after the comma; enter a space before and after the hyphen. Enter ingress with additional keywords to enable ingress traffic forwarding on the destination port and to specify the encapsulation type: • dot1q vlan vlan-id—Forward ingress packets with 802.1Q encapsulation with the specified VLAN as the default VLAN. • isl—Forward ingress packets with ISL encapsulation. • untagged vlan vlan-id or vlan vlan-id—Forward ingress packets with untagged encapsulation type with the specified VLAN as the default VLAN. Step 5 end Return to privileged EXEC mode. Step 6 show monitor [session session_number] show running-config Verify the configuration. Step 7 copy running-config startup-config (Optional) Save the configuration in the configuration file. Command Purpose22-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Configuring SPAN and RSPAN Specifying VLANs to Filter Beginning in privileged EXEC mode, follow these steps to configure the RSPAN source session to limit RSPAN source traffic to specific VLANs: To monitor all VLANs on the trunk port, use the no monitor session session_number filter vlan global configuration command. This example shows how to remove any existing configuration on RSPAN session 2, configure RSPAN session 2 to monitor traffic received on trunk port 0/4 on switch 1, and send traffic for only VLANs 1 through 5 and 9 to destination RSPAN VLAN 902. Switch(config)# no monitor session 2 Switch(config)# monitor session 2 source interface gigabitethernet1/0/4 rx Switch(config)# monitor session 2 filter vlan 1 - 5 , 9 Switch(config)# monitor session 2 destination remote vlan 902 Switch(config)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no monitor session {session_number | all | local | remote} Remove any existing SPAN configuration for the session. For session_number, the range is from 1 to 66. Specify all to remove all SPAN sessions, local to remove all local sessions, or remote to remove all remote SPAN sessions. Step 3 monitor session session_number source interface interface-id Specify the characteristics of the source port (monitored port) and SPAN session. For session_number, the range is from 1 to 66. For interface-id, specify the source port to monitor. The interface specified must already be configured as a trunk port. Step 4 monitor session session_number filter vlan vlan-id [, | -] Limit the SPAN source traffic to specific VLANs. For session_number, enter the session number specified in step 3. For vlan-id, the range is 1 to 4094. (Optional) Use a comma (,) to specify a series of VLANs or use a hyphen (-) to specify a range of VLANs. Enter a space before and after the comma; enter a space before and after the hyphen. Step 5 monitor session session_number destination remote vlan vlan-id Specify the RSPAN session and the destination remote VLAN (RSPAN VLAN). For session_number, enter the session number specified in step 3. For vlan-id, specify the RSPAN VLAN to carry the monitored traffic to the destination port. Step 6 end Return to privileged EXEC mode. Step 7 show monitor [session session_number] show running-config Verify the configuration. Step 8 copy running-config startup-config (Optional) Save the configuration in the configuration file.22-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Displaying SPAN and RSPAN Status Displaying SPAN and RSPAN Status To display the current SPAN or RSPAN configuration, use the show monitor user EXEC command. You can also use the show running-config privileged EXEC command to display configured SPAN or RSPAN sessions. This is an example of output for a switch with two source sessions configured: Switch# show monitor Session 1 --------- Type :Local Session Source Ports: RX Only: Fa4/0/24 TX Only: None Both: Fa2/0/1-2,Fa4/0/1-5 Source VLANs: RX Only: None TX Only: None Both: None Source RSPAN VLAN:None Destination Ports:Fa2/0/18 Encapsulation:Replicate Filter VLANs: None Dest RSPAN VLAN: None Session 2 --------- Type :Remote Source Session Source Ports: RX Only: None TX Only: None Both: None Source VLANs: RX Only: None TX Only: 10 Both: 1-9 Source RSPAN VLAN:None Destination Ports:None Filter VLANs: None Dest RSPAN VLAN: 10522-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Displaying SPAN and RSPAN Status This is an example of output for the show monitor session all user EXEC command when ingress traffic forwarding is enabled: Switch# show monitor session all Session 1 --------- Type :Local Session Source Ports : Both :Fa1/0/2 Destination Ports :Fa2/0/2 Encapsulation :Replicate Ingress:Enabled, default VLAN = 5 Ingress encapsulation:DOT1Q Session 2 --------- Type :Local Session Source Ports : Both :Fa3/0/2 Destination Ports :Fa3/0/4 Encapsulation :Replicate Ingress:Enabled Ingress encapsulation:ISL This is an example of the configuration and output for the show running-config privileged EXEC command when ingress traffic forwarding is enabled. SPAN and RSPAN sessions are displayed near the end of the output. Switch(config)# monitor session 2 source remote vlan 901 Switch(config)# monitor session 2 destination interface gigabitethernet1/0/2 ingress vlan 6 Switch(config)# end Switch# show running-config Building configuration... Current configuration : 8238 bytes ! version 12.1 no service pad service timestamps debug uptime service timestamps log datetime no service password-encryption service sequence-numbers

! ! monitor session 2 destination interface gi1/0/2 ingress vlan 6 end22-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 22 Configuring SPAN and RSPAN Displaying SPAN and RSPAN StatusC H A P T E R 23-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 23 Configuring RMON This chapter describes how to configure Remote Network Monitoring (RMON) on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. RMON is a standard monitoring specification that defines a set of statistics and functions that can be exchanged between RMON-compliant console systems and network probes. RMON provides you with comprehensive network-fault diagnosis, planning, and performance-tuning information. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This chapter consists of these sections: • Understanding RMON, page 23-1 • Configuring RMON, page 23-2 • Displaying RMON Status, page 23-6 Understanding RMON RMON is an Internet Engineering Task Force (IETF) standard monitoring specification that allows various network agents and console systems to exchange network monitoring data. You can use the RMON feature with the Simple Network Management Protocol (SNMP) agent in the switch to monitor all the traffic flowing among switches on all connected LAN segments. 23-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 23 Configuring RMON Configuring RMON Figure 23-1 Remote Monitoring Example The switch supports these RMON groups (defined in RFC 1757): • Statistics (RMON group 1)—Collects Ethernet, Fast Ethernet, and Gigabit Ethernet statistics on an interface. • History (RMON group 2)—Collects a history group of statistics on Ethernet, Fast Ethernet, and Gigabit Ethernet interfaces for a specified polling interval. • Alarm (RMON group 3)—Monitors a specific management information base (MIB) object for a specified interval, triggers an alarm at a specified value (rising threshold), and resets the alarm at another value (falling threshold). Alarms can be used with events; the alarm triggers an event, which can generate a log entry or an SNMP trap. • Event (RMON group 9)—Determines the action to take when an event is triggered by an alarm. The action can be to generate a log entry or an SNMP trap. Because switches supported by this software release use hardware counters for RMON data processing, the monitoring is more efficient, and little processing power is required. Configuring RMON These sections describe how to configure RMON on your switch: • Default RMON Configuration, page 23-3 • Configuring RMON Alarms and Events, page 23-3 (required) • Collecting Group History Statistics on an Interface, page 23-5 (optional) • Collecting Group Ethernet Statistics on an Interface, page 23-6 (optional) Catalyst 3750 switch RMON alarms and events configured. SNMP configured. Catalyst 2950 switch RMON history and statistic collection enabled. Workstations 86471 Catalyst 3550 switch Workstations Network management station with generic RMON console application23-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 23 Configuring RMON Configuring RMON Default RMON Configuration RMON is disabled by default; no alarms or events are configured. Only RMON 1 is supported on the switch. Configuring RMON Alarms and Events You can configure your switch for RMON by using the command-line interface (CLI) or an SNMP-compatible network management station. We recommend that you use a generic RMON console application on the network management station (NMS) to take advantage of RMON’s network management capabilities. You must also configure SNMP on the switch to access RMON MIB objects. For more information, see Chapter 25, “Configuring SNMP.” Beginning in privileged EXEC mode, follow these steps to enable RMON alarms and events. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 rmon alarm number variable interval {absolute | delta} rising-threshold value [event-number] falling-threshold value [event-number] [owner string] Set an alarm on a MIB object. • For number, specify the alarm number. The range is 1 to 65535. • For variable, specify the MIB object to monitor. • For interval, specify the time in seconds the alarm monitors the MIB variable. The range is 1 to 4294967295 seconds. • Specify the absolute keyword to test each MIB variable directly. Specify the delta keyword to test the change between samples of a MIB variable. • For value, specify a number at which the alarm is triggered and one for when the alarm is reset. The range for the rising threshold and falling threshold values is -2147483648 to 2147483647. • (Optional) For event-number, specify the event number to trigger when the rising or falling threshold exceeds its limit. • (Optional) For owner string, specify the owner of the alarm.23-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 23 Configuring RMON Configuring RMON To disable an alarm, use the no rmon alarm number global configuration command on each alarm you configured. You cannot disable at once all the alarms that you configured. To disable an event, use the no rmon event number global configuration command. To learn more about alarms and events and how they interact with each other, refer to RFC 1757. You can set an alarm on any MIB object. The following example configures RMON alarm number 10 by using the rmon alarm command. The alarm monitors the MIB variable ifEntry.20.1 once every 20 seconds until the alarm is disabled and checks the change in the variable’s rise or fall. If the ifEntry.20.1 value shows a MIB counter increase of 15 or more, such as from 100000 to 100015, the alarm is triggered. The alarm in turn triggers event number 1, which is configured with the rmon event command. Possible events can include a log entry or an SNMP trap. If the ifEntry.20.1 value changes by 0, the alarm is reset and can be triggered again. Switch(config)# rmon alarm 10 ifEntry.20.1 20 delta rising-threshold 15 1 falling-threshold 0 owner jjohnson The following example creates RMON event number 1 by using the rmon event command. The event is defined as High ifOutErrors and generates a log entry when the event is triggered by the alarm. The user jjones owns the row that is created in the event table by this command. This example also generates an SNMP trap when the event is triggered. Switch(config)# rmon event 1 log trap eventtrap description "High ifOutErrors" owner jjones Step 3 rmon event number [description string] [log] [owner string] [trap community] Add an event in the RMON event table that is associated with an RMON event number. • For number, assign an event number. The range is 1 to 65535. • (Optional) For description string, specify a description of the event. • (Optional) Use the log keyword to generate an RMON log entry when the event is triggered. • (Optional) For owner string, specify the owner of this event. • (Optional) For trap community, enter the SNMP community string used for this trap. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose23-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 23 Configuring RMON Configuring RMON Collecting Group History Statistics on an Interface You must first configure RMON alarms and events to display collection information. Beginning in privileged EXEC mode, follow these steps to collect group history statistics on an interface. This procedure is optional. To disable history collection, use the no rmon collection history index interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface on which to collect history. Step 3 rmon collection history index [buckets bucket-number] [interval seconds] [owner ownername] Enable history collection for the specified number of buckets and time period. • For index, identify the RMON group of statistics The range is 1 to 65535. • (Optional) For buckets bucket-number, specify the maximum number of buckets desired for the RMON collection history group of statistics. The range is 1 to 65535. The default is 50 buckets. • (Optional) For interval seconds, specify the number of seconds in each polling cycle. The range is 1 to 3600. The default is 1800 seconds. • (Optional) For owner ownername, enter the name of the owner of the RMON group of statistics. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 show rmon history Display the contents of the switch history table. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.23-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 23 Configuring RMON Displaying RMON Status Collecting Group Ethernet Statistics on an Interface Beginning in privileged EXEC mode, follow these steps to collect group Ethernet statistics on an interface. This procedure is optional. To disable the collection of group Ethernet statistics, use the no rmon collection stats index interface configuration command. This example shows how to collect RMON statistics for the owner root on Gigabit Ethernet interface 0/1 of stack member 2: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# rmon collection stats 2 owner root Displaying RMON Status To display the RMON status, use one or more of the privileged EXEC commands in Table 23-1: For information about the fields in these displays, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface on which to collect statistics. Step 3 rmon collection stats index [owner ownername] Enable RMON statistic collection on the interface. • For index, specify the RMON group of statistics. The range is from 1 to 65535. • (Optional) For owner ownername, enter the name of the owner of the RMON group of statistics. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 show rmon statistics Display the contents of the switch statistics table. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Table 23-1 Commands for Displaying RMON Status Command Purpose show rmon Displays general RMON statistics. show rmon alarms Displays the RMON alarm table. show rmon events Displays the RMON event table. show rmon history Displays the RMON history table. show rmon statistics Displays the RMON statistics table.C H A P T E R 24-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 24 Configuring System Message Logging This chapter describes how to configure system message logging on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This chapter consists of these sections: • Understanding System Message Logging, page 24-1 • Configuring System Message Logging, page 24-2 • Displaying the Logging Configuration, page 24-13 Understanding System Message Logging By default, a switch sends the output from system messages and debug privileged EXEC commands to a logging process. Stack members can trigger system messages. A stack member that generates a system message appends its hostname in the form of hostname-n, where n is a switch number from 1 to 9, and redirects the output to the logging process on the stack master. Though the stack master is a stack member, it does not append its hostname to system messages. The logging process controls the distribution of logging messages to various destinations, such as the logging buffer, terminal lines, or a UNIX syslog server, depending on your configuration. The process also sends messages to the console. Note The syslog format is compatible with 4.3 BSD UNIX. When the logging process is disabled, messages are sent only to the console. The messages are sent as they are generated, so message and debug output are interspersed with prompts or output from other commands. Messages are displayed on the active consoles after the process that generated them has finished. You can set the severity level of the messages to control the type of messages displayed on the consoles and each of the destinations. You can timestamp log messages or set the syslog source address to enhance real-time debugging and management. For information on possible messages, refer to the system message guide for this release.24-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging You can access logged system messages by using the switch command-line interface (CLI) or by saving them to a properly configured syslog server. The switch software saves syslog messages in an internal buffer on a standalone switch, and in the case of a switch stack, on the stack master. If a standalone switch or the stack master fails, the log is lost unless you had saved it to Flash memory. You can remotely monitor system messages by viewing the logs on a syslog server or by accessing the switch through Telnet or through the console port. In a switch stack, all stack member consoles provide the same console output. Configuring System Message Logging These sections describe how to configure system message logging: • System Log Message Format, page 24-2 • Default System Message Logging Configuration, page 24-4 • Disabling Message Logging, page 24-4 (optional) • Setting the Message Display Destination Device, page 24-5 (optional) • Synchronizing Log Messages, page 24-6 (optional) • Enabling and Disabling Timestamps on Log Messages, page 24-8 (optional) • Enabling and Disabling Sequence Numbers in Log Messages, page 24-8 (optional) • Defining the Message Severity Level, page 24-9 (optional) • Limiting Syslog Messages Sent to the History Table and to SNMP, page 24-10 (optional) • Configuring UNIX Syslog Servers, page 24-11 (optional) System Log Message Format System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or timestamp information, if configured. Messages are displayed in this format: seq no:timestamp: %facility-severity-MNEMONIC:description (hostname-n) The part of the message preceding the percent sign depends on the setting of the service sequence-numbers, service timestamps log datetime, service timestamps log datetime [localtime] [msec] [show-timezone], or service timestamps log uptime global configuration command.24-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Table 24-1 describes the elements of syslog messages. This example shows a partial switch system message for a stack master and a stack member (hostname Switch-2): 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to up 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down 2 *Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) 18:47:02: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) *Mar 1 18:48:50.483 UTC: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up (Switch-2) 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/1, changed state to up (Switch-2) 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/2, changed state to up (Switch-2) 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down (Switch-2) 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/1, changed state to down 2 (Switch-2) Table 24-1 System Log Message Elements Element Description seq no: Stamps log messages with a sequence number only if the service sequence-numbers global configuration command is configured. For more information, see the “Enabling and Disabling Sequence Numbers in Log Messages” section on page 24-8. timestamp formats: mm/dd hh:mm:ss or hh:mm:ss (short uptime) or d h (long uptime) Date and time of the message or event. This information appears only if the service timestamps log [datetime | log] global configuration command is configured. For more information, see the “Enabling and Disabling Timestamps on Log Messages” section on page 24-8. facility The facility to which the message refers (for example, SNMP, SYS, and so forth). For a list of supported facilities, see Table 24-4 on page 24-13. severity Single-digit code from 0 to 7 that is the severity of the message. For a description of the severity levels, see Table 24-3 on page 24-10. MNEMONIC Text string that uniquely describes the message. description Text string containing detailed information about the event being reported. hostname-n Host name of a stack member and its switch number in the stack. Though the stack master is a stack member, it does not append its hostname to system messages.24-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Default System Message Logging Configuration Table 24-2 shows the default system message logging configuration. Disabling Message Logging Message logging is enabled by default. It must be enabled to send messages to any destination other than the console. When enabled, log messages are sent to a logging process, which logs messages to designated locations asynchronously to the processes that generated the messages. Beginning in privileged EXEC mode, follow these steps to disable message logging. This procedure is optional. Disabling the logging process can slow down the switch because a process must wait until the messages are written to the console before continuing. When the logging process is disabled, messages are displayed on the console as soon as they are produced, often appearing in the middle of command output. Table 24-2 Default System Message Logging Configuration Feature Default Setting System message logging to the console Enabled. Console severity Debugging (and numerically lower levels; see Table 24-3 on page 24-10). Logging file configuration No filename specified. Logging buffer size 4096 bytes. Logging history size 1 message. Timestamps Disabled. Synchronous logging Disabled. Logging server Disabled. Syslog server IP address None configured. Server facility Local7 (see Table 24-4 on page 24-13). Server severity Informational (and numerically lower levels; see Table 24-3 on page 24-10). Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no logging on Disable message logging. Step 3 end Return to privileged EXEC mode. Step 4 show running-config or show logging Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.24-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging The logging synchronous global configuration command also affects the display of messages to the console. When this command is enabled, messages appear only after you press Return. For more information, see the “Synchronizing Log Messages” section on page 24-6. To re-enable message logging after it has been disabled, use the logging on global configuration command. Setting the Message Display Destination Device If message logging is enabled, you can send messages to specific locations in addition to the console. Beginning in privileged EXEC mode, use one or more of the following commands to specify the locations that receive messages. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 logging buffered [size] Log messages to an internal buffer on a standalone switch or, in the case of a switch stack, on the stack master. The default buffer size is 4096. The range is 4096 to 2147483647 bytes. If the standalone switch or the stack master fails, the log file is lost unless you previously saved it to Flash memory. See Step 4. Note Do not make the buffer size too large because the switch could run out of memory for other tasks. Use the show memory privileged EXEC command to view the free processor memory on the switch. However, this value is the maximum available, and the buffer size should not be set to this amount. Step 3 logging host Log messages to a UNIX syslog server host. For host, specify the name or IP address of the host to be used as the syslog server. To build a list of syslog servers that receive logging messages, enter this command more than once. For complete syslog server configuration steps, see the “Configuring UNIX Syslog Servers” section on page 24-11. Step 4 logging file flash:filename [max-file-size [min-file-size]] [severity-level-number | type] Store log messages in a file in Flash memory on a standalone switch or, in the case of a switch stack, on the stack master. • For filename, enter the log message filename. • (Optional) For max-file-size, specify the maximum logging file size. The range is 4096 to 2147483647. The default is 4096 bytes. • (Optional) For min-file-size, specify the minimum logging file size. The range is 1024 to 2147483647. The default is 2048 bytes. • (Optional) For severity-level-number | type, specify either the logging severity level or the logging type. The severity range is 0 to 7. For a list of logging type keywords, see Table 24-3 on page 24-10. By default, the log file receives debugging messages and numerically lower levels. Step 5 end Return to privileged EXEC mode.24-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging The logging buffered global configuration command copies logging messages to an internal buffer. The buffer is circular, so newer messages overwrite older messages after the buffer is full. To display the messages that are logged in the buffer, use the show logging privileged EXEC command. The first message displayed is the oldest message in the buffer. To clear the contents of the buffer, use the clear logging privileged EXEC command. To disable logging to the console, use the no logging console global configuration command. To disable logging to a file, use the no logging file [severity-level-number | type] global configuration command. Synchronizing Log Messages You can synchronize unsolicited messages and debug privileged EXEC command output with solicited device output and prompts for a specific console port line or virtual terminal line. You can identify the types of messages to be output asynchronously based on the level of severity. You can also determine the maximum number of buffers for storing asynchronous messages for the terminal after which messages are dropped. When synchronous logging of unsolicited messages and debug command output is enabled, unsolicited device output is displayed on the console or printed after solicited device output is displayed or printed. Unsolicited messages and debug command output is displayed on the console after the prompt for user input is returned. Therefore, unsolicited messages and debug command output are not interspersed with solicited device output and prompts. After the unsolicited messages are displayed, the console again displays the user prompt. Beginning in privileged EXEC mode, follow these steps to configure synchronous logging. This procedure is optional. Step 6 terminal monitor Log messages to a nonconsole terminal during the current session. Terminal parameter-setting commands are set locally and do not remain in effect after the session has ended. You must perform this step for each session to see the debugging messages. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose24-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging To disable synchronization of unsolicited messages and debug output, use the no logging synchronous [level severity-level | all] [limit number-of-buffers] line configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 line [console | vty] line-number [ending-line-number] Specify the line to be configured for synchronous logging of messages. • Use the console keyword for configurations that occur through the switch console port. • Use the line vty line-number command to specify which vty lines are to have synchronous logging enabled. You use a vty connection for configurations that occur through a Telnet session. The range of line numbers is from 0 to 15. You can change the setting of all 16 vty lines at once by entering: line vty 0 15 Or you can change the setting of the single vty line being used for your current connection. For example, to change the setting for vty line 2, enter: line vty 2 When you enter this command, the mode changes to line configuration. Step 3 logging synchronous [level [severity-level | all] | limit number-of-buffers] Enable synchronous logging of messages. • (Optional) For level severity-level, specify the message severity level. Messages with a severity level equal to or higher than this value are printed asynchronously. Low numbers mean greater severity and high numbers mean lesser severity. The default is 2. • (Optional) Specifying level all means that all messages are printed asynchronously regardless of the severity level. • (Optional) For limit number-of-buffers, specify the number of buffers to be queued for the terminal after which new messages are dropped. The range is 0 to 2147483647. The default is 20. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.24-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Enabling and Disabling Timestamps on Log Messages By default, log messages are not timestamped. Beginning in privileged EXEC mode, follow these steps to enable timestamping of log messages. This procedure is optional. To disable timestamps for both debug and log messages, use the no service timestamps global configuration command. This example shows part of a logging display with the service timestamps log datetime global configuration command enabled: *Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) (Switch-2) This example shows part of a logging display with the service timestamps log uptime global configuration command enabled: 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up (Switch-2) Enabling and Disabling Sequence Numbers in Log Messages Because there is a chance that more than one log message can have the same timestamp, you can display messages with sequence numbers so that you can unambiguously refer to a single message. By default, sequence numbers in log messages are not displayed. Beginning in privileged EXEC mode, follow these steps to enable sequence numbers in log messages. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 service timestamps log uptime or service timestamps log datetime [msec] [localtime] [show-timezone] Enable log timestamps. The first command enables timestamps on log messages, showing the time since the system was rebooted. The second command enables timestamps on log messages. Depending on the options selected, the timestamp can include the date, time in milliseconds relative to the local time zone, and the time zone name. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 service sequence-numbers Enable sequence numbers. Step 3 end Return to privileged EXEC mode.24-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging To disable sequence numbers, use the no service sequence-numbers global configuration command. This example shows part of a logging display with sequence numbers enabled: 000019: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) (Switch-2) Defining the Message Severity Level You can limit messages displayed to the selected device by specifying the severity level of the message, which are described in Table 24-3. Beginning in privileged EXEC mode, follow these steps to define the message severity level. This procedure is optional. Note Specifying a level causes messages at that level and numerically lower levels to be displayed at the destination. To disable logging to the console, use the no logging console global configuration command. To disable logging to a terminal other than the console, use the no logging monitor global configuration command. To disable logging to syslog servers, use the no logging trap global configuration command. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 logging console level Limit messages logged to the console. By default, the console receives debugging messages and numerically lower levels (see Table 24-3 on page 24-10). Step 3 logging monitor level Limit messages logged to the terminal lines. By default, the terminal receives debugging messages and numerically lower levels (see Table 24-3 on page 24-10). Step 4 logging trap level Limit messages logged to the syslog servers. By default, syslog servers receive informational messages and numerically lower levels (see Table 24-3 on page 24-10). For complete syslog server configuration steps, see the “Configuring UNIX Syslog Servers” section on page 24-11. Step 5 end Return to privileged EXEC mode. Step 6 show running-config or show logging Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.24-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Table 24-3 describes the level keywords. It also lists the corresponding UNIX syslog definitions from the most severe level to the least severe level. The software generates four other categories of messages: • Error messages about software or hardware malfunctions, displayed at levels warnings through emergencies. These types of messages mean that the functionality of the switch is affected. For information on how to recover from these malfunctions, refer to the system message guide for this release. • Output from the debug commands, displayed at the debugging level. Debug commands are typically used only by the Technical Assistance Center. • Interface up or down transitions and system restart messages, displayed at the notifications level. This message is only for information; switch functionality is not affected. • Reload requests and low-process stack messages, displayed at the informational level. This message is only for information; switch functionality is not affected. Limiting Syslog Messages Sent to the History Table and to SNMP If you enabled syslog message traps to be sent to an SNMP network management station by using the snmp-server enable trap global configuration command, you can change the level of messages sent and stored in the switch history table. You also can change the number of messages that are stored in the history table. Messages are stored in the history table because SNMP traps are not guaranteed to reach their destination. By default, one message of the level warning and numerically lower levels (see Table 24-3 on page 24-10) are stored in the history table even if syslog traps are not enabled. Table 24-3 Message Logging Level Keywords Level Keyword Level Description Syslog Definition emergencies 0 System unstable LOG_EMERG alerts 1 Immediate action needed LOG_ALERT critical 2 Critical conditions LOG_CRIT errors 3 Error conditions LOG_ERR warnings 4 Warning conditions LOG_WARNING notifications 5 Normal but significant condition LOG_NOTICE informational 6 Informational messages only LOG_INFO debugging 7 Debugging messages LOG_DEBUG24-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Beginning in privileged EXEC mode, follow these steps to change the level and history table size defaults. This procedure is optional. When the history table is full (it contains the maximum number of message entries specified with the logging history size global configuration command), the oldest message entry is deleted from the table to allow the new message entry to be stored. To return the logging of syslog messages to the default level, use the no logging history global configuration command. To return the number of messages in the history table to the default value, use the no logging history size global configuration command. Configuring UNIX Syslog Servers The next sections describe how to configure the UNIX server syslog daemon and how to define the UNIX system logging facility. Logging Messages to a UNIX Syslog Daemon Before you can send system log messages to a UNIX syslog server, you must configure the syslog daemon on a UNIX server. This procedure is optional. Log in as root, and perform these steps: Note Some recent versions of UNIX syslog daemons no longer accept by default syslog packets from the network. If this is the case with your system, use the UNIX man syslogd command to determine what options must be added to or removed from the syslog command line to enable logging of remote syslog messages. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 logging history level 1 1. Table 24-3 lists the level keywords and severity level. For SNMP usage, the severity level values increase by 1. For example, emergencies equal 1, not 0, and critical equals 3, not 2. Change the default level of syslog messages stored in the history file and sent to the SNMP server. See Table 24-3 on page 24-10 for a list of level keywords. By default, warnings, errors, critical, alerts, and emergencies messages are sent. Step 3 logging history size number Specify the number of syslog messages that can be stored in the history table. The default is to store one message. The range is 0 to 500 messages. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.24-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Configuring System Message Logging Step 1 Add a line such as the following to the file /etc/syslog.conf: local7.debug /usr/adm/logs/cisco.log The local7 keyword specifies the logging facility to be used; see Table 24-4 on page 24-13 for information on the facilities. The debug keyword specifies the syslog level; see Table 24-3 on page 24-10 for information on the severity levels. The syslog daemon sends messages at this level or at a more severe level to the file specified in the next field. The file must already exist, and the syslog daemon must have permission to write to it. Step 2 Create the log file by entering these commands at the UNIX shell prompt: $ touch /var/log/cisco.log $ chmod 666 /var/log/cisco.log Step 3 Make sure the syslog daemon reads the new changes: $ kill -HUP `cat /etc/syslog.pid` For more information, see the man syslog.conf and man syslogd commands on your UNIX system. Configuring the UNIX System Logging Facility When sending system log messages to an external device, you can cause the switch to identify its messages as originating from any of the UNIX syslog facilities. Beginning in privileged EXEC mode, follow these steps to configure UNIX system facility message logging. This procedure is optional. To remove a syslog server, use the no logging host global configuration command, and specify the syslog server IP address. To disable logging to syslog servers, enter the no logging trap global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 logging host Log messages to a UNIX syslog server host by entering its IP address. To build a list of syslog servers that receive logging messages, enter this command more than once. Step 3 logging trap level Limit messages logged to the syslog servers. Be default, syslog servers receive informational messages and lower. See Table 24-3 on page 24-10 for level keywords. Step 4 logging facility facility-type Configure the syslog facility. See Table 24-4 on page 24-13 for facility-type keywords. The default is local7. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.24-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Displaying the Logging Configuration Table 24-4 lists the UNIX system facilities supported by the software. For more information about these facilities, consult the operator’s manual for your UNIX operating system. Displaying the Logging Configuration To display the logging configuration and the contents of the log buffer, use the show logging privileged EXEC command. For information about the fields in this display, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. Table 24-4 Logging Facility-Type Keywords Facility Type Keyword Description auth Authorization system cron Cron facility daemon System daemon kern Kernel local0-7 Locally defined messages lpr Line printer system mail Mail system news USENET news sys9-14 System use syslog System log user User process uucp UNIX-to-UNIX copy system24-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 24 Configuring System Message Logging Displaying the Logging ConfigurationC H A P T E R 25-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 25 Configuring SNMP This chapter describes how to configure the Simple Network Management Protocol (SNMP) on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the switch command reference for this release and to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This chapter consists of these sections: • Understanding SNMP, page 25-1 • Configuring SNMP, page 25-6 • Displaying SNMP Status, page 25-17 Understanding SNMP SNMP is an application-layer protocol that provides a message format for communication between managers and agents. The SNMP system consists of an SNMP manager, an SNMP agent, and a management information base (MIB). The SNMP manager can be part of a network management system (NMS) such as CiscoWorks. The agent and MIB reside on the switch. To configure SNMP on the switch, you define the relationship between the manager and the agent. The SNMP agent contains MIB variables whose values the SNMP manager can request or change. A manager can get a value from an agent or store a value into the agent. The agent gathers data from the MIB, the repository for information about device parameters and network data. The agent can also respond to a manager’s requests to get or set data. An agent can send unsolicited traps to the manager. Traps are messages alerting the SNMP manager to a condition on the network. Traps can mean improper user authentication, restarts, link status (up or down), MAC address tracking, closing of a Transmission Control Protocol (TCP) connection, loss of connection to a neighbor, or other significant events. On the Catalyst 3750, the stack master handles the SNMP requests and traps for the whole switch stack. The stack master transparently manages any requests or traps that are related to all stack members. When a new stack master is elected, the new master continues to handle SNMP requests and traps as configured on the previous stack master, assuming that IP connectivity to the SNMP management stations is still in place after the new master has taken control. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.”25-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Understanding SNMP This section includes information about these topics: • SNMP Versions, page 25-2 • SNMP Manager Functions, page 25-3 • SNMP Agent Functions, page 25-4 • SNMP Community Strings, page 25-4 • Using SNMP to Access MIB Variables, page 25-5 • SNMP Notifications, page 25-5 SNMP Versions This software release supports these SNMP versions: • SNMPv1—The Simple Network Management Protocol, a Full Internet Standard, defined in RFC 1157. • SNMPv2C replaces the Party-based Administrative and Security Framework of SNMPv2Classic with the community-string-based Administrative Framework of SNMPv2C while retaining the bulk retrieval and improved error handling of SNMPv2Classic. It has these features: – SNMPv2—Version 2 of the Simple Network Management Protocol, a Draft Internet Standard, defined in RFCs 1902 through 1907. – SNMPv2C—The community-string-based Administrative Framework for SNMPv2, an Experimental Internet Protocol defined in RFC 1901. • SNMPv3—Version 3 of the SNMP is an interoperable standards-based protocol defined in RFCs 2273 to 2275. SNMPv3 provides secure access to devices by authenticating and encrypting packets over the network and includes these security features: – Message integrity—ensuring that a packet was not tampered with in transit – Authentication—determining that the message is from a valid source – Encryption—mixing the contents of a package to prevent it from being read by an unauthorized source. Note To select encryption, enter the priv keyword. This keyword is available only when the crypto (encrypted) software image is installed. Both SNMPv1 and SNMPv2C use a community-based form of security. The community of managers able to access the agent’s MIB is defined by an IP address access control list and password. SNMPv2C includes a bulk retrieval mechanism and more detailed error message reporting to management stations. The bulk retrieval mechanism retrieves tables and large quantities of information, minimizing the number of round-trips required. The SNMPv2C improved error-handling includes expanded error codes that distinguish different kinds of error conditions; these conditions are reported through a single error code in SNMPv1. Error return codes in SNMPv2C report the error type. SNMPv3 provides for both security models and security levels. A security model is an authentication strategy set up for a user and the group within which the user resides. A security level is the permitted level of security within a security model. A combination of the security level and the security model determine which security mechanism is used when handling an SNMP packet. Available security models are SNMPv1, SNMPv2C, and SNMPv3.25-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Understanding SNMP Table 25-1 identifies the characteristics of the different combinations of security models and levels. You must configure the SNMP agent to use the SNMP version supported by the management station. Because an agent can communicate with multiple managers, you can configure the software to support communications using SNMPv1, and SNMPv2C, and SNMPv3 protocols. SNMP Manager Functions The SNMP manager uses information in the MIB to perform the operations described in Table 25-2. Table 25-1 SNMP Security Models and Levels Model Level Authentication Encryption Result SNMPv1 noAuthNoPriv Community string No Uses a community string match for authentication. SNMPv2C noAuthNoPriv Community string No Uses a community string match for authentication. SNMPv3 noAuthNoPriv Username No Uses a username match for authentication. SNMPv3 authNoPriv MD5 or SHA No Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms. SNMPv3 authPriv (requires the cryptographic software image) MD5 or SHA DES Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms. Provides DES 56-bit encryption in addition to authentication based on the CBC-DES (DES-56) standard. Table 25-2 SNMP Operations Operation Description get-request Retrieves a value from a specific variable. get-next-request Retrieves a value from a variable within a table. 1 1. With this operation, an SNMP manager does not need to know the exact variable name. A sequential search is performed to find the needed variable from within a table. get-bulk-request 2 2. The get-bulk command only works with SNMPv2 or later. Retrieves large blocks of data, such as multiple rows in a table, that would otherwise require the transmission of many small blocks of data. get-response Replies to a get-request, get-next-request, and set-request sent by an NMS. set-request Stores a value in a specific variable. trap An unsolicited message sent by an SNMP agent to an SNMP manager when some event has occurred.25-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Understanding SNMP SNMP Agent Functions The SNMP agent responds to SNMP manager requests as follows: • Get a MIB variable—The SNMP agent begins this function in response to a request from the NMS. The agent retrieves the value of the requested MIB variable and responds to the NMS with that value. • Set a MIB variable—The SNMP agent begins this function in response to a message from the NMS. The SNMP agent changes the value of the MIB variable to the value requested by the NMS. The SNMP agent also sends unsolicited trap messages to notify an NMS that a significant event has occurred on the agent. Examples of trap conditions include, but are not limited to, when a port or module goes up or down, when spanning-tree topology changes occur, and when authentication failures occur. SNMP Community Strings SNMP community strings authenticate access to MIB objects and function as embedded passwords. In order for the NMS to access the switch, the community string definitions on the NMS must match at least one of the three community string definitions on the switch. A community string can have one of these attributes: • Read-only (RO)—Gives read access to authorized management stations to all objects in the MIB except the community strings, but does not allow write access • Read-write (RW)—Gives read and write access to authorized management stations to all objects in the MIB, but does not allow access to the community strings • Read-write-all—Gives read and write access to authorized management stations to all objects in the MIB, including the community strings Note When a cluster is created, the command switch manages the exchange of messages among member switches and the SNMP application. The Cluster Management software appends the member switch number (@esN, where N is the switch number) to the first configured RW and RO community strings on the command switch and propagates them to the member switches. For more information, see Chapter 6, “Clustering Switches.”25-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Understanding SNMP Using SNMP to Access MIB Variables An example of an NMS is the CiscoWorks network management software. CiscoWorks 2000 software uses the switch MIB variables to set device variables and to poll devices on the network for specific information. The results of a poll can be displayed as a graph and analyzed to troubleshoot internetworking problems, increase network performance, verify the configuration of devices, monitor traffic loads, and more. As shown in Figure 25-1, the SNMP agent gathers data from the MIB. The agent can send traps, or notification of certain events, to the SNMP manager, which receives and processes the traps. Traps alert the SNMP manager to a condition on the network such as improper user authentication, restarts, link status (up or down), MAC address tracking, and so forth. The SNMP agent also responds to MIB-related queries sent by the SNMP manager in get-request, get-next-request, and set-request format. Figure 25-1 SNMP Network For information on supported MIBs and how to access them, see Appendix A, “Supported MIBs.” SNMP Notifications SNMP allows the switch to send notifications to SNMP managers when particular events occur. SNMP notifications can be sent as traps or inform requests. In command syntax, unless there is an option in the command to select either traps or informs, the keyword traps refers to either traps or informs, or both. Use the snmp-server host command to specify whether to send SNMP notifications as traps or informs. Note SNMPv1 does not support informs. Traps are unreliable because the receiver does not send an acknowledgment when it receives a trap, and the sender cannot determine if the trap was received. When an SNMP manager receives an inform request, it acknowledges the message with an SNMP response protocol data unit (PDU). If the sender does not receive a response, the inform request can be sent again. Because they can be re-sent, informs are more likely than traps to reach their intended destination. The characteristics that make informs more reliable than traps also consume more resources in the switch and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request is held in memory until a response is received or the request times out. Traps are sent only once, but an inform might be re-sent or retried several times. The retries increase traffic and contribute to a higher overhead on the network. Therefore, traps and informs require a trade-off between reliability and resources. If it is important that the SNMP manager receive every notification, use inform requests. If traffic on the network or memory in the switch is a concern and notification is not required, use traps. Get-request, Get-next-request, Get-bulk, Set-request Network device Get-response, traps SNMP Manager 43581 NMS MIB SNMP Agent25-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Configuring SNMP This section describes how to configure SNMP on your switch. It contains this configuration information: • Default SNMP Configuration, page 25-6 • SNMP Configuration Guidelines, page 25-7 • Disabling the SNMP Agent, page 25-7 • Configuring Community Strings, page 25-8 • Configuring SNMP Groups and Users, page 25-9 • Configuring SNMP Notifications, page 25-12 • Setting the Agent Contact and Location Information, page 25-15 • Limiting TFTP Servers Used Through SNMP, page 25-15 • SNMP Examples, page 25-16 Default SNMP Configuration Table 25-3 shows the default SNMP configuration. Table 25-3 Default SNMP Configuration Feature Default Setting SNMP agent Enabled SNMP community strings Read-Only: Public Read-Write: Private Read-Write-all: Secret SNMP trap receiver None configured SNMP traps None enabled SNMP version If no version keyword is present, the default is version 1. SNMPv3 authentication If no keyword is entered, the default is the noauth (noAuthNoPriv) security level. SNMP notification type If no type is specified, all notifications are sent.25-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP SNMP Configuration Guidelines An SNMP group is a table that maps SNMP users to SNMP views. An SNMP user is a member of an SNMP group. An SNMP host is the recipient of an SNMP trap operation. An SNMP engine ID is a name for the local or remote SNMP engine. When configuring SNMP, follow these guidelines: • When configuring an SNMP group, do not specify a notify view. The snmp-server host global configuration command autogenerates a notify view for the user and then adds it to the group associated with that user. Modifying the group's notify view affects all users associated with that group. Refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1 for information about when you should configure notify views. • To configure a remote user, specify the IP address or port number for the remote SNMP agent of the device where the user resides. • Before you configure remote users for a particular agent, configure the SNMP engine ID, using the snmp-server engineID global configuration with the remote option. The remote agent's SNMP engine ID and user password are used to compute the authentication and privacy digests. If you do not configure the remote engine ID first, the configuration command fails. • When configuring SNMP informs, you need to configure the SNMP engine ID for the remote agent in the SNMP database before you can send proxy requests or informs to it. • Changing the value of the SNMP engine ID has important side effects. A user's password (entered on the command line) is converted to an MD5 or SHA security digest based on the password and the local engine ID. The command-line password is then destroyed, as required by RFC 2274. Because of this deletion, if the value of the engine ID changes, the security digests of SNMPv3 users become invalid, and you need to reconfigure SNMP users by using the snmp-server user username global configuration command. Similar restrictions require the reconfiguration of community strings when the engine ID changes. Disabling the SNMP Agent Beginning in privileged EXEC mode, follow these steps to disable the SNMP agent: The no snmp-server global configuration command disables all running versions (version 1, version 2C, and version 3) on the device. No specific IOS command exists to enable SNMP. The first snmp-server global configuration command that you enter enables all versions of SNMP. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no snmp-server Disable the SNMP agent operation. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.25-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Configuring Community Strings You use the SNMP community string to define the relationship between the SNMP manager and the agent. The community string acts like a password to permit access to the agent on the switch. Optionally, you can specify one or more of these characteristics associated with the string: • An access list of IP addresses of the SNMP managers that are permitted to use the community string to gain access to the agent • A MIB view, which defines the subset of all MIB objects accessible to the given community • Read and write or read-only permission for the MIB objects accessible to the community Beginning in privileged EXEC mode, follow these steps to configure a community string on the switch: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server community string [view view-name] [ro | rw] [access-list-number] Configure the community string. • For string, specify a string that acts like a password and permits access to the SNMP protocol. You can configure one or more community strings of any length. • (Optional) For view, specify the view record accessible to the community. • (Optional) Specify either read-only (ro) if you want authorized management stations to retrieve MIB objects, or specify read-write (rw) if you want authorized management stations to retrieve and modify MIB objects. By default, the community string permits read-only access to all objects. • (Optional) For access-list-number, enter an IP standard access list numbered from 1 to 99 and 1300 to 1999. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] (Optional) If you specified an IP standard access list number in Step 2, then create the list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the IP address of the SNMP managers that are permitted to use the community string to gain access to the agent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode.25-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Note To disable access for an SNMP community, set the community string for that community to the null string (do not enter a value for the community string). To remove a specific community string, use the no snmp-server community string global configuration command. This example shows how to assign the string comaccess to SNMP, to allow read-only access, and to specify that IP access list 4 can use the community string to gain access to the switch SNMP agent: Switch(config)# snmp-server community comaccess ro 4 Configuring SNMP Groups and Users You can specify an identification name (engine ID) for the local or remote SNMP server engine on the switch. You can configure an SNMP server group that maps SNMP users to SNMP views, and you can add new users to the SNMP group. Beginning in privileged EXEC mode, follow these steps to configure SNMP on the switch: Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server engineID {local engineid-string | remote ip-address [udp-port port-number] engineid-string} Configure a name for either the local or remote copy of SNMP. • The engineid-string is a 24-character ID string with the name of the copy of SNMP. You need not specify the entire 24-character engine ID if it has trailing zeros. Specify only the portion of the engine ID up to the point where only zeros remain in the value. For example, to configure an engine ID of 123400000000000000000000, you can enter this: snmp-server engineID local 1234 • If you select remote, specify the ip-address of the device that contains the remote copy of SNMP and the optional UDP port on the remote device. The default is 162.25-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Step 3 snmp-server group groupname {v1 | v2c | v3 [auth | noauth | priv]} [read readview] [write writeview] [notify notifyview] [access access-list] Configure a new SNMP group on the remote device. • For groupname, specify the name of the group. • Specify a security model: – v1 is the least secure of the possible security models. – v2c is the second least secure model. It allows transmission of informs and integers twice the normal width. – v3, the most secure, requires you to select an authentication level: auth—Enables the Message Digest 5 (MD5) and the Secure Hash Algorithm (SHA) packet authentication. noauth —The noAuthNoPriv security level. This is the default if no keyword is specified. priv—Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the crypto software image is installed. • (Optional) Enter read readview with a string (not to exceed 64 characters) that is the name of the view in which you can only view the contents of the agent. • (Optional) Enter write writeview with a string (not to exceed 64 characters) that is the name of the view in which you enter data and configure the contents of the agent. • (Optional) Enter notify notifyview with a string (not to exceed 64 characters) that is the name of the view in which you specify a notify, inform, or trap. • (Optional) Enter access access-list with a string (not to exceed 64 characters) that is the name of the access list. Command Purpose25-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Step 3 snmp-server group groupname {v1 | v2c | v3 [auth | noauth | priv]} [read readview] [write writeview] [notify notifyview] [access access-list] Configure a new SNMP group on the remote device. • For groupname, specify the name of the group. • Specify a security model: – v1 is the least secure of the possible security models. – v2c is the second least secure model. It allows transmission of informs and integers twice the normal width. – v3, the most secure, requires you to select an authentication level: auth—Enables the Message Digest 5 (MD5) and the Secure Hash Algorithm (SHA) packet authentication. noauth —The noAuthNoPriv security level. This is the default if no keyword is specified. priv—Enables Data Encryption Standard (DES) packet encryption (also called privacy). Note The priv keyword is available only when the crypto software image is installed. • (Optional) Enter read readview with a string (not to exceed 64 characters) that is the name of the view in which you can only view the contents of the agent. • (Optional) Enter write writeview with a string (not to exceed 64 characters) that is the name of the view in which you enter data and configure the contents of the agent. • (Optional) Enter notify notifyview with a string (not to exceed 64 characters) that is the name of the view in which you specify a notify, inform, or trap. • (Optional) Enter access access-list with a string (not to exceed 64 characters) that is the name of the access list. Command Purpose25-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Configuring SNMP Notifications A trap manager is a management station that receives and processes traps. Traps are system alerts that the switch generates when certain events occur. By default, no trap manager is defined, and no traps are sent. Switches running this IOS release can have an unlimited number of trap managers. Note Many commands use the word traps in the command syntax. Unless there is an option in the command to select either traps or informs, the keyword traps refers to either traps, informs, or both. Use the snmp-server host command to specify whether to send SNMP notifications as traps or informs. Table 25-4 describes the supported switch traps (notification types). You can enable any or all of these traps and configure a trap manager to receive them. Step 4 snmp-server user username groupname [remote host [udp-port port]] {v1 | v2c | v3 [auth {md5 | sha} auth-password]} [encrypted] [access access-list] Configure a new user to an SNMP group. • The username is the name of the user on the host that connects to the agent. • The groupname is the name of the group to which the user is associated. • (Optional) Enter remote to specify a remote SNMP entity to which the user belongs and the hostname or IP address of that entity with the optional UDP port number. The default is 162. • Enter the SNMP version number (v1,or v2c, or v3). If you enter v3, you have these additional options: – auth is an authentication level setting session, which can be either the HMAC-MD5-96 or the HMAC-SHA-96 authentication level, and requires a password string (not to exceed 64 characters). – encrypted specifies that the password appears in encrypted format. • (Optional) Enter access access-list with a string (not to exceed 64 characters) that is the name of the access list. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Table 25-4 Switch Notification Types Notification Type Keyword Description bgp Generates BGP state change traps. This option is only available when the enhanced multilayer image is installed. bridge Generates STP bridge MIB traps. cluster Generates a trap when the cluster configuration changes.25-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP You can use the snmp-server host global configuration command to a specific host to receive the notification types listed in Table 25-4. config Generates a trap for SNMP configuration changes. config-copy Generates a trap for SNMP copy configuration changes. entity Generates a trap for SNMP entity changes. envmon Generates environmental monitor traps. You can enable any or all of these environmental traps: fan, shutdown, supply, temperature. flash Generates SNMP FLASH notifications. You can optionally enable notification for flash insertion or removal, which would cause a trap to be issued whenever a switch in the stack is removed or inserted (physical removal, power cycle, or reload). fru-ctrl Generates entity FRU control traps. In the Catalyst 3750 switch stack, this trap refers to the insertion or removal of a switch in the stack. hsrp Generates a trap for Hot Standby Router Protocol (HSRP) changes. mac-notification Generates a trap for MAC address notifications. port-security Generates SNMP port security traps. You can also set a maximum trap rate per second. The range is from 0 to 1000; the default is 0, which means that there is no rate limit. rtr Generates a trap for the SNMP Response Time Reporter (RTR). snmp Generates a trap for SNMP-type notifications for authentication, cold start, warm start, link up or link down. stpx Generates SNMP STP Extended MIB traps. syslog Generates SNMP syslog traps. tty Generates a trap for TCP connections. vlan-membership Generates a trap for SNMP VLAN membership changes. vlancreate Generates SNMP VLAN created traps. vlandelete Generates SNMP VLAN deleted traps. vtp Generates a trap for VLAN Trunking Protocol (VTP) changes. Table 25-4 Switch Notification Types (continued) Notification Type Keyword Description25-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP Beginning in privileged EXEC mode, follow these steps to configure the switch to send traps or informs to a host: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server engineID remote ip-address engineid-string Specify the engine ID for the remote host. Step 3 snmp-server user username groupname remote host [udp-port port] {v1 | v2c | v3 [auth {md5 | sha} auth-password]} [encrypted] [access access-list] Configure an SNMP user to be associated with the remote host created in Step 2. Note You cannot configure a remote user for an address without first configuring the engine ID for the remote host. If you try to configure the user before configuring the remote engine ID, you receive an error message, and the command is not executed. Step 4 snmp-server host host-addr [traps | informs] [version {1 | 2c | 3 [auth | noauth | priv]}] community-string [udp-port port] [notification-type] Specify the recipient of an SNMP trap operation. • For host-addr, specify the name or Internet address of the host (the targeted recipient). • (Optional) Enter traps (the default) to send SNMP traps to the host. • (Optional) Enter informs to send SNMP informs to the host. • (Optional) Specify the SNMP version (1, 2c, or 3). SNMPv1 does not support informs. • (Optional) For version 3, select authentication level auth, noauth, or priv. Note The priv keyword is available only when the crypto software image is installed. • For community-string, enter the password-like community string sent with the notification operation. • (Optional) For udp-port port, enter the remote device UDP port. • (Optional) For notification-type, use the keywords listed in Table 25-4 on page 25-12. If no type is specified, all notifications are sent. Step 5 snmp-server enable traps notification-types Enable the switch to send traps or informs and specify the type of notifications to be sent. For a list of notification types, see Table 25-4 on page 25-12, or enter this: snmp-server enable traps ? To enable multiple types of traps, you must enter a separate snmp-server enable traps command for each trap type. Step 6 snmp-server trap-source interface-id (Optional) Specify the source interface, which provides the IP address for the trap message. This command also sets the source IP address for informs. Step 7 snmp-server queue-length length (Optional) Establish the message queue length for each trap host. The range is 1 to 1000; the default is 10. Step 8 snmp-server trap-timeout seconds (Optional) Define how often to resend trap messages. The range is 1 to 1000; the default is 30 seconds. Step 9 end Return to privileged EXEC mode.25-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP The snmp-server host command specifies which hosts receive the notifications. The snmp-server enable trap command globally enables the mechanism for the specified notification (for traps and informs). To enable a host to receive an inform, you must configure an snmp-server host informs command for the host and globally enable informs by using the snmp-server enable traps command. To remove the specified host from receiving traps, use the no snmp-server host host global configuration command. The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs global configuration command. To disable a specific trap type, use the no snmp-server enable traps notification-types global configuration command. Setting the Agent Contact and Location Information Beginning in privileged EXEC mode, follow these steps to set the system contact and location of the SNMP agent so that these descriptions can be accessed through the configuration file: Limiting TFTP Servers Used Through SNMP Beginning in privileged EXEC mode, follow these steps to limit the TFTP servers used for saving and loading configuration files through SNMP to the servers specified in an access list: Step 10 show running-config Verify your entries. Step 11 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server contact text Set the system contact string. For example: snmp-server contact Dial System Operator at beeper 21555. Step 3 snmp-server location text Set the system location string. For example: snmp-server location Building 3/Room 222 Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 snmp-server tftp-server-list access-list-number Limit TFTP servers used for configuration file copies through SNMP to the servers in the access list. For access-list-number, enter an IP standard access list numbered from 1 to 99 and 1300 to 1999.25-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Configuring SNMP SNMP Examples This example shows how to enable all versions of SNMP. The configuration permits any SNMP manager to access all objects with read-only permissions using the community string public. This configuration does not cause the switch to send any traps. Switch(config)# snmp-server community public This example shows how to permit any SNMP manager to access all objects with read-only permission using the community string public. The switch also sends VTP traps to the hosts 192.180.1.111 and 192.180.1.33 using SNMPv1 and to the host 192.180.1.27 using SNMPv2C. The community string public is sent with the traps. Switch(config)# snmp-server community public Switch(config)# snmp-server enable traps vtp Switch(config)# snmp-server host 192.180.1.27 version 2c public Switch(config)# snmp-server host 192.180.1.111 version 1 public Switch(config)# snmp-server host 192.180.1.33 public This example shows how to allow read-only access for all objects to members of access list 4 that use the comaccess community string. No other SNMP managers have access to any objects. SNMP Authentication Failure traps are sent by SNMPv2C to the host cisco.com using the community string public. Switch(config)# snmp-server community comaccess ro 4 Switch(config)# snmp-server enable traps snmp authentication Switch(config)# snmp-server host cisco.com version 2c public Step 3 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the IP address of the TFTP servers that can access the switch. • (Optional) For source-wildcard, enter the wildcard bits, in dotted decimal notation, to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose25-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Displaying SNMP Status This example shows how to send Entity MIB traps to the host cisco.com. The community string is restricted. The first line enables the switch to send Entity MIB traps in addition to any traps previously enabled. The second line specifies the destination of these traps and overwrites any previous snmp-server host commands for the host cisco.com. Switch(config)# snmp-server enable traps entity Switch(config)# snmp-server host cisco.com restricted entity This example shows how to enable the switch to send all traps to the host myhost.cisco.com using the community string public: Switch(config)# snmp-server enable traps Switch(config)# snmp-server host myhost.cisco.com public Displaying SNMP Status To display SNMP input and output statistics, including the number of illegal community string entries, errors, and requested variables, use the show snmp privileged EXEC command.You can also use the other privileged EXEC commands in Table 25-5 to display SNMP information. For information about the fields in the output displays, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. Note Though visible in the command-line help strings, the snmp-server enable informs command is not supported. To enable the sending of SNMP inform notifications, use the snmp-server enable traps command combined with the snmp-server host host-addr informs command. Table 25-5 Commands for Displaying SNMP Information Feature Default Setting show snmp Displays SNMP statistics. show snmp engineID [local | remote] Displays information on the local SNMP engine and all remote engines that have been configured on the device. show snmp group Displays information on each SNMP group on the network. show snmp user Displays information on each SNMP user name in the SNMP users table.25-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 25 Configuring SNMP Displaying SNMP StatusC H A P T E R 26-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 26 Configuring Network Security with ACLs This chapter describes how to configure network security on the Catalyst 3750 switch by using access control lists (ACLs), which are also referred to in commands and tables as access lists. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release and the “Configuring IP Services” section of the Cisco IOS IP and IP Routing Configuration Guide and the Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1. This chapter consists of these sections: • Understanding ACLs, page 26-1 • Configuring IP ACLs, page 26-6 • Creating Named MAC Extended ACLs, page 26-26 • Configuring VLAN Maps, page 26-29 • Using VLAN Maps with Router ACLs, page 26-36 • Displaying ACL Configuration, page 26-41 Understanding ACLs Packet filtering can help limit network traffic and restrict network use by certain users or devices. ACLs can filter traffic as it passes through a router or switch and permit or deny packets crossing specified interfaces or VLANs. An ACL is a sequential collection of permit and deny conditions that apply to packets. When a packet is received on an interface, the switch compares the fields in the packet against any applied ACLs to verify that the packet has the required permissions to be forwarded, based on the criteria specified in the access lists. It tests packets against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packets. Because the switch stops testing conditions after the first match, the order of conditions in the list is critical. If no conditions match, the switch rejects the packets. If there are no restrictions, the switch forwards the packet; otherwise, the switch drops the packet. The switch can access-control all packets it switches, including packets bridged within a VLAN. You configure access lists on a router or Layer 3 switch to provide basic security for your network. If you do not configure ACLs, all packets passing through the switch could be allowed onto all parts of the network. You can use ACLs to control which hosts can access different parts of a network or to decide 26-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Understanding ACLs which types of traffic are forwarded or blocked at router interfaces. For example, you can allow e-mail traffic to be forwarded but not Telnet traffic. ACLs can be configured to block inbound traffic, outbound traffic, or both. An ACL contains an ordered list of access control entries (ACEs). Each ACE specifies permit or deny and a set of conditions the packet must satisfy in order to match the ACE. The meaning of permit or deny depends on the context in which the ACL is used. The switch supports IP ACLs and Ethernet (MAC) ACLs: • IP ACLs filter IP traffic, including TCP, User Datagram Protocol (UDP), Internet Group Management Protocol (IGMP), and Internet Control Message Protocol (ICMP). • Ethernet ACLs filter non-IP traffic. This switch also supports quality of service (QoS) classification ACLs. For more information, see the “Classification Based on QoS ACLs” section on page 27-7. This section includes information on these topics: • Supported ACLs, page 26-2 • Handling Fragmented and Unfragmented Traffic, page 26-5 • ACLs and Switch Stacks, page 26-6 Supported ACLs The switch supports three applications of ACLs to filter traffic: • Router ACLs access-control routed traffic between VLANs and are applied to Layer 3 interfaces. • Port ACLs access-control traffic entering a Layer 2 interface. The switch does not support port ACLs in the outbound direction. You can apply only one IP access list and one MAC access list to a Layer 2 interface. • VLAN ACLs or VLAN maps access-control all packets (bridged and routed). You can use VLAN maps to filter traffic between devices in the same VLAN. VLAN maps are configured to provide access-control based on Layer 3 addresses for IP. Unsupported protocols are access-controlled through MAC addresses using Ethernet ACEs. After a VLAN map is applied to a VLAN, all packets (routed or bridged) entering the VLAN are checked against the VLAN map. Packets can either enter the VLAN through a switch port or through a routed port after being routed. You can use router ACLs, input port ACLs, and VLAN maps on the same switch. However, a port ACL takes precedence over a router ACL or VLAN map. • When both an input port ACL and a VLAN map are applied, incoming packets received on ports with a port ACL applied are filtered by the port ACL. Other packets are filtered by the VLAN map • When an input router ACL and input port ACL exist in an switch virtual interface (SVI), incoming packets received on ports to which a port ACL is applied are filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by the router ACL. Other packets are not filtered. • When an output router ACL and input port ACL exist in an SVI, incoming packets received on the ports to which a port ACL is applied are filtered by the port ACL. Outgoing routed IP packets are filtered by the router ACL. Other packets are not filtered. • When a VLAN map, input router ACL, and input port ACL exist in an SVI, incoming packets received on the ports to which a port ACL is applied are only filtered by the port ACL. Incoming routed IP packets received on other ports are filtered by both the VLAN map and the router ACL. Other packets are filtered only by the VLAN map.26-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Understanding ACLs • When a VLAN map, output router ACL, and input port ACL exist in an SVI, incoming packets received on the ports to which a port ACL is applied are only filtered by the port ACL. Outgoing routed IP packets are filtered by both the VLAN map and the router ACL. Other packets are filtered only by the VLAN map. Router ACLs You can apply router ACLs on switch virtual interfaces (SVIs), which are Layer 3 interfaces to VLANs; on physical Layer 3 interfaces; and on Layer 3 EtherChannel interfaces. You apply router ACLs on interfaces for specific directions (inbound or outbound). You can apply one router ACL in each direction on an interface. One ACL can be used with multiple features for a given interface, and one feature can use multiple ACLs. When a single router ACL is used by multiple features, it is examined multiple times. • Standard IP access lists use source addresses for matching operations. • Extended IP access lists use source and destination addresses and optional protocol type information for matching operations. The switch examines ACLs associated with features configured on a given interface and a direction. As packets enter the switch on an interface, ACLs associated with all inbound features configured on that interface are examined. After packets are routed and before they are forwarded to the next hop, all ACLs associated with outbound features configured on the egress interface are examined. ACLs permit or deny packet forwarding based on how the packet matches the entries in the ACL, and can be used to control access to a network or to part of a network. In Figure 26-1, ACLs applied at the router input allow Host A to access the Human Resources network, but prevent Host B from accessing the same network. Figure 26-1 Using ACLs to Control Traffic to a Network Si Host A Host B 83217 Research & Development network = ACL denying traffic from Host B and permitting traffic from Host A = Packet Catalyst 3750 switch Human Resources network26-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Understanding ACLs Port ACLs Port ACLs are ACLs that are applied to Layer 2 interfaces on a switch. Port ACLs are supported only on physical interfaces and not on EtherChannel interfaces. Port ACLs are applied only on interfaces for inbound traffic. These access lists are supported on Layer 2 interfaces: • Standard IP access lists using source addresses • Extended IP access lists using source and destination addresses and optional protocol type information • MAC extended access lists using source and destination MAC addresses and optional protocol type information As with router ACLs, the switch examines ACLs associated with features configured on a given interface and permits or denies packet forwarding based on how the packet matches the entries in the ACL. ACLs can only be applied to Layer 2 interfaces in the inbound direction. In the example in Figure 26-1, if all workstations were in the same VLAN, ACLs applied at the Layer 2 input would allow Host A to access the Human Resources network, but prevent Host B from accessing the same network. When you apply a port ACL to a trunk port, the ACL filters traffic on all VLANs present on the trunk port. When you apply a port ACL to a port with voice VLAN, the ACL filters traffic on both data and voice VLANs. With port ACLs, you can filter IP traffic by using IP access lists and non-IP traffic by using MAC addresses. You can filter both IP and non-IP traffic on the same Layer 2 interface by applying both an IP access list and a MAC access list to the interface. Note You cannot apply more than one IP access list and one MAC access list to a Layer 2 interface. If an IP access list or MAC access list is already configured on a Layer 2 interface and you apply a new IP access list or MAC access list to the interface, the new ACL replaces the previously configured one. VLAN Maps VLAN ACLs or VLAN maps can access-control all traffic.You can apply VLAN maps to all packets that are routed into or out of a VLAN or are bridged within a VLAN in the stack.VLAN maps are used for security packet filtering. VLAN maps are not defined by direction (input or output). You can configure VLAN maps to match Layer 3 addresses for IP traffic. All non-IP protocols are access-controlled through MAC addresses and Ethertype using MAC VLAN maps. (IP traffic is not access controlled by MAC VLAN maps.) You can enforce VLAN maps only on packets going through the switch; you cannot enforce VLAN maps on traffic between hosts on a hub or on another switch connected to this switch. With VLAN maps, forwarding of packets is permitted or denied, based on the action specified in the map. Figure 26-2 illustrates how a VLAN map is applied to deny a specific type of traffic from Host A in VLAN 10 from being forwarded. You can apply only one VLAN map to a VLAN.26-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Understanding ACLs Figure 26-2 Using VLAN Maps to Control Traffic Handling Fragmented and Unfragmented Traffic IP packets can be fragmented as they cross the network. When this happens, only the fragment containing the beginning of the packet contains the Layer 4 information, such as TCP or UDP port numbers, ICMP type and code, and so on. All other fragments are missing this information. Some ACEs do not check Layer 4 information and therefore can be applied to all packet fragments. ACEs that do test Layer 4 information cannot be applied in the standard manner to most of the fragments in a fragmented IP packet. When the fragment contains no Layer 4 information and the ACE tests some Layer 4 information, the matching rules are modified: • Permit ACEs that check the Layer 3 information in the fragment (including protocol type, such as TCP, UDP, and so on) are considered to match the fragment regardless of what the missing Layer 4 information might have been. • Deny ACEs that check Layer 4 information never match a fragment unless the fragment contains Layer 4 information. Consider access list 102, configured with these commands, applied to three fragmented packets: Switch(config)# access-list 102 permit tcp any host 10.1.1.1 eq smtp Switch(config)# access-list 102 deny tcp any host 10.1.1.2 eq telnet Switch(config)# access-list 102 permit tcp any host 10.1.1.2 Switch(config)# access-list 102 deny tcp any any Note In the first and second ACEs in the examples, the eq keyword after the destination address means to test for the TCP-destination-port well-known numbers equaling Simple Mail Transfer Protocol (SMTP) and Telnet, respectively. • Packet A is a TCP packet from host 10.2.2.2., port 65000, going to host 10.1.1.1 on the SMTP port. If this packet is fragmented, the first fragment matches the first ACE (a permit) as if it were a complete packet because all Layer 4 information is present. The remaining fragments also match the first ACE, even though they do not contain the SMTP port information, because the first ACE only checks Layer 3 information when applied to fragments. The information in this example is that the packet is TCP and that the destination is 10.1.1.1. • Packet B is from host 10.2.2.2, port 65001, going to host 10.1.1.2 on the Telnet port. If this packet is fragmented, the first fragment matches the second ACE (a deny) because all Layer 3 and Layer 4 information is present. The remaining fragments in the packet do not match the second ACE because they are missing Layer 4 information. Instead, they match the third ACE (a permit). Si Host B (VLAN 10) Host A (VLAN 10) 83218 = VLAN map denying specific type of traffic from Host A = Packet Catalyst 3750 switch bridging traffic26-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Because the first fragment was denied, host 10.1.1.2 cannot reassemble a complete packet, so packet B is effectively denied. However, the later fragments that are permitted will consume bandwidth on the network and resources of host 10.1.1.2 as it tries to reassemble the packet. • Fragmented packet C is from host 10.2.2.2, port 65001, going to host 10.1.1.3, port ftp. If this packet is fragmented, the first fragment matches the fourth ACE (a deny). All other fragments also match the fourth ACE because that ACE does not check any Layer 4 information and because Layer 3 information in all fragments shows that they are being sent to host 10.1.1.3, and the earlier permit ACEs were checking different hosts. ACLs and Switch Stacks ACL support is the same for a switch stack as for a standalone switch. ACL configuration information is propagated to all switches in the stack. All switches in the stack, including the stack master, process the information and program their hardware. (For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.”) The stack master performs these ACL functions: • It processes the ACL configuration and propagates the information to all stack members. • It distributes the ACL information to any switch that joins the stack. • If packets must be forwarded by software for any reason (for example, not enough hardware resources), the master switch forwards the packets only after applying ACLs on the packets. • It programs its hardware with the ACL information it processes. Stack members perform these ACL functions: • They receive the ACL information from the master switch and program their hardware. • They act as standby switches, ready to take over the role of the stack master if the existing master were to fail and they were to be elected as the new stack master. When a stack master fails and a new stack master is elected, the newly elected master reparses the backed up running configuration. (See Chapter 5, “Managing Switch Stacks.”) The ACL configuration that is part of the running configuration is also reparsed during this step. The new stack master distributes the ACL information to all switches in the stack. Configuring IP ACLs Configuring IP ACLs on the switch is the same as configuring IP ACLs on other Cisco switches and routers. The process is briefly described here. For more detailed information on configuring ACLs, refer to the “Configuring IP Services” chapter in the Cisco IP and IP Routing Configuration Guide for IOS Release 12.1. For detailed information about the commands, refer to Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1. The switch does not support these IOS router ACL-related features: • Non-IP protocol ACLs (see Table 26-1 on page 26-8) or bridge-group ACLs • IP accounting • Inbound and outbound rate limiting (except with QoS ACLs)26-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs • Reflexive ACLs or dynamic ACLs (except for some specialized dynamic ACLs used by the switch clustering feature) • ACL logging for port ACLs and VLAN maps These are the steps to use IP ACLs on the switch: Step 1 Create an ACL by specifying an access list number or name and access conditions. Step 2 Apply the ACL to interfaces or terminal lines. You can also apply standard and extended IP ACLs to VLAN maps. This section includes the following information: • Creating Standard and Extended IP ACLs, page 26-7 • Applying an IP ACL to a Terminal Line, page 26-18 • Applying an IP ACL to an Interface, page 26-19 • Hardware and Software Treatment of IP ACLs, page 26-20 • IP ACL Configuration Examples, page 26-21 Creating Standard and Extended IP ACLs This section describes IP ACLs. An ACL is a sequential collection of permit and deny conditions. The switch tests packets against the conditions in an access list one by one. The first match determines whether the switch accepts or rejects the packet. Because the switch stops testing conditions after the first match, the order of the conditions is critical. If no conditions match, the switch denies the packet. The software supports these types of ACLs or access lists for IP: • Standard IP access lists use source addresses for matching operations. • Extended IP access lists use source and destination addresses for matching operations and optional protocol-type information for finer granularity of control. These sections describe access lists and how to create them: • Access List Numbers, page 26-8 • Creating a Numbered Standard ACL, page 26-9 • Creating a Numbered Extended ACL, page 26-10 • Creating Named Standard and Extended ACLs, page 26-14 • Using Time Ranges with ACLs, page 26-16 • Including Comments in ACLs, page 26-1826-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Access List Numbers The number you use to denote your ACL shows the type of access list that you are creating. Table 26-1 lists the access-list number and corresponding access list type and shows whether or not they are supported in the switch. The switch supports IP standard and IP extended access lists, numbers 1 to 199 and 1300 to 2699. Note In addition to numbered standard and extended ACLs, you can also create standard and extended named IP ACLs using the supported numbers. That is, the name of a standard IP ACL can be 1 to 99; the name of an extended IP ACL can be 100 to 199. The advantage of using named ACLs instead of numbered lists is that you can delete individual entries from a named list. Table 26-1 Access List Numbers Access List Number Type Supported 1–99 IP standard access list Yes 100–199 IP extended access list Yes 200–299 Protocol type-code access list No 300–399 DECnet access list No 400–499 XNS standard access list No 500–599 XNS extended access list No 600–699 AppleTalk access list No 700–799 48-bit MAC address access list No 800–899 IPX standard access list No 900–999 IPX extended access list No 1000–1099 IPX SAP access list No 1100–1199 Extended 48-bit MAC address access list No 1200–1299 IPX summary address access list No 1300–1999 IP standard access list (expanded range) Yes 2000–2699 IP extended access list (expanded range) Yes26-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Creating a Numbered Standard ACL Beginning in privileged EXEC mode, follow these steps to create a numbered standard ACL: Use the no access-list access-list-number global configuration command to delete the entire ACL. You cannot delete individual ACEs from numbered access lists. Note When creating an ACL, remember that, by default, the end of the ACL contains an implicit deny statement for all packets that it did not find a match for before reaching the end. With standard access lists, if you omit the mask from an associated IP host address ACL specification, 0.0.0.0 is assumed to be the mask. This example shows how to create a standard ACL to deny access to IP host 171.69.198.102, permit access to any others, and display the results. Switch (config)# access-list 2 deny host 171.69.198.102 Switch (config)# access-list 2 permit any Switch(config)# end Switch# show access-lists Standard IP access list 2 deny 171.69.198.102 permit any Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] [log] Define a standard IP access list by using a source address and wildcard. The access-list-number is a decimal number from 1 to 99 or 1300 to 1999. Enter deny or permit to specify whether to deny or permit access if conditions are matched. The source is the source address of the network or host from which the packet is being sent specified as: • The 32-bit quantity in dotted-decimal format. • The keyword any as an abbreviation for source and source-wildcard of 0.0.0.0 255.255.255.255. You do not need to enter a source-wildcard. • The keyword host as an abbreviation for source and source-wildcard of source 0.0.0.0. (Optional) The source-wildcard applies wildcard bits to the source. (Optional) Enter log to cause an informational logging message about the packet that matches the entry to be sent to the console. Step 3 end Return to privileged EXEC mode. Step 4 show access-lists [number | name] Show the access list configuration. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.26-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs The switch always rewrites the order of standard access lists so that entries with host matches and entries with matches having a don’t care mask of 0.0.0.0 are moved to the top of the list, above any entries with non-zero don’t care masks. Therefore, in show command output and in the configuration file, the ACEs do not necessarily appear in the order in which they were entered. The switch software can provide logging messages about packets permitted or denied by a standard IP access list. That is, any packet that matches the ACL causes an informational logging message about the packet to be sent to the console. The level of messages logged to the console is controlled by the logging console commands controlling the syslog messages. Note Because routing is done in hardware and logging is done in software, if a large number of packets match a permit or deny ACE containing a log keyword, the software might not be able to match the hardware processing rate, and not all packets will be logged. The first packet that triggers the ACL causes a logging message right away, and subsequent packets are collected over 5-minute intervals before they are displayed or logged. The logging message includes the access list number, whether the packet was permitted or denied, the source IP address of the packet, and the number of packets from that source permitted or denied in the prior 5-minute interval. After creating a numbered standard IP ACL, you can apply it to terminal lines (see the “Applying an IP ACL to a Terminal Line” section on page 26-18), to interfaces (see the “Applying an IP ACL to an Interface” section on page 26-19), or to VLANs (see the “Configuring VLAN Maps” section on page 26-29). Creating a Numbered Extended ACL Although standard ACLs use only source addresses for matching, you can use extended ACL source and destination addresses for matching operations and optional protocol type information for finer granularity of control. When you are creating ACEs in numbered extended access lists, remember that after you create the ACL, any additions are placed at the end of the list. You cannot reorder the list or selectively add or remove ACEs from a numbered list. Some protocols also have specific parameters and keywords that apply to that protocol. These IP protocols are supported (protocol keywords are in parentheses in bold): Authentication Header Protocol (ahp), Enhanced Interior Gateway Routing Protocol (eigrp), Encapsulation Security Payload (esp), generic routing encapsulation (gre), Internet Control Message Protocol (icmp), Internet Group Management Protocol (igmp), Interior Gateway Routing Protocol (igrp), any Interior Protocol (ip), IP in IP tunneling (ipinip), KA9Q NOS-compatible IP over IP tunneling (nos), Open Shortest Path First routing (ospf), Payload Compression Protocol (pcp), Protocol Independent Multicast (pim), Transmission Control Protocol (tcp), or User Datagram Protocol (udp). Note ICMP echo-reply cannot be filtered. All other ICMP codes or types can be filtered. For more details on the specific keywords relative to each protocol, refer to Cisco IP and IP Routing Command Reference for IOS Release 12.1. Note The switch does not support dynamic or reflexive access lists. It also does not support filtering based on the type of service (ToS) minimize-monetary-cost bit.26-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Supported parameters can be grouped into these categories: TCP, UDP, ICMP, IGMP, or other IP. Beginning in privileged EXEC mode, follow these steps to create an extended ACL: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2a access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] Note If you enter a dscp value, you cannot enter tos or precedence. You can enter both a tos and a precedence value with no dscp. Define an extended IP access list and the access conditions. The access-list-number is a decimal number from 100 to 199 or 2000 to 2699. Enter deny or permit to specify whether to deny or permit the packet if conditions are matched. For protocol, enter the name or number of an IP protocol: ahp, eigrp, esp, gre, icmp, igmp, igrp, ip, ipinip, nos, ospf, pcp, pim, tcp, or udp, or an integer in the range 0 to 255 representing an IP protocol number. To match any Internet protocol (including ICMP, TCP, and UDP) use the keyword ip. Note This step includes options for most IP protocols. For additional specific parameters for TCP, UDP, ICMP, and IGMP, see steps 2b through 2e. The source is the number of the network or host from which the packet is sent. The source-wildcard applies wildcard bits to the source. The destination is the network or host number to which the packet is sent. The destination-wildcard applies wildcard bits to the destination. Source, source-wildcard, destination, and destination-wildcard can be specified as: • The 32-bit quantity in dotted-decimal format. • The keyword any for 0.0.0.0 255.255.255.255 (any host). • The keyword host for a single host 0.0.0.0. The other keywords are optional and have these meanings: • precedence—Enter to match packets with a precedence level specified as a number from 0 to 7 or by name: routine (0), priority (1), immediate (2), flash (3), flash-override (4), critical (5), internet (6), network (7). • fragments—Enter to check non-initial fragments. • tos—Enter to match by type of service level, specified by a number from 0 to 15 or a name: normal (0), max-reliability (2), max-throughput (4), min-delay (8). • log—Enter to create an informational logging message to be sent to the console about the packet that matches the entry or log-input to include the input interface in the log entry. • time-range—For an explanation of this keyword, see the “Using Time Ranges with ACLs” section on page 26-16. • dscp—Enter to match packets with the DSCP value specified by a number from 0 to 63, or use the question mark (?) to see a list of available values.26-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs or access-list access-list-number {deny | permit} protocol any any [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] In access-list configuration mode, define an extended IP access list using an abbreviation for a source and source wildcard of 0.0.0.0 255.255.255.255 and an abbreviation for a destination and destination wildcard of 0.0.0.0 255.255.255.255. You can use the any keyword in place of source and destination address and wildcard. or access-list access-list-number {deny | permit} protocol host source host destination [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] Define an extended IP access list using an abbreviation for a source and source wildcard of source 0.0.0.0 and an abbreviation for a destination and destination wildcard of destination 0.0.0.0. You can use the host keyword in place of source and destination wildcard or mask. Step 2b access-list access-list-number {deny | permit} tcp source source-wildcard [operator port] destination destination-wildcard [operator port] [established] [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] [flag] (Optional) Define an extended TCP access list and the access conditions. Enter tcp for Transmission Control Protocol. The parameters are the same as those described in Step 2a with these exceptions: (Optional) Enter an operator and port to compare source (if positioned after source source-wildcard) or destination (if positioned after destination destination-wildcard) port. Possible operators include eq (equal), gt (greater than), lt (less than), neq (not equal), and range (inclusive range). Operators require a port number (range requires two port numbers separated by a space). Enter the port number as a decimal number (from 0 to 65535) or the name of a TCP port. To see TCP port names, use the ? or refer to “Configuring IP Services” section of Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1. Use only TCP port numbers or names when filtering TCP. The additional optional keywords have these meanings: • established—Enter to match an established connection. This has the same function as matching on the ack or rst flag. • flag—Enter one of these flags to match by the specified TCP header bits: ack (acknowledge), fin (finish), psh (push), rst (reset), syn (synchronize), or urg (urgent). Step 2c access-list access-list-number {deny | permit} udp source source-wildcard [operator port] destination destination-wildcard [operator port] [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] (Optional) Define an extended UDP access list and the access conditions. Enter udp for the User Datagram Protocol. The UDP parameters are the same as those described for TCP except that [operator [port]] port number or name must be a UDP port number or name, and the flag and established parameters are not valid for UDP. Command Purpose26-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Use the no access-list access-list-number global configuration command to delete the entire access list. You cannot delete individual ACEs from numbered access lists. This example shows how to create and display an extended access list to deny Telnet access from any host in network 171.69.198.0 to any host in network 172.20.52.0 and permit any others. (The eq keyword after the destination address means to test for the TCP destination port number equaling Telnet.) Switch(config)# access-list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet Switch(config)# access-list 102 permit tcp any any Switch(config)# end Switch# show access-lists Extended IP access list 102 deny tcp 171.69.198.0 0.0.0.255 172.20.52.0 0.0.0.255 eq telnet permit tcp any any After an ACL is created, any additions (possibly entered from the terminal) are placed at the end of the list. You cannot selectively add or remove access list entries from a numbered access list. Note When you are creating an ACL, remember that, by default, the end of the access list contains an implicit deny statement for all packets if it did not find a match before reaching the end. Step 2d access-list access-list-number {deny | permit} icmp source source-wildcard destination destination-wildcard [icmp-type | [[icmp-type icmp-code] | [icmp-message]] [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] (Optional) Define an extended ICMP access list and the access conditions. Enter icmp for Internet Control Message Protocol. The ICMP parameters are the same as those described for most IP protocols in Step 2a, with the addition of the ICMP message type and code parameters. These optional keywords have these meanings: • icmp-type—Enter to filter by ICMP message type, a number from 0 to 255. • icmp-code—Enter to filter ICMP packets that are filtered by ICMP message type by the ICMP message code, a number from 0 to 255. • icmp-message—Enter to filter ICMP packets by ICMP message type name or ICMP message type and code name. To see a list of ICMP message type names and ICMP message type and code names, use the ? or refer to the “Configuring IP Services” section of Cisco IOS IP and IP Routing Command Reference for IOS Release 12.1. Step 2e access-list access-list-number {deny | permit} igmp source source-wildcard destination destination-wildcard [igmp-type] [precedence precedence] [tos tos] [fragments] [log] [log-input] [time-range time-range-name] [dscp dscp] (Optional) Define an extended IGMP access list and the access conditions. Enter igmp for Internet Group Management Protocol. The IGMP parameters are the same as those described for most IP protocols in Step 2a, with the addition of this optional parameter. igmp-type—To match IGMP message type, enter a number from 0 to 15, or enter the message name (dvmrp, host-query, host-report, pim, or trace). Step 3 show access-lists [number | name] Verify the access list configuration. Step 4 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose26-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs After creating a numbered extended ACL, you can apply it to terminal lines (see the “Applying an IP ACL to a Terminal Line” section on page 26-18), to interfaces (see the “Applying an IP ACL to an Interface” section on page 26-19), or to VLANs (see the “Configuring VLAN Maps” section on page 26-29). Creating Named Standard and Extended ACLs You can identify IP ACLs with an alphanumeric string (a name) rather than a number. You can use named ACLs to configure more IP access lists in a router than if you were to use numbered access lists. If you identify your access list with a name rather than a number, the mode and command syntax are slightly different. However, not all commands that use IP access lists accept a named access list. Note The name you give to a standard or extended ACL can also be a number in the supported range of access list numbers. That is, the name of a standard IP ACL can be 1 to 99; the name of an extended IP ACL can be 100 to 199. The advantage of using named ACLs instead of numbered lists is that you can delete individual entries from a named list. Consider these guidelines and limitations before configuring named ACLs: • Not all commands that accept a numbered ACL accept a named ACL. ACLs for packet filters and route filters on interfaces can use a name. VLAN maps also accept a name. • A standard ACL and an extended ACL cannot have the same name. • Numbered ACLs are also available, as described in the “Creating Standard and Extended IP ACLs” section on page 26-7. • You can use standard and extended ACLs (named or numbered) in VLAN maps. Beginning in privileged EXEC mode, follow these steps to create a standard ACL using names: To remove a named standard ACL, use the no ip access-list standard name global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip access-list standard name Define a standard IP access list using a name, and enter access-list configuration mode. Note The name can be a number from 1 to 99. Step 3 deny {source [source-wildcard] | host source | any} [log] or permit {source [source-wildcard] | host source | any} [log] In access-list configuration mode, specify one or more conditions denied or permitted to determine if the packet is forwarded or dropped. • host source—A source and source wildcard of source 0.0.0.0. • any—A source and source wildcard of 0.0.0.0 255.255.255.255. Step 4 end Return to privileged EXEC mode. Step 5 show access-lists [number | name] Show the access list configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Beginning in privileged EXEC mode, follow these steps to create an extended ACL using names: To remove a named extended ACL, use the no ip access-list extended name global configuration command. When you are creating standard extended ACLs, remember that, by default, the end of the ACL contains an implicit deny statement for everything if it did not find a match before reaching the end. For standard ACLs, if you omit the mask from an associated IP host address access list specification, 0.0.0.0 is assumed to be the mask. After you create an ACL, any additions are placed at the end of the list. You cannot selectively add ACL entries to a specific ACL. However, you can use no permit and no deny access-list configuration mode commands to remove entries from a named ACL. This example shows how you can delete individual ACEs from the named access list border-list: Switch(config)# ip access-list extended border-list Switch(config-ext-nacl)# no permit ip host 10.1.1.3 any Being able to selectively remove lines from a named ACL is one reason you might use named ACLs instead of numbered ACLs. After creating a named ACL, you can apply it to interfaces (see the “Applying an IP ACL to an Interface” section on page 26-19) or VLANs (see the “Configuring VLAN Maps” section on page 26-29). Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip access-list extended name Define an extended IP access list using a name and enter access-list configuration mode. Note The name can be a number from 100 to 199. Step 3 {deny | permit} protocol {source [source-wildcard] | host source | any} {destination [destination-wildcard] | host destination | any} [precedence precedence] [tos tos] [established] [log] [time-range time-range-name] In access-list configuration mode, specify the conditions allowed or denied. Use the log keyword to get access list logging messages, including violations. See the “Creating a Numbered Extended ACL” section on page 26-10 for definitions of protocols and other keywords. • host source—A source and source wildcard of source 0.0.0.0. • host destination—A destination and destination wildcard of destination 0.0.0.0. • any—A source and source wildcard or destination and destination wildcard of 0.0.0.0 255.255.255.255. Step 4 end Return to privileged EXEC mode. Step 5 show access-lists [number | name] Show the access list configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Using Time Ranges with ACLs You can selectively apply extended ACLs based on the time of day and week by using the time-range global configuration command. First, define a time-range name and set the times and the dates or the days of the week in the time range. Then enter the time-range name when applying an ACL to set restrictions to the access list. You can use the time range to define when the permit or deny statements in the ACL are in effect, for example, during a specified time period or on specified days of the week. The time-range keyword and argument are referenced in the named and numbered extended ACL task tables in the previous sections, the “Creating Standard and Extended IP ACLs” section on page 26-7, and the “Creating Named Standard and Extended ACLs” section on page 26-14. These are some of the many possible benefits of using time ranges: • You have more control over permitting or denying a user access to resources, such as an application (identified by an IP address/mask pair and a port number). • You can control logging messages. ACL entries can be set to log traffic only at certain times of the day. Therefore, you can simply deny access without needing to analyze many logs generated during peak hours. Time-based access lists trigger CPU activity because the new configuration of the access list must be merged with other features and the combined configuration loaded into the TCAM. For this reason, you should be careful not to have several access lists configured to take affect in close succession (within a small number of minutes of each other.) Note The time range relies on the switch system clock; therefore, you need a reliable clock source. We recommend that you use Network Time Protocol (NTP) to synchronize the switch clock. For more information, see the “Managing the System Time and Date” section on page 7-1. Beginning in privileged EXEC mode, follow these steps to configure an time-range parameter for an ACL: Repeat the steps if you have multiple items that you want in effect at different times. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 time-range time-range-name Assign a meaningful name (for example, workhours) to the time range to be created, and enter time-range configuration mode. The name cannot contain a space or quotation mark and must begin with a letter. Step 3 absolute [start time date] [end time date] or periodic day-of-the-week hh:mm to [day-of-the-week] hh:mm or periodic {weekdays | weekend | daily} hh:mm to hh:mm Specify when the function it will be applied to is operational. • You can use only one absolute statement in the time range. If you configure more than one absolute statement, only the one configured last is executed. • You can enter multiple periodic statements. For example, you could configure different hours for weekdays and weekends. Refer to the example configurations. Step 4 end Return to privileged EXEC mode. Step 5 show time-range Verify the time-range configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs To remove a configured time-range limitation, use the no time-range time-range-name global configuration command. This example shows how to configure time ranges for workhours and for company holidays and to verify your configuration. Switch(config)# time-range workhours Switch(config-time-range)# periodic weekdays 8:00 to 12:00 Switch(config-time-range)# periodic weekdays 13:00 to 17:00 Switch(config-time-range)# exit Switch(config)# time-range new_year_day_2003 Switch(config-time-range)# absolute start 00:00 1 Jan 2003 end 23:59 1 Jan 2003 Switch(config-time-range)# exit Switch(config)# time-range thanksgiving_2003 Switch(config-time-range)# absolute start 00:00 27 Nov 2003 end 23:59 28 Nov 2003 Switch(config-time-range)# exit Switch(config)# time-range christmas_2003 Switch(config-time-range)# absolute start 00:00 24 Dec 2003 end 23:50 25 Dec 2003 Switch(config-time-range)# end Switch# show time-range time-range entry: christmas_2003 (inactive) absolute start 00:00 24 December 2003 end 23:50 25 December 2003 time-range entry: new_year_day_2003 (inactive) absolute start 00:00 01 January 2003 end 23:59 01 January 2003 time-range entry: thanksgiving_2000 (inactive) absolute start 00:00 22 November 2003 end 23:59 23 November 2003 time-range entry: workhours (inactive) periodic weekdays 8:00 to 12:00 periodic weekdays 13:00 to 17:00 To apply a time-range, enter the time-range name in an extended ACL that can implement time ranges. This example shows how to create and verify extended access list 188 that denies TCP traffic from any source to any destination during the defined holiday times and permits all TCP traffic during work hours. Switch(config)# access-list 188 deny tcp any any time-range new_year_day_2003 Switch(config)# access-list 188 deny tcp any any time-range thanskgiving_2003 Switch(config)# access-list 188 deny tcp any any time-range christmas_2003 Switch(config)# access-list 188 permit tcp any any time-range workhours Switch(config)# end Switch# show access-lists Extended IP access list 188 deny tcp any any time-range new_year_day_2003 (inactive) deny tcp any any time-range thanskgiving_2003 (active) deny tcp any any time-range christmas_2003 (inactive) permit tcp any any time-range workhours (inactive) This example uses named ACLs to permit and deny the same traffic. Switch(config)# ip access-list extended deny_access Switch(config-ext-nacl)# deny tcp any any time-range new_year_day_2003 Switch(config-ext-nacl)# deny tcp any any time-range thanksgiving_2003 Switch(config-ext-nacl)# deny tcp any any time-range christmas_2003 Switch(config-ext-nacl)# exit Switch(config)# ip access-list extended may_access Switch(config-ext-nacl)# permit tcp any any time-range workhours Switch(config-ext-nacl)# end Switch# show ip access-lists Extended IP access list deny_access deny tcp any any time-range new_year_day_2003 (inactive) deny tcp any any time-range thanksgiving_2003 (inactive) deny tcp any any time-range christmas_2003 (inactive) Extended IP access list may_access permit tcp any any time-range workhours (inactive) 26-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Including Comments in ACLs You can use the remark keyword to include comments (remarks) about entries in any IP standard or extended ACL. The remarks make the ACL easier for you to understand and scan. Each remark line is limited to 100 characters. The remark can go before or after a permit or deny statement. You should be consistent about where you put the remark so that it is clear which remark describes which permit or deny statement. For example, it would be confusing to have some remarks before the associated permit or deny statements and some remarks after the associated statements. To include a comment for IP numbered standard or extended ACLs, use the access-list access-list number remark remark global configuration command. To remove the remark, use the no form of this command. In this example, the workstation belonging to Jones is allowed access, and the workstation belonging to Smith is not allowed access: Switch(config)# access-list 1 remark Permit only Jones workstation through Switch(config)# access-list 1 permit 171.69.2.88 Switch(config)# access-list 1 remark Do not allow Smith workstation through Switch(config)# access-list 1 deny 171.69.3.13 For an entry in a named IP ACL, use the remark access-list configuration command. To remove the remark, use the no form of this command. In this example, the Jones subnet is not allowed to use outbound Telnet: Switch(config)# ip access-list extended telnetting Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out Switch(config-ext-nacl)# deny tcp host 171.69.2.88 any eq telnet Applying an IP ACL to a Terminal Line You can use numbered ACLs to control access to one or more terminal lines. You cannot apply named ACLs to lines. You must set identical restrictions on all the virtual terminal lines because a user can attempt to connect to any of them. For procedures for applying ACLs to interfaces, see the “Applying an IP ACL to an Interface” section on page 26-19. For applying ACLs to VLANs, see the “Configuring VLAN Maps” section on page 26-29. Beginning in privileged EXEC mode, follow these steps to restrict incoming and outgoing connections between a virtual terminal line and the addresses in an ACL: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 line [console | vty] line-number Identify a specific line to configure, and enter in-line configuration mode. • console—Specify the console terminal line. The console port is DCE. • vty—Specify a virtual terminal for remote console access. The line-number is the first line number in a contiguous group that you want to configure when the line type is specified. The range is from 0 to 16. Step 3 access-class access-list-number {in | out} Restrict incoming and outgoing connections between a particular virtual terminal line (into a device) and the addresses in an access list.26-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs To remove an ACL from a terminal line, use the no access-class access-list-number {in | out} line configuration command. Applying an IP ACL to an Interface This section describes how to apply IP ACLs to network interfaces. You can apply an ACL to either outbound or inbound Layer 3 interfaces. You can apply ACLs only to inbound Layer 2 interfaces. Note these guidelines: • When controlling access to an interface, you can use a named or numbered ACL. • If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the VLAN. Incoming packets received on the Layer 2 port are always filtered by the port ACL. • If you apply an ACL to a Layer 3 interface and routing is not enabled on the switch, the ACL only filters packets that are intended for the CPU, such as SNMP, Telnet, or web traffic. You do not have to enable routing to apply ACLs to Layer 2 interfaces. Note By default, the router sends Internet Control Message Protocol (ICMP) unreachable messages when a packet is denied by an access group. These access-group denied packets are not dropped in hardware but are bridged to the switch CPU so that it can generate the ICMP-unreachable message. Beginning in privileged EXEC mode, follow these steps to control access to an interface: To remove the specified access group, use the no ip access-group {access-list-number | name} {in | out} interface configuration command. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Display the access list configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Identify a specific interface for configuration, and enter interface configuration mode. The interface can be a Layer 2 interface (port ACL), or a Layer 3 interface (router ACL). Step 3 ip access-group {access-list-number | name} {in | out} Control access to the specified interface. The out keyword is not supported for Layer 2 interfaces (port ACLs). Step 4 end Return to privileged EXEC mode. Step 5 show running-config Display the access list configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs This example shows how to apply access list 2 on Gigabit Ethernet interface 1/0/3 on stack member 1 to filter packets entering the interface: Switch(config)# interface gigabitethernet1/0/3 Router(config-if)# ip access-group 2 in Note When you apply the ip access-group interface configuration command to a Layer 3 interface (an SVI, a Layer 3 EtherChannel, or a routed port), the interface must have been configured with an IP address. Layer 3 access groups filter packets that are routed or are received by Layer 3 processes on the CPU. They do not affect packets bridged within a VLAN. For inbound ACLs, after receiving a packet, the switch checks the packet against the ACL. If the ACL permits the packet, the switch continues to process the packet. If the ACL rejects the packet, the switch discards the packet. For outbound ACLs, after receiving and routing a packet to a controlled interface, the switch checks the packet against the ACL. If the ACL permits the packet, the switch sends the packet. If the ACL rejects the packet, the switch discards the packet. By default, the input interface sends ICMP Unreachable messages whenever a packet is discarded, regardless of whether the packet was discarded because of an ACL on the input interface or because of an ACL on the output interface. ICMP Unreachables are normally limited to no more than one every one-half second per input interface, but this can be changed by using the ip icmp rate-limit unreachable global configuration command. When you apply an undefined ACL to an interface, the switch acts as if the ACL has not been applied to the interface and permits all packets. Remember this behavior if you use undefined ACLs for network security. Hardware and Software Treatment of IP ACLs ACL processing is primarily accomplished in hardware, but requires forwarding of some traffic flows to the CPU for software processing. If the hardware reaches its capacity to store ACL configurations, packets are sent to the CPU for forwarding. The forwarding rate for software-forwarded traffic is substantially less than for hardware-forwarded traffic. Note If an ACL configuration cannot be implemented in hardware due to an out-of-resource condition on a stack member, then only the traffic in that VLAN arriving on that switch is affected (forwarded in software). Software forwarding of packets might adversely impact the performance of the switch stack, depending on the number of CPU cycles that this consumes. For router ACLs, other factors can cause packets to be sent to the CPU: • Using the log keyword • Generating ICMP unreachable messages When traffic flows are both logged and forwarded, forwarding is done by hardware, but logging must be done by software. Because of the difference in packet handling capacity between hardware and software, if the sum of all flows being logged (both permitted flows and denied flows) is of great enough bandwidth, not all of the packets that are forwarded can be logged. If router ACL configuration cannot be applied in hardware, packets arriving in a VLAN that must be routed are routed in software, but are bridged in hardware. If ACLs cause large numbers of packets to be sent to the CPU, the switch performance can be negatively affected.26-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs When you enter the show ip access-lists privileged EXEC command, the match count displayed does not account for packets that are access controlled in hardware. Use the show access-lists hardware counters privileged EXEC command to obtain some basic hardware ACL statistics for switched and routed packets. Router ACLs function as follows: • The hardware controls permit and deny actions of standard and extended ACLs (input and output) for security access control. • If log has not been specified, the flows that match a deny statement in a security ACL are dropped by the hardware if ip unreachables is disabled. The flows matching a permit statement are switched in hardware. • Adding the log keyword to an ACE in a router ACL causes a copy of the packet to be sent to the CPU for logging only. If the ACE is a permit statement, the packet is still switched and routed in hardware. IP ACL Configuration Examples This section provides examples of configuring and applying IP ACLs. For detailed information about compiling ACLs, refer to the Security Configuration Guide and the “IP Services” chapter of the Cisco IOS IP and IP Routing Configuration Guide for IOS Release 12.1. Figure 26-3 shows a small networked office environment with the routed port 1/0/2 connected to Server A, containing benefits and other information that all employees can access, and routed port 1/0/3 connected to Server B, containing confidential payroll data. All users can access Server A, but Server B has restricted access. Use router ACLs to do this in one of two ways: • Create a standard ACL, and filter traffic coming to the server from port 1/0/3. • Create an extended ACL, and filter traffic coming from the server into port 1/0/3.26-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Figure 26-3 Using Router ACLs to Control Traffic This example uses a standard ACL to filter traffic coming into Server B from Gigabit Ethernet port 3 on switch 1, permitting traffic only from Accounting’s source addresses 172.20.128.64 to 172.20.128.95. Switch(config)# access-list 6 permit 172.20.128.64 0.0.0.31 Switch(config)# end Switch# show access-lists Standard IP access list 6 permit 172.20.128.64, wildcard bits 0.0.0.31 Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# ip access-group 6 out The ACL is applied to traffic coming out of routed port 3 on switch 1 from the specified source address. This example uses an extended ACL to filter traffic coming from Server B into port 3 on switch 1, permitting traffic from any source address (in this case Server B) to only the Accounting destination addresses 172.20.128.64 to 172.20.128.95. Switch(config)# access-list 106 permit ip any 172.20.128.64 0.0.0.31 Switch(config)# end Switch# show access-lists Extended IP access list 106 permit ip any 172.20.128.64 0.0.0.31 Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# ip access-group 106 in The ACL is then applied to traffic going into routed port 3 on switch 1, permitting it to go only to the specified destination addresses. Note that with extended ACLs, you must enter the protocol (IP) before the source and destination information. Si Server A Benefits Server B Payroll Port 1/0/2 Port 1/0/3 Catalyst 3750 switch Accounting 172.20.128.64-95 Human Resources 172.20.128.0-31 8321926-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Numbered ACLs In this example, network 36.0.0.0 is a Class A network whose second octet specifies a subnet; that is, its subnet mask is 255.255.0.0. The third and fourth octets of a network 36.0.0.0 address specify a particular host. Using access list 2, the switch accepts one address on subnet 48 and reject all others on that subnet. The last line of the list shows that the switch accepts addresses on all other network 36.0.0.0 subnets. The ACL is then applied to packets entering Gigabit Ethernet interface 1 on switch 2. Switch(config)# access-list 2 permit 36.48.0.3 Switch(config)# access-list 2 deny 36.48.0.0 0.0.255.255 Switch(config)# access-list 2 permit 36.0.0.0 0.255.255.255 Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# ip access-group 2 in Extended ACLs In this example, the first line permits any incoming TCP connections with destination ports greater than 1023. The second line permits incoming TCP connections to the Simple Mail Transfer Protocol (SMTP) port of host 128.88.1.2. The third line permits incoming ICMP messages for error feedback. Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 gt 1023 Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25 Switch(config)# access-list 102 permit icmp any any Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# ip access-group 102 in For another example of using an extended ACL, suppose that you have a network connected to the Internet, and you want any host on the network to be able to form TCP connections to any host on the Internet. However, you do not want IP hosts to be able to form TCP connections to hosts on your network, except to the mail (SMTP) port of a dedicated mail host. SMTP uses TCP port 25 on one end of the connection and a random port number on the other end. The same port numbers are used throughout the life of the connection. Mail packets coming in from the Internet have a destination port of 25. Outbound packets have the port numbers reversed. Because the secure system of the network always accepts mail connections on port 25, the incoming and outgoing services are separately controlled. The ACL must be configured as an input ACL on the outbound interface and an output ACL on the inbound interface. In this example, the network is a Class B network with the address 128.88.0.0, and the mail host address is 128.88.1.2. The established keyword is used only for the TCP to show an established connection. A match occurs if the TCP datagram has the ACK or RST bits set, which show that the packet belongs to an existing connection. Gigabit Ethernet interface 0/1 on switch 1 is the interface that connects the router to the Internet. Switch(config)# access-list 102 permit tcp any 128.88.0.0 0.0.255.255 established Switch(config)# access-list 102 permit tcp any host 128.88.1.2 eq 25 Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip access-group 102 in26-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Named ACLs This example creates a standard ACL named internet_filter and an extended ACL named marketing_group. The internet_filter ACL allows all traffic from the source address 1.2.3.4. Switch(config)# ip access-list standard Internet_filter Switch(config-ext-nacl)# permit 1.2.3.4 Switch(config-ext-nacl)# exit The marketing_group ACL allows any TCP Telnet traffic to the destination address and wildcard 171.69.0.0 0.0.255.255 and denies any other TCP traffic. It permits ICMP traffic, denies UDP traffic from any source to the destination address range 171.69.0.0 through 179.69.255.255 with a destination port less than 1024, denies any other IP traffic, and provides a log of the result. Switch(config)# ip access-list extended marketing_group Switch(config-ext-nacl)# permit tcp any 171.69.0.0 0.0.255.255 eq telnet Switch(config-ext-nacl)# deny tcp any any Switch(config-ext-nacl)# permit icmp any any Switch(config-ext-nacl)# deny udp any 171.69.0.0 0.0.255.255 lt 1024 Switch(config-ext-nacl)# deny ip any any log Switch(config-ext-nacl)# exit The ACLs are applied to Gigabit Ethernet port 0/5 on switch 3, which is configured as a Layer 3 port, with the Internet_filter ACL applied to outgoing traffic and the marketing_group ACL applied to incoming traffic. Switch(config)# interface gigabitethernet3/0/5 Switch(config-if)# no switchport Switch(config-if)# ip address 2.0.5.1 255.255.255.0 Switch(config-if)# ip access-group Internet_filter out Switch(config-if)# ip access-group marketing_group in Time Range Applied to an IP ACL This example denies HTTP traffic on IP on Monday through Friday between the hours of 8:00 a.m. and 6:00 p.m (18:00). The example allows UDP traffic only on Saturday and Sunday from noon to 8:00 p.m. (20:00). Switch(config)# time-range no-http Switch(config)# periodic weekdays 8:00 to 18:00 ! Switch(config)# time-range udp-yes Switch(config)# periodic weekend 12:00 to 20:00 ! Switch(config)# ip access-list extended strict Switch(config-ext-nacl)# deny tcp any any eq www time-range no-http Switch(config-ext-nacl)# permit udp any any time-range udp-yes ! Switch(config-ext-nacl)# exit Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# ip access-group strict in26-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring IP ACLs Commented IP ACL Entries In this example of a numbered ACL, the workstation belonging to Jones is allowed access, and the workstation belonging to Smith is not allowed access: Switch(config)# access-list 1 remark Permit only Jones workstation through Switch(config)# access-list 1 permit 171.69.2.88 Switch(config)# access-list 1 remark Do not allow Smith workstation through Switch(config)# access-list 1 deny 171.69.3.13 In this example of a numbered ACL, the Winter and Smith workstations are not allowed to browse the web: Switch(config)# access-list 100 remark Do not allow Winter to browse the web Switch(config)# access-list 100 deny host 171.69.3.85 any eq www Switch(config)# access-list 100 remark Do not allow Smith to browse the web Switch(config)# access-list 100 deny host 171.69.3.13 any eq www In this example of a named ACL, the Jones subnet is not allowed access: Switch(config)# ip access-list standard prevention Switch(config-std-nacl)# remark Do not allow Jones subnet through Switch(config-std-nacl)# deny 171.69.0.0 0.0.255.255 In this example of a named ACL, the Jones subnet is not allowed to use outbound Telnet: Switch(config)# ip access-list extended telnetting Switch(config-ext-nacl)# remark Do not allow Jones subnet to telnet out Switch(config-ext-nacl)# deny tcp 171.69.0.0 0.0.255.255 any eq telnet ACL Logging Two variations of logging are supported on router ACLs. The log keyword sends an informational logging message to the console about the packet that matches the entry; the log-input keyword includes the input interface in the log entry. In this example, standard named access list stan1 denies traffic from 10.1.1.0 0.0.0.255, allows traffic from all other sources, and includes the log keyword. Switch(config)# ip access-list standard stan1 Switch(config-std-nacl)# deny 10.1.1.0 0.0.0.255 log Switch(config-std-nacl)# permit any log Switch(config-std-nacl)# exit Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip access-group stan1 in Switch(config-if)# end Switch# show logging Syslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Console logging: level debugging, 37 messages logged Monitor logging: level debugging, 0 messages logged Buffer logging: level debugging, 37 messages logged File logging: disabled Trap logging: level debugging, 39 message lines logged Log Buffer (4096 bytes): 00:00:48: NTP: authentication delay calculation problems

00:09:34:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet 00:09:59:%SEC-6-IPACCESSLOGS:list stan1 denied 10.1.1.15 1 packet 00:10:11:%SEC-6-IPACCESSLOGS:list stan1 permitted 0.0.0.0 1 packet26-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Creating Named MAC Extended ACLs This example is a named extended access list ext1 that permits ICMP packets from any source to 10.1.1.0 0.0.0.255 and denies all UDP packets. Switch(config)# ip access-list extended ext1 Switch(config-ext-nacl)# permit icmp any 10.1.1.0 0.0.0.255 log Switch(config-ext-nacl)# deny udp any any log Switch(config-std-nacl)# exit Switch(config)# interface gigabitethernet1/0/3 Switch(config-if)# ip access-group ext1 in This is a an example of a log for an extended ACL: 01:24:23:%SEC-6-IPACCESSLOGDP:list ext1 permitted icmp 10.1.1.15 -> 10.1.1.61 (0/0), 1 packet 01:25:14:%SEC-6-IPACCESSLOGDP:list ext1 permitted icmp 10.1.1.15 -> 10.1.1.61 (0/0), 7 packets 01:26:12:%SEC-6-IPACCESSLOGP:list ext1 denied udp 0.0.0.0(0) -> 255.255.255.255(0), 1 packet 01:31:33:%SEC-6-IPACCESSLOGP:list ext1 denied udp 0.0.0.0(0) -> 255.255.255.255(0), 8 packets Note that all logging entries for IP ACLs start with %SEC-6-IPACCESSLOG with minor variations in format depending on the kind of ACL and the access entry that has been matched. This is an example of an output message when the log-input keyword is entered: 00:04:21:%SEC-6-IPACCESSLOGDP:list inputlog permitted icmp 10.1.1.10 (Vlan1 0001.42ef.a400) -> 10.1.1.61 (0/0), 1 packet A log message for the same sort of packet using the log keyword does not include the input interface information: 00:05:47:%SEC-6-IPACCESSLOGDP:list inputlog permitted icmp 10.1.1.10 -> 10.1.1.61 (0/0), 1 packet Creating Named MAC Extended ACLs You can filter non-IP traffic on a VLAN or on a Layer 2 interface by using MAC addresses and named MAC extended ACLs. The procedure is similar to that of configuring other extended named ACLs. Note You cannot apply named MAC extended ACLs to Layer 3 interfaces. For more information about the supported non-IP protocols in the mac access-list extended command, refer to the command reference for this release. Note Though visible in the command-line help strings, appletalk is not supported as a matching condition for the deny and permit MAC access-list configuration mode commands.26-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Creating Named MAC Extended ACLs Beginning in privileged EXEC mode, follow these steps to create a named MAC extended ACL: Use the no mac access-list extended name global configuration command to delete the entire ACL. You can also delete individual ACEs from named MAC extended ACLs. This example shows how to create and display an access list named mac1, denying only EtherType DECnet Phase IV traffic, but permitting all other types of traffic. Switch(config)# mac access-list extended mac1 Switch(config-ext-macl)# deny any any decnet-iv Switch(config-ext-macl)# permit any any Switch(config-ext-macl)# end Switch # show access-lists Extended MAC access list mac1 deny any any decnet-iv permit any any Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mac access-list extended name Define an extended MAC access list using a name. Step 3 {deny | permit} {any | host source MAC address | source MAC address mask} {any | host destination MAC address | destination MAC address mask} [type mask | lsap lsap mask | aarp | amber | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | mop-console | mop-dump | msdos | mumps | netbios | vines-echo |vines-ip | xns-idp | 0-65535] [cos cos] In extended MAC access-list configuration mode, specify to permit or deny any source MAC address, a source MAC address with a mask, or a specific host source MAC address and any destination MAC address, destination MAC address with a mask, or a specific destination MAC address. (Optional) You can also enter these options: • type mask—An arbitrary EtherType number of a packet with Ethernet II or SNAP encapsulation in decimal, hex, or octal with optional mask of don’t care bits applied to the EtherType before testing for a match. • lsap lsap mask—An LSAP number of a packet with 802.2 encapsulation in decimal, hex, or octal with optional mask of don’t care bits. • aarp | amber | dec-spanning | decnet-iv | diagnostic | dsm | etype-6000 | etype-8042 | lat | lavc-sca | mop-console | mop-dump | msdos | mumps | netbios | vines-echo |vines-ip | xns-idp—A non-IP protocol. • cos cos—An IEEE 802.1Q cost of service number from 0 to 7 used to set priority. Step 4 end Return to privileged EXEC mode. Step 5 show access-lists [number | name] Show the access list configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Creating Named MAC Extended ACLs Applying a MAC ACL to a Layer 2 Interface After you create a MAC ACL, you can apply it to a Layer 2 interface to filter non-IP traffic coming in that interface. When you apply the MAC ACL, consider these guidelines: • If you apply an ACL to a Layer 2 interface that is a member of a VLAN, the Layer 2 (port) ACL takes precedence over an input Layer 3 ACL applied to the VLAN interface or a VLAN map applied to the VLAN. Incoming packets received on the Layer 2 port are always filtered by the port ACL. • You can apply no more than one IP access list and one MAC access list to the same Layer 2 interface. The IP access list filters only IP packets, and the MAC access list filters non-IP packets. • A Layer 2 interface can have only one MAC access list. If you apply a MAC access list to a Layer 2 interface that has a MAC ACL configured, the new ACL replaces the previously configured one. Beginning in privileged EXEC mode, follow these steps to apply a MAC access list to control access to a Layer 2 interface: To remove the specified access group, use the no mac access-group {name} interface configuration command. This example shows how to apply MAC access list mac1 on Gigabit Ethernet interface 1/0/3 to filter packets entering the interface: Switch(config)# interface gigabitethernet1/0/3 Router(config-if)# mac access-group mac1 in Note The mac access-group interface configuration command is only valid when applied to a physical Layer 2 interface.You cannot use the command on EtherChannel port channels. After receiving a packet, the switch checks it against the inbound ACL. If the ACL permits it, the switch continues to process the packet. If the ACL rejects the packet, the switch discards it. When you apply an undefined ACL to an interface, the switch acts as if the ACL has not been applied and permits all packets. Remember this behavior if you use undefined ACLs for network security. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Identify a specific interface, and enter interface configuration mode. The interface must be a physical Layer 2 interface (port ACL). Step 3 mac access-group {name} {in} Control access to the specified interface by using the MAC access list. Note Port ACLs are supported only in the inbound direction. Step 4 end Return to privileged EXEC mode. Step 5 show mac access-group [interface interface-id] Display the MAC access list applied to the interface or all Layer 2 interfaces. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.26-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps Configuring VLAN Maps This section describes how to configure VLAN maps, which is the only way to control filtering within a VLAN. VLAN maps have no direction. To filter traffic in a specific direction by using a VLAN map, you need to include an ACL with specific source or destination addresses. If there is a match clause for that type of packet (IP or MAC) in the VLAN map, the default action is to drop the packet if the packet does not match any of the entries within the map. If there is no match clause for that type of packet, the default is to forward the packet. Note For complete syntax and usage information for the commands used in this section, refer to the command reference for this release. To create a VLAN map and apply it to one or more VLANs, perform these steps: Step 1 Create the standard or extended IP ACLs or named MAC extended ACLs that you want to apply to the VLAN. See the “Creating Standard and Extended IP ACLs” section on page 26-7 and the “Creating a VLAN Map” section on page 26-30. Step 2 Enter the vlan access-map global configuration command to create a VLAN ACL map entry. Step 3 In access map configuration mode, optionally enter an action—forward (the default) or drop—and enter the match command to specify an IP packet or a non-IP packet (with only a known MAC address) and to match the packet against one or more ACLs (standard or extended). Note If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not match the type, the default is to drop the packet. If there is no match clause in the VLAN map for that type of packet, and no action specified, the packet is forwarded. Step 4 Use the vlan filter global configuration command to apply a VLAN map to one or more VLANs. This section contains these topics: • VLAN Map Configuration Guidelines, page 26-29 • Creating a VLAN Map, page 26-30 • Applying a VLAN Map to a VLAN, page 26-33 • Using VLAN Maps in Your Network, page 26-33 VLAN Map Configuration Guidelines Follow these guidelines when configuring VLAN maps: • If there is no ACL configured to deny traffic on an interface and no VLAN map is configured, all traffic is permitted. • Each VLAN map consists of a series of entries. The order of entries in an VLAN map is important. A packet that comes into the switch is tested against the first entry in the VLAN map. If it matches, the action specified for that part of the VLAN map is taken. If there is no match, the packet is tested against the next entry in the map.26-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps • If the VLAN map has at least one match clause for the type of packet (IP or MAC) and the packet does not match any of these match clauses, the default is to drop the packet. If there is no match clause for that type of packet in the VLAN map, the default is to forward the packet. • The system might take longer to boot if you have configured a very large number of ACLs. • Logging is not supported for VLAN maps. • If VLAN map configuration cannot be applied in hardware, all packets in that VLAN must be bridged and routed by software. • When a switch has an IP access list or MAC access list applied to a Layer 2 interface, and you apply a VLAN map to a VLAN that the port belongs to, the port ACL takes precedence over the VLAN map. • See the “Using VLAN Maps in Your Network” section on page 26-33 for configuration examples. • For information about using both router ACLs and VLAN maps, see the “Guidelines” section on page 26-36. Creating a VLAN Map Each VLAN map consists of an ordered series of entries. Beginning in privileged EXEC mode, follow these steps to create, add to, or delete a VLAN map entry: Use the no vlan access-map name global configuration command to delete a map. Use the no vlan access-map name number global configuration command to delete a single sequence entry from within the map. Use the no action access-map configuration command to enforce the default action, which is to forward. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vlan access-map name [number] Create a VLAN map, and give it a name and (optionally) a number. The number is the sequence number of the entry within the map. When you create VLAN maps with the same name, numbers are assigned sequentially in increments of 10. When modifying or deleting maps, you can enter the number of the map entry that you want to modify or delete. Entering this command changes to access-map configuration mode. Step 3 action {drop | forward} (Optional) Set the action for the map entry. The default is to forward. Step 4 match {ip | mac} address {name | number} [name | number] Match the packet (using either the IP or MAC address) against one or more standard or extended access lists. Note that packets are only matched against access lists of the correct protocol type. IP packets are matched against standard or extended IP access lists. Non-IP packets are only matched against named MAC extended access lists. Step 5 end Return to global configuration mode. Step 6 show running-config Display the access list configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.26-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps VLAN maps do not use the specific permit or deny keywords. To deny a packet by using VLAN maps, create an ACL that would match the packet, and set the action to drop. A permit in the ACL counts as a match. A deny in the ACL means no match. Examples of ACLs and VLAN Maps These examples show how to create ACLs and VLAN maps that for specific purposes. Example 1 This example shows how to create an ACL and a VLAN map to deny a packet. In the first map, any packets that match the ip1 ACL (TCP packets) would be dropped. You first create the ip1ACL to permit any TCP packet and no other packets. Because there is a match clause for IP packets in the VLAN map, the default action is to drop any IP packet that does not match any of the match clauses. Switch(config)# ip access-list extended ip1 Switch(config-ext-nacl)# permit tcp any any Switch(config-ext-nacl)# exit Switch(config)# vlan access-map map_1 10 Switch(config-access-map)# match ip address ip1 Switch(config-access-map)# action drop This example shows how to create a VLAN map to permit a packet. ACL ip2 permits UDP packets and any packets that match the ip2 ACL are forwarded. In this map, any IP packets that did not match any of the previous ACLs (that is, packets that are not TCP packets or UDP packets) would get dropped. Switch(config)# ip access-list extended ip2 Switch(config-ext-nacl)# permit udp any any Switch(config-ext-nacl)# exit Switch(config)# vlan access-map map_1 20 Switch(config-access-map)# match ip address ip2 Switch(config-access-map)# action forward Example 2 In this example, the VLAN map has a default action of drop for IP packets and a default action of forward for MAC packets. Used with standard ACL 101 and extended named access lists igmp-match and tcp-match, the map will have the following results: • Forward all UDP packets • Drop all IGMP packets • Forward all TCP packets • Drop all other IP packets • Forward all non-IP packets Switch(config)# access-list 101 permit udp any any Switch(config)# ip access-list extended igmp-match Switch(config-ext-nacl)# permit igmp any any Switch(config)# ip access-list extended tcp-match Switch(config-ext-nacl)# permit tcp any any Switch(config-ext-nacl)# exit Switch(config)# vlan access-map drop-ip-default 10 Switch(config-access-map)# match ip address 101 Switch(config-access-map)# action forward Switch(config-access-map)# exit Switch(config)# vlan access-map drop-ip-default 20 Switch(config-access-map)# match ip address igmp-match26-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps Switch(config-access-map)# action drop Switch(config-access-map)# exit Switch(config)# vlan access-map drop-ip-default 30 Switch(config-access-map)# match ip address tcp-match Switch(config-access-map)# action forward Example 3 In this example, the VLAN map has a default action of drop for MAC packets and a default action of forward for IP packets. Used with MAC extended access lists good-hosts and good-protocols, the map will have the following results: • Forward MAC packets from hosts 0000.0c00.0111 and 0000.0c00.0211 • Forward MAC packets with decnet-iv or vines-ip protocols • Drop all other non-IP packets • Forward all IP packets Switch(config)# mac access-list extended good-hosts Switch(config-ext-macl)# permit host 000.0c00.0111 any Switch(config-ext-macl)# permit host 000.0c00.0211 any Switch(config-ext-nacl)# exit Switch(config)# mac access-list extended good-protocols Switch(config-ext-macl)# permit any any decnet-ip Switch(config-ext-macl)# permit any any vines-ip Switch(config-ext-nacl)# exit Switch(config)# vlan access-map drop-mac-default 10 Switch(config-access-map)# match mac address good-hosts Switch(config-access-map)# action forward Switch(config-access-map)# exit Switch(config)# vlan access-map drop-mac-default 20 Switch(config-access-map)# match mac address good-protocols Switch(config-access-map)# action forward Example 4 In this example, the VLAN map has a default action of drop for all packets (IP and non-IP). Used with access lists tcp-match and good-hosts from Examples 2 and 3, the map will have the following results: • Forward all TCP packets • Forward MAC packets from hosts 0000.0c00.0111 and 0000.0c00.0211 • Drop all other IP packets • Drop all other MAC packets Switch(config)# vlan access-map drop-all-default 10 Switch(config-access-map)# match ip address tcp-match Switch(config-access-map)# action forward Switch(config-access-map)# exit Switch(config)# vlan access-map drop-all-default 20 Switch(config-access-map)# match mac address good-hosts Switch(config-access-map)# action forward26-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps Applying a VLAN Map to a VLAN Beginning in privileged EXEC mode, follow these steps to apply a VLAN map to one or more VLANs: To remove the VLAN map, use the no vlan filter mapname vlan-list list global configuration command. This example shows how to apply VLAN map 1 to VLANs 20 through 22: Switch(config)# vlan filter map 1 vlan-list 20-22 Using VLAN Maps in Your Network This section describes some typical uses for VLAN maps and includes these topics: • Wiring Closet Configuration, page 26-33 • Denying Access to a Server on Another VLAN, page 26-35 Wiring Closet Configuration In a wiring closet configuration, routing might not be enabled on the switch. In this configuration, the switch can still support a VLAN map and a QoS classification ACL. In Figure 26-4, assume that Host X and Host Y are in different VLANs and are connected to wiring closet switches A and C. Traffic from Host X to Host Y is eventually being routed by Switch B, which has routing enabled. Traffic from Host X to Host Y can be access-controlled at the traffic entry point, Switch A. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 vlan filter mapname vlan-list list Apply the VLAN map to one or more VLAN IDs. The list can be a single VLAN ID (22), a consecutive list (10-22), or a string of VLAN IDs (12, 22, 30). Spaces around the comma and hyphen are optional. Step 3 show running-config Display the access list configuration. Step 4 copy running-config startup-config (Optional) Save your entries in the configuration file.26-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps Figure 26-4 Wiring Closet Configuration If you do not want HTTP traffic switched from Host X to Host Y, you can configure a VLAN map on Switch A to drop all HTTP traffic from Host X (IP address 10.1.1.32) to Host Y (IP address 10.1.1.34) at Switch A and not bridge it to Switch B. First, define the IP access list http that permits (matches) any TCP traffic on the HTTP port. Switch(config)# ip access-list extended http Switch(config-ext-nacl)# permit tcp host 10.1.1.32 host 10.1.1.34 eq www Switch(config-ext-nacl)# exit Next, create VLAN access map map2 so that traffic that matches the http access list is dropped and all other IP traffic is forwarded. Switch(config)# vlan access-map map2 10 Switch(config-access-map)# match ip address http Switch(config-access-map)# action drop Switch(config-access-map)# exit Switch(config)# ip access-list extended match_all Switch(config-ext-nacl)# permit ip any any Switch(config-ext-nacl)# exit Switch(config)# vlan access-map map2 20 Switch(config-access-map)# match ip address match_all Switch(config-access-map)# action forward Then, apply VLAN access map map2 to VLAN 1. Switch(config)# vlan filter map2 vlan 1 Catalyst 3750 switch Switch A Switch C Switch B VLAN map: Deny HTTP from X to Y. HTTP is dropped at entry point. Host X 10.1.1.32 Host Y 10.1.1.34 VLAN 1 VLAN 2 Packet 83220 Si26-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Configuring VLAN Maps Denying Access to a Server on Another VLAN You can restrict access to a server on another VLAN. For example, server 10.1.1.100 in VLAN 10 needs to have access denied to these hosts (see Figure 26-5): • Hosts in subnet 10.1.2.0/8 in VLAN 20 should not have access. • Hosts 10.1.1.4 and 10.1.1.8 in VLAN 10 should not have access. Figure 26-5 Deny Access to a Server on Another VLAN This example shows how to deny access to a server on another VLAN by creating the VLAN map SERVER 1 that denies access to hosts in subnet 10.1.2.0/8, host 10.1.1.4, and host 10.1.1.8 and permits other IP traffic. The final step is to apply the map SERVER1 to VLAN 10. Step 1 Define the IP ACL that will match the correct packets. Switch(config)# ip access-list extended SERVER1_ACL Switch(config-ext-nacl))# permit ip 10.1.2.0 0.0.0.255 host 10.1.1.100 Switch(config-ext-nacl))# permit ip host 10.1.1.4 host 10.1.1.100 Switch(config-ext-nacl))# permit ip host 10.1.1.8 host 10.1.1.100 Switch(config-ext-nacl))# exit Step 2 Define a VLAN map using this ACL that will drop IP packets that match SERVER1_ACL and forward IP packets that do not match the ACL. Switch(config)# vlan access-map SERVER1_MAP Switch(config-access-map)# match ip address SERVER1_ACL Switch(config-access-map)# action drop Switch(config)# vlan access-map SERVER1_MAP 20 Switch(config-access-map)# action forward Switch(config-access-map)# exit Step 3 Apply the VLAN map to VLAN 10. Switch(config)# vlan filter SERVER1_MAP vlan-list 10. Catalyst 3750 switch Host (VLAN 20) Host (VLAN 10) Host (VLAN 10) Server (VLAN 10) 83221 VLAN map Subnet 10.1.2.0/8 10.1.1.100 10.1.1.4 10.1.1.8 Packet26-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Using VLAN Maps with Router ACLs Using VLAN Maps with Router ACLs To access control both bridged and routed traffic, you can use VLAN maps only or a combination of router ACLs and VLAN maps. You can define router ACLs on both input and output routed VLAN interfaces, and you can define a VLAN map to access control the bridged traffic. If a packet flow matches a VLAN-map deny clause in the ACL, regardless of the router ACL configuration, the packet flow is denied. Note When you use router ACLs with VLAN maps, packets that require logging on the router ACLs are not logged if they are denied by a VLAN map. If the VLAN map has a match clause for the type of packet (IP or MAC) and the packet does not match the type, the default is to drop the packet. If there is no match clause in the VLAN map, and no action specified, the packet is forwarded if it does not match any VLAN map entry. This section includes this information about using VLAN maps with router ACLs: • Guidelines, page 26-36 • Examples of Router ACLs and VLAN Maps Applied to VLANs, page 26-37 Guidelines These guidelines are for configurations where you need to have an router ACL and a VLAN map on the same VLAN. These guidelines do not apply to configurations where you are mapping router ACLs and VLAN maps on different VLANs. The switch hardware provides one lookup for security ACLs for each direction (input and output); therefore, you must merge a router ACL and a VLAN map when they are configured on the same VLAN. Merging the router ACL with the VLAN map might significantly increase the number of ACEs. If you must configure a router ACL and a VLAN map on the same VLAN, use these guidelines for both router ACL and VLAN map configuration: • You can configure only one VLAN map and one router ACL in each direction (input/output) on a VLAN interface. • Whenever possible, try to write the ACL with all entries having a single action except for the final, default action of the other type. That is, write the ACL using one of these two forms: permit... permit... permit... deny ip any any or deny... deny... deny... permit ip any any • To define multiple actions in an ACL (permit, deny), group each action type together to reduce the number of entries.26-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Using VLAN Maps with Router ACLs • Avoid including Layer 4 information in an ACL; adding this information complicates the merging process. The best merge results are obtained if the ACLs are filtered based on IP addresses (source and destination) and not on the full flow (source IP address, destination IP address, protocol, and protocol ports). It is also helpful to use don’t care bits in the IP address, whenever possible. If you need to specify the full-flow mode and the ACL contains both IP ACEs and TCP/UDP/ICMP ACEs with Layer 4 information, put the Layer 4 ACEs at the end of the list. This gives priority to the filtering of traffic based on IP addresses. Examples of Router ACLs and VLAN Maps Applied to VLANs This section gives examples of applying router ACLs and VLAN maps to a VLAN for switched, bridged, routed, and multicast packets. Although the following illustrations show packets being forwarded to their destination, each time the packet’s path crosses a line indicating a VLAN map or an ACL, it is also possible that the packet might be dropped, rather than forwarded. ACLs and Switched Packets Figure 26-6 shows how an ACL is applied on packets that are switched within a VLAN. Packets switched within the VLAN without being routed or forwarded by fallback bridging are only subject to the VLAN map of the input VLAN. Figure 26-6 Applying ACLs on Switched Packets VLAN 10 map Frame Input router ACL Output router ACL Routing function or fallback bridge Catalyst 3750 switch VLAN 10 VLAN 20 Host C (VLAN 10) Host A (VLAN 10) VLAN 20 map Packet 8322226-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Using VLAN Maps with Router ACLs ACLs and Bridged Packets Figure 26-7 shows how an ACL is applied on fallback-bridged packets. For bridged packets, only Layer 2 ACLs are applied to the input VLAN. Only non-IP, non-ARP packets can be fallback-bridged. Figure 26-7 Applying ACLs on Bridged Packets Frame Fallback bridge VLAN 10 Host A (VLAN 10) Packet 83225 Catalyst 3750 switch VLAN 20 Host B (VLAN 20) VLAN 10 map VLAN 20 map26-39 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Using VLAN Maps with Router ACLs ACLs and Routed Packets Figure 26-8 shows how ACLs are applied on routed packets. For routed packets, the ACLs are applied in this order: 1. VLAN map for input VLAN 2. Input router ACL 3. Output router ACL 4. VLAN map for output VLAN Figure 26-8 Applying ACLs on Routed Packets Frame Routing function VLAN 10 Host A (VLAN 10) Packet 83224 Catalyst 3750 switch VLAN 20 Host B (VLAN 20) VLAN 10 map Input router ACL Output router ACL VLAN 20 map26-40 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Using VLAN Maps with Router ACLs ACLs and Multicast Packets Figure 26-9 shows how ACLs are applied on packets that are replicated for IP multicasting. A multicast packet being routed has two different kinds of filters applied: one for destinations that are other ports in the input VLAN and another for each of the destinations that are in other VLANs to which the packet has been routed. The packet might be routed to more than one output VLAN, in which case a different router output ACL and VLAN map would apply for each destination VLAN. The final result is that the packet might be permitted in some of the output VLANs and not in others. A copy of the packet is forwarded to those destinations where it is permitted. However, if the input VLAN map (VLAN 10 map in Figure 26-9) drops the packet, no destination receives a copy of the packet. Figure 26-9 Applying ACLs on Multicast Packets VLAN 10 map Frame Input router ACL Output router ACL Routing function Catalyst 3750 switch VLAN 10 VLAN 20 Host C (VLAN 10) Host A (VLAN 10) Host B (VLAN 20) VLAN 20 map Packet 8322326-41 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Displaying ACL Configuration Displaying ACL Configuration You can display the ACLs that are configured on the switch, and you can display the ACLs that have been applied to interfaces and VLANs. When you use the ip access-group interface configuration command to apply ACLs to a Layer 2 or 3 interface, you can display the access groups on the interface. You can also display the MAC ACLs applied to a Layer 2 interface. You can use the privileged EXEC commands as described in Table 26-2 to display this information. You can also display information about VLAN access maps or VLAN filters. Use the privileged EXEC commands in Table 26-3 to display VLAN map information. Table 26-2 Commands for Displaying Access Lists and Access Groups Command Purpose show access-lists [number | name] Display the contents of one or all current IP and MAC address access lists or a specific access list (numbered or named). show ip access-lists [number | name] Display the contents of all current IP access lists or a specific IP access list (numbered or named). show ip interface interface-id Display detailed configuration and status of an interface. If IP is enabled on the interface and ACLs have been applied by using the ip access-group interface configuration command, the access groups are included in the display. show running-config [interface interface-id] Displays the contents of the configuration file for the switch or the specified interface, including all configured MAC and IP access lists and which access groups are applied to an interface. show mac access-group [interface interface-id] Displays MAC access lists applied to all Layer 2 interfaces or the specified Layer 2 interface. Table 26-3 Commands for Displaying VLAN Map Information Command Purpose show vlan access-map [mapname] Show information about all VLAN access-maps or the specified access map. show vlan filter [access-map name | vlan vlan-id] Show information about all VLAN filters or about a specified VLAN or VLAN access map.26-42 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 26 Configuring Network Security with ACLs Displaying ACL ConfigurationC H A P T E R 27-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 27 Configuring QoS This chapter describes how to configure quality of service (QoS) by using automatic QoS (auto-QoS) commands or by using standard QoS commands on the Catalyst 3750 switch. With QoS, you can provide preferential treatment to certain traffic at the expense of others. Without QoS, the switch offers best-effort service to each packet, regardless of the packet contents or size. It sends the packets without any assurance of reliability, delay bounds, or throughput. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference this release. This chapter consists of these sections: • Understanding QoS, page 27-1 • Configuring Auto-QoS, page 27-18 • Displaying Auto-QoS Information, page 27-26 • Configuring Standard QoS, page 27-26 • Displaying Standard QoS Information, page 27-64 Understanding QoS Typically, networks operate on a best-effort delivery basis, which means that all traffic has equal priority and an equal chance of being delivered in a timely manner. When congestion occurs, all traffic has an equal chance of being dropped. When you configure the QoS feature, you can select specific network traffic, prioritize it according to its relative importance, and use congestion-management and congestion-avoidance techniques to provide preferential treatment. Implementing QoS in your network makes network performance more predictable and bandwidth utilization more effective. The QoS implementation is based on the Differentiated Services (Diff-Serv) architecture, an emerging standard from the Internet Engineering Task Force (IETF). This architecture specifies that each packet is classified upon entry into the network. 27-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS The classification is carried in the IP packet header, using 6 bits from the deprecated IP type of service (TOS) field to carry the classification (class) information. Classification can also be carried in the Layer 2 frame. These special bits in the Layer 2 frame or a Layer 3 packet are described here and shown in Figure 27-1: • Prioritization bits in Layer 2 frames: Layer 2 Inter-Switch Link (ISL) frame headers have a 1-byte User field that carries an IEEE 802.1P class of service (CoS) value in the three least-significant bits. On interfaces configured as Layer 2 ISL trunks, all traffic is in ISL frames. Layer 2 802.1Q frame headers have a 2-byte Tag Control Information field that carries the CoS value in the three most-significant bits, which are called the User Priority bits. On interfaces configured as Layer 2 802.1Q trunks, all traffic is in 802.1Q frames except for traffic in the native VLAN. Other frame types cannot carry Layer 2 CoS values. Layer 2 CoS values range from 0 for low priority to 7 for high priority. • Prioritization bits in Layer 3 packets: Layer 3 IP packets can carry either an IP precedence value or a Differentiated Services Code Point (DSCP) value. QoS supports the use of either value because DSCP values are backward-compatible with IP precedence values. IP precedence values range from 0 to 7. DSCP values range from 0 to 63. Figure 27-1 QoS Classification Layers in Frames and Packets Note Layer 3 IPv6 packets are treated as non-IP packets and are bridged by the switch. 46974 Encapsulated Packet Layer 2 header IP header 3 bits used for CoS Data Layer 2 ISL Frame ISL header (26 bytes) Encapsulated frame 1... (24.5 KB) FCS (4 bytes) Layer 2 802.1Q/P Frame Preamble Start frame delimiter DA Len SA Ta g PT Data FCS Layer 3 IPv4 Packet Version length To S (1 byte) ID Offset TTL Proto FCS IP-SA IP-DA Data 3 bits used for CoS (user priority) IP precedence or DSCP27-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS All switches and routers that access the Internet rely on the class information to provide the same forwarding treatment to packets with the same class information and different treatment to packets with different class information. The class information in the packet can be assigned by end hosts or by switches or routers along the way, based on a configured policy, detailed examination of the packet, or both. Detailed examination of the packet is expected to happen closer to the edge of the network so that the core switches and routers are not overloaded with this task. Switches and routers along the path can use the class information to limit the amount of resources allocated per traffic class. The behavior of an individual device when handling traffic in the DiffServ architecture is called per-hop behavior. If all devices along a path provide a consistent per-hop behavior, you can construct an end-to-end QoS solution. Implementing QoS in your network can be a simple or complex task and depends on the QoS features offered by your internetworking devices, the traffic types and patterns in your network, and the granularity of control that you need over incoming and outgoing traffic. Basic QoS Model To implement QoS, the switch must distinguish packets or flow from one another (classify), assign a label to indicate the given quality of service as the packets move through the switch, make the packets comply with the configured resource usage limits (police and mark), and provide different treatment (queue and schedule) in all situations where resource contention exists. The switch also needs to ensure that traffic sent from it meets a specific traffic profile (shape). Figure 27-2 shows the basic QoS model. Actions at the ingress interface include classifying traffic, policing, marking, queueing, and scheduling: • Classification is the process of generating a distinct path for a packet by associating it with a QoS label. The switch maps the CoS or DSCP in the packet to a QoS label to distinguish one kind of traffic from another. The QoS label that is generated identifies all future QoS actions to be performed on this packet. For more information, see the “Classification” section on page 27-4. • Policing determines whether a packet is in or out of profile by comparing the rate of the incoming traffic to the configured policer. The policer limits the bandwidth consumed by a flow of traffic. The result of this determination is passed to the marker. For more information, see the “Policing and Marking” section on page 27-8. • Marking evaluates the policer and configuration information for the action to be taken when a packet is out of profile and decides what to do with the packet (pass through a packet without modification, mark down the QoS label in the packet, or drop the packet). For more information, see the “Policing and Marking” section on page 27-8. • Queueing evaluates the QoS label and the corresponding DSCP or CoS value to determine into which of the two ingress queues to place a packet. Queueing is enhanced with the weighted tail-drop (WTD) algorithm, a congestion-avoidance mechanism. If the threshold is exceeded, the packet is dropped. For more information, see the “Queueing and Scheduling Overview” section on page 27-11. • Scheduling services the queues based on their configured shaped round robin (SRR) weights. One of the ingress queues is the priority queue, and SRR services it for its configured share before servicing the other queue. For more information, see the “SRR Shaping and Sharing” section on page 27-12.27-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Actions at the egress interface include queueing and scheduling: • Queueing evaluates the QoS label and the corresponding DSCP or CoS value to determine into which of the four egress queues to place a packet. Because congestion can occur when multiple ingress ports simultaneously send data to an egress port, WTD is used to differentiate traffic classes and to subject the packets to different thresholds based on the QoS label. If the threshold is exceeded, the packet is dropped. For more information, see the “Queueing and Scheduling Overview” section on page 27-11. • Scheduling services the four egress queues based on their configured SRR shared or shaped weights. Figure 27-2 Basic QoS Model Classification Classification is the process of distinguishing one kind of traffic from another by examining the fields in the packet. Classification is enabled only if QoS is globally enabled on the switch. By default, QoS is globally disabled, so no classification occurs. Note Classification occurs only on a physical interface basis. No support exists for classifying packets at the VLAN or the switch virtual interface level. During classification, the switch performs a lookup and assigns a QoS label to the packet. The QoS label identifies all QoS actions to be performed on the packet and from which queue the packet is sent. The QoS label is based on the DSCP or the CoS value in the packet and determines the queueing and scheduling actions to perform on the packet. The label is mapped according to the trust setting and the packet type as shown in Figure 27-3 on page 27-6. 86682 Classification Policing Generate QoS label Actions at ingress Actions at egress Mark In profile or out of profile Inspect packet and determine the QoS label based on ACLs or the configuration. Compare the incoming traffic rate with the configured policer and determine if the packet is in profile or out of profile. Based on whether the packet is in or out of profile and the configured parameters, determine whether to pass through, mark down, or drop the packet. Queueing and scheduling Based on the QoS label, determine into which of the egress queues to place the packet. Then service the queues according to the configured weights. Based on the QoS label, determine into which of the ingress queues to place the packet. Then service the queues according to the configured weights. Queueing and scheduling27-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS You specify which fields in the frame or packet that you want to use to classify incoming traffic. For non-IP traffic, you have these classification options as shown in Figure 27-3: • Trust the CoS value in the incoming frame (configure the port to trust CoS). Then use the configurable CoS-to-DSCP map to generate a DSCP value for the packet. Layer 2 ISL frame headers carry the CoS value in the three least-significant bits of the 1-byte User field. Layer 2 802.1Q frame headers carry the CoS value in the three most-significant bits of the Tag Control Information field. CoS values range from 0 for low priority to 7 for high priority. • Trust the DSCP or trust IP precedence value in the incoming frame. These configurations are meaningless for non-IP traffic. If you configure a port with either of these options and non-IP traffic is received, the switch assigns a CoS value and generates a DSCP value from the CoS-to-DSCP map. • Perform the classification based on a configured Layer 2 MAC access control list (ACL), which can examine the MAC source address, the MAC destination address, and other fields. If no ACL is configured, the packet is assigned 0 as the DSCP and CoS values, which means best-effort traffic. Otherwise, the policy-map action specifies a DSCP or CoS value to assign to the incoming frame. For IP traffic, you have these classification options as shown in Figure 27-3: • Trust the DSCP value in the incoming packet (configure the port to trust DSCP), and assign the same DSCP value to the packet. The IETF defines the six most-significant bits of the 1-byte TOS field as the DSCP. The priority represented by a particular DSCP value is configurable. DSCP values range from 0 to 63. For ports that are on the boundary between two QoS administrative domains, you can modify the DSCP to another value by using the configurable DSCP-to-DSCP-mutation map. • Trust the IP precedence value in the incoming packet (configure the port to trust IP precedence), and generate a DSCP value for the packet by using the configurable IP-precedence-to-DSCP map. The IP version 4 specification defines the three most-significant bits of the 1-byte ToS field as the IP precedence. IP precedence values range from 0 for low priority to 7 for high priority. • Trust the CoS value (if present) in the incoming packet, and generate a DSCP value for the packet by using the CoS-to-DSCP map. If the CoS value is not present, use the default port CoS value. • Perform the classification based on a configured IP standard or an extended ACL, which examines various fields in the IP header. If no ACL is configured, the packet is assigned 0 as the DSCP and CoS values, which means best-effort traffic. Otherwise, the policy-map action specifies a DSCP or CoS value to assign to the incoming frame. For information on the maps described in this section, see the “Mapping Tables” section on page 27-10. For configuration information on port trust states, see the “Configuring Classification Using Port Trust States” section on page 27-30. After classification, the packet is sent to the policing, marking, and the ingress queueing and scheduling stages.27-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Figure 27-3 Classification Flowchart 86834 Generate the DSCP based on IP precedence in packet. Use the IP-precedence-to-DSCP map. Use the DSCP value to generate the QoS label. Assign default port CoS. Ye s Ye s No No No Ye s N o (Optional) Modify the DSCP by using the DSCP-to-DSCP-mutation map. Use the DSCP value to generate the QoS label. Read ingress interface configuration for classification. Assign DSCP identical to DSCP in packet. Check if packet came with CoS label (tag). Use the CoS value to generate the QoS label. Generate DSCP from CoS-to-DSCP map. Use the DSCP value to generate the QoS label. Ye s Read next ACL. Is there a match with a "permit" action? Assign the DSCP or CoS as specified by ACL action to generate the QoS label. Assign the default DSCP (0). Are there any (more) QoS ACLs configured for this interface? Check if packet came with CoS label (tag). Use CoS from frame. Start Trust CoS (IP and non-IP traffic). IP and non-IP traffic Trust DSCP or IP precedence (non-IP traffic). Trust IP precedence (IP traffic). Trust DSCP (IP traffic). Done Done Done Done Assign the default port CoS and generate a DSCP from the CoS-to-DSCP map. Generate the DSCP by using the CoS-to-DSCP map.27-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Classification Based on QoS ACLs You can use IP standard, IP extended, or Layer 2 MAC ACLs to define a group of packets with the same characteristics (class). In the QoS context, the permit and deny actions in the access control entries (ACEs) have different meanings than with security ACLs: • If a match with a permit action is encountered (first-match principle), the specified QoS-related action is taken. • If a match with a deny action is encountered, the ACL being processed is skipped, and the next ACL is processed. • If no match with a permit action is encountered and all the ACEs have been examined, no QoS processing occurs on the packet, and the switch offers best-effort service to the packet. • If multiple ACLs are configured on an interface, the lookup stops after the packet matches the first ACL with a permit action, and QoS processing begins. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. After a traffic class has been defined with the ACL, you can attach a policy to it. A policy might contain multiple classes with actions specified for each one of them. A policy might include commands to classify the class as a particular aggregate (for example, assign a DSCP) or rate-limit the class. This policy is then attached to a particular port on which it becomes effective. You implement IP ACLs to classify IP traffic by using the access-list global configuration command; you implement Layer 2 MAC ACLs to classify non-IP traffic by using the mac access-list extended global configuration command. For configuration information, see the “Configuring a QoS Policy” section on page 27-36. Classification Based on Class Maps and Policy Maps A class map is a mechanism that you use to name a specific traffic flow (or class) and to isolate it from all other traffic. The class map defines the criteria used to match against a specific traffic flow to further classify it. The criteria can include matching the access group defined by the ACL or matching a specific list of DSCP or IP precedence values. If you have more than one type of traffic that you want to classify, you can create another class map and use a different name. After a packet is matched against the class-map criteria, you further classify it through the use of a policy map. A policy map specifies which traffic class to act on. Actions can include trusting the CoS, DSCP, or IP precedence values in the traffic class; setting a specific DSCP or IP precedence value in the traffic class; or specifying the traffic bandwidth limitations and the action to take when the traffic is out of profile. Before a policy map can be effective, you must attach it to an interface. You create a class map by using the class-map global configuration command or the class policy-map configuration command. You should use the class-map command when the map is shared among many ports. When you enter the class-map command, the switch enters the class-map configuration mode. In this mode, you define the match criterion for the traffic by using the match class-map configuration command.27-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS You create and name a policy map by using the policy-map global configuration command. When you enter this command, the switch enters the policy-map configuration mode. In this mode, you specify the actions to take on a specific traffic class by using the class, trust, or set policy-map configuration and policy-map class configuration commands. The policy map can contain the police and police aggregate policy-map class configuration commands, which define the policer, the bandwidth limitations of the traffic, and the action to take if the limits are exceeded. To make the policy map effective, you attach it to an interface by using the service-policy interface configuration command. For more information, see the “Policing and Marking” section on page 27-8. For configuration information, see the “Configuring a QoS Policy” section on page 27-36. Policing and Marking After a packet is classified and has a DSCP-based or CoS-based QoS label assigned to it, the policing and marking process can begin as shown in Figure 27-4. Policing involves creating a policer that specifies the bandwidth limits for the traffic. Packets that exceed the limits are out of profile or nonconforming. Each policer determines on a packet-by-packet basis whether the packet is in or out of profile and specifies the actions on the packet. These actions, carried out by the marker, include passing through the packet without modification, dropping the packet, or modifying (marking down) the assigned DSCP of the packet and allowing the packet to pass through. The configurable policed-DSCP map provides the packet with a new DSCP-based QoS label. For information on the policed-DSCP map, see the “Mapping Tables” section on page 27-10. Marked-down packets use the same queues as the original QoS label to prevent packets in a flow from getting out of order. Note All traffic, regardless of whether it is bridged or routed, is subjected to a policer, if one is configured. As a result, bridged packets might be dropped or might have their DSCP or CoS fields modified when they are policed and marked. You can create these types of policers: • Individual QoS applies the bandwidth limits specified in the policer separately to each matched traffic class. You configure this type of policer within a policy map by using the police policy-map class configuration command. • Aggregate QoS applies the bandwidth limits specified in an aggregate policer cumulatively to all matched traffic flows. You configure this type of policer by specifying the aggregate policer name within a policy map by using the police aggregate policy-map class configuration command. You specify the bandwidth limits of the policer by using the mls qos aggregate-policer global configuration command. In this way, the aggregate policer is shared by multiple classes of traffic within a policy map.27-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Policing uses a token-bucket algorithm. As each frame is received by the switch, a token is added to the bucket. The bucket has a hole in it and leaks at a rate that you specify as the average traffic rate in bits per second. Each time a token is added to the bucket, the switch performs a check to determine if there is enough room in the bucket. If there is not enough room, the packet is marked as nonconforming, and the specified policer action is taken (dropped or marked down). How quickly the bucket fills is a function of the bucket depth (burst-byte), the rate at which the tokens are removed (rate-bps), and the duration of the burst above the average rate. The size of the bucket imposes an upper limit on the burst length and determines the number of frames that can be transmitted back-to-back. If the burst is short, the bucket does not overflow, and no action is taken against the traffic flow. However, if a burst is long and at a higher rate, the bucket overflows, and the policing actions are taken against the frames in that burst. You configure the bucket depth (the maximum burst that is tolerated before the bucket overflows) by using the burst-byte option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. You configure how fast (the average rate) that the tokens are removed from the bucket by using the rate-bps option of the police policy-map class configuration command or the mls qos aggregate-policer global configuration command. After you configure the policy map and policing actions, attach the policy to an ingress interface by using the service-policy interface configuration command. For configuration information, see the “Classifying, Policing, and Marking Traffic by Using Policy Maps” section on page 27-42 and the “Classifying, Policing, and Marking Traffic by Using Aggregate Policers” section on page 27-45. Figure 27-4 Policing and Marking Flowchart 86835 Ye s Ye s No No Pass through Drop Mark Get the clasification result for the packet. Is a policer configured for this packet? Check if the packet is in profile by querying the policer. Check out-of-profile action configured for this policer. Drop packet. Modify DSCP according to the policed-DSCP map. Generate a new QoS label. Start Done27-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Mapping Tables During QoS processing, the switch represents the priority of all traffic (including non-IP traffic) with an QoS label based on the DSCP or CoS value from the classification stage: • During classification, QoS uses configurable mapping tables to derive a corresponding DSCP or CoS value from a received CoS, DSCP, or IP precedence value. These maps include the CoS-to-DSCP map and the IP-precedence-to-DSCP map. You configure these maps by using the mls qos map cos-dscp and the mls qos map ip-prec-dscp global configuration commands. On an ingress interface configured in the DSCP-trusted state, if the DSCP values are different between the QoS domains, you can apply the configurable DSCP-to-DSCP-mutation map to the interface that is on the boundary between the two QoS domains. You configure this map by using the mls qos map dscp-mutation global configuration command. • During policing, QoS can assign another DSCP value to an IP or a non-IP packet (if the packet is out of profile and the policer specifies a marked-down value). This configurable map is called the policed-DSCP map. You configure this map by using the mls qos map policed-dscp global configuration command. • Before the traffic reaches the scheduling stage, QoS stores the packet in an ingress and an egress queue according to the QoS label. The QoS label is based on the DSCP or the CoS value in the packet and selects the queue through the DSCP input and output queue threshold maps or through the CoS input and output queue threshold maps. You configure these maps by using the mls qos srr-queue {input | output} dscp-map and the mls qos srr-queue {input | output} cos-map global configuration commands. The CoS-to-DSCP, DSCP-to-CoS, and the IP-precedence-to-DSCP maps have default values that might or might not be appropriate for your network. The default DSCP-to-DSCP-mutation map and the default policed-DSCP map are null maps; they map an incoming DSCP value to the same DSCP value. The DSCP-to-DSCP-mutation map is the only map you apply to a specific port. All other maps apply to the entire switch. For configuration information, see the “Configuring DSCP Maps” section on page 27-47. For information about the DSCP and CoS input queue threshold maps, see the “Queueing and Scheduling on Ingress Queues” section on page 27-13. For information about the DSCP and CoS output queue threshold maps, see the “Queueing and Scheduling on Egress Queues” section on page 27-15.27-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Queueing and Scheduling Overview The switch has queues at specific points to help prevent congestion as shown in Figure 27-5. Figure 27-5 Ingress and Egress Queue Location Because the total ingress bandwidth of all ports can exceed the bandwidth of the stack ring, ingress queues are located after the packet is classified, policed, and marked and before packets are forwarded into the switch fabric. Because multiple ingress ports can simultaneously send packets to an egress port and cause congestion, egress queues are located after the stack ring. Weighted Tail Drop Both the ingress and egress queues use an enhanced version of the tail-drop congestion-avoidance mechanism called weighted tail drop (WTD). WTD is implemented on queues to manage the queue lengths and to provide drop precedences for different traffic classifications. As a frame is enqueued to a particular queue, WTD uses the frame’s assigned QoS label to subject it to different thresholds. If the threshold is exceeded for that QoS label (the space available in the destination queue is less than the size of the frame), the switch drops the frame. Figure 27-6 shows an example of WTD operating on a queue whose size is 1000 frames. Three drop percentages are configured: 40 percent (400 frames), 60 percent (600 frames), and 100 percent (1000 frames). These percentages mean that up to 400 frames can be queued at the 40-percent threshold, up to 600 frames at the 60-percent threshold, and up to 1000 frames at the 100-percent threshold. In this example, CoS values 6 and 7 have a greater importance than the other CoS values, and they are assigned to the 100-percent drop threshold (queue-full state). CoS values 4 and 5 are assigned to the 60-percent threshold, and CoS values 0 to 3 are assigned to the 40-percent threshold. Suppose the queue is already filled with 600 frames, and a new frame arrives. It contains CoS values 4 and 5 and is subjected to the 60-percent threshold. If this frame is added to the queue, the threshold will be exceeded, so the switch drops it. Policer Marker Policer Marker Marker Ingress queues Stack ring Egress Policer queues Policer Marker Classify Traffic SRR SRR 8669127-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Figure 27-6 WTD and Queue Operation For more information, see the “Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds” section on page 27-53, the “Allocating Buffer Space to and Setting WTD Thresholds for an Egress Queue-Set” section on page 27-57, and the “Mapping DSCP or CoS Values to an Egress Queue and to a Threshold ID” section on page 27-59. SRR Shaping and Sharing Both the ingress and egress queues are serviced by SRR, which determines the rate at which packets are sent. On the ingress queues, SRR sends packets to the stack ring. On the egress queues, SRR sends packets to the egress interface. You can configure SRR on egress queues for sharing or for shaping. However, for ingress queues, sharing is the default mode, and it is the only mode supported. In shaped mode, the egress queues are guaranteed a percentage of the bandwidth, and they are rate-limited to that amount. Shaped traffic does not use more than the allocated bandwidth even if the link is idle. Shaping provides a more even flow of traffic over time and reduces the peaks and valleys of bursty traffic. With shaping, the absolute value of each weight is used to compute the bandwidth available for the queues. In shared mode, the queues share the bandwidth among them according to the configured weights. The bandwidth is guaranteed at this level but not limited to it. For example, if a queue is empty and no longer requires a share of the link, the remaining queues can expand into the unused bandwidth and share it among them. With sharing, the ratio of the weights determines the frequency of dequeuing; the absolute values are meaningless. For more information, see the “Allocating Bandwidth Between the Ingress Queues” section on page 27-55, the “Configuring SRR Shaped Weights on Egress Queues” section on page 27-61, and the “Configuring SRR Shared Weights on Egress Queues” section on page 27-62. CoS 6-7 100% 60% 40% 1000 600 400 0 CoS 4-5 CoS 0-3 8669227-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Queueing and Scheduling on Ingress Queues Figure 27-7 shows the queueing and scheduling flowchart for ingress ports. Figure 27-7 Queueing and Scheduling Flowchart for Ingress Ports Note SRR services the priority queue for its configured share before servicing the other queue. The switch supports two configurable ingress queues, which are serviced by SRR in shared mode only. Table 27-1 describes the queues. 86693 Read QoS label (DSCP or CoS value). Determine ingress queue number, buffer allocation, and WTD thresholds. Are thresholds being exceeded? Queue the packet. Service the queue according to the SRR weights. Send packet to the stack ring. Drop packet. Start Ye s No Table 27-1 Ingress Queue Types Queue Type 1 1. The switch uses two nonconfigurable queues for traffic that is essential for proper network and stack operation. Function Normal User traffic that is considered to be normal priority. You can configure three different thresholds to differentiate among the flows. You can use the mls qos srr-queue input threshold, the mls qos srr-queue input dscp-map, and the mls qos srr-queue input cos-map global configuration commands. Expedite High-priority user traffic such as differentiated services (DF) expedited forwarding or voice traffic. You can configure the bandwidth required for this traffic as a percentage of the total stack traffic by using the mls qos srr-queue input priority-queue global configuration command. The expedite queue has guaranteed bandwidth.27-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS You assign each packet that flows through the switch to a queue and to a threshold. Specifically, you map DSCP or CoS values to an ingress queue and map DSCP or CoS values to a threshold ID. You use the mls qos srr-queue input dscp-map queue queue-id {dscp1...dscp8 | threshold threshold-id dscp1...dscp8} or the mls qos srr-queue input cos-map queue queue-id {cos1...cos8 | threshold threshold-id cos1...cos8} global configuration command. You can display the DSCP input queue threshold map and the CoS input queue threshold map by using the show mls qos maps privileged EXEC command. WTD Thresholds The queues use WTD to support distinct drop percentages for different traffic classes. Each queue has three drop thresholds: two configurable (explicit) WTD thresholds and one nonconfigurable (implicit) threshold preset to the queue-full state. You assign the two explicit WTD threshold percentages for threshold ID 1 and ID 2 to the ingress queues by using the mls qos srr-queue input threshold queue-id threshold-percentage1 threshold-percentage2 global configuration command. Each threshold value is a percentage of the total number of allocated buffers for the queue. The drop threshold for threshold ID 3 is preset to the queue-full state, and you cannot modify it. For more information about how WTD works, see the “Weighted Tail Drop” section on page 27-11. Buffer and Bandwidth Allocation You define the ratio (allocate the amount of space) with which to divide the ingress buffers between the two queues by using the mls qos srr-queue input buffers percentage1 percentage2 global configuration command. The buffer allocation together with the bandwidth allocation determine how much data can be buffered and sent before packets are dropped. You allocate bandwidth as a percentage by using the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. The ratio of the weights is the ratio of the frequency in which the SRR scheduler sends packets from each queue. Priority Queueing You can configure one ingress queue as the priority queue by using the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. The priority queue should be used for traffic (such as voice) that requires guaranteed delivery because this queue is guaranteed part of the bandwidth regardless of the load on the stack ring. SRR services the priority queue for its configured weight as specified by the bandwidth keyword in the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. Then, SRR shares the remaining bandwidth with both ingress queues and services them as specified by the weights configured with the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. You can combine the commands described in this section to prioritize traffic by placing packets with particular DSCPs or CoSs into certain queues, by allocating a large queue size or by servicing the queue more frequently, and by adjusting queue thresholds so that packets with lower priorities are dropped. For configuration information, see the “Configuring Ingress Queue Characteristics” section on page 27-52.27-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS Queueing and Scheduling on Egress Queues Figure 27-8 shows the queueing and scheduling flowchart for egress ports. Figure 27-8 Queueing and Scheduling Flowchart for Egress Ports Each port supports four egress queues. These queues are assigned to a queue-set. All traffic exiting the switch flows through one of these four queues and is subjected to a threshold based on the QoS label assigned to the packet. Figure 27-9 shows the egress queue buffer. The buffer space is divided between the common pool and the reserved pool. The switch uses a buffer allocation scheme to reserve a minimum amount of buffers for each egress queue, to prevent any queue or port from consuming all the buffers and depriving other queues, and to determine whether to grant buffer space to a requesting queue. The switch determines 86694 Receive packet from the stack ring. Read QoS label (DSCP or CoS value). Determine egress queue number and threshold based on the label. Are thresholds being exceeded? Send the packet out the port. Queue the packet. Service the queue according to the SRR weights. Drop packet. Start Done Ye s No Rewrite DSCP and/or CoS value as appropriate.27-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS whether the target queue has not consumed more buffers than its reserved amount (under-limit), whether it has consumed all of its maximum buffers (over limit), and whether the common pool is empty (no free buffers) or not empty (free buffers). If the queue is not over-limit, the switch can allocate buffer space from the reserved pool or from the common pool (if it is not empty). If there are no free buffers in the common pool or if the queue is over-limit, the switch drops the frame. Figure 27-9 Egress Queue Buffer Allocation Buffer and Memory Allocation You guarantee the availability of buffers, set drop thresholds, and configure the maximum memory allocation for a queue-set by using the mls qos queue-set output qset-id threshold queue-id drop-threshold1 drop-threshold2 reserved-threshold maximum-threshold global configuration command. Each threshold value is a percentage of the queue’s allocated memory, which you specify by using the mls qos queue-set output qset-id buffers allocation1 ... allocation4 global configuration command. The sum of all the allocated buffers represents the reserved pool, and the remaining buffers are part of the common pool. Through buffer allocation, you can ensure that high-priority traffic is buffered. For example, if the buffer space is 400, you can allocate 70 percent of it to queue 1 and 10 percent to queues 2 through 4. Queue 1 then has 280 buffers allocated to it, and queues 2 through 4 each have 40 buffers allocated to them. You can guarantee that the allocated buffers are reserved for a specific queue in a queue-set. For example, if there are 100 buffers for a queue, you can reserve 50 percent (50 buffers). The switch returns the remaining 50 buffers to the common pool. You also can enable a queue in the full condition to obtain more buffers than are reserved for it by setting a maximum threshold. The switch can allocate the needed buffers from the common pool if the common pool is not empty. WTD Thresholds You can assign each packet that flows through the switch to a queue and to a threshold. Specifically, you map DSCP or CoS values to an egress queue and map DSCP or CoS values to a threshold ID. You use the mls qos srr-queue output dscp-map queue queue-id {dscp1...dscp8 | threshold threshold-id dscp1...dscp8} or the mls qos srr-queue output cos-map queue queue-id {cos1...cos8 | threshold threshold-id cos1...cos8} global configuration command. You can display the DSCP output queue threshold map and the CoS output queue threshold map by using the show mls qos maps privileged EXEC command. The queues use WTD to support distinct drop percentages for different traffic classes. Each queue has three drop thresholds: two configurable (explicit) WTD thresholds and one nonconfigurable (implicit) threshold preset to the queue-full state. You assign the two WTD threshold percentages for threshold Port 1 queue 1 Port 1 queue 2 Port 1 queue 3 Port 1 queue 4 Port 2 queue 1 Port 2 queue 2 Common pool Reserved pool 8669527-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Understanding QoS ID 1 and ID 2. The drop threshold for threshold ID 3 is preset to the queue-full state, and you cannot modify it. For more information about how WTD works, see the “Weighted Tail Drop” section on page 27-11. Shaped or Shared Mode SRR services each queue-set in shared or shaped mode.You map an interface to a queue-set by using the queue-set qset-id interface configuration command. You assign shared or shaped weights to the interface by using the srr-queue bandwidth share weight1 weight2 weight3 weight4 or the srr-queue bandwidth shape weight1 weight2 weight3 weight4 interface configuration command. For an explanation of the differences between shaping and sharing, see the “SRR Shaping and Sharing” section on page 27-12. The buffer allocation together with the SRR weight ratios determine how much data can be buffered and sent before packets are dropped. The weight ratio is the ratio of the frequency in which the SRR scheduler sends packets from each queue. You can combine the commands described in this section to prioritize traffic by placing packets with particular DSCPs or CoSs into certain queues, by allocating a large queue size or by servicing the queue more frequently, and by adjusting queue thresholds so that packets with lower priorities are dropped. For configuration information, see the “Configuring Egress Queue Characteristics” section on page 27-57. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Packet Modification A packet is classified, policed, and queued to provide QoS. Packet modifications can occur during this process: • For IP and non-IP packets, classification involves assigning a QoS label to a packet based on the DSCP or CoS of the received packet. However, the packet is not modified at this stage; only an indication of the assigned DSCP or CoS value is carried along. The reason for this is that QoS classification and forwarding lookups occur in parallel, and it is possible that the packet is forwarded with its original DSCP to the CPU where it is again processed through software. • During policing, IP and non-IP packets can have another DSCP assigned to them (if they are out of profile and the policer specifies a markdown DSCP). Once again, the DSCP in the packet is not modified, but an indication of the marked-down value is carried along. For IP packets, the packet modification occurs at a later stage; for non-IP packets the DSCP is converted to CoS and used for queueing and scheduling decisions. • Depending on the QoS label assigned to a frame and the mutation chosen, the DSCP and CoS values of the frame are rewritten. If you do not configure the mutation map and if you configure the interface to trust the DSCP of the incoming frame, the DSCP value in the frame is not changed, but the CoS is rewritten according to the DSCP-to-CoS map. If you configure the interface to trust the CoS of the incoming frame and it is an IP packet, the CoS value in the frame is not changed, but the DSCP might be changed according to the CoS-to-DSCP map. The input mutation causes the DSCP to be rewritten depending on the new value of DSCP chosen. The set action in a policy map also causes the DSCP to be rewritten.27-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Configuring Auto-QoS You can use the auto-QoS feature to simplify the deployment of existing QoS features. Auto-QoS makes assumptions about the network design, and as a result, the switch can prioritize different traffic flows and appropriately use the ingress and egress queues instead of using the default QoS behavior. (The default is that QoS is disabled. The switch then offers best-effort service to each packet, regardless of the packet contents or size, and sends it from a single queue.) When you enable auto-QoS, it automatically classifies traffic based on the traffic type and ingress packet label. The switch uses the resulting classification to choose the appropriate egress queue. You use auto-QoS commands to identify ports connected to Cisco IP Phones and to identify ports that receive trusted voice over IP (VoIP) traffic through an uplink. Auto-QoS then performs these functions: • Detects the presence or absence of Cisco IP Phones • Configures QoS classification • Configures egress queues These sections describe how to configure auto-QoS on your switch: • Generated Auto-QoS Configuration, page 27-18 • Effects of Auto-QoS on the Configuration, page 27-22 • Auto-QoS Configuration Guidelines, page 27-22 • Enabling Auto-QoS for VoIP, page 27-22 • Auto-QoS Configuration Example, page 27-24 Generated Auto-QoS Configuration By default, auto-QoS is disabled on all interfaces. When auto-QoS is enabled, it uses the ingress packet label to categorize traffic, to assign packet labels, and to configure the ingress and egress queues as shown in Table 27-2. Table 27-2 Traffic Types, Ingress Packet Labels, Assigned Packet Labels, and Queues VoIP Data Traffic VoIP Control Traffic Routing Protocol Traffic STP BPDU Traffic All Other Traffic Ingress DSCP 46 26 – – – Ingress CoS 5 3 6 7 – DiffServ EF AF31 – – – Assigned DSCP 46 26 48 56 0 Assigned CoS 5 3 6 7 0 CoS-to-Ingress Queue Map 2, 3, 4, 5, 6, 7 (queue 2) 0, 1 (queue 1) CoS-to-Egress Queue Map 5 (queue 1) 3, 6, 7 (queue 2) 2, 4 (queue 3) 0, 1 (queue 4)27-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Table 27-3 shows the generated auto-QoS configuration for the ingress queues. Table 27-4 shows the generated auto-QoS configuration for the egress queues. When you enable the auto-QoS feature on the first interface, these automatic actions occur: • QoS is globally enabled (mls qos global configuration command), and other global configuration commands are added. • When you enter the auto qos voip cisco-phone interface configuration command on a port at the edge of the network that is connected to a Cisco IP Phone, the switch enables the trusted boundary feature. The switch uses the Cisco Discovery Protocol (CDP) to detect the presence or absence of a Cisco IP Phone. When a Cisco IP Phone is detected, the ingress classification on the interface is set to trust the QoS label received in the packet. When a Cisco IP Phone is absent, the ingress classification is set to not trust the QoS label in the packet. The switch configures ingress and egress queues on the interface according to the settings in Table 27-3 and Table 27-4. • When you enter the auto qos voip trust interface configuration command on a port connected to the interior of the network, the switch trusts the CoS value for nonrouted interfaces or the DSCP value for routed interfaces in ingress packets (the assumption is that traffic has already been classified by other edge devices). The switch configures the ingress and egress queues on the interface according to the settings in Table 27-3 and Table 27-4. For information about the trusted boundary feature, see the “Configuring a Trusted Boundary to Ensure Port Security” section on page 27-34. When you enable auto-QoS by using the auto qos voip cisco-phone or the auto qos voip trust interface configuration command, the switch automatically generates a QoS configuration based on the traffic type and ingress packet label and applies the commands listed in Table 27-5 to the interface. Table 27-3 Auto-QoS Configuration for the Ingress Queues Ingress Queue Queue Number CoS-to-Queue Map Queue Weight (Bandwidth) Queue (Buffer) Size SRR shared 1 0, 1 90 percent 90 percent Priority 2 2, 3, 4, 5, 6, 7 10 percent 10 percent Table 27-4 Auto-QoS Configuration for the Egress Queues Egress Queue Queue Number CoS-to-Queue Map Queue Weight (Bandwidth) Queue (Buffer) Size Priority (shaped) 1 5 10 percent 20 percent SRR shared 2 3, 6, 7 10 percent 20 percent SRR shared 3 2, 4 60 percent 20 percent SRR shared 4 0, 1 20 percent 40 percent27-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Table 27-5 Generated Auto-QoS Configuration Description Automatically Generated Command The switch automatically enables standard QoS and configures the CoS-to-DSCP map (maps CoS values in incoming packets to a DSCP value). Switch(config)# mls qos Switch(config)# mls qos map cos-dscp 0 8 16 26 32 46 48 56 The switch automatically maps CoS values to an ingress queue and to a threshold ID. Switch(config)# no mls qos srr-queue input cos-map Switch(config)# mls qos srr-queue input cos-map queue 1 threshold 3 0 Switch(config)# mls qos srr-queue input cos-map queue 1 threshold 2 1 Switch(config)# mls qos srr-queue input cos-map queue 2 threshold 1 2 Switch(config)# mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7 Switch(config)# mls qos srr-queue input cos-map queue 2 threshold 3 3 5 The switch automatically maps CoS values to an egress queue and to a threshold ID. Switch(config)# no mls qos srr-queue output cos-map Switch(config)# mls qos srr-queue output cos-map queue 1 threshold 3 5 Switch(config)# mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7 Switch(config)# mls qos srr-queue output cos-map queue 3 threshold 3 2 4 Switch(config)# mls qos srr-queue output cos-map queue 4 threshold 2 1 Switch(config)# mls qos srr-queue output cos-map queue 4 threshold 3 0 The switch automatically maps DSCP values to an ingress queue and to a threshold ID. Switch(config)# no mls qos srr-queue input dscp-map Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 13 14 15 Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4 5 6 7 Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 3 32 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 2 26 33 34 35 36 37 38 39 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 2 48 49 50 51 52 53 54 55 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 2 56 57 58 59 60 61 62 63 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 40 Switch(config)# mls qos srr-queue input dscp-map queue 2 threshold 3 41 42 43 44 45 46 4727-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS The switch automatically maps DSCP values to an egress queue and to a threshold ID. Switch(config)# no mls qos srr-queue output dscp-map Switch(config)# mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47 Switch(config)# mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 27 28 29 30 31 48 Switch(config)# mls qos srr-queue output dscp-map queue 2 threshold 3 49 50 51 52 53 54 55 56 Switch(config)# mls qos srr-queue output dscp-map queue 2 threshold 3 57 58 59 60 61 62 63 Switch(config)# mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23 Switch(config)# mls qos srr-queue output dscp-map queue 3 threshold 3 26 32 33 34 35 36 37 38 Switch(config)# mls qos srr-queue output dscp-map queue 3 threshold 3 39 Switch(config)# mls qos srr-queue output dscp-map queue 4 threshold 1 8 Switch(config)# mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15 Switch(config)# mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7 The switch automatically sets up the ingress queues, with queue 2 as the priority queue and queue 1 in shared mode. The switch also configures the bandwidth and buffer size for the ingress queues. Switch(config)# no mls qos srr-queue input priority-queue 1 Switch(config)# no mls qos srr-queue input priority-queue 2 Switch(config)# mls qos srr-queue input bandwidth 90 10 Switch(config)# no mls qos srr-queue input buffers The switch automatically configures the egress queue buffer sizes. It configures the bandwidth and the SRR mode (shaped or shared) on the egress queues mapped to the port. Switch(config)# mls qos queue-set output 1 buffers 20 20 20 40 Switch(config-if)# srr-queue bandwidth shape 10 0 0 0 Switch(config-if)# srr-queue bandwidth share 10 10 60 20 The switch automatically sets the ingress classification to trust the CoS value received in the packet on a nonrouted interface or to trust the DSCP value received in the packet on a routed interface. Switch(config-if)# mls qos trust cos Switch(config-if)# mls qos trust dscp If you entered the auto qos voip cisco-phone command, the switch automatically enables the trusted boundary feature, which uses the CDP to detect the presence or absence of a Cisco IP Phone. Switch(config-if)# mls qos trust device cisco-phone Table 27-5 Generated Auto-QoS Configuration (continued) Description Automatically Generated Command27-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Effects of Auto-QoS on the Configuration When auto-QoS is enabled, the auto qos voip interface configuration command and the generated configuration are added to the running configuration. The switch applies the auto-QoS-generated commands as if the commands were entered from the CLI. An existing user configuration can cause the application of the generated commands to fail or to be overridden by the generated commands. These actions occur without warning. If all the generated commands are successfully applied, any user-entered configuration that was not overridden remains in the running configuration. Any user-entered configuration that was overridden can be retrieved by reloading the switch without saving the current configuration to memory. If the generated commands fail to be applied, the previous running configuration is restored. Auto-QoS Configuration Guidelines Before configuring auto-QoS, you should be aware of this information: • In this release, auto-QoS configures the switch only for VoIP with Cisco IP Phones. • To take advantage of the auto-QoS defaults, you should enable auto-QoS before you configure other QoS commands. If necessary, you can fine-tune the QoS configuration, but we recommend that you do so only after the auto-QoS configuration is completed. For more information, see the “Effects of Auto-QoS on the Configuration” section on page 27-22. • You can enable auto-QoS on static, dynamic-access, voice VLAN access, and trunk ports. • By default, the CDP is enabled on all interfaces. For auto-QoS to function properly, do not disable the CDP. • Policing is not enabled with auto-QoS. You can manually enable policing, as described in the “Configuring a QoS Policy” section on page 27-36. Enabling Auto-QoS for VoIP Beginning in privileged EXEC mode, follow these steps to enable auto-QoS for VoIP within a QoS domain: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface that is connected to a Cisco IP Phone or the uplink interface that is connected to another switch or router in the interior of the network. Step 3 auto qos voip {cisco-phone | trust} Enable auto-QoS. The keywords have these meanings: • cisco-phone—If the interface is connected to a Cisco IP Phone, the QoS labels of incoming packets are trusted only when the telephone is detected. • trust—The uplink interface is connected to a trusted switch or router, and the VoIP traffic classification in the ingress packet is trusted.27-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS To display the QoS commands that are automatically generated when auto-QoS is enabled or disabled, enter the debug autoqos privileged EXEC command before enabling auto-QoS. For more information, refer to the “debug autoqos” command in the command reference for this release. To disable auto-QoS on an interface, use the no auto qos voip interface configuration command. Only the auto-QoS-generated interface configuration commands for this interface are removed. If this is the last interface on which auto-QoS is enabled and you enter the no auto qos voip command, auto-QoS is considered disabled even though the auto-QoS-generated global configuration commands remain (to avoid disrupting traffic on other interfaces affected by the global configuration). You can use the no mls qos global configuration command to disable the auto-QoS-generated global configuration commands. With QoS disabled, there is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing). This example shows how to enable auto-QoS and to trust the QoS labels received in incoming packets when the switch or router connected to Gigabit Ethernet interface 0/1 on stack member 2 is a trusted device: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# auto qos voip trust Step 4 end Return to privileged EXEC mode. Step 5 show auto qos interface interface-id Verify your entries. This command displays the initial auto-QoS configuration that was applied; it does not display any user changes to the configuration that might be in effect. You can use the show running-config privileged EXEC command to display the auto-QoS configuration and the user modifications. Command Purpose27-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Auto-QoS Configuration Example This section describes how you could implement auto-QoS in a network, as shown in Figure 27-10. Figure 27-10 Auto-QoS Configuration Example Network The intelligent wiring closets in Figure 27-10 are composed of Catalyst 2970 and Catalyst 3750 switches. The object of this example is to prioritize the VoIP traffic over all other traffic. To do so, enable auto-QoS on the switches at the edge of the QoS domains in the wiring closets. Cisco router Catalyst 3750 switch Catalyst 2970 switch Catalyst 2970 switch Gigabit Ethernet 1/0/1 Gigabit Ethernet 0/1 To Internet Catalyst 3750 switch Gigabit Ethernet 1/0/5 Gigabit Ethernet 1/0/2 Gigabit Ethernet 0/2 Gigabit Ethernet 0/1 Trunk link Gigabit Ethernet 1/0/1 Trunk link Cisco IP phones End stations Fast Ethernet 1/0/3 Fast Ethernet 1/0/5 Gigabit Ethernet 0/5 Cisco IP phones Video server 172.20.10.16 Catalyst 3750 switch 93208 IP IP IP IP Gigabit Ethernet 0/327-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Auto-QoS Note You should not configure any standard QoS commands before entering the auto-QoS commands. You can fine-tune the QoS configuration, but we recommend that you do so only after the auto-QoS configuration is completed. Beginning in privileged EXEC mode, follow these steps to configure the switch at the edge of the QoS domain to prioritize the VoIP traffic over all other traffic: Command Purpose Step 1 debug autoqos Enable debugging for auto-QoS. When debugging is enabled, the switch displays the QoS configuration that is automatically generated when auto-QoS is enabled. Step 2 configure terminal Enter global configuration mode. Step 3 cdp enable Enable CDP globally. By default, it is enabled. Step 4 interface fastethernet1/0/3 Enter interface configuration mode. Step 5 auto qos voip cisco-phone Enable auto-QoS on the interface, and specify that the interface is connected to a Cisco IP Phone. The QoS labels of incoming packets are trusted only when the IP Phone is detected. Step 6 exit Return to global configuration mode. Step 7 interface fastethernet1/0/5 Enter interface configuration mode, and specify that the interface is connected to a Cisco IP Phone. The QoS labels of incoming packets are trusted only when the Cisco IP Phone is detected. Step 8 auto qos voip cisco-phone Enable auto-QoS on the interface, and specify that the interface is connected to a Cisco IP Phone. Step 9 exit Return to global configuration mode. Step 10 interface gigabitethernet1/0/1 Enter interface configuration mode. Step 11 auto qos voip trust Enable auto-QoS on the interface, and specify that the interface is connected to a trusted router or switch. Step 12 end Return to privileged EXEC mode. Step 13 show auto qos Verify your entries. This command displays the auto-QoS configuration that is initially applied; it does not display any user changes to the configuration that might be in effect. For information about the QoS configuration that might be affected by auto-QoS, see the “Displaying Auto-QoS Information” section on page 26-12. Step 14 copy running-config startup-config Save the auto qos voip interface configuration commands and the generated auto-QoS configuration in the configuration file.27-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Displaying Auto-QoS Information Displaying Auto-QoS Information To display the initial auto-QoS configuration, use the show auto qos [interface [interface-id]] privileged EXEC command. To display any user changes to that configuration, use the show running-config privileged EXEC command. You can compare the show auto qos and the show running-config command output to identify the user-defined QoS settings. To display information about the QoS configuration that might be affected by auto-QoS, use one of these commands: • show mls qos • show mls qos maps cos-dscp • show mls qos interface [interface-id] [buffers | queueing] • show mls qos maps [cos-dscp | cos-input-q | cos-output-q | dscp-cos | dscp-input-q | dscp-output-q] • show mls qos input-queue • show running-config For more information about these commands, refer to the command reference for this release. Configuring Standard QoS Before configuring standard QoS, you must have a thorough understanding of these items: • The types of applications used and the traffic patterns on your network. • Traffic characteristics and needs of your network. Is the traffic bursty? Do you need to reserve bandwidth for voice and video streams? • Bandwidth requirements and speed of the network. • Location of congestion points in the network. These sections describe how to configure QoS on your switch: • Default Standard QoS Configuration, page 27-27 • Standard QoS Configuration Guidelines, page 27-29 • Enabling QoS Globally, page 27-30 (required) • Configuring Classification Using Port Trust States, page 27-30 (required • Configuring a QoS Policy, page 27-36 (required) • Configuring DSCP Maps, page 27-47 (optional, unless you need to use the DSCP-to-DSCP-mutation map or the policed-DSCP map) • Configuring Ingress Queue Characteristics, page 27-52 (optional) • Configuring Egress Queue Characteristics, page 27-57 (optional)27-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Default Standard QoS Configuration QoS is disabled. There is no concept of trusted or untrusted ports because the packets are not modified (the CoS, DSCP, and IP precedence values in the packet are not changed). Traffic is switched in pass-through mode (packets are switched without any rewrites and classified as best effort without any policing). When QoS is enabled with the mls qos global configuration command and all other QoS settings are at their defaults, traffic is classified as best effort (the DSCP and CoS value is set to 0) without any policing. No policy maps are configured. The default port trust state on all ports is untrusted. The default ingress and egress queue settings are described in the “Default Ingress Queue Configuration” section on page 27-27 and the “Default Egress Queue Configuration” section on page 27-28. Default Ingress Queue Configuration Table 27-6 shows the default ingress queue configuration when QoS is enabled. Table 27-7 shows the default CoS input queue threshold map when QoS is enabled. Table 27-8 shows the default DSCP input queue threshold map when QoS is enabled. Table 27-6 Default Ingress Queue Configuration Feature Queue 1 Queue 2 Buffer Allocation 90 percent 10 percent Bandwidth Allocation 1 1. The bandwidth is equally shared between the queues. SRR sends packets in shared mode only. 4 4 Priority Queue Bandwidth 2 2. Queue 2 is the priority queue. SRR services the priority queue for its configured share before servicing the other queue. 0 10 WTD Drop Threshold 1 100 percent 100 percent WTD Drop Threshold 2 100 percent 100 percent Table 27-7 Default CoS Input Queue Threshold Map CoS Value 0–4 5 6, 7 Queue ID - Threshold ID 1 - 1 2 - 1 1 - 1 Table 27-8 Default DSCP Input Queue Threshold Map DSCP Value 0–39 40–47 48–63 Queue ID - Threshold ID 1 - 1 2 - 1 1 - 127-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Default Egress Queue Configuration Table 27-9 shows the default egress queue configuration for each queue-set when QoS is enabled. All ports are mapped to queue-set 1. The port bandwidth limit is set to 100 percent and rate unlimited. Table 27-10 shows the default CoS output queue threshold map when QoS is enabled. Table 27-11 shows the default DSCP output queue threshold map when QoS is enabled. Default Mapping Table Configuration The default CoS-to-DSCP map is shown in Table 27-12 on page 27-47. The default IP-precedence-to-DSCP map is shown in Table 27-13 on page 27-48. The default DSCP-to-CoS map is shown in Table 27-14 on page 27-50. The default DSCP-to-DSCP-mutation map is a null map, which maps an incoming DSCP value to the same DSCP value. The default policed-DSCP map is a null map, which maps an incoming DSCP value to the same DSCP value (no markdown). Table 27-9 Default Egress Queue Configuration Feature Queue 1 Queue 2 Queue 3 Queue 4 Buffer Allocation 25 percent 25 percent 25 percent 25 percent WTD Drop Threshold 1 100 percent 50 percent 100 percent 100 percent WTD Drop Threshold 2 100 percent 50 percent 100 percent 100 percent Reserved Threshold 50 percent 100 percent 50 percent 50 percent Maximum Threshold 400 percent 400 percent 400 percent 400 percent SRR Shaped Weights (absolute) 1 1. A shaped weight of zero means that this queue is operating in shared mode. 25 0 0 0 SRR Shared Weights 2 2. One quarter of the bandwidth is allocated to each queue. 25 25 25 25 Table 27-10 Default CoS Output Queue Threshold Map CoS Value 0, 1 2, 3 4 5 6, 7 Queue ID - Threshold ID 2 - 1 3 - 1 4 - 1 1 -1 4 - 1 Table 27-11 Default DSCP Output Queue Threshold Map DSCP Value 0–15 16–31 32–39 40–47 48–63 Queue ID - Threshold ID 2 - 1 3 - 1 4 - 1 1 - 1 4 - 127-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Standard QoS Configuration Guidelines Before beginning the QoS configuration, you should be aware of this information: • You configure QoS only on physical ports; there is no support for it on the VLAN or switch virtual interface level. • It is not possible to match IP fragments against configured IP extended ACLs to enforce QoS. IP fragments are sent as best-effort. IP fragments are denoted by fields in the IP header. • Only one ACL per class map and only one match class-map configuration command per class map are supported. The ACL can have multiple ACEs, which match fields against the contents of the packet. • Incoming traffic is classified, policed, and marked down (if configured) regardless of whether the traffic is bridged, routed, or sent to the CPU. It is possible for bridged frames to be dropped or to have their DSCP and CoS values modified. • Only one policer is applied to a packet on an ingress interface. Only the average rate and committed burst parameters are configurable. • The port ASIC supports 256 policers (255 policers plus 1 no policer). The maximum number of policers supported per port is 64. For example, you could configure 32 policers on a Gigabit Ethernet port and 8 policers on a Fast Ethernet port, or you could configure 64 policers on a Gigabit Ethernet port and 5 policers on a Fast Ethernet port. Policers are allocated on demand by the software and are constrained by the hardware and ASIC boundaries. You cannot reserve policers per port; there is no guarantee that a port will be assigned to any policer. • On an interface configured for QoS, all traffic received through the interface is classified, policed, and marked according to the policy map attached to the interface. On a trunk interface configured for QoS, traffic in all VLANs received through the interface is classified, policed, and marked according to the policy map attached to the interface. • You can create an aggregate policer that is shared by multiple traffic classes within the same policy map. However, you cannot use the aggregate policer across different policy maps. • If you have EtherChannel ports configured on your switch, you must configure QoS classification, policing, mapping, and queueing on the individual physical ports that comprise the EtherChannel. You must decide whether the QoS configuration should match on all ports in the EtherChannel. • Control traffic (such as spanning-tree bridge protocol data units [BPDUs] and routing update packets) received by the switch are subject to all ingress QoS processing. • You are likely to lose data when you change queue settings; therefore, try to make changes when traffic is at a minimum.27-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Enabling QoS Globally By default, QoS is disabled on the switch. Beginning in privileged EXEC mode, follow these steps to enable QoS. This procedure is required. To disable QoS, use the no mls qos global configuration command. Configuring Classification Using Port Trust States These sections describe how to classify incoming traffic by using port trust states. Depending on your network configuration, you must perform one or more of these tasks or one or more of the tasks in the “Configuring a QoS Policy” section on page 27-36: • Configuring the Trust State on Ports within the QoS Domain, page 27-31 • Configuring the CoS Value for an Interface, page 27-33 • Configuring a Trusted Boundary to Ensure Port Security, page 27-34 • Configuring the DSCP Trust State on a Port Bordering Another QoS Domain, page 27-35 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos Enable QoS globally. QoS runs from the default settings described in the “Default Standard QoS Configuration” section on page 27-27, the “Queueing and Scheduling on Ingress Queues” section on page 27-13, and the “Queueing and Scheduling on Egress Queues” section on page 27-15. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the Trust State on Ports within the QoS Domain Packets entering a QoS domain are classified at the edge of the QoS domain. When the packets are classified at the edge, the switch port within the QoS domain can be configured to one of the trusted states because there is no need to classify the packets at every switch within the QoS domain. Figure 27-11 shows a sample network topology. Figure 27-11 Port Trusted States within the QoS Domain 93196 Catalyst 3750 switch Trunk Trusted interface Classification of traffic performed here Catalyst 3750 wiring closet Trusted boundary IP P3 P127-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Beginning in privileged EXEC mode, follow these steps to configure the port to trust the classification of the traffic that it receives: To return a port to its untrusted state, use the no mls qos trust interface configuration command. For information on how to change the default CoS value, see the “Configuring the CoS Value for an Interface” section on page 27-33. For information on how to configure the CoS-to-DSCP map, see the “Configuring the CoS-to-DSCP Map” section on page 27-47. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be trusted. Valid interfaces include physical interfaces. Step 3 mls qos trust [cos | dscp | ip-precedence] Configure the port trust state. By default, the port is not trusted. If no keyword is specified, the default is dscp. The keywords have these meanings: • cos—Classifies an ingress packet by using the packet CoS value. For an untagged packet, the port default CoS value is used. The default port CoS value is 0. • dscp—Classifies an ingress packet by using the packet DSCP value. For a non-IP packet, the packet CoS value is used if the packet is tagged; for an untagged packet, the default port CoS is used. Internally, the switch maps the CoS value to a DSCP value by using the CoS-to-DSCP map. • ip-precedence—Classifies an ingress packet by using the packet IP-precedence value. For a non-IP packet, the packet CoS value is used if the packet is tagged; for an untagged packet, the default port CoS is used. Internally, the switch maps the CoS value to a DSCP value by using the CoS-to-DSCP map. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos interface Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the CoS Value for an Interface QoS assigns the CoS value specified with the mls qos cos interface configuration command to untagged frames received on trusted and untrusted ports. Beginning in privileged EXEC mode, follow these steps to define the default CoS value of a port or to assign the default CoS to all incoming packets on the port: To return to the default setting, use the no mls qos cos {default-cos | override} interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Valid interfaces include physical interfaces. Step 3 mls qos cos {default-cos | override} Configure the default CoS value for the port. • For default-cos, specify a default CoS value to be assigned to a port. If the packet is untagged, the default CoS value becomes the packet CoS value. The CoS range is 0 to 7. The default is 0. • Use the override keyword to override the previously configured trust state of the incoming packet and to apply the default port CoS value to the port on all incoming packets. By default, CoS override is disabled. Use the override keyword when all incoming packets on specified ports deserve higher or lower priority than packets entering from other ports. Even if a port was previously set to trust DSCP, CoS, or IP precedence, this command overrides the previously configured trust state, and all the incoming CoS values are assigned the default CoS value configured with this command. If an incoming packet is tagged, the CoS value of the packet is modified with the default CoS of the port at the ingress port. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos interface Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring a Trusted Boundary to Ensure Port Security In a typical network, you connect a Cisco IP Phone to a switch port, as shown in Figure 27-11 on page 27-31, and cascade devices that generate data packets from the back of the telephone. The Cisco IP Phone guarantees the voice quality through a shared data link by marking the CoS level of the voice packets as high priority (CoS = 5) and by marking the data packets as low priority (CoS = 0). Traffic sent from the telephone to the switch is typically marked with a tag that uses the 802.1Q header. The header contains the VLAN information and the class of service (CoS) 3-bit field, which determines the priority of the packet. For most Cisco IP Phone configurations, the traffic sent from the telephone to the switch should be trusted to ensure that voice traffic is properly prioritized over other types of traffic in the network. By using the mls qos trust cos interface configuration command, you configure the switch port to which the telephone is connected to trust the CoS labels of all traffic received on that port. With the trusted setting, you also can use the trusted boundary feature to prevent misuse of a high-priority queue if a user bypasses the telephone and connects the PC directly to the switch. Without trusted boundary, the CoS labels generated by the PC are trusted by the switch (because of the trusted CoS setting). By contrast, trusted boundary uses CDP to detect the presence of a Cisco IP Phone (such as the Cisco IP Phone 7910, 7935, 7940, and 7960) on a switch port. If the telephone is not detected, the trusted boundary feature disables the trusted setting on the switch port and prevents misuse of a high-priority queue. Note that the trusted boundary feature is not effective if the PC and Cisco IP Phone are connected to a hub that is connected to the switch. In some situations, you can prevent a PC connected to the Cisco IP Phone from taking advantage of a high-priority data queue. You can use the switchport priority extend cos interface configuration command to configure the telephone through the switch CLI to override the priority of the traffic received from the PC. Beginning in privileged EXEC mode, follow these steps to enable trusted boundary on a port: To disable the trusted boundary feature, use the no mls qos trust device interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 cdp run Enable CDP globally. By default, CDP is enabled. Step 3 interface interface-id Enter interface configuration mode, and specify the interface connected to the Cisco IP Phone. Valid interfaces include physical interfaces. Step 4 cdp enable Enable CDP on the interface. By default, CDP is enabled. Step 5 mls qos trust cos Configure the interface to trust the CoS value in traffic received from the Cisco IP Phone. By default, the port is not trusted. Step 6 mls qos trust device cisco-phone Specify that the Cisco IP Phone is a trusted device. You cannot enable both trusted boundary and auto-QoS (auto qos voip interface configuration command) at the same time; they are mutually exclusive. Step 7 end Return to privileged EXEC mode. Step 8 show mls qos interface Verify your entries. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.27-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the DSCP Trust State on a Port Bordering Another QoS Domain If you are administering two separate QoS domains between which you want to implement QoS features for IP traffic, you can configure the switch ports bordering the domains to a DSCP-trusted state as shown in Figure 27-12. Then the receiving port accepts the DSCP-trusted value and avoids the classification stage of QoS. If the two domains use different DSCP values, you can configure the DSCP-to-DSCP-mutation map to translate a set of DSCP values to match the definition in the other domain. Figure 27-12 DSCP-Trusted State on a Port Bordering Another QoS Domain Beginning in privileged EXEC mode, follow these steps to configure the DSCP-trusted state on a port and modify the DSCP-to-DSCP-mutation map. To ensure a consistent mapping strategy across both QoS domains, you must perform this procedure on the ports in both domains: 86684 Catalyst 3750 switch Catalyst 3750 switch QoS Domain 1 QoS Domain 2 Set interface to the DSCP-trusted state. Configure the DSCP-to-DSCP-mutation map. IP traffic Gigabit Ethernet 1/0/3 Gigabit Ethernet 2/0/3 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map dscp-mutation dscp-mutation-name in-dscp to out-dscp Modify the DSCP-to-DSCP-mutation map. The default DSCP-to-DSCP-mutation map is a null map, which maps an incoming DSCP value to the same DSCP value. • For dscp-mutation-name, enter the mutation map name. You can create more than one map by specifying a new name. • For in-dscp, enter up to eight DSCP values separated by spaces. Then enter the to keyword. • For out-dscp, enter a single DSCP value. The DSCP range is 0 to 63. Step 3 interface interface-id Enter interface configuration mode, and specify the interface to be trusted. Valid interfaces include physical interfaces. Step 4 mls qos trust dscp Configure the ingress port as a DSCP-trusted port. By default, the port is not trusted.27-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To return a port to its non-trusted state, use the no mls qos trust interface configuration command. To return to the default DSCP-to-DSCP-mutation map values, use the no mls qos map dscp-mutation dscp-mutation-name global configuration command. This example shows how to configure Gigabit Ethernet port 0/3 on stack member 2 to the DSCP-trusted state and to modify the DSCP-to-DSCP-mutation map (named gi2/0/3-mutation) so that incoming DSCP values 10 to 13 are mapped to DSCP 30: Switch(config)# mls qos map dscp-mutation gi2/0/3-mutation 10 11 12 13 to 30 Switch(config)# interface gigabitethernet2/0/3 Switch(config-if)# mls qos trust dscp Switch(config-if)# mls qos dscp-mutation gi2/0/3-mutation Switch(config-if)# end Configuring a QoS Policy Configuring a QoS policy typically requires classifying traffic into classes, configuring policies applied to those traffic classes, and attaching policies to interfaces. For background information, see the “Classification” section on page 27-4 and the “Policing and Marking” section on page 27-8. For configuration guidelines, see the “Standard QoS Configuration Guidelines” section on page 27-29. These sections describe how to classify, police, and mark traffic. Depending on your network configuration, you must perform one or more of these tasks: • Classifying Traffic by Using ACLs, page 27-37 • Classifying Traffic by Using Class Maps, page 27-40 • Classifying, Policing, and Marking Traffic by Using Policy Maps, page 27-42 • Classifying, Policing, and Marking Traffic by Using Aggregate Policers, page 27-45 Step 5 mls qos dscp-mutation dscp-mutation-name Apply the map to the specified ingress DSCP-trusted port. For dscp-mutation-name, specify the mutation map name created in Step 2. You can configure multiple DSCP-to-DSCP-mutation maps on an ingress port. Step 6 end Return to privileged EXEC mode. Step 7 show mls qos maps dscp-mutation Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose27-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Classifying Traffic by Using ACLs You can classify IP traffic by using IP standard or IP extended ACLs; you can classify non-IP traffic by using Layer 2 MAC ACLs. Beginning in privileged EXEC mode, follow these steps to create an IP standard ACL for IP traffic: To delete an access list, use the no access-list access-list-number global configuration command. This example shows how to allow access for only those hosts on the three specified networks. The wildcard bits apply to the host portions of the network addresses. Any host with a source address that does not match the access list statements is rejected. Switch(config)# access-list 1 permit 192.5.255.0 0.0.0.255 Switch(config)# access-list 1 permit 128.88.0.0 0.0.255.255 Switch(config)# access-list 1 permit 36.0.0.0 0.0.0.255 ! (Note: all other access implicitly denied) Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] Create an IP standard ACL, repeating the command as many times as necessary. • For access-list-number, enter the access list number. The range is 1 to 99 and 1300 to 1999. • Use the permit keyword to permit a certain type of traffic if the conditions are matched. Use the deny keyword to deny a certain type of traffic if conditions are matched. • For source, enter the network or host from which the packet is being sent. You can use the any keyword as an abbreviation for 0.0.0.0 255.255.255.255. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 3 end Return to privileged EXEC mode. Step 4 show access-lists Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Beginning in privileged EXEC mode, follow these steps to create an IP extended ACL for IP traffic: To delete an access list, use the no access-list access-list-number global configuration command. This example shows how to create an ACL that permits IP traffic from any source to any destination that has the DSCP value set to 32: Switch(config)# access-list 100 permit ip any any dscp 32 This example shows how to create an ACL that permits IP traffic from a source host at 10.1.1.1 to a destination host at 10.1.1.2 with a precedence value of 5: Switch(config)# access-list 100 permit ip host 10.1.1.1 host 10.1.1.2 precedence 5 This example shows how to create an ACL that permits PIM traffic from any source to a destination group address of 224.0.0.2 with a DSCP set to 32: Switch(config)# access-list 102 permit pim any 224.0.0.2 dscp 32 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard Create an IP extended ACL, repeating the command as many times as necessary. • For access-list-number, enter the access list number. The range is 100 to 199 and 2000 to 2699. • Use the permit keyword to permit a certain type of traffic if the conditions are matched. Use the deny keyword to deny a certain type of traffic if conditions are matched. • For protocol, enter the name or number of an IP protocol. Use the question mark (?) to see a list of available protocol keywords. • For source, enter the network or host from which the packet is being sent. You specify this by using dotted decimal notation, by using the any keyword as an abbreviation for source 0.0.0.0 source-wildcard 255.255.255.255, or by using the host keyword for source 0.0.0.0. • For source-wildcard, enter the wildcard bits by placing ones in the bit positions that you want to ignore. You specify the wildcard by using dotted decimal notation, by using the any keyword as an abbreviation for source 0.0.0.0 source-wildcard 255.255.255.255, or by using the host keyword for source 0.0.0.0. • For destination, enter the network or host to which the packet is being sent. You have the same options for specifying the destination and destination-wildcard as those described by source and source-wildcard. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 3 end Return to privileged EXEC mode. Step 4 show access-lists Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-39 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Beginning in privileged EXEC mode, follow these steps to create a Layer 2 MAC ACL for non-IP traffic: To delete an access list, use the no mac access-list extended access-list-name global configuration command. This example shows how to create a Layer 2 MAC ACL with two permit statements. The first statement allows traffic from the host with MAC address 0001.0000.0001 to the host with MAC address 0002.0000.0001. The second statement allows only Ethertype XNS-IDP traffic from the host with MAC address 0001.0000.0002 to the host with MAC address 0002.0000.0002. Switch(config)# mac access-list extended maclist1 Switch(config-ext-macl)# permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0 Switch(config-ext-macl)# permit 0001.0000.0002 0.0.0 0002.0000.0002 0.0.0 xns-idp ! (Note: all other access implicitly denied) Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mac access-list extended name Create a Layer 2 MAC ACL by specifying the name of the list. After entering this command, the mode changes to extended MAC ACL configuration. Step 3 {permit | deny} {host src-MAC-addr mask | any | host dst-MAC-addr | dst-MAC-addr mask} [type mask] Specify the type of traffic to permit or deny if the conditions are matched, entering the command as many times as necessary. • For src-MAC-addr, enter the MAC address of the host from which the packet is being sent. You specify this by using the hexadecimal format (H.H.H), by using the any keyword as an abbreviation for source 0.0.0, source-wildcard 255.255.255, or by using the host keyword for source 0.0.0. • For mask, enter the wildcard bits by placing ones in the bit positions that you want to ignore. • For dst-MAC-addr, enter the MAC address of the host to which the packet is being sent. You specify this by using the hexadecimal format (H.H.H), by using the any keyword as an abbreviation for source 0.0.0, source-wildcard 255.255.255, or by using the host keyword for source 0.0.0. • (Optional) For type mask, specify the Ethertype number of a packet with Ethernet II or SNAP encapsulation to identify the protocol of the packet. For type, the range is from 0 to 65535, typically specified in hexadecimal. For mask, enter the don’t care bits applied to the Ethertype before testing for a match. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 4 end Return to privileged EXEC mode. Step 5 show access-lists [access-list-number | access-list-name] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-40 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Classifying Traffic by Using Class Maps You use the class-map global configuration command to name and to isolate a specific traffic flow (or class) from all other traffic. The class map defines the criteria to use to match against a specific traffic flow to further classify it. Match statements can include criteria such as an ACL, IP precedence values, or DSCP values. The match criterion is defined with one match statement entered within the class-map configuration mode. Note You can also create class-maps during policy map creation by using the class policy-map configuration command. For more information, see the “Classifying, Policing, and Marking Traffic by Using Policy Maps” section on page 27-42. Beginning in privileged EXEC mode, follow these steps to create a class map and to define the match criterion to classify traffic: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] or access-list access-list-number {deny | permit} protocol source [source-wildcard] destination [destination-wildcard] or mac access-list extended name {permit | deny} {host src-MAC-addr mask | any | host dst-MAC-addr | dst-MAC-addr mask} [type mask] Create an IP standard or extended ACL for IP traffic or a Layer 2 MAC ACL for non-IP traffic, repeating the command as many times as necessary. For more information, see the “Classifying Traffic by Using ACLs” section on page 27-37. Note When creating an access list, remember that, by default, the end of the access list contains an implicit deny statement for everything if it did not find a match before reaching the end. Step 3 class-map [match-all | match-any] class-map-name Create a class map, and enter class-map configuration mode. By default, no class maps are defined. • (Optional) Use the match-all keyword to perform a logical-AND of all matching statements under this class map. All match criteria in the class map must be matched. • (Optional) Use the match-any keyword to perform a logical-OR of all matching statements under this class map. One or more match criteria must be matched. • For class-map-name, specify the name of the class map. If neither the match-all or match-any keyword is specified, the default is match-all. Note Because only one match command per class map is supported, the match-all and match-any keywords function the same.27-41 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To delete an existing class map, use the no class-map [match-all | match-any] class-map-name global configuration command. To remove a match criterion, use the no match {access-group acl-index-or-name | ip dscp | ip precedence} class-map configuration command. This example shows how to configure the class map called class1. The class1 has one match criterion, which is access list 103. It permits traffic from any host to any destination that matches a DSCP value of 10. Switch(config)# access-list 103 permit any any dscp 10 Switch(config)# class-map class1 Switch(config-cmap)# match access-group 103 Switch(config-cmap)# end Switch# This example shows how to create a class map called class2, which matches incoming traffic with DSCP values of 10, 11, and 12. Switch(config)# class-map class2 Switch(config-cmap)# match ip dscp 10 11 12 Switch(config-cmap)# end Switch# This example shows how to create a class map called class3, which matches incoming traffic with IP-precedence values of 5, 6, and 7: Switch(config)# class-map class3 Switch(config-cmap)# match ip precedence 5 6 7 Switch(config-cmap)# end Switch# Step 4 match {access-group acl-index-or-name | ip dscp dscp-list | ip precedence ip-precedence-list} Define the match criterion to classify traffic. By default, no match criterion is defined. Only one match criterion per class map is supported, and only one ACL per class map is supported. • For access-group acl-index-or-name, specify the number or name of the ACL created in Step 2. • For ip dscp dscp-list, enter a list of up to eight IP DSCP values to match against incoming packets. Separate each value with a space. The range is 0 to 63. • For ip precedence ip-precedence-list, enter a list of up to eight IP-precedence values to match against incoming packets. Separate each value with a space. The range is 0 to 7. Step 5 end Return to privileged EXEC mode. Step 6 show class-map Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose27-42 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Classifying, Policing, and Marking Traffic by Using Policy Maps A policy map specifies which traffic class to act on. Actions can include trusting the CoS, DSCP, or IP precedence values in the traffic class; setting a specific DSCP or IP precedence value in the traffic class; and specifying the traffic bandwidth limitations for each matched traffic class (policer) and the action to take when the traffic is out of profile (marking). A policy map also has these characteristics: • A policy map can contain multiple class statements, each with different match criteria and policers. • A separate policy-map class can exist for each type of traffic received through an interface. • A policy-map trust state and an interface trust state are mutually exclusive, and whichever is configured last takes affect. You can attach only one policy map per ingress interface. Beginning in privileged EXEC mode, follow these steps to create a policy map: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 class-map [match-all | match-any] class-map-name Create a class map, and enter class-map configuration mode. By default, no class maps are defined. • (Optional) Use the match-all keyword to perform a logical-AND of all matching statements under this class map. All match criteria in the class map must be matched. • (Optional) Use the match-any keyword to perform a logical-OR of all matching statements under this class map. One or more match criteria must be matched. • For class-map-name, specify the name of the class map. If neither the match-all or match-any keyword is specified, the default is match-all. Note Because only one match command per class map is supported, the match-all and match-any keywords function the same. Step 3 policy-map policy-map-name Create a policy map by entering the policy map name, and enter policy-map configuration mode. By default, no policy maps are defined. The default behavior of a policy map is to set the DSCP to 0 if the packet is an IP packet and to set the CoS to 0 if the packet is tagged. No policing is performed. Step 4 class class-map-name Define a traffic classification, and enter policy-map class configuration mode. By default, no policy map class-maps are defined. If a traffic class has already been defined by using the class-map global configuration command, specify its name for class-map-name in this command.27-43 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Step 5 trust [cos | dscp | ip-precedence] Configure the trust state, which QoS uses to generate a CoS-based or DSCP-based QoS label. Note This command is mutually exclusive with the set command within the same policy map. If you enter the trust command, then skip Step 6. By default, the port is not trusted. If no keyword is specified when the command is entered, the default is dscp. The keywords have these meanings: • cos—QoS derives the DSCP value by using the received or default port CoS value and the CoS-to-DSCP map. • dscp—QoS derives the DSCP value by using the DSCP value from the ingress packet. For non-IP packets that are tagged, QoS derives the DSCP value by using the received CoS value; for non-IP packets that are untagged, QoS derives the DSCP value by using the default port CoS value. In either case, the DSCP value is derived from the CoS-to-DSCP map. • ip-precedence—QoS derives the DSCP value by using the IP precedence value from the ingress packet and the IP-precedence-to-DSCP map. For non-IP packets that are tagged, QoS derives the DSCP value by using the received CoS value; for non-IP packets that are untagged, QoS derives the DSCP value by using the default port CoS value. In either case, the DSCP value is derived from the CoS-to-DSCP map. For more information, see the “Configuring the CoS-to-DSCP Map” section on page 27-47. Step 6 set {ip dscp new-dscp | ip precedence new-precedence} Classify IP traffic by setting a new value in the packet. • For ip dscp new-dscp, enter a new DSCP value to be assigned to the classified traffic. The range is 0 to 63. • For ip precedence new-precedence, enter a new IP-precedence value to be assigned to the classified traffic. The range is 0 to 7. Step 7 police rate-bps burst-byte [exceed-action {drop | policed-dscp-transmit}] Define a policer for the classified traffic. By default, no policer is defined. For information on the number of policers supported, see the “Standard QoS Configuration Guidelines” section on page 27-29. • For rate-bps, specify average traffic rate in bits per second (bps). The range is 8000 to 1000000000. • For burst-byte, specify the normal burst size in bytes. The range is 8000 to 1000000. • (Optional) Specify the action to take when the rates are exceeded. Use the exceed-action drop keywords to drop the packet. Use the exceed-action policed-dscp-transmit keywords to mark down the DSCP value (by using the policed-DSCP map) and send the packet. For more information, see the “Configuring the Policed-DSCP Map” section on page 27-49. Command Purpose27-44 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To delete an existing policy map, use the no policy-map policy-map-name global configuration command. To delete an existing class map, use the no class class-map-name policy-map configuration command. To return to the untrusted state, use the no trust policy-map configuration command. To remove an assigned DSCP or IP precedence value, use the no set {ip dscp new-dscp | ip precedence new-precedence} policy-map configuration command. To remove an existing policer, use the no police rate-bps burst-byte [exceed-action {drop | policed-dscp-transmit}] policy-map configuration command. To remove the policy map and interface association, use the no service-policy input policy-map-name interface configuration command. This example shows how to create a policy map and attach it to an ingress interface on stack member 2. In the configuration, the IP standard ACL permits traffic from network 10.1.0.0. For traffic matching this classification, the DSCP value in the incoming packet is trusted. If the matched traffic exceeds an average traffic rate of 48000 bps and a normal burst size of 8000 bytes, its DSCP is marked down (based on the policed-DSCP map) and sent: Switch(config)# access-list 1 permit 10.1.0.0 0.0.255.255 Switch(config)# class-map ipclass1 Switch(config-cmap)# match access-group 1 Switch(config-cmap)# exit Switch(config)# policy-map flow1t Switch(config-pmap)# class ipclass1 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police 48000 8000 exceed-action policed-dscp-transmit Switch(config-pmap-c)# exit Switch(config-pmap)# exit Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# service-policy input flow1t This example shows how to create a Layer 2 MAC ACL with two permit statements and attach it to an ingress interface on the stack master. The first permit statement allows traffic from the host with MAC address 0001.0000.0001 destined for the host with MAC address 0002.0000.0001. The second permit statement allows only Ethertype XNS-IDP traffic from the host with MAC address 0001.0000.0002 destined for the host with MAC address 0002.0000.0002. Switch(config)# mac access-list extended maclist1 Switch(config-ext-mac)# permit 0001.0000.0001 0.0.0 0002.0000.0001 0.0.0 Switch(config-ext-mac)# permit 0001.0000.0002 0.0.0 0002.0000.0002 0.0.0 xns-idp Switch(config-ext-mac)# exit Switch(config)# mac access-list extended maclist2 Switch(config-ext-mac)# permit 0001.0000.0003 0.0.0 0002.0000.0003 0.0.0 Switch(config-ext-mac)# permit 0001.0000.0004 0.0.0 0002.0000.0004 0.0.0 aarp Step 8 exit Return to policy map configuration mode. Step 9 exit Return to global configuration mode. Step 10 interface interface-id Enter interface configuration mode, and specify the interface to attach to the policy map. Valid interfaces include physical interfaces. Step 11 service-policy input policy-map-name Specify the policy-map name, and apply it to an ingress interface. Only one policy map per ingress interface is supported. Step 12 end Return to privileged EXEC mode. Step 13 show policy-map [policy-map-name [class class-map-name]] Verify your entries. Step 14 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose27-45 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Switch(config-ext-mac)# exit Switch(config)# class-map macclass1 Switch(config-cmap)# match access-group maclist1 Switch(config-cmap)# exit Switch(config)# policy-map macpolicy1 Switch(config-pmap)# class macclass1 Switch(config-pmap-c)# set ip dscp 63 Switch(config-pmap-c)# exit Switch(config-pmap)# class macclass2 maclist2 Switch(config-pmap-c)# set ip dscp 45 Switch(config-pmap-c)# exit Switch(config-pmap)# exit Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# mls qos trust cos Switch(config-if)# service-policy input macpolicy1 Classifying, Policing, and Marking Traffic by Using Aggregate Policers By using an aggregate policer, you can create a policer that is shared by multiple traffic classes within the same policy map. However, you cannot use the aggregate policer across different policy maps or interfaces. Beginning in privileged EXEC mode, follow these steps to create an aggregate policer: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos aggregate-policer aggregate-policer-name rate-bps burst-byte exceed-action {drop | policed-dscp-transmit} Define the policer parameters that can be applied to multiple traffic classes within the same policy map. By default, no aggregate policer is defined. For information on the number of policers supported, see the “Standard QoS Configuration Guidelines” section on page 27-29 • For aggregate-policer-name, specify the name of the aggregate policer. • For rate-bps, specify average traffic rate in bits per second (bps). The range is 8000 to 1000000000. • For burst-byte, specify the normal burst size in bytes. The range is 8000 to 1000000. • Specify the action to take when the rates are exceeded. Use the exceed-action drop keywords to drop the packet. Use the exceed-action policed-dscp-transmit keywords to mark down the DSCP value (by using the policed-DSCP map) and send the packet. For more information, see the “Configuring the Policed-DSCP Map” section on page 27-49. Step 3 class-map [match-all | match-any] class-map-name Create a class map to classify traffic as necessary. For more information, see the “Classifying Traffic by Using Class Maps” section on page 27-40. Step 4 policy-map policy-map-name Create a policy map by entering the policy map name, and enter policy-map configuration mode. For more information, see the “Classifying, Policing, and Marking Traffic by Using Policy Maps” section on page 27-42.27-46 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To remove the specified aggregate policer from a policy map, use the no police aggregate aggregate-policer-name policy map configuration mode. To delete an aggregate policer and its parameters, use the no mls qos aggregate-policer aggregate-policer-name global configuration command. This example shows how to create an aggregate policer and attach it to multiple classes within a policy map. In the configuration, the IP ACLs permit traffic from network 10.1.0.0 and from host 11.3.1.1. For traffic coming from network 10.1.0.0, the DSCP in the incoming packets is trusted. For traffic coming from host 11.3.1.1, the DSCP in the packet is changed to 56. The traffic rate from the 10.1.0.0 network and from host 11.3.1.1 is policed. If the traffic exceeds an average rate of 48000 bps and a normal burst size of 8000 bytes, its DSCP is marked down (based on the policed-DSCP map) and sent. The policy map is attached to an ingress interface on stack member 2. Switch(config)# access-list 1 permit 10.1.0.0 0.0.255.255 Switch(config)# access-list 2 permit 11.3.1.1 Switch(config)# mls qos aggregate-police transmit1 48000 8000 exceed-action policed-dscp-transmit Switch(config)# class-map ipclass1 Switch(config-cmap)# match access-group 1 Switch(config-cmap)# exit Switch(config)# class-map ipclass2 Switch(config-cmap)# match access-group 2 Switch(config-cmap)# exit Switch(config)# policy-map aggflow1 Switch(config-pmap)# class ipclass1 Switch(config-pmap-c)# trust dscp Switch(config-pmap-c)# police aggregate transmit1 Switch(config-pmap-c)# exit Switch(config-pmap)# class ipclass2 Switch(config-pmap-c)# set ip dscp 56 Switch(config-pmap-c)# police aggregate transmit1 Switch(config-pmap-c)# exit Switch(config-pmap)# exit Step 5 class class-map-name Define a traffic classification, and enter policy-map class configuration mode. For more information, see the “Classifying, Policing, and Marking Traffic by Using Policy Maps” section on page 27-42. Step 6 police aggregate aggregate-policer-name Apply an aggregate policer to multiple classes in the same policy map. For aggregate-policer-name, enter the name specified in Step 2. Step 7 exit Return to global configuration mode. Step 8 interface interface-id Enter interface configuration mode, and specify the interface to attach to the policy map. Valid interfaces include physical interfaces. Step 9 service-policy input policy-map-name Specify the policy-map name, and apply it to an ingress interface. Only one policy map per ingress interface is supported. Step 10 end Return to privileged EXEC mode. Step 11 show mls qos aggregate-policer [aggregate-policer-name] Verify your entries. Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose27-47 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# service-policy input aggflow1 Switch(config-if)# exit Configuring DSCP Maps These sections describe how to configure the DSCP maps: • Configuring the CoS-to-DSCP Map, page 27-47 (optional) • Configuring the IP-Precedence-to-DSCP Map, page 27-48 (optional) • Configuring the Policed-DSCP Map, page 27-49 (optional, unless the null settings in the map are not appropriate) • Configuring the DSCP-to-CoS Map, page 27-50 (optional) • Configuring the DSCP-to-DSCP-Mutation Map, page 27-51 (optional, unless the null settings in the map are not appropriate) All the maps, except the DSCP-to-DSCP-mutation map, are globally defined and are applied to all ports. Configuring the CoS-to-DSCP Map You use the CoS-to-DSCP map to map CoS values in incoming packets to a DSCP value that QoS uses internally to represent the priority of the traffic. Table 27-12 shows the default CoS-to-DSCP map. If these values are not appropriate for your network, you need to modify them. Beginning in privileged EXEC mode, follow these steps to modify the CoS-to-DSCP map. This procedure is optional. To return to the default map, use the no mls qos cos-dscp global configuration command. Table 27-12 Default CoS-to-DSCP Map CoS value 0 1 2 3 4 5 6 7 DSCP value 0 8 16 24 32 40 48 56 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map cos-dscp dscp1...dscp8 Modify the CoS-to-DSCP map. For dscp1...dscp8, enter eight DSCP values that correspond to CoS values 0 to 7. Separate each DSCP value with a space. The DSCP range is 0 to 63. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos maps cos-dscp Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-48 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS This example shows how to modify and display the CoS-to-DSCP map: Switch(config)# mls qos map cos-dscp 10 15 20 25 30 35 40 45 Switch(config)# end Switch# show mls qos maps cos-dscp Cos-dscp map: cos: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 10 15 20 25 30 35 40 45 Configuring the IP-Precedence-to-DSCP Map You use the IP-precedence-to-DSCP map to map IP precedence values in incoming packets to a DSCP value that QoS uses internally to represent the priority of the traffic. Table 27-13 shows the default IP-precedence-to-DSCP map: If these values are not appropriate for your network, you need to modify them. Beginning in privileged EXEC mode, follow these steps to modify the IP-precedence-to-DSCP map. This procedure is optional. To return to the default map, use the no mls qos ip-prec-dscp global configuration command. This example shows how to modify and display the IP-precedence-to-DSCP map: Switch(config)# mls qos map ip-prec-dscp 10 15 20 25 30 35 40 45 Switch(config)# end Switch# show mls qos maps ip-prec-dscp IpPrecedence-dscp map: ipprec: 0 1 2 3 4 5 6 7 -------------------------------- dscp: 10 15 20 25 30 35 40 45 Table 27-13 Default IP-Precedence-to-DSCP Map IP precedence value 0 1 2 3 4 5 6 7 DSCP value 0 8 16 24 32 40 48 56 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map ip-prec-dscp dscp1...dscp8 Modify the IP-precedence-to-DSCP map. For dscp1...dscp8, enter eight DSCP values that correspond to the IP precedence values 0 to 7. Separate each DSCP value with a space. The DSCP range is 0 to 63. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos maps ip-prec-dscp Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-49 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the Policed-DSCP Map You use the policed-DSCP map to mark down a DSCP value to a new value as the result of a policing and marking action. The default policed-DSCP map is a null map, which maps an incoming DSCP value to the same DSCP value. Beginning in privileged EXEC mode, follow these steps to modify the policed-DSCP map. This procedure is optional. To return to the default map, use the no mls qos policed-dscp global configuration command. This example shows how to map DSCP 50 to 57 to a marked-down DSCP value of 0: Switch(config)# mls qos map policed-dscp 50 51 52 53 54 55 56 57 to 0 Switch(config)# end Switch# show mls qos maps policed-dscp Policed-dscp map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 01 02 03 04 05 06 07 08 09 1 : 10 11 12 13 14 15 16 17 18 19 2 : 20 21 22 23 24 25 26 27 28 29 3 : 30 31 32 33 34 35 36 37 38 39 4 : 40 41 42 43 44 45 46 47 48 49 5 : 00 00 00 00 00 00 00 00 58 59 6 : 60 61 62 63 Note In this policed-DSCP map, the marked-down DSCP values are shown in the body of the matrix. The d1 column specifies the most-significant digit of the original DSCP; the d2 row specifies the least-significant digit of the original DSCP. The intersection of the d1 and d2 values provides the marked-down value. For example, an original DSCP value of 53 corresponds to a marked-down DSCP value of 0. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map policed-dscp dscp-list to mark-down-dscp Modify the policed-DSCP map. • For dscp-list, enter up to eight DSCP values separated by spaces. Then enter the to keyword. • For mark-down-dscp, enter the corresponding policed (marked down) DSCP value. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos maps policed-dscp Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-50 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the DSCP-to-CoS Map You use the DSCP-to-CoS map to generate a CoS value, which is used to select one of the four egress queues. Table 27-14 shows the default DSCP-to-CoS map. If these values are not appropriate for your network, you need to modify them. Beginning in privileged EXEC mode, follow these steps to modify the DSCP-to-CoS map. This procedure is optional. To return to the default map, use the no mls qos dscp-cos global configuration command. This example shows how to map DSCP values 0, 8, 16, 24, 32, 40, 48, and 50 to CoS value 0 and to display the map: Switch(config)# mls qos map dscp-cos 0 8 16 24 32 40 48 50 to 0 Switch(config)# end Switch# show mls qos maps dscp-cos Dscp-cos map: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 00 00 00 00 00 00 00 00 01 1 : 01 01 01 01 01 01 00 02 02 02 2 : 02 02 02 02 00 03 03 03 03 03 3 : 03 03 00 04 04 04 04 04 04 04 4 : 00 05 05 05 05 05 05 05 00 06 5 : 00 06 06 06 06 06 07 07 07 07 6 : 07 07 07 07 Note In the above DSCP-to-CoS map, the CoS values are shown in the body of the matrix. The d1 column specifies the most-significant digit of the DSCP; the d2 row specifies the least-significant digit of the DSCP. The intersection of the d1 and d2 values provides the CoS value. For example, in the DSCP-to-CoS map, a DSCP value of 08 corresponds to a CoS value of 0. Table 27-14 Default DSCP-to-CoS Map DSCP value 0–7 8–15 16–23 24–31 32–39 40–47 48–55 56–63 CoS value 0 1 2 3 4 5 6 7 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map dscp-cos dscp-list to cos Modify the DSCP-to-CoS map. • For dscp-list, enter up to eight DSCP values separated by spaces. Then enter the to keyword. • For cos, enter the CoS value to which the DSCP values correspond. The DSCP range is 0 to 63; the CoS range is 0 to 7. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos maps dscp-to-cos Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-51 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the DSCP-to-DSCP-Mutation Map If two QoS domains have different DSCP definitions, use the DSCP-to-DSCP-mutation map to translate one set of DSCP values to match the definition of another domain. You apply the DSCP-to-DSCP-mutation map to the receiving interface (ingress mutation) at the boundary of a QoS administrative domain. With ingress mutation, the new DSCP value overwrites the one in the packet, and QoS treats the packet with this new value. The switch sends the packet out the interface with the new DSCP value. You can configure multiple DSCP-to-DSCP-mutation maps on an ingress port. The default DSCP-to-DSCP-mutation map is a null map, which maps an incoming DSCP value to the same DSCP value. Beginning in privileged EXEC mode, follow these steps to modify the DSCP-to-DSCP-mutation map. This procedure is optional. To return to the default map, use the no mls qos dscp-mutation dscp-mutation-name global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos map dscp-mutation dscp-mutation-name in-dscp to out-dscp Modify the DSCP-to-DSCP-mutation map. • For dscp-mutation-name, enter the mutation map name. You can create more than one map by specifying a new name. • For in-dscp, enter up to eight DSCP values separated by spaces. Then enter the to keyword. • For out-dscp, enter a single DSCP value. The DSCP range is 0 to 63. Step 3 interface interface-id Enter interface configuration mode, and specify the interface to which to attach the map. Valid interfaces include physical interfaces. Step 4 mls qos trust dscp Configure the ingress port as a DSCP-trusted port. By default, the port is not trusted. Step 5 mls qos dscp-mutation dscp-mutation-name Apply the map to the specified ingress DSCP-trusted port. For dscp-mutation-name, enter the mutation map name specified in Step 2. Step 6 end Return to privileged EXEC mode. Step 7 show mls qos maps dscp-mutation Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.27-52 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS This example shows how to define the DSCP-to-DSCP-mutation map. All the entries that are not explicitly configured are not modified (remains as specified in the null map): Switch(config)# mls qos map dscp-mutation mutation1 1 2 3 4 5 6 7 to 0 Switch(config)# mls qos map dscp-mutation mutation1 8 9 10 11 12 13 to 10 Switch(config)# mls qos map dscp-mutation mutation1 20 21 22 to 20 Switch(config)# mls qos map dscp-mutation mutation1 30 31 32 33 34 to 30 Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# mls qos trust dscp Switch(config-if)# mls qos dscp-mutation mutation1 Switch(config-if)# end Switch# show mls qos maps dscp-mutation mutation1 Dscp-dscp mutation map: mutation1: d1 : d2 0 1 2 3 4 5 6 7 8 9 --------------------------------------- 0 : 00 00 00 00 00 00 00 00 10 10 1 : 10 10 10 10 14 15 16 17 18 19 2 : 20 20 20 23 24 25 26 27 28 29 3 : 30 30 30 30 30 35 36 37 38 39 4 : 40 41 42 43 44 45 46 47 48 49 5 : 50 51 52 53 54 55 56 57 58 59 6 : 60 61 62 63 Note In the above DSCP-to-DSCP-mutation map, the mutated values are shown in the body of the matrix. The d1 column specifies the most-significant digit of the original DSCP; the d2 row specifies the least-significant digit of the original DSCP. The intersection of the d1 and d2 values provides the mutated value. For example, a DSCP value of 12 corresponds to a mutated value of 10. Configuring Ingress Queue Characteristics Depending on the complexity of your network and your QoS solution, you might need to perform all of the tasks in the next sections. You will need to make decisions about these characteristics: • Which packets are assigned (by DSCP or CoS value) to each queue? • What drop percentage thresholds apply to each queue, and which CoS or DSCP values map to each threshold? • How much of the available buffer space is allocated between the queues? • How much of the available bandwidth is allocated between the queues? • Is there traffic (such as voice) that should be given high priority? These sections describe how to configure ingress queue characteristics: • Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds, page 27-53 (optional) • Allocating Buffer Space Between the Ingress Queues, page 27-54 (optional) • Allocating Bandwidth Between the Ingress Queues, page 27-55 (optional) • Configuring the Ingress Priority Queue, page 27-56 (optional)27-53 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds You can prioritize traffic by placing packets with particular DSCPs or CoSs into certain queues and adjusting the queue thresholds so that packets with lower priorities are dropped. Beginning in privileged EXEC mode, follow these steps to map DSCP or CoS values to an ingress queue and to set WTD thresholds. This procedure is optional. To return to the default CoS input queue threshold map or the default DSCP input queue threshold map, use the no mls qos srr-queue input cos-map or the no mls qos srr-queue input dscp-map global configuration command. To return to the default WTD threshold percentages, use the no mls qos srr-queue input threshold queue-id global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos srr-queue input dscp-map queue queue-id threshold threshold-id dscp1...dscp8 or mls qos srr-queue input cos-map queue queue-id threshold threshold-id cos1...cos8 Map DSCP or CoS values to an ingress queue and to a threshold ID. By default, DSCP values 0–39 and 48–63 are mapped to queue 1 and threshold 1. DSCP values 40–47 are mapped to queue 2 and threshold 1. By default, CoS values 0–4, 6, and 7 are mapped to queue 1 and threshold 1. CoS value 5 is mapped to queue 2 and threshold 1. • For queue-id, the range is 1 to 2. • For threshold-id, the range is 1 to 3. The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. • For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. • For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. Step 3 mls qos srr-queue input threshold queue-id threshold-percentage1 threshold-percentage2 Assign the two WTD threshold percentages for (threshold 1 and 2) to an ingress queue. The default, both thresholds are set to 100 percent. • For queue-id, the range is 1 to 2. • For threshold-percentage1 threshold-percentage2, the range is 1 to 100. Separate each value with a space. Each threshold value is a percentage of the total number of queue descriptors allocated for the queue. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos maps Verify your entries. The DSCP input queue threshold map is displayed as a matrix. The d1 column specifies the most-significant digit of the DSCP number; the d2 row specifies the least-significant digit in the DSCP number. The intersection of the d1 and the d2 values provides the queue ID and threshold ID; for example, queue 2 and threshold 1 (02-01). The CoS input queue threshold map shows the CoS value in the top row and the corresponding queue ID and threshold ID in the second row; for example, queue 2 and threshold 2 (2-2). Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-54 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS This example shows how to map DSCP values 0 to 6 to ingress queue 1 and to threshold 1 with a drop threshold of 50 percent. It maps DSCP values 20 to 26 to ingress queue 1 and to threshold 2 with a drop threshold of 70 percent: Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 1 0 1 2 3 4 5 6 Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 2 20 21 22 23 24 25 26 Switch(config)# mls qos srr-queue input threshold 1 50 70 In this example, the DSCP values (0 to 6) are assigned the WTD threshold of 50 percent and will be dropped sooner than the DSCP values (20 to 26) assigned to the WTD threshold of 70 percent. Allocating Buffer Space Between the Ingress Queues You define the ratio (allocate the amount of space) with which to divide the ingress buffers between the two queues. The buffer and the bandwidth allocation determine how much data can be buffered before packets are dropped. Beginning in privileged EXEC mode, follow these steps to allocate the buffers between the ingress queues. This procedure is optional. To return to the default setting, use the no mls qos srr-queue input buffers global configuration command. This example shows how to allocate 60 percent of the buffer space to ingress queue 1 and 40 percent of the buffer space to ingress queue 2: Switch(config)# mls qos srr-queue input buffers 60 40 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos srr-queue input buffers percentage1 percentage2 Allocate the buffers between the ingress queues By default 90 percent of the buffers are allocated to queue 1, and 10 percent of the buffers are allocated to queue 2. For percentage1 percentage2, the range is 0 to 100. Separate each value with a space. You should allocate the buffers so that the queues can handle any incoming bursty traffic. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos interface buffer or show mls qos input-queue Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-55 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Allocating Bandwidth Between the Ingress Queues You need to specify how much of the available bandwidth is allocated between the ingress queues. The ratio of the weights is the ratio of the frequency in which the SRR scheduler sends packets from each queue. The bandwidth and the buffer allocation determine how much data can be buffered before packets are dropped. On ingress queues, SRR operates only in shared mode. Beginning in privileged EXEC mode, follow these steps to allocate bandwidth between the ingress queues. This procedure is optional. To return to the default setting, use the no mls qos srr-queue input bandwidth global configuration command. This example shows how to assign the ingress bandwidth for the queues in the stack. Priority queueing is disabled, and the shared bandwidth ratio allocated to queue 1 is 25/(25+75) and to queue 2 is 75/(25+75): Switch(config)# mls qos srr-queue input priority-queue 2 bandwidth 0 Switch(config)# mls qos srr-queue input bandwidth 25 75 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos srr-queue input bandwidth weight1 weight2 Assign shared round robin weights to the ingress queues. The default setting for weight1 and weight2 is 4 (1/2 of the bandwidth is equally shared between the two queues). For weight1 and weight2, the range is 1 to 100. Separate each value with a space. SRR services the priority queue for its configured weight as specified by the bandwidth keyword in the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. Then, SRR shares the remaining bandwidth with both ingress queues and services them as specified by the weights configured with the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. For more information, see the “Configuring the Ingress Priority Queue” section on page 27-56. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos interface queueing or show mls qos input-queue Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-56 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring the Ingress Priority Queue You should use the priority queue only for traffic that needs to be expedited (for example, voice traffic, which needs minimum delay and jitter). The priority queue is guaranteed part of the bandwidth to reduce the delay and jitter under heavy network traffic on an oversubscribed ring (when there is more traffic than the backplane can carry, and the queues are full and dropping frames). SRR services the priority queue for its configured weight as specified by the bandwidth keyword in the mls qos srr-queue input priority-queue queue-id bandwidth weight global configuration command. Then, SRR shares the remaining bandwidth with both ingress queues and services them as specified by the weights configured with the mls qos srr-queue input bandwidth weight1 weight2 global configuration command. Beginning in privileged EXEC mode, follow these steps to configure the priority queue. This procedure is optional. To return to the default setting, use the no mls qos srr-queue input priority-queue queue-id global configuration command. To disable priority queueing, set the bandwidth weight to 0, for example, mls qos srr-queue input priority-queue queue-id bandwidth 0. This example shows how to assign the ingress bandwidths for the queues in the stack. Queue 1 is the priority queue with 10 percent of the bandwidth allocated to it. The bandwidth ratios allocated to queues 1 and 2 is 4/(4+4). SRR services queue 1 (the priority queue) first for its configured 10 percent bandwidth. Then SRR equally shares the remaining 90 percent of the bandwidth between queues 1 and 2 by allocating 45 percent to each queue: Switch(config)# mls qos srr-queue input priority-queue 1 bandwidth 10 Switch(config)# mls qos srr-queue input bandwidth 4 4 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos srr-queue input priority-queue queue-id bandwidth weight Assign a queue as the priority queue and guarantee bandwidth on the stack ring if the ring is congested. By default, the priority queue is queue 2, and 10 percent of the bandwidth is allocated to it. • For queue-id, the range is 1 to 2. • For bandwidth weight, assign the bandwidth percentage of the stack ring. The range is 0 to 40. The amount of bandwidth that can be guaranteed is restricted because a large value affects the entire ring and can degrade the stack performance. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos interface queueing or show mls qos input-queue Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-57 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring Egress Queue Characteristics Depending on the complexity of your network and your QoS solution, you might need to perform all of the tasks in the next sections. You will need to make decisions about these characteristics: • Which packets are mapped by DSCP or CoS value to each queue and threshold ID? • What drop percentage thresholds apply to the queue-set (four egress queues per port), and how much reserved and maximum memory is needed for the traffic type? • How much of the fixed buffer space is allocated to the queue-set? • Does the bandwidth of the port need to be rate limited? • How often should the egress queues be serviced and which technique (shaped, shared, or both) should be used? These sections describe how to configure egress queue characteristics: • Allocating Buffer Space to and Setting WTD Thresholds for an Egress Queue-Set, page 27-57 (optional) • Mapping DSCP or CoS Values to an Egress Queue and to a Threshold ID, page 27-59 (optional) • Configuring SRR Shaped Weights on Egress Queues, page 27-61 (optional) • Configuring SRR Shared Weights on Egress Queues, page 27-62 (optional) • Limiting the Bandwidth on an Egress Interface, page 27-63 (optional) Allocating Buffer Space to and Setting WTD Thresholds for an Egress Queue-Set You can guarantee the availability of buffers, set WTD thresholds, and configure the maximum memory allocation for a queue-set by using the mls qos queue-set output qset-id threshold queue-id drop-threshold1 drop-threshold2 reserved-threshold maximum-threshold global configuration command. Each threshold value is a percentage of the queue’s allocated memory, which you specify by using the mls qos queue-set output qset-id buffers allocation1 ... allocation4 global configuration command. The queues use WTD to support distinct drop percentages for different traffic classes. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution.27-58 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Beginning in privileged EXEC mode, follow these steps to configure the memory allocation and drop thresholds for a queue-set. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos queue-set output qset-id buffers allocation1 ... allocation4 Allocate buffers to a queue-set. By default, all allocation values are equally mapped among the four queues (25, 25, 25, 25). Each queue has 1/4 of the buffer space. • For qset-id, enter the ID of the queue-set. The range is 1 to 2. Each port belongs to a queue-set, which defines all the characteristics of the four egress queues per port. • For allocation1 ... allocation4, specify four percentages, one for each queue in the queue-set. The range is 0 to 100. Separate each value with a space. Allocate buffers according to the importance of the traffic; for example, give a large percentage of the buffer to the queue with the highest-priority traffic. Step 3 mls qos queue-set output qset-id threshold queue-id drop-threshold1 drop-threshold2 reserved-threshold maximum-threshold Configure the WTD thresholds, guarantee the availability of buffers, and configure the maximum memory allocation for the queue-set (four egress queues per port). By default, the WTD thresholds for queues 1, 3, and 4 are set to 100 percent. The thresholds for queue 2 are set to 50 percent. The reserved thresholds for queues 1, 3, and 4 are set to 50 percent. The reserved threshold for queue 2 is set to 100 percent. The maximum thresholds for all queues are set to 400 percent. • For qset-id, enter the ID of the queue-set specified in Step 2. The range is 1 to 2. • For queue-id, enter the specific queue in the queue-set on which the command is performed. The range is 1 to 4. • For drop-threshold1 drop-threshold2, specify the two WTD thresholds expressed as a percentage of the queue’s allocated memory. The range is 1 to 400 percent. • For reserved-threshold, enter the amount of memory to be guaranteed (reserved) for the queue expressed as a percentage of the allocated memory. The range is 1 to 100 percent. • For maximum-threshold, enable a queue in the full condition to obtain more buffers than are reserved for it. This is the maximum memory the queue can have before the packets are dropped if the common pool is not empty. The range is 1 to 400 percent. Step 4 interface interface-id Specify the interface of the outbound traffic, and enter interface configuration mode. Step 5 queue-set qset-id Map the port to a queue-set. For qset-id, enter the ID of the queue-set specified in Step 2. The range is 1 to 2. The default is 1. Step 6 end Return to privileged EXEC mode.27-59 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To return to the default setting, use the no mls qos queue-set output qset-id buffers global configuration command. To return to the default WTD threshold percentages, use the no mls qos queue-set output qset-id threshold [queue-id] global configuration command. This example shows how to map Fast Ethernet interface 0/1 on stack member 2 to queue-set 2. It allocates 40 percent of the buffer space to egress queue 1 and 20 percent to egress queues 2, 3, and 4. It configures the drop thresholds for queue 2 to 40 and 60 percent of the allocated memory, guarantees (reserves) 100 percent of the allocated memory, and configures 200 percent as the maximum memory this queue can have before packets are dropped: Switch(config)# mls qos queue-set output 2 buffers 40 20 20 20 Switch(config)# mls qos queue-set output 2 threshold 2 40 60 100 200 Switch(config)# interface fastethernet2/0/1 Switch(config-if)# queue-set 2 Mapping DSCP or CoS Values to an Egress Queue and to a Threshold ID You can prioritize traffic by placing packets with particular DSCPs or CoSs into certain queues and adjusting the queue thresholds so that packets with lower priorities are dropped. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Beginning in privileged EXEC mode, follow these steps to map DSCP or CoS values to an egress queue and to a threshold ID. This procedure is optional. Step 7 show mls qos interface [interface-id] buffers Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose27-60 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS To return to the default DSCP output queue threshold map or the default CoS output queue threshold map, use the no mls qos srr-queue output dscp-map or the no mls qos srr-queue output cos-map global configuration command. This example shows how to map DSCP values 10 and 11 to egress queue 1 and to threshold 2: Switch(config)# mls qos srr-queue output dscp-map queue 1 threshold 2 10 11 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 mls qos srr-queue output dscp-map queue queue-id threshold threshold-id dscp1...dscp8 or mls qos srr-queue output cos-map queue queue-id threshold threshold-id cos1...cos8 Map DSCP or CoS values to an egress queue and to a threshold ID. By default, DSCP values 0–15 are mapped to queue 2 and threshold 1. DSCP values 16–31 are mapped to queue 3 and threshold 1. DSCP values 32–39 and 48–63 are mapped to queue 4 and threshold 1. DSCP values 40–47 are mapped to queue 1 and threshold 1. By default, CoS values 0 and 1 are mapped to queue 2 and threshold 1. CoS values 2 and 3 are mapped to queue 3 and threshold 1. CoS values 4, 6, and 7 are mapped to queue 4 and threshold 1. CoS value 5 is mapped to queue 1 and threshold 1. • For queue-id, the range is 1 to 4. • For threshold-id, the range is 1 to 3. The drop-threshold percentage for threshold 3 is predefined. It is set to the queue-full state. • For dscp1...dscp8, enter up to eight values, and separate each value with a space. The range is 0 to 63. • For cos1...cos8, enter up to eight values, and separate each value with a space. The range is 0 to 7. Step 3 end Return to privileged EXEC mode. Step 4 show mls qos maps Verify your entries. The DSCP output queue threshold map is displayed as a matrix. The d1 column specifies the most-significant digit of the DSCP number; the d2 row specifies the least-significant digit in the DSCP number. The intersection of the d1 and the d2 values provides the queue ID and threshold ID; for example, queue 2 and threshold 1 (02-01). The CoS output queue threshold map shows the CoS value in the top row and the corresponding queue ID and threshold ID in the second row; for example, queue 2 and threshold 2 (2-2). Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.27-61 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Configuring SRR Shaped Weights on Egress Queues You can specify how much of the available bandwidth is allocated to each queue. The ratio of the weights is the ratio of frequency in which the SRR scheduler sends packets from each queue. You can configure the egress queues for shaped or shared weights, or both. Use shaping to smooth bursty traffic or to provide a smoother output over time. For information about, see the “SRR Shaping and Sharing” section on page 27-12. For information about shared weights, see the “Configuring SRR Shared Weights on Egress Queues” section on page 27-62. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Beginning in privileged EXEC mode, follow these steps to assign the shaped weights and to enable bandwidth shaping on the four egress queues mapped to a port. This procedure is optional. To return to the default setting, use the no srr-queue bandwidth shape interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Specify the interface of the outbound traffic, and enter interface configuration mode. Step 3 srr-queue bandwidth shape weight1 weight2 weight3 weight4 Assign SRR weights to the egress queues. By default, weight1 is set to 25; weight2, weight3, and weight4 are set to 0, and these queues are in shared mode. For weight1 weight2 weight3 weight4, enter the weights to determine the percentage of the port that is shaped. The inverse ratio (1/weight) determines the shaping bandwidth for this queue. Separate each value with a space. The range is 0 to 65535. If you configure a weight of 0, the corresponding queue operates in shared mode. The weight specified with the srr-queue bandwidth shape command is ignored, and the weights specified with the srr-queue bandwidth share interface configuration command for a queue come into effect. When configuring queues in the same queue-set for both shaping and sharing, make sure that you configure the lowest number queue for shaping. The shaped mode overrides the shared mode. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos interface interface-id queueing Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-62 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS This example shows how to configure bandwidth shaping on queue 1. Because the weight ratios for queues 2, 3, and 4 are set to 0, these queues operate in shared mode. The bandwidth weight for queue 1 is 1/8, which is 12.5 percent: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth shape 8 0 0 0 Configuring SRR Shared Weights on Egress Queues In shared mode, the queues share the bandwidth among them according to the configured weights. The bandwidth is guaranteed at this level but not limited to it. For example, if a queue empties and does not require a share of the link, the remaining queues can expand into the unused bandwidth and share it among them. With sharing, the ratio of the weights determines the frequency of dequeuing; the absolute values are meaningless. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Beginning in privileged EXEC mode, follow these steps to assign the shared weights and to enable bandwidth sharing on the four egress queues mapped to a port. This procedure is optional. To return to the default setting, use the no srr-queue bandwidth share interface configuration command. This example shows how to configure the weight ratio of the SRR scheduler running on egress port Gigabit Ethernet 0/1 on stack member 2. Four queues are used, and the bandwidth ratio allocated for each queue in shared mode is 1/(1+2+3+4), 2/(1+2+3+4), 3/(1+2+3+4), and 4/(1+2+3+4), which is 10 percent, 20 percent, 30 percent, and 40 percent for queues 1, 2, 3, and 4. This means that queue 4 has four times the bandwidth of queue 1, twice the bandwidth of queue 2, and one-and-a-third times the bandwidth of queue 3. Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth share 1 2 3 4 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Specify the interface of the outbound traffic, and enter interface configuration mode. Step 3 srr-queue bandwidth share weight1 weight2 weight3 weight4 Assign SRR weights to the egress queues. By default, all four weights are 25 (1/4 of the bandwidth is allocated to each queue). For weight1 weight2 weight3 weight4, enter the weights to determine the ratio of the frequency in which the SRR scheduler sends packets. Separate each value with a space. The range is 1 to 255. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos interface interface-id queueing Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-63 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Configuring Standard QoS Limiting the Bandwidth on an Egress Interface You can limit the bandwidth on an egress interface. For example, if a customer pays only for a small percentage of a high-speed link, you can limit the bandwidth to that amount. Note The egress queue default settings are suitable for most situations. You should change them only when you have a thorough understanding of the egress queues and if these settings do not meet your QoS solution. Beginning in privileged EXEC mode, follow these steps to limit the bandwidth on an egress interface. This procedure is optional. To return to the default setting, use the no srr-queue bandwidth limit interface configuration command. This example shows how to limit the bandwidth on Gigabit Ethernet interface 0/1 on stack member 2 to 80 percent: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# srr-queue bandwidth limit 80 When you configure this command to 80 percent, the port is idle 20 percent of the time. The line rate drops to 80 percent of the connected speed, which is 800 Mbps. These values are not exact because the hardware adjusts the line rate in increments of six. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Specify the interface to be rate limited, and enter interface configuration mode. Step 3 srr-queue bandwidth limit weight1 Specify the percentage of the port speed to which the port should be limited. The range is 10 to 90. By default, the port is not rate limited and is set to 100 percent. Step 4 end Return to privileged EXEC mode. Step 5 show mls qos interface [interface-id] queueing Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.27-64 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 27 Configuring QoS Displaying Standard QoS Information Displaying Standard QoS Information To display standard QoS information, use one or more of the privileged EXEC commands in Table 27-15: Table 27-15 Commands for Displaying Standard QoS Information Command Purpose show class-map [class-map-name] Display QoS class maps, which define the match criteria to classify traffic. show mls qos Display global QoS configuration information. show mls qos aggregate-policer [aggregate-policer-name] Display the aggregate policer configuration. show mls qos input-queue Display QoS settings for the ingress queues. show mls qos interface [interface-id] [buffers | policers | queueing | statistics] Display QoS information at the interface level, including the buffer allocation, which interfaces have configured policers, the queueing strategy, and the ingress and egress statistics. show mls qos maps [cos-dscp | cos-input-q | cos-output-q | dscp-cos | dscp-input-q | dscp-mutation dscp-mutation-name | dscp-output-q | ip-prec-dscp | policed-dscp] Display QoS mapping information. show mls qos queue-set [qset-id] Display QoS settings for the egress queues. show policy-map [policy-map-name [class class-map-name]] Display QoS policy maps, which define classification criteria for incoming traffic. Note Do not use the show policy-map interface privileged EXEC command to display classification information for incoming traffic. The interface keyword is not supported, and the statistics shown in the display should be ignored.C H A P T E R 28-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 28 Configuring EtherChannels This chapter describes how to configure EtherChannels on Layer 2 and Layer 3 interfaces on the Catalyst 3750 switch. EtherChannel provides fault-tolerant high-speed links between switches, routers, and servers. You can use it to increase the bandwidth between the wiring closets and the data center, and you can deploy it anywhere in the network where bottlenecks are likely to occur. EtherChannel provides automatic recovery for the loss of a link by redistributing the load across the remaining links. If a link fails, EtherChannel redirects traffic from the failed link to the remaining links in the channel without intervention. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release. This chapter consists of these sections: • Understanding EtherChannels, page 28-1 • Configuring EtherChannels, page 28-10 • Displaying EtherChannel, PAgP, and LACP Status, page 28-22 Understanding EtherChannels These sections describe how EtherChannels work: • EtherChannel Overview, page 28-2 • Port-Channel Interfaces, page 28-4 • Port Aggregation Protocol, page 28-5 • Link Aggregation Control Protocol, page 28-6 • Load Balancing and Forwarding Methods, page 28-7 • EtherChannel and Switch Stacks, page 28-928-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels EtherChannel Overview An EtherChannel consists of individual Fast Ethernet or Gigabit Ethernet links bundled into a single logical link as shown in Figure 28-1. Figure 28-1 Typical EtherChannel Configuration The EtherChannel provides full-duplex bandwidth up to 800 Mbps (Fast EtherChannel) or 8 Gbps (Gigabit EtherChannel) between your switch and another switch or host. Each EtherChannel can consist of up to eight compatibly configured Ethernet interfaces. All interfaces in each EtherChannel must be configured as either Layer 2 or Layer 3 interfaces. For Catalyst 3750 switches, the number of EtherChannels is limited to 12. For more information, see the “EtherChannel Configuration Guidelines” section on page 28-11. The EtherChannel Layer 3 interfaces are made up of routed ports. Routed ports are physical ports configured to be in Layer 3 mode by using the no switchport interface configuration command. For more information, see the Chapter 11, “Configuring Interface Characteristics.” You can create an EtherChannel on a standalone switch, on a single switch in the stack, or on multiple switches in the stack (known as cross-stack EtherChannel). See Figure 28-2 and Figure 28-3. If a link within an EtherChannel fails, traffic previously carried over that failed link changes to the remaining links within the EtherChannel. A trap is sent for a failure, identifying the switch, the EtherChannel, and the failed link. Inbound broadcast and multicast packets on one link in an EtherChannel are blocked from returning on any other link of the EtherChannel. Catalyst 8500, 6000, 5500, or 4000 series switch Catalyst 3750 switch Gigabit EtherChannel Catalyst 3550 switch Workstations 10/100 Switched links 86481 Catalyst 2950G switch Workstations 10/100 Switched links 1000BASE-X 1000BASE-X28-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels Figure 28-2 Single-Switch EtherChannel Figure 28-3 Cross-Stack EtherChannel Switch 1 Catalyst 3750 switch stack Switch 2 Channel group 1 Channel group 2 StackWise port connections Switch 3 Switch A 86492 Switch 1 Catalyst 3750 switch stack Switch 2 Channel group 1 StackWise port connections Switch 3 Switch A 8649328-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels Port-Channel Interfaces When you create an EtherChannel, a port-channel logical interface is involved: • With Layer 2 interfaces, use the channel-group interface configuration command to dynamically create the port-channel logical interface. You also can use the interface port-channel port-channel-number global configuration command to manually create the port-channel logical interface, but then you must use the channel-group channel-group-number command to bind the logical interface to a physical port. The channel-group-number can be the same as the port-channel-number, or you can use a new number. If you use a new number, the channel-group command dynamically creates a new port channel. • With Layer 3 interfaces, you should manually create the logical interface by using the interface port-channel global configuration command followed by the no switchport interface configuration command. Then you manually assign an interface to the EtherChannel by using the channel-group interface configuration command. For both Layer 2 and Layer 3 interfaces, the channel-group command binds the physical and logical ports together as shown in Figure 28-4. Each EtherChannel has a port-channel logical interface numbered from 1 to 12. This port-channel interface number corresponds to the one specified with the channel-group interface configuration command. Figure 28-4 Relationship of Physical Ports, Logical Port Channels, and Channel Groups After you configure an EtherChannel, configuration changes applied to the port-channel interface apply to all the physical interfaces assigned to the port-channel interface. Configuration changes applied to the physical interface affect only the interface where you apply the configuration. To change the parameters of all ports in an EtherChannel, apply configuration commands to the port-channel interface, for example, spanning-tree commands or commands to configure a Layer 2 EtherChannel as a trunk. Catalyst 3750 SERIES SYST RPS MASTR STAT DUPLX SPEED STACK MODE 1X 2X 17X 18X 33X 34X 15X 16X 31X 32X 47X 48X 1 2 3 4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 17 18 19 20 21 22 23 24 25 26 27 28 29 30 33 34 35 36 37 38 39 40 41 42 43 44 45 46 15 16 31 32 47 48 86679 10/100 ports Physical ports SFP module slots Logical port-channel Channel-group binding Logical port-channel28-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels Port Aggregation Protocol The Port Aggregation Protocol (PAgP) is a Cisco-proprietary protocol that can be run only on Cisco switches and on those switches licensed by vendors to support PAgP. PAgP facilitates the automatic creation of EtherChannels by exchanging PAgP packets between Ethernet interfaces. You can use PAgP only in single-switch EtherChannel configurations; PAgP cannot be enabled on cross-stack EtherChannels. For more information, see the “EtherChannel Configuration Guidelines” section on page 28-11. By using PAgP, the switch stack learns the identity of partners capable of supporting PAgP and the capabilities of each interface. It then dynamically groups similarly configured interfaces (on a single switch in the stack) into a single logical link (channel or aggregate port). Similarly configured interfaces are grouped based on hardware, administrative, and port parameter constraints. For example, PAgP groups the interfaces with the same speed, duplex mode, native VLAN, VLAN range, and trunking status and type. After grouping the links into an EtherChannel, PAgP adds the group to the spanning tree as a single switch port. PAgP Modes Table 28-1 shows the user-configurable EtherChannel PAgP modes for the channel-group interface configuration command. Switch interfaces exchange PAgP packets only with partner interfaces configured in the auto or desirable modes. Interfaces configured in the on mode do not exchange PAgP packets. Both the auto and desirable modes allow interfaces to negotiate with partner interfaces to determine if they can form an EtherChannel based on criteria such as interface speed and, for Layer 2 EtherChannels, trunking state and VLAN numbers. Interfaces can form an EtherChannel when they are in different PAgP modes as long as the modes are compatible. For example: • An interface in the desirable mode can form an EtherChannel with another interface that is in the desirable or auto mode. • An interface in the auto mode can form an EtherChannel with another interface in the desirable mode. An interface in the auto mode cannot form an EtherChannel with another interface that is also in the auto mode because neither interface starts PAgP negotiation. Table 28-1 EtherChannel PAgP Modes Mode Description auto Places an interface into a passive negotiating state, in which the interface responds to PAgP packets it receives but does not start PAgP packet negotiation. This setting minimizes the transmission of PAgP packets. desirable Places an interface into an active negotiating state, in which the interface starts negotiations with other interfaces by sending PAgP packets. on Forces the interface to channel without PAgP (or the Link Aggregation Control Protocol [LACP]). With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode. This is the only setting that is supported when the EtherChannel members are from different switches in the switch stack (cross-stack EtherChannel).28-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels An interface in the on mode that is added to a port channel is forced to have the same characteristics as the already existing on mode interfaces in the channel. Caution You should exercise care when setting the mode to on (manual configuration). All ports configured in the on mode are bundled in the same group and are forced to have similar characteristics. If the group is misconfigured, packet loss or spanning-tree loops might occur. If your switch is connected to a partner that is PAgP-capable, you can configure the switch interface for nonsilent operation by using the non-silent keyword. If you do not specify non-silent with the auto or desirable mode, silent mode is assumed. Use the silent mode when the switch is connected to a device that is not PAgP-capable and seldom, if ever, sends packets. An example of a silent partner is a file server or a packet analyzer that is not generating traffic. In this case, running PAgP on a physical port connected to a silent partner prevents that switch port from ever becoming operational. However, the silent setting allows PAgP to operate, to attach the interface to a channel group, and to use the interface for transmission. PAgP Interaction with Other Features The Dynamic Trunking Protocol (DTP) and the Cisco Discovery Protocol (CDP) send and receive packets over the physical interfaces in the EtherChannel. Trunk ports send and receive PAgP protocol data units (PDUs) on the lowest numbered VLAN. In Layer 2 EtherChannels, the first port in the channel that comes up provides its MAC address to the EtherChannel. If this port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address to the EtherChannel. For Layer 3 EtherChannels, the MAC address is allocated by the stack master as soon as the interface is created (through the interface port-channel global configuration command). PAgP sends and receives PAgP PDUs only from interfaces that are up and have PAgP enabled for the auto or desirable mode. Link Aggregation Control Protocol The LACP is defined in IEEE 802.3AD and enables Cisco switches to manage Ethernet channels between switches that conform to the 802.3AD protocol. LACP facilitates the automatic creation of EtherChannels by exchanging LACP packets between Ethernet interfaces. You can use LACP only in single-switch EtherChannel configurations; LACP cannot be enabled on cross-stack EtherChannels. For more information, see the “EtherChannel Configuration Guidelines” section on page 28-11. By using LACP, the switch stack learns the identity of partners capable of supporting LACP and the capabilities of each interface. It then dynamically groups similarly configured interfaces (on a single switch in the stack) into a single logical link (channel or aggregate port). Similarly configured interfaces are grouped based on hardware, administrative, and port parameter constraints. For example, LACP groups the interfaces with the same speed, duplex mode, native VLAN, VLAN range, and trunking status and type. After grouping the links into an EtherChannel, LACP adds the group to the spanning tree as a single switch port.28-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels LACP Modes Table 28-2 shows the user-configurable EtherChannel LACP modes for the channel-group interface configuration command. Both the active and passive LACP modes enable interfaces to negotiate with partner interfaces to determine if they can form an EtherChannel based on criteria such as interface speed and, for Layer 2 EtherChannels, trunking state and VLAN numbers. Interfaces can form an EtherChannel when they are in different LACP modes as long as the modes are compatible. For example: • An interface in the active mode can form an EtherChannel with another interface that is in the active or passive mode. • An interface in the passive mode cannot form an EtherChannel with another interface that is also in the passive mode because neither interface starts LACP negotiation. LACP Interaction with Other Features The DTP and the CDP send and receive packets over the physical interfaces in the EtherChannel. Trunk ports send and receive LACP PDUs on the lowest numbered VLAN. In Layer 2 EtherChannels, the first port in the channel that comes up provides its MAC address to the EtherChannel. If this port is removed from the bundle, one of the remaining ports in the bundle provides its MAC address to the EtherChannel. For Layer 3 EtherChannels, the MAC address is allocated by the stack master as soon as the interface is created through the interface port-channel global configuration command. LACP sends and receives LACP PDUs only from interfaces that are up and have LACP enabled for the active or passive mode. Load Balancing and Forwarding Methods EtherChannel balances the traffic load across the links in a channel by reducing part of the binary pattern formed from the addresses in the frame to a numerical value that selects one of the links in the channel. EtherChannel load balancing can use MAC addresses or IP addresses, source or destination addresses, Table 28-2 EtherChannel LACP Modes Mode Description active Places an interface into an active negotiating state in which the interface starts negotiations with other interfaces by sending LACP packets. passive Places an interface into a passive negotiating state in which the interface responds to LACP packets that it receives, but does not start LACP packet negotiation. This setting minimizes the transmission of LACP packets. on Forces the interface to channel without PAgP or LACP. With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode. This is the only setting that is supported when the EtherChannel members are from different switches in the switch stack (cross-stack EtherChannel).28-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels or both source and destination addresses. The selected mode applies to all EtherChannels configured on the switch. You configure the load balancing and forwarding method by using the port-channel load-balance global configuration command. With source-MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on the source-MAC address of the incoming packet. Therefore, to provide load balancing, packets from different hosts use different ports in the channel, but packets from the same host use the same port in the channel. With destination-MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on the destination host’s MAC address of the incoming packet. Therefore, packets to the same destination are forwarded over the same port, and packets to a different destination are sent on a different port in the channel. With source-and-destination MAC address forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the channel based on both the source and destination MAC addresses. This forwarding method, a combination source-MAC and destination-MAC address forwarding methods of load distribution, can be used if it is not clear whether source-MAC or destination-MAC address forwarding is better suited on a particular switch. With source-and-destination MAC-address forwarding, packets sent from host A to host B, host A to host C, and host C to host B could all use different ports in the channel. With source-IP address-based forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the EtherChannel based on the source-IP address of the incoming packet. Therefore, to provide load-balancing, packets from different IP addresses use different ports in the channel, but packets from the same IP address use the same port in the channel. With destination-IP address-based forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the EtherChannel based on the destination-IP address of the incoming packet. Therefore, to provide load-balancing, packets from the same IP source address sent to different IP destination addresses could be sent on different ports in the channel. But packets sent from different source IP addresses to the same destination IP address are always sent on the same port in the channel. With source-and-destination IP address-based forwarding, when packets are forwarded to an EtherChannel, they are distributed across the ports in the EtherChannel based on both the source and destination IP addresses of the incoming packet. This forwarding method, a combination of source-IP and destination-IP address-based forwarding, can be used if it is not clear whether source-IP or destination-IP address-based forwarding is better suited on a particular switch. In this method, packets sent from the IP address A to IP address B, from IP address A to IP address C, and from IP address C to IP address B could all use different ports in the channel. Different load-balancing methods have different advantages, and the choice of a particular load-balancing method should be based on the position of the switch in the network and the kind of traffic that needs to be load-distributed. In Figure 28-5, an EtherChannel of four workstations communicates with a router. Because the router is a single-MAC-address device, source-based forwarding on the switch EtherChannel ensures that the switch uses all available bandwidth to the router. The router is configured for destination-based forwarding because the large number of workstations ensures that the traffic is evenly distributed from the router EtherChannel. Use the option that provides the greatest variety in your configuration. For example, if the traffic on a channel is going only to a single MAC address, using the destination-MAC address always chooses the same link in the channel. Using source addresses or IP addresses might result in better load balancing.28-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Understanding EtherChannels Figure 28-5 Load Distribution and Forwarding Methods EtherChannel and Switch Stacks If a stack member that has ports participating in an EtherChannel fails or leaves the stack, the stack master removes the failed stack member switch ports from the EtherChannel. The remaining ports of the EtherChannel, if any, continue to provide connectivity. When a switch is added to an existing stack, the new switch receives the running configuration from the stack master and updates itself with the EtherChannel-related stack configuration. The stack member also receives the operational information (the list of ports that are up and are members of a channel). When two stacks merge that have EtherChannels configured between them, self-looped ports result. Spanning tree detects this condition and acts accordingly. Any PAgP or LACP configuration on a winning switch stack is not affected, but the PAgP or LACP configuration on the losing switch stack is lost after the stack reboots. If the stack master fails or leaves the stack, a new stack master is elected. A spanning-tree reconvergence is not triggered unless there is a change in the EtherChannel bandwidth. The new stack master synchronizes the configuration of the stack members to that of the stack master. The PAgP or LACP configuration is not affected after a stack master change over unless the EtherChannel resides on the old stack master. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.” 86482 Cisco router with destination-based forwarding enabled EtherChannel Catalyst 3750 switch with source-based forwarding enabled28-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels Configuring EtherChannels These sections describe how to configure EtherChannel on Layer 2 and Layer 3 interfaces: • Default EtherChannel Configuration, page 28-10 • EtherChannel Configuration Guidelines, page 28-11 • Configuring Layer 2 EtherChannels, page 28-12 (required) • Configuring Layer 3 EtherChannels, page 28-14 (required) • Configuring EtherChannel Load Balancing, page 28-17 (optional) • Configuring the PAgP Learn Method and Priority, page 28-18 (optional) • Configuring LACP Hot-Standby Ports, page 28-20 (optional) Note Make sure that the interfaces are correctly configured. For more information, see the “EtherChannel Configuration Guidelines” section on page 28-11. Note After you configure an EtherChannel, configuration changes applied to the port-channel interface apply to all the physical interfaces assigned to the port-channel interface, and configuration changes applied to the physical interface affect only the interface where you apply the configuration. Default EtherChannel Configuration Table 28-3 shows the default EtherChannel configuration. Table 28-3 Default EtherChannel Configuration Feature Default Setting Channel groups None assigned. Port-channel logical interface None defined. PAgP mode No default. PAgP learn method Aggregate-port learning on all interfaces. PAgP priority 128 on all interfaces. LACP mode No default. LACP learn method Aggregate-port learning on all interfaces. LACP port priority 32768 on all interfaces. LACP system priority 32768. LACP system ID LACP system priority and the switch MAC address. Load balancing Load distribution on the switch is based on the source-MAC address of the incoming packet. 28-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels EtherChannel Configuration Guidelines If improperly configured, some EtherChannel interfaces are automatically disabled to avoid network loops and other problems. Follow these guidelines to avoid configuration problems: • More than 12 EtherChannels cannot be configured on a Catalyst 3750 switch stack. • Configure a PAgP EtherChannel with up to eight Ethernet interfaces of the same type. • Configure a LACP EtherChannel with up to 16 Ethernet interfaces of the same type. Up to eight ports can be active, and up to eight ports can be in standby mode. If your switch is part of a switch stack, the 16 interfaces in the LACP EtherChannel must be on the same switch. • Configure all interfaces in an EtherChannel to operate at the same speeds and duplex modes. • Enable all interfaces in an EtherChannel. An interface in an EtherChannel that is disabled by using the shutdown interface configuration command is treated as a link failure, and its traffic is transferred to one of the remaining interfaces in the EtherChannel. • When a group is first created, all ports follow the parameters set for the first port to be added to the group. If you change the configuration of one of these parameters, you must also make the changes to all ports in the group: – Allowed-VLAN list – Spanning-tree path cost for each VLAN – Spanning-tree port priority for each VLAN – Spanning-tree Port Fast setting • Do not configure a port to be a member of more than one EtherChannel group. • Do not configure an EtherChannel in both the PAgP and LACP modes. EtherChannel groups running PAgP and LACP can coexist on the same switch or on different switches in the stack (but not in a cross-stack configuration). Individual EtherChannel groups can run either PAgP or LACP, but they cannot interoperate. • Do not configure a Switched Port Analyzer (SPAN) destination as part of an EtherChannel. • Do not configure a secure port as part of an EtherChannel or the reverse. • Do not configure a port that is an active member of an EtherChannel as an 802.1X port. If 802.1X is enabled on a not-yet active port of an EtherChannel, the port does not join the EtherChannel. • For Layer 2 EtherChannels: – Assign all interfaces in the EtherChannel to the same VLAN, or configure them as trunks. Interfaces with different native VLANs cannot form an EtherChannel. – If you configure an EtherChannel from trunk interfaces, verify that the trunking mode (ISL or 802.1Q) is the same on all the trunks. Inconsistent trunk modes on EtherChannel interfaces can have unexpected results. – An EtherChannel supports the same allowed range of VLANs on all the interfaces in a trunking Layer 2 EtherChannel. If the allowed range of VLANs is not the same, the interfaces do not form an EtherChannel even when PAgP is set to the auto or desirable mode. – Interfaces with different spanning-tree path costs can form an EtherChannel if they are otherwise compatibly configured. Setting different spanning-tree path costs does not, by itself, make interfaces incompatible for the formation of an EtherChannel. • For Layer 3 EtherChannels, assign the Layer 3 address to the port-channel logical interface, not to the physical interfaces in the channel.28-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels • For cross-stack EtherChannel configurations, disable PAgP and LACP on all interfaces targeted for the EtherChannel by using the channel-group channel-group-number mode on interface configuration command. Before adding a stack member interface to an existing EtherChannel, manually disable PAgP and LACP on all the interfaces that are members of the channel group, and then manually configure the cross-stack EtherChannel. PAgP and LACP are not supported on cross-stack EtherChannels. • If cross-stack EtherChannel is configured and the switch stack partitions, loops and forwarding misbehaviors can occur. Configuring Layer 2 EtherChannels You configure Layer 2 EtherChannels by assigning interfaces to a channel group with the channel-group interface configuration command. This command automatically creates the port-channel logical interface. If you enabled PAgP on an interface in the auto or desirable mode, you must reconfigure it for the on mode by using the channel-group channel-group-number mode on interface configuration command before adding this interface to a cross-stack EtherChannel. PAgP is not supported on cross-stack EtherChannels. If you enabled LACP on an interface in the active or passive mode, you must reconfigure it for the on mode by using the channel-group channel-group-number mode on interface configuration command before adding this interface to a cross-stack EtherChannel. LACP is not supported on cross-stack EtherChannels. Beginning in privileged EXEC mode, follow these steps to assign a Layer 2 Ethernet interface to a Layer 2 EtherChannel. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify a physical interface to configure. Valid interfaces include physical interfaces. For a PAgP EtherChannel, you can configure up to eight interfaces of the same type and speed for the same group. For a LACP EtherChannel, you can configure up to 16 Ethernet interfaces of the same type. Up to eight ports can be active, and up to eight ports can be in standby mode. If your switch is part of a switch stack, the 16 interfaces in the LACP EtherChannel must be on the same switch. Step 3 switchport mode {access | trunk} switchport access vlan vlan-id Assign all interfaces as static-access ports in the same VLAN, or configure them as trunks. If you configure the interface as a static-access port, assign it to only one VLAN. The range is 1 to 4094.28-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels To remove an interface from the EtherChannel group, use the no channel-group interface configuration command. Step 4 channel-group channel-group-number mode {auto [non-silent] | desirable [non-silent] | on} | {active | passive} Assign the interface to a channel group, and specify the PAgP or the LACP mode. For channel-group-number, the range is 1 to 12. For mode, select one of these keywords: • auto—Enables PAgP only if a PAgP device is detected. It places an interface into a passive negotiating state, in which the interface responds to PAgP packets it receives but does not start PAgP packet negotiation. • desirable—Unconditionally enables PAgP. It places an interface into an active negotiating state, in which the interface starts negotiations with other interfaces by sending PAgP packets. • on—Forces the interface to channel without PAgP or LACP. With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode. You must use this keyword when EtherChannel members are from different switches in the switch stack (cross-stack EtherChannel). • non-silent—(Optional) If your switch is connected to a partner that is PAgP-capable, configure the switch interface for nonsilent operation when the interface is in the auto or desirable mode. If you do not specify non-silent, silent is assumed. The silent setting is for connections to file servers or packet analyzers. This setting allows PAgP to operate, to attach the interface to a channel group, and to use the interface for transmission. • active—Enables LACP only if a LACP device is detected. It places an interface into an active negotiating state in which the interface starts negotiations with other interfaces by sending LACP packets. • passive—Enables LACP on an interface and places it into a passive negotiating state in which the interface responds to LACP packets that it receives, but does not start LACP packet negotiation. For information on compatible modes for the switch and its partner, see the “PAgP Modes” section on page 28-5 and the “LACP Modes” section on page 28-7. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose28-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels This example shows how to configure an EtherChannel on a single switch in the stack. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 as static-access ports in VLAN 10 to channel 5 with the PAgP mode desirable: Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode desirable non-silent Switch(config-if-range)# end This example shows how to configure an EtherChannel on a single switch in the stack. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 as static-access ports in VLAN 10 to channel 5 with the LACP mode active: Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode active Switch(config-if-range)# end This example shows how to configure cross-stack EtherChannel. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 and Gigabit Ethernet interface 0/3 on stack member 3 as static-access ports in VLAN 10 to channel 5 with the PAgP and LACP modes disabled (on): Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# channel-group 5 mode on Switch(config-if-range)# exit Switch(config)# interface gigabitethernet3/0/3 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# channel-group 5 mode on Switch(config-if)# exit Configuring Layer 3 EtherChannels To configure Layer 3 EtherChannels, you create the port-channel logical interface and then put the Ethernet interfaces into the port-channel as described in the next two sections. Creating Port-Channel Logical Interfaces When configuring Layer 3 EtherChannels, you should first manually create the port-channel logical interface by using the interface port-channel global configuration command. Then you put the logical interface into the channel group by using the channel-group interface configuration command. Note To move an IP address from a physical interface to an EtherChannel, you must delete the IP address from the physical interface before configuring it on the port-channel interface.28-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels Beginning in privileged EXEC mode, follow these steps to create a port-channel interface for a Layer 3 EtherChannel. This procedure is required. To remove the port-channel, use the no interface port-channel port-channel-number global configuration command. This example shows how to create the logical port channel (5) and assign 172.10.20.10 as its IP address: Switch# configure terminal Switch(config)# interface port-channel 5 Switch(config-if)# no switchport Switch(config-if)# ip address 172.10.20.10 255.255.255.0 Switch(config-if)# end Configuring the Physical Interfaces Beginning in privileged EXEC mode, follow these steps to assign an Ethernet interface to a Layer 3 EtherChannel. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface port-channel port-channel-number Enter interface configuration mode, and create the port-channel logical interface. For port-channel-number, the range is 1 to 12. Step 3 no switchport Put the interface into Layer 3 mode. Step 4 ip address ip-address mask Assign an IP address and subnet mask to the EtherChannel. Step 5 end Return to privileged EXEC mode. Step 6 show etherchannel channel-group-number detail Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Step 8 Assign an Ethernet interface to the Layer 3 EtherChannel. For more information, see the “Configuring the Physical Interfaces” section on page 28-15. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify a physical interface to configure. Valid interfaces include physical interfaces. For a PAgP EtherChannel, you can configure up to eight interfaces of the same type and speed for the same group. For a LACP EtherChannel, you can configure up to 16 Ethernet interfaces of the same type. Up to eight ports can be active, and up to eight ports can be in standby mode. If your switch is part of a switch stack, the 16 interfaces in the LACP EtherChannel must be on the same switch. Step 3 no ip address Ensure that there is no IP address assigned to the physical interface.28-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels Step 4 no switchport Put the interface into Layer 3 mode. Step 5 channel-group channel-group-number mode {auto [non-silent] | desirable [non-silent] | on} | {active | passive} Assign the interface to a channel group, and specify the PAgP or the LACP mode. For channel-group-number, the range is 1 to 12. This number must be the same as the port-channel-number (logical port) configured in the “Creating Port-Channel Logical Interfaces” section on page 28-14. For mode, select one of these keywords: • auto—Enables PAgP only if a PAgP device is detected. It places an interface into a passive negotiating state, in which the interface responds to PAgP packets it receives but does not start PAgP packet negotiation. • desirable—Unconditionally enables PAgP. It places an interface into an active negotiating state, in which the interface starts negotiations with other interfaces by sending PAgP packets. • on—Forces the interface to channel without PAgP or LACP. With the on mode, a usable EtherChannel exists only when an interface group in the on mode is connected to another interface group in the on mode. You must use this keyword when EtherChannel members are from different switches in the switch stack (cross-stack EtherChannel). • non-silent—(Optional) If your switch is connected to a partner that is PAgP capable, configure the switch interface for nonsilent operation when the interface is in the auto or desirable mode. If you do not specify non-silent, silent is assumed. The silent setting is for connections to file servers or packet analyzers. This setting allows PAgP to operate, to attach the interface to a channel group, and to use the interface for transmission. • active—Enables LACP only if a LACP device is detected. It places an interface into an active negotiating state in which the interface starts negotiations with other interfaces by sending LACP packets. • passive—Enables LACP on an interface and places it into a passive negotiating state in which the interface responds to LACP packets that it receives, but does not start LACP packet negotiation. For information on compatible modes for the switch and its partner, see the “PAgP Modes” section on page 28-5 and the “LACP Modes” section on page 28-7. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose28-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels This example shows how to configure an EtherChannel on a single switch in the stack. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 to channel 5 with the LACP mode active: Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# no ip address Switch(config-if-range)# no switchport Switch(config-if-range)# channel-group 5 mode active Switch(config-if-range)# end This example shows how to configure cross-stack EtherChannel. It assigns Gigabit Ethernet interfaces 0/4 and 0/5 on stack member 2 and Gigabit Ethernet interface 0/3 on stack member 3 to channel 5 with the PAgP mode and LACP modes disabled (on): Switch# configure terminal Switch(config)# interface range gigabitethernet2/0/4 -5 Switch(config-if-range)# no ip address Switch(config-if-range)# no switchport Switch(config-if-range)# channel-group 5 mode on Switch(config-if-range)# exit Switch(config)# interface gigabitethernet3/0/3 Switch(config-if)# no ip address Switch(config-if-range)# no switchport Switch(config-if)# channel-group 5 mode on Switch(config-if)# exit Configuring EtherChannel Load Balancing This section describes how to configure EtherChannel load balancing by using source-based or destination-based forwarding methods. For more information, see the “Load Balancing and Forwarding Methods” section on page 28-7.28-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels Beginning in privileged EXEC mode, follow these steps to configure EtherChannel load balancing. This procedure is optional. To return EtherChannel load balancing to the default configuration, use the no port-channel load-balance global configuration command. Configuring the PAgP Learn Method and Priority Network devices are classified as PAgP physical learners or aggregate-port learners. A device is a physical learner if it learns addresses by physical ports and directs transmissions based on that knowledge. A device is an aggregate-port learner if it learns addresses by aggregate (logical) ports. The learn method must be configured the same at both ends of the link. When a device and its partner are both aggregate-port learners, they learn the address on the logical port-channel. The device sends packets to the source by using any of the interfaces in the EtherChannel. With aggregate-port learning, it is not important on which physical port the packet arrives. PAgP cannot automatically detect when the partner device is a physical learner and when the local device is an aggregate-port learner. Therefore, you must manually set the learning method on the local device to learn addresses by physical ports. You also must set the load-distribution method to source-based distribution, so that any given source MAC address is always sent on the same physical port. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 port-channel load-balance {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac} Configure an EtherChannel load-balancing method. The default is src-mac. Select one of these keywords to determine the load-distribution method: • dst-ip—Load distribution is based on the destination-host IP address. • dst-mac—Load distribution is based on the destination-host MAC address of the incoming packet. • src-dst-ip—Load distribution is based on the source-and-destination host-IP address. • src-dst-mac—Load distribution is based on the source-and-destination host-MAC address. • src-ip—Load distribution is based on the source-host IP address. • src-mac—Load distribution is based on the source-MAC address of the incoming packet. Step 3 end Return to privileged EXEC mode. Step 4 show etherchannel load-balance Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.28-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels You also can configure a single interface within the group for all transmissions and use other interfaces for hot standby. The unused interfaces in the group can be swapped into operation in just a few seconds if the selected single interface loses hardware-signal detection. You can configure which interface is always selected for packet transmission by changing its priority with the pagp port-priority interface configuration command. The higher the priority, the more likely that the port will be selected. Note The Catalyst 3750 switch supports address learning only on aggregate ports even though the physical-port keyword is provided in the CLI. The pagp learn-method command and the pagp port-priority command have no effect on the switch hardware, but they are required for PAgP interoperability with devices that only support address learning by physical ports, such as the Catalyst 1900 switch. When the link partner to the Catalyst 3750 switch is a physical learner (such as a Catalyst 1900 series switch), we recommend that you configure the Catalyst 3750 switch as a physical-port learner by using the pagp learn-method physical-port interface configuration command. Set the load-distribution method based on the source MAC address by using the port-channel load-balance src-mac global configuration command. The switch then sends packets to the Catalyst 1900 switch using the same interface in the EtherChannel from which it learned the source address. Use the pagp learn-method command only in this situation. Beginning in privileged EXEC mode, follow these steps to configure your switch as a PAgP physical-port learner and to adjust the priority so that the same port in the bundle is selected for sending packets. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface for transmission. Step 3 pagp learn-method physical-port Select the PAgP learning method. By default, aggregation-port learning is selected, which means the switch sends packets to the source by using any of the interfaces in the EtherChannel. With aggregate-port learning, it is not important on which physical port the packet arrives. Select physical-port to connect with another switch that is a physical learner. Make sure to configure the port-channel load-balance global configuration command to src-mac as described in the “Configuring EtherChannel Load Balancing” section on page 28-17. The learning method must be configured the same at both ends of the link. Step 4 pagp port-priority priority Assign a priority so that the selected interface is chosen for packet transmission. For priority, the range is 0 to 255. The default is 128. The higher the priority, the more likely that the interface will be used for PAgP transmission. Step 5 end Return to privileged EXEC mode.28-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels To return the priority to its default setting, use the no pagp port-priority interface configuration command. To return the learning method to its default setting, use the no pagp learn-method interface configuration command. Configuring LACP Hot-Standby Ports When enabled, LACP tries to configure the maximum number of LACP-compatible ports in a channel, up to a maximum of 16 ports. Only eight LACP links can be active at one time. The software places any additional links in a hot-standby mode. If one of the active links becomes inactive, a link that is in the hot-standby mode becomes active in its place. If you configure more than eight links for an EtherChannel group, the software automatically determines which of the hot-standby ports to make active based on the LACP priority. The software assigns to every link between systems that operate LACP a unique priority made up of these elements (in priority order): • LACP system priority • System ID (a combination of the LACP system priority and the switch MAC address) • LACP port priority • Port number In priority comparisons, numerically lower values have higher priority. The priority determines which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating. Ports are considered for active use in aggregation in link-priority order starting with the port attached to the highest priority link. Each port is selected for active use if the preceding higher priority selections can also be maintained. Otherwise, the port is selected for standby mode. You can change the default values of the LACP system priority and the LACP port priority to affect how the software selects active and standby links. For more information, see the “Configuring the LACP System Priority” section on page 28-20 and the “Configuring the LACP Port Priority” section on page 28-21. Configuring the LACP System Priority You can configure the system priority for all of the EtherChannels that are enabled for LACP by using the lacp system-priority global configuration command. You cannot configure a system priority for each LACP-configured channel. By changing this value from the default, you can affect how the software selects active and standby links. You can use the show etherchannel summary privileged EXEC command to see which ports are in the hot-standby mode (denoted with an H port-state flag). Step 6 show running-config or show pagp channel-group-number internal Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose28-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Configuring EtherChannels Beginning in privileged EXEC mode, follow these steps to configure the LACP system priority. This procedure is optional. To return the LACP system priority to the default value, use the no lacp system-priority global configuration command. Configuring the LACP Port Priority By default, all ports use the same port priority. If the local system has a lower value for the system priority and the system ID than the remote system, you can affect which of the hot-standby links become active first by changing the port priority of LACP EtherChannel ports to a lower value than the default. The hot-standby ports that have lower port numbers become active in the channel first. You can use the show etherchannel summary privileged EXEC command to see which ports are in the hot-standby mode (denoted with an H port-state flag). Note If LACP is not able to aggregate all the ports that are compatible (for example, the remote system might have more restrictive hardware limitations), all the ports that cannot be actively included in the EtherChannel are put in the hot-standby state and are used only if one of the channeled ports fails. Beginning in privileged EXEC mode, follow these steps to configure the LACP port priority. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 lacp system-priority priority Configure the LACP system priority. For priority, the range is 1 to 65535. The default is 32768. The lower the value, the higher the system priority. Step 3 end Return to privileged EXEC mode. Step 4 show running-config or show lacp sys-id Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 lacp port-priority priority Configure the LACP port priority. For priority, the range is 1 to 65535. The is 32768. The lower the value, the more likely that the interface will be used for LACP transmission. Step 4 end Return to privileged EXEC mode.28-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 28 Configuring EtherChannels Displaying EtherChannel, PAgP, and LACP Status To return the LACP port priority to the default value, use the no lacp port-priority interface configuration command. Displaying EtherChannel, PAgP, and LACP Status To display EtherChannel, PAgP, and LACP status information, use the privileged EXEC commands described in Table 28-4: You can clear PAgP channel-group information and traffic counters by using the clear pagp {channel-group-number counters | counters} privileged EXEC command. You can clear LACP channel-group information and traffic counters by using the clear lacp {channel-group-number counters | counters} privileged EXEC command. For detailed information about the fields in the displays, refer to the command reference for this release. Step 5 show running-config or show lacp [channel-group-number] internal Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Table 28-4 Commands for Displaying EtherChannel, PAgP, and LACP Status Command Description show etherchannel [channel-group-number {detail | port | port-channel | protocol | summary}] {detail | load-balance | port | port-channel | protocol | summary} Displays EtherChannel information in a brief, detailed, and one-line summary form. Also displays the load-balance or frame-distribution scheme, port, port-channel, and protocol information. show pagp [channel-group-number] {counters | internal | neighbor} Displays PAgP information such as traffic information, the internal PAgP configuration, and neighbor information. show lacp [channel-group-number] {counters | internal | neighbor} Displays LACP information such as traffic information, the internal LACP configuration, and neighbor information.C H A P T E R 29-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 29 Configuring IP Unicast Routing This chapter describes how to configure IP unicast routing on the Catalyst 3750 switch. Unless otherwise noted, the term switch refers to a standalone switch and a switch stack. A switch stack operates and appears as a single router to the rest of the routers in the network. Basic routing functions, including static routing and the Routing Information Protocol (RIP), are available with both the standard multilayer software image (SMI) and the enhanced multilayer image (EMI). To use advanced routing features and other routing protocols, you must have the enhanced multilayer image installed on the standalone switch or on the stack master. Note For more detailed IP unicast configuration information, refer to the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1. For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This chapter consists of these sections: • Understanding IP Routing, page 29-2 • Steps for Configuring Routing, page 29-4 • Configuring IP Addressing, page 29-5 • Enabling IP Unicast Routing, page 29-19 • Configuring RIP, page 29-20 • Configuring IGRP, page 29-25 • Configuring OSPF, page 29-30 • Configuring EIGRP, page 29-39 • Configuring BGP, page 29-45 • Configuring Protocol-Independent Features, page 29-66 • Monitoring and Maintaining the IP Network, page 29-81 Note When configuring routing parameters on the switch and to allocate system resources to maximize the number of unicast routes allowed, you can use the sdm prefer routing global configuration command to set the Switch Database Management (sdm) feature to the routing template. For more information on the SDM templates, see Chapter 8, “Configuring SDM Templates” or refer to the sdm prefer command in the command reference for this release.29-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Understanding IP Routing Understanding IP Routing In some network environments, VLANs are associated with individual networks or subnetworks. In an IP network, each subnetwork is mapped to an individual VLAN. Configuring VLANs helps control the size of the broadcast domain and keeps local traffic local. However, network devices in different VLANs cannot communicate with one another without a Layer 3 device (router) to route traffic between the VLAN, referred to as inter-VLAN routing. You configure one or more routers to route traffic to the appropriate destination VLAN. Figure 29-1 shows a basic routing topology. Switch A is in VLAN 10, and Switch B is in VLAN 20. The router has an interface in each VLAN. Figure 29-1 Routing Topology Example When Host A in VLAN 10 needs to communicate with Host B in VLAN 10, it sends a packet addressed to that host. Switch A forwards the packet directly to Host B, without sending it to the router. When Host A sends a packet to Host C in VLAN 20, Switch A forwards the packet to the router, which receives the traffic on the VLAN 10 interface. The router checks the routing table, determines the correct outgoing interface, and forwards the packet on the VLAN 20 interface to Switch B. Switch B receives the packet and forwards it to Host C. This section contains information on these routing topics: • Types of Routing, page 29-2 • IP Routing and Switch Stacks, page 29-3 Types of Routing Routers and Layer 3 switches can route packets in three different ways: • By using default routing • By using preprogrammed static routes for the traffic • By dynamically calculating routes by using a routing protocol Default routing refers to sending traffic with a destination unknown to the router to a default outlet or destination. Static unicast routing forwards packets from predetermined ports through a single path into and out of a network. Static routing is secure and uses little bandwidth, but does not automatically respond to changes in the network, such as link failures, and therefore, might result in unreachable destinations. As networks grow, static routing becomes a labor-intensive liability. 18071 A B C Host Host Host Switch A Switch B VLAN 10 VLAN 20 ISL Trunks29-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Understanding IP Routing Dynamic routing protocols are used by routers to dynamically calculate the best route for forwarding traffic. There are two types of dynamic routing protocols: • Routers using distance-vector protocols maintain routing tables with distance values of networked resources, and periodically pass these tables to their neighbors. Distance-vector protocols use one or a series of metrics for calculating the best routes. These protocols are easy to configure and use. • Routers using link-state protocols maintain a complex database of network topology, based on the exchange of link-state advertisements (LSAs) between routers. LSAs are triggered by an event in the network, which speeds up the convergence time or time required to respond to these changes. Link-state protocols respond quickly to topology changes, but require greater bandwidth and more resources than distance-vector protocols. Distance-vector protocols supported by the Catalyst 3750 switch are Routing Information Protocol (RIP), which uses a single distance metric (cost) to determine the best path; Interior Gateway Routing Protocol (IGRP), which uses a series of metrics; and Border Gateway Protocol (BGP), which adds a path vector mechanism. The switch also supports the Open Shortest Path First (OSPF) link-state protocol and Enhanced IGRP (EIGRP), which adds some link-state routing features to traditional IGRP to improve efficiency. Note On a switch stack, the supported protocols are determined by the software running on the stack master. If the stack master is running the SMI, only default routing, static routing and RIP are supported. All other routing protocols require the EMI. IP Routing and Switch Stacks A Catalyst 3750 switch stack appears to the network as a single router, regardless of which switch in the stack is connected to a routing peer. For additional information about switch stack operation, see Chapter 5, “Managing Switch Stacks.” The stack master performs these functions: • It initializes and configures the routing protocols. • It sends routing protocol messages and updates to other routers. • It processes routing protocol messages and updates received from peer routers. • It generates, maintains, and distributes the distributed Cisco Express Forwarding (dCEF) database to all stack members. The routes are programmed on all switches in the stack bases on this database. • The MAC address of the stack master is used as the router MAC address for the whole stack, and all outside devices use this address to send IP packets to the stack. • All IP packets that require software forwarding or processing go through the CPU of the stack master. Stack members perform these functions: • They act as routing standby switches, ready to take over in case they are elected as the new stack master if the stack master fails. • They program the routes into hardware. The routes programmed by the stack members are the same that are downloaded by the stack master as part of the dCEF database. If a stack master fails, the stack detects that the stack master is down and elects one of the stack members to be the new stack master. During this period, except for a momentary interruption, the hardware continues to forward packets with no protocols active. 29-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Steps for Configuring Routing Upon election, the new stack master performs these functions: • It starts generating, receiving, and processing routing updates. • It builds routing tables, generates the CEF database, and distributes it to stack members. • It begins using its MAC address as the router MAC address. To update its network peers of the new MAC address, it periodically (every few seconds for 5 minutes) sends a gratuitous ARP reply with the new router MAC address. • It attempts to determine the reachability of every proxy ARP entry by sending an ARP request to the proxy ARP IP address and receiving an ARP reply. For each reachable proxy ARP IP address, it generates a gratuitous ARP reply with the new router MAC address. This process is repeated for 5 minutes after a new stack master election. Note When a stack master is running the EMI, the stack is able to run all supported protocols, including Open Shortest Path First (OSPF), Interior Gateway Routing Protocol (IGRP), Enhanced IGRP (EIGRP), and Border Gateway Protocol (BGP). If the stack master fails and the new elected stack master is running the SMI, these protocols will no longer run in the stack. Caution Partitioning of the switch stack into two or more stacks might lead to undesirable behavior in the network. Steps for Configuring Routing By default, IP routing is disabled on the switch, and you must enable it before routing can take place. For detailed IP routing configuration information, refer to the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1. In the following procedures, the specified interface must be one of these Layer 3 interfaces: • A routed port: a physical port configured as a Layer 3 port by using the no switchport interface configuration command. • A switch virtual interface (SVI): a VLAN interface created by using the interface vlan vlan_id global configuration command and by default a Layer 3 interface. • An EtherChannel port channel in Layer 3 mode: a port-channel logical interface created by using the interface port-channel port-channel-number global configuration command and binding the Ethernet interface into the channel group. For more information, see the “Configuring Layer 3 EtherChannels” section on page 28-14. Note A Layer 3 switch can have an IP address assigned to each routed port and SVI. The number of routed ports and SVIs that you can configure is not limited by software. However, the interrelationship between this number and the number and volume of features being implemented might have an impact on CPU utilization because of hardware limitations. To optimize system memory for routing, use the sdm prefer routing global configuration command. All Layer 3 interfaces on which routing will occur must have IP addresses assigned to them. See the “Assigning IP Addresses to Network Interfaces” section on page 29-6. 29-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Configuring routing consists of several main procedures: • To support VLAN interfaces, create and configure VLANs on the switch stack, and assign VLAN membership to Layer 2 interfaces. For more information, see Chapter 12, “Configuring VLANs.” • Configure Layer 3 interfaces. • Enable IP routing on the switch. • Assign IP addresses to the Layer 3 interfaces. • Enable selected routing protocols on the switch. • Configure routing protocol parameters (optional). Configuring IP Addressing A required task for configuring IP routing is to assign IP addresses to Layer 3 network interfaces to enable the interfaces and allow communication with the hosts on those interfaces that use IP. These sections describe how to configure various IP addressing features. Assigning IP addresses to the interface is required; the other procedures are optional. • Default Addressing Configuration, page 29-5 • Assigning IP Addresses to Network Interfaces, page 29-6 • Configuring Address Resolution Methods, page 29-9 • Routing Assistance When IP Routing is Disabled, page 29-12 • Configuring Broadcast Packet Handling, page 29-14 • Monitoring and Maintaining IP Addressing, page 29-18 Default Addressing Configuration Table 29-1 shows the default addressing configuration. Table 29-1 Default Addressing Configuration Feature Default Setting IP address None defined. ARP No permanent entries in the Address Resolution Protocol (ARP) cache. Encapsulation: Standard Ethernet-style ARP. Timeout: 14400 seconds (4 hours). IP broadcast address 255.255.255.255 (all ones). IP classless routing Enabled. IP default gateway Disabled. IP directed broadcast Disabled (all IP directed broadcasts are dropped). IP domain Domain list: No domain names defined. Domain lookup: Enabled. Domain name: Enabled.29-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Assigning IP Addresses to Network Interfaces An IP address identifies a location to which IP packets can be sent. Some IP addresses are reserved for special uses and cannot be used for host, subnet, or network addresses. RFC 1166, “Internet Numbers,” contains the official description of IP addresses. An interface can have one primary IP address. A mask identifies the bits that denote the network number in an IP address. When you use the mask to subnet a network, the mask is referred to as a subnet mask. To receive an assigned network number, contact your Internet service provider. Beginning in privileged EXEC mode, follow these steps to assign an IP address and a network mask to a Layer 3 interface: IP forward-protocol If a helper address is defined or User Datagram Protocol (UDP) flooding is configured, UDP forwarding is enabled on default ports. Any-local-broadcast: Disabled. Spanning Tree Protocol (STP): Disabled. Turbo-flood: Disabled. IP helper address Disabled. IP host Disabled. IRDP Disabled. Defaults when enabled: • Broadcast IRDP advertisements. • Maximum interval between advertisements: 600 seconds. • Minimum interval between advertisements: 0.75 times max interval • Preference: 0. IP proxy ARP Enabled. IP routing Disabled. IP subnet-zero Disabled. Table 29-1 Default Addressing Configuration (continued) Feature Default Setting Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 no switchport Remove the interface from Layer 2 configuration mode (if it is a physical interface). Step 4 ip address ip-address subnet-mask Configure the IP address and IP subnet mask. Step 5 no shutdown Enable the interface. Step 6 end Return to privileged EXEC mode.29-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Use of Subnet Zero Subnetting with a subnet address of zero is strongly discouraged because of the problems that can arise if a network and a subnet have the same addresses. For example, if network 131.108.0.0 is subnetted as 255.255.255.0, subnet zero would be written as 131.108.0.0, which is the same as the network address. You can use the all ones subnet (131.108.255.0) and even though it is discouraged, you can enable the use of subnet zero if you need the entire subnet space for your IP address. Beginning in privileged EXEC mode, follow these steps to enable subnet zero: Use the no ip subnet-zero global configuration command to restore the default and disable the use of subnet zero. Classless Routing By default, classless routing behavior is enabled on the switch when it is configured to route. With classless routing, if a router receives packets for a subnet of a network with no default route, the router forwards the packet to the best supernet route. A supernet consists of contiguous blocks of Class C address spaces used to simulate a single, larger address space and is designed to relieve the pressure on the rapidly depleting Class B address space. In Figure 29-2, classless routing is enabled. When the host sends a packet to 120.20.4.1, instead of discarding the packet, the router forwards it to the best supernet route. If you disable classless routing and a router receives packets destined for a subnet of a network with no network default route, the router discards the packet. Step 7 show interfaces [interface-id] show ip interface [interface-id] show running-config interface [interface-id] Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip subnet-zero Enable the use of subnet zero for interface addresses and routing updates. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file.29-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Figure 29-2 IP Classless Routing In Figure 29-3, the router in network 128.20.0.0 is connected to subnets 128.20.1.0, 128.20.2.0, and 128.20.3.0. If the host sends a packet to 120.20.4.1, because there is no network default route, the router discards the packet. Figure 29-3 No IP Classless Routing To prevent the switch from forwarding packets destined for unrecognized subnets to the best supernet route possible, you can disable classless routing behavior. Beginning in privileged EXEC mode, follow these steps to disable classless routing: Host 128.20.1.0 128.20.2.0 128.20.3.0 128.20.4.1 128.0.0.0/8 128.20.4.1 IP classless 45749 128.20.0.0 Host 128.20.1.0 128.20.2.0 128.20.3.0 128.20.4.1 128.0.0.0/8 128.20.4.1 Bit bucket 45748 128.20.0.0 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 no ip classless Disable classless routing behavior. Step 3 end Return to privileged EXEC mode.29-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing To restore the default and have the switch forward packets destined for a subnet of a network with no network default route to the best supernet route possible, use the ip classless global configuration command. Configuring Address Resolution Methods You can control interface-specific handling of IP by using address resolution. A device using IP can have both a local address or MAC address, which uniquely defines the device on its local segment or LAN, and a network address, which identifies the network to which the device belongs. Note In a Catalyst 3750 switch stack, network communication uses a single MAC address and the IP address of the stack. The local address or MAC address is known as a data link address because it is contained in the data link layer (Layer 2) section of the packet header and is read by data link (Layer 2) devices. To communicate with a device on Ethernet, the software must determine the MAC address of the device. The process of determining the MAC address from an IP address is called address resolution. The process of determining the IP address from the MAC address is called reverse address resolution. The switch can use these forms of address resolution: • Address Resolution Protocol (ARP) is used to associate IP address with MAC addresses. Taking an IP address as input, ARP determines the associated MAC address and then stores the IP address/MAC address association in an ARP cache for rapid retrieval. Then the IP datagram is encapsulated in a link-layer frame and sent over the network. Encapsulation of IP datagrams and ARP requests or replies on IEEE 802 networks other than Ethernet is specified by the Subnetwork Access Protocol (SNAP). • Proxy ARP helps hosts with no routing tables determine the MAC addresses of hosts on other networks or subnets. If the switch (router) receives an ARP request for a host that is not on the same interface as the ARP request sender, and if the router has all of its routes to the host through other interfaces, it generates a proxy ARP packet giving its own local data link address. The host that sent the ARP request then sends its packets to the router, which forwards them to the intended host. Catalyst 3750 switches also use the Reverse Address Resolution Protocol (RARP), which functions the same as ARP does, except that the RARP packets request an IP address instead of a local MAC address. Using RARP requires a RARP server on the same network segment as the router interface. Use the ip rarp-server address interface configuration command to identify the server. For more information on RARP, refer to the Cisco IOS Configuration Fundamentals Configuration Guide for Release 12.1. You can perform these tasks to configure address resolution: • Define a Static ARP Cache, page 29-10 • Set ARP Encapsulation, page 29-11 • Enable Proxy ARP, page 29-11 Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file. Command Purpose29-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Define a Static ARP Cache ARP and other address resolution protocols provide dynamic mapping between IP addresses and MAC addresses. Because most hosts support dynamic address resolution, you usually do not need to specify static ARP cache entries. If you must define a static ARP cache entry, you can do so globally, which installs a permanent entry in the ARP cache that the switch uses to translate IP addresses into MAC addresses. Optionally, you can also specify that the switch respond to ARP requests as if it were the owner of the specified IP address. If you do not want the ARP entry to be permanent, you can specify a timeout period for the ARP entry. Beginning in privileged EXEC mode, follow these steps to provide static mapping between IP addresses and MAC addresses: To remove an entry from the ARP cache, use the no arp ip-address hardware-address type global configuration command. To remove all nonstatic entries from the ARP cache, use the clear arp-cache privileged EXEC command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 arp ip-address hardware-address type Globally associate an IP address with a MAC (hardware) address in the ARP cache, and specify encapsulation type as one of these: • arpa—ARP encapsulation for Ethernet interfaces • snap—Subnetwork Address Protocol encapsulation for Token Ring and FDDI interfaces • sap—HP’s ARP type Step 3 arp ip-address hardware-address type [alias] (Optional) Specify that the switch respond to ARP requests as if it were the owner of the specified IP address. Step 4 interface interface-id Enter interface configuration mode, and specify the interface to configure. Step 5 arp timeout seconds (Optional) Set the length of time an ARP cache entry will stay in the cache. The default is 14400 seconds (4 hours). The range is 0 to 2147483 seconds. Step 6 end Return to privileged EXEC mode. Step 7 show interfaces [interface-id] Verify the type of ARP and the timeout value used on all interfaces or a specific interface. Step 8 show arp or show ip arp View the contents of the ARP cache. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.29-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Set ARP Encapsulation By default, Ethernet ARP encapsulation (represented by the arpa keyword) is enabled on an IP interface. You can change the encapsulation methods to SNAP if required by your network. Beginning in privileged EXEC mode, follow these steps to specify the ARP encapsulation type: To disable an encapsulation type, use the no arp arpa or no arp snap interface configuration command. Enable Proxy ARP By default, the switch uses proxy ARP to help hosts determine MAC addresses of hosts on other networks or subnets. Beginning in privileged EXEC mode, follow these steps to enable proxy ARP if it has been disabled: To disable proxy ARP on the interface, use the no ip proxy-arp interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 arp {arpa | snap} Specify the ARP encapsulation method: • arpa—Address Resolution Protocol • snap—Subnetwork Address Protocol Step 4 end Return to privileged EXEC mode. Step 5 show interfaces [interface-id] Verify ARP encapsulation configuration on all interfaces or the specified interface. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip proxy-arp Enable proxy ARP on the interface. Step 4 end Return to privileged EXEC mode. Step 5 show ip interface [interface-id] Verify the configuration on the interface or all interfaces. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Routing Assistance When IP Routing is Disabled These mechanisms allow the switch to learn about routes to other networks when it does not have IP routing enabled: • Proxy ARP, page 29-12 • Default Gateway, page 29-12 • ICMP Router Discovery Protocol (IRDP), page 29-13 Proxy ARP Proxy ARP, the most common method for learning about other routes, enables an Ethernet host with no routing information to communicate with hosts on other networks or subnets. The host assumes that all hosts are on the same local Ethernet and that they can use ARP to determine their MAC addresses. If a switch receives an ARP request for a host that is not on the same network as the sender, the switch evaluates whether it has the best route to that host. If it does, it sends an ARP reply packet with its own Ethernet MAC address, and the host that sent the request sends the packet to the switch, which forwards it to the intended host. Proxy ARP treats all networks as if they are local and performs ARP requests for every IP address. Proxy ARP is enabled by default. To enable it after it has been disabled, see the “Enable Proxy ARP” section on page 29-11. Proxy ARP works as long as other routers support it. Default Gateway Another method for locating routes is to define a default router or default gateway. All nonlocal packets are sent to this router, which either routes them appropriately or sends an IP Control Message Protocol (ICMP) redirect message back, defining which local router the host should use. The switch caches the redirect messages and forwards each packet as efficiently as possible. A limitation of this method is that there is no means of detecting when the default router has gone down or is unavailable. Beginning in privileged EXEC mode, follow these steps to define a default gateway (router) when IP routing is disabled: Use the no ip default-gateway global configuration command to disable this function. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip default-gateway ip-address Set up a default gateway (router). Step 3 end Return to privileged EXEC mode. Step 4 show ip redirects Display the address of the default gateway router to verify the setting. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.29-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing ICMP Router Discovery Protocol (IRDP) Router discovery allows the switch to dynamically learn about routes to other networks using IRDP. IRDP allows hosts to locate routers. When operating as a client, the switch generates router discovery packets. When operating as a host, the switch receives router discovery packets. The switch can also listen to Routing Information Protocol (RIP) and Interior Gateway Routing Protocol (IGRP) routing updates and use this information to infer locations of routers. The switch does not actually store the routing tables sent by routing devices; it merely keeps track of which systems are sending the data. The advantage of using IRDP is that it allows each router to specify both a priority and the time after which a device is assumed to be down if no further packets are received. Each device discovered becomes a candidate for the default router, and a new highest-priority router is selected when a higher priority router is discovered, when the current default router is declared down, or when a TCP connection is about to time out because of excessive retransmissions. The only required task for IRDP routing on an interface is to enable IRDP processing on that interface. When enabled, the default parameters apply. You can optionally change any of these parameters. Beginning in privileged EXEC mode, follow these steps to enable and configure IRDP on an interface: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip irdp Enable IRDP processing on the interface. Step 4 ip irdp multicast (Optional) Send IRDP advertisements to the multicast address (224.0.0.1) instead of IP broadcasts. Note This command allows for compatibility with Sun Microsystems Solaris, which requires IRDP packets to be sent out as multicasts. Many implementations cannot receive these multicasts; ensure end-host ability before using this command. Step 5 ip irdp holdtime seconds (Optional) Set the IRDP period for which advertisements are valid. The default is three times the maxadvertinterval value. It must be greater than maxadvertinterval and cannot be greater than 9000 seconds. If you change the maxadvertinterval value, this value also changes. Step 6 ip irdp maxadvertinterval seconds (Optional) Set the IRDP maximum interval between advertisements. The default is 600 seconds. Step 7 ip irdp minadvertinterval seconds (Optional) Set the IRDP minimum interval between advertisements. The default is 0.75 times the maxadvertinterval. If you change the maxadvertinterval, this value changes to the new default (0.75 of maxadvertinterval). Step 8 ip irdp preference number (Optional) Set a device IRDP preference level. The allowed range is –2 31 to 2 31 . The default is 0. A higher value increases the router preference level. Step 9 ip irdp address address [number] (Optional) Specify an IRDP address and preference to proxy-advertise. Step 10 end Return to privileged EXEC mode. Step 11 show ip irdp Verify settings by displaying IRDP values. Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file.29-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing If you change the maxadvertinterval value, the holdtime and minadvertinterval values also change, so it is important to first change the maxadvertinterval value, before manually changing either the holdtime or minadvertinterval values. Use the no ip irdp interface configuration command to disable IRDP routing. Configuring Broadcast Packet Handling After configuring an IP interface address, you can enable routing and configure one or more routing protocols, or you can configure the way the switch responds to network broadcasts. A broadcast is a data packet destined for all hosts on a physical network. The switch supports two kinds of broadcasting: • A directed broadcast packet is sent to a specific network or series of networks. A directed broadcast address includes the network or subnet fields. • A flooded broadcast packet is sent to every network. Note You can also limit broadcast, unicast, and multicast traffic on Layer 2 interfaces by using the storm-control interface configuration command to set traffic suppression levels. For more information, see Chapter 19, “Configuring Port-Based Traffic Control.” Routers provide some protection from broadcast storms by limiting their extent to the local cable. Bridges (including intelligent bridges), because they are Layer 2 devices, forward broadcasts to all network segments, thus propagating broadcast storms. The best solution to the broadcast storm problem is to use a single broadcast address scheme on a network. In most modern IP implementations, you can set the address to be used as the broadcast address. Many implementations, including the one in the Catalyst 3750 switch, support several addressing schemes for forwarding broadcast messages. Perform the tasks in these sections to enable these schemes: • Enabling Directed Broadcast-to-Physical Broadcast Translation, page 29-14 • Forwarding UDP Broadcast Packets and Protocols, page 29-15 • Establishing an IP Broadcast Address, page 29-16 • Flooding IP Broadcasts, page 29-17 Enabling Directed Broadcast-to-Physical Broadcast Translation By default, IP directed broadcasts are dropped; they are not forwarded. Dropping IP-directed broadcasts makes routers less susceptible to denial-of-service attacks. You can enable forwarding of IP-directed broadcasts on an interface where the broadcast becomes a physical (MAC-layer) broadcast. Only those protocols configured by using the ip forward-protocol global configuration command are forwarded. You can specify an access list to control which broadcasts are forwarded. When an access list is specified, only those IP packets permitted by the access list are eligible to be translated from directed broadcasts to physical broadcasts. For more information on access lists, see Chapter 26, “Configuring Network Security with ACLs.”29-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Beginning in privileged EXEC mode, follow these steps to enable forwarding of IP-directed broadcasts on an interface: Use the no ip directed-broadcast interface configuration command to disable translation of directed broadcast to physical broadcasts. Use the no ip forward-protocol global configuration command to remove a protocol or port. Forwarding UDP Broadcast Packets and Protocols User Datagram Protocol (UDP) is an IP host-to-host layer protocol, as is TCP. UDP provides a low-overhead, connectionless session between two end systems and does not provide for acknowledgment of received datagrams. Network hosts occasionally use UDP broadcasts to determine address, configuration, and name information. If such a host is on a network segment that does not include a server, UDP broadcasts are normally not forwarded. You can remedy this situation by configuring an interface on a router to forward certain classes of broadcasts to a helper address. You can use more than one helper address per interface. You can specify a UDP destination port to control which UDP services are forwarded. You can specify multiple UDP protocols. You can also specify the Network Disk (ND) protocol, which is used by older diskless Sun workstations and the network security protocol SDNS. By default, both UDP and ND forwarding are enabled if a helper address has been defined for an interface. The description for the ip forward-protocol interface configuration command in the Cisco IOS IP and IP Routing Command Reference for Release 12.1 lists the ports that are forwarded by default if you do not specify any UDP ports. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to configure. Step 3 ip directed-broadcast [access-list-number] Enable directed broadcast-to-physical broadcast translation on the interface. You can include an access list to control which broadcasts are forwarded. When an access list is specified, only IP packets permitted by the access list are eligible to be translated. Step 4 exit Return to global configuration mode. Step 5 ip forward-protocol {udp [port] | nd | sdns} Specify which protocols and ports the router forwards when forwarding broadcast packets. • udp—Forward UPD datagrams. port: (Optional) Destination port that controls which UDP services are forwarded. • nd—Forward ND datagrams. • sdns—Forward SDNS datagrams Step 6 end Return to privileged EXEC mode. Step 7 show ip interface [interface-id] or show running-config Verify the configuration on the interface or all interfaces. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.29-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing If you do not specify any UDP ports when you configure the forwarding of UDP broadcasts, you are configuring the router to act as a BOOTP forwarding agent. BOOTP packets carry Dynamic Host Configuration Protocol (DHCP) information. Beginning in privileged EXEC mode, follow these steps to enable forwarding UDP broadcast packets on an interface and specify the destination address: Use the no ip helper-address interface configuration command to disable the forwarding of broadcast packets to specific addresses. Use the no ip forward-protocol global configuration command to remove a protocol or port. Establishing an IP Broadcast Address The most popular IP broadcast address (and the default) is an address consisting of all ones (255.255.255.255). However, the switch can be configured to generate any form of IP broadcast address. Beginning in privileged EXEC mode, follow these steps to set the IP broadcast address on an interface: To restore the default IP broadcast address, use the no ip broadcast-address interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip helper-address address Enable forwarding and specify the destination address for forwarding UDP broadcast packets, including BOOTP. Step 4 exit Return to global configuration mode. Step 5 ip forward-protocol {udp [port] | nd | sdns} Specify which protocols the router forwards when forwarding broadcast packets. Step 6 end Return to privileged EXEC mode. Step 7 show ip interface [interface-id] or show running-config Verify the configuration on the interface or all interfaces. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to configure. Step 3 ip broadcast-address ip-address Enter a broadcast address different from the default, for example 128.1.255.255. Step 4 end Return to privileged EXEC mode. Step 5 show ip interface [interface-id] Verify the broadcast address on the interface or all interfaces. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Flooding IP Broadcasts You can allow IP broadcasts to be flooded throughout your internetwork in a controlled fashion by using the database created by the bridging STP. Using this feature also prevents loops. To support this capability, bridging must be configured on each interface that is to participate in the flooding. If bridging is not configured on an interface, it still can receive broadcasts. However, the interface never forwards broadcasts it receives, and the router never uses that interface to send broadcasts received on a different interface. Packets that are forwarded to a single network address using the IP helper-address mechanism can be flooded. Only one copy of the packet is sent on each network segment. To be considered for flooding, packets must meet these criteria. (Note that these are the same conditions used to consider packet forwarding using IP helper addresses.) • The packet must be a MAC-level broadcast. • The packet must be an IP-level broadcast. • The packet must be a TFTP, DNS, Time, NetBIOS, ND, or BOOTP packet, or a UDP specified by the ip forward-protocol udp global configuration command. • The time-to-live (TTL) value of the packet must be at least two. A flooded UDP datagram is given the destination address specified with the ip broadcast-address interface configuration command on the output interface. The destination address can be set to any address. Thus, the destination address might change as the datagram propagates through the network. The source address is never changed. The TTL value is decremented. When a flooded UDP datagram is sent out an interface (and the destination address possibly changed), the datagram is handed to the normal IP output routines and is, therefore, subject to access lists, if they are present on the output interface. Beginning in privileged EXEC mode, follow these steps to use the bridging spanning-tree database to flood UDP datagrams: Use the no ip forward-protocol spanning-tree global configuration command to disable the flooding of IP broadcasts. In the Catalyst 3750 switch, the majority of packets are forwarded in hardware; most packets do not go through the switch CPU. For those packets that do go to the CPU, you can speed up spanning tree-based UDP flooding by a factor of about four to five times by using turbo-flooding. This feature is supported over Ethernet interfaces configured for ARP encapsulation. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip forward-protocol spanning-tree Use the bridging spanning-tree database to flood UDP datagrams. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file.29-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IP Addressing Beginning in privileged EXEC mode, follow these steps to increase spanning-tree-based flooding: To disable this feature, use the no ip forward-protocol turbo-flood global configuration command. Monitoring and Maintaining IP Addressing When the contents of a particular cache, table, or database have become or are suspected to be invalid, you can remove all its contents by using the clear privileged EXEC commands. Table 29-2 lists the commands for clearing contents. You can display specific statistics, such as the contents of IP routing tables, caches, and databases; the reachability of nodes; and the routing path that packets are taking through the network. Table 29-3 lists the privileged EXEC commands for displaying IP statistics. Command Purpose Step 1 configure terminal Enter global configuration mode Step 2 ip forward-protocol turbo-flood Use the spanning-tree database to speed up flooding of UDP datagrams. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file. Table 29-2 Commands to Clear Caches, Tables, and Databases Command Purpose clear arp-cache Clear the IP ARP cache and the fast-switching cache. clear host {name | *} Remove one or all entries from the host name and the address cache. clear ip route {network [mask] |*} Remove one or more routes from the IP routing table. Table 29-3 Commands to Display Caches, Tables, and Databases Command Purpose show arp Display the entries in the ARP table. show hosts Display the default domain name, style of lookup service, name server hosts, and the cached list of host names and addresses. show ip aliases Display IP addresses mapped to TCP ports (aliases). show ip arp Display the IP ARP cache. show ip interface [interface-id] Display the IP status of interfaces. show ip irdp Display IRDP values. show ip masks address Display the masks used for network addresses and the number of subnets using each mask. show ip redirects Display the address of a default gateway. show ip route [address [mask]] | [protocol] Display the current state of the routing table. show ip route summary Display the current state of the routing table in summary form.29-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Enabling IP Unicast Routing Enabling IP Unicast Routing By default, the switch is in Layer 2 switching mode and IP routing is disabled. To use the Layer 3 capabilities of the switch, you must enable IP routing. Beginning in privileged EXEC mode, follow these steps to enable IP routing: Use the no ip routing global configuration command to disable routing. This example shows how to enable IP routing using RIP as the routing protocol: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# ip routing Switch(config)# router rip Switch(config-router)# network 10.0.0.0 Switch(config-router)# end You can now set up parameters for the selected routing protocols as described in these sections: • Configuring RIP, page 29-20 • Configuring IGRP, page 29-25 • Configuring OSPF, page 29-30 • Configuring EIGRP, page 29-39 • Configuring BGP, page 29-45 You can also configure nonprotocol-specific features: • Configuring Protocol-Independent Features, page 29-66 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip routing Enable IP routing. Step 3 router ip_routing_protocol Specify an IP routing protocol. This step might include other commands, such as specifying the networks to route with the network (RIP) router configuration command. For information on specific protocols, refer to sections later in this chapter and to the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1. Note The SMI supports only RIP as a routing protocol Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring RIP Configuring RIP The Routing Information Protocol (RIP) is an interior gateway protocol (IGP) created for use in small, homogeneous networks. It is a distance-vector routing protocol that uses broadcast User Datagram Protocol (UDP) data packets to exchange routing information. The protocol is documented in RFC 1058. You can find detailed information about RIP in IP Routing Fundamentals, published by Cisco Press. Note RIP is the only routing protocol supported by the SMI; other routing protocols require the stack master to be running the EMI. Using RIP, the switch sends routing information updates (advertisements) every 30 seconds. If a router does not receive an update from another router for 180 seconds or more, it marks the routes served by that router as unusable. If there is still no update after 240 seconds, the router removes all routing table entries for the non-updating router. RIP uses hop counts to rate the value of different routes. The hop count is the number of routers that can be traversed in a route. A directly connected network has a hop count of zero; a network with a hop count of 16 is unreachable. This small range (0 to 15) makes RIP unsuitable for large networks. If the router has a default network path, RIP advertises a route that links the router to the pseudonetwork 0.0.0.0. The 0.0.0.0 network does not exist; it is treated by RIP as a network to implement the default routing feature. The switch advertises the default network if a default was learned by RIP or if the router has a gateway of last resort and RIP is configured with a default metric. RIP sends updates to the interfaces in specified networks. If an interface’s network is not specified, it is not advertised in any RIP update. This section briefly describes how to configure RIP. It includes this information: • Default RIP Configuration, page 29-20 • Configuring Basic RIP Parameters, page 29-21 • Configuring RIP Authentication, page 29-23 • Configuring Summary Addresses and Split Horizon, page 29-23 Default RIP Configuration Table 29-4 shows the default RIP configuration. Table 29-4 Default RIP Configuration Feature Default Setting Auto summary Enabled. Default-information originate Disabled. Default metric Built-in; automatic metric translations. IP RIP authentication key-chain No authentication. Authentication mode: clear text. IP RIP receive version According to the version router configuration command. IP RIP send version According to the version router configuration command. IP RIP triggered According to the version router configuration command.29-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring RIP Configuring Basic RIP Parameters To configure RIP, you enable RIP routing for a network and optionally configure other parameters. Beginning in privileged EXEC mode, follow these steps to enable and configure RIP: IP split horizon Varies with media. Neighbor None defined. Network None specified. Offset list Disabled. Output delay 0 milliseconds. Timers basic • Update: 30 seconds. • Invalid: 180 seconds. • Hold-down: 180 seconds. • Flush: 240 seconds. Validate-update-source Enabled. Version Receives RIP version 1 and 2 packets; sends version 1 packets. Table 29-4 Default RIP Configuration (continued) Feature Default Setting Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip routing Enable IP routing. (Required only if IP routing is disabled.) Step 3 router rip Enable a RIP routing process, and enter router configuration mode. Step 4 network network number Associate a network with a RIP routing process. You can specify multiple network commands. RIP routing updates are sent and received through interfaces only on these networks. Step 5 neighbor ip-address (Optional) Define a neighboring router with which to exchange routing information. This step allows routing updates from RIP (normally a broadcast protocol) to reach nonbroadcast networks. Step 6 offset list [access-list number | name] {in | out} offset [type number] (Optional) Apply an offset list to routing metrics to increase incoming and outgoing metrics to routes learned through RIP. You can limit the offset list with an access list or an interface.29-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring RIP To turn off the RIP routing process, use the no router rip global configuration command. To display the parameters and current state of the active routing protocol process, use the show ip protocols privileged EXEC command. Use the show ip rip database privileged EXEC command to display summary address entries in the RIP database. Step 7 timers basic update invalid holddown flush (Optional) Adjust routing protocol timers. Valid ranges for all timers are 0 to 4294967295 seconds. • update—The time between sending routing updates. The default is 30 seconds. • invalid—The timer after which a route is declared invalid. The default is 180 seconds. • holddown—The time before a route is removed from the routing table. The default is 180 seconds. • flush—The amount of time for which routing updates are postponed. The default is 240 seconds. Step 8 version {1 | 2} (Optional) Configure the switch to receive and send only RIP Version 1 or RIP version 2 packets. By default, the switch receives Version 1 and 2 but sends only Version 1. You can also use the interface commands ip rip {send | receive} version 1 | 2 | 1 2} to control what versions are used for sending and receiving on interfaces. Step 9 no auto summary (Optional) Disable automatic summarization. By default, the switch summarizes subprefixes when crossing classful network boundaries. Disable summarization (RIP version 2 only) to advertise subnet and host routing information to classful network boundaries. Step 10 no validate-update-source (Optional) Disable validation of the source IP address of incoming RIP routing updates. By default, the switch validates the source IP address of incoming RIP routing updates and discards the update if the source address is not valid. Under normal circumstances, disabling this feature is not recommended. However, if you have a router that is off-network and you want to receive its updates, you can use this command. Step 11 output-delay delay (Optional) Add interpacket delay for RIP updates sent. By default, packets in a multiple-packet RIP update have no delay added between packets. If you are sending packets to a lower-speed device, you can add an interpacket delay in the range of 8 to 50 milliseconds. Step 12 end Return to privileged EXEC mode. Step 13 show ip protocols Verify your entries. Step 14 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring RIP Configuring RIP Authentication RIP version 1 does not support authentication. If you are sending and receiving RIP Version 2 packets, you can enable RIP authentication on an interface. The key chain determines the set of keys that can be used on the interface. If a key chain is not configured, no authentication is performed, not even the default. Therefore, you must also perform the tasks in the “Managing Authentication Keys” section on page 29-80. The switch supports two modes of authentication on interfaces for which RIP authentication is enabled: plain text and MD5. The default is plain text. Beginning in privileged EXEC mode, follow these steps to configure RIP authentication on an interface: To restore clear text authentication, use the no ip rip authentication mode interface configuration command. To prevent authentication, use the no ip rip authentication key-chain interface configuration command. Configuring Summary Addresses and Split Horizon Routers connected to broadcast-type IP networks and using distance-vector routing protocols normally use the split-horizon mechanism to reduce the possibility of routing loops. Split horizon blocks information about routes from being advertised by a router on any interface from which that information originated. This feature usually optimizes communication among multiple routers, especially when links are broken. Note In general, disabling split horizon is not recommended unless you are certain that your application requires it to properly advertise routes. If you want to configure an interface running RIP to advertise a summarized local IP address pool on a network access server for dial-up clients, use the ip summary-address rip interface configuration command. Note If split horizon is enabled, neither autosummary nor interface IP summary addresses are advertised. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to configure. Step 3 ip rip authentication key-chain name-of-chain Enable RIP authentication. Step 4 ip rip authentication mode [text | md5} Configure the interface to use plain text authentication (the default) or MD5 digest authentication. Step 5 end Return to privileged EXEC mode. Step 6 show running-config interface [interface-id] Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.29-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring RIP Beginning in privileged EXEC mode, follow these steps to set an interface to advertise a summarized local IP address and to disable split horizon on the interface: To disable IP summarization, use the no ip summary-address rip router configuration command. In this example, the major net is 10.0.0.0. The summary address 10.2.0.0 overrides the autosummary address of 10.0.0.0 so that 10.2.0.0 is advertised out interface Gigabit Ethernet 2 on switch 1, and 10.0.0.0 is not advertised. In the example, if the interface is still in Layer 2 mode (the default), you must enter a no switchport interface configuration command before entering the ip address interface configuration command. Note If split horizon is enabled, neither autosummary nor interface summary addresses (those configured with the ip summary-address rip router configuration command) are advertised. Switch(config)# router rip Switch(config-router)# interface gi1/0/2 Switch(config-if)# ip address 10.1.5.1 255.255.255.0 Switch(config-if)# ip summary-address rip 10.2.0.0 255.255.0.0 Switch(config-if)# no ip split-horizon Switch(config-if)# exit Switch(config)# router rip Switch(config-router)# network 10.0.0.0 Switch(config-router)# neighbor 2.2.2.2 peer-group mygroup Switch(config-router)# end Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip address ip-address subnet-mask Configure the IP address and IP subnet. Step 4 ip summary-address rip ip address ip-network mask Configure the IP address to be summarized and the IP network mask. Step 5 no ip split horizon Disable split horizon on the interface. Step 6 end Return to privileged EXEC mode. Step 7 show ip interface interface-id Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.29-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IGRP Configuring IGRP Interior Gateway Routing Protocol (IGRP) is a dynamic, distance-vector routing, proprietary Cisco protocol for routing in an autonomous system (AS) that contains large, arbitrarily complex networks with diverse bandwidth and delay characteristics. IGRP uses a combination of user-configurable metrics, including internetwork delay, bandwidth, reliability, and load. IGRP also advertises types of routes: interior, system, and exterior, as shown in Figure 29-4. • Interior routes are routes between subnets in the network attached to a router interface. If the network attached to a router is not subnetted, IGRP does not advertise interior routes. • System routes are routes to networks within an autonomous system. The router derives system routes from directly connected network interfaces and system route information provided by other IGRP-speaking routers or access servers. System routes do not include subnet information. • Exterior routes are routes to networks outside the AS that are considered when identifying a gateway of last resort. The router chooses a gateway of last resort from the list of exterior routes that IGRP provides if it does not have a better route for a packet and the destination is not a connected network. If the AS has more than one connection to an external network, different routers can choose different exterior routers as the gateway of last resort. Figure 29-4 Interior, System, and Exterior Routes By default, a router running IGRP sends an update broadcast every 90 seconds and declares a route inaccessible if it does not receive an update from the first router in the route within three update periods (270 seconds). After seven update periods (630 seconds), the route is removed from the routing table. This section briefly describes how to configure IGRP. It includes this information: • Default IGRP Configuration, page 29-26 • Understanding Load Balancing and Traffic Distribution Control, page 29-26 • Configuring Basic IGRP Parameters, page 29-27 • Configuring Split Horizon, page 29-29 Note To enable IGRP, the stack master must be running the EMI. Router System Subnet A Subnet B Interior 46649 Exterior Autonomous system 1 Autonomous system 2 Router Router29-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IGRP Default IGRP Configuration Table 29-5 shows the default IGRP configuration. Routers running IGRP use flash and poison-reverse updates to speed up the convergence of the routing algorithm. Flash updates are updates sent before the standard interval, notifying other routers of a metric change. Poison-reverse updates are intended to defeat larger routing loops caused by increases in routing metrics. The poison-reverse updates are sent to remove a route and place it in hold-down, which keeps new routing information from being used for a certain period of time. Understanding Load Balancing and Traffic Distribution Control IGRP can simultaneously use an asymmetric set of paths for a given destination. This unequal-cost load balancing allows traffic to be distributed among up to four unequal-cost paths to provide greater overall throughput and reliability. Alternate path variance (that is, the difference in desirability between the primary and alternate paths) determines the feasibility of a potential route. An alternate route is feasible if the next router in the path is closer to the destination (has a lower metric value) than the router being used, and if the metric for the entire alternate path is within the variance. Only feasible paths are used for load balancing and are included in the routing table. These conditions limit the number of load balancing occurrences, but ensure that the dynamics of the network remain stable. These general rules apply to IGRP unequal-cost load balancing: • IGRP accepts up to four paths for a given destination network. • The local best metric must be greater than the metric learned from the next router; that is, the next hop router must be closer (have a smaller metric value) to the destination than the local best metric. Table 29-5 Default IGRP Configuration Feature Default Setting IP split horizon Varies with media. Metric holddown Disabled. Metric maximum-hops 100 hops. Neighbor None defined. Network None specified. Offset-list Disabled. Set metric None set in route map. Timers basic Update: 90 seconds. Invalid: 270 seconds. Hold-down: 280 seconds. Flush: 630 seconds. Sleeptime: 0 milliseconds. Traffic-share Distributed proportionately to the ratios of the metrics.29-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IGRP • The alternative path metric must be within the specified variance of the local best metric. The multiplier times the local best metric for the destination must be greater than or equal to the metric through the next router. If these conditions are met, the route is determined to be feasible and can be added to the routing table. By default, the amount of variance is set to one (equal-cost load balancing). Use the variance router configuration command to define how much worse an alternate path can be before that path is disallowed. If variance is configured as described in the preceding section, IGRP or Enhanced IGRP distributes traffic among multiple routes of unequal cost to the same destination. If you want faster convergence to alternate routes, but you do not want to send traffic across inferior routes in the normal case, you might prefer to have no traffic flow along routes with higher metrics. Use the traffic-share router configuration command to control distribution of traffic among multiple routes of unequal cost. Note For more information and examples, refer to the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1. Configuring Basic IGRP Parameters Beginning in privileged EXEC mode, follow these steps to configure IGRP. Configuring the routing process is required; other steps are optional: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router igrp autonomous-system Enable an IGRP routing process, and enter router configuration mode. The AS number identifies the routes to other IGRP routers and tags routing information. Step 3 network network-number Associate networks with an IGRP routing process. IGRP sends updates to the interfaces in the specified networks. If an interface’s network is not specified, it is not advertised in any IGRP update. It is not necessary to have a registered AS number, but if you do have a registered number, we recommend that you use it to identify your process. Step 4 offset list [access-list number | name] {in | out} offset [type number] (Optional) Apply an offset list to routing metrics to increase incoming and outgoing metrics to routes learned through IGRP. You can limit the offset list with an access list or an interface. Step 5 neighbor ip-address (Optional) Define a neighboring router with which to exchange routing information. This step allows routing updates from RIP (normally a broadcast protocol) to reach nonbroadcast network. Step 6 metric weights tos k1 k2 k3 k4 k5 (Optional) Adjust the IGRP metric. By default, the IGRP composite metric is a 23-bit quantity that is the sum of the segment delays and the lowest segment bandwidth for a given route. • tos—Type of services; the default is 0. • k1-k5—Constants that convert a metric vector into a scalar quantity. Defaults for k1 and k3 are 1; all others are 0.29-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IGRP To shut down an IGRP routing process, use the no router igrp global configuration command. Step 7 timers basic update invalid holddown flush [sleeptime] (Optional) Adjust routing protocol timers. • update—The time (in seconds) between sending of routing updates. The default is 90 seconds. • invalid—The timer interval (in seconds) after which a route is declared invalid. The default is 270 seconds. • holddown—The time (in seconds) during which routing information about better paths is suppressed. The default is 280 seconds. • flush—The time (in seconds) that must pass before a route is removed from the routing table. The default is 630 seconds. • sleeptime—Interval in milliseconds for postponing routing updates. The default is 0. Step 8 no metric holddown (Optional) Disable the IGRP hold-down period. The route to a network is placed in holddown if the router learns that the network is farther away than previously known or is down. Holddown keeps new routing information from being used for a certain period of time. This can prevent routing loops caused by slow convergence. It is sometimes advantageous to disable holddown to increase the network's ability to quickly respond to topology changes; this command provides this function. Use the metric holddown command if other routers or access servers within the IGRP autonomous system are not configured with the no metric holddown command. If all routers are not configured the same way, you increase the possibility of routing loops. Step 9 metric maximum-hops hops (Optional) Configure the maximum network diameter. Routes with hop counts exceeding this diameter are not advertised. The default is 100 hops; the maximum is 255 hops. Step 10 no validate-update-source (Optional) Disable validation of the source IP address of incoming RIP routing updates. By default, the switch validates the source IP address of incoming RIP routing updates and discards the update if the source address is not valid. Step 11 variance multiplier (Optional) Define the variance associated with a particular path to enable unequal-cost load balancing if desired, balancing traffic across all feasible paths to converge to a new path if a path should fail. The multiplier can be from 1 to 128; the default is 1 (equal-cost load balancing). Step 12 traffic-share {balanced | min} (Optional) Distribute traffic by one of these methods: • balanced—Proportionately to the ratios of metrics • min—By the minimum-cost route. Step 13 end Return to privileged EXEC mode. Step 14 show ip protocols Verify your entries. Step 15 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring IGRP This example shows how to configure a router for IGRP and assign it autonomous system 109. The network router configuration commands show the networks directly connected to the router. Switch(config)# router igrp 109 Switch(config-router)# network 131.108.0.0 Switch(config-router)# network 192.31.7.0 Configuring Split Horizon Routers connected to broadcast-type IP networks and using distance-vector routing protocols normally use the split-horizon mechanism to reduce the possibility of routing loops. Split horizon blocks information about routes from being advertised by a router on any interface from which that information originated. This feature can optimize communication among multiple routers, especially when links are broken. Note In general, we do not recommend disabling split horizon unless you are certain that your application requires it to properly advertise routes. Beginning in privileged EXEC mode, follow these steps to disable split horizon on the interface: To enable the split horizon mechanism, use the ip split-horizon interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to configure. Step 3 ip address ip-address subnet-mask Configure the IP address and IP subnet. Step 4 no ip split-horizon Disable split horizon on the interface. Step 5 end Return to privileged EXEC mode. Step 6 show ip interface interface-id Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.29-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Configuring OSPF This section briefly describes how to configure Open Shortest Path First (OSPF). For a complete description of the OSPF commands, refer to the “OSPF Commands” chapter of the Cisco IOS IP and IP Routing Command Reference for Release 12.1. Note OSPF classifies different media into broadcast, nonbroadcast, and point-to-point networks. The Catalyst 3750 switch supports broadcast (Ethernet, Token Ring, and FDDI) and point-to-point networks (Ethernet interfaces configured as point-to-point links). OSPF is an Interior Gateway Protocol (IGP) designed expressly for IP networks, supporting IP subnetting and tagging of externally derived routing information. OSPF also allows packet authentication and uses IP multicast when sending and receiving packets. The Cisco implementation supports RFC 1253, OSPF management information base (MIB). The Cisco implementation conforms to the OSPF Version 2 specifications with these key features: • Definition of stub areas is supported. • Routes learned through any IP routing protocol can be redistributed into another IP routing protocol. At the intradomain level, this means that OSPF can import routes learned through IGRP and RIP. OSPF routes can also be exported into IGRP and RIP. • Plain text and MD5 authentication among neighboring routers within an area is supported. • Configurable routing interface parameters include interface output cost, retransmission interval, interface transmit delay, router priority, router dead and hello intervals, and authentication key. • Virtual links are supported. • Not-so-stubby-areas (NSSAs) per RFC 1587are supported. OSPF typically requires coordination among many internal routers, area border routers (ABRs) connected to multiple areas, and autonomous system boundary routers (ASBRs). The minimum configuration would use all default parameter values, no authentication, and interfaces assigned to areas. If you customize your environment, you must ensure coordinated configuration of all routers. This section briefly describes how to configure OSPF. It includes this information: • Default OSPF Configuration, page 29-31 • Configuring Basic OSPF Parameters, page 29-32 • Configuring OSPF Interfaces, page 29-33 • Configuring OSPF Area Parameters, page 29-34 • Configuring Other OSPF Parameters, page 29-35 • Changing LSA Group Pacing, page 29-37 • Configuring a Loopback Interface, page 29-37 • Monitoring OSPF, page 29-38 Note To enable OSPF, the stack master must be running the EMI.29-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Default OSPF Configuration Table 29-6 shows the default OSPF configuration. Table 29-6 Default OSPF Configuration Feature Default Setting Interface parameters Cost: No default cost predefined. Retransmit interval: 5 seconds. Transmit delay: 1 second. Priority: 1. Hello interval: 10 seconds. Dead interval: 4 times the hello interval. No authentication. No password specified. MD5 authentication disabled. Area Authentication type: 0 (no authentication). Default cost: 1. Range: Disabled. Stub: No stub area defined. NSSA: No NSSA area defined. Auto cost 100 Mbps. Default-information originate Disabled. When enabled, the default metric setting is 10, and the external route type default is Type 2. Default metric Built-in, automatic metric translation, as appropriate for each routing protocol. Distance OSPF dist1 (all routes within an area): 110. dist2 (all routes from one area to another): 110. and dist3 (routes from other routing domains): 110. OSPF database filter Disabled. All outgoing link-state advertisements (LSAs) are flooded to the interface. IP OSPF name lookup Disabled. Log adjacency changes Enabled. Neighbor None specified. Neighbor database filter Disabled. All outgoing LSAs are flooded to the neighbor. Network area Disabled. Router ID No OSPF routing process defined. Summary address Disabled. Timers LSA group pacing 240 seconds.29-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Configuring Basic OSPF Parameters Enabling OSPF requires that you create an OSPF routing process, specify the range of IP addresses to be associated with the routing process, and assign area IDs to be associated with that range. Beginning in privileged EXEC mode, follow these steps to enable OSPF: To terminate an OSPF routing process, use the no router ospf process-id global configuration command. This example shows how to configure an OSPF routing process and assign it a process number of 109: Switch(config)# router ospf 109 Switch(config-router)# network 131.108.0.0 255.255.255.0 area 24 Timers shortest path first (spf) spf delay: 5 seconds. spf-holdtime: 10 seconds. Virtual link No area ID or router ID defined. Hello interval: 10 seconds. Retransmit interval: 5 seconds. Transmit delay: 1 second. Dead interval: 40 seconds. Authentication key: no key predefined. Message-digest key (MD5): no key predefined. Table 29-6 Default OSPF Configuration (continued) Feature Default Setting Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router ospf process-id Enable OSPF routing, and enter router configuration mode. The process ID is an internally used identification parameter that is locally assigned and can be any positive integer. Each OSPF routing process has a unique value. Step 3 network address wildcard-mask area area-id Define an interface on which OSPF runs and the area ID for that interface. You can use the wildcard-mask to use a single command to define one or more multiple interfaces to be associated with a specific OSPF area. The area ID can be a decimal value or an IP address. Step 4 end Return to privileged EXEC mode. Step 5 show ip protocols Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Configuring OSPF Interfaces You can use the ip ospf interface configuration commands to modify interface-specific OSPF parameters. You are not required to modify any of these parameters, but some interface parameters (hello interval, dead interval, and authentication key) must be consistent across all routers in an attached network. If you modify these parameters, be sure all routers in the network have compatible values. Note The ip ospf interface configuration commands are all optional. Beginning in privileged EXEC mode, follow these steps to modify OSPF interface parameters: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip ospf cost (Optional) Explicitly specify the cost of sending a packet on the interface. Step 4 ip ospf retransmit-interval seconds (Optional) Specify the number of seconds between link state advertisement transmissions. The range is 1 to 65535 seconds. The default is 5 seconds. Step 5 ip ospf transmit-delay seconds (Optional) Set the estimated number of seconds to wait before sending a link state update packet. The range is 1 to 65535 seconds. The default is 1 second. Step 6 ip ospf priority number (Optional) Set priority to help determine the OSPF designated router for a network. The range is from 0 to 255. The default is 1. Step 7 ip ospf hello-interval seconds (Optional) Set the number of seconds between hello packets sent on an OSPF interface. The value must be the same for all nodes on a network. The range is 1 to 65535 seconds. The default is 10 seconds. Step 8 ip ospf dead-interval seconds (Optional) Set the number of seconds after the last device hello packet was seen before its neighbors declare the OSPF router to be down. The value must be the same for all nodes on a network. The range is 1 to 65535 seconds. The default is 4 times the hello interval. Step 9 ip ospf authentication-key key (Optional) Assign a password to be used by neighboring OSPF routers. The password can be any string of keyboard-entered characters up to 8 bytes in length. All neighboring routers on the same network must have the same password to exchange OSPF information. Step 10 ip ospf message digest-key keyid md5 key (Optional) Enable MDS authentication. • keyid—An identifier from 1 to 255. • key—An alphanumeric password of up to 16 bytes. Step 11 ip ospf database-filter all out (Optional) Block flooding of OSPF LSA packets to the interface. By default, OSPF floods new LSAs over all interfaces in the same area, except the interface on which the LSA arrives. Step 12 end Return to privileged EXEC mode.29-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Use the no form of these commands to remove the configured parameter value or return to the default value. Configuring OSPF Area Parameters You can optionally configure several OSPF area parameters. These parameters include authentication for password-based protection against unauthorized access to an area, stub areas, and not-so-stubby-areas (NSSAs). Stub areas are areas into which information on external routes is not sent. Instead, the area border router (ABR) generates a default external route into the stub area for destinations outside the autonomous system (AS). An NSSA does not flood all LSAs from the core into the area, but can import AS external routes within the area by redistribution. Route summarization is the consolidation of advertised addresses into a single summary route to be advertised by other areas. If network numbers are contiguous, you can use the area range router configuration command to configure the ABR to advertise a summary route that covers all networks in the range. Note The OSPF area router configuration commands are all optional. Beginning in privileged EXEC mode, follow these steps to configure area parameters: Step 13 show ip ospf interface [interface-name] Display OSPF-related interface information. Step 14 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router ospf process-id Enable OSPF routing, and enter router configuration mode. Step 3 area area-id authentication (Optional) Allow password-based protection against unauthorized access to the identified area. The identifier can be either a decimal value or an IP address. Step 4 area area-id authentication message-digest (Optional) Enable MD5 authentication on the area. Step 5 area area-id stub [no-summary] (Optional) Define an area as a stub area. The no-summary keyword prevents an ABR from sending summary link advertisements into the stub area. Step 6 area area-id nssa [no-redistribution] [default-information-originate] [no-summary] (Optional) Defines an area as a not-so-stubby-area. Every router within the same area must agree that the area is NSSA. Select one of these keywords: • no-redistribution—Select when the router is an NSSA ABR and you want the redistribute command to import routes into normal areas, but not into the NSSA. • default-information-originate—Select on an ABR to allow importing type 7 LSAs into the NSSA. • no-redistribution—Select to not send summary LSAs into the NSSA.29-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Use the no form of these commands to remove the configured parameter value or to return to the default value. Configuring Other OSPF Parameters You can optionally configure other OSPF parameters in router configuration mode. • Route summarization: When redistributing routes from other protocols as described in the “Using Route Maps to Redistribute Routing Information” section on page 29-70, each route is advertised individually in an external LSA. To help decrease the size of the OSPF link state database, you can use the summary-address router configuration command to advertise a single router for all the redistributed routes included in a specified network address and mask. • Virtual links: In OSPF, all areas must be connected to a backbone area. You can establish a virtual link in case of a backbone-continuity break by configuring two Area Border Routers as endpoints of a virtual link. Configuration information includes the identity of the other virtual endpoint (the other ABR) and the nonbackbone link that the two routers have in common (the transit area). Virtual links cannot be configured through a stub area. • Default route: When you specifically configure redistribution of routes into an OSPF routing domain, the route automatically becomes an autonomous system boundary router (ASBR). You can force the ASBR to generate a default route into the OSPF routing domain. • Domain Name Server (DNS) names for use in all OSPF show privileged EXEC command displays makes it easier to identify a router than displaying it by router ID or neighbor ID. • Default Metrics: OSPF calculates the OSPF metric for an interface according to the bandwidth of the interface. The metric is calculated as ref-bw divided by bandwidth, where ref is 10 by default, and bandwidth (bw) is determined by the bandwidth interface configuration command. For multiple links with high bandwidth, you can specify a larger number to differentiate the cost on those links. • Administrative distance is a rating of the trustworthiness of a routing information source, an integer between 0 and 255, with a higher value meaning a lower trust rating. An administrative distance of 255 means the routing information source cannot be trusted at all and should be ignored. OSPF uses three different administrative distances: routes within an area (interarea), routes to another area (interarea), and routes from another routing domain learned through redistribution (external). You can change any of the distance values. • Passive interfaces: Because interfaces between two devices on an Ethernet represent only one network segment, to prevent OSPF from sending hello packets for the sending interface, you must configure the sending device to be a passive interface. Both devices can identify each other through the hello packet for the receiving interface. Step 7 area area-id range address mask (Optional) Specify an address range for which a single route is advertised. Use this command only with area border routers. Step 8 end Return to privileged EXEC mode. Step 9 show ip ospf [process-id] show ip ospf [process-id [area-id]] database Display information about the OSPF routing process in general or for a specific process ID to verify configuration. Display lists of information related to the OSPF database for a specific router. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF • Route calculation timers: You can configure the delay time between when OSPF receives a topology change and when it starts the shortest path first (SPF) calculation and the hold time between two SPF calculations. • Log neighbor changes: You can configure the router to send a syslog message when an OSPF neighbor state changes, providing a high-level view of changes in the router. Beginning in privileged EXEC mode, follow these steps to configure these OSPF parameters: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router ospf process-id Enable OSPF routing, and enter router configuration mode. Step 3 summary-address address mask (Optional) Specify an address and IP subnet mask for redistributed routes so that only one summary route is advertised. Step 4 area area-id virtual-link router-id [hello-interval seconds] [retransmit-interval seconds] [trans] [[authentication-key key] | message-digest-key keyid md5 key]] (Optional) Establish a virtual link and set its parameters. See the “Configuring OSPF Interfaces” section on page 29-33 for parameter definitions and Table 29-6 on page 29-31 for virtual link defaults. Step 5 default-information originate [always] [metric metric-value] [metric-type type-value] [route-map map-name] (Optional) Force the ASBR to generate a default route into the OSPF routing domain. Parameters are all optional. Step 6 ip ospf name-lookup (Optional) Configure DNS name lookup. The default is disabled. Step 7 ip auto-cost reference-bandwidth ref-bw (Optional) Specify an address range for which a single route will be advertised. Use this command only with area border routers. Step 8 distance ospf {[inter-area dist1] [inter-area dist2] [external dist3]} (Optional) Change the OSPF distance values. The default distance for each type of route is 110. The range is 1 to 255. Step 9 passive-interface type number (Optional) Suppress the sending of hello packets through the specified interface. Step 10 timers spf spf-delay spf-holdtime (Optional) Configure route calculation timers. • spf-delay—Enter an integer from 0 to 65535. The default is 5 seconds; 0 means no delay. • spf-holdtime—Enter an integer from 0 to 65535. The default is 10 seconds; 0 means no delay. Step 11 ospf log-adj-changes (Optional) Send syslog message when a neighbor state changes. Step 12 end Return to privileged EXEC mode. Step 13 show ip ospf [process-id [area-id]] database Display lists of information related to the OSPF database for a specific router. For some of the keyword options, see to the “Monitoring OSPF” section on page 29-38. Step 14 copy running-config startup-config (Optional) Save your entries in the configuration file.29-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Changing LSA Group Pacing The OSPF LSA group pacing feature allows the router to group OSPF LSAs and pace the refreshing, check-summing, and aging functions for more efficient router use. This feature is enabled by default with a 4-minute default pacing interval, and you will not usually need to modify this parameter. The optimum group pacing interval is inversely proportional to the number of LSAs the router is refreshing, check-summing, and aging. For example, if you have approximately 10,000 LSAs in the database, decreasing the pacing interval would benefit you. If you have a very small database (40 to 100 LSAs), increasing the pacing interval to 10 to 20 minutes might benefit you slightly. Beginning in privileged EXEC mode, follow these steps to configure OSPF LSA pacing: To return to the default value, use the no timers lsa-group-pacing router configuration command. Configuring a Loopback Interface OSPF uses the highest IP address configured on the interfaces as its router ID. If this interface is down or removed, the OSPF process must recalculate a new router ID and resend all its routing information out its interfaces. If a loopback interface is configured with an IP address, OSPF uses this IP address as its router ID, even if other interfaces have higher IP addresses. Because loopback interfaces never fail, this provides greater stability. OSPF automatically prefers a loopback interface over other interfaces, and it chooses the highest IP address among all loopback interfaces. Beginning in privileged EXEC mode, follow these steps to configure a loopback interface: Use the no interface loopback 0 global configuration command to disable the loopback interface. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router ospf process-id Enable OSPF routing, and enter router configuration mode. Step 3 timers lsa-group-pacing seconds Change the group pacing of LSAs. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface loopback 0 Create a loopback interface, and enter interface configuration mode. Step 3 ip address address mask Assign an IP address to this interface. Step 4 end Return to privileged EXEC mode. Step 5 show ip interface Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring OSPF Monitoring OSPF You can display specific statistics such as the contents of IP routing tables, caches, and databases. Table 29-7 lists some of the privileged EXEC commands for displaying statistics. For more show ip ospf database privileged EXEC command options and for explanations of fields in the resulting display, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. Table 29-7 Show IP OSPF Statistics Commands Command Purpose show ip ospf [process-id] Display general information about OSPF routing processes. show ip ospf [process-id] database [router] [link-state-id] show ip ospf [process-id] database [router] [self-originate] show ip ospf [process-id] database [router] [adv-router [ip-address]] show ip ospf [process-id] database [network] [link-state-id] show ip ospf [process-id] database [summary] [link-state-id] show ip ospf [process-id] database [asbr-summary] [link-state-id] show ip ospf [process-id] database [external] [link-state-id] show ip ospf [process-id area-id] database [database-summary] Display lists of information related to the OSPF database. show ip ospf border-routes Display the internal OSPF routing ABR and ASBR table entries. show ip ospf interface [interface-name] Display OSPF-related interface information. show ip ospf neighbor [interface-name] [neighbor-id] detail Display OSPF interface neighbor information. show ip ospf virtual-links Display OSPF-related virtual links information.29-39 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP Configuring EIGRP Enhanced IGRP (EIGRP) is a Cisco proprietary enhanced version of the IGRP. Enhanced IGRP uses the same distance vector algorithm and distance information as IGRP; however, the convergence properties and the operating efficiency of Enhanced IGRP are significantly improved. The convergence technology employs an algorithm referred to as the Diffusing Update Algorithm (DUAL), which guarantees loop-free operation at every instant throughout a route computation and allows all devices involved in a topology change to synchronize at the same time. Routers that are not affected by topology changes are not involved in recomputations. IP EIGRP provides increased network width. With RIP, the largest possible width of your network is 15 hops. When IGRP is enabled, the largest possible width is 224 hops. Because the EIGRP metric is large enough to support thousands of hops, the only barrier to expanding the network is the transport-layer hop counter. EIGRP increments the transport control field only when an IP packet has traversed 15 routers and the next hop to the destination was learned through EIGRP. When a RIP route is used as the next hop to the destination, the transport control field is incremented as usual. EIGRP offers these features: • Fast convergence. • Incremental updates when the state of a destination changes, instead of sending the entire contents of the routing table, minimizing the bandwidth required for EIGRP packets. • Less CPU usage than IGRP because full update packets need not be processed each time they are received. • Protocol-independent neighbor discovery mechanism to learn about neighboring routers. • Variable-length subnet masks (VLSMs). • Arbitrary route summarization. • EIGRP scales to large networks. Enhanced IGRP has these four basic components: • Neighbor discovery and recovery is the process that routers use to dynamically learn of other routers on their directly attached networks. Routers must also discover when their neighbors become unreachable or inoperative. Neighbor discovery and recovery is achieved with low overhead by periodically sending small hello packets. As long as hello packets are received, the Cisco IOS software can determine that a neighbor is alive and functioning. When this status is determined, the neighboring routers can exchange routing information. • The reliable transport protocol is responsible for guaranteed, ordered delivery of EIGRP packets to all neighbors. It supports intermixed transmission of multicast and unicast packets. Some EIGRP packets must be sent reliably, and others need not be. For efficiency, reliability is provided only when necessary. For example, on a multiaccess network that has multicast capabilities (such as Ethernet), it is not necessary to send hellos reliably to all neighbors individually. Therefore, EIGRP sends a single multicast hello with an indication in the packet informing the receivers that the packet need not be acknowledged. Other types of packets (such as updates) require acknowledgment, which is shown in the packet. The reliable transport has a provision to send multicast packets quickly when there are unacknowledged packets pending. Doing so helps ensure that convergence time remains low in the presence of varying speed links. • The DUAL finite state machine embodies the decision process for all route computations. It tracks all routes advertised by all neighbors. DUAL uses the distance information (known as a metric) to select efficient, loop-free paths. DUAL selects routes to be inserted into a routing table based on feasible successors. A successor is a neighboring router used for packet forwarding that has a least-cost path to a destination that is guaranteed not to be part of a routing loop. When there are no 29-40 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP feasible successors, but there are neighbors advertising the destination, a recomputation must occur. This is the process whereby a new successor is determined. The amount of time it takes to recompute the route affects the convergence time. Recomputation is processor-intensive; it is advantageous to avoid recomputation if it is not necessary. When a topology change occurs, DUAL tests for feasible successors. If there are feasible successors, it uses any it finds to avoid unnecessary recomputation. • The protocol-dependent modules are responsible for network layer protocol-specific tasks. An example is the IP EIGRP module, which is responsible for sending and receiving EIGRP packets that are encapsulated in IP. It is also responsible for parsing EIGRP packets and informing DUAL of the new information received. EIGRP asks DUAL to make routing decisions, but the results are stored in the IP routing table. EIGRP is also responsible for redistributing routes learned by other IP routing protocols. This section briefly describes how to configure EIGRP. It includes this information: • Default EIGRP Configuration, page 29-40 • Configuring Basic EIGRP Parameters, page 29-41 • Configuring EIGRP Interfaces, page 29-42 • Configuring EIGRP Route Authentication, page 29-43 • Monitoring and Maintaining EIGRP, page 29-44 Note To enable EIGRP, the stack master must be running the EMI. Default EIGRP Configuration Table 29-8 shows the default EIGRP configuration. Table 29-8 Default EIGRP Configuration Feature Default Setting Auto summary Enabled. Subprefixes are summarized to the classful network boundary when crossing classful network boundaries. Default-information Exterior routes are accepted and default information is passed between IGRP or EIGRP processes when doing redistribution. Default metric Only connected routes and interface static routes can be redistributed without a default metric. The metric includes: • Bandwidth: 0 or greater kbps. • Delay (tens of microseconds): 0 or any positive number that is a multiple of 39.1 nanoseconds. • Reliability: any number between 0 and 255 (255 means 100 percent reliability). • Loading: effective bandwidth as a number between 0 and 255 (255 is 100 percent loading). • MTU: maximum transmission unit size of the route in bytes. 0 or any positive integer.29-41 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP To create an EIGRP routing process, you must enable EIGRP and associate networks. EIGRP sends updates to the interfaces in the specified networks. If you do not specify an interface network, it is not advertised in any EIGRP update. Note If you have routers on your network that are configured for IGRP, and you want to change to EIGRP, you must designate transition routers that have both IGRP and EIGRP configured. In these cases, perform Steps 1 through 3 in the next section and also see the “Configuring IGRP” section on page 29-25. You must use the same AS number for routes to be automatically redistributed. Configuring Basic EIGRP Parameters Beginning in privileged EXEC mode, follow these steps to configure EIGRP. Configuring the routing process is required; other steps are optional: Distance Internal distance: 90. External distance: 170. EIGRP log-neighbor changes Disabled. No adjacency changes logged. IP authentication key-chain No authentication provided. IP authentication mode No authentication provided. IP bandwidth-percent 50 percent. IP hello interval For low-speed nonbroadcast multiaccess (NBMA) networks: 60 seconds; all other networks: 5 seconds. IP hold-time For low-speed NBMA networks: 180 seconds; all other networks: 15 seconds. IP split-horizon Enabled. IP summary address No summary aggregate addresses are predefined. Metric weights tos: 0; k1 and k3: 1; k2, k4, and k5: 0 Network None specified. Offset-list Disabled. Router EIGRP Disabled. Set metric No metric set in the route map. Traffic-share Distributed proportionately to the ratios of the metrics. Variance 1 (equal-cost load balancing). Table 29-8 Default EIGRP Configuration (continued) Feature Default Setting Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router eigrp autonomous-system Enable an EIGRP routing process, and enter router configuration mode. The AS number identifies the routes to other EIGRP routers and is used to tag routing information.29-42 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the feature or return the setting to the default value. Configuring EIGRP Interfaces Other optional EIGRP parameters can be configured on an interface basis. Beginning in privileged EXEC mode, follow these steps to configure EIGRP interfaces: Step 3 network network-number Associate networks with an EIGRP routing process. EIGRP sends updates to the interfaces in the specified networks. If an interface’s network is not specified, it is not advertised in any IGRP or EIGRP update. Step 4 eigrp log-neighbor-changes (Optional) Enable logging of EIGRP neighbor changes to monitor routing system stability. Step 5 metric weights tos k1 k2 k3 k4 k5 (Optional) Adjust the EIGRP metric. Although the defaults have been carefully determined to provide excellent operation in most networks, you can adjust them. Caution Determining metrics is complex and is not recommended without guidance from an experienced network designer. Step 6 offset list [access-list number | name] {in | out} offset [type number] (Optional) Apply an offset list to routing metrics to increase incoming and outgoing metrics to routes learned through EIGRP. You can limit the offset list with an access list or an interface. Step 7 no auto-summary (Optional) Disable automatic summarization of subnet routes into network-level routes. Step 8 ip summary-address eigrp autonomous-system-number address mask (Optional) Configure a summary aggregate. Step 9 end Return to privileged EXEC mode. Step 10 show ip protocols Verify your entries. Step 11 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip bandwidth-percent eigrp percent (Optional) Configure the percentage of bandwidth that can be used by EIGRP on an interface. The default is 50 percent. Step 4 ip summary-address eigrp autonomous-system-number address mask (Optional) Configure a summary aggregate address for a specified interface (not usually necessary if auto-summary is enabled).29-43 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the feature or return the setting to the default value. Configuring EIGRP Route Authentication EIGRP route authentication provides MD5 authentication of routing updates from the EIGRP routing protocol to prevent the introduction of unauthorized or false routing messages from unapproved sources. Beginning in privileged EXEC mode, follow these steps to enable authentication: Step 5 ip hello-interval eigrp autonomous-system-number seconds (Optional) Change the hello time interval for an EIGRP routing process. The range is 1 to 65535 seconds. The default is 60 seconds for low-speed NBMA networks and 5 seconds for all other networks. Step 6 ip hold-time eigrp autonomous-system-number seconds (Optional) Change the hold time interval for an EIGRP routing process. The range is 1 to 65535 seconds. The default is 180 seconds for low-speed NBMA networks and 15 seconds for all other networks. Caution Do not adjust the hold time without consulting Cisco technical support. Step 7 no ip split-horizon eigrp autonomous-system-number (Optional) Disable split horizon to allow route information to be advertised by a router out any interface from which that information originated. Step 8 end Return to privileged EXEC mode. Step 9 show ip eigrp interface Display which interfaces EIGRP is active on and information about EIGRP relating to those interfaces. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip authentication mode eigrp autonomous-system md5 Enable MD5 authentication in IP EIGRP packets. Step 4 ip authentication key-chain eigrp autonomous-system key-chain Enable authentication of IP EIGRP packets. Step 5 exit Return to global configuration mode. Step 6 key chain name-of-chain Identify a key chain and enter key-chain configuration mode. Match the name configured in Step 4. Step 7 key number In key-chain configuration mode, identify the key number. Step 8 key-string text In key-chain key configuration mode, identify the key string.29-44 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the feature or to return the setting to the default value. Monitoring and Maintaining EIGRP You can delete neighbors from the neighbor table. You can also display various EIGRP routing statistics. Table 29-9 lists the privileged EXEC commands for deleting neighbors and displaying statistics. For explanations of fields in the resulting display, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. Step 9 accept-lifetime start-time {infinite | end-time | duration seconds} (Optional) Specify the time period during which the key can be received. The start-time and end-time syntax can be either hh:mm:ss Month date year or hh:mm:ss date Month year. The default is forever with the default start-time and the earliest acceptable date as January 1, 1993. The default end-time and duration is infinite. Step 10 send-lifetime start-time {infinite | end-time | duration seconds} (Optional) Specify the time period during which the key can be sent. The start-time and end-time syntax can be either hh:mm:ss Month date year or hh:mm:ss date Month year. The default is forever with the default start-time and the earliest acceptable date as January 1, 1993. The default end-time and duration is infinite. Step 11 end Return to privileged EXEC mode. Step 12 show key chain Display authentication key information. Step 13 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Table 29-9 IP EIGRP Clear and Show Commands Command Purpose clear ip eigrp neighbors [if-address | interface] Delete neighbors from the neighbor table. show ip eigrp interface [interface] [as number] Display information about interfaces configured for EIGRP. show ip eigrp neighbors [type-number] Display EIGRP discovered neighbors. show ip eigrp topology [autonomous-system-number] | [[ip-address] mask]] Display the EIGRP topology table for a given process. show ip eigrp traffic [autonomous-system-number] Display the number of packets sent and received for all or a specified EIGRP process.29-45 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Configuring BGP The Border Gateway Protocol (BGP) is an exterior gateway protocol used to set up an interdomain routing system that guarantees the loop-free exchange of routing information between autonomous systems. Autonomous systems are made up of routers that operate under the same administration and that run Interior Gateway Protocols (IGPs), such as RIP or OSPF, within their boundaries and that interconnect by using an Exterior Gateway Protocol (EGP). BGP version 4 is the standard EGP for interdomain routing in the Internet. The protocol is defined in RFCs 1163, 1267, and 1771. You can find detailed information about BGP in Internet Routing Architectures, published by Cisco Press, and in the “Configuring BGP” chapter in the Cisco IOS IP and IP Routing Configuration Guide. Note For details about BGP commands and keywords, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. For a list of BGP commands that are visible but not supported by the switch, see Appendix C, “Unsupported Commands in Cisco IOS Release 12.1(14)EA1.” Routers that belong to the same autonomous system (AS) and that exchange BGP updates run internal BGP (IBGP), and routers that belong to different autonomous systems and that exchange BGP updates run external BGP (EBGP). Most configuration commands are the same for configuring EBGP and IBGP. The difference is that the routing updates are exchanged either between autonomous systems (EBGP) or within an AS (IBGP). Figure 29-5 shows a network that is running both EBGP and IBGP. Figure 29-5 EBGP, IBGP, and Multiple Autonomous Systems Before exchanging information with an external AS, BGP ensures that networks within the AS can be reached by defining internal BGP peering among routers within the AS and by redistributing BGP routing information to IGPs that run within the AS, such as IGRP and OSPF. Routers that run a BGP routing process are often referred to as BGP speakers. BGP uses the Transmission Control Protocol (TCP) as its transport protocol (specifically port 179). Two BGP speakers that have a TCP connection to each other for exchanging routing information are known as peers or neighbors. In Figure 29-5, Routers A and B are BGP peers, as are Routers B and C and Routers C and D. The routing information is a series of AS numbers that describe the full path to the destination network. BGP uses this information to construct a loop-free map of autonomous systems. AS 100 74775 AS 200 129.213.1.2 175.220.212.1 129.213.1.1 192.208.10.2 AS 300 EBGP EBGP 192.208.10.1 175.220.1.2 IBGP Router B Router A Router D Router C29-46 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP The network has these characteristics: • Routers A and B are running EBGP, and Routers B and C are running IBGP. Note that the EBGP peers are directly connected and that the IBGP peers are not. As long as there is an IGP running that allows the two neighbors to reach one another, IBGP peers do not have to be directly connected. • All BGP speakers within an AS must establish a peer relationship with each other. That is, the BGP speakers within an AS must be fully meshed logically. BGP4 provides two techniques that reduce the requirement for a logical full mesh: confederations and route reflectors. • AS 200 is a transit AS for AS 100 and AS 300—that is, AS 200 is used to transfer packets between AS 100 and AS 300. BGP peers initially exchange their full BGP routing tables and then send only incremental updates. BGP peers also exchange keepalive messages (to ensure that the connection is up) and notification messages (in response to errors or special conditions). In BGP, each route consists of a network number, a list of autonomous systems that information has passed through (the autonomous system path), and a list of other path attributes. The primary function of a BGP system is to exchange network reachability information, including information about the list of AS paths, with other BGP systems. This information can be used to determine AS connectivity, to prune routing loops, and to enforce AS-level policy decisions. A router or switch running Cisco IOS does not select or use an IBGP route unless it has a route available to the next-hop router and it has received synchronization from an IGP (unless IGP synchronization is disabled). When multiple routes are available, BGP bases its path selection on attribute values. See the “Configuring BGP Decision Attributes” section on page 29-52 for information about BGP attributes. BGP Version 4 supports classless interdomain routing (CIDR) so you can reduce the size of your routing tables by creating aggregate routes, resulting in supernets. CIDR eliminates the concept of network classes within BGP and supports the advertising of IP prefixes. These sections briefly describe how to configure BGP and supported BGP features: • Default BGP Configuration, page 29-47 • Enabling BGP Routing, page 29-49 • Managing Routing Policy Changes, page 29-51 • Configuring BGP Decision Attributes, page 29-52 • Configuring BGP Filtering with Route Maps, page 29-54 • Configuring BGP Filtering by Neighbor, page 29-55 • Configuring Prefix Lists for BGP Filtering, page 29-56 • Configuring BGP Community Filtering, page 29-57 • Configuring BGP Neighbors and Peer Groups, page 29-59 • Configuring Aggregate Addresses, page 29-61 • Configuring Routing Domain Confederations, page 29-61 • Configuring BGP Route Reflectors, page 29-62 • Configuring Route Dampening, page 29-63 • Monitoring and Maintaining BGP, page 29-64 For detailed descriptions of BGP configuration, refer to the “Configuring BGP” chapter in the Cisco IOS IP and IP Routing Configuration Guide. For details about specific commands, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1.29-47 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP For a list of BGP commands that are visible but not supported by the switch, see Appendix C, “Unsupported Commands in Cisco IOS Release 12.1(14)EA1.” Default BGP Configuration Table 29-10 shows the basic default BGP configuration. For the defaults for all characteristics, refer to the specific commands in the Cisco IOS IP and IP Routing Command Reference for Release 12.1. Table 29-10 Default BGP Configuration Feature Default Setting Aggregate address Disabled: None defined. AS path access list None defined. Auto summary Enabled. Best path • The router considers as-path in choosing a route and does not compare similar routes from external BGP peers. • Compare router ID: Disabled. BGP community list • Number: None defined. When you permit a value for the community number, the list defaults to an implicit deny for everything else that has not been permitted. • Format: Cisco default format (32-bit number). BGP confederation identifier/peers • Identifier: None configured. • Peers: None identified. BGP Fast external fallover Enabled. BGP local preference 100. The range is 0 to 4294967295 with the higher value preferred. BGP network None specified; no backdoor route advertised. BGP route dampening Disabled by default. When enabled: • Half-life is 15 minutes. • Re-use is 750 (10-second increments). • Suppress is 2000 (10-second increments). • Max-suppress-time is 4 times half-life; 60 minutes. BGP router ID The IP address of a loopback interface if one is configured or the highest IP address configured for a physical interface on the router. Default information originate (protocol or network redistribution) Disabled. Default metric Built-in, automatic metric translations. Distance • External route administrative distance: 20 (acceptable values are from 1 to 255). • Internal route administrative distance: 200 (acceptable values are from 1 to 255). • Local route administrative distance: 200 (acceptable values are from 1 to 255). Distribute list • In (filter networks received in updates): Disabled. • Out (suppress networks from being advertised in updates): Disabled. Internal route redistribution Disabled.29-48 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP IP prefix list None defined. Multi exit discriminator (MED) • Always compare: Disabled. Does not compare MEDs for paths from neighbors in different autonomous systems. • Best path compare: Disabled. • MED missing as worst path: Disabled. • Deterministic MED comparison is disabled. Neighbor • Advertisement interval: 30 seconds for external peers; 5 seconds for internal peers. • Change logging: Enabled. • Conditional advertisement: Disabled. • Default originate: No default route is sent to the neighbor. • Description: None. • Distribute list: None defined. • External BGP multihop: Only directly connected neighbors are allowed. • Filter list: None used. • Maximum number of prefixes received: No limit. • Next hop (router as next hop for BGP neighbor): Disabled. • Password: Disabled. Neighbor • Peer group: None defined; no members assigned. • Prefix list: None specified. • Remote AS (add entry to neighbor BGP table): No peers defined. • Private AS number removal: Disabled. • Route maps: None applied to a peer. • Send community attributes: None sent to neighbors. • Shutdown or soft reconfiguration: Not enabled. • Timers: keepalive: 60 seconds; holdtime: 180 seconds. • Update source: Best local address. • Version: BGP version 4. • Weight: Routes learned through BGP peer: 0; routes sourced by the local router: 32768. Route reflector None configured. Synchronization (BGP and IGP) Enabled. Table map update Disabled. Timers Keepalive: 60 seconds; holdtime: 180 seconds. Table 29-10 Default BGP Configuration (continued) Feature Default Setting29-49 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Enabling BGP Routing To enable BGP routing, you establish a BGP routing process and define the local network. Because BGP must completely recognize the relationships with its neighbors, you must also specify a BGP neighbor. BGP supports two kinds of neighbors: internal and external. Internal neighbors are in the same AS; external neighbors are in different autonomous systems. External neighbors are usually adjacent to each other and share a subnet, but internal neighbors can be anywhere in the same AS. The switch supports the use of private AS numbers, usually assigned by service providers and given to systems whose routes are not advertised to external neighbors. The private AS numbers are from 64512 to 65535. You can configure external neighbors to remove private AS numbers from the AS path by using the neighbor remove-private-as router configuration command. Then when an update is passed to an external neighbor, if the AS path includes private AS numbers, these numbers are dropped. If your AS will be passing traffic through it from another AS to a third AS, it is important to be consistent about the routes it advertises. If BGP advertised a route before all routers in the network had learned about the route through the IGP, the AS might receive traffic that some routers could not yet route. To prevent this from happening, BGP must wait until the IGP has propagated information across the AS so that BGP is synchronized with the IGP. Synchronization is enabled by default. If your AS does not pass traffic from one AS to another AS, or if all routers in your autonomous systems are running BGP, you can disable synchronization, which allows your network to carry fewer routes in the IGP and allows BGP to converge more quickly. Note To enable BGP, the stack master must be running the EMI. Beginning in privileged EXEC mode, follow these steps to enable BGP routing, establish a BGP routing process, and specify a neighbor: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip routing Enable IP routing (required only if IP routing is disabled). Step 3 router bgp autonomous-system Enable a BGP routing process, assign it an AS number, and enter router configuration mode. The AS number can be from 1 to 65535, with 64512 to 65535 designated as private autonomous numbers. Step 4 network network-number [mask network-mask] [route-map route-map-name] Configure a network as local to this AS, and enter it in the BGP table. Step 5 neighbor {ip-address | peer-group-name} remote-as number Add an entry to the BGP neighbor table specifying that the neighbor identified by the IP address belongs to the specified AS. For EBGP, neighbors are usually directly connected, and the IP address is the address of the interface at the other end of the connection. For IBGP, the IP address can be the address of any of the router interfaces. Step 6 neighbor {ip-address | peer-group-name} remove-private-as (Optional) Remove private AS numbers from the AS-path in outbound routing updates. Step 7 no synchronization (Optional) Disable synchronization between BGP and an IGP.29-50 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Use the no router bgp autonomous-system global configuration command to remove a BGP AS. Use the no network network-number router configuration command to remove the network from the BGP table. Use the no neighbor {ip-address | peer-group-name} remote-as number router configuration command to remove a neighbor. Use the no neighbor {ip-address | peer-group-name} remove-private-as router configuration command to include private AS numbers in updates to a neighbor. Use the synchronization router configuration command to re-enable synchronization. These examples show how to configure BGP on the routers in Figure 29-5. Router A: Switch(config)# router bgp 100 Switch(config-router)# neighbor 129.213.1.1 remote-as 200 Router B: Switch(config)# router bgp 200 Switch(config-router)# neighbor 129.213.1.2 remote-as 100 Switch(config-router)# neighbor 175.220.1.2 remote-as 200 Router C: Switch(config)# router bgp 200 Switch(config-router)# neighbor 175.220.212.1 remote-as 200 Switch(config-router)# neighbor 192.208.10.1 remote-as 300 Router D: Switch(config)# router bgp 300 Switch(config-router)# neighbor 192.208.10.2 remote-as 200 To verify that BGP peers are running, use the show ip bgp neighbors privileged EXEC command. This is the output of this command on Router A: Switch# show ip bgp neighbors BGP neighbor is 129.213.1.1, remote AS 200, external link BGP version 4, remote router ID 175.220.212.1 BGP state = established, table version = 3, up for 0:10:59 Last read 0:00:29, hold time is 180, keepalive interval is 60 seconds Minimum time between advertisement runs is 30 seconds Received 2828 messages, 0 notifications, 0 in queue Sent 2826 messages, 0 notifications, 0 in queue Connections established 11; dropped 10 Step 8 no auto-summary (Optional) Disable automatic network summarization. By default, when a subnet is redistributed from an IGP into BGP, only the network route is inserted into the BGP table. Step 9 bgp fast-external-fallover (Optional) Automatically reset a BGP session when a link between external neighbors goes down. By default, the session is not immediately reset. Step 10 end Return to privileged EXEC mode. Step 11 show ip bgp network network-number show ip bgp neighbor Verify the configuration. Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-51 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Anything other than state = established means that the peers are not running. The remote router ID is the highest IP address on that router (or the highest loopback interface). Each time the table is updated with new information, the table version number increments. A table version number that continually increments means that a route is flapping, causing continual routing updates. For exterior protocols, a reference to an IP network from the network router configuration command controls only which networks are advertised. This is in contrast to Interior Gateway Protocols (IGPs), such as IGRP, which also use the network command to determine where to send updates. For detailed descriptions of BGP configuration, refer to the “Configuring BGP” chapter in the Cisco IOS IP and IP Routing Configuration Guide. For details about specific commands, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. See Appendix C, “Unsupported Commands in Cisco IOS Release 12.1(14)EA1,” for a list of BGP commands that are visible but not supported by the switch. Managing Routing Policy Changes Routing policies for a peer include all the configurations that might affect inbound or outbound routing table updates. When you have defined two routers as BGP neighbors, they form a BGP connection and exchange routing information. If you later change a BGP filter, weight, distance, version, or timer, or make a similar configuration change, you must reset the BGP sessions so that the configuration changes take effect. There are two types of reset, hard reset and soft reset. Cisco IOS software releases 12.1 and later support a soft reset without any prior configuration. To use a soft reset without preconfiguration, both BGP peers must support the soft route refresh capability, which is advertised in the OPEN message sent when the peers establish a TCP session. A soft reset allows the dynamic exchange of route refresh requests and routing information between BGP routers and the subsequent re-advertisement of the respective outbound routing table. • When soft reset generates inbound updates from a neighbor, it is called dynamic inbound soft reset. • When soft reset sends a set of updates to a neighbor, it is called outbound soft reset. A soft inbound reset causes the new inbound policy to take effect. A soft outbound reset causes the new local outbound policy to take effect without resetting the BGP session. As a new set of updates is sent during outbound policy reset, a new inbound policy can also take effect. Table 29-11 lists the advantages and disadvantages hard reset and soft reset. Table 29-11 Advantages and Disadvantages of Hard and Soft Resets Type of Reset Advantages Disadvantages Hard reset No memory overhead The prefixes in the BGP, IP, and FIB tables provided by the neighbor are lost. Not recommended. Outbound soft reset No configuration, no storing of routing table updates Does not reset inbound routing table updates. Dynamic inbound soft reset Does not clear the BGP session and cache Does not require storing of routing table updates and has no memory overhead Both BGP routers must support the route refresh capability (in Cisco IOS Release 12.1 and later).29-52 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Beginning in privileged EXEC mode, follow these steps to determine if a BGP peer supports the route refresh capability and to reset the BGP session: Configuring BGP Decision Attributes When a BGP speaker receives updates from multiple autonomous systems that describe different paths to the same destination, it must choose the single best path for reaching that destination. When chosen, the selected path is entered into the BGP routing table and propagated to its neighbors. The decision is based on the value of attributes that the update contains and other BGP-configurable factors. When a BGP peer learns two EBGP paths for a prefix from a neighboring AS, it chooses the best path and inserts that path in the IP routing table. If BGP multipath support is enabled and the EBGP paths are learned from the same neighboring autonomous systems, instead of a single best path, multiple paths are installed in the IP routing table. Then, during packet switching, per-packet or per-destination load balancing is performed among the multiple paths. The maximum-paths router configuration command controls the number of paths allowed. These factors summarize the order in which BGP evaluates the attributes for choosing the best path: 1. If the path specifies a next hop that is inaccessible, drop the update. The BGP next-hop attribute, automatically determined by the software, is the IP address of the next hop that is going to be used to reach a destination. For EBGP, this is usually the IP address of the neighbor specified by the neighbor remote-as router configuration command. You can disable next-hop processing by using route maps or the neighbor next-hop-self router configuration command. 2. Prefer the path with the largest weight (a Cisco proprietary parameter). The weight attribute is local to the router and not propagated in routing updates. By default, the weight attribute is 32768 for paths that the router originates and zero for other paths. Routes with the largest weight are preferred. You can use access lists, route maps, or the neighbor weight router configuration command to set weights. Command Purpose Step 1 show ip bgp neighbors Display whether a neighbor supports the route refresh capability. When supported, this message appears for the router: Received route refresh capability from peer. Step 2 clear ip bgp {* | address | peer-group-name} Reset the routing table on the specified connection. • Enter an asterisk (*) to specify that all connections be reset. • Enter an IP address to specify the connection to be reset. • Enter a peer group name to reset the peer group. Step 3 clear ip bgp {* | address | peer-group-name} soft out (Optional) Perform an outbound soft reset to reset the inbound routing table on the specified connection. Use this command if route refresh is supported. • Enter an asterisk (*) to specify that all connections be reset. • Enter an IP address to specify the connection to be reset. • Enter a peer group name to reset the peer group. Step 4 show ip bgp show ip bgp neighbors Verify the reset by checking information about the routing table and about BGP neighbors. 29-53 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP 3. Prefer the route with the highest local preference. Local preference is part of the routing update and exchanged among routers in the same AS. The default value of the local preference attribute is 100. You can set local preference by using the bgp default local-preference router configuration command or by using a route map. 4. Prefer the route that was originated by BGP running on the local router. 5. Prefer the route with the shortest AS path. 6. Prefer the route with the lowest origin type. An interior route or IGP is lower than a route learned by EGP, and an EGP-learned route is lower than one of unknown origin or learned in another way. 7. Prefer the route with the lowest multi -exit discriminator (MED) metric attribute if the neighboring AS is the same for all routes considered. You can configure the MED by using route maps or by using the default-metric router configuration command. When an update is sent to an IBGP peer, the MED is included. 8. Prefer the external (EBGP) path over the internal (IBGP) path. 9. Prefer the route that can be reached through the closest IGP neighbor (the lowest IGP metric). This means that the router will prefer the shortest internal path within the AS to reach the destination (the shortest path to the BGP next-hop). 10. If the following conditions are all true, insert the route for this path into the IP routing table: – Both the best route and this route are external. – Both the best route and this route are from the same neighboring autonomous system. – maximum-paths is enabled. 11. If multipath is not enabled, prefer the route with the lowest IP address value for the BGP router ID. The router ID is usually the highest IP address on the router or the loopback (virtual) address, but might be implementation-specific. Beginning in privileged EXEC mode, follow these steps to configure some decision attributes: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enable a BGP routing process, assign it an AS number, and enter router configuration mode. Step 3 bgp best-path as-path ignore (Optional) Configure the router to ignore AS path length in selecting a route. Step 4 neighbor {ip-address | peer-group-name} next-hop-self (Optional) Disable next-hop processing on BGP updates to a neighbor by entering a specific IP address to be used instead of the next-hop address. Step 5 neighbor {ip-address | peer-group-name} weight weight (Optional) Assign a weight to a neighbor connection. Acceptable values are from 0 to 65535; the largest weight is the preferred route. Routes learned through another BGP peer have a default weight of 0; routes sourced by the local router have a default weight of 32768. Step 6 default-metric number (Optional) Set a MED metric to set preferred paths to external neighbors. All routes without a MED will also be set to this value. The range is 1 to 4294967295. The lowest value is the most desirable.29-54 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Use the no form of each command to return to the default state. Configuring BGP Filtering with Route Maps Within BGP, route maps can be used to control and to modify routing information and to define the conditions by which routes are redistributed between routing domains. See the “Using Route Maps to Redistribute Routing Information” section on page 29-70 for more information about route maps. Each route map has a name that identifies the route map (map tag) and an optional sequence number. Beginning in privileged EXEC mode, follow these steps to use a route map to disable next-hop processing: Step 7 bgp bestpath med missing-as-worst (Optional) Configure the switch to consider a missing MED as having a value of infinity, making the path without a MED value the least desirable path. Step 8 bgp always-compare med (Optional) Configure the switch to compare MEDs for paths from neighbors in different autonomous systems. By default, MED comparison is only done among paths in the same AS. Step 9 bgp bestpath med confed (Optional) Configure the switch to consider the MED in choosing a path from among those advertised by different subautonomous systems within a confederation. Step 10 bgp deterministic med (Optional) Configure the switch to consider the MED variable when choosing among routes advertised by different peers in the same AS. Step 11 bgp default local-preference value (Optional) Change the default local preference value. The range is 0 to 4294967295; the default value is 100. The highest local preference value is preferred. Step 12 maximum-paths number (Optional) Configure the number of paths to be added to the IP routing table. The default is to only enter the best path in the routing table. The range is from 1 to 8. Having multiple paths allows load balancing among the paths. Step 13 end Return to privileged EXEC mode. Step 14 show ip bgp show ip bgp neighbors Verify the reset by checking information about the routing table and about BGP neighbors. Step 15 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 route-map map-tag [[permit | deny] | sequence-number]] Create a route map, and enter route-map configuration mode.29-55 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Use the no route-map map-tag command to delete the route map. Use the no set ip next-hop ip-address command to re-enable next-hop processing. Configuring BGP Filtering by Neighbor You can filter BGP advertisements by using AS-path filters, such as the as-path access-list global configuration command and the neighbor filter-list router configuration command. You can also use access lists with the neighbor distribute-list router configuration command. Distribute-list filters are applied to network numbers. See the “Controlling Advertising and Processing in Routing Updates” section on page 29-78 for information about the distribute-list command. You can use route maps on a per-neighbor basis to filter updates and to modify various attributes. A route map can be applied to either inbound or outbound updates. Only the routes that pass the route map are sent or accepted in updates. On both inbound and outbound updates, matching is supported based on AS path, community, and network numbers. Autonomous system path matching requires the match as-path access-list route-map command, community based matching requires the match community-list route-map command, and network-based matching requires the ip access-list global configuration command. Beginning in privileged EXEC mode, follow these steps to apply a per-neighbor route map: Step 3 set ip next-hop ip-address [...ip-address] [peer-address] (Optional) Set a route map to disable next-hop processing • In an inbound route map, set the next hop of matching routes to be the neighbor peering address, overriding third-party next hops. • In an outbound route map of a BGP peer, set the next hop to the peering address of the local router, disabling the next-hop calculation. Step 4 end Return to privileged EXEC mode. Step 5 show route-map [map-name] Display all route maps configured or only the one specified to verify configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enable a BGP routing process, assign it an AS number, and enter router configuration mode. Step 3 neighbor {ip-address | peer-group name} distribute-list {access-list-number | name} {in | out} (Optional) Filter BGP routing updates to or from neighbors as specified in an access list. Note You can also use the neighbor prefix-list router configuration command to filter updates, but you cannot use both commands to configure the same BGP peer. Step 4 neighbor {ip-address | peer-group name} route-map map-tag {in | out} (Optional) Apply a route map to filter an incoming or outgoing route. Step 5 end Return to privileged EXEC mode.29-56 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Use the no neighbor distribute-list command to remove the access list from the neighbor. Use the no neighbor route-map map-tag router configuration command to remove the route map from the neighbor. Another method of filtering is to specify an access list filter on both incoming and outbound updates, based on the BGP autonomous system paths. Each filter is an access list based on regular expressions. (Refer to the “Regular Expressions” appendix in the Cisco IOS Dial Services Command Reference for more information on forming regular expressions.) To use this method, define an autonomous system path access list, and apply it to updates to and from particular neighbors. Beginning in privileged EXEC mode, follow these steps to configure BGP path filtering: Configuring Prefix Lists for BGP Filtering You can use prefix lists as an alternative to access lists in many BGP route filtering commands, including the neighbor distribute-list router configuration command. The advantages of using prefix lists include performance improvements in loading and lookup of large lists, incremental update support, easier CLI configuration, and greater flexibility. Filtering by a prefix list involves matching the prefixes of routes with those listed in the prefix list, as when matching access lists. When there is a match, the route is used. Whether a prefix is permitted or denied is based upon these rules: • An empty prefix list permits all prefixes. • An implicit deny is assumed if a given prefix does not match any entries in a prefix list. • When multiple entries of a prefix list match a given prefix, the sequence number of a prefix list entry identifies the entry with the lowest sequence number. By default, sequence numbers are generated automatically and incremented in units of five. If you disable the automatic generation of sequence numbers, you must specify the sequence number for each entry. You can specify sequence values in any increment. If you specify increments of one, you cannot insert additional entries into the list; if you choose very large increments, you might run out of values. Step 6 show ip bgp neighbors Verify the configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip as-path access-list access-list-number {permit | deny} as-regular-expressions Define a BGP-related access list. Step 3 router bgp autonomous-system Enter BGP router configuration mode. Step 4 neighbor {ip-address | peer-group name} filter-list {access-list-number | name} {in | out | weight weight} Establish a BGP filter based on an access list. Step 5 end Return to privileged EXEC mode. Step 6 show ip bgp neighbors [paths regular-expression] Verify the configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.29-57 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP You do not need to specify a sequence number when removing a configuration entry. Show commands include the sequence numbers in their output. Before using a prefix list in a command, you must set up the prefix list. Beginning in privileged EXEC mode, follow these steps to create a prefix list or to add an entry to a prefix list: To delete a prefix list and all of its entries, use the no ip prefix-list list-name global configuration command. To delete an entry from a prefix list, use the no ip prefix-list seq seq-value global configuration command. To disable automatic generation of sequence numbers, use the no ip prefix-list sequence number command; to reenable automatic generation, use the ip prefix-list sequence number command. To clear the hit-count table of prefix list entries, use the clear ip prefix-list privileged EXEC command. Configuring BGP Community Filtering One way that BGP controls the distribution of routing information based on the value of the COMMUNITIES attribute. The attribute is a way to groups destinations into communities and to apply routing decisions based on the communities. This method simplifies configuration of a BGP speaker to control distribution of routing information. A community is a group of destinations that share some common attribute. Each destination can belong to multiple communities. AS administrators can define to which communities a destination belongs. By default, all destinations belong to the general Internet community. The community is identified by the COMMUNITIES attribute, an optional, transitive, global attribute in the numerical range from 1 to 4294967200. These are some predefined, well-known communities: • internet—Advertise this route to the Internet community. All routers belong to it. • no-export—Do not advertise this route to EBGP peers. • no-advertise—Do not advertise this route to any peer (internal or external). • local-as—Do not advertise this route to peers outside the local autonomous system. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip prefix-list list-name [seq seq-value] deny | permit network/len [ge ge-value] [le le-value] Create a prefix list with an optional sequence number to deny or permit access for matching conditions. You must enter at least one permit or deny clause. • network/len is the network number and length (in bits) of the network mask. • (Optional) ge and le values specify the range of the prefix length to be matched.The specified ge-value and le-value must satisfy this condition: len < ge-value < le-value < 32 Step 3 ip prefix-list list-name seq seq-value deny | permit network/len [ge ge-value] [le le-value] (Optional) Add an entry to a prefix list, and assign a sequence number to the entry. Step 4 end Return to privileged EXEC mode. Step 5 show ip prefix list [detail | summary] name [network/len] [seq seq-num] [longer] [first-match] Verify the configuration by displaying information about a prefix list or prefix list entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-58 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Based on the community, you can control which routing information to accept, prefer, or distribute to other neighbors. A BGP speaker can set, append, or modify the community of a route when learning, advertising, or redistributing routes. When routes are aggregated, the resulting aggregate has a COMMUNITIES attribute that contains all communities from all the initial routes. You can use community lists to create groups of communities to use in a match clause of a route map. As with an access list, a series of community lists can be created. Statements are checked until a match is found. As soon as one statement is satisfied, the test is concluded. To set the COMMUNITIES attribute and match clauses based on communities, see the match community-list and set community route-map configuration commands in the “Using Route Maps to Redistribute Routing Information” section on page 29-70. By default, no COMMUNITIES attribute is sent to a neighbor. You can specify that the COMMUNITIES attribute be sent to the neighbor at an IP address by using the neighbor send-community router configuration command. Beginning in privileged EXEC mode, follow these steps to create and to apply a community list: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip community-list community-list-number {permit | deny} community-number Create a community list, and assign it a number. • The community-list-number is an integer from 1 to 99 that identifies one or more permit or deny groups of communities. • The community-number is the number configured by a set community route-map configuration command. Step 3 router bgp autonomous-system Enter BGP router configuration mode. Step 4 neighbor {ip-address | peer-group name} send-community Specify that the COMMUNITIES attribute be sent to the neighbor at this IP address. Step 5 set comm-list list-num delete (Optional) Remove communities from the community attribute of an inbound or outbound update that match a standard or extended community list specified by a route map. Step 6 exit Return to global configuration mode. Step 7 ip bgp-community new-format (Optional) Display and parse BGP communities in the format AA:NN. A BGP community is displayed in a two-part format 2 bytes long. The Cisco default community format is in the format NNAA. In the most recent RFC for BGP, a community takes the form AA:NN, where the first part is the AS number and the second part is a 2-byte number. Step 8 end Return to privileged EXEC mode. Step 9 show ip bgp community Verify the configuration. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file.29-59 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Configuring BGP Neighbors and Peer Groups Often many BGP neighbors are configured with the same update policies (that is, the same outbound route maps, distribute lists, filter lists, update source, and so on). Neighbors with the same update policies can be grouped into peer groups to simplify configuration and to make updating more efficient. When you have configured many peers, we recommend this approach. To configure a BGP peer group, you create the peer group, assign options to the peer group, and add neighbors as peer group members. You configure the peer group by using the neighbor router configuration commands. By default, peer group members inherit all the configuration options of the peer group, including the remote-as (if configured), version, update-source, out-route-map, out-filter-list, out-dist-list, minimum-advertisement-interval, and next-hop-self. All peer group members also inherit changes made to the peer group. Members can also be configured to override the options that do not affect outbound updates. To assign configuration options to an individual neighbor, specify any of these router configuration commands by using the neighbor IP address. To assign the options to a peer group, specify any of the commands by using the peer group name. You can disable a BGP peer or peer group without removing all the configuration information by using the neighbor shutdown router configuration command. Beginning in privileged EXEC mode, use these commands to configure BGP peers: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enter BGP router configuration mode. Step 3 neighbor peer-group-name peer-group Create a BGP peer group. Step 4 neighbor ip-address peer-group peer-group-name Make a BGP neighbor a member of the peer group. Step 5 neighbor {ip-address | peer-group-name} remote-as number Specify a BGP neighbor. If a peer group is not configured with a remote-as number, use this command to create peer groups containing EBGP neighbors. The range is 1 to 65535. Step 6 neighbor {ip-address | peer-group-name} description text (Optional) Associate a description with a neighbor. Step 7 neighbor {ip-address | peer-group-name} default-originate [route-map map-name] (Optional) Allow a BGP speaker (the local router) to send the default route 0.0.0.0 to a neighbor for use as a default route. Step 8 neighbor {ip-address | peer-group-name} send-community (Optional) Specify that the COMMUNITIES attribute be sent to the neighbor at this IP address. Step 9 neighbor {ip-address | peer-group-name} update-source interface (Optional) Allow internal BGP sessions to use any operational interface for TCP connections. Step 10 neighbor {ip-address | peer-group-name} ebgp-multihop (Optional) Allow BGP sessions, even when the neighbor is not on a directly connected segment. The multihop session is not established if the only route to the multihop peer’s address is the default route (0.0.0.0). Step 11 neighbor {ip-address | peer-group-name} local-as number (Optional) Specify an AS number to use as the local AS. The range is 1 to 65535. Step 12 neighbor {ip-address | peer-group-name} advertisement-interval seconds (Optional) Set the minimum interval between sending BGP routing updates. 29-60 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP To disable an existing BGP neighbor or neighbor peer group, use the neighbor shutdown router configuration command. To enable a previously existing neighbor or neighbor peer group that had been disabled, use the no neighbor shutdown router configuration command. Step 13 neighbor {ip-address | peer-group-name} maximum-prefix maximum [threshold] (Optional) Control how many prefixes can be received from a neighbor. The range is 1 to 4294967295. The threshold (optional) is the percentage of maximum at which a warning message is generated. The default is 75 percent. Step 14 neighbor {ip-address | peer-group-name} next-hop-self (Optional) Disable next-hop processing on the BGP updates to a neighbor. Step 15 neighbor {ip-address | peer-group-name} password string (Optional) Set MD5 authentication on a TCP connection to a BGP peer. The same password must be configured on both BGP peers, or the connection between them is not made. Step 16 neighbor {ip-address | peer-group-name} route-map map-name {in | out} (Optional) Apply a route map to incoming or outgoing routes. Step 17 neighbor {ip-address | peer-group-name} send-community (Optional) Specify that the COMMUNITIES attribute be sent to the neighbor at this IP address. Step 18 neighbor {ip-address | peer-group-name} timers keepalive holdtime (Optional) Set timers for the neighbor or peer group. • The keepalive interval is the time within which keepalive messages are sent to peers. The range is 1 to 4294967295 seconds; the default is 60. • The holdtime is the interval after which a peer is declared inactive after not receiving a keepalive message from it. The range is 1 to 4294967295 seconds; the default is 180. Step 19 neighbor {ip-address | peer-group-name} weight weight (Optional) Specify a weight for all routes from a neighbor. Step 20 neighbor {ip-address | peer-group-name} distribute-list {access-list-number | name} {in | out} (Optional) Filter BGP routing updates to or from neighbors, as specified in an access list. Step 21 neighbor {ip-address | peer-group-name} filter-list access-list-number {in | out | weight weight} (Optional) Establish a BGP filter. Step 22 neighbor {ip-address | peer-group-name} version value (Optional) Specify the BGP version to use when communicating with a neighbor. Step 23 neighbor {ip-address | peer-group-name} soft-reconfiguration inbound (Optional) Configure the software to start storing received updates. Step 24 end Return to privileged EXEC mode. Step 25 show ip bgp neighbors Verify the configuration. Step 26 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-61 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Configuring Aggregate Addresses Classless interdomain routing (CIDR) enables you to create aggregate routes (or supernets) to minimize the size of routing tables. You can configure aggregate routes in BGP either by redistributing an aggregate route into BGP or by creating an aggregate entry in the BGP routing table. An aggregate address is added to the BGP table when there is at least one more specific entry in the BGP table. Beginning in privileged EXEC mode, use these commands to create an aggregate address in the routing table: To delete an aggregate entry, use the no aggregate-address address mask router configuration command. To return options to the default values, use the command with keywords. Configuring Routing Domain Confederations One way to reduce the IBGP mesh is to divide an autonomous system into multiple subautonomous systems and to group them into a single confederation that appears as a single autonomous system. Each autonomous system is fully meshed within itself and has a few connections to other autonomous systems in the same confederation. Even though the peers in different autonomous systems have EBGP sessions, they exchange routing information as if they were IBGP peers. Specifically, the next hop, MED, and local preference information is preserved. You can then use a single IGP for all of the autonomous systems. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enter BGP router configuration mode. Step 3 aggregate-address address mask Create an aggregate entry in the BGP routing table. The aggregate route is advertised as coming from the AS, and the atomic aggregate attribute is set to indicate that information might be missing. Step 4 aggregate-address address mask as-set (Optional) Generate AS set path information. This command creates an aggregate entry following the same rules as the previous command, but the advertised path will be an AS_SET consisting of all elements contained in all paths. Do not use this keyword when aggregating many paths because this route must be continually withdrawn and updated. Step 5 aggregate-address address-mask summary-only (Optional) Advertise summary addresses only. Step 6 aggregate-address address mask suppress-map map-name (Optional) Suppress selected, more specific routes. Step 7 aggregate-address address mask advertise-map map-name (Optional) Generate an aggregate based on conditions specified by the route map. Step 8 aggregate-address address mask attribute-map map-name (Optional) Generate an aggregate with attributes specified in the route map. Step 9 end Return to privileged EXEC mode. Step 10 show ip bgp neighbors [advertised-routes] Verify the configuration. Step 11 copy running-config startup-config (Optional) Save your entries in the configuration file.29-62 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP To configure a BGP confederation, you must specify a confederation identifier that acts as the autonomous system number for the group of autonomous systems. Beginning in privileged EXEC mode, use these commands to configure a BGP confederation: Configuring BGP Route Reflectors BGP requires that all of the IBGP speakers be fully meshed. When a router receives a route from an external neighbor, it must advertise it to all internal neighbors. To prevent a routing information loop, all IBPG speakers must be connected. The internal neighbors do not send routes learned from internal neighbors to other internal neighbors. With route reflectors, all IBGP speakers need not be fully meshed because another method is used to pass learned routes to neighbors. When you configure an internal BGP peer to be a route reflector, it is responsible for passing IBGP learned routes to a set of IBGP neighbors. The internal peers of the route reflector are divided into two groups: client peers and nonclient peers (all the other routers in the autonomous system). A route reflector reflects routes between these two groups. The route reflector and its client peers form a cluster. The nonclient peers must be fully meshed with each other, but the client peers need not be fully meshed. The clients in the cluster do not communicate with IBGP speakers outside their cluster. When the route reflector receives an advertised route, it takes one of these actions, depending on the neighbor: • A route from an external BGP speaker is advertised to all clients and nonclient peers. • A route from a nonclient peer is advertised to all clients. • A route from a client is advertised to all clients and nonclient peers. Hence, the clients need not be fully meshed. Usually a cluster of clients have a single route reflector, and the cluster is identified by the route reflector router ID. To increase redundancy and to avoid a single point of failure, a cluster might have more than one route reflector. In this case, all route reflectors in the cluster must be configured with the same 4-byte cluster ID so that a route reflector can recognize updates from route reflectors in the same cluster. All the route reflectors serving a cluster should be fully meshed and should have identical sets of client and nonclient peers. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enter BGP router configuration mode. Step 3 bgp confederation identifier autonomous-system Configure a BGP confederation identifier. Step 4 bgp confederation peers autonomous-system [autonomous-system ...] Specify the autonomous systems that belong to the confederation and that will be treated as special EBGP peers. Step 5 end Return to privileged EXEC mode. Step 6 show ip bgp neighbor show ip bgp network Verify the configuration. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.29-63 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP Beginning in privileged EXEC mode, use these commands to configure a route reflector and clients: Configuring Route Dampening Route flap dampening is a BGP feature designed to minimize the propagation of flapping routes across an internetwork. A route is considered to be flapping when it is repeatedly available, then unavailable, then available, then unavailable, and so on. When route dampening is enabled, a numeric penalty value is assigned to a route when it flaps. When a route’s accumulated penalties reach a configurable limit, BGP suppresses advertisements of the route, even if the route is running. The reuse limit is a configurable value that is compared with the penalty. If the penalty is less than the reuse limit, a suppressed route that is up is advertised again. Dampening is not applied to routes that are learned by IBGP. This policy prevents the IBGP peers from having a higher penalty for routes external to the AS. Beginning in privileged EXEC mode, use these commands to configure BGP route dampening: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enter BGP router configuration mode. Step 3 neighbor ip-address | peer-group-name route-reflector-client Configure the local router as a BGP route reflector and the specified neighbor as a client. Step 4 bgp cluster-id cluster-id (Optional) Configure the cluster ID if the cluster has more than one route reflector. Step 5 no bgp client-to-client reflection (Optional) Disable client-to-client route reflection. By default, the routes from a route reflector client are reflected to other clients. However, if the clients are fully meshed, the route reflector does not need to reflect routes to clients. Step 6 end Return to privileged EXEC mode. Step 7 show ip bgp Verify the configuration. Display the originator ID and the cluster-list attributes. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router bgp autonomous-system Enter BGP router configuration mode. Step 3 bgp dampening Enable BGP route dampening. Step 4 bgp dampening half-life reuse suppress max-suppress [route-map map] (Optional) Change the default values of route dampening factors. Step 5 end Return to privileged EXEC mode. Step 6 show ip bgp flap-statistics [{regexp regexp} | {filter-list list} | {address mask [longer-prefix]}] (Optional) Monitor the flaps of all paths that are flapping. The statistics are deleted when the route is not suppressed and is stable. Step 7 show ip bgp dampened-paths (Optional) Display the dampened routes, including the time remaining before they are suppressed.29-64 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP To disable flap dampening, use the no bgp dampening router configuration command without keywords. To set dampening factors back to the default values, use the no bgp dampening router configuration command with values. Monitoring and Maintaining BGP You can remove all contents of a particular cache, table, or database. This might be necessary when the contents of the particular structure have become or are suspected to be invalid. You can display specific statistics, such as the contents of BGP routing tables, caches, and databases. You can use the information to determine resource utilization and solve network problems. You can also display information about node reachability and discover the routing path your device’s packets are taking through the network. Table 29-9 lists the privileged EXEC commands for clearing and displaying BGP. For explanations of the display fields, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. Step 8 clear ip bgp flap-statistics [{regexp regexp} | {filter-list list} | {address mask [longer-prefix]} (Optional) Clear BGP flap statistics to make it less likely that a route will be dampened. Step 9 clear ip bgp dampening (Optional) Clear route dampening information, and unsuppress the suppressed routes. Step 10 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Table 29-12 IP BGP Clear and Show Commands Command Purpose clear ip bgp address Reset a particular BGP connection. clear ip bgp * Reset all BGP connections. clear ip bgp peer-group tag Remove all members of a BGP peer group. show ip bgp prefix Display peer groups and peers not in peer groups to which the prefix has been advertised. Also display prefix attributes such as the next hop and the local prefix. show ip bgp cidr-only Display all BGP routes that contain subnet and supernet network masks. show ip bgp community [community-number] [exact] Display routes that belong to the specified communities. show ip bgp community-list community-list-number [exact-match] Display routes that are permitted by the community list. show ip bgp filter-list access-list-number Display routes that are matched by the specified AS path access list. show ip bgp inconsistent-as Display the routes with inconsistent originating autonomous systems. show ip bgp regexp regular-expression Display the routes that have an AS path that matches the specified regular expression entered on the command line. show ip bgp Display the contents of the BGP routing table.29-65 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring BGP You can also enable the logging of messages generated when a BGP neighbor resets, comes up, or goes down by using the bgp log-neighbor changes router configuration command. show ip bgp neighbors [address] Display detailed information on the BGP and TCP connections to individual neighbors. show ip bgp neighbors [address] [advertised-routes | dampened-routes | flap-statistics | paths regular-expression | received-routes | routes] Display routes learned from a particular BGP neighbor. show ip bgp paths Display all BGP paths in the database. show ip bgp peer-group [tag] [summary] Display information about BGP peer groups. show ip bgp summary Display the status of all BGP connections. Table 29-12 IP BGP Clear and Show Commands (continued) Command Purpose29-66 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Configuring Protocol-Independent Features This section describes how to configure IP routing protocol-independent features. These features are available on switches running the SMI or the EMI; except that with the SMI, protocol-related features are available only for RIP. For a complete description of the IP routing protocol-independent commands in this chapter, refer to the “IP Routing Protocol-Independent Commands” chapter of the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This section includes these procedures: • Configuring Distributed Cisco Express Forwarding, page 29-66 • Configuring the Number of Equal-Cost Routing Paths, page 29-67 • Configuring Static Unicast Routes, page 29-68 • Specifying Default Routes and Networks, page 29-69 • Using Route Maps to Redistribute Routing Information, page 29-70 • Configuring Policy-Based Routing, page 29-74 • Filtering Routing Information, page 29-77 • Managing Authentication Keys, page 29-80 Configuring Distributed Cisco Express Forwarding Cisco Express Forwarding (CEF) is a Layer 3 IP switching technology used to optimize network performance. CEF implements an advanced IP look-up and forwarding algorithm to deliver maximum Layer 3 switching performance. CEF is less CPU-intensive than fast switching route caching, allowing more CPU processing power to be dedicated to packet forwarding. In a Catalyst 3750 switch stack, the hardware uses distributed CEF (dCEF) to achieve Gigabit-speed line rate IP traffic for each switch in the stack. In dynamic networks, fast switching cache entries are frequently invalidated because of routing changes, which can cause traffic to be process switched using the routing table, instead of fast switched using the route cache. CEF and dCEF use the Forwarding Information Base (FIB) lookup table to perform destination-based switching of IP packets. The two main components in dCEF are the distributed FIB and the distributed adjacency tables. • The FIB is similar to a routing table or information base and maintains a mirror image of the forwarding information in the IP routing table. When routing or topology changes occur in the network, the IP routing table is updated, and those changes are reflected in the FIB. The FIB maintains next-hop address information based on the information in the IP routing table. Because the FIB contains all known routes that exist in the routing table, CEF eliminates route cache maintenance, is more efficient for switching traffic, and is not affected by traffic patterns. • Nodes in the network are said to be adjacent if they can reach each other with a single hop across a link layer. CEF uses adjacency tables to prepend Layer 2 addressing information. The adjacency table maintains Layer 2 next-hop addresses for all FIB entries. Distributed CEF is enabled globally by default. If for some reason it is disabled, you can re-enable it by using the ip cef distributed global configuration command. The default configuration is dCEF enabled on all Layer 3 interfaces. Caution Although the no ip route-cache cef interface configuration command to disable CEF on an interface is visible in the CLI, we strongly recommend that you do not disable dCEF on interfaces.29-67 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Beginning in privileged EXEC mode, follow these steps to enable dCEF globally and on an interface in case, if, for some reason, it has been disabled: Configuring the Number of Equal-Cost Routing Paths When a router has two or more routes to the same network with the same metrics, these routes can be thought of as having an equal cost. The term parallel path is another way to refer to occurrences of equal-cost routes in a routing table. If a router has two or more equal-cost paths to a network, it can use them concurrently. Parallel paths provide redundancy in case of a circuit failure and also enable a router to load balance packets over the available paths for more efficient use of available bandwidth. Equal-cost routes are supported across switches in a stack. Although the router automatically learns about and configures equal-cost routes, you can control the maximum number of parallel paths supported by an IP routing protocol in its routing table. Beginning in privileged EXEC mode, follow these steps to change the maximum number of parallel paths installed in a routing table from the default: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 1 ip cef distributed Enable dCEF operation. Step 2 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface to configure. Step 3 ip route-cache cef Enable CEF on the interface. Step 4 end Return to privileged EXEC mode. Step 5 show ip cef Display the CEF status on all interfaces. Step 6 show cef linecard [slot-number] [detail] Display CEF-related interface information by stack member for all switches in the stack or for the specified switch. (Optional) For slot-number, enter the stack member switch number. Step 7 show cef interface [interface-id] Display detailed CEF information for all interfaces or the specified interface. Step 8 show adjacency Display CEF adjacency table information. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router {bgp | rip | ospf | igrp | eigrp} Enter router configuration mode. Step 3 maximum-paths maximum Set the maximum number of parallel paths for the protocol routing table. The range is from 1 to 8; the default is 4 for most IP routing protocols, but only 1 for BGP. Step 4 end Return to privileged EXEC mode. Step 5 show ip protocols Verify the setting in the Maximum path field. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-68 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Use the no maximum-paths router configuration command to restore the default value. Configuring Static Unicast Routes Static unicast routes are user-defined routes that cause packets moving between a source and a destination to take a specified path. Static routes can be important if the router cannot build a route to a particular destination and are useful for specifying a gateway of last resort to which all unroutable packets are sent. Beginning in privileged EXEC mode, follow these steps to configure a static route: Use the no ip route prefix mask {address | interface} global configuration command to remove a static route. The switch retains static routes until you remove them. However, you can override static routes with dynamic routing information by assigning administrative distance values. Each dynamic routing protocol has a default administrative distance, as listed in Table 29-13. If you want a static route to be overridden by information from a dynamic routing protocol, set the administrative distance of the static route higher than that of the dynamic protocol. Static routes that point to an interface are advertised through RIP, IGRP, and other dynamic routing protocols, whether or not static redistribute router configuration commands were specified for those routing protocols. These static routes are advertised because static routes that point to an interface are considered in the routing table to be connected and hence lose their static nature. However, if you define Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip route prefix mask {address | interface} [distance] Establish a static route. Step 3 end Return to privileged EXEC mode. Step 4 show ip route Display the current state of the routing table to verify the configuration. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Table 29-13 Dynamic Routing Protocol Default Administrative Distances Route Source Default Distance Connected interface 0 Static route 1 Enhanced IRGP summary route 5 External BGP 20 Internal Enhanced IGRP 90 IGRP 100 OSPF 110 RIP 120 Internal BGP 200 Unknown 22529-69 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features a static route to an interface that is not one of the networks defined in a network command, no dynamic routing protocols advertise the route unless a redistribute static command is specified for these protocols. When an interface goes down, all static routes through that interface are removed from the IP routing table. When the software can no longer find a valid next hop for the address specified as the forwarding router's address in a static route, the static route is also removed from the IP routing table. Specifying Default Routes and Networks A router might not be able to determine the routes to all other networks. To provide complete routing capability, you can use some routers as smart routers and give the remaining routers default routes to the smart router. (Smart routers have routing table information for the entire internetwork.) These default routes can be dynamically learned or can be configured in the individual routers. Most dynamic interior routing protocols include a mechanism for causing a smart router to generate dynamic default information that is then forwarded to other routers. If a router has a directly connected interface to the specified default network, the dynamic routing protocols running on that device generate a default route. In RIP, it advertises the pseudonetwork 0.0.0.0. In IGRP, the network itself is advertised and flagged as an exterior route. A router that is generating the default for a network also might need a default of its own. One way a router can generate its own default is to specify a static route to the network 0.0.0.0 through the appropriate device. Beginning in privileged EXEC mode, follow these steps to define a static route to a network as the static default route: Use the no ip default-network network number global configuration command to remove the route. When default information is passed through a dynamic routing protocol, no further configuration is required. The system periodically scans its routing table to choose the optimal default network as its default route. In IGRP networks, there might be several candidate networks for the system default. Cisco routers use administrative distance and metric information to determine the default route or the gateway of last resort. If dynamic default information is not being passed to the system, candidates for the default route are specified with the ip default-network global configuration command. If this network appears in the routing table from any source, it is flagged as a possible choice for the default route. If the router has no interface on the default network, but does have a path to it, the network is considered as a possible candidate, and the gateway to the best default path becomes the gateway of last resort. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip default-network network number Specify a default network. Step 3 end Return to privileged EXEC mode. Step 4 show ip route Display the selected default route in the gateway of last resort display. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.29-70 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Using Route Maps to Redistribute Routing Information The switch can run multiple routing protocols simultaneously, and it can redistribute information from one routing protocol to another. For example, you can instruct the switch to readvertise IGRP-derived routes by using RIP or to readvertise static routes by using IGRP. Redistributing information from one routing protocol to another applies to all supported IP-based routing protocols. You can also conditionally control the redistribution of routes between routing domains by defining enhanced packet filters or route maps between the two domains. The match and set route-map configuration commands define the condition portion of a route map. The match command specifies that a criterion must be matched; the set command specifies an action to be taken if the routing update meets the conditions defined by the match command. Although redistribution is a protocol-independent feature, some of the match and set route-map configuration commands are specific to a particular protocol. One or more match commands and one or more set commands follow a route-map command. If there are no match commands, everything matches. If there are no set commands, nothing is done, other than the match. Therefore, you need at least one match or set command. You can also identify route-map statements as permit or deny. If the statement is marked as a deny, the packets meeting the match criteria are sent back through the normal forwarding channels (destination-based routing). If the statement is marked as permit, set clauses are applied to packets meeting the match criteria. Packets that do not meet the match criteria are forwarded through the normal routing channel. Note Although each of Steps 3 through 14 in the following section is optional, you must enter at least one match route-map configuration command and one set route-map configuration command. Beginning in privileged EXEC mode, follow these steps to configure a route map for redistribution: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 route-map map-tag [permit | deny] [sequence number] Define any route maps used to control redistribution and enter route-map configuration mode. map-tag—A meaningful name for the route map. The redistribute router configuration command uses this name to reference this route map. Multiple route maps might share the same map tag name. (Optional) If permit is specified and the match criteria are met for this route map, the route is redistributed as controlled by the set actions. If deny is specified, the route is not redistributed. sequence number (Optional)— Number that indicates the position a new route map is to have in the list of route maps already configured with the same name. Step 3 match as-path path-list-number Match a BGP AS path access list. Step 4 match community-list community-list-number [exact] Match a BGP community list.29-71 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Step 5 match ip address {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match a standard access list by specifying the name or number. It can be an integer from 1 to 199. Step 6 match metric metric-value Match the specified route metric. The metric-value can be an IGRP five-part metric with a specified value from 0 to 4294967295. Step 7 match ip next-hop {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match a next-hop router address passed by one of the access lists specified (numbered from 1 to 199). Step 8 match tag tag value [...tag-value] Match the specified tag value in a list of one or more route tag values. Each can be an integer from 0 to 4294967295. Step 9 match interface type number [...type number] Match the specified next hop route out one of the specified interfaces. Step 10 match ip route-source {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match the address specified by the specified advertised access lists. Step 11 match route-type {local | internal | external [type-1 | type-2]} Match the specified route-type: • local—Locally generated BGP routes. • internal—OSPF intra-area and interarea routes or EIGRP internal routes. • external—OSPF external routes (Type 1 or Type 2) or EIGRP external routes. Step 12 set dampening halflife reuse suppress max-suppress-time Set BGP route dampening factors. Step 13 set local-preference value Assign a value to a local BGP path. Step 14 set origin {igp | egp as | incomplete} Set the BGP origin code. Step 15 set as-path {tag | prepend as-path-string} Modify the BGP autonomous system path. Step 16 set level {level-1 | level-2 | level-1-2 | stub-area | backbone} Set the level for routes that are advertised into the specified area of the routing domain. The stub-area and backbone are OSPF NSSA and backbone areas. Step 17 set metric metric value Set the metric value to give the redistributed routes (for any protocol except IGRP or EIGRP). The metric value is an integer from -294967295 to 294967295. Command Purpose29-72 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Step 5 match ip address {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match a standard access list by specifying the name or number. It can be an integer from 1 to 199. Step 6 match metric metric-value Match the specified route metric. The metric-value can be an IGRP five-part metric with a specified value from 0 to 4294967295. Step 7 match ip next-hop {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match a next-hop router address passed by one of the access lists specified (numbered from 1 to 199). Step 8 match tag tag value [...tag-value] Match the specified tag value in a list of one or more route tag values. Each can be an integer from 0 to 4294967295. Step 9 match interface type number [...type number] Match the specified next hop route out one of the specified interfaces. Step 10 match ip route-source {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match the address specified by the specified advertised access lists. Step 11 match route-type {local | internal | external [type-1 | type-2]} Match the specified route-type: • local—Locally generated BGP routes. • internal—OSPF intra-area and interarea routes or EIGRP internal routes. • external—OSPF external routes (Type 1 or Type 2) or EIGRP external routes. Step 12 set dampening halflife reuse suppress max-suppress-time Set BGP route dampening factors. Step 13 set local-preference value Assign a value to a local BGP path. Step 14 set origin {igp | egp as | incomplete} Set the BGP origin code. Step 15 set as-path {tag | prepend as-path-string} Modify the BGP autonomous system path. Step 16 set level {level-1 | level-2 | level-1-2 | stub-area | backbone} Set the level for routes that are advertised into the specified area of the routing domain. The stub-area and backbone are OSPF NSSA and backbone areas. Step 17 set metric metric value Set the metric value to give the redistributed routes (for any protocol except IGRP or EIGRP). The metric value is an integer from -294967295 to 294967295. Command Purpose29-73 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features To delete an entry, use the no route-map map tag global configuration command or the no match or no set route-map configuration commands. You can distribute routes from one routing domain into another and control route distribution. Beginning in privileged EXEC mode, follow these steps to control route redistribution. Note that the keywords are the same as defined in the previous procedure. Step 18 set metric bandwidth delay reliability loading mtu Set the metric value to give the redistributed routes (for IGRP or EIGRP only): • bandwidth—Metric value or IGRP bandwidth of the route in kilobits per second in the range 0 to 4294967295 • delay—Route delay in tens of microseconds in the range 0 to 4294967295. • reliability—Likelihood of successful packet transmission expressed as a number between 0 and 255, where 255 means 100 percent reliability and 0 means no reliability. • loading— Effective bandwidth of the route expressed as a number from 0 to 255 (255 is 100 percent loading). • mtu—Minimum maximum transmission unit (MTU) size of the route in bytes in the range 0 to 4294967295. Step 19 set metric-type {type-1 | type-2} Set the OSPF external metric type for redistributed routes. Step 20 set metric-type internal Set the multi-exit discriminator (MED) value on prefixes advertised to external BGP neighbor to match the IGP metric of the next hop. Step 21 set weight Set the BGP weight for the routing table. The value can be from 1 to 65535. Step 22 end Return to privileged EXEC mode. Step 23 show route-map Display all route maps configured or only the one specified to verify configuration. Step 24 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router {bgp | rip | ospf | igrp | eigrp} Enter router configuration mode. Step 3 redistribute protocol [process-id] {level-1 | level-1-2 | level-2} [metric metric-value] [metric-type type-value] [match internal | external type-value] [tag tag-value] [route-map map-tag] [weight weight] [subnets] Redistribute routes from one routing protocol to another routing protocol. If no route-maps are specified, all routes are redistributed. If the keyword route-map is specified with no map-tag, no routes are distributed.29-74 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features To disable redistribution, use the no form of the commands. The metrics of one routing protocol do not necessarily translate into the metrics of another. For example, the RIP metric is a hop count, and the IGRP metric is a combination of five qualities. In these situations, an artificial metric is assigned to the redistributed route. Uncontrolled exchanging of routing information between different routing protocols can create routing loops and seriously degrade network operation. If you have not defined a default redistribution metric that replaces metric conversion, some automatic metric translations occur between routing protocols: • RIP can automatically redistribute static routes. It assigns static routes a metric of 1 (directly connected). • IGRP can automatically redistribute static routes and information from other IGRP-routed autonomous systems. IGRP assigns static routes a metric that identifies them as directly connected. It does not change the metrics of routes derived from IGRP updates from other autonomous systems. • Any protocol can redistribute other routing protocols if a default mode is in effect. Configuring Policy-Based Routing You can use policy-based routing (PBR) to configure a defined policy for traffic flows. By using PBR, you can have more control over routing by reducing the reliance on routes derived from routing protocols. PBR can determine and implement routing policies that allow or deny paths based on: • Identity of a particular end system • Application • Protocol You can use PBR to provide equal-access and source-sensitive routing, routing based on interactive versus batch traffic, or routing based on dedicated links. For example, you could transfer stock records to a corporate office on a high-bandwidth, high-cost link for a short time while transmitting routine application data such as e-mail over a low-bandwidth, low-cost link. Step 4 default-metric number Cause the current routing protocol to use the same metric value for all redistributed routes (BGP, RIP and OSPF). Step 5 default-metric bandwidth delay reliability loading mtu Cause the IGRP or EIGRP routing protocol to use the same metric value for all non-IGRP redistributed routes. Step 6 no default-information {in | out} Disable the redistribution of default information between IGRP processes, which is enabled by default. Step 7 end Return to privileged EXEC mode. Step 8 show route-map Display all route maps configured or only the one specified to verify configuration. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-75 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features With PBR, you classify traffic using access control lists (ACLs) and then make traffic go through a different path. PBR is applied to incoming packets. All packets received on an interface with PBR enabled are passed through route maps. Based on the criteria defined in the route maps, packets are forwarded (routed) to the appropriate next hop. • If packets do not match any route map statements, all set clauses are applied. • If a statement is marked as deny, packets meeting the match criteria are sent through normal forwarding channels, and destination-based routing is performed. • If a statement is marked as permit and the packets do not match any route-map statements, the packets are sent through the normal forwarding channels, and destination-based routing is performed. For more information about configuring route maps, see the “Using Route Maps to Redistribute Routing Information” section on page 29-70. You can use standard IP ACLs to specify match criteria for a source address or extended IP ACLs to specify match criteria based on an application, a protocol type, or an end station. The process proceeds through the route map until a match is found. If no match is found, or if the route map is a deny, normal destination-based routing occurs. There is an implicit deny at the end of the list of match statements. If match clauses are satisfied, you can use a set clause to specify the IP addresses identifying the next hop router in the path. Note For details about PBR commands and keywords, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. For a list of PBR commands that are visible but not supported by the switch, see Appendix C, “Unsupported Commands in Cisco IOS Release 12.1(14)EA1.” PBR configuration is applied to the whole stack, and all switches use the stack master configuration. PBR Configuration Guidelines Before configuring PBR, you should be aware of this information: • To use PBR, you must have the EMI installed on the stack master. • Multicast traffic is not policy-routed. PBR applies to only to unicast traffic. • You can enable PBR on a routed port or an SVI. • You can apply a policy route map to an EtherChannel port channel in Layer 3 mode, but you cannot apply a policy route map to a physical interface that is a member of the EtherChannel. If you try to do so, the command is rejected. When a policy route map is applied to a physical interface, that interface cannot become a member of an EtherChannel. • You can define a maximum of 246 IP policy route-maps on the switch stack. • You can define a maximum of 512 access control entries (ACEs) for PBR on the switch stack. • To use PBR, you must first enable the routing template by using the sdm prefer routing global configuration command. PBR is not supported with the VLAN or default template. For more information on the SDM templates, see Chapter 8, “Configuring SDM Templates.” • The number of TCAM entries used by PBR depends on the route map itself, the ACLs used, and the order of the ACLs and route-map entries. • Policy-based routing based on packet length, IP precedence and TOS, set interface, set default next hop, or set default interface are not supported. Policy maps with no valid set actions or with set action set to Don’t Fragment are not supported. 29-76 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Enabling PBR By default, PBR is disabled on the switch. To enable PBR, you must create a route map that specifies the match criteria and the resulting action if all of the match clauses are met. Then, you must enable PBR for that route map on an interface. All packets arriving on the specified interface matching the match clauses are subject to PBR. PBR can be fast-switched or implemented at speeds that do not slow down the switch. Fast-switched PBR supports most match and set commands. PBR must be enabled before you enable fast-switched PBR. Fast-switched PBR is disabled by default. Packets that are generated by the switch, or local packets, are not normally policy-routed. When you globally enable local PBR on the switch, all packets that originate on the switch are subject to local PBR. Local PBR is disabled by default. Note To enable PBR, the stack master must be running the EMI. Beginning in privileged EXEC mode, follow these steps to configure PBR: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 route-map map-tag [permit | deny] [sequence number] Define any route maps used to control where packets are output, and enter route-map configuration mode. map-tag—A meaningful name for the route map. The ip policy route-map interface configuration command uses this name to reference the route map. Multiple route maps might share the same map tag name. (Optional) If permit is specified and the match criteria are met for this route map, the route is policy-routed as controlled by the set actions. If deny is specified, the route is not policy-routed. sequence number (Optional)— Number that shows the position of a new route map in the list of route maps already configured with the same name. Step 3 match ip address {access-list-number | access-list-name} [...access-list-number | ...access-list-name] Match the source and destination IP address that is permitted by one or more standard or extended access lists. If you do not specify a match command, the route map applies to all packets. Step 4 set ip next-hop ip-address [...ip-address] Specify the action to take on the packets that match the criteria. Set next hop to which to route the packet (the next hop must be adjacent). Step 5 interface interface-id Enter interface configuration mode, and specify the interface to configure.29-77 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Use the no route-map map-tag global configuration command or the no match or no set route-map configuration commands to delete an entry. Use the no ip policy route-map map-tag interface configuration command to disable PBR on an interface. Use the no ip route-cache policy interface configuration command to disable fast-switching PBR. Use the no ip local policy route-map map-tag global configuration command to disable policy-based routing on packets originating on the switch. Filtering Routing Information You can filter routing protocol information by performing the tasks described in this section. Note When routes are redistributed between OSPF processes, no OSPF metrics are preserved. Setting Passive Interfaces To prevent other routers on a local network from dynamically learning about routes, you can use the passive-interface router configuration command to keep routing update messages from being sent through a router interface. When you use this command in the OSPF protocol, the interface address you specify as passive appears as a stub network in the OSPF domain. OSPF routing information is neither sent nor received through the specified router interface. In networks with many interfaces, to avoid having to manually set them as passive, you can set all interfaces to be passive by default by using the passive-interface default router configuration command and manually setting interfaces where adjacencies are desired. Step 6 ip policy route-map map-tag Enable PBR on a Layer 3 interface, and identify the route map to use. You can configure only one route map on an interface. However, you can have multiple route map entries with different sequence numbers. These entries are evaluated in sequence number order until the first match. If there is no match, packets are routed as usual. Step 7 ip route-cache policy (Optional) Enable fast-switching PBR. You must first enable PBR before enabling fast-switching PBR. Step 8 exit Return to global configuration mode. Step 9 ip local policy route-map map-tag (Optional) Enable local PBR to perform policy-based routing on packets originating at the switch. This applies to packets generated by the switch and not to incoming packets. Step 10 end Return to privileged EXEC mode. Step 11 show route-map [map-name] (Optional) Display all route maps configured or only the one specified to verify configuration. Step 12 show ip policy (Optional) Display policy route maps attached to interfaces. Step 13 show ip local policy (Optional) Display whether or not local policy routing is enabled and, if so, the route map being used. Step 14 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose29-78 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Beginning in privileged EXEC mode, follow these steps to configure passive interfaces: Use a network monitoring privileged EXEC command such as show ip ospf interface to verify the interfaces that you enabled as passive, or use the show ip interface privileged EXEC command to verify the interfaces that you enabled as active. To re-enable the sending of routing updates, use the no passive-interface interface-id router configuration command. The default keyword sets all interfaces as passive by default. You can then configure individual interfaces where you want adjacencies by using the no passive-interface router configuration command. The default keyword is useful in Internet service provider and large enterprise networks where many of the distribution routers have more than 200 interfaces. Controlling Advertising and Processing in Routing Updates You can use the distribute-list router configuration command with access control lists to suppress routes from being advertised in routing updates and to prevent other routers from learning one or more routes. When used in OSPF, this feature applies to only external routes, and you cannot specify an interface name. You can also use a distribute-list router configuration command to avoid processing certain routes listed in incoming updates. (This feature does not apply to OSPF.) Beginning in privileged EXEC mode, follow these steps to control the advertising or processing of routing updates: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router {bgp | rip | ospf | igrp | eigrp} Enter router configuration mode. Step 3 passive-interface interface-id Suppress sending routing updates through the specified Layer 3 interface. Step 4 passive-interface default (Optional) Set all interfaces as passive by default. Step 5 no passive-interface interface type (Optional) Activate only those interfaces that need to have adjacencies sent. Step 6 network network-address (Optional) Specify the list of networks for the routing process. The network-address is an IP address. Step 7 end Return to privileged EXEC mode. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router {bgp | rip | igrp | eigrp} Enter router configuration mode. Step 3 distribute-list {access-list-number | access-list-name} out [interface-name | routing process | autonomous-system-number] Permit or deny routes from being advertised in routing updates, depending upon the action listed in the access list. Step 4 distribute-list {access-list-number | access-list-name} in [type-number] Suppress processing in routes listed in updates.29-79 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Use the no distribute-list in router configuration command to change or cancel a filter. To cancel suppression of network advertisements in updates, use the no distribute-list out router configuration command. Filtering Sources of Routing Information Because some routing information might be more accurate than others, you can use filtering to prioritize information coming from different sources. An administrative distance is a rating of the trustworthiness of a routing information source, such as a router or group of routers. In a large network, some routing protocols can be more reliable than others. By specifying administrative distance values, you enable the router to intelligently discriminate between sources of routing information. The router always picks the route whose routing protocol has the lowest administrative distance. Table 29-13 on page 29-68 shows the default administrative distances for various routing information sources. Because each network has its own requirements, there are no general guidelines for assigning administrative distances. Beginning in privileged EXEC mode, follow these steps to filter sources of routing information: To remove a distance definition, use the no distance router configuration command. Step 5 end Return to privileged EXEC mode. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 router {bgp | rip | ospf | igrp | eigrp} Enter router configuration mode. Step 3 distance weight {ip-address {ip-address mask}} [ip access list] Define an administrative distance. weight—The administrative distance as an integer from 10 to 255. Used alone, weight specifies a default administrative distance that is used when no other specification exists for a routing information source. Routes with a distance of 255 are not installed in the routing table. (Optional) ip access list—An IP standard or extended access list to be applied to incoming routing updates. Step 4 end Return to privileged EXEC mode. Step 5 show ip protocols Display the default administrative distance for a specified routing process. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.29-80 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Configuring Protocol-Independent Features Managing Authentication Keys Key management is a method of controlling authentication keys used by routing protocols. Not all protocols can use key management. Authentication keys are available for EIGRP and RIP Version 2. Before you manage authentication keys, you must enable authentication. See the appropriate protocol section to see how to enable authentication for that protocol. To manage authentication keys, define a key chain, identify the keys that belong to the key chain, and specify how long each key is valid. Each key has its own key identifier (specified with the key number key chain configuration command), which is stored locally. The combination of the key identifier and the interface associated with the message uniquely identifies the authentication algorithm and Message Digest 5 (MD5) authentication key in use. You can configure multiple keys with life times. Only one authentication packet is sent, regardless of how many valid keys exist. The software examines the key numbers in order from lowest to highest, and uses the first valid key it encounters. The lifetimes allow for overlap during key changes. Note that the router must know these lifetimes. Beginning in privileged EXEC mode, follow these steps to manage authentication keys: To remove the key chain, use the no key chain name-of-chain global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 key chain name-of-chain Identify a key chain, and enter key chain configuration mode. Step 3 key number Identify the key number. The range is 0 to 2147483647. Step 4 key-string text Identify the key string. The string can contain from 1 to 80 uppercase and lowercase alphanumeric characters, but the first character cannot be a number. Step 5 accept-lifetime start-time {infinite | end-time | duration seconds} (Optional) Specify the time period during which the key can be received. The start-time and end-time syntax can be either hh:mm:ss Month date year or hh:mm:ss date Month year. The default is forever with the default start-time and the earliest acceptable date as January 1, 1993. The default end-time and duration is infinite. Step 6 send-lifetime start-time {infinite | end-time | duration seconds} (Optional) Specify the time period during which the key can be sent. The start-time and end-time syntax can be either hh:mm:ss Month date year or hh:mm:ss date Month year. The default is forever with the default start-time and the earliest acceptable date as January 1, 1993. The default end-time and duration is infinite. Step 7 end Return to privileged EXEC mode. Step 8 show key chain Display authentication key information. Step 9 copy running-config startup-config (Optional) Save your entries in the configuration file.29-81 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Monitoring and Maintaining the IP Network Monitoring and Maintaining the IP Network You can remove all contents of a particular cache, table, or database. You can also display specific statistics. Use the privileged EXEC commands in Table 29-14 to clear routes or display status: Table 29-14 Commands to Clear IP Routes or Display Route Status Command Purpose clear ip route {network [mask | *]} Clear one or more routes from the IP routing table. show ip protocols Display the parameters and state of the active routing protocol process. show ip route [address [mask] [longer-prefixes]] | [protocol [process-id]] Display the current state of the routing table. show ip route summary Display the current state of the routing table in summary form. show ip route supernets-only Display supernets. show ip cache Display the routing table used to switch IP traffic. show route-map [map-name] Display all route maps configured or only the one specified.29-82 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 29 Configuring IP Unicast Routing Monitoring and Maintaining the IP NetworkC H A P T E R 30-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 30 Configuring HSRP This chapter describes how to use Hot Standby Router Protocol (HSRP) on the Catalyst 3750 switch to provide routing redundancy for routing IP traffic without being dependent on the availability of any single router. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note You can also use a version of HSRP in Layer 2 mode to configure a redundant command switch to take over cluster management if the cluster command switch fails. For more information about clustering, see Chapter 6, “Clustering Switches.” Note For complete syntax and usage information for the commands used in this chapter, refer to the switch command reference for this release and the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This chapter consists of these sections: • Understanding HSRP, page 30-1 • Configuring HSRP, page 30-3 • Displaying HSRP Configurations, page 30-10 Understanding HSRP HSRP is Cisco’s standard method of providing high network availability by providing first-hop redundancy for IP hosts on an IEEE 802 LAN configured with a default gateway IP address. HSRP routes IP traffic without relying on the availability of any single router. It enables a set of router interfaces to work together to present the appearance of a single virtual router or default gateway to the hosts on a LAN. When HSRP is configured on a network or segment, it provides a virtual Media Access Control (MAC) address and an IP address that is shared among a group of configured routers. HSRP allows two or more HSRP-configured routers to use the MAC address and IP network address of a virtual router. The virtual router does not exist; it represents the common target for routers that are configured to provide backup to each other. One of the routers is selected to be the active router and another to be the standby router, which assumes control of the group MAC address and IP address should the designated active router fail. Note Routers in an HSRP group can be any router interface that supports HSRP, including Catalyst 3750 routed ports and switch virtual interfaces (SVIs).30-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Understanding HSRP HSRP provides high network availability by providing redundancy for IP traffic from hosts on networks. In a group of router interfaces, the active router is the router of choice for routing packets; the standby router is the router that takes over the routing duties when an active router fails or when preset conditions are met. HSRP is useful for hosts that do not support a router discovery protocol and cannot switch to a new router when their selected router reloads or loses power. When HSRP is configured on a network segment, it provides a virtual MAC address and an IP address that is shared among router interfaces in a group of router interfaces running HSRP. The router selected by the protocol to be the active router receives and routes packets destined for the group’s MAC address. For n routers running HSRP, there are n +1 IP and MAC addresses assigned. HSRP detects when the designated active router fails, and a selected standby router assumes control of the Hot Standby group’s MAC and IP addresses. A new standby router is also selected at that time. Devices running HSRP send and receive multicast UDP-based hello packets to detect router failure and to designate active and standby routers. When HSRP is configured on an interface, Internet Control Message Protocol (ICMP) redirect messages are disabled by default for the interface. You can configure multiple Hot Standby groups among Catalyst 3750 switches and switch stacks that are operating in Layer 3 to make more use of the redundant routers. To do so, specify a group number for each Hot Standby command group you configure for an interface. For example, you might configure an interface on switch 1 as an active router and one on switch 2 as a standby router and also configure another interface on switch 2 as an active router with another interface on switch 1 as its standby router. Figure 30-1 shows a segment of a network configured for HSRP. Each router is configured with the MAC address and IP network address of the virtual router. Instead of configuring hosts on the network with the IP address of Router A, you configure them with the IP address of the virtual router as their default router. When Host C sends packets to Host B, it sends them to the MAC address of the virtual router. If for any reason, Router A stops transferring packets, Router B responds to the virtual IP address and virtual MAC address and becomes the active router, assuming the active router duties. Host C continues to use the IP address of the virtual router to address packets destined for Host B, which Router B now receives and sends to Host B. Until Router A resumes operation, HSRP allows Router B to provide uninterrupted service to users on Host C’s segment that need to communicate with users on Host B’s segment and also continues to perform its normal function of handling packets between the Host A segment and Host B. HSRP and Switch Stacks HSRP hello messages are generated by the stack master. If an HSRP-active stack master fails, a flap in the HSRP active state might occur. This is because HSRP hello messages are not generated while a new stack master is elected and initialized, and the standby router might become active after the stack master fails.30-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Figure 30-1 Typical HSRP Configuration Configuring HSRP These sections include HSRP configuration information: • Default HSRP Configuration, page 30-4 • HSRP Configuration Guidelines, page 30-4 • Enabling HSRP, page 30-5 • Configuring HSRP Group Attributes, page 30-6 • Configuring HSRP Groups and Clustering, page 30-9 Host B 172.20.130.5 172.20.128.32 Host A 172.20.128.55 172.20.128.1 172.20.128.3 172.20.128.2 Virtual router Active router Standby router Router A Router B Host C 86893 Catalyst 3750 Layer 3 switches30-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Default HSRP Configuration Table 30-1 shows the default HSRP configuration. HSRP Configuration Guidelines Follow these guidelines when configuring HSRP: • HSRP can be configured on a maximum of 32 VLAN or routing interfaces. • In the following procedures, the specified interface must be one of these Layer 3 interfaces: – Routed port: a physical port configured as a Layer 3 port by entering the no switchport interface configuration command. – SVI: a VLAN interface created by using the interface vlan vlan_id global configuration command and by default a Layer 3 interface. – Etherchannel port channel in Layer 3 mode: a port-channel logical interface created by using the interface port-channel port-channel-number global configuration command and binding the Ethernet interface into the channel group. For more information, see the “Configuring Layer 3 EtherChannels” section on page 28-14. • All Layer 3 interfaces must have IP addresses assigned to them. See the “Configuring Layer 3 Interfaces” section on page 11-18. Table 30-1 Default HSRP Configuration Feature Default Setting HSRP groups None configured Standby group number 0 Standby MAC address System assigned as: 0000.0c07.acXX, where XX is the HSRP group number Standby priority 100 Standby delay 0 (no delay) Standby track interface priority 10 Standby hello time 3 seconds Standby holdtime 10 seconds30-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Enabling HSRP The standby ip interface configuration command activates HSRP on the configured interface. If an IP address is specified, that address is used as the designated address for the Hot Standby group. If no IP address is specified, the address is learned through the standby function. You must configure at least one routing port on the cable with the designated address. Configuring an IP address always overrides another designated address currently in use. When the standby ip command is enabled on an interface and proxy ARP is enabled, if the interface’s Hot Standby state is active, proxy ARP requests are answered using the Hot Standby group MAC address. If the interface is in a different state, proxy ARP responses are suppressed. Note When multi-VRF CE is configured, you cannot assign the same HSRP standby address to two different VPNs. Beginning in privileged EXEC mode, follow these steps to create or enable HSRP on a Layer 3 interface: Use the no standby [group-number] ip [ip-address] interface configuration command to disable HSRP. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the Layer 3 interface on which you want to enable HSRP. Step 3 standby [group-number] ip [ip-address [secondary]] Create (or enable) the HSRP group using its number and virtual IP address. • (Optional) group-number—The group number on the interface for which HSRP is being enabled. The range is 0 to 255; the default is 0. If there is only one HSRP group, you do not need to enter a group number. • (Optional on all but one interface) ip-address—The virtual IP address of the hot standby router interface. You must enter the virtual IP address for at least one of the interfaces; it can be learned on the other interfaces. • (Optional) secondary—The IP address is a secondary hot standby router interface. If neither router is designated as a secondary or standby router and no priorities are set, the primary IP addresses are compared and the higher IP address is the active router, with the next highest as the standby router. Step 4 end Return to privileged EXEC mode. Step 5 show standby [interface-id [group]] Verify the configuration. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.30-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP This example shows how to activate HSRP for group 1 on Gigabit Ethernet interface 1/0/1. The IP address used by the hot standby group is learned by using HSRP. Note This procedure is the minimum number of steps required to enable HSRP. Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no switchport Switch(config-if)# standby 1 ip Switch(config-if)# end Switch# show standby Configuring HSRP Group Attributes Although HSRP can run with no other configuration required, you can configure attributes for the HSRP group, including authentication, priority, preemption and preemption delay, timers, or MAC address. Configuring HSRP Priority The standby priority, standby preempt, and standby track interface configuration commands are all used to set characteristics for determining active and standby routers and behavior regarding when a new active router takes over. When configuring priority, follow these guidelines: • Assigning priority helps select the active and standby routers. If preemption is enabled, the router with the highest priority becomes the designated active router. If priorities are equal, the primary IP addresses are compared, and the higher IP address has priority. • The highest number (1 to 255) represents the highest priority (most likely to become the active router). • When setting the priority, preempt, or both, you must specify at least one keyword (priority, preempt, or both). • The priority of the device can change dynamically if an interface is configured with the standby track command and another interface on the router goes down. • The standby track interface configuration command ties the router hot standby priority to the availability of its interfaces and is useful for tracking interfaces that are not configured for HSRP. When a tracked interface fails, the hot standby priority on the device on which tracking has been configured decreases by 10. If an interface is not tracked, its state changes do not affect the hot standby priority of the configured device. For each interface configured for hot standby, you can configure a separate list of interfaces to be tracked. • The standby track interface-priority interface configuration command specifies how much to decrement the hot standby priority when a tracked interface goes down. When the interface comes back up, the priority is incremented by the same amount. • When multiple tracked interfaces are down and interface-priority values have been configured, the configured priority decrements are cumulative. If tracked interfaces that were not configured with priority values fail, the default decrement is 10, and it is noncumulative. • When routing is first enabled for the interface, it does not have a complete routing table. If it is configured to preempt, it becomes the active router, even though it is unable to provide adequate routing services. To solve this problem, configure a delay time to allow the router to update its routing table.30-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Beginning in privileged EXEC mode, use one or more of these steps to configure HSRP priority characteristics on an interface: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the HSRP interface on which you want to set priority. Step 3 standby [group-number] priority priority [preempt [delay delay]] Set a priority value used in choosing the active router. The range is 1 to 255; the default priority is 100. The highest number represents the highest priority. • (Optional) group-number—The group number to which the command applies. • (Optional) preempt—Select so that when the local router has a higher priority than the active router, it assumes control as the active router. • (Optional) delay—Set to cause the local router to postpone taking over the active role for the shown number of seconds. The range is 0 to 36000 (1 hour); the default is 0 (no delay before taking over). Use the no form of the command to restore the default values. Step 4 standby [group-number] [priority priority] preempt [delay delay] Configure the router to preempt, which means that when the local router has a higher priority than the active router, it assumes control as the active router. • (Optional) group-number—The group number to which the command applies. • (Optional) priority—Enter to set or change the group priority. The range is 1 to 255; the default is 100. • (Optional) delay—Set to cause the local router to postpone taking over the active role for the number of seconds shown. The range is 0 to 36000 (1 hour); the default is 0 (no delay before taking over). Use the no form of the command to restore the default values. Step 5 standby [group-number] track type number [interface-priority] Configure an interface to track other interfaces so that if one of the other interfaces goes down, the device’s Hot Standby priority is lowered. • (Optional) group-number—The group number to which the command applies. • type—Enter the interface type (combined with interface number) that is tracked. • number—Enter the interface number (combined with interface type) that is tracked. • (Optional) interface-priority—Enter the amount by which the hot standby priority for the router is decremented or incremented when the interface goes down or comes back up. The default value is 10. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify the configuration of the standby groups. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.30-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Use the no standby [group-number] priority priority [preempt [delay delay]] and no standby [group-number] [priority priority] preempt [delay delay] interface configuration commands to restore default priority, preempt, and delay values. Use the no standby [group-number] track type number [interface-priority] interface configuration command to remove the tracking. This example activates Gigabit Ethernet interface 1/0/1, sets an IP address and a priority of 120 (higher than the default value), and waits for 300 seconds (5 minutes) before attempting to become the active router: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no switchport Switch(config-if)# standby ip 172.19.108.254 Switch(config-if)# standby priority 120 preempt delay 300 Switch(config-if)# end Switch# Configuring HSRP Authentication and Timers You can optionally configure an HSRP authentication string or change the hello-time interval and holdtime. When configuring these attributes, follow these guidelines: • The authentication string is sent unencrypted in all HSRP messages. You must configure the same authentication string on all routers and access servers on a cable to ensure interoperation. Authentication mismatch prevents a device from learning the designated Hot Standby IP address and timer values from other routers configured with HSRP. • Routers or access servers on which standby timer values are not configured can learn timer values from the active or standby router. The timers configured on an active router always override any other timer settings. • All routers in a Hot Standby group should use the same timer values. Normally, the holdtime is greater than or equal to 3 times the hellotime. Beginning in privileged EXEC mode, use one or more of these steps to configure HSRP authentication and timers on an interface: Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and enter the HSRP interface on which you want to set authentication. Step 3 standby [group-number] authentication string (Optional) authentication string—Enter a string to be carried in all HSRP messages. The authentication string can be up to eight characters in length; the default string is cisco. (Optional) group-number—The group number to which the command applies. 30-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Configuring HSRP Use the no standby [group-number] authentication string interface configuration command to delete an authentication string. Use the no standby [group-number] timers hellotime holdtime interface configuration command to restore timers to their default values. This example shows how to configure word as the authentication string required to allow Hot Standby routers in group 1 to interoperate: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no switchport Switch(config-if)# standby 1 authentication word Switch(config-if)# end Switch# This example shows how to set the timers on standby group 1 with the time between hello packets at 5 seconds and the time after which a router is considered down to be 15 seconds: Switch# configure terminal Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# no switchport Switch(config-if)# standby 1 ip Switch(config-if)# standby 1 timers 5 15 Switch(config-if)# end Switch# Configuring HSRP Groups and Clustering When a device is participating in an HSRP standby routing and clustering is enabled, you can use the same standby group for command switch redundancy and HSRP redundancy. Use the cluster standby-group HSRP-group-name [routing-redundancy] global configuration command to enable the same HSRP standby group to be used for command switch and routing redundancy. If you create a cluster with the same HSRP standby group name without entering the routing-redundancy keyword, HSRP standby routing is disabled for the group. Step 4 standby [group-number] timers hellotime holdtime (Optional) Configure the time between hello packets and the time before other routers declare the active router to be down. • group-number—The group number to which the command applies. • hellotime—The hello interval in seconds. The range is from 1 to 255; the default is 3 seconds. • holdtime—The time in seconds before the active or standby router is declared to be down. The range is from 1 to 255; the default is 10 seconds. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify the configuration of the standby groups. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose30-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 30 Configuring HSRP Displaying HSRP Configurations This example shows how to bind standby group my_hsrp to the cluster and enable the same HSRP group to be used for command switch redundancy and router redundancy. The command can only be executed on the command switch. If the standby group name or number does not exist, or if the switch is a member switch, an error message appears. Switch# configure terminal Switch(config)# cluster standby-group my_hsrp routing-redundancy Switch(config)# end Displaying HSRP Configurations From privileged EXEC mode, use this command to display HSRP settings: show standby [interface-id [group]] [brief] [detail] You can display HSRP information for the whole switch, for a specific interface, for an HSRP group, or for an HSRP group on an interface. You can also specify whether to display a concise overview of HSRP information or detailed HSRP information. The default display is detail. If there are a large number of HSRP groups, using the show standby command without qualifiers can result in an unwieldy display. This is a an example of output from the show standby privileged EXEC command, displaying HSRP information for two standby groups (group 1 and group 100): Switch# show standby VLAN1 - Group 1 Local state is Standby, priority 105, may preempt Hellotime 3 holdtime 10 Next hello sent in 00:00:02.182 Hot standby IP address is 10.0.0.1 configured Active router is 172.20.138.35 expires in 00:00:09 Standby router is local Standby virtual mac address is 0000.0c07.ac01 Name is bbb VLAN1 - Group 100 Local state is Active, priority 105, may preempt Hellotime 3 holdtime 10 Next hello sent in 00:00:02.262 Hot standby IP address is 172.20.138.51 configured Active router is local Standby router is unknown expired Standby virtual mac address is 0000.0c07.ac64 Name is testC H A P T E R 31-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 31 Configuring IP Multicast Routing This chapter describes how to configure IP multicast routing on the Catalyst 3750 switch. IP multicasting is a more efficient way to use network resources, especially for bandwidth-intensive services such as audio and video. IP multicast routing enables a host (source) to send packets to a group of hosts (receivers) anywhere within the IP network by using a special form of IP address called the IP multicast group address. The sending host inserts the multicast group address into the IP destination address field of the packet, and IP multicast routers and multilayer switches forward incoming IP multicast packets out all interfaces that lead to members of the multicast group. Any host, regardless of whether it is a member of a group, can sent to a group. However, only the members of a group receive the message. To use this feature, the stack master must be running the enhanced multilayer image (EMI). Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This chapter consists of these sections: • Understanding Cisco’s Implementation of IP Multicast Routing, page 31-2 • Multicast Routing and Switch Stacks, page 31-8 • Configuring IP Multicast Routing, page 31-8 • Configuring Advanced PIM Features, page 31-23 • Configuring Optional IGMP Features, page 31-27 • Configuring Optional Multicast Routing Features, page 31-32 • Configuring Basic DVMRP Interoperability Features, page 31-37 • Configuring Advanced DVMRP Interoperability Features, page 31-42 • Monitoring and Maintaining IP Multicast Routing, page 31-50 For information on configuring the Multicast Source Discovery Protocol (MSDP), see Chapter 32, “Configuring MSDP.”31-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing The Cisco IOS software supports these protocols to implement IP multicast routing: • Internet Group Management Protocol (IGMP) is used among hosts on a LAN and the routers (and multilayer switches) on that LAN to track the multicast groups of which hosts are members. • Protocol-Independent Multicast (PIM) protocol is used among routers and multilayer switches to track which multicast packets to forward to each other and to their directly connected LANs. • Distance Vector Multicast Routing Protocol (DVMRP) is used on the multicast backbone of the Internet (MBONE). The software supports PIM-to-DVMRP interaction. • Cisco Group Management Protocol (CGMP) is used on Cisco routers and multilayer switches connected to Layer 2 Catalyst switches to perform tasks similar to those performed by IGMP. Figure 31-1 shows where these protocols operate within the IP multicast environment. Figure 31-1 IP Multicast Routing Protocols Understanding IGMP To participate in IP multicasting, multicast hosts, routers, and multilayer switches must have the IGMP operating. This protocol defines the querier and host roles: • A querier is a network device that sends query messages to discover which network devices are members of a given multicast group. • A host is a receiver that sends report messages (in response to query messages) to inform a querier of a host membership. A set of queriers and hosts that receive multicast data streams from the same source is called a multicast group. Queriers and hosts use IGMP messages to join and leave multicast groups. Any host, regardless of whether it is a member of a group, can send to a group. However, only the members of a group receive the message. Membership in a multicast group is dynamic; hosts can join and leave at any time. There is no restriction on the location or number of members in a multicast group. A host can be a member of more than one multicast group at a time. How active a multicast group is and Host Host PIM IGMP CGMP DVMRP Internet MBONE Cisco Catalyst switch (CGMP client) 4496631-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing what members it has can vary from group to group and from time to time. A multicast group can be active for a long time, or it can be very short-lived. Membership in a group can constantly change. A group that has members can have no activity. IP multicast traffic uses group addresses, which are class D addresses. The high-order bits of a Class D address are 1110. Therefore, host group addresses can be in the range 224.0.0.0 through 239.255.255.255. Multicast addresses in the range 224.0.0.0 to 24.0.0.255 are reserved for use by routing protocols and other network control traffic. The address 224.0.0.0 is guaranteed not to be assigned to any group. IGMP packets are sent using these IP multicast group addresses: • IGMP general queries are destined to the address 224.0.0.1 (all systems on a subnet). • IGMP group-specific queries are destined to the group IP address for which the switch is querying. • IGMP group membership reports are destined to the group IP address for which the switch is reporting. • IGMP Version 2 (IGMPv2) leave messages are destined to the address 224.0.0.2 (all-multicast-routers on a subnet). In some old host IP stacks, leave messages might be destined to the group IP address rather than to the all-routers address. IGMP Version 1 IGMP Version 1 (IGMPv1) primarily uses a query-response model that enables the multicast router and multilayer switch to determine which multicast groups are active (have one or more hosts interested in a multicast group) on the local subnet. IGMPv1 has other processes that enable a host to join and leave a multicast group. For more information, refer to RFC 1112. IGMP Version 2 IGMPv2 extends IGMP functionality by providing such features as the IGMP leave process to reduce leave latency, group-specific queries, and an explicit maximum query response time. IGMPv2 also adds the capability for routers to elect the IGMP querier without depending on the multicast protocol to perform this task. For more information, refer to RFC 2236. Understanding PIM PIM is called protocol-independent: regardless of the unicast routing protocols used to populate the unicast routing table, PIM uses this information to perform multicast forwarding instead of maintaining a separate multicast routing table. PIM is defined in RFC 2362, Protocol-Independent Multicast-Sparse Mode (PIM-SM): Protocol Specification. PIM is defined in these Internet Engineering Task Force (IETF) Internet drafts: • Protocol Independent Multicast (PIM): Motivation and Architecture • Protocol Independent Multicast (PIM), Dense Mode Protocol Specification • Protocol Independent Multicast (PIM), Sparse Mode Protocol Specification • draft-ietf-idmr-igmp-v2-06.txt, Internet Group Management Protocol, Version 2 • draft-ietf-pim-v2-dm-03.txt, PIM Version 2 Dense Mode31-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing PIM Versions PIMv2 includes these improvements over PIMv1: • A single, active rendezvous point (RP) exists per multicast group, with multiple backup RPs. This single RP compares to multiple active RPs for the same group in PIMv1. • A bootstrap router (BSR) provides a fault-tolerant, automated RP discovery and distribution mechanism that enables routers and multilayer switches to dynamically learn the group-to-RP mappings. • Sparse mode and dense mode are properties of a group, as opposed to an interface. We strongly recommend sparse-dense mode, as opposed to either sparse mode or dense mode only. • PIM join and prune messages have more flexible encoding for multiple address families. • A more flexible hello packet format replaces the query packet to encode current and future capability options. • Register messages to an RP specify whether they are sent by a border router or a designated router. • PIM packets are no longer inside IGMP packets; they are standalone packets. PIM Modes PIM can operate in dense mode (DM), sparse mode (SM), or in sparse-dense mode (PIM DM-SM), which handles both sparse groups and dense groups at the same time. PIM DM PIM DM builds source-based multicast distribution trees. In dense mode, a PIM DM router or multilayer switch assumes that all other routers or multilayer switches forward multicast packets for a group. If a PIM DM device receives a multicast packet and has no directly connected members or PIM neighbors present, a prune message is sent back to the source to stop unwanted multicast traffic. Subsequent multicast packets are not flooded to this router or switch on this pruned branch because branches without receivers are pruned from the distribution tree, leaving only branches that contain receivers. When a new receiver on a previously pruned branch of the tree joins a multicast group, the PIM DM device detects the new receiver and immediately sends a graft message up the distribution tree toward the source. When the upstream PIM DM device receives the graft message, it immediately puts the interface on which the graft was received into the forwarding state so that the multicast traffic begins flowing to the receiver. PIM SM PIM SM uses shared trees and shortest-path-trees (SPTs) to distribute multicast traffic to multicast receivers in the network. In PIM SM, a router or multilayer switch assumes that other routers or switches do not forward multicast packets for a group, unless there is an explicit request for the traffic (join message). When a host joins a multicast group using IGMP, its directly connected PIM SM device sends PIM join messages toward the root, also known as the RP. This join message travels router-by-router toward the root, constructing a branch of the shared tree as it goes. The RP keeps track of multicast receivers. It also registers sources through register messages received from the source’s first-hop router (designated router [DR]) to complete the shared tree path from the source to the receiver. When using a shared tree, sources must send their traffic to the RP so that the traffic reaches all receivers. 31-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing Prune messages are sent up the distribution tree to prune multicast group traffic. This action permits branches of the shared tree or SPT that were created with explicit join messages to be torn down when they are no longer needed. Auto-RP This proprietary feature eliminates the need to manually configure the RP information in every router and multilayer switch in the network. For Auto-RP to work, you configure a Cisco router or multilayer switch as the mapping agent. It uses IP multicast to learn which routers or switches in the network are possible candidate RPs to receive candidate RP announcements. Candidate RPs periodically send multicast RP-announce messages to a particular group or group range to announce their availability. Mapping agents listen to these candidate RP announcements and use the information to create entries in their Group-to-RP mapping caches. Only one mapping cache entry is created for any Group-to-RP range received, even if multiple candidate RPs are sending RP announcements for the same range. As the RP-announce messages arrive, the mapping agent selects the router or switch with the highest IP address as the active RP and stores this RP address in the Group-to-RP mapping cache. Mapping agents periodically multicast the contents of their Group-to-RP mapping cache. Thus, all routers and switches automatically discover which RP to use for the groups they support. If a router or switch fails to receive RP-discovery messages and the Group-to-RP mapping information expires, it switches to a statically configured RP that was defined with the ip pim rp-address global configuration command. If no statically configured RP exists, the router or switch changes the group to dense-mode operation. Multiple RPs serve different group ranges or serve as hot backups of each other. Bootstrap Router PIMv2 BSR is another method to distribute group-to-RP mapping information to all PIM routers and multilayer switches in the network. It eliminates the need to manually configure RP information in every router and switch in the network. However, instead of using IP multicast to distribute group-to-RP mapping information, BSR uses hop-by-hop flooding of special BSR messages to distribute the mapping information. The BSR is elected from a set of candidate routers and switches in the domain that have been configured to function as BSRs. The election mechanism is similar to the root-bridge election mechanism used in bridged LANs. The BSR election is based on the BSR priority of the device contained in the BSR messages that are sent hop-by-hop through the network. Each BSR device examines the message and forwards out all interfaces only the message that has either a higher BSR priority than its BSR priority or the same BSR priority, but with a higher BSR IP address. Using this method, the BSR is elected. The elected BSR sends BSR messages with a TTL of 1. Neighboring PIMv2 routers or multilayer switches receive the BSR message and multicast it out all other interfaces (except the one on which it was received) with a TTL of 1. In this way, BSR messages travel hop-by-hop throughout the PIM domain. Because BSR messages contain the IP address of the current BSR, the flooding mechanism enables candidate RPs to automatically learn which device is the elected BSR. Candidate RPs send candidate RP advertisements showing the group range for which they are responsible to the BSR, which stores this information in its local candidate-RP cache. The BSR periodically advertises the contents of this cache in BSR messages to all other PIM devices in the domain. These messages travel hop-by-hop through the network to all routers and switches, which store the RP information in the BSR message in their local RP cache. The routers and switches select the same RP for a given group because they all use a common RP hashing algorithm.31-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing Multicast Forwarding and Reverse Path Check With unicast routing, routers and multilayer switches forward traffic through the network along a single path from the source to the destination host whose IP address appears in the destination address field of the IP packet. Each router and switch along the way makes a unicast forwarding decision, using the destination IP address in the packet, by looking up the destination address in the unicast routing table and forwarding the packet through the specified interface to the next hop toward the destination. With multicasting, the source is sending traffic to an arbitrary group of hosts represented by a multicast group address in the destination address field of the IP packet. To determine whether to forward or drop an incoming multicast packet, the router or multilayer switch uses a reverse path forwarding (RPF) check on the packet as follows and shown in Figure 31-2: 1. The router or multilayer switch examines the source address of the arriving multicast packet to determine whether the packet arrived on an interface that is on the reverse path back to the source. 2. If the packet arrives on the interface leading back to the source, the RPF check is successful and the packet is forwarded to all interfaces in the outgoing interface list (which might not be all interfaces on the router). 3. If the RPF check fails, the packet is discarded. Some multicast routing protocols, such as DVMRP, maintain a separate multicast routing table and use it for the RPF check. However, PIM uses the unicast routing table to perform the RPF check. Figure 31-2 shows Gigabit Ethernet interface 0/2 on stack member 1 receiving a multicast packet from source 151.10.3.21. A check of the routing table shows that the interface on the reverse path to the source is Gigabit Ethernet interface 0/1, not interface 0/2. Because the RPF check fails, the multilayer switch discards the packet. Another multicast packet from source 151.10.3.21 is received on interface 0/1, and the routing table shows this interface is on the reverse path to the source. Because the RPF check passes, the switch forwards the packet to all interfaces in the outgoing interface list. Figure 31-2 RPF Check Multicast packet from source 151.10.3.21 is forwarded. Multicast packet from source 151.10.3.21 packet is discarded. Routing Table Network Interface 151.10.0.0/16 Gigabit Ethernet 1/0/1 Gigabit Ethernet 1/0/1 198.14.32.0/32 Gigabit Ethernet 1/0/3 Gigabit Ethernet 1/0/3 204.1.16.0/24 Gigabit Ethernet 1/0/4 Gigabit Ethernet 1/0/4 Gigabit Ethernet 1/0/2 86509 Si31-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing PIM uses both source trees and RP-rooted shared trees to forward datagrams (described in the “PIM DM” section on page 31-4 and the “PIM SM” section on page 31-4). The RPF check is performed differently for each: • If a PIM router or multilayer switch has a source-tree state (that is, an (S,G) entry is present in the multicast routing table), it performs the RPF check against the IP address of the source of the multicast packet. • If a PIM router or multilayer switch has a shared-tree state (and no explicit source-tree state), it performs the RPF check on the RP address (which is known when members join the group). Sparse-mode PIM uses the RPF lookup function to determine where it needs to send joins and prunes: • (S,G) joins (which are source-tree states) are sent toward the source. • (*,G) joins (which are shared-tree states) are sent toward the RP. DVMRP and dense-mode PIM use only source trees and use RPF as previously described. Understanding DVMRP DVMRP is implemented in the equipment of many vendors and is based on the public-domain mrouted program. This protocol has been deployed in the MBONE and in other intradomain multicast networks. Cisco routers and multilayer switches run PIM and can forward multicast packets to and receive from a DVMRP neighbor. It is also possible to propagate DVMRP routes into and through a PIM cloud. The software propagates DVMRP routes and builds a separate database for these routes on each router and multilayer switch, but PIM uses this routing information to make the packet-forwarding decision. The software does not implement the complete DVMRP. However, it supports dynamic discovery of DVMRP routers and can interoperate with them over traditional media (such as Ethernet and FDDI) or over DVMRP-specific tunnels. DVMRP neighbors build a route table by periodically exchanging source network routing information in route-report messages. The routing information stored in the DVMRP routing table is separate from the unicast routing table and is used to build a source distribution tree and to perform multicast forward using RPF. DVMRP is a dense-mode protocol and builds a parent-child database using a constrained multicast model to build a forwarding tree rooted at the source of the multicast packets. Multicast packets are initially flooded down this source tree. If redundant paths are on the source tree, packets are not forwarded along those paths. Forwarding occurs until prune messages are received on those parent-child links, which further constrain the broadcast of multicast packets. Understanding CGMP This software release provides CGMP-server support on your switch; no client-side functionality is provided. The switch serves as a CGMP server for devices that do not support IGMP snooping but have CGMP-client functionality. CGMP is a protocol used on Cisco routers and multilayer switches connected to Layer 2 Catalyst switches to perform tasks similar to those performed by IGMP. CGMP permits Layer 2 group membership information to be communicated from the CGMP server to the switch. The switch can then can learn on which ports multicast members reside instead of flooding multicast traffic to all switch ports. (IGMP snooping is another method to constrain the flooding of multicast packets. For more information, see Chapter 18, “Configuring IGMP Snooping and MVR.”)31-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Multicast Routing and Switch Stacks CGMP is necessary because the Layer 2 switch cannot distinguish between IP multicast data packets and IGMP report messages, which are both at the MAC-level and are addressed to the same group address. Multicast Routing and Switch Stacks For all multicast routing protocols, the entire stack appears as a single router to the network and operates as a single multicast router. In a Catalyst 3750 switch stack, the routing master (stack master) performs these functions: • It is responsible for completing the IP multicast routing functions of the stack. It fully initializes and runs the IP multicast routing protocols. • It builds and maintains the multicast routing table for the entire stack. • It is responsible for distributing the multicast routing table to all stack members. The stack members perform these functions: • They act as multicast routing standby devices and are ready to take over if there is a stack master failure. If the stack master fails, all stack members delete their multicast routing tables. The newly elected stack master starts building the routing tables and distributes them to the stack members. Note If a stack master running the EMI fails and if the newly elected stack master is running the SMI, the switch stack will lose its multicast routing capability. For information about the stack master election process, see Chapter 5, “Managing Switch Stacks.” • They do not build multicast routing tables. Instead, they use the multicast routing table that is distributed by the stack master. Configuring IP Multicast Routing These sections describe how to configure IP multicast routing: • Default Multicast Routing Configuration, page 31-9 • Multicast Routing Configuration Guidelines, page 31-9 • Configuring Basic Multicast Routing, page 31-10 (required) • Configuring a Rendezvous Point, page 31-12 (required if the interface is in sparse-dense mode, and you want to treat the group as a sparse group) • Using Auto-RP and a BSR, page 31-22 (required for non-Cisco PIMv2 devices to interoperate with Cisco PIM v1 devices)) • Monitoring the RP Mapping Information, page 31-23 (optional) • Troubleshooting PIMv1 and PIMv2 Interoperability Problems, page 31-23 (optional)31-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Default Multicast Routing Configuration Table 31-1 shows the default multicast routing configuration. Multicast Routing Configuration Guidelines To avoid misconfiguring multicast routing on your switch, review the information in these sections: • PIMv1 and PIMv2 Interoperability, page 31-9 • Auto-RP and BSR Configuration Guidelines, page 31-10 PIMv1 and PIMv2 Interoperability The Cisco PIMv2 implementation provides interoperability and transition between Version 1 and Version 2, although there might be some minor problems. You can upgrade to PIMv2 incrementally. PIM Versions 1 and 2 can be configured on different routers and multilayer switches within one network. Internally, all routers and multilayer switches on a shared media network must run the same PIM version. Therefore, if a PIMv2 device detects a PIMv1 device, the Version 2 device downgrades itself to Version 1 until all Version 1 devices have been shut down or upgraded. PIMv2 uses the BSR to discover and announce RP-set information for each group prefix to all the routers and multilayer switches in a PIM domain. PIMv1, together with the Auto-RP feature, can perform the same tasks as the PIMv2 BSR. However, Auto-RP is a standalone protocol, separate from PIMv1, and is a proprietary Cisco protocol. PIMv2 is a standards track protocol in the IETF. We recommend that you use PIMv2. The BSR mechanism interoperates with Auto-RP on Cisco routers and multilayer switches. For more information, see the “Auto-RP and BSR Configuration Guidelines” section on page 31-10. When PIMv2 devices interoperate with PIMv1 devices, Auto-RP should have already been deployed. A PIMv2 BSR that is also an Auto-RP mapping agent automatically advertises the RP elected by Auto-RP. That is, Auto-RP sets its single RP on every router or multilayer switch in the group. Not all routers and switches in the domain use the PIMv2 hash function to select multiple RPs. Dense-mode groups in a mixed PIMv1 and PIMv2 region need no special configuration; they automatically interoperate. Table 31-1 Default Multicast Routing Configuration Feature Default Setting Multicast routing Disabled on all interfaces. PIM version Version 2. PIM mode No mode is defined. PIM RP address None configured. PIM domain border Disabled. PIM multicast boundary None. Candidate BSRs Disabled. Candidate RPs Disabled. Shortest-path tree threshold rate 0 kbps. PIM router query message interval 30 seconds.31-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Sparse-mode groups in a mixed PIMv1 and PIMv2 region are possible because the Auto-RP feature in PIMv1 interoperates with the PIMv2 RP feature. Although all PIMv2 devices can also use PIMv1, we recommend that the RPs be upgraded to PIMv2. To ease the transition to PIMv2, we have these recommendations: • Use Auto-RP throughout the region. • Configure sparse-dense mode throughout the region. If Auto-RP is not already configured in the PIMv1 regions, configure Auto-RP. For more information, see the “Configuring Auto-RP” section on page 31-14. Auto-RP and BSR Configuration Guidelines There are two approaches to using PIMv2. You can use Version 2 exclusively in your network or migrate to Version 2 by employing a mixed PIM version environment. • If your network is all Cisco routers and multilayer switches, you can use either Auto-RP or BSR. • If you have non-Cisco routers in your network, you must use BSR. • If you have Cisco PIMv1 and PIMv2 routers and multilayer switches and non-Cisco routers, you must use both Auto-RP and BSR. If your network includes routers from other vendors, configure the Auto-RP mapping agent and the BSR on a Cisco PIMv2 device. Ensure that no PIMv1 device is located in the path a between the BSR and a non-Cisco PIMv2 device. • Because bootstrap messages are sent hop-by-hop, a PIMv1 device prevents these messages from reaching all routers and multilayer switches in your network. Therefore, if your network has a PIMv1 device in it and only Cisco routers and multilayer switches, it is best to use Auto-RP. • If you have a network that includes non-Cisco routers, configure the Auto-RP mapping agent and the BSR on a Cisco PIMv2 router or multilayer switch. Ensure that no PIMv1 device is on the path between the BSR and a non-Cisco PIMv2 router. • If you have non-Cisco PIMv2 routers that need to interoperate with Cisco PIMv1 routers and multilayer switches, both Auto-RP and a BSR are required. We recommend that a Cisco PIMv2 device be both the Auto-RP mapping agent and the BSR. For more information, see the “Using Auto-RP and a BSR” section on page 31-22. Configuring Basic Multicast Routing You must enable IP multicast routing and configure the PIM version and PIM mode so that the software can forward multicast packets and determine how the switch populates its multicast routing table. You can configure an interface to be in PIM dense mode, sparse mode, or sparse-dense mode. The mode determines how the switch populates its multicast routing table and how it forwards multicast packets it receives from its directly connected LANs. You must enable PIM in one of these modes for an interface to perform IP multicast routing. Enabling PIM on an interface also enables IGMP operation on that interface. In populating the multicast routing table, dense-mode interfaces are always added to the table. Sparse-mode interfaces are added to the table only when periodic join messages are received from downstream devices or when there is a directly connected member on the interface. When forwarding from a LAN, sparse-mode operation occurs if there is an RP known for the group. If so, the packets are encapsulated and sent toward the RP. When no RP is known, the packet is flooded in a dense-mode fashion. If the multicast traffic from a specific source is sufficient, the receiver’s first-hop router might send join messages toward the source to build a source-based distribution tree.31-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing By default, multicast routing is disabled, and there is no default mode setting. This procedure is required. Beginning in privileged EXEC mode, follow these steps to enable IP multicasting, to configure a PIM version, and to configure a PIM mode. This procedure is required. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip multicast-routing distributed Enable IP multicast distributed switching. Step 3 interface interface-id Enter interface configuration mode, and specify the Layer 3 interface on which you want to enable multicast routing. The specified interface must be one of the following: • A routed port: a physical port that has been configured as a Layer 3 port by entering the no switchport interface configuration command. • An SVI: a VLAN interface created by using the interface vlan vlan-id global configuration command. These ports must have IP addresses assigned to them. For more information, see the “Configuring Layer 3 Interfaces” section on page 11-18. Step 4 ip pim version [1 | 2] Configure the PIM version on the interface. By default, Version 2 is enabled and is the recommended setting. An interface in PIMv2 mode automatically downgrades to PIMv1 mode if that interface has a PIMv1 neighbor. The interface returns to Version 2 mode after all Version 1 neighbors are shut down or upgraded. For more information, see the “PIMv1 and PIMv2 Interoperability” section on page 31-9. Step 5 ip pim {dense-mode | sparse-mode | sparse-dense-mode} Enable a PIM mode on the interface. By default, no mode is configured. The keywords have these meanings: • dense-mode—Enables dense mode of operation. • sparse-mode—Enables sparse mode of operation. If you configure sparse-mode, you must also configure an RP. For more information, see the “Configuring a Rendezvous Point” section on page 31-12. • sparse-dense-mode—Causes the interface to be treated in the mode in which the group belongs. Sparse-dense-mode is the recommended setting. Note After you enable a PIM mode on the interface, the ip mroute-cache distributed interface configuration command is automatically entered for the interface and appears in the running configuration. Step 6 end Return to privileged EXEC mode. Step 7 show running-config Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file.31-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing To disable multicasting, use the no ip multicast-routing distributed global configuration command. To return to the default PIM version, use the no ip pim version interface configuration command. To disable PIM on an interface, use the no ip pim interface configuration command. Configuring a Rendezvous Point You must have an RP if the interface is in sparse-dense mode and if you want to treat the group as a sparse group. You can use several methods, as described in these sections: • Manually Assigning an RP to Multicast Groups, page 31-12 • Configuring Auto-RP, page 31-14 (a standalone, Cisco-proprietary protocol separate from PIMv1) • Configuring PIMv2 BSR, page 31-18 (a standards track protocol in the Internet Engineering Task Force (IETF) You can use Auto-RP, BSR, or a combination of both, depending on the PIM version you are running and the types of routers in your network. For more information, see the “PIMv1 and PIMv2 Interoperability” section on page 31-9 and the “Auto-RP and BSR Configuration Guidelines” section on page 31-10. Manually Assigning an RP to Multicast Groups This section explains how to manually configure an RP. If the RP for a group is learned through a dynamic mechanism (such as Auto-RP or BSR), you need not perform this task for that RP. Senders of multicast traffic announce their existence through register messages received from the source’s first-hop router (designated router) and forwarded to the RP. Receivers of multicast packets use RPs to join a multicast group by using explicit join messages. RPs are not members of the multicast group; rather, they serve as a meeting place for multicast sources and group members. You can configure a single RP for multiple groups defined by an access list. If there is no RP configured for a group, the multilayer switch treats the group as dense and uses the dense-mode PIM techniques. Beginning in privileged EXEC mode, follow these steps to manually configure the address of the RP. This procedure is optional.31-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing To remove an RP address, use the no ip pim rp-address ip-address [access-list-number] [override] global configuration command. This example shows how to configure the address of the RP to 147.106.6.22 for multicast group 225.2.2.2 only: Switch(config)# access-list 1 permit 225.2.2.2 0.0.0.0 Switch(config)# ip pim rp-address 147.106.6.22 1 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip pim rp-address ip-address [access-list-number] [override] Configure the address of a PIM RP. By default, no PIM RP address is configured. You must configure the IP address of RPs on all routers and multilayer switches (including the RP). If there is no RP configured for a group, the switch treats the group as dense, using the dense-mode PIM techniques. A PIM device can be an RP for more than one group. Only one RP address can be used at a time within a PIM domain. The conditions specified by the access list determine for which groups the device is an RP. • For ip-address, enter the unicast address of the RP in dotted-decimal notation. • (Optional) For access-list-number, enter an IP standard access list number from 1 to 99. If no access list is configured, the RP is used for all groups. • (Optional) The override keyword means that if there is a conflict between the RP configured with this command and one learned by Auto-RP or BSR, the RP configured with this command prevails. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the multicast group address for which the RP should be used. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Configuring Auto-RP Auto-RP uses IP multicast to automate the distribution of group-to-RP mappings to all Cisco routers and multilayer switches in a PIM network. It has these benefits: • It is easy to use multiple RPs within a network to serve different group ranges. • It provides load splitting among different RPs and arrangement of RPs according to the location of group participants. • It avoids inconsistent, manual RP configurations on every router and multilayer switch in a PIM network, which can cause connectivity problems. Note If you configure PIM in sparse mode or sparse-dense mode and do not configure Auto-RP, you must manually configure an RP as described in the “Manually Assigning an RP to Multicast Groups” section on page 31-12. Note If routed interfaces are configured in sparse mode, Auto-RP can still be used if all devices are configured with a manual RP address for the Auto-RP groups. These sections describe how to configure Auto-RP: • Setting up Auto-RP in a New Internetwork, page 31-14 (optional) • Adding Auto-RP to an Existing Sparse-Mode Cloud, page 31-14 (optional) • Preventing Join Messages to False RPs, page 31-16 (optional) • Filtering Incoming RP Announcement Messages, page 31-17 (optional) For overview information, see the “Auto-RP” section on page 31-5. Setting up Auto-RP in a New Internetwork If you are setting up Auto-RP in a new internetwork, you do not need a default RP because you configure all the interfaces for sparse-dense mode. Follow the process described in the next section “Adding Auto-RP to an Existing Sparse-Mode Cloud” section on page 31-14. However, skip Step 3 to configure a PIM router as the RP for the local group. Adding Auto-RP to an Existing Sparse-Mode Cloud This section contains some suggestions for the initial deployment of Auto-RP into an existing sparse-mode cloud to minimize disruption of the existing multicast infrastructure. Beginning in privileged EXEC mode, follow these steps to deploy Auto-RP in an existing sparse-mode cloud. This procedure is optional.31-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Command Purpose Step 1 show running-config Verify that a default RP is already configured on all PIM devices and the RP in the sparse-mode network. It was previously configured with the ip pim rp-address global configuration command. This step is not required for spare-dense-mode environments. The selected RP should have good connectivity and be available across the network. Use this RP for the global groups (for example 224.x.x.x and other global groups). Do not reconfigure the group address range that this RP serves. RPs dynamically discovered through Auto-RP take precedence over statically configured RPs. Assume that it is desirable to use a second RP for the local groups. Step 2 configure terminal Enter global configuration mode. Step 3 ip pim send-rp-announce interface-id scope ttl group-list access-list-number interval seconds Configure another PIM device to be the candidate RP for local groups. • For interface-id, enter the interface type and number that identifies the RP address. Valid interfaces include physical ports, port channels, and VLANs. • For scope ttl, specify the time-to-live value in hops. Enter a hop count that is high enough so that the RP-announce messages reach all mapping agents in the network. There is no default setting. The range is 1 to 255. • For group-list access-list-number, enter an IP standard access list number from 1 to 99. If no access list is configured, the RP is used for all groups. • For interval seconds, specify how often the announcement messages must be sent. The default is 60 seconds. The range is 1 to 16383. Step 4 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 3. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the multicast group address range for which the RP should be used. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything.31-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing To remove the PIM device configured as the candidate RP, use the no ip pim send-rp-announce interface-id global configuration command. To remove the switch as the RP-mapping agent, use the no ip pim send-rp-discovery global configuration command. This example shows how to send RP announcements out all PIM-enabled interfaces for a maximum of 31 hops. The IP address of Gigabit Ethernet interface 0/1 on stack member 1 is the RP. Access list 5 describes the group for which this switch serves as RP: Switch(config)# ip pim send-rp-announce gigabitethernet1/0/1 scope 31 group-list 5 Switch(config)# access-list 5 permit 224.0.0.0 15.255.255.255 Preventing Join Messages to False RPs Determine whether the ip pim accept-rp command was previously configured throughout the network by using the show running-config privileged EXEC command. If the ip pim accept-rp command is not configured on any device, this problem can be addressed later. In those routers or multilayer switches already configured with the ip pim accept-rp command, you must enter the command again to accept the newly advertised RP. To accept all RPs advertised with Auto-RP and reject all other RPs by default, use the ip pim accept-rp auto-rp global configuration command. This procedure is optional. If all interfaces are in sparse mode, use a default-configured RP to support the two well-known groups 224.0.1.39 and 224.0.1.40. Auto-RP uses these two well-known groups to collect and distribute RP-mapping information. When this is the case and the ip pim accept-rp auto-rp command is configured, another ip pim accept-rp command accepting the RP must be configured as follows: Switch(config)# ip pim accept-rp 172.10.20.1 1 Switch(config)# access-list 1 permit 224.0.1.39 Switch(config)# access-list 1 permit 224.0.1.40 Step 5 ip pim send-rp-discovery scope ttl Find a switch whose connectivity is not likely to be interrupted, and assign it the role of RP-mapping agent. For scope ttl, specify the time-to-live value in hops to limit the RP discovery packets. All devices within the hop count from the source device receive the Auto-RP discovery messages. These messages tell other devices which group-to-RP mapping to use to avoid conflicts (such as overlapping group-to-RP ranges). There is no default setting. The range is 1 to 255. Step 6 end Return to privileged EXEC mode. Step 7 show running-config show ip pim rp mapping show ip pim rp Verify your entries. Display active RPs that are cached with associated multicast routing entries. Display the information cached in the routing table. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose31-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Filtering Incoming RP Announcement Messages You can add configuration commands to the mapping agents to prevent a maliciously configured router from masquerading as a candidate RP and causing problems. Beginning in privileged EXEC mode, follow these steps to filter incoming RP announcement messages. This procedure is optional. To remove a filter on incoming RP announcement messages, use the no ip pim rp-announce-filter rp-list access-list-number [group-list access-list-number] global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip pim rp-announce-filter rp-list access-list-number group-list access-list-number Filter incoming RP announcement messages. Enter this command on each mapping agent in the network. Without this command, all incoming RP-announce messages are accepted by default. For rp-list access-list-number, configure an access list of candidate RP addresses that, if permitted, is accepted for the group ranges supplied in the group-list access-list-number variable. If this variable is omitted, the filter applies to all multicast groups. If more than one mapping agent is used, the filters must be consistent across all mapping agents to ensure that no conflicts occur in the Group-to-RP mapping information. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • Create an access list that specifies from which routers and multilayer switches the mapping agent accepts candidate RP announcements (rp-list ACL). • Create an access list that specifies the range of multicast groups from which to accept or deny (group-list ACL). • For source, enter the multicast group address range for which the RP should be used. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing This example shows a sample configuration on an Auto-RP mapping agent that is used to prevent candidate RP announcements from being accepted from unauthorized candidate RPs: Switch(config)# ip pim rp-announce-filter rp-list 10 group-list 20 Switch(config)# access-list 10 permit host 172.16.5.1 Switch(config)# access-list 10 permit host 172.16.2.1 Switch(config)# access-list 20 deny 239.0.0.0 0.0.255.255 Switch(config)# access-list 20 permit 224.0.0.0 15.255.255.255 In this example, the mapping agent accepts candidate RP announcements from only two devices, 172.16.5.1 and 172.16.2.1. The mapping agent accepts candidate RP announcements from these two devices only for multicast groups that fall in the group range of 224.0.0.0 to 239.255.255.255. The mapping agent does not accept candidate RP announcements from any other devices in the network. Furthermore, the mapping agent does not accept candidate RP announcements from 172.16.5.1 or 172.16.2.1 if the announcements are for any groups in the 239.0.0.0 through 239.255.255.255 range. This range is the administratively scoped address range. Configuring PIMv2 BSR These sections describe how to set up BSR in your PIMv2 network: • Defining the PIM Domain Border, page 31-18 (optional) • Defining the IP Multicast Boundary, page 31-19 (optional) • Configuring Candidate BSRs, page 31-20 (optional) • Configuring Candidate RPs, page 31-21 (optional) For overview information, see the “Bootstrap Router” section on page 31-5. Defining the PIM Domain Border As IP multicast becomes more widespread, the chance of one PIMv2 domain bordering another PIMv2 domain is increasing. Because these two domains probably do not share the same set of RPs, BSR, candidate RPs, and candidate BSRs, you need to constrain PIMv2 BSR messages from flowing into or out of the domain. Allowing these messages to leak across the domain borders could adversely affect the normal BSR election mechanism and elect a single BSR across all bordering domains and co-mingle candidate RP advertisements, resulting in the election of RPs in the wrong domain. Beginning in privileged EXEC mode, follow these steps to define the PIM domain border. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip pim bsr-border Define a PIM bootstrap message boundary for the PIM domain. Enter this command on each interface that connects to other bordering PIM domains. This command instructs the switch to neither send or receive PIMv2 BSR messages on this interface as shown in Figure 31-3. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing To remove the PIM border, use the no ip pim bsr-border interface configuration command. Figure 31-3 Constraining PIMv2 BSR Messages Defining the IP Multicast Boundary You define a multicast boundary to prevent Auto-RP messages from entering the PIM domain. You create an access list to deny packets destined for 224.0.1.39 and 224.0.1.40, which carry Auto-RP information. Beginning in privileged EXEC mode, follow these steps to define a multicast boundary. This procedure is optional. Si Si 45151 PIMv2 sparse-mode network BSR BSR messages Neighboring PIMv2 domain Neighboring Border PIMv2 domain router Border router A B Configure the ip pim bsr-border command on this interface. Configure the ip pim bsr-border command on this interface. BSR messages Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number deny source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. • For source, enter multicast addresses 224.0.1.39 and 224.0.1.40, which carry Auto-RP information. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 3 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 4 ip multicast boundary access-list-number Configure the boundary, specifying the access list you created in Step 2. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.31-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing To remove the boundary, use the no ip multicast boundary interface configuration command. This example shows a portion of an IP multicast boundary configuration that denies Auto-RP information: Switch(config)# access-list 1 deny 224.0.1.39 Switch(config)# access-list 1 deny 224.0.1.40 Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip multicast boundary 1 Configuring Candidate BSRs You can configure one or more candidate BSRs. The devices serving as candidate BSRs should have good connectivity to other devices and be in the backbone portion of the network. Beginning in privileged EXEC mode, follow these steps to configure your switch as a candidate BSR. This procedure is optional. To remove this device as a candidate BSR, use the no ip pim bsr-candidate global configuration command. This example shows how to configure a candidate BSR, which uses the IP address 172.21.24.18 on Gigabit Ethernet interface 0/2 on stack member 1 as the advertised BSR address, uses 30 bits as the hash-mask-length, and has a priority of 10. Switch(config)# interface gigabitethernet1/0/2 Switch(config-if)# ip address 172.21.24.18 255.255.255.0 Switch(config-if)# ip pim sparse-dense-mode Switch(config-if)# ip pim bsr-candidate gigabitethernet1/0/2 30 10 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip pim bsr-candidate interface-id hash-mask-length [priority] Configure your switch to be a candidate BSR. • For interface-id, enter the interface on this switch from which the BSR address is derived to make it a candidate. This interface must be enabled with PIM. Valid interfaces include physical ports, port channels, and VLANs. • For hash-mask-length, specify the mask length (32 bits maximum) that is to be ANDed with the group address before the hash function is called. All groups with the same seed hash correspond to the same RP. For example, if this value is 24, only the first 24 bits of the group addresses matter. • (Optional) For priority, enter a number from 0 to 255. The BSR with the larger priority is preferred. If the priority values are the same, the device with the highest IP address is selected as the BSR. The default is 0. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.31-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing Configuring Candidate RPs You can configure one or more candidate RPs. Similar to BSRs, the RPs should also have good connectivity to other devices and be in the backbone portion of the network. An RP can serve the entire IP multicast address space or a portion of it. Candidate RPs send candidate RP advertisements to the BSR. When deciding which devices should be RPs, consider these options: • In a network of Cisco routers and multilayer switches where only Auto-RP is used, any device can be configured as an RP. • In a network that includes only Cisco PIMv2 routers and multilayer switches and with routers from other vendors, any device can be used as an RP. • In a network of Cisco PIMv1 routers, Cisco PIMv2 routers, and routers from other vendors, configure only Cisco PIMv2 routers and multilayer switches as RPs. Beginning in privileged EXEC mode, follow these steps to configure your switch to advertise itself as a PIMv2 candidate RP to the BSR. This procedure is optional. To remove this device as a candidate RP, use the no ip pim rp-candidate interface-id global configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip pim rp-candidate interface-id [group-list access-list-number] Configure your switch to be a candidate RP. • For interface-id, specify the interface whose associated IP address is advertised as a candidate RP address. Valid interfaces include physical ports, port channels, and VLANs. • (Optional) For group-list access-list-number, enter an IP standard access list number from 1 to 99. If no group-list is specified, the switch is a candidate RP for all groups. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, enter the access list number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the number of the network or host from which the packet is being sent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring IP Multicast Routing This example shows how to configure the switch to advertise itself as a candidate RP to the BSR in its PIM domain. Standard access list number 4 specifies the group prefix associated with the RP that has the address identified by Gigabit Ethernet interface0/2 on stack member 1. That RP is responsible for the groups with the prefix 239. Switch(config)# ip pim rp-candidate gigabitethernet1/0/2 group-list 4 Switch(config)# access-list 4 permit 239.0.0.0 0.255.255.255 Using Auto-RP and a BSR If there are only Cisco devices in you network (no routers from other vendors), there is no need to configure a BSR. Configure Auto-RP in a network that is running both PIMv1 and PIMv2. If you have non-Cisco PIMv2 routers that need to interoperate with Cisco PIMv1 routers and multilayer switches, both Auto-RP and a BSR are required. We recommend that a Cisco PIMv2 router or multilayer switch be both the Auto-RP mapping agent and the BSR. If you must have one or more BSRs, we have these recommendations: • Configure the candidate BSRs as the RP-mapping agents for Auto-RP. For more information, see the “Configuring Auto-RP” section on page 31-14 and the “Configuring Candidate BSRs” section on page 31-20. • For group prefixes advertised through Auto-RP, the PIMv2 BSR mechanism should not advertise a subrange of these group prefixes served by a different set of RPs. In a mixed PIMv1 and PIMv2 domain, have backup RPs serve the same group prefixes. This prevents the PIMv2 DRs from selecting a different RP from those PIMv1 DRs, due to the longest match lookup in the RP-mapping database. Beginning in privileged EXEC mode, follow these steps to verify the consistency of group-to-RP mappings. This procedure is optional. Command Purpose Step 1 show ip pim rp [[group-name | group-address] | mapping] On any Cisco device, display the available RP mappings. • (Optional) For group-name, specify the name of the group about which to display RPs. • (Optional) For group-address, specify the address of the group about which to display RPs. • (Optional) Use the mapping keyword to display all group-to-RP mappings of which the Cisco device is aware (either configured or learned from Auto-RP). Step 2 show ip pim rp-hash group On a PIMv2 router or multilayer switch, confirm that the same RP is the one that a PIMv1 system chooses. For group, enter the group address for which to display RP information.31-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced PIM Features Monitoring the RP Mapping Information To monitor the RP mapping information, use these commands in privileged EXEC mode: • show ip pim bsr displays information about the elected BSR. • show ip pim rp-hash group displays the RP that was selected for the specified group. • show ip pim rp [group-name | group-address | mapping] displays how the switch learns of the RP (through the BSR or the Auto-RP mechanism). Troubleshooting PIMv1 and PIMv2 Interoperability Problems When debugging interoperability problems between PIMv1 and PIMv2, check these in the order shown: 1. Verify RP mapping with the show ip pim rp-hash privileged EXEC command, making sure that all systems agree on the same RP for the same group. 2. Verify interoperability between different versions of DRs and RPs. Make sure the RPs are interacting with the DRs properly (by responding with register-stops and forwarding decapsulated data packets from registers). Configuring Advanced PIM Features These sections describe the optional advanced PIM features: • Understanding PIM Shared Tree and Source Tree, page 31-23 • Delaying the Use of PIM Shortest-Path Tree, page 31-25 (optional) • Modifying the PIM Router-Query Message Interval, page 31-26 (optional) Understanding PIM Shared Tree and Source Tree By default, members of a group receive data from senders to the group across a single data-distribution tree rooted at the RP. Figure 31-4 shows this type of shared-distribution tree. Data from senders is delivered to the RP for distribution to group members joined to the shared tree. 31-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced PIM Features Figure 31-4 Shared Tree and Source Tree (Shortest-Path Tree) If the data rate warrants, leaf routers (routers without any downstream connections) on the shared tree can use the data distribution tree rooted at the source. This type of distribution tree is called a shortest-path tree or source tree. By default, the software switches to a source tree upon receiving the first data packet from a source. This process describes the move from a shared tree to a source tree: 1. A receiver joins a group; leaf Router C sends a join message toward the RP. 2. The RP puts a link to Router C in its outgoing interface list. 3. A source sends data; Router A encapsulates the data in a register message and sends it to the RP. 4. The RP forwards the data down the shared tree to Router C and sends a join message toward the source. At this point, data might arrive twice at Router C, once encapsulated and once natively. 5. When data arrives natively (unencapsulated) at the RP, it sends a register-stop message to Router A. 6. By default, reception of the first data packet prompts Router C to send a join message toward the source. 7. When Router C receives data on (S,G), it sends a prune message for the source up the shared tree. 8. The RP deletes the link to Router C from the outgoing interface of (S,G). The RP triggers a prune message toward the source. Join and prune messages are sent for sources and RPs. They are sent hop-by-hop and are processed by each PIM device along the path to the source or RP. Register and register-stop messages are not sent hop-by-hop. They are sent by the designated router that is directly connected to a source and are received by the RP for the group. Multiple sources sending to groups use the shared tree. You can configure the PIM device to stay on the shared tree. For more information, see the “Delaying the Use of PIM Shortest-Path Tree” section on page 31-25. Router A Source Receiver Router C RP Router B Shared tree from RP Source tree (shortest path tree) 4496731-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced PIM Features Delaying the Use of PIM Shortest-Path Tree The change from shared to source tree happens when the first data packet arrives at the last-hop router (Router C in Figure 31-4). This change occurs because the ip pim spt-threshold global configuration command controls that timing. The shortest-path tree requires more memory than the shared tree but reduces delay. You might want to postpone its use. Instead of allowing the leaf router to immediately move to the shortest-path tree, you can specify that the traffic must first reach a threshold. You can configure when a PIM leaf router should join the shortest-path tree for a specified group. If a source sends at a rate greater than or equal to the specified kbps rate, the multilayer switch triggers a PIM join message toward the source to construct a source tree (shortest-path tree). If the traffic rate from the source drops below the threshold value, the leaf router switches back to the shared tree and sends a prune message toward the source. You can specify to which groups the shortest-path tree threshold applies by using a group list (a standard access list). If a value of 0 is specified or if the group list is not used, the threshold applies to all groups. Beginning in privileged EXEC mode, follow these steps to configure a traffic rate threshold that must be reached before multicast routing is switched from the source tree to the shortest-path tree. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, specify the multicast group to which the threshold will apply. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 3 ip pim spt-threshold {kbps | infinity} [group-list access-list-number] Specify the threshold that must be reached before moving to shortest-path tree (spt). • For kbps, specify the traffic rate in kilobits per second. The default is 0 kbps. Note Because of Catalyst 3750 hardware limitations, 0 kbps is the only valid entry even though the range is 0 to 4294967. • Specify infinity if you want all sources for the specified group to use the shared tree, never switching to the source tree. • (Optional) For group-list access-list-number, specify the access list created in Step 2. If the value is 0 or if the group-list is not used, the threshold applies to all groups.31-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced PIM Features To return to the default setting, use the no ip pim spt-threshold {kbps | infinity} global configuration command. Modifying the PIM Router-Query Message Interval PIM routers and multilayer switches send PIM router-query messages to determine which device will be the DR for each LAN segment (subnet). The DR is responsible for sending IGMP host-query messages to all hosts on the directly connected LAN. With PIM DM operation, the DR has meaning only if IGMPv1 is in use. IGMPv1 does not have an IGMP querier election process, so the elected DR functions as the IGMP querier. With PIM SM operation, the DR is the device that is directly connected to the multicast source. It sends PIM register messages to notify the RP that multicast traffic from a source needs to be forwarded down the shared tree. In this case, the DR is the device with the highest IP address. Beginning in privileged EXEC mode, follow these steps to modify the router-query message interval. This procedure is optional. To return to the default setting, use the no ip pim query-interval [seconds] interface configuration command. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip pim query-interval seconds Configure the frequency at which the switch sends PIM router-query messages. The default is 30 seconds. The range is 1 to 65535. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional IGMP Features Configuring Optional IGMP Features These sections describe how to configure optional IGMP features: • Default IGMP Configuration, page 31-27 • Configuring the Switch as a Member of a Group, page 31-27 (optional) • Controlling Access to IP Multicast Groups, page 31-28 (optional) • Changing the IGMP Version, page 31-29 (optional) • Modifying the IGMP Host-Query Message Interval, page 31-30 (optional) • Changing the IGMP Query Timeout for IGMPv2, page 31-31 (optional) • Changing the Maximum Query Response Time for IGMPv2, page 31-31 (optional) • Configuring the Switch as a Statically Connected Member, page 31-32 (optional) Default IGMP Configuration Table 31-2 shows the default IGMP configuration. Configuring the Switch as a Member of a Group You can configure the switch as a member of a multicast group. This is useful to determine multicast reachability in a network. If all the multicast-capable routers and multilayer switches that you administer are members of a multicast group, pinging that group causes all these devices to respond. The devices respond to ICMP echo-request packets addressed to a group of which they are members. Another example is the multicast trace-route tools provided in the software. Caution Performing this procedure might impact the CPU performance because the CPU will receive all data traffic for the group address. Table 31-2 Default IGMP Configuration Feature Default Setting Multilayer switch as a member of a multicast group No group memberships are defined. Access to multicast groups All groups are allowed on an interface. IGMP version Version 2 on all interfaces. IGMP host-query message interval 60 seconds on all interfaces. IGMP query timeout 60 seconds on all interfaces. IGMP maximum query response time 10 seconds on all interfaces. Multilayer switch as a statically connected member Disabled.31-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional IGMP Features Beginning in privileged EXEC mode, follow these steps to configure the switch to be a member of a group. This procedure is optional. To cancel membership in a group, use the no ip igmp join-group group-address interface configuration command. This example shows how to enable the switch to join multicast group 255.2.2.2: Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip igmp join-group 255.2.2.2 Controlling Access to IP Multicast Groups The switch sends IGMP host-query messages to determine which multicast groups have members on attached local networks. The switch then forwards to these group members all packets addressed to the multicast group. You can place a filter on each interface to restrict the multicast groups that hosts on the subnet serviced by the interface can join. Beginning in privileged EXEC mode, follow these steps to filter multicast groups allowed on an interface. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp join-group group-address Configure the switch to join a multicast group. By default, no group memberships are defined. For group-address, specify the multicast IP address in dotted decimal notation. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp access-group access-list-number Specify the multicast groups that hosts on the subnet serviced by an interface can join. By default, all groups are allowed on an interface. For access-list-number, specify an IP standard access list number. The range is 1 to 99. Step 4 exit Return to global configuration mode.31-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional IGMP Features To disable groups on an interface, use the no ip igmp access-group interface configuration command. This example shows how to configure hosts attached to Gigabit Ethernet interface 0/1 on stack member 1 as able to join only group 255.2.2.2: Switch(config)# access-list 1 255.2.2.2 0.0.0.0 Switch(config-if)# interface gigabitethernet1/0/1 Switch(config-if)# ip igmp access-group 1 Changing the IGMP Version By default, the switch uses IGMP Version 2, which provides features such as the IGMP query timeout and the maximum query response time. All systems on the subnet must support the same version. The switch does not automatically detect Version 1 systems and switch to Version 1. You can mix Version 1 and Version 2 hosts on the subnet because Version 2 routers or switches always work correctly with IGMPv1 hosts. Configure the switch for Version 1 if your hosts do not support Version 2. Beginning in privileged EXEC mode, follow these steps to change the IGMP version. This procedure is optional. Step 5 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list. • For access-list-number, specify the access list created in Step 3. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, specify the multicast group that hosts on the subnet can join. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 6 end Return to privileged EXEC mode. Step 7 show ip igmp interface [interface-id] Verify your entries. Step 8 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp version {1 | 2} Specify the IGMP version that the switch uses. Note If you change to Version 1, you cannot configure the ip igmp query-interval or the ip igmp query-max-response-time interface configuration commands.31-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional IGMP Features To return to the default setting, use the no ip igmp version interface configuration command. Modifying the IGMP Host-Query Message Interval The switch periodically sends IGMP host-query messages to discover which multicast groups are present on attached networks. These messages are sent to the all-hosts multicast group (224.0.0.1) with a time-to-live (TTL) of 1. The switch sends host-query messages to refresh its knowledge of memberships present on the network. If, after some number of queries, the software discovers that no local hosts are members of a multicast group, the software stops forwarding multicast packets to the local network from remote origins for that group and sends a prune message upstream toward the source. The switch elects a PIM designated router (DR) for the LAN (subnet). The DR is the router or multilayer switch with the highest IP address for IGMPv2. For IGMPv1, the DR is elected according to the multicast routing protocol that runs on the LAN. The designated router is responsible for sending IGMP host-query messages to all hosts on the LAN. In sparse mode, the designated router also sends PIM register and PIM join messages toward the RP router. Beginning in privileged EXEC mode, follow these steps to modify the host-query interval. This procedure is optional. To return to the default setting, use the no ip igmp query-interval interface configuration command. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp query-interval seconds Configure the frequency at which the designated router sends IGMP host-query messages. By default, the designated router sends IGMP host-query messages every 60 seconds to keep the IGMP overhead very low on hosts and networks. The range is 1 to 65535. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional IGMP Features Changing the IGMP Query Timeout for IGMPv2 If you are using IGMPv2, you can specify the period of time before the switch takes over as the querier for the interface. By default, the switch waits twice the query interval controlled by the ip igmp query-interval interface configuration command. After that time, if the switch has received no queries, it becomes the querier. You can determine the query interval by entering the show ip igmp interface interface-id privileged EXEC command. Beginning in privileged EXEC mode, follow these steps to change the IGMP query timeout. This procedure is optional. To return to the default setting, use the no ip igmp querier-timeout interface configuration command. Changing the Maximum Query Response Time for IGMPv2 If you are using IGMPv2, you can change the maximum query response time advertised in IGMP queries. The maximum query response time enables the switch to quickly detect that there are no more directly connected group members on a LAN. Decreasing the value enables the switch to prune groups faster. Beginning in privileged EXEC mode, follow these steps to change the maximum query response time. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp querier-timeout seconds Specify the IGMP query timeout. The default is 60 seconds (twice the query interval). The range is 60 to 300. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp query-max-response-time seconds Change the maximum query response time advertised in IGMP queries. The default is 10 seconds. The range is 1 to 25. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional Multicast Routing Features To return to the default setting, use the no ip igmp query-max-response-time interface configuration command. Configuring the Switch as a Statically Connected Member Sometimes there is either no group member on a network segment or a host cannot report its group membership by using IGMP. However, you might want multicast traffic to go to that network segment. These are ways to pull multicast traffic down to a network segment: • Use the ip igmp join-group interface configuration command. With this method, the switch accepts the multicast packets in addition to forwarding them. Accepting the multicast packets prevents the switch from fast switching. • Use the ip igmp static-group interface configuration command. With this method, the switch does not accept the packets itself, but only forwards them. This method enables fast switching. The outgoing interface appears in the IGMP cache, but the switch itself is not a member, as evidenced by lack of an L (local) flag in the multicast route entry. Beginning in privileged EXEC mode, follow these steps to configure the switch itself to be a statically connected member of a group (and enable fast switching). This procedure is optional. To remove the switch as a member of the group, use the no ip igmp static-group group-address interface configuration command. Configuring Optional Multicast Routing Features This section describes how to configure optional multicast routing features, which are grouped as follows: • Features for Layer 2 connectivity and MBONE multimedia conference session and set up: – Enabling CGMP Server Support, page 31-33 (optional) – Configuring sdr Listener Support, page 31-34 (optional) • Features that control bandwidth utilization: – Configuring an IP Multicast Boundary, page 31-35 (optional) Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip igmp static-group group-address Configure the switch as a statically connected member of a group. By default, this feature is disabled. Step 4 end Return to privileged EXEC mode. Step 5 show ip igmp interface [interface-id] Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional Multicast Routing Features Enabling CGMP Server Support The switch serves as a CGMP server for devices that do not support IGMP snooping but have CGMP client functionality. CGMP is a protocol used on Cisco routers and multilayer switches connected to Layer 2 Catalyst switches to perform tasks similar to those performed by IGMP. CGMP is necessary because the Layer 2 switch cannot distinguish between IP multicast data packets and IGMP report messages, which are both at the MAC-level and are addressed to the same group address. Beginning in privileged EXEC mode, follow these steps to enable the CGMP server on the switch interface. This procedure is optional. To disable CGMP on the interface, use the no ip cgmp interface configuration command. When multiple Cisco CGMP-capable devices are connected to a switched network and the ip cgmp proxy command is needed, we recommend that all devices be configured with the same CGMP option and have precedence for becoming the IGMP querier over non-Cisco routers. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface that is connected to the Layer 2 Catalyst switch. Step 3 ip cgmp [proxy] Enable CGMP on the interface. By default, CGMP is disabled on all interfaces. Enabling CGMP triggers a CGMP join message. Enable CGMP only on Layer 3 interfaces connected to Layer 2 Catalyst switches. (Optional) When you enter the proxy keyword, the CGMP proxy function is enabled. The proxy router advertises the existence of non-CGMP-capable routers by sending a CGMP join message with the non-CGMP-capable router MAC address and a group address of 0000.0000.0000. Note To perform CGMP proxy, the switch must be the IGMP querier. If you configure the ip cgmp proxy command, you must manipulate the IP addresses so that the switch is the IGMP querier, which might be the highest or lowest IP address, depending on which version of IGMP is running on the network. An IGMP Version 2 querier is selected based on the lowest IP address on the interface. An IGMP Version 1 querier is selected based on the multicast routing protocol used on the interface. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Step 7 Verify the Layer 2 Catalyst switch CGMP-client configuration. For more information, refer to the documentation that shipped with the product.31-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional Multicast Routing Features Configuring sdr Listener Support The MBONE is the small subset of Internet routers and hosts that are interconnected and capable of forwarding IP multicast traffic. Other interesting multimedia content is often broadcast over the MBONE. Before you can join a multimedia session, you need to know what multicast group address and port are being used for the session, when the session is going to be active, and what sort of applications (audio, video, and so forth) are required on your workstation. The MBONE Session Directory version 2 (sdr) tool provides this information. This freeware application can be downloaded from several sites on the World Wide Web, one of which is http://www.video.ja.net/mice/index.html. SDR is a multicast application that listens to a well-known multicast group address and port for Session Announcement Protocol (SAP) multicast packets from SAP clients, which announce their conference sessions. These SAP packets contain a session description, the time the session is active, its IP multicast group addresses, media format, contact person, and other information about the advertised multimedia session. The information in the SAP packet is displayed in the SDR Session Announcement window. Enabling sdr Listener Support By default, the switch does not listen to session directory advertisements. Beginning in privileged EXEC mode, follow these steps to enable the switch to join the default session directory group (224.2.127.254) on the interface and listen to session directory advertisements. This procedure is optional. To disable sdr support, use the no ip sdr listen interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be enabled for sdr. Step 3 ip sdr listen Enable sdr listener support. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional Multicast Routing Features Limiting How Long an sdr Cache Entry Exists By default, entries are never deleted from the sdr cache. You can limit how long the entry remains active so that if a source stops advertising SAP information, old advertisements are not needlessly kept. Beginning in privileged EXEC mode, follow these steps to limit how long an sdr cache entry stays active in the cache. This procedure is optional. To return to the default setting, use the no ip sdr cache-timeout global configuration command. To delete the entire cache, use the clear ip sdr privileged EXEC command. To display the session directory cache, use the show ip sdr privileged EXEC command. Configuring an IP Multicast Boundary Administratively-scoped boundaries can be used to limit the forwarding of multicast traffic outside of a domain or subdomain. This approach uses a special range of multicast addresses, called administratively-scoped addresses, as the boundary mechanism. If you configure an administratively-scoped boundary on a routed interface, multicast traffic whose multicast group addresses fall in this range can not enter or exit this interface, thereby providing a firewall for multicast traffic in this address range. Note Multicast boundaries and TTL thresholds control the scoping of multicast domains; however, TTL thresholds are not supported by the switch. You should use multicast boundaries instead of TTL thresholds to limit the forwarding of multicast traffic outside of a domain or a subdomain. Figure 31-5 shows that Company XYZ has an administratively-scoped boundary set for the multicast address range 239.0.0.0/8 on all routed interfaces at the perimeter of its network. This boundary prevents any multicast traffic in the range 239.0.0.0 through 239.255.255.255 from entering or leaving the network. Similarly, the engineering and marketing departments have an administratively-scoped boundary of 239.128.0.0/16 around the perimeter of their networks. This boundary prevents multicast traffic in the range of 239.128.0.0 through 239.128.255.255 from entering or leaving their respective networks. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip sdr cache-timeout minutes Limit how long an sdr cache entry stays active in the cache. By default, entries are never deleted from the cache. For minutes, the range is 1 to 4294967295. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.31-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Optional Multicast Routing Features Figure 31-5 Administratively-Scoped Boundaries You can define an administratively-scoped boundary on a routed interface for multicast group addresses. A standard access list defines the range of addresses affected. When a boundary is defined, no multicast data packets are allowed to flow across the boundary from either direction. The boundary allows the same multicast group address to be reused in different administrative domains. The IANA has designated the multicast address range 239.0.0.0 to 239.255.255.255 as the administratively-scoped addresses. This range of addresses can then be reused in domains administered by different organizations. The addresses would be considered local, not globally unique. Beginning in privileged EXEC mode, follow these steps to set up an administratively-scoped boundary. This procedure is optional. 45154 Company XYZ Engineering Marketing 239.128.0.0/16 239.0.0.0/8 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the number of the network or host from which the packet is being sent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 3 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 4 ip multicast boundary access-list-number Configure the boundary, specifying the access list you created in Step 2. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.31-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Basic DVMRP Interoperability Features To remove the boundary, use the no ip multicast boundary interface configuration command. This example shows how to set up a boundary for all administratively-scoped addresses: Switch(config)# access-list 1 deny 239.0.0.0 0.255.255.255 Switch(config)# access-list 1 permit 224.0.0.0 15.255.255.255 Switch(config)# interface gigabitethernet1/0/1 Switch(config-if)# ip multicast boundary 1 Configuring Basic DVMRP Interoperability Features These sections describe how to perform basic configuration tasks on your switch to interoperate with DVMRP devices: • Configuring DVMRP Interoperability, page 31-37 (optional) • Configuring a DVMRP Tunnel, page 31-39 (optional) • Advertising Network 0.0.0.0 to DVMRP Neighbors, page 31-41 (optional) • Responding to mrinfo Requests, page 31-42 (optional) For more advanced DVMRP features, see the “Configuring Advanced DVMRP Interoperability Features” section on page 31-42. Configuring DVMRP Interoperability Cisco multicast routers and multilayer switches using PIM can interoperate with non-Cisco multicast routers that use the DVMRP. PIM devices dynamically discover DVMRP multicast routers on attached networks by listening to DVMR probe messages. When a DVMRP neighbor has been discovered, the PIM device periodically sends DVMRP report messages advertising the unicast sources reachable in the PIM domain. By default, directly connected subnets and networks are advertised. The device forwards multicast packets that have been forwarded by DVMRP routers and, in turn, forwards multicast packets to DVMRP routers. You can configure an access list on the PIM routed interface connected to the MBONE to limit the number of unicast routes that are advertised in DVMRP route reports. Otherwise, all routes in the unicast routing table are advertised. Note The mrouted protocol is a public-domain implementation of DVMRP. You must use mrouted Version 3.8 (which implements a nonpruning version of DVMRP) when Cisco routers and multilayer switches are directly connected to DVMRP routers or interoperate with DVMRP routers over an MBONE tunnel. DVMRP advertisements produced by the Cisco IOS software can cause older versions of the mrouted protocol to corrupt their routing tables and those of their neighbors. You can configure what sources are advertised and what metrics are used by configuring the ip dvmrp metric interface configuration command. You can also direct all sources learned through a particular unicast routing process to be advertised into DVMRP.31-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Basic DVMRP Interoperability Features Beginning in privileged EXEC mode, follow these steps to configure the sources that are advertised and the metrics that are used when DVMRP route-report messages are sent. This procedure is optional. To disable the metric or route map, use the no ip dvmrp metric metric [list access-list-number] [[protocol process-id] | [dvmrp]] or the no ip dvmrp metric metric route-map map-name interface configuration command. A more sophisticated way to achieve the same results as the preceding command is to use a route map (ip dvmrp metric metric route-map map-name interface configuration command) instead of an access list. You subject unicast routes to route-map conditions before they are injected into DVMRP. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the number of the network or host from which the packet is being sent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 3 interface interface-id Enter interface configuration mode, and specify the interface connected to the MBONE and enabled for multicast routing. Step 4 ip dvmrp metric metric [list access-list-number] [[protocol process-id] | [dvmrp]] Configure the metric associated with a set of destinations for DVMRP reports. • For metric, the range is 0 to 32. A value of 0 means that the route is not advertised. A value of 32 is equivalent to infinity (unreachable). • (Optional) For list access-list-number, enter the access list number created in Step 2. If specified, only the multicast destinations that match the access list are reported with the configured metric. • (Optional) For protocol process-id, enter the name of the unicast routing protocol, such as eigrp, igrp, ospf, rip, static, or dvmrp, and the process ID number of the routing protocol. If specified, only routes learned by the specified routing protocol are advertised in DVMRP report messages. • (Optional) If specified, the dvmrp keyword allows routes from the DVMRP routing table to be advertised with the configured metric or filtered. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.31-39 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Basic DVMRP Interoperability Features This example shows how to configure DVMRP interoperability when the PIM device and the DVMRP router are on the same network segment. In this example, access list 1 advertises the networks (198.92.35.0, 198.92.36.0, 198.92.37.0, 131.108.0.0, and 150.136.0.0) to the DVMRP router, and access list 2 prevents all other networks from being advertised (ip dvmrp metric 0 interface configuration command). Switch(config-if)# interface gigabitethernet1/0/1 Switch(config-if)# ip address 131.119.244.244 255.255.255.0 Switch(config-if)# ip pim dense-mode Switch(config-if)# ip dvmrp metric 1 list 1 Switch(config-if)# ip dvmrp metric 0 list 2 Switch(config-if)# exit Switch(config)# access-list 1 permit 198.92.35.0 0.0.0.255 Switch(config)# access-list 1 permit 198.92.36.0 0.0.0.255 Switch(config)# access-list 1 permit 198.92.37.0 0.0.0.255 Switch(config)# access-list 1 permit 131.108.0.0 0.0.255.255 Switch(config)# access-list 1 permit 150.136.0.0 0.0.255.255 Switch(config)# access-list 1 deny 0.0.0.0 255.255.255.255 Switch(config)# access-list 2 permit 0.0.0.0 255.255.255.255 Configuring a DVMRP Tunnel The software supports DVMRP tunnels to the MBONE. You can configure a DVMRP tunnel on a router or multilayer switch if the other end is running DVMRP. The software then sends and receives multicast packets through the tunnel. This strategy enables a PIM domain to connect to the DVMRP router when all routers on the path do not support multicast routing. You cannot configure a DVMRP tunnel between two routers. When a Cisco router or multilayer switch runs DVMRP through a tunnel, it advertises sources in DVMRP report messages, much as it does on real networks. The software also caches DVMRP report messages it receives and uses them in its RPF calculation. This behavior enables the software to forward multicast packets received through the tunnel. When you configure a DVMRP tunnel, you should assign an IP address to a tunnel in these cases: • To send IP packets through the tunnel • To configure the software to perform DVMRP summarization The software does not advertise subnets through the tunnel if the tunnel has a different network number from the subnet. In this case, the software advertises only the network number through the tunnel.31-40 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Basic DVMRP Interoperability Features Beginning in privileged EXEC mode, follow these steps to configure a DVMRP tunnel. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 access-list access-list-number {deny | permit} source [source-wildcard] Create a standard access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the number of the network or host from which the packet is being sent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 3 interface tunnel number Enter interface configuration mode, and specify a tunnel interface. Step 4 tunnel source ip-address Specify the source address of the tunnel interface. Enter the IP address of the interface on the switch. Step 5 tunnel destination ip-address Specify the destination address of the tunnel interface. Enter the IP address of the mrouted router. Step 6 tunnel mode dvmrp Configure the encapsulation mode for the tunnel to DVMRP. Step 7 ip address address mask or ip unnumbered type number Assign an IP address to the interface. or Configure the interface as unnumbered. Step 8 ip pim [dense-mode | sparse-mode] Configure the PIM mode on the interface. Step 9 ip dvmrp accept-filter access-list-number [distance] neighbor-list access-list-number Configure an acceptance filter for incoming DVMRP reports. By default, all destination reports are accepted with a distance of 0. Reports from all neighbors are accepted. • For access-list-number, specify the access list number created in Step 2. Any sources that match the access list are stored in the DVMRP routing table with distance. • (Optional) For distance, enter the administrative distance to the destination. By default, the administrative distance for DVMRP routes is 0 and take precedence over unicast routing table routes. If you have two paths to a source, one through unicast routing (using PIM as the multicast routing protocol) and another using DVMRP, and if you want to use the PIM path, increase the administrative distance for DVMRP routes. The range is 1 to 255. • For neighbor-list access-list-number, enter the number of the neighbor list created in Step 2. DVMRP reports are accepted only by those neighbors on the list. Step 10 end Return to privileged EXEC mode.31-41 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Basic DVMRP Interoperability Features To disable the filter, use the no ip dvmrp accept-filter access-list-number [distance] neighbor-list access-list-number interface configuration command. This example shows how to configure a DVMRP tunnel. In this configuration, the IP address of the tunnel on the Cisco switch is assigned unnumbered, which causes the tunnel to appear to have the same IP address as Gigabit Ethernet interface 0/1 on stack member 1. The tunnel endpoint source address is 172.16.2.1, and the tunnel endpoint address of the remote DVMRP router to which the tunnel is connected is 192.168.1.10. Any packets sent through the tunnel are encapsulated in an outer IP header. The Cisco switch is configured to accept incoming DVMRP reports with a distance of 100 from 198.92.37.0 through 198.92.37.255. Switch(config)# ip multicast-routing Switch(config)# interface tunnel 0 Switch(config-if)# ip unnumbered gigabitethernet1/0/1 Switch(config-if)# ip pim dense-mode Switch(config-if)# tunnel source gigabitethernet1/0/1 Switch(config-if)# tunnel destination 192.168.1.10 Switch(config-if)# tunnel mode dvmrp Switch(config-if)# ip dvmrp accept-filter 1 100 Switch(config-if)# interface gigabitethernet1/0/1 Switch(config-if)# ip address 172.16.2.1 255.255.255.0 Switch(config-if)# ip pim dense-mode Switch(config)# exit Switch(config)# access-list 1 permit 198.92.37.0 0.0.0.255 Advertising Network 0.0.0.0 to DVMRP Neighbors If your switch is a neighbor of an mrouted version 3.6 device, you can configure the software to advertise network 0.0.0.0 (the default route) to the DVMRP neighbor. The DVMRP default route computes the RPF information for any multicast sources that do not match a more specific route. Do not advertise the DVMRP default into the MBONE. Beginning in privileged EXEC mode, follow these steps to advertise network 0.0.0.0 to DVMRP neighbors on an interface. This procedure is optional. Step 11 show running-config Verify your entries. Step 12 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface that is connected to the DVMRP router.31-42 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features To prevent the default route advertisement, use the no ip dvmrp default-information interface configuration command. Responding to mrinfo Requests The software answers mrinfo requests sent by mrouted systems and Cisco routers and multilayer switches. The software returns information about neighbors through DVMRP tunnels and all the routed interfaces. This information includes the metric (always set to 1), the configured TTL threshold, the status of the interface, and various flags. You can also use the mrinfo privileged EXEC command to query the router or switch itself, as in this example: Switch# mrinfo 171.69.214.27 (mm1-7kd.cisco.com) [version cisco 11.1] [flags: PMS]: 171.69.214.27 -> 171.69.214.26 (mm1-r7kb.cisco.com) [1/0/pim/querier] 171.69.214.27 -> 171.69.214.25 (mm1-45a.cisco.com) [1/0/pim/querier] 171.69.214.33 -> 171.69.214.34 (mm1-45c.cisco.com) [1/0/pim] 171.69.214.137 -> 0.0.0.0 [1/0/pim/querier/down/leaf] 171.69.214.203 -> 0.0.0.0 [1/0/pim/querier/down/leaf] 171.69.214.18 -> 171.69.214.20 (mm1-45e.cisco.com) [1/0/pim] 171.69.214.18 -> 171.69.214.19 (mm1-45c.cisco.com) [1/0/pim] 171.69.214.18 -> 171.69.214.17 (mm1-45a.cisco.com) [1/0/pim] Configuring Advanced DVMRP Interoperability Features Cisco routers and multilayer switches run PIM to forward multicast packets to receivers and receive multicast packets from senders. It is also possible to propagate DVMRP routes into and through a PIM cloud. PIM uses this information; however, Cisco routers and multilayer switches do not implement DVMRP to forward multicast packets. Step 3 ip dvmrp default-information {originate | only} Advertise network 0.0.0.0 to DVMRP neighbors. Use this command only when the switch is a neighbor of mrouted version 3.6 machines. The keywords have these meanings: • originate—Specifies that other routes more specific than 0.0.0.0 can also be advertised. • only—Specifies that no DVMRP routes other than 0.0.0.0 are advertised. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose31-43 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features These sections describe how to perform advanced optional configuration tasks on your switch to interoperate with DVMRP devices: • Enabling DVMRP Unicast Routing, page 31-43 (optional) • Rejecting a DVMRP Nonpruning Neighbor, page 31-44 (optional) • Controlling Route Exchanges, page 31-46 (optional) For information on basic DVMRP features, see the “Configuring Basic DVMRP Interoperability Features” section on page 31-37. Enabling DVMRP Unicast Routing Because multicast routing and unicast routing require separate topologies, PIM must follow the multicast topology to build loopless distribution trees. Using DVMRP unicast routing, Cisco routers, multilayer switches, and mrouted-based machines exchange DVMRP unicast routes, to which PIM can then reverse-path forward. Cisco devices do not perform DVMRP multicast routing among each other, but they can exchange DVMRP routes. The DVMRP routes provide a multicast topology that might differ from the unicast topology. This enables PIM to run over the multicast topology, thereby enabling sparse-mode PIM over the MBONE topology. When DVMRP unicast routing is enabled, the router or switch caches routes learned in DVMRP report messages in a DVMRP routing table. When PIM is running, these routes might be preferred over routes in the unicast routing table, enabling PIM to run on the MBONE topology when it is different from the unicast topology. DVMRP unicast routing can run on all interfaces. For DVMRP tunnels, it uses DVMRP multicast routing. This feature does not enable DVMRP multicast routing among Cisco routers and multilayer switches. However, if there is a DVMRP-capable multicast router, the Cisco device can do PIM/DVMRP multicast routing. Beginning in privileged EXEC mode, follow these steps to enable DVMRP unicast routing. This procedure is optional. To disable this feature, use the no ip dvmrp unicast-routing interface configuration command. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface that is connected to the DVMRP router. Step 3 ip dvmrp unicast-routing Enable DVMRP unicast routing (to send and receive DVMRP routes). This feature is disabled by default. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-44 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Rejecting a DVMRP Nonpruning Neighbor By default, Cisco devices accept all DVMRP neighbors as peers, regardless of their DVMRP capability. However, some non-Cisco devices run old versions of DVMRP that cannot prune, so they continuously receive forwarded packets, wasting bandwidth. Figure 31-6 shows this scenario. Figure 31-6 Leaf Nonpruning DVMRP Neighbor You can prevent the switch from peering (communicating) with a DVMRP neighbor if that neighbor does not support DVMRP pruning or grafting. To do so, configure the switch (which is a neighbor to the leaf, nonpruning DVMRP machine) with the ip dvmrp reject-non-pruners interface configuration command on the interface connected to the nonpruning machine as shown in Figure 31-7. In this case, when the switch receives DVMRP probe or report message without the prune-capable flag set, the switch logs a syslog message and discards the message. Si Router A Router B Catalyst 3750 switch RP Valid multicast traffic Unnecessary multicast traffic 86512 Source router or RP PIM dense mode Leaf nonpruning DVMRP device Receiver Stub LAN with no members31-45 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Figure 31-7 Router Rejects Nonpruning DVMRP Neighbor Note that the ip dvmrp reject-non-pruners interface configuration command prevents peering with neighbors only. If there are any nonpruning routers multiple hops away (downstream toward potential receivers) that are not rejected, a nonpruning DVMRP network might still exist. Beginning in privileged EXEC mode, follow these steps to prevent peering with nonpruning DVMRP neighbors. This procedure is optional. To disable this function, use the no ip dvmrp reject-non-pruners interface configuration command. Router A Router B Catalyst 3750 switch RP Multicast traffic gets to receiver, not to leaf DVMRP device 86513 Source router or RP Leaf nonpruning DVMRP device Configure the ip dvmrp reject-non-pruners command on this interface. Receiver Si Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface connected to the nonpruning DVMRP neighbor. Step 3 ip dvmrp reject-non-pruners Prevent peering with nonpruning DVMRP neighbors. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-46 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Controlling Route Exchanges These sections describe how to tune the Cisco device advertisements of DVMRP routes: • Limiting the Number of DVMRP Routes Advertised, page 31-46 (optional) • Changing the DVMRP Route Threshold, page 31-46 (optional) • Configuring a DVMRP Summary Address, page 31-47 (optional) • Disabling DVMRP Autosummarization, page 31-49 (optional) • Adding a Metric Offset to the DVMRP Route, page 31-49 (optional) Limiting the Number of DVMRP Routes Advertised By default, only 7000 DVMRP routes are advertised over an interface enabled to run DVMRP (that is, a DVMRP tunnel, an interface where a DVMRP neighbor has been discovered, or an interface configured to run the ip dvmrp unicast-routing interface configuration command). Beginning in privileged EXEC mode, follow these steps to change the DVMRP route limit. This procedure is optional. To configure no route limit, use the no ip dvmrp route-limit global configuration command. Changing the DVMRP Route Threshold By default, 10,000 DVMRP routes can be received per interface within a 1-minute interval. When that rate is exceeded, a syslog message is issued, warning that there might be a route surge occurring. The warning is typically used to quickly detect when devices have been misconfigured to inject a large number of routes into the MBONE. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip dvmrp route-limit count Change the number of DVMRP routes advertised over an interface enabled for DVMRP. This command prevents misconfigured ip dvmrp metric interface configuration commands from causing massive route injection into the MBONE. By default, 7000 routes are advertised. The range is 0 to 4294967295. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.31-47 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Beginning in privileged EXEC mode, follow these steps to change the threshold number of routes that trigger the warning. This procedure is optional. To return to the default setting use the no ip dvmrp routehog-notification global configuration command. Use the show ip igmp interface privileged EXEC command to display a running count of routes. When the count is exceeded, *** ALERT *** is appended to the line. Configuring a DVMRP Summary Address By default, a Cisco device advertises in DVMRP route-report messages only connected unicast routes (that is, only routes to subnets that are directly connected to the router) from its unicast routing table. These routes undergo normal DVMRP classful route summarization. This process depends on whether the route being advertised is in the same classful network as the interface over which it is being advertised. Figure 31-8 shows an example of the default behavior. This example shows that the DVMRP report sent by the Cisco router contains the three original routes received from the DVMRP router that have been poison-reversed by adding 32 to the DVMRP metric. Listed after these routes are two routes that are advertisements for the two directly connected networks (176.32.10.0/24 and 176.32.15.0/24) that were taken from the unicast routing table. Because the DVMRP tunnel shares the same IP address as Fast Ethernet 0/1 and falls into the same Class B network as the two directly connected subnets, classful summarization of these routes was not performed. As a result, the DVMRP router is able to poison-reverse only these two routes to the directly connected subnets and is able to only RPF properly for multicast traffic sent by sources on these two Ethernet segments. Any other multicast source in the network behind the Cisco router that is not on these two Ethernet segments does not properly RPF-check on the DVMRP router and is discarded. You can force the Cisco router to advertise the summary address (specified by the address and mask pair in the ip dvmrp summary-address address mask interface configuration command) in place of any route that falls in this address range. The summary address is sent in a DVMRP route report if the unicast routing table contains at least one route in this range; otherwise, the summary address is not advertised. In Figure 31-8, you configure the ip dvmrp summary-address command on the Cisco router tunnel interface. As a result, the Cisco router sends only a single summarized Class B advertisement for network 176.32.0.0.16 from the unicast routing table. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip dvmrp routehog-notification route-count Configure the number of routes that trigger a syslog message. The default is 10,000 routes. The range is 1 to 4294967295. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.31-48 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Figure 31-8 Only Connected Unicast Routes Are Advertised by Default Beginning in privileged EXEC mode, follow these steps to customize the summarization of DVMRP routes if the default classful autosummarization does not suit your needs. This procedure is optional. Note At least one more-specific route must be present in the unicast routing table before a configured summary address is advertised. To remove the summary address, use the no ip dvmrp summary-address address mask [metric value] interface configuration command. Network Intf Metric Dist 176.13.10.0/24 Fa1/0/1 10514432 90 176.32.15.0/24 Fa1/0/2 10512012 90 176.32.20.0/24 Fa1/0/2 45106372 90 Src Network Intf Metric Dist 151.16.0/16 Fa1/0/1 7 0 172.34.15.0/24 Fa1/0/1 10 0 202.13.3.0/24 Fa1/0/1 8 0 151.16.0.0/16 m = 39 172.34.15.0/24 m = 42 202.13.3.0/24 m = 40 176.32.10.0/24 m = 1 176.32.15.0/24 m = 1 DVMRP router Cisco router Tunnel Fast Ethernet 1/0/1 176.32.10.0/24 Fast Ethernet 1/0/2 176.32.15.0/24 DVMRP Report 86514 DVMRP Route Table Unicast Routing Table (10,000 Routes) interface tunnel 0 ip unnumbered fastethernet1/0/1 interface fastethernet1/0/1 ip addr 176.32.10.1 255.255.255.0 ip pim dense-mode interface fastethernet1/0/2 ip addr 176.32.15.1 255.255.255.0 ip pim dense-mode Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration command, and specify the interface that is connected to the DVMRP router. Step 3 ip dvmrp summary-address address mask [metric value] Specify a DVMRP summary address. • For summary-address address mask, specify the summary IP address and mask that is advertised instead of the more specific route. • (Optional) For metric value, specify the metric that is advertised with the summary address. The default is 1. The range is 1 to 32. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-49 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Disabling DVMRP Autosummarization By default, the software automatically performs some level of DVMRP summarization. Disable this function if you want to advertise all routes, not just a summary. In some special cases, you can use the neighboring DVMRP router with all subnet information to better control the flow of multicast traffic in the DVMRP network. One such case might occur if the PIM network is connected to the DVMRP cloud at several points and more specific (unsummarized) routes are being injected into the DVMRP network to advertise better paths to individual subnets inside the PIM cloud. If you configure the ip dvmrp summary-address interface configuration command and did not configure no ip dvmrp auto-summary, you get both custom and autosummaries. Beginning in privileged EXEC mode, follow these steps to disable DVMRP autosummarization. This procedure is optional. To re-enable auto summarization, use the ip dvmrp auto-summary interface configuration command. Adding a Metric Offset to the DVMRP Route By default, the switch increments by one the metric (hop count) of a DVMRP route advertised in incoming DVMRP reports. You can change the metric if you want to favor or not favor a certain route. For example, a route is learned by multilayer switch A, and the same route is learned by multilayer switch B with a higher metric. If you want to use the path through switch B because it is a faster path, you can apply a metric offset to the route learned by switch A to make it larger than the metric learned by switch B, and you can choose the path through switch B. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface connected to the DVMRP router. Step 3 no ip dvmrp auto-summary Disable DVMRP autosummarization. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-50 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Monitoring and Maintaining IP Multicast Routing Beginning in privileged EXEC mode, follow these steps to change the default metric. This procedure is optional. To return to the default setting, use the no ip dvmrp metric-offset interface configuration command. Monitoring and Maintaining IP Multicast Routing These sections describe how to monitor and maintain IP multicast routing: • Clearing Caches, Tables, and Databases, page 31-51 • Displaying System and Network Statistics, page 31-51 • Monitoring IP Multicast Routing, page 31-52 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to be configured. Step 3 ip dvmrp metric-offset [in | out] increment Change the metric added to DVMRP routes advertised in incoming reports. The keywords have these meanings: • (Optional) in—Specifies that the increment value is added to incoming DVMRP reports and is reported in mrinfo replies. • (Optional) out—Specifies that the increment value is added to outgoing DVMRP reports for routes from the DVMRP routing table. If neither in nor out is specified, in is the default. For increment, specify the value that is added to the metric of a DVMRP router advertised in a report message. The range is 1 to 31. If the ip dvmrp metric-offset command is not configured on an interface, the default increment value for incoming routes is 1, and the default for outgoing routes is 0. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.31-51 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Monitoring and Maintaining IP Multicast Routing Clearing Caches, Tables, and Databases You can remove all contents of a particular cache, table, or database. Clearing a cache, table, or database might be necessary when the contents of the particular structure are or suspected to be invalid. You can use any of the privileged EXEC commands in Table 31-3 to clear IP multicast caches, tables, and databases: Displaying System and Network Statistics You can display specific statistics, such as the contents of IP routing tables, caches, and databases. Note This release does not support per-route statistics. You can display information to determine resource utilization and solve network problems. You can also display information about node reachability and discover the routing path your device’s packets are taking through the network. You can use any of the privileged EXEC commands in Table 31-4 to display various routing statistics: Table 31-3 Commands for Clearing Caches, Tables, and Databases Command Purpose clear ip cgmp Clear all group entries the Catalyst switches have cached. clear ip dvmrp route {* | route} Delete routes from the DVMRP routing table. clear ip igmp group [group-name | group-address | interface] Delete entries from the IGMP cache. clear ip mroute {* | group [source]} Delete entries from the IP multicast routing table. clear ip pim auto-rp rp-address Clear the Auto-RP cache. clear ip sdr [group-address | “session-name”] Delete the Session Directory Protocol Version 2 cache or an sdr cache entry. Table 31-4 Commands for Displaying System and Network Statistics Command Purpose ping [group-name | group-address] Send an ICMP Echo Request to a multicast group address. show ip dvmrp route [ip-address] Display the entries in the DVMRP routing table. show ip igmp groups [group-name | group-address | type number] Display the multicast groups that are directly connected to the switch and that were learned through IGMP. show ip igmp interface [type number] Display multicast-related information about an interface. show ip mcache [group [source]] Display the contents of the IP fast-switching cache.31-52 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 31 Configuring IP Multicast Routing Monitoring and Maintaining IP Multicast Routing Monitoring IP Multicast Routing You can use the privileged EXEC commands in Table 31-5 to monitor IP multicast routers, packets, and paths: show ip mpacket [source-address | name] [group-address | name] [detail] Display the contents of the circular cache-header buffer. show ip mroute [group-name | group-address] [source] [summary] [count] [active kbps] Display the contents of the IP multicast routing table. show ip pim interface [type number] [count] Display information about interfaces configured for PIM. show ip pim neighbor [type number] List the PIM neighbors discovered by the switch. show ip pim rp [group-name | group-address] Display the RP routers associated with a sparse-mode multicast group. show ip rpf {source-address | name} Display how the switch is doing Reverse-Path Forwarding (that is, from the unicast routing table, DVMRP routing table, or static mroutes). show ip sdr [group | “session-name” | detail] Display the Session Directory Protocol Version 2 cache. Table 31-4 Commands for Displaying System and Network Statistics (continued) Command Purpose Table 31-5 Commands for Monitoring IP Multicast Routing Command Purpose mrinfo [hostname | address] [source-address | interface] Query a multicast router or multilayer switch about which neighboring multicast devices are peering with it. mstat source [destination] [group] Display IP multicast packet rate and loss information. mtrace source [destination] [group] Trace the path from a source to a destination branch for a multicast distribution tree for a given group.C H A P T E R 32-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 32 Configuring MSDP This chapter describes how to configure the Multicast Source Discovery Protocol (MSDP) on the Catalyst 3750 switch. The MSDP connects multiple Protocol-Independent Multicast sparse-mode (PIM-SM) domains. MSDP is not fully supported in this software release because of a lack of support for Multicast Border Gateway Protocol (MBGP), which works closely with MSDP. However, it is possible to create default peers that MSDP can operate with if MBGP is not running. To use this feature, the stack master must be running the enhanced multilayer image (EMI). Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS IP and IP Routing Command Reference for Release 12.1. This chapter consists of these sections: • Understanding MSDP, page 32-1 • Configuring MSDP, page 32-4 • Monitoring and Maintaining MSDP, page 32-19 Understanding MSDP MSDP allows multicast sources for a group to be known to all rendezvous points (RPs) in different domains. Each PIM-SM domain uses its own RPs and does not depend on RPs in other domains. An RP runs MSDP over the Transmission Control Protocol (TCP) to discover multicast sources in other domains. An RP in a PIM-SM domain has an MSDP peering relationship with MSDP-enabled devices in another domain. The peering relationship occurs over a TCP connection, primarily exchanging a list of sources sending to multicast groups. The TCP connections between RPs are achieved by the underlying routing system. The receiving RP uses the source lists to establish a source path.32-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Understanding MSDP The purpose of this topology is to have domains discover multicast sources in other domains. If the multicast sources are of interest to a domain that has receivers, multicast data is delivered over the normal, source-tree building mechanism in PIM-SM. MSDP is also used to announce sources sending to a group. These announcements must originate at the domain’s RP. MSDP depends heavily on the Border Gateway Protocol (BGP) or MBGP for interdomain operation. We recommend that you run MSDP in RPs in your domain that are RPs for sources sending to global groups to be announced to the Internet. MSDP Operation Figure 32-1 shows MSDP operating between two MSDP peers. PIM uses MSDP as the standard mechanism to register a source with the RP of a domain. When MSDP is configured, this sequence occurs. When a source sends its first multicast packet, the first-hop router (designated router or RP) directly connected to the source sends a PIM register message to the RP. The RP uses the register message to register the active source and to forward the multicast packet down the shared tree in the local domain. With MSDP configured, the RP also forwards a source-active (SA) message to all MSDP peers. The SA message identifies the source, the group the source is sending to, and the address of the RP or the originator ID (the IP address of the interface used as the RP address), if configured. Each MSDP peer receives and forwards the SA message away from the originating RP to achieve peer reverse-path flooding (RPF). The MSDP device examines the BGP or MBGP routing table to determine which peer is the next hop toward the originating RP of the SA message. Such a peer is called an RPF peer (reverse-path forwarding peer). The MSDP device forwards the message to all MSDP peers other than the RPF peer. For information on how to configure an MSDP peer when BGP and MBGP are not supported, see the “Configuring a Default MSDP Peer” section on page 32-4. If the MSDP peer receives the same SA message from a non-RPF peer toward the originating RP, it drops the message. Otherwise, it forwards the message to all its MSDP peers. When the RP for a domain receives the SA message from an MSDP peer, it determines if it has any join requests for the group the SA message describes. If the (*,G) entry exists with a nonempty outgoing interface list, the domain is interested in the group, and the RP triggers an (S,G) join toward the source. After the (S,G) join reaches the source’s DR, a branch of the source tree has been built from the source to the RP in the remote domain. Multicast traffic can now flow from the source across the source tree to the RP and then down the shared tree in the remote domain to the receiver.32-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Understanding MSDP Figure 32-1 MSDP Running Between RP Peers MSDP Benefits MSDP has these benefits: • It breaks up the shared multicast distribution tree. You can make the shared tree local to your domain. Your local members join the local tree, and join messages for the shared tree never need to leave your domain. • PIM sparse-mode domains can rely only on their own RPs, decreasing reliance on RPs in another domain. This increases security because you can prevent your sources from being known outside your domain. • Domains with only receivers can receive data without globally advertising group membership. • Global source multicast routing table state is not required, saving memory. RP + MSDP peer MSDP peer 49885 MSDP peer Receiver MSDP SA MSDP SA MSDP SA TCP connection BGP Source Multicast Register Peer RPF flooding PIM sparse-mode domain PIM DR (S,G) Join32-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Configuring MSDP These sections describe how to configure MSDP: • Default MSDP Configuration, page 32-4 • Configuring a Default MSDP Peer, page 32-4 (required) • Caching Source-Active State, page 32-6 (optional) • Requesting Source Information from an MSDP Peer, page 32-8 (optional) • Controlling Source Information that Your Switch Originates, page 32-8 (optional) • Controlling Source Information that Your Switch Forwards, page 32-12 (optional) • Controlling Source Information that Your Switch Receives, page 32-14 (optional) • Configuring an MSDP Mesh Group, page 32-16 (optional) • Shutting Down an MSDP Peer, page 32-16 (optional) • Including a Bordering PIM Dense-Mode Region in MSDP, page 32-17 (optional) • Configuring an Originating Address other than the RP Address, page 32-18 (optional) Default MSDP Configuration MSDP is not enabled, and no default MSDP peer exists. Configuring a Default MSDP Peer In this software release, because BGP and MBGP are not supported, you cannot configure an MSDP peer on the local switch by using the ip msdp peer global configuration command. Instead, you define a default MSDP peer (by using the ip msdp default-peer global configuration command) from which to accept all SA messages for the switch. The default MSDP peer must be a previously configured MSDP peer. Configure a default MSDP peer when the switch is not BGP- or MBGP-peering with an MSDP peer. If a single MSDP peer is configured, the switch always accepts all SA messages from that peer. Figure 32-2 shows a network in which default MSDP peers might be used. In Figure 32-2, a customer who owns Switch B is connected to the Internet through two Internet service providers (ISPs), one owning Router A and the other owning Router C. They are not running BGP or MBGP between them. To learn about sources in the ISP’s domain or in other domains, Switch B at the customer site identifies Router A as its default MSDP peer. Switch B advertises SA messages to both Router A and Router C but accepts SA messages only from Router A or only from Router C. If Router A is first in the configuration file, it is used if it is running. If Router A is not running, only then does Switch B accept SA messages from Router C. This is the default behavior without a prefix list. If you specify a prefix list, the peer is a default peer only for the prefixes in the list. You can have multiple active default peers when you have a prefix list associated with each. When you do not have any prefix lists, you can configure multiple default peers, but only the first one is the active default peer as long as the router has connectivity to this peer and the peer is alive. If the first configured peer fails or the connectivity to this peer fails, the second configured peer becomes the active default, and so on. The ISP probably uses a prefix list to define which prefixes it accepts from the customer’s router. 32-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Figure 32-2 Default MSDP Peer Network Beginning in privileged EXEC mode, follow these steps to specify a default MSDP peer. This procedure is required. Si ISP A PIM domain ISP C PIM domain SA Router A Switch B 10.1.1.1 Default MSDP peer Default MSDP peer Default MSDP peer Customer PIM domain Router C SA SA 86515 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp default-peer ip-address | name [prefix-list list] Define a default peer from which to accept all MSDP SA messages. • For ip-address | name, enter the IP address or Domain Name System (DNS) server name of the MSDP default peer. • (Optional) For prefix-list list, enter the list name that specifies the peer to be the default peer only for the listed prefixes. You can have multiple active default peers when you have a prefix list associated with each. When you enter multiple ip msdp default-peer commands with the prefix-list keyword, you use all the default peers at the same time for different RP prefixes. This syntax is typically used in a service provider cloud that connects stub site clouds. When you enter multiple ip msdp default-peer commands without the prefix-list keyword, a single active peer accepts all SA messages. If that peer fails, the next configured default peer accepts all SA messages. This syntax is typically used at a stub site.32-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP To remove the default peer, use the no ip msdp default-peer ip-address | name global configuration command. This example shows a partial configuration of Router A and Router C in Figure 32-2. Each of these ISPs have more than one customer (like the customer in Figure 32-2) who use default peering (no BGP or MBGP). In that case, they might have similar configurations. That is, they accept SAs only from a default peer if the SA is permitted by the corresponding prefix list. Router A Router(config)# ip msdp default-peer 10.1.1.1 Router(config)# ip msdp default-peer 10.1.1.1 prefix-list site-a Router(config)# ip prefix-list site-b permit 10.0.0.0/8 Router C Router(config)# ip msdp default-peer 10.1.1.1 prefix-list site-a Router(config)# ip prefix-list site-b permit 10.0.0.0/8 Caching Source-Active State By default, the switch does not cache source/group pairs from received SA messages. When the switch forwards the MSDP SA information, it does not store it in memory. Therefore, if a member joins a group soon after a SA message is received by the local RP, that member needs to wait until the next SA message to hear about the source. This delay is known as join latency. If you want to sacrifice some memory in exchange for reducing the latency of the source information, you can configure the switch to cache SA messages. Step 3 ip prefix-list name [description string] | seq number {permit | deny} network length (Optional) Create a prefix list using the name specified in Step 2. • (Optional) For description string, enter a description of up to 80 characters to describe this prefix list. • For seq number, enter the sequence number of the entry. The range is 1 to 4294967294. • The deny keyword denies access to matching conditions. • The permit keyword permits access to matching conditions. • For network length, specify the network number and length (in bits) of the network mask that is permitted or denied. Step 4 ip msdp description {peer-name | peer-address} text (Optional) Configure a description for the specified peer to make it easier to identify in a configuration or in show command output. By default, no description is associated with an MSDP peer. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose32-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Beginning in privileged EXEC mode, follow these steps to enable the caching of source/group pairs. This procedure is optional. Note An alternative to this command is the ip msdp sa-request global configuration command, which causes the switch to send an SA request message to the MSDP peer when a new member for a group becomes active. For more information, see the next section. To return to the default setting (no SA state is created), use the no ip msdp cache-sa-state global configuration command. This example shows how to enable the cache state for all sources in 171.69.0.0/16 sending to groups 224.2.0.0/16: Switch(config)# ip msdp cache-sa-state 100 Switch(config)# access-list 100 permit ip 171.69.0.0 0.0.255.255 224.2.0.0 0.0.255.255 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp cache-sa-state [list access-list-number] Enable the caching of source/group pairs (create an SA state). Those pairs that pass the access list are cached. For list access-list-number, the range is 100 to 199. Step 3 access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard Create an IP extended access list, repeating the command as many times as necessary. • For access-list-number, the range is 100 to 199. Enter the same number created in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For protocol, enter ip as the protocol name. • For source, enter the number of the network or host from which the packet is being sent. • For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. • For destination, enter the number of the network or host to which the packet is being sent. • For destination-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the destination. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.32-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Requesting Source Information from an MSDP Peer Local RPs can send SA requests and get immediate responses for all active sources for a given group. By default, the switch does not send any SA request messages to its MSDP peers when a new member joins a group and wants to receive multicast traffic. The new member waits to receive the next periodic SA message. If you want a new member of a group to learn the active multicast sources in a connected PIM sparse-mode domain that are sending to a group, configure the switch to send SA request messages to the specified MSDP peer when a new member joins a group. The peer replies with the information in its SA cache. If the peer does not have a cache configured, this command has no result. Configuring this feature reduces join latency but sacrifices memory. Beginning in privileged EXEC mode, follow these steps to configure the switch to send SA request messages to the MSDP peer when a new member joins a group and wants to receive multicast traffic. This procedure is optional. To return to the default setting, use the no ip msdp sa-request {ip-address | name} global configuration command. This example shows how to configure the switch to send SA request messages to the MSDP peer at 171.69.1.1: Switch(config)# ip msdp sa-request 171.69.1.1 Controlling Source Information that Your Switch Originates You can control the multicast source information that originates with your switch: • Sources you advertise (based on your sources) • Receivers of source information (based on knowing the requestor) For more information, see the “Redistributing Sources” section on page 32-9 and the “Filtering Source-Active Request Messages” section on page 32-11. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp sa-request {ip-address | name} Configure the switch to send SA request messages to the specified MSDP peer. For ip-address | name, enter the IP address or name of the MSDP peer from which the local switch requests SA messages when a new member for a group becomes active. Repeat the command for each MSDP peer that you want to supply with SA messages. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.32-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Redistributing Sources SA messages originate on RPs to which sources have registered. By default, any source that registers with an RP is advertised. The A flag is set in the RP when a source is registered, which means the source is advertised in an SA unless it is filtered. Beginning in privileged EXEC mode, follow these steps to further restrict which registered sources are advertised. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp redistribute [list access-list-name] [asn aspath-access-list-number] [route-map map] Configure which (S,G) entries from the multicast routing table are advertised in SA messages. By default, only sources within the local domain are advertised. • (Optional) For list access-list-name, enter the name or number of an IP standard or extended access list. The range is 1 to 99 for standard access lists and 100 to 199 for extended lists. The access list controls which local sources are advertised and to which groups they send. • (Optional) For asn aspath-access-list-number, enter the IP standard or extended access list number in the range 1 to 199. This access list number must also be configured in the ip as-path access-list command. • (Optional) For route-map map, enter the IP standard or extended access list number in the range 1 to 199. This access list number must also be configured in the ip as-path access-list command. The access list or autonomous system path access list determines which (S,G) pairs are advertised.32-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP To remove the filter, use the no ip msdp redistribute global configuration command. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] or access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard Create an IP standard access list, repeating the command as many times as necessary. or Create an IP extended access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99 for standard access lists and 100 to 199 for extended lists. Enter the same number created in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For protocol, enter ip as the protocol name. • For source, enter the number of the network or host from which the packet is being sent. • For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. • For destination, enter the number of the network or host to which the packet is being sent. • For destination-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the destination. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose32-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Filtering Source-Active Request Messages By default, only switches that are caching SA information can respond to SA requests. By default, such a switch honors all SA request messages from its MSDP peers and supplies the IP addresses of the active sources. However, you can configure the switch to ignore all SA requests from an MSDP peer. You can also honor only those SA request messages from a peer for groups described by a standard access list. If the groups in the access list pass, SA request messages are accepted. All other such messages from the peer for other groups are ignored. Beginning in privileged EXEC mode, follow these steps to configure one of these options. This procedure is optional. To return to the default setting, use the no ip msdp filter-sa-request {ip-address | name} global configuration command. This example shows how to configure the switch to filter SA request messages from the MSDP peer at 171.69.2.2. SA request messages from sources on network 192.4.22.0 pass access list 1 and are accepted; all others are ignored. Switch(config)# ip msdp filter sa-request 171.69.2.2 list 1 Switch(config)# access-list 1 permit 192.4.22.0 0.0.0.255 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp filter-sa-request ip-address | name or ip msdp filter-sa-request {ip-address | name} list access-list-number Filter all SA request messages from the specified MSDP peer. or Filter SA request messages from the specified MSDP peer for groups that pass the standard access list. The access list describes a multicast group address. The range for the access-list-number is 1 to 99. Step 3 access-list access-list-number {deny | permit} source [source-wildcard] Create an IP standard access list, repeating the command as many times as necessary. • For access-list-number, the range is 1 to 99. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For source, enter the number of the network or host from which the packet is being sent. • (Optional) For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.32-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Controlling Source Information that Your Switch Forwards By default, the switch forwards all SA messages it receives to all its MSDP peers. However, you can prevent outgoing messages from being forwarded to a peer by using a filter or by setting a time-to-live (TTL) value. These methods are described in the next sections. Using a Filter By creating a filter, you can perform one of these actions: • Filter all source/group pairs • Specify an IP extended access list to pass only certain source/group pairs • Filter based on match criteria in a route map Beginning in privileged EXEC mode, follow these steps to apply a filter. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp sa-filter out ip-address | name or ip msdp sa-filter out {ip-address | name} list access-list-number or ip msdp sa-filter out {ip-address | name} route-map map-tag Filter all SA messages to the specified MSDP peer. or To the specified peer, pass only those SA messages that pass the IP extended access list. The range for the extended access-list-number is 100 to 199. If both the list and the route-map keywords are used, all conditions must be true to pass any (S,G) pair in outgoing SA messages. or To the specified MSDP peer, pass only those SA messages that meet the match criteria in the route map map-tag. If all match criteria are true, a permit from the route map passes routes through the filter. A deny filters routes. 32-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP To remove the filter, use the no ip msdp sa-filter out {ip-address | name} [list access-list-number] [route-map map-tag] global configuration command. This example shows how to allow only (S,G) pairs that pass access list 100 to be forwarded in an SA message to the peer named switch.cisco.com: Switch(config)# ip msdp peer switch.cisco.com connect-source gigabitethernet1/0/1 Switch(config)# ip msdp sa-filter out switch.cisco.com list 100 Switch(config)# access-list 100 permit ip 171.69.0.0 0.0.255.255 224.20 0 0.0.255.255 Step 3 access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard (Optional) Create an IP extended access list, repeating the command as many times as necessary. • For access-list-number, enter the number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For protocol, enter ip as the protocol name. • For source, enter the number of the network or host from which the packet is being sent. • For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. • For destination, enter the number of the network or host to which the packet is being sent. • For destination-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the destination. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose32-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Using TTL to Limit the Multicast Data Sent in SA Messages You can use a TTL value to control what data is encapsulated in the first SA message for every source. Only multicast packets with an IP-header TTL greater than or equal to the ttl argument are sent to the specified MSDP peer. For example, you can limit internal traffic to a TTL of 8. If you want other groups to go to external locations, you must send those packets with a TTL greater than 8. Beginning in privileged EXEC mode, follow these steps to establish a TTL threshold. This procedure is optional. To return to the default setting, use the no ip msdp ttl-threshold {ip-address | name} global configuration command. Controlling Source Information that Your Switch Receives By default, the switch receives all SA messages that its MSDP RPF peers send to it. However, you can control the source information that you receive from MSDP peers by filtering incoming SA messages. In other words, you can configure the switch to not accept them. You can perform one of these actions: • Filter all incoming SA messages from an MSDP peer • Specify an IP extended access list to pass certain source/group pairs • Filter based on match criteria in a route map Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp ttl-threshold {ip-address | name} ttl Limit which multicast data is encapsulated in the first SA message to the specified MSDP peer. • For ip-address | name, enter the IP address or name of the MSDP peer to which the TTL limitation applies. • For ttl, enter the TTL value. The default is 0, which means all multicast data packets are forwarded to the peer until the TTL is exhausted. The range is 0 to 255. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.32-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Beginning in privileged EXEC mode, follow these steps to apply a filter. This procedure is optional. To remove the filter, use the no ip msdp sa-filter in {ip-address | name} [list access-list-number] [route-map map-tag] global configuration command. This example shows how to filter all SA messages from the peer named switch.cisco.com: Switch(config)# ip msdp peer switch.cisco.com connect-source gigabitethernet1/0/1 Switch(config)# ip msdp sa-filter in switch.cisco.com Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp sa-filter in ip-address | name or ip msdp sa-filter in {ip-address | name} list access-list-number or ip msdp sa-filter in {ip-address | name} route-map map-tag Filter all SA messages from the specified MSDP peer. or From the specified peer, pass only those SA messages that pass the IP extended access list. The range for the extended access-list-number is 100 to 199. If both the list and the route-map keywords are used, all conditions must be true to pass any (S,G) pair in incoming SA messages. or From the specified MSDP peer, pass only those SA messages that meet the match criteria in the route map map-tag. If all match criteria are true, a permit from the route map passes routes through the filter. A deny will filter routes. Step 3 access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard (Optional) Create an IP extended access list, repeating the command as many times as necessary. • For access-list-number, enter the number specified in Step 2. • The deny keyword denies access if the conditions are matched. The permit keyword permits access if the conditions are matched. • For protocol, enter ip as the protocol name. • For source, enter the number of the network or host from which the packet is being sent. • For source-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the source. Place ones in the bit positions that you want to ignore. • For destination, enter the number of the network or host to which the packet is being sent. • For destination-wildcard, enter the wildcard bits in dotted decimal notation to be applied to the destination. Place ones in the bit positions that you want to ignore. Recall that the access list is always terminated by an implicit deny statement for everything. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file.32-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Configuring an MSDP Mesh Group An MSDP mesh group is a group of MSDP speakers that have fully meshed MSDP connectivity among one another. Any SA messages received from a peer in a mesh group are not forwarded to other peers in the same mesh group. Thus, you reduce SA message flooding and simplify peer-RPF flooding. Use the ip msdp mesh-group global configuration command when there are multiple RPs within a domain. It is especially used to send SA messages across a domain. You can configure multiple mesh groups (with different names) in a single switch. Beginning in privileged EXEC mode, follow these steps to create a mesh group. This procedure is optional. To remove an MSDP peer from a mesh group, use the no ip msdp mesh-group name {ip-address | name} global configuration command. Shutting Down an MSDP Peer If you want to configure many MSDP commands for the same peer and you do not want the peer to become active, you can shut down the peer, configure it, and later bring it up. When a peer is shut down, the TCP connection is terminated and is not restarted. You can also shut down an MSDP session without losing configuration information for the peer. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp mesh-group name {ip-address | name} Configure an MSDP mesh group, and specify the MSDP peer belonging to that mesh group. By default, the MSDP peers do not belong to a mesh group. • For name, enter the name of the mesh group. • For ip-address | name, enter the IP address or name of the MSDP peer to be a member of the mesh group. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Step 6 Repeat this procedure on each MSDP peer in the group.32-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Beginning in privileged EXEC mode, follow these steps to shut down a peer. This procedure is optional. To bring the peer back up, use the no ip msdp shutdown {peer-name | peer address} global configuration command. The TCP connection is reestablished Including a Bordering PIM Dense-Mode Region in MSDP You can configure MSDP on a switch that borders a PIM sparse-mode region with a dense-mode region. By default, active sources in the dense-mode region do not participate in MSDP. Note We do not recommend using the ip msdp border sa-address global configuration command. It is better to configure the border router in the sparse-mode domain to proxy-register sources in the dense-mode domain to the RP of the sparse-mode domain and have the sparse-mode domain use standard MSDP procedures to advertise these sources. Beginning in privileged EXEC mode, follow these steps to configure the border router to send SA messages for sources active in the dense-mode region to the MSDP peers. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp shutdown {peer-name | peer address} Administratively shut down the specified MSDP peer without losing configuration information. For peer-name | peer address, enter the IP address or name of the MSDP peer to shut down. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp border sa-address interface-id Configure the switch on the border between a dense-mode and sparse-mode region to send SA messages about active sources in the dense-mode region. For interface-id, specify the interface from which the IP address is derived and used as the RP address in SA messages. The IP address of the interface is used as the Originator-ID, which is the RP field in the SA message. Step 3 ip msdp redistribute [list access-list-name] [asn aspath-access-list-number] [route-map map] Configure which (S,G) entries from the multicast routing table are advertised in SA messages. For more information, see the “Redistributing Sources” section on page 32-9. Step 4 end Return to privileged EXEC mode.32-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Configuring MSDP Note that the ip msdp originator-id global configuration command also identifies an interface to be used as the RP address. If both the ip msdp border sa-address and the ip msdp originator-id global configuration commands are configured, the address derived from the ip msdp originator-id command determines the RP address. To return to the default setting (active sources in the dense-mode region do not participate in MSDP), use the no ip msdp border sa-address interface-id global configuration command. Configuring an Originating Address other than the RP Address You can allow an MSDP speaker that originates an SA message to use the IP address of the interface as the RP address in the SA message by changing the Originator ID. You might change the Originator ID in one of these cases: • If you configure a logical RP on multiple switches in an MSDP mesh group. • If you have a switch that borders a PIM sparse-mode domain and a dense-mode domain. If a switch borders a dense-mode domain for a site, and sparse-mode is being used externally, you might want dense-mode sources to be known to the outside world. Because this switch is not an RP, it would not have an RP address to use in an SA message. Therefore, this command provides the RP address by specifying the address of the interface. Beginning in privileged EXEC mode, follow these steps to allow an MSDP speaker that originates an SA message to use the IP address on the interface as the RP address in the SA message. This procedure is optional. If both the ip msdp border sa-address and the ip msdp originator-id global configuration commands are configured, the address derived from the ip msdp originator-id command determines the address of the RP. To prevent the RP address from being derived in this way, use the no ip msdp originator-id interface-id global configuration command. Step 5 show running-config Verify your entries. Step 6 copy running-config startup-config (Optional) Save your entries in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 ip msdp originator-id interface-id Configures the RP address in SA messages to be the address of the originating device interface. For interface-id, specify the interface on the local switch. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entries. Step 5 copy running-config startup-config (Optional) Save your entries in the configuration file.32-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Monitoring and Maintaining MSDP Monitoring and Maintaining MSDP To monitor MSDP SA messages, peers, state, or peer status, use one or more of the privileged EXEC commands in Table 32-1: To clear MSDP connections, statistics, or SA cache entries, use the privileged EXEC commands in Table 32-2: Table 32-1 Commands for Monitoring and Maintaining MSDP Command Purpose debug ip msdp [peer-address | name] [detail] [routes] Debugs an MSDP activity. debug ip msdp resets Debugs MSDP peer reset reasons. show ip msdp count [autonomous-system-number] Displays the number of sources and groups originated in SA messages from each autonomous system. The ip msdp cache-sa-state command must be configured for this command to produce any output. show ip msdp peer [peer-address | name] Displays detailed information about an MSDP peer. show ip msdp sa-cache [group-address | source-address | group-name | source-name] [autonomous-system-number] Displays (S,G) state learned from MSDP peers. show ip msdp summary Displays MSDP peer status and SA message counts. Table 32-2 Commands for Clearing MSDP Connections, Statistics, or SA Cache Entries Command Purpose clear ip msdp peer peer-address | name Clears the TCP connection to the specified MSDP peer, resetting all MSDP message counters. clear ip msdp statistics [peer-address | name] Clears statistics counters for one or all the MSDP peers without resetting the sessions. clear ip msdp sa-cache [group-address | name] Clears the SA cache entries for all entries, all sources for a specific group, or all entries for a specific source/group pair.32-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 32 Configuring MSDP Monitoring and Maintaining MSDPC H A P T E R 33-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 33 Configuring Fallback Bridging This chapter describes how to configure fallback bridging (VLAN bridging) on the Catalyst 3750 switch.With fallback bridging, you can forward non-IP packets that the switch does not route between VLAN bridge domains and routed ports. To use this feature, the stack master must be running the enhanced multilayer image (EMI). Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the Cisco IOS Bridging and IBM Networking Command Reference for Release 12.1. This chapter consists of these sections: • Understanding Fallback Bridging, page 33-1 • Configuring Fallback Bridging, page 33-3 • Monitoring and Maintaining Fallback Bridging, page 33-11 Understanding Fallback Bridging These sections describe how fallback bridging works: • Fallback Bridging Overview, page 33-1 • Fallback Bridging and Switch Stacks, page 33-3 Fallback Bridging Overview With fallback bridging, the switch bridges together two or more VLANs or routed ports, essentially connecting multiple VLANs within one bridge domain. Fallback bridging forwards traffic that the switch does not route and forwards traffic belonging to a nonroutable protocol such as DECnet. A VLAN bridge domain is represented with switch virtual interfaces (SVIs). A set of SVIs and routed ports (which do not have any VLANs associated with them) can be configured (grouped together) to form a bridge group. Recall that an SVI represents a VLAN of switch ports as one interface to the routing or bridging function in the system. You associate only one SVI with a VLAN, and you configure an SVI for a VLAN only when you want to route between VLANs, to fallback-bridge nonroutable protocols between VLANs, or to provide IP host connectivity to the switch. A routed port is a physical port that 33-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Understanding Fallback Bridging acts like a port on a router, but it is not connected to a router. A routed port is not associated with a particular VLAN, does not support VLAN subinterfaces, but behaves like a normal routed interface. For more information about SVIs and routed ports, see Chapter 11, “Configuring Interface Characteristics.” A bridge group is an internal organization of network interfaces on a switch. You cannot use bridge groups to identify traffic switched within the bridge group outside the switch on which they are defined. Bridge groups on the switch function as distinct bridges; that is, bridged traffic and bridge protocol data units (BPDUs) are not exchanged between different bridge groups on a switch. Fallback bridging does not allow the spanning trees from the VLANs being bridged to collapse. Each VLAN has its own spanning-tree instance and a separate spanning tree, called the VLAN-bridge spanning tree, which runs on top of the bridge group to prevent loops. The switch creates a VLAN-bridge spanning-tree instance when a bridge group is created. The switch runs the bridge group and treats the SVIs and routed ports in the bridge group as its spanning-tree ports. These are the reasons for placing network interfaces into a bridge group: • To bridge all nonrouted traffic among the network interfaces making up the bridge group. If the packet destination address is in the bridge table, the packet is forwarded on a single interface in the bridge group. If the packet destination address is not in the bridge table, the packet is flooded on all forwarding interfaces in the bridge group. A source MAC address is learned on a bridge group only when the address is learned on a VLAN (the reverse is not true). Any address that is learned on a stack member is learned by all switches in the stack. • To participate in the spanning-tree algorithm by receiving, and in some cases sending, BPDUs on the LANs to which they are attached. A separate spanning-tree process runs for each configured bridge group. Each bridge group participates in a separate spanning-tree instance. A bridge group establishes a spanning-tree instance based on the BPDUs it receives on only its member interfaces. If the bridge STP BPDU is received on a port whose VLAN does not belong to a bridge group, the BPDU is flooded on all the forwarding ports of the VLAN. Figure 33-1 shows a fallback bridging network example. The switch has two interfaces configured as SVIs with different assigned IP addresses and attached to two different VLANs. Another interface is configured as a routed port with its own IP address. If all three of these ports are assigned to the same bridge group, non-IP protocol frames can be forwarded among the end stations connected to the switch even though they are on different networks and in different VLANs. IP addresses do not need to be assigned to routed ports or SVIs for fallback bridging to work. Figure 33-1 Fallback Bridging Network Example Si Host A Host C 172.20.128.1 172.20.129.1 SVI 1 Routed port 172.20.130.1 SVI 2 Catalyst 3750 switch with enhanced multilayer software image VLAN 20 Host B VLAN 30 8647033-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Fallback Bridging and Switch Stacks When the stack master fails, a stack member becomes the new stack master by using the election process described in Chapter 5, “Managing Switch Stacks.” The new stack master creates new VLAN-bridge spanning-tree instance, which temporarily puts the spanning-tree ports used for fallback bridging into a nonforwarding state. A momentary traffic disruption occurs until the spanning-tree states transition to the forwarding state. All MAC addresses must be relearned in the bridge group. Note If a stack master running the EMI fails and if the newly elected stack master is running the SMI, the switch stack loses its fallback bridging capability. If stacks merge or if a switch is added to the stack, any new VLANs that are part of a bridge group and become active are included in the VLAN-bridge STP. When a stack member fails, the addresses learned from this member are deleted from the bridge group MAC address table. For more information about switch stacks, see Chapter 5, “Managing Switch Stacks.” Configuring Fallback Bridging These sections describe how to configure fallback bridging on your switch: • Default Fallback Bridging Configuration, page 33-4 • Fallback Bridging Configuration Guidelines, page 33-4 • Creating a Bridge Group, page 33-4 (required) • Adjusting Spanning-Tree Parameters, page 33-6 (optional)33-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Default Fallback Bridging Configuration Table 33-1 shows the default fallback bridging configuration. Fallback Bridging Configuration Guidelines Up to 32 bridge groups can be configured on the switch. An interface (an SVI or routed port) can be a member of only one bridge group. Use a bridge group for each separately bridged (topologically distinct) network connected to the switch. Creating a Bridge Group To configure fallback bridging for a set of SVIs or routed ports, these interfaces must be assigned to bridge groups. All interfaces in the same group belong to the same bridge domain. Each SVI or routed port can be assigned to only one bridge group. Note The protected port feature is not compatible with fallback bridging. When fallback bridging is enabled, it is possible for packets to be forwarded from one protected port on a switch to another protected port on the same switch if the ports are in different VLANs. Table 33-1 Default Fallback Bridging Configuration Feature Default Setting Bridge groups None are defined or assigned to an interface. No VLAN-bridge STP is defined. Switch forwards frames for stations that it has dynamically learned Enabled. Spanning tree parameters: • Switch priority • Interface priority • Interface path cost • Hello BPDU interval • Forward-delay interval • Maximum idle interval • 32768. • 128. • 10 Mbps: 100. 100 Mbps: 19. 1000 Mbps: 4. • 2 seconds. • 20 seconds. • 30 seconds.33-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Beginning in privileged EXEC mode, follow these steps to create a bridge group and to assign an interface to it. This procedure is required. To remove a bridge group, use the no bridge bridge-group global configuration command. The no bridge bridge-group command automatically removes all SVIs and routes ports from that bridge group. To remove an interface from a bridge group and to remove the bridge group, use the no bridge-group bridge-group interface configuration command. This example shows how to create bridge group 10, to specify that the VLAN-bridge STP runs in the bridge group, to define the interface on stack member 3 as a routed port, and to assign the interface to the bridge group: Switch(config)# bridge 10 protocol vlan-bridge Switch(config)# interface gigabitethernet3/0/1 Switch(config-if)# no switchport Switch(config-if)# no shutdown Switch(config-if)# bridge-group 10 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 bridge bridge-group protocol vlan-bridge Assign a bridge group number, and specify the VLAN-bridge spanning-tree protocol to run in the bridge group. The ibm and dec keywords are not supported. For bridge-group, specify the bridge group number. The range is 1 to 255. You can create up to 32 bridge groups. Frames are bridged only among interfaces in the same group. Step 3 interface interface-id Enter interface configuration mode, and specify the interface on which you want to assign the bridge group. The specified interface must be one of these: • A routed port: a physical port that you have configured as a Layer 3 port by entering the no switchport interface configuration command. • An SVI: a VLAN interface that you created by using the interface vlan vlan-id global configuration command. Note You can assign an IP address to the routed port or to the SVI, but it is not required. Step 4 bridge-group bridge-group Assign the interface to the bridge group created in Step 2. By default, the interface is not assigned to any bridge group. An interface can be assigned to only one bridge group. Step 5 end Return to privileged EXEC mode. Step 6 show running-config Verify your entries. Step 7 copy running-config startup-config (Optional) Save your entries in the configuration file.33-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging This example shows how to create bridge group 10 and to specify that the VLAN-bridge STP runs in the bridge group. It defines an interface on stack member 2 as an SVI and assigns this interface to VLAN 2 and to the bridge group: Switch(config)# bridge 10 protocol vlan-bridge Switch(config)# vlan 2 Switch(config-vlan)# exit Switch(config)# interface vlan 2 Switch(config-if)# bridge-group 10 Switch(config-if)# no shutdown Switch(config-if)# exit Switch(config)# interface gigabitethernet2/0/2 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 2 Switch(config-if)# no shutdown Adjusting Spanning-Tree Parameters You might need to adjust certain spanning-tree parameters if the default values are not suitable. You configure parameters affecting the entire spanning tree by using variations of the bridge global configuration command. You configure interface-specific parameters by using variations of the bridge-group interface configuration command. You can adjust spanning-tree parameters by performing any of the tasks in these sections: • Changing the VLAN-Bridge Spanning-Tree Priority, page 33-7 (optional) • Changing the Interface Priority, page 33-7 (optional) • Assigning a Path Cost, page 33-8 (optional) • Adjusting BPDU Intervals, page 33-9 (optional) • Disabling the Spanning Tree on an Interface, page 33-11 (optional) Note Only network administrators with a good understanding of how switches and STP function should make adjustments to spanning-tree parameters. Poorly planned adjustments can have a negative impact on performance. A good source on switching is the IEEE 802.1D specification. For more information, refer to the “References and Recommended Reading” appendix in the Cisco IOS Configuration Fundamentals Command Reference.33-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Changing the VLAN-Bridge Spanning-Tree Priority You can globally configure the VLAN-bridge spanning-tree priority of a switch when it ties with another switch for the position as the root switch. You also can configure the likelihood that the switch will be selected as the root switch. This priority is determined by default; however, you can change it. Beginning in privileged EXEC mode, follow these steps to change the switch priority. This procedure is optional. To return to the default setting, use the no bridge bridge-group priority global configuration command. To change the priority on an interface, use the bridge-group priority interface configuration command (described in the next section). This example shows how to set the switch priority to 100 for bridge group 10: Switch(config)# bridge 10 priority 100 Changing the Interface Priority You can change the priority for an interface. When two switches tie for position as the root switch, you configure an interface priority to break the tie. The switch with the lowest interface value is elected. Beginning in privileged EXEC mode, follow these steps to change the interface priority. This procedure is optional. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 bridge bridge-group priority number Change the VLAN-bridge spanning-tree priority of the switch. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For number, enter a number from 0 to 65535. The default is 32768. The lower the number, the more likely the switch will be chosen as the root. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to set the priority. Step 3 bridge-group bridge-group priority number Change the priority of an interface. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For number, enter a number from 0 to 255 in increments of 4. The lower the number, the more likely that the interface on the switch will be chosen as the root. The default is 128. Step 4 end Return to privileged EXEC mode.33-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging To return to the default setting, use the no bridge-group bridge-group priority interface configuration command. This example shows how to change the priority to 20 on an interface on stack member 2 in bridge group 10: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# bridge-group 10 priority 20 Assigning a Path Cost Each interface has a path cost associated with it. By convention, the path cost is 1000/data rate of the attached LAN, in Mbps. Beginning in privileged EXEC mode, follow these steps to assign a path cost. This procedure is optional. To return to the default path cost, use the no bridge-group bridge-group path-cost interface configuration command. This example shows how to change the path cost to 20 on an interface on stack member 2 in bridge group 10: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# bridge-group 10 path-cost 20 Step 5 show running-config Verify your entry. Step 6 copy running-config startup-config (Optional) Save your entry in the configuration file. Command Purpose Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface to set the path cost. Step 3 bridge-group bridge-group path-cost cost Assign the path cost of an interface. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For cost, enter a number from 0 to 65535. The higher the value, the higher the cost. – For 10 Mbps, the default path cost is 100. – For 100 Mbps, the default path cost is 19. – For 1000 Mbps, the default path cost is 4. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entry. Step 6 copy running-config startup-config (Optional) Save your entry in the configuration file.33-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Adjusting BPDU Intervals You can adjust BPDU intervals as described in these sections: • Adjusting the Interval between Hello BPDUs, page 33-9 (optional) • Changing the Forward-Delay Interval, page 33-10 (optional) • Changing the Maximum-Idle Interval, page 33-10 (optional) Note Each switch in a spanning tree adopts the interval between hello BPDUs, the forward delay interval, and the maximum idle interval parameters of the root switch, regardless of what its individual configuration might be. Adjusting the Interval between Hello BPDUs Beginning in privileged EXEC mode, follow these step to adjust the interval between hello BPDUs. This procedure is optional. To return to the default setting, use the no bridge bridge-group hello-time global configuration command. This example shows how to change the hello interval to 5 seconds in bridge group 10: Switch(config)# bridge 10 hello-time 5 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 bridge bridge-group hello-time seconds Specify the interval between hello BPDUs. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For seconds, enter a number from 1 to 10. The default is 2. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file.33-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Configuring Fallback Bridging Changing the Forward-Delay Interval The forward-delay interval is the amount of time spent listening for topology change information after an interface has been activated for switching and before forwarding actually begins. Beginning in privileged EXEC mode, follow these steps to change the forward-delay interval. This procedure is optional. To return to the default setting, use the no bridge bridge-group forward-time global configuration command. This example shows how to change the forward-delay interval to 10 seconds in bridge group 10: Switch(config)# bridge 10 forward-time 10 Changing the Maximum-Idle Interval If a switch does not receive BPDUs from the root switch within a specified interval, it recomputes the spanning-tree topology. Beginning in privileged EXEC mode, follow these steps to change the maximum-idle interval (maximum aging time). This procedure is optional. To return to the default setting, use the no bridge bridge-group max-age global configuration command. This example shows how to change the maximum-idle interval to 30 seconds in bridge group 10: Switch(config)# bridge 10 max-age 30 Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 bridge bridge-group forward-time seconds Specify the forward-delay interval. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For seconds, enter a number from 4 to 200. The default is 20. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 bridge bridge-group max-age seconds Specify the interval that the switch waits to hear BPDUs from the root switch. • For bridge-group, specify the bridge group number. The range is 1 to 255. • For seconds, enter a number from 6 to 200. The default is 30. Step 3 end Return to privileged EXEC mode. Step 4 show running-config Verify your entry. Step 5 copy running-config startup-config (Optional) Save your entry in the configuration file.33-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Monitoring and Maintaining Fallback Bridging Disabling the Spanning Tree on an Interface When a loop-free path exists between any two switched subnetworks, you can prevent BPDUs generated in one switching subnetwork from impacting devices in the other switching subnetwork, yet still permit switching throughout the network as a whole. For example, when switched LAN subnetworks are separated by a WAN, BPDUs can be prevented from traveling across the WAN link. Beginning in privileged EXEC mode, follow these steps to disable spanning tree on an interface. This procedure is optional. To re-enable spanning tree on the interface, use the no bridge-group bridge-group spanning-disabled interface configuration command. This example shows how to disable spanning tree on an interface on stack member 2 in bridge group 10: Switch(config)# interface gigabitethernet2/0/1 Switch(config-if)# bridge group 10 spanning-disabled Monitoring and Maintaining Fallback Bridging To monitor and maintain the network, use one or more of the privileged EXEC commands in Table 33-2: To display the bridge-group MAC address table on a stack member, start a session from the stack master to the stack member by using the session stack-member-number global configuration command. Enter the show bridge [bridge-group] [interface-id | mac-address | verbose] privileged EXEC command at the stack member prompt. For information about the fields in these displays, refer to the Cisco IOS Bridging and IBM Networking Command Reference for Release 12.1. Command Purpose Step 1 configure terminal Enter global configuration mode. Step 2 interface interface-id Enter interface configuration mode, and specify the interface ID. Step 3 bridge-group bridge-group spanning-disabled Disable spanning tree on the interface. For bridge-group, specify the bridge group number. The range is 1 to 255. Step 4 end Return to privileged EXEC mode. Step 5 show running-config Verify your entry. Step 6 copy running-config startup-config (Optional) Save your entry in the configuration file. Table 33-2 Commands for Monitoring and Maintaining Fallback Bridging Command Purpose clear bridge bridge-group Removes any learned entries from the forwarding database. show bridge [bridge-group] group Displays details about the bridge group. show bridge [bridge-group] [interface-id | mac-address | verbose] Displays MAC addresses learned in the bridge group.33-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 33 Configuring Fallback Bridging Monitoring and Maintaining Fallback BridgingC H A P T E R 34-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 34 Troubleshooting This chapter describes how to identify and resolve software problems related to the Cisco IOS software on the Catalyst 3750 switch. Depending on the nature of the problem, you can use the command-line interface (CLI) or the Cluster Management Suite (CMS) to identify and solve problems. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Additional troubleshooting information is provided in the hardware installation guide. Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release and the Cisco IOS Command Summary for Release 12.1. This chapter consists of these sections: • Recovering from Corrupted Software By Using the XMODEM Protocol, page 34-2 • Recovering from a Lost or Forgotten Password, page 34-4 • Preventing Switch Stack Problems, page 34-8 • Recovering from a Command Switch Failure, page 34-9 • Recovering from Lost Cluster Member Connectivity, page 34-12 Note Recovery procedures require that you have physical access to the switch. • Preventing Autonegotiation Mismatches, page 34-12 • SFP Module Security and Identification, page 34-13 • Using Ping, page 34-13 • Using Layer 2 Traceroute, page 34-15 • Using Debug Commands, page 34-17 • Using the show platform forward Command, page 34-19 • Using the crashinfo File, page 34-2134-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from Corrupted Software By Using the XMODEM Protocol Recovering from Corrupted Software By Using the XMODEM Protocol Switch software can be corrupted during an upgrade, by downloading the wrong file to the switch, and by deleting the image file. In all of these cases, the switch does not pass the power-on self-test (POST), and there is no connectivity. This procedure uses the XMODEM Protocol to recover from a corrupt or wrong image file. There are many software packages that support the XMODEM Protocol, and this procedure is largely dependent on the emulation software you are using. This recovery procedure requires that you have physical access to the switch. Step 1 From your PC, download the software image tar file (image_filename.tar) from Cisco.com. The Cisco IOS image is stored as a bin file in a directory in the tar file. For information about locating the software image files on Cisco.com, refer to the release notes. Step 2 Extract the bin file from the tar file. • If you are using Windows, use a zip program that is capable of reading a tar file. Use the zip program to navigate to and extract the bin file. • If you are using UNIX, follow these steps: 1. Display the contents of the tar file by using the tar -tvf UNIX command. switch% tar -tvf image_filename.tar drwxr-xr-x 9658/25 0 Apr 21 13:20 2003 c3750-i5-mz.121.11-AX/ drwxr-xr-x 9658/25 0 Apr 18 18:31 2003 c3750-i5-mz.121.11-AX/html/ -rw-r--r-- 9658/25 4005 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/homepage.htm -rw-r--r-- 9658/25 1392 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/not_supported.html -rw-r--r-- 9658/25 9448 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/common.js -rw-r--r-- 9658/25 22152 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/cms_splash.gif -rw-r--r-- 9658/25 1211 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/cms_13.html -rw-r--r-- 9658/25 2823 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/cluster.html -rw-r--r-- 9658/25 4195 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/Redirect.jar -rw-r--r-- 9658/25 14984 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/mono_disc.sgz -rw-r--r-- 9658/25 1329516 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/CMS.sgz -rw-r--r-- 9658/25 140105 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/images.sgz -rw-r--r-- 9658/25 213848 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/help.sgz -rw-r--r-- 9658/25 135599 Apr 18 15:56 2003 c3750-i5-mz.121.11-AX/html/CiscoChartPanel.sgz -rwxr-xr-x 9658/25 58860 Apr 18 18:31 2003 c3750-i5-mz.121.11-AX/html/cms_boot.jar -rw-r--r-- 9658/25 3970586 Apr 21 12:00 2003 c3750-i5-mz.121.11-AX/c3750-i5-mz.121.11-AX.bin -rw-r--r-- 9658/25 391 Apr 21 13:20 2003 c3750-i5-mz.121.11-AX/info -rw-r--r-- 9658/25 98 Apr 18 16:46 2003 info34-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from Corrupted Software By Using the XMODEM Protocol 2. Locate the bin file and extract it by using the tar -xvf UNIX command. switch% tar -xvf image_filename.tar image_filename.bin x c3750-i5-mz.121.11-AX/c3750-i5-mz.121.11-AX.bin, 3970586 bytes, 7756 tape blocks 3. Verify that the bin file was extracted by using the ls -l UNIX command. switch% ls -l image_filename.bin -rw-r--r-- 1 boba 3970586 Apr 21 12:00 c3750-i5-mz.121.11-AX/c3750-i5-mz.121.11-AX.bin Step 3 Connect your PC with terminal-emulation software supporting the XMODEM Protocol to the switch console port. Step 4 Set the line speed on the emulation software to 9600 baud. Step 5 Unplug the switch power cord. Step 6 Press the Mode button, and at the same time, reconnect the power cord to the switch. You can release the Mode button a second or two after the LED above port 1 goes off. Several lines of information about the software appear along with instructions: The system has been interrupted prior to initializing the flash file system. The following commands will initialize the flash file system, and finish loading the operating system software# flash_init load_helper boot Step 7 Initialize the Flash file system: switch: flash_init Step 8 If you had set the console port speed to anything other than 9600, it has been reset to that particular speed. Change the emulation software line speed to match that of the switch console port. Step 9 Load any helper files: switch: load_helper Step 10 Start the file transfer by using the XMODEM protocol. switch: copy xmodem: flash:image_filename.bin Step 11 After the XMODEM request appears, use the appropriate command on the terminal-emulation software to start the transfer and to copy the software image into Flash memory. Step 12 Boot the newly-downloaded Cisco IOS image. switch:boot flash:image_filename.bin Step 13 Use the archive download-sw privileged EXEC command to download the software image to the switch or to the switch stack. Step 14 Use the reload privileged EXEC command to restart the switch and to verify that the new software image is operating properly. Step 15 Delete the flash:image_filename.bin file from the switch.34-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Lost or Forgotten Password Recovering from a Lost or Forgotten Password The default configuration for the switch allows an end user with physical access to the switch to recover from a lost password by interrupting the boot process during power-on and by entering a new password. These recovery procedures require that you have physical access to the switch. Note On these switches, a system administrator can disable some of the functionality of this feature by allowing an end user to reset a password only by agreeing to return to the default configuration. If you are an end user trying to reset a password when password recovery has been disabled, a status message shows this during the recovery process. This section describes how to recover a forgotten or lost switch password. It provides two solutions: • Procedure with Password Recovery Enabled, page 34-5 • Procedure with Password Recovery Disabled, page 34-6 You enable or disable password recovery by using the service password-recovery global configuration command. When you enter the service password-recovery or no service password-recovery command on the stack master, it is propagated throughout the stack and applied to all switches in the stack. Follow the steps in this procedure if you have forgotten or lost the switch password. Step 1 Connect a terminal or PC with terminal-emulation software to the switch console port. If you are recovering the password to a switch stack, connect to the console port of the stack master. Step 2 Set the line speed on the emulation software to 9600 baud. Step 3 Power off the standalone switch or the entire switch stack. Step 4 Press the Mode button, and at the same time, reconnect the power cord to the standalone switch or the stack master. You can release the Mode button a second or two after the LED above port 1 turns off. Several lines of information about the software appear with instructions, informing you if the password recovery procedure has been disabled or not. • If you see a message that begins with this: The system has been interrupted prior to initializing the flash file system. The following commands will initialize the flash file system proceed to the “Procedure with Password Recovery Enabled” section on page 34-5, and follow the steps. • If you see a message that begins with this: The password-recovery mechanism has been triggered, but is currently disabled. proceed to the “Procedure with Password Recovery Disabled” section on page 34-6, and follow the steps. Step 5 After recovering the password, reload the standalone switch or the stack master: Switch> reload slot Proceed with reload? [confirm] y Step 6 Power on the rest of the switch stack.34-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Lost or Forgotten Password Procedure with Password Recovery Enabled If the password-recovery mechanism is enabled, this message appears: The system has been interrupted prior to initializing the flash file system. The following commands will initialize the flash file system, and finish loading the operating system software: flash_init load_helper boot Step 1 Initialize the Flash file system: switch: flash_init Step 2 If you had set the console port speed to anything other than 9600, it has been reset to that particular speed. Change the emulation software line speed to match that of the switch console port. Step 3 Load any helper files: switch: load_helper Step 4 Display the contents of Flash memory: switch: dir flash: The switch file system appears: Directory of flash: 13 drwx 192 Mar 01 1993 22:30:48 c3750-i5-mz-121-1.0 11 -rwx 5825 Mar 01 1993 22:31:59 config.text 18 -rwx 720 Mar 01 1993 02:21:30 vlan.dat 16128000 bytes total (10003456 bytes free) Step 5 Rename the configuration file to config.text.old. This file contains the password definition. switch: rename flash:config.text flash:config.text.old Step 6 Boot the system: switch: boot You are prompted to start the setup program. Enter N at the prompt: Continue with the configuration dialog? [yes/no]: N Step 7 At the switch prompt, enter privileged EXEC mode: Switch> enable Step 8 Rename the configuration file to its original name: Switch# rename flash:config.text.old flash:config.text Note Before continuing to Step 9, power on any connected stack members and wait until they have completely initialized.34-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Lost or Forgotten Password Step 9 Copy the configuration file into memory: Switch# copy flash:config.text system:running-config Source filename [config.text]? Destination filename [running-config]? Press Return in response to the confirmation prompts. The configuration file is now reloaded, and you can change the password. Step 10 Enter global configuration mode: Switch# configure terminal Step 11 Change the password: Switch (config)# enable secret password The secret password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, and allows spaces but ignores leading spaces. Step 12 Return to privileged EXEC mode: Switch (config)# exit Switch# Step 13 Write the running configuration to the startup configuration file: Switch# copy running-config startup-config The new password is now in the startup configuration. Note This procedure is likely to leave your switch virtual interface in a shutdown state. You can see which interface is in this state by entering the show running-config privileged EXEC command. To re-enable the interface, enter the interface vlan vlan-id global configuration command, and specify the VLAN ID of the shutdown interface. With the switch in interface configuration mode, enter the no shutdown command. Step 14 Reload the switch stack: Switch# reload Procedure with Password Recovery Disabled If the password-recovery mechanism is disabled, this message appears: The password-recovery mechanism has been triggered, but is currently disabled. Access to the boot loader prompt through the password-recovery mechanism is disallowed at this point. However, if you agree to let the system be reset back to the default system configuration, access to the boot loader prompt can still be allowed. Would you like to reset the system back to the default configuration (y/n)? Caution Returning the switch to the default configuration results in the loss of all existing configurations. We recommend that you contact your system administrator to verify if there are backup switch and VLAN configuration files.34-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Lost or Forgotten Password • If you enter n (no), the normal boot process continues as if the Mode button had not been pressed; you cannot access the boot loader prompt, and you cannot enter a new password. You see the message: Press Enter to continue........ • If you enter y (yes), the configuration file in Flash memory and the VLAN database file are deleted. When the default configuration loads, you can reset the password. Step 1 Elect to continue with password recovery and lose the existing configuration: Would you like to reset the system back to the default configuration (y/n)? Y Step 2 Load any helper files: Switch: load_helper Step 3 Display the contents of Flash memory: switch: dir flash: The switch file system appears: Directory of flash: 13 drwx 192 Mar 01 1993 22:30:48 c3750-i5-mz-121-1.0 16128000 bytes total (10003456 bytes free) Step 4 Boot the system: Switch: boot You are prompted to start the setup program. To continue with password recovery, enter N at the prompt: Continue with the configuration dialog? [yes/no]: N Step 5 At the switch prompt, enter privileged EXEC mode: Switch> enable Step 6 Enter global configuration mode: Switch# configure terminal Step 7 Change the password: Switch (config)# enable secret password The secret password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, and allows spaces but ignores leading spaces. Step 8 Return to privileged EXEC mode: Switch (config)# exit Switch# Note Before continuing to Step 9, power on any connected stack members and wait until they have completely initialized.34-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Preventing Switch Stack Problems Step 9 Write the running configuration to the startup configuration file: Switch# copy running-config startup-config The new password is now in the startup configuration. Note This procedure is likely to leave your switch virtual interface in a shutdown state. You can see which interface is in this state by entering the show running-config privileged EXEC command. To re-enable the interface, enter the interface vlan vlan-id global configuration command, and specify the VLAN ID of the shutdown interface. With the switch in interface configuration mode, enter the no shutdown command. Step 10 You must now reconfigure the switch. If the system administrator has the backup switch and VLAN configuration files available, you should use those. Preventing Switch Stack Problems Note • Make sure the switches that you add to or remove from the switch stack are powered off. For all powering considerations in switch stacks, refer to the “Switch Installation” chapter in the hardware installation guide. • After adding or removing stack members, make sure that the switch stack is operating at full bandwidth (32 Gbps). Press the Mode button on a stack member until the Stack mode LED is on. The last two port LEDs on the switch should be green. Depending on the switch model, the last two ports are either 10/100/1000 ports or small form-factor pluggable (SFP) module ports. If one or both of the last two port LEDs are not green, the stack is not operating at full bandwidth. • We recommend using only one CLI session when managing the switch stack. Be careful when using multiple CLI sessions to the stack master. Commands that you enter in one session are not displayed in the other sessions. Therefore, it is possible that you might not be able to identify the session from which you entered a command. • Manually assigning stack member numbers according to the placement of the switches in the stack can make it easier to remotely troubleshoot the switch stack. However, you will need to remember that the switches have manually assigned numbers if you add, remove, or rearrange switches later. Use the switch current-stack-member-number renumber new-stack-member-number global configuration command to manually assign a stack member number. For more information about stack member numbers, see the “Stack Member Numbers” section on page 5-6. If you replace a stack member with an identical model, the new switch functions with the exact same configuration as the replaced switch. This is also assuming the new switch is using the same member number as the replaced switch. Removing powered-on stack members causes the switch stack to divide (partition) into two or more switch stacks, each with the same configuration. If you want the switch stacks to remain separate, change the IP address or addresses of the newly created switch stacks. To recover from a partitioned switch stack: 1. Power off the newly created switch stacks. 2. Reconnect them to the original switch stack through their StackWise ports. 3. Power on the switches. For the commands that you can use to monitor the switch stack and its members, see the “Displaying Information about the Switch Stack” section on page 5-16.34-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Command Switch Failure Recovering from a Command Switch Failure This section describes how to recover from a failed command switch. You can configure a redundant command switch group by using the Hot Standby Router Protocol (HSRP). For more information, see Chapter 6, “Clustering Switches” and Chapter 30, “Configuring HSRP.” Note HSRP is the preferred method for supplying redundancy to a cluster. If you have not configured a standby command switch, and your command switch loses power or fails in some other way, management contact with the member switches is lost, and you must install a new command switch. However, connectivity between switches that are still connected is not affected, and the member switches forward packets as usual. You can manage the members as standalone switches through the console port or, if they have IP addresses, through the other management interfaces. You can prepare for a command switch failure by assigning an IP address to a member switch or another switch that is command-capable, making a note of the command-switch password, and cabling your cluster to provide redundant connectivity between the member switches and the replacement command switch. This section describes two solutions for replacing a failed command switch: • Replacing a Failed Command Switch with a Cluster Member, page 34-9 • Replacing a Failed Command Switch with Another Switch, page 34-11 These recovery procedures require that you have physical access to the switch. For information on command-capable switches, refer to the release notes. Replacing a Failed Command Switch with a Cluster Member To replace a failed command switch with a command-capable member in the same cluster, follow these steps: Step 1 Disconnect the command switch from the member switches, and physically remove it from the cluster. Step 2 Insert the member switch in place of the failed command switch, and duplicate its connections to the cluster members. Step 3 Start a CLI session on the new command switch. You can access the CLI by using the console port or, if an IP address has been assigned to the switch, by using Telnet. For details about using the console port, refer to the switch hardware installation guide. Step 4 At the switch prompt, enter privileged EXEC mode: Switch> enable Switch# Step 5 Enter the password of the failed command switch. Step 6 Enter global configuration mode. Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Step 7 Remove the member switch from the cluster. Switch(config)# no cluster commander-address34-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Command Switch Failure Step 8 Return to privileged EXEC mode. Switch(config)# end Switch# Step 9 Use the setup program to configure the switch IP information. This program prompts you for IP address information and passwords. From privileged EXEC mode, enter setup, and press Return. Switch# setup --- System Configuration Dialog --- Continue with configuration dialog? [yes/no]: y At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no]: Step 10 Enter Y at the first prompt. The prompts in the setup program vary depending on the member switch you selected to be the command switch: Continue with configuration dialog? [yes/no]: y or Configuring global parameters: If this prompt does not appear, enter enable, and press Return. Enter setup, and press Return to start the setup program. Step 11 Respond to the questions in the setup program. When prompted for the host name, recall that on a command switch, the host name is limited to 28 characters; on a member switch to 31 characters. Do not use -n, where n is a number, as the last characters in a host name for any switch. When prompted for the Telnet (virtual terminal) password, recall that it can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces. Step 12 When prompted for the enable secret and enable passwords, enter the passwords of the failed command switch again. Step 13 When prompted, make sure to enable the switch as the cluster command switch, and press Return. Step 14 When prompted, assign a name to the cluster, and press Return. The cluster name can be 1 to 31 alphanumeric characters, dashes, or underscores. Step 15 After the initial configuration displays, verify that the addresses are correct. Step 16 If the displayed information is correct, enter Y, and press Return. If this information is not correct, enter N, press Return, and begin again at Step 9. Step 17 Start your browser, and enter the IP address of the new command switch. Step 18 From the Cluster menu, select Add to Cluster to display a list of candidate switches to add to the cluster.34-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from a Command Switch Failure Replacing a Failed Command Switch with Another Switch To replace a failed command switch with a switch that is command-capable but not part of the cluster, follow these steps: Step 1 Insert the new switch in place of the failed command switch, and duplicate its connections to the cluster members. Step 2 Start a CLI session on the new command switch. You can access the CLI by using the console port or, if an IP address has been assigned to the switch, by using Telnet. For details about using the console port, refer to the switch hardware installation guide. Step 3 At the switch prompt, enter privileged EXEC mode: Switch> enable Switch# Step 4 Enter the password of the failed command switch. Step 5 Use the setup program to configure the switch IP information. This program prompts you for IP address information and passwords. From privileged EXEC mode, enter setup, and press Return. Switch# setup --- System Configuration Dialog --- Continue with configuration dialog? [yes/no]: y At any point you may enter a question mark '?' for help. Use ctrl-c to abort configuration dialog at any prompt. Default settings are in square brackets '[]'. Basic management setup configures only enough connectivity for management of the system, extended setup will ask you to configure each interface on the system Would you like to enter basic management setup? [yes/no]: Step 6 Enter Y at the first prompt. The prompts in the setup program vary depending on the switch you selected to be the command switch: Continue with configuration dialog? [yes/no]: y or Configuring global parameters: If this prompt does not appear, enter enable, and press Return. Enter setup, and press Return to start the setup program. Step 7 Respond to the questions in the setup program. When prompted for the host name, recall that on a command switch, the host name is limited to 28 characters. Do not use -n, where n is a number, as the last characters in a host name for any switch. When prompted for the Telnet (virtual terminal) password, recall that it can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces. Step 8 When prompted for the enable secret and enable passwords, enter the passwords of the failed command switch again. Step 9 When prompted, make sure to enable the switch as the cluster command switch, and press Return.34-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Recovering from Lost Cluster Member Connectivity Step 10 When prompted, assign a name to the cluster, and press Return. The cluster name can be 1 to 31 alphanumeric characters, dashes, or underscores. Step 11 When the initial configuration displays, verify that the addresses are correct. Step 12 If the displayed information is correct, enter Y, and press Return. If this information is not correct, enter N, press Return, and begin again at Step 9. Step 13 Start your browser, and enter the IP address of the new command switch. Step 14 From the Cluster menu, select Add to Cluster to display a list of candidate switches to add to the cluster. Recovering from Lost Cluster Member Connectivity Some configurations can prevent the command switch from maintaining contact with member switches. If you are unable to maintain management contact with a member, and the member switch is forwarding packets normally, check for these conflicts: • A member switch (Catalyst 3750, Catalyst 3550, Catalyst 3500 XL, Catalyst 2950, Catalyst 2900 XL, Catalyst 2820, and Catalyst 1900 switch) cannot connect to the command switch through a port that is defined as a network port. • Catalyst 3500 XL, Catalyst 2900 XL, Catalyst 2820, and Catalyst 1900 member switches must connect to the command switch through a port that belongs to the same management VLAN. • A member switch (Catalyst 3750, Catalyst 3550, Catalyst 2950, Catalyst 3500 XL, Catalyst 2900 XL, Catalyst 2820, and Catalyst 1900 switch) connected to the command switch through a secured port can lose connectivity if the port is disabled because of a security violation. Preventing Autonegotiation Mismatches The IEEE 802.3AB autonegotiation protocol manages the switch settings for speed (10 Mbps, 100 Mbps, and 1000 Mbps, excluding SFP module ports) and duplex (half or full). There are situations when this protocol can incorrectly align these settings, reducing performance. A mismatch occurs under these circumstances: • A manually-set speed or duplex parameter is different from the manually set speed or duplex parameter on the connected port. • A port is set to autonegotiate, and the connected port is set to full duplex with no autonegotiation. To maximize switch performance and ensure a link, follow one of these guidelines when changing the settings for duplex and speed: • Let both ports autonegotiate both speed and duplex. • Manually set the speed and duplex parameters for the ports on both ends of the connection. Note If a remote device does not autonegotiate, configure the duplex settings on the two ports to match. The speed parameter can adjust itself even if the connected port does not autonegotiate.34-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting SFP Module Security and Identification SFP Module Security and Identification Cisco-approved small form-factor pluggable (SFP) modules have a serial EEPROM that contains the module serial number, the vendor name and ID, a unique security code, and cyclic redundancy check (CRC). When an SFP module is inserted in the switch, the switch software reads the EEPROM to verify the serial number, vendor name and vendor ID, and recompute the security code and CRC. If the serial number, the vendor name or vendor ID, the security code, or CRC is invalid, the software generates a security error message and places the interface in an error-disabled state. Note The security error message references the GBIC_SECURITY facility. The Catalyst 3750 supports SFP modules and does not support GBIC modules. Although the error message text refers to GBIC interfaces and modules, the security messages actually refer to the SFP modules and module interfaces. For more information about error messages, refer to the system message guide for this release. If you are using a non-Cisco approved SFP module, remove the SFP module from the switch, and replace it with a Cisco-approved module. After inserting a Cisco-approved SFP module, use the errdisable recovery cause gbic-invalid global configuration command to verify the port status, and enter a time interval for recovering from the error-disabled state. After the elapsed interval, the switch brings the interface out of the error-disabled state and retries the operation. For more information about the errdisable recovery command, refer to the command reference for this release. If the module is identified as a Cisco SFP module, but the system is unable to read vendor-data information to verify its accuracy, an SFP module error message is generated. In this case, you should remove and re-insert the SFP module. If it continues to fail, the SFP module might be defective. Using Ping This section consists of this information: • Understanding Ping, page 34-13 • Executing Ping, page 34-14 Understanding Ping The switch supports IP ping, which you can use to test connectivity to remote hosts. Ping sends an echo request packet to an address and waits for a reply. Ping returns one of these responses: • Normal response—The normal response (hostname is alive) occurs in 1 to 10 seconds, depending on network traffic. • Destination does not respond—If the host does not respond, a no-answer message is returned. • Unknown host—If the host does not exist, an unknown host message is returned. • Destination unreachable—If the default gateway cannot reach the specified network, a destination-unreachable message is returned. • Network or host unreachable—If there is no entry in the route table for the host or network, a network or host unreachable message is returned.34-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using Ping Executing Ping If you attempt to ping a host in a different IP subnetwork, you must define a static route to the network or have IP routing configured to route between those subnets. For more information, see Chapter 29, “Configuring IP Unicast Routing.” IP routing is disabled by default on all switches. If you need to enable or configure IP routing, see Chapter 29, “Configuring IP Unicast Routing.” Beginning in privileged EXEC mode, use this command to ping another device on the network from the switch: Note Though other protocol keywords are available with the ping command, they are not supported in this release. This example shows how to ping an IP host: Switch# ping 172.20.52.3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echoes to 172.20.52.3, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms Switch# Table 34-1 describes the possible ping character output. To terminate a ping session, enter the escape sequence (Ctrl-^ X by default). You enter the default by simultaneously pressing and releasing the Ctrl, Shift, and 6 keys, and then pressing the X key. Command Purpose ping ip host | address Ping a remote host through IP or by supplying the host name or network address. Table 34-1 Ping Output Display Characters Character Description ! Each exclamation point means receipt of a reply. . Each period means the network server timed out while waiting for a reply. U A destination unreachable error PDU was received. C A congestion experienced packet was received. I User interrupted test. ? Unknown packet type. & Packet lifetime exceeded.34-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using Layer 2 Traceroute Using Layer 2 Traceroute This section describes this information: • Understanding Layer 2 Traceroute, page 34-15 • Switches Supporting Layer 2 Traceroute, page 34-15 • Usage Guidelines, page 34-16 • Displaying the Physical Path, page 34-17 Understanding Layer 2 Traceroute The Layer 2 traceroute feature allows the switch to identify the physical path that a packet takes from a source device to a destination device. Layer 2 traceroute supports only unicast source and destination MAC addresses. It determines the path by using the MAC address tables of the switches in the path. When the switch detects a device in the path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out. The switch can only identify the path from the source device to the destination device. It cannot identify the path that a packet takes from source host to the source device or from the destination device to the destination host. Switches Supporting Layer 2 Traceroute The Layer 2 traceroute feature is available on these switches: • Catalyst 2940 switches • Catalyst 2950 switches running Cisco IOS Release 12.1(12c)EA1 or later • Catalyst 2955 switches • Catalyst 2970 switches • Catalyst 3550 switches running Cisco IOS Release 12.1(12c)EA1 or later • Catalyst 3750 switches • Catalyst 4000 switches running Catalyst software Cisco IOS Release 6.2 or later for the supervisor engine • Catalyst 5000 switches running Catalyst software Cisco IOS Release 6.1 or later for the supervisor engine • Catalyst 6000 switches running Catalyst software Cisco IOS Release 6.1 or later for the supervisor engine34-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using Layer 2 Traceroute Usage Guidelines These are the Layer 2 traceroute usage guidelines: • Cisco Discovery Protocol (CDP) must be enabled on all the devices in the network. For Layer 2 traceroute to function properly, do not disable CDP. For a list of switches that support Layer 2 traceroute, see the “Switches Supporting Layer 2 Traceroute” section on page 34-15. If any devices in the physical path are transparent to CDP, the switch cannot identify the path through these devices. Note For more information about enabling CDP, see Chapter 20, “Configuring CDP.” • A switch is reachable from another switch when you can test connectivity by using the ping privileged EXEC command. All switches in the physical path must be reachable from each other. • The maximum number of hops identified in the path is ten. • You can enter the traceroute mac or the traceroute mac ip privileged EXEC command on a switch that is not in the physical path from the source device to the destination device. All switches in the path must be reachable from this switch. • The traceroute mac command output shows the Layer 2 path only when the specified source and destination MAC addresses belong to the same VLAN. If you specify source and destination MAC addresses that belong to different VLANs, the Layer 2 path is not identified, and an error message appears. • If you specify a multicast source or destination MAC address, the path is not identified, and an error message appears. • If the source or destination MAC address belongs to multiple VLANs, you must specify the VLAN to which both the source and destination MAC addresses belong. If the VLAN is not specified, the path is not identified, and an error message appears. • The traceroute mac ip command output shows the Layer 2 path when the specified source and destination IP addresses belong to the same subnet. When you specify the IP addresses, the switch uses the Address Resolution Protocol (ARP) to associate the IP addresses with the corresponding MAC addresses and the VLAN IDs. – If an ARP entry exists for the specified IP address, the switch uses the associated MAC address and identifies the physical path. – If an ARP entry does not exist, the switch sends an ARP query and tries to resolve the IP address. If the IP address is not resolved, the path is not identified, and an error message appears. • When multiple devices are attached to one port through hubs (for example, multiple CDP neighbors are detected on a port), the Layer 2 traceroute feature is not supported. When more than one CDP neighbor is detected on a port, the Layer 2 path is not identified, and an error message appears. • This feature is not supported in Token Ring VLANs.34-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using Debug Commands Displaying the Physical Path You can display physical path that a packet takes from a source device to a destination device by using one of these privileged EXEC commands: • tracetroute mac [interface interface-id] {source-mac-address} [interface interface-id] {destination-mac-address} [vlan vlan-id] [detail] • tracetroute mac ip {source-ip-address | source-hostname}{destination-ip-address | destination-hostname} [detail] For more information, refer to the command reference for this release. Using Debug Commands This section explains how you use debug commands to diagnose and resolve internetworking problems. It contains this information: • Enabling Debugging on a Specific Feature, page 34-17 • Enabling All-System Diagnostics, page 34-18 • Redirecting Debug and Error Message Output, page 34-18 Caution Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. It is best to use debug commands during periods of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use. Note For complete syntax and usage information for specific debug commands, refer to the command reference for this release. Enabling Debugging on a Specific Feature When you enable debugging, it is enabled only on the stack master. To enable debugging on a stack member, you must start a session from the stack master by using the session switch-number privileged EXEC command. Then, enter the debug command at the command-line prompt of the stack member. All debug commands are entered in privileged EXEC mode, and most debug commands take no arguments. For example, beginning in privileged EXEC mode, enter this command to enable the debugging for Switched Port Analyzer (SPAN): Switch# debug span-session The switch continues to generate output until you enter the no form of the command.34-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using Debug Commands If you enable a debug command and no output appears, consider these possibilities: • The switch might not be properly configured to generate the type of traffic you want to monitor. Use the show running-config command to check its configuration. • Even if the switch is properly configured, it might not generate the type of traffic you want to monitor during the particular period that debugging is enabled. Depending on the feature you are debugging, you can use commands such as the TCP/IP ping command to generate network traffic. To disable debugging of SPAN, enter this command in privileged EXEC mode: Switch# no debug span-session Alternately, in privileged EXEC mode, you can enter the undebug form of the command: Switch# undebug span-session To display the state of each debugging option, enter this command in privileged EXEC mode: Switch# show debugging Enabling All-System Diagnostics Beginning in privileged EXEC mode, enter this command to enable all-system diagnostics: Switch# debug all Caution Because debugging output takes priority over other network traffic, and because the debug all privileged EXEC command generates more output than any other debug command, it can severely diminish switch performance or even render it unusable. In virtually all cases, it is best to use more specific debug commands. The no debug all privileged EXEC command disables all diagnostic output. Using the no debug all command is a convenient way to ensure that you have not accidentally left any debug commands enabled. Redirecting Debug and Error Message Output By default, the network server sends the output from debug commands and system error messages to the console. If you use this default, you can use a virtual terminal connection to monitor debug output instead of connecting to the console port. Possible destinations include the console, virtual terminals, internal buffer, and UNIX hosts running a syslog server. The syslog format is compatible with 4.3 Berkeley Standard Distribution (BSD) UNIX and its derivatives. Note Be aware that the debugging destination you use affects system overhead. Logging messages to the console produces very high overhead, whereas logging messages to a virtual terminal produces less overhead. Logging messages to a syslog server produces even less, and logging to an internal buffer produces the least overhead of any method.34-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using the show platform forward Command When stack members generate a system error message, the stack master displays the error message to all stack members. The syslog resides on the stack master. Note Make sure to save the syslog to Flash memory so that the syslog is not lost if the stack master fails. For more information about system message logging, see Chapter 24, “Configuring System Message Logging.” Using the show platform forward Command The output from the show platform forward privileged EXEC command provides some useful information about the forwarding results if a packet entering an interface is sent through the system. Depending upon the parameters entered about the packet, the output provides lookup table results and port maps used to calculate forwarding destinations, bitmaps, and egress information. Note For more syntax and usage information for the show platform forward command, refer to the switch command reference for this release. Most of the information in the output from the command is useful mainly for technical support personnel, who have access to detailed information about the switch application-specific integrated circuits (ASICs). However, packet forwarding information can also be helpful in troubleshooting. This is an example of the output from the show platform forward command on Gigabit Ethernet port 24 on stack member 1 in VLAN 5 when the packet entering that port is addressed to unknown MAC addresses. The packet should be flooded to all other ports in VLAN 5. Switch# show platform forward gigabitethernet1/0/24 vlan 5 1.1.1 2.2.2 ip 13.1.1.1 13.2.2.2 udp 10 20 Global Port Number:24, Asic Number:5 Src Real Vlan Id:5, Mapped Vlan Id:5 Ingress: Lookup Key-Used Index-Hit A-Data InptACL 40_0D020202_0D010101-00_40000014_000A0000 01FFA 03000000 L2Local 80_00050002_00020002-00_00000000_00000000 00C71 0000002B Station Descriptor:02340000, DestIndex:0239, RewriteIndex:F005 ========================================== Egress:Asic 2, switch 1 Output Packets: ------------------------------------------ Packet 1 Lookup Key-Used Index-Hit A-Data OutptACL 50_0D020202_0D010101-00_40000014_000A0000 01FFE 03000000 Port Vlan SrcMac DstMac Cos Dscpv Gi1/0/3 0005 0001.0001.0001 0002.0002.0002 ------------------------------------------ Packet 2 Lookup Key-Used Index-Hit A-Data OutptACL 50_0D020202_0D010101-00_40000014_000A0000 01FFE 03000000 Port Vlan SrcMac DstMac Cos Dscpv34-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using the show platform forward Command Gi1/0/4 0005 0001.0001.0001 0002.0002.0002 ------------------------------------------ Packet 3 Lookup Key-Used Index-Hit A-Data OutptACL 50_0D020202_0D010101-00_40000014_000A0000 01FFE 03000000 Port Vlan SrcMac DstMac Cos Dscpv Gi1/0/2 0005 0001.0001.0001 0002.0002.0002 ------------------------------------------

------------------------------------------ Packet 10 Lookup Key-Used Index-Hit A-Data OutptACL 50_0D020202_0D010101-00_40000014_000A0000 01FFE 03000000 Packet dropped due to failed DEJA_VU Check on Gi1/0/24 This is an example of the output when the packet coming in on Gigabit Ethernet port 24 on stack member 1 in VLAN 5 is sent to an address already learned on the VLAN on another port. It should be forwarded from the port on which the address was learned. Switch# show platform forward giigabitethernet1/0/24 vlan 5 1.1.1 0009.43a8.0145 ip 13.1.1.1 13.2.2.2 udp 10 20 Global Port Number:24, Asic Number:5 Src Real Vlan Id:5, Mapped Vlan Id:5 Ingress: Lookup Key-Used Index-Hit A-Data InptACL 40_0D020202_0D010101-00_40000014_000A0000 01FFA 03000000 L2Local 80_00050009_43A80145-00_00000000_00000000 00086 02010197 Station Descriptor:F0050003, DestIndex:F005, RewriteIndex:0003 ========================================== Egress:Asic 3, switch 1 Output Packets: ------------------------------------------ Packet 1 Lookup Key-Used Index-Hit A-Data OutptACL 50_0D020202_0D010101-00_40000014_000A0000 01FFE 03000000 Port Vlan SrcMac DstMac Cos Dscpv Gi1/0/5 0005 0001.0001.0001 0009.43A8.0145 This is an example of the output when the packet coming in on Gigabit Ethernet port 24 on stack member 1 in VLAN 5 has a destination MAC address set to the router MAC address in VLAN 5 and the destination IP address unknown. Since there is no default route set, the packet should be dropped. Switch# show platform forward gigabitethernet1/0/24 vlan 5 1.1.1 03.e319.ee44 ip 13.1.1.1 13.2.2.2 udp 10 20 Global Port Number:24, Asic Number:5 Src Real Vlan Id:5, Mapped Vlan Id:5 Ingress: Lookup Key-Used Index-Hit A-Data InptACL 40_0D020202_0D010101-00_41000014_000A0000 01FFA 03000000 L3Local 00_00000000_00000000-90_00001400_0D020202 010F0 01880290 L3Scndr 12_0D020202_0D010101-00_40000014_000A0000 034E0 000C001D_00000000 Lookup Used:Secondary Station Descriptor:02260000, DestIndex:0226, RewriteIndex:000034-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using the crashinfo File This is an example of the output when the packet coming in on Gigabit Ethernet port 24 on stack member 1 in VLAN 5 has a destination MAC address set to the router MAC address in VLAN 5 and the destination IP address set to an IP address that is in the IP routing table. It should be forwarded as specified in the routing table. Switch# show platform forward gigabitethernet1/0/24 vlan 5 1.1.1 03.e319.ee44 ip 110.1.5.5 16.1.10.5 Global Port Number:24, Asic Number:5 Src Real Vlan Id:5, Mapped Vlan Id:5 Ingress: Lookup Key-Used Index-Hit A-Data InptACL 40_10010A05_0A010505-00_41000014_000A0000 01FFA 03000000 L3Local 00_00000000_00000000-90_00001400_10010A05 010F0 01880290 L3Scndr 12_10010A05_0A010505-00_40000014_000A0000 01D28 30090001_00000000 Lookup Used:Secondary Station Descriptor:F0070007, DestIndex:F007, RewriteIndex:0007 ========================================== Egress:Asic 3, switch 1 Output Packets: ------------------------------------------ Packet 1 Lookup Key-Used Index-Hit A-Data OutptACL 50_10010A05_0A010505-00_40000014_000A0000 01FFE 03000000 Port Vlan SrcMac DstMac Cos Dscpv Gi1/0/7 0007 XXXX.XXXX.0246 0009.43A8.0147 Using the crashinfo File The crashinfo file saves information that helps Cisco technical support representatives to debug problems that caused the Cisco IOS image to fail (crash). The switch writes the crash information to the console at the time of the failure, and the file is created the next time you boot the Cisco IOS image after the failure (instead of while the system is failing). The information in the file includes the Cisco IOS image name and version that failed, a list of the processor registers, and a stack trace. You can provide this information to the Cisco technical support representative by using the show tech-support privileged EXEC command. All crashinfo files are kept in this directory on the Flash file system: flash:/crashinfo/crashinfo_n where n is a sequence number. Each new crashinfo file that is created uses a sequence number that is larger than any previously-existing sequence number, so the file with the largest sequence number describes the most recent failure. Version numbers are used instead of a timestamp because the switches do not include a real-time clock. You cannot change the name of the file that the system will use when it creates the file. However, after the file is created, you can use the rename privileged EXEC command to rename it, but the contents of the renamed file will not be displayed by the show stacks or the show tech-support privileged EXEC command. You can delete crashinfo files by using the delete privileged EXEC command. You can display the most recent crashinfo file (that is, the file with the highest sequence number at the end of its filename) by entering the show stacks or the show tech-support privileged EXEC command. You also can access the file by using any command that can copy or display files, such as the more or the copy privileged EXEC command.34-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Chapter 34 Troubleshooting Using the crashinfo FileA-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 A P P E N D I X A Supported MIBs This appendix lists the supported management information base (MIBs) for this release on the Catalyst 3750 switch. It contains these sections: • MIB List, page A-1 • Using FTP to Access the MIB Files, page A-3 MIB List • BRIDGE-MIB (RFC1493) Note The BRIDGE-MIB supports the context of a single VLAN. By default, SNMP messages using the configured community string always provide information for VLAN 1. To obtain the BRIDGE-MIB information for other VLANs, for example VLAN x, use this community string in the SNMP message: configured community string @x. • CISCO-CDP-MIB • CISCO-CLUSTER-MIB • CISCO-CONFIG-COPY-MIB • CISCO-CONFIG-MAN-MIB • CISCO-ENTITY-FRU-CONTROL-MIB • CISCO-ENVMON-MIB • CISCO-FLASH-MIB (Flash memory on all switches is modeled as removable Flash memory.) • CISCO-FTP-CLIENT-MIB • CISCO-HSRP-MIB • CISCO-HSRP-EXT-MIB (partial support) • CISCO-IGMP-FILTER-MIB • CISCO-IMAGE-MIB (Only stack master image details are shown.) • CISCO IP-STAT-MIB • CICSO-L2L3-INTERFACE-MIB • CISCO-LACP-MIBA-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix A Supported MIBs MIB List • CISCO-MAC-NOTIFICATION-MIB • CISCO-MEMORY-POOL-MIB (Only stack master image details are shown.) • CISCO-PAGP-MIB • CISCO-PING-MIB • CISCO-PROCESS-MIB (Only stack master details are shown.) • CISCO-RTTMON-MIB • CISCO-STACK-MIB (Partial support: for some objects, only stack master information is supported. ENTITY MIB is a better alternative.) • CISCO-STACKMAKER-MIB • CISCO-STP-EXTENSIONS-MIB • CISCO-SYSLOG-MIB • CISCO-TCP-MIB • CISCO-VLAN-IFTABLE-RELATIONSHIP-MIB • CISCO-VLAN-MEMBERSHIP-MIB • CISCO-VTP-MIB • ENTITY-MIB • ETHERLIKE_MIB • IEEE8023-LACP-MIB • IF-MIB (In and out counters for VLANs are not supported.) • IGMP-MIB • IPMROUTE-MIB • OLD-CISCO-CHASSIS-MIB (Partial support; some objects reflect only the stack master.) • OLD-CISCO-FLASH-MIB (Supports only the stack master. Use CISCO-FLASH_MIB.) • OLD-CISCO-INTERFACES-MIB • OLD-CISCO-IP-MIB • OLD-CISCO-SYS-MIB • OLD-CISCO-TCP-MIB • OLD-CISCO-TS-MIB • PIM-MIB • RFC1213-MIB (Functionality is as per the agent capabilities specified in the CISCO-RFC1213-CAPABILITY.my.) • RFC1253-MIB (OSPF-MIB) • RMON-MIB • RMON2-MIB • SNMP-FRAMEWORK-MIB • SNMP-MPD-MIB • SNMP-NOTIFICATION-MIB • SNMP-TARGET-MIBA-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix A Supported MIBs Using FTP to Access the MIB Files • SNMPv2-MIB • TCP-MIB • UDP-MIB Note You can also use this URL for a list of supported MIBs for the Catalyst 3750 switch: ftp://ftp.cisco.com/pub/mibs/supportlists/cat3750/cat3750-supportlist.html You can access other information about MIBs and Cisco products on the Cisco web site: http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml Using FTP to Access the MIB Files You can obtain each MIB file by using this procedure: Step 1 Use FTP to access the server ftp.cisco.com. Step 2 Log in with the username anonymous. Step 3 Enter your e-mail username when prompted for the password. Step 4 At the ftp> prompt, change directories to /pub/mibs/v1 and /pub/mibs/v2. Step 5 Use the get MIB_filename command to obtain a copy of the MIB file.A-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix A Supported MIBs Using FTP to Access the MIB FilesB-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 A P P E N D I X B Working with the Cisco IOS File System, Configuration Files, and Software Images This appendix describes how to manipulate the Catalyst 3750 Flash file system, how to copy configuration files, and how to archive (upload and download) software images to a standalone switch or to a switch stack. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note For complete syntax and usage information for the commands used in this chapter, refer to the switch command reference for this release and the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1. This appendix consists of these sections: • Working with the Flash File System, page B-1 • Working with Configuration Files, page B-9 • Working with Software Images, page B-21 Working with the Flash File System The Flash file system is a single Flash device on which you can store files. It also provides several commands to help you manage software image and configuration files. The default Flash file system on the switch is named flash:. As viewed from the stack master, or any stack member, flash: refers to the local Flash device, which is the device attached to the same switch on which the file system is being viewed. In a switch stack, each of the Flash devices from the various stack members can be viewed from the stack master. The names of these Flash file systems include the corresponding switch member numbers. For example, flash3:, as viewed from the stack master, refers to the same file system as does flash: on stack member 3. Use the show file systems privileged EXEC command to list all file systems, including the Flash file systems in the switch stack. No more than one user at a time can manage the software images and configuration files for a switch stack.B-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System This section contains this information: • Displaying Available File Systems, page B-2 • Setting the Default File System, page B-3 • Displaying Information about Files on a File System, page B-3 • Creating and Removing Directories, page B-4 • Copying Files, page B-5 • Deleting Files, page B-6 • Creating, Displaying, and Extracting tar Files, page B-6 • Displaying the Contents of a File, page B-8 Displaying Available File Systems To display the available file systems on your switch, use the show file systems privileged EXEC command as shown in this example. In this example, the stack master is stack member 3; therefore flash3: is aliased to flash:. The file system on stack member 5 is displayed as flash5 on the stack master. Switch# show file systems File Systems: Size(b) Free(b) Type Flags Prefixes * 15998976 5135872 flash rw flash:flash3: - - opaque rw bs: - - opaque rw vb: 524288 520138 nvram rw nvram: - - network rw tftp: - - opaque rw null: - - opaque rw system: - - opaque ro xmodem: - - opaque ro ymodem: 15998976 645120 unknown rw flash5: - - network rw rcp: - - network rw ftp: Table B-1 show file systems Field Descriptions Field Value Size(b) Amount of memory in the file system in bytes. Free(b) Amount of free memory in the file system in bytes. Type Type of file system. flash—The file system is for a Flash memory device. nvram—The file system is for a nonvolatile RAM (NVRAM) device. opaque—The file system is a locally generated pseudo file system (for example, the system) or a download interface, such as brimux. unknown—The file system is an unknown type.B-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System Setting the Default File System You can specify the file system or directory that the system uses as the default file system by using the cd filesystem: privileged EXEC command. You can set the default file system to omit the filesystem: argument from related commands. For example, for all privileged EXEC commands that have the optional filesystem: argument, the system uses the file system specified by the cd command. By default, the default file system is flash:. You can display the current default file system as specified by the cd command by using the pwd privileged EXEC command. Displaying Information about Files on a File System You can view a list of the contents of a file system before manipulating its contents. For example, before copying a new configuration file to Flash memory, you might want to verify that the file system does not already contain a configuration file with the same name. Similarly, before copying a Flash configuration file to another location, you might want to verify its filename for use in another command. Flags Permission for file system. ro—read-only. rw—read/write. wo—write-only. Prefixes Alias for file system. flash:—Flash file system. nvram:—NVRAM. null:—Null destination for copies. You can copy a remote file to null to determine its size. rcp:—Remote Copy Protocol (RCP) network server. system:—Contains the system memory, including the running configuration. tftp:—Trivial File Transfer Protocol (TFTP) network server. xmodem:—Obtain the file from a network machine by using the XMODEM protocol. ymodem:—Obtain the file from a network machine by using the YMODEM protocol. Table B-1 show file systems Field Descriptions (continued) Field ValueB-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System To display information about files on a file system, use one of the privileged EXEC commands in Table B-2: Changing Directories and Displaying the Working Directory Beginning in privileged EXEC mode, follow these steps to change directories and display the working directory. Creating and Removing Directories Beginning in privileged EXEC mode, follow these steps to create and remove a directory: To delete a directory with all its files and subdirectories, use the delete /force /recursive filesystem:/file-url privileged EXEC command. Table B-2 Commands for Displaying Information About Files Command Description dir [/all] [filesystem:][filename] Display a list of files on a file system. show file systems Display more information about each of the files on a file system. show file information file-url Display information about a specific file. show file descriptors Display a list of open file descriptors. File descriptors are the internal representations of open files. You can use this command to see if another user has a file open. Command Purpose Step 1 dir filesystem: Display the directories on the specified file system. For filesystem:, use flash: for the system board Flash device. Step 2 cd new_configs Change to the directory of interest. The command example shows how to change to the directory named new_configs. Step 3 pwd Display the working directory. Command Purpose Step 1 dir filesystem: Display the directories on the specified file system. For filesystem:, use flash: for the system board Flash device. Step 2 mkdir old_configs Create a new directory. The command example shows how to create the directory named old_configs. Directory names are case sensitive. Directory names are limited to 45 characters between the slashes (/); the name cannot contain control characters, spaces, deletes, slashes, quotes, semicolons, or colons. Step 3 dir filesystem: Verify your entry.B-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System Use the /recursive keyword to delete the named directory and all subdirectories and the files contained in it. Use the /force keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only once at the beginning of this deletion process. Use the /force and /recursive keywords for deleting old software images that were installed by using the archive download-sw command but are no longer needed. For filesystem, use flash: for the system board Flash device. For file-url, enter the name of the directory to be deleted. All the files in the directory and the directory are removed. Caution When files and directories are deleted, their contents cannot be recovered. Copying Files To copy a file from a source to a destination, use the copy source-url destination-url privileged EXEC command. For the source and destination URLs, you can use running-config and startup-config keyword shortcuts. For example, the copy running-config startup-config command saves the currently running configuration file to the NVRAM section of Flash memory to be used as the configuration during system initialization. You can also copy from special file systems (xmodem:, ymodem:) as the source for the file from a network machine that uses the XMODEM or YMODEM protocol. Network file system URLs include ftp:, rcp:, and tftp: and have these syntaxes: • File Transfer Protocol (FTP)—ftp:[[//username [:password]@location]/directory]/filename • Remote Copy Protocol (RCP)—rcp:[[//username@location]/directory]/filename • Trivial File Transfer Protocol (TFTP)—tftp:[[//location]/directory]/filename Local writable file systems include flash:. Some invalid combinations of source and destination exist. Specifically, you cannot copy these combinations: • From a running configuration to a running configuration • From a startup configuration to a startup configuration • From a device to the same device (for example, the copy flash: flash: command is invalid) For specific examples of using the copy command with configuration files, see the “Working with Configuration Files” section on page B-9. To copy software images either by downloading a new version or uploading the existing one, use the archive download-sw or the archive upload-sw privileged EXEC command. For more information, see the “Working with Software Images” section on page B-21.B-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System Deleting Files When you no longer need a file on a Flash memory device, you can permanently delete it. To delete a file or directory from a specified Flash device, use the delete [/force] [/recursive] [filesystem:]/file-url privileged EXEC command. Use the /recursive keyword for deleting a directory and all subdirectories and the files contained in it. Use the /force keyword to suppress the prompting that confirms a deletion of each file in the directory. You are prompted only once at the beginning of this deletion process. Use the /force and /recursive keywords for deleting old software images that were installed by using the archive download-sw command but are no longer needed. If you omit the filesystem: option, the switch uses the default device specified by the cd command. For file-url, you specify the path (directory) and the name of the file to be deleted. When you attempt to delete any files, the system prompts you to confirm the deletion. Caution When files are deleted, their contents cannot be recovered. This example shows how to delete the file myconfig from the default Flash memory device: Switch# delete myconfig Creating, Displaying, and Extracting tar Files You can create a tar file and write files into it, list the files in a tar file, and extract the files from a tar file as described in the next sections. Note Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software image files. For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. Creating a tar File To create a tar file and write files into it, use this privileged EXEC command: archive tar /create destination-url flash:/file-url For destination-url, specify the destination URL alias for the local or network file system and the name of the tar file to create. These options are supported: • For the local Flash file system, the syntax is flash: • For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tarB-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System • For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar • For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to be created. For flash:/file-url, specify the location on the local Flash file system from which the new tar file is created. You can also specify an optional list of files or directories within the source directory to write to the new tar file. If none are specified, all files and directories at this level are written to the newly created tar file. This example shows how to create a tar file. This command writes the contents of the new-configs directory on the local Flash device to a file named saved.tar on the TFTP server at 172.20.10.30: Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs Displaying the Contents of a tar File To display the contents of a tar file on the screen, use this privileged EXEC command: archive tar /table source-url For source-url, specify the source URL alias for the local or network file system. These options are supported: • For the local Flash file system, the syntax is flash: • For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tar • For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar • For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file to display. You can also limit the display of the files by specifying an optional list of files or directories after the tar file; then only those files appear. If none are specified, all files and directories appear. This example shows how to display the contents of a switch tar file that is in Flash memory: Switch# archive tar /table flash:c3750-i5q3l2-mz.121-6.AX1.tar info (219 bytes) c3750-i5q3l2-mz.121-6.AX1/ (directory) c3750-i5q3l2-mz.121-6.AX1/html/ (directory) c3750-i5q3l2-mz.121-6.AX1/html/foo.html (0 bytes) c3750-i5q3l2-mz.121-6.AX1/c3750-i5q3l2-mz.121-6.AX1.bin (610856 bytes) c3750-i5q3l2-mz.121-6.AX1/info (219 bytes) This example shows how to display only the /html directory and its contents: Switch# archive tar /table flash:c3750-tv0-m.tar c3750-i5q3l2-mz.121-6.AX1/html c3750-i5q3l2-mz.121-6.AX1/html/ (directory) c3750-i5q3l2-mz.121-6.AX1/html/foo.html (0 bytes)B-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System Extracting a tar File To extract a tar file into a directory on the Flash file system, use this privileged EXEC command: archive tar /xtract source-url flash:/file-url For source-url, specify the source URL alias for the local or network file system. These options are supported: • For the local Flash file system, the syntax is flash: • For the File Transfer Protocol (FTP), the syntax is ftp:[[//username[:password]@location]/directory]/tar-filename.tar • For the Remote Copy Protocol (RCP), the syntax is rcp:[[//username@location]/directory]/tar-filename.tar • For the Trivial File Transfer Protocol (TFTP), the syntax is tftp:[[//location]/directory]/tar-filename.tar The tar-filename.tar is the tar file from which to extract files. For flash:/file-url, specify the location on the local Flash file system into which the tar file is extracted. You can also specify an optional list of files or directories within the tar file for extraction. If none are specified, all files and directories are extracted. This example shows how to extract the contents of a tar file located on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local Flash file system. The remaining files in the saved.tar file are ignored. Switch# archive tar /xtract tftp:/172.20.10.30/saved.tar flash:/new-configs Displaying the Contents of a File To display the contents of any readable file, including a file on a remote file system, use the more [/ascii | /binary | /ebcdic] file-url privileged EXEC command: This example shows how to display the contents of a configuration file on a TFTP server: Switch# more tftp://serverA/hampton/savedconfig ! ! Saved configuration on server ! version 11.3 service timestamps log datetime localtime service linenumber service udp-small-servers service pt-vty-logging !

B-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Working with Configuration Files This section describes how to create, load, and maintain configuration files. Note For information about configuration files in switch stacks, see the “Switch Stack Configuration Files” section on page 5-9. Configuration files contain commands entered to customize the function of the Cisco IOS software. A way to create a basic configuration file is to use the setup program or to enter the setup privileged EXEC command. For more information, see Chapter 4, “Assigning the Switch IP Address and Default Gateway.” You can copy (download) configuration files from a TFTP, FTP, or RCP server to the running configuration or startup configuration of the switch. You might want to perform this for one of these reasons: • To restore a backed-up configuration file. • To use the configuration file for another switch. For example, you might add another switch to your network and want it to have a configuration similar to the original switch. By copying the file to the new switch, you can change the relevant parts rather than recreating the whole file. • To load the same configuration commands on all the switches in your network so that all the switches have similar configurations. Yo u c an co p y (upload) configuration files from the switch to a file server by using TFTP, FTP, or RCP. You might perform this task to back up a current configuration file to a server before changing its contents so that you can later restore the original configuration file from the server. The protocol you use depends on which type of server you are using. The FTP and RCP transport mechanisms provide faster performance and more reliable delivery of data than TFTP. These improvements are possible because FTP and RCP are built on and use the Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which is connection-oriented. This section includes this information: • Guidelines for Creating and Using Configuration Files, page B-10 • Configuration File Types and Location, page B-10 • Creating a Configuration File By Using a Text Editor, page B-11 • Copying Configuration Files By Using TFTP, page B-11 • Copying Configuration Files By Using FTP, page B-13 • Copying Configuration Files By Using RCP, page B-17 • Clearing Configuration Information, page B-20 • Copying an Image File from One Stack Member to Another, page B-35B-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Guidelines for Creating and Using Configuration Files Creating configuration files can aid in your switch configuration. Configuration files can contain some or all of the commands needed to configure one or more switches. For example, you might want to download the same configuration file to several switches that have the same hardware configuration. Use these guidelines when creating a configuration file: • We recommend that you connect through the console port for the initial configuration of the switch. If you are accessing the switch through a network connection instead of through a direct connection to the console port, keep in mind that some configuration changes (such as changing the switch IP address or disabling ports) can cause a loss of connectivity to the switch. • If no password has been set on the switch, we recommend that you set one by using the enable secret secret-password global configuration command. Note The copy {ftp: | rcp: | tftp:} system:running-config privileged EXEC command loads the configuration files on the switch as if you were entering the commands at the command line. The switch does not erase the existing running configuration before adding the commands. If a command in the copied configuration file replaces a command in the existing configuration file, the existing command is erased. For example, if the copied configuration file contains a different IP address in a particular command than the existing configuration, the IP address in the copied configuration is used. However, some commands in the existing configuration might not be replaced or negated. In this case, the resulting configuration file is a mixture of the existing configuration file and the copied configuration file, with the copied configuration file having precedence. To restore a configuration file to an exact copy of a file stored on a server, copy the configuration file directly to the startup configuration (by using the copy {ftp: | rcp: | tftp:} nvram:startup-config privileged EXEC command), and reload the switch. Configuration File Types and Location Startup configuration files are used during system startup to configure the software. Running configuration files contain the current configuration of the software. The two configuration files can be different. For example, you might want to change the configuration for a short time period rather than permanently. In this case, you would change the running configuration but not save the configuration by using the copy running-config startup-config privileged EXEC command. The running configuration is saved in DRAM; the startup configuration is stored in the NVRAM section of Flash memory. B-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Creating a Configuration File By Using a Text Editor When creating a configuration file, you must list commands logically so that the system can respond appropriately. This is one method of creating a configuration file: Step 1 Copy an existing configuration from a switch to a server. For more information, see the “Downloading the Configuration File By Using TFTP” section on page B-12, the “Downloading a Configuration File By Using FTP” section on page B-14, or the “Downloading a Configuration File By Using RCP” section on page B-18. Step 2 Open the configuration file in a text editor, such as vi or emacs on UNIX or Notepad on a PC. Step 3 Extract the portion of the configuration file with the desired commands, and save it in a new file. Step 4 Copy the configuration file to the appropriate server location. For example, copy the file to the TFTP directory on the workstation (usually /tftpboot on a UNIX workstation). Step 5 Make sure the permissions on the file are set to world-read. Copying Configuration Files By Using TFTP You can configure the switch by using configuration files you create, download from another switch, or download from a TFTP server. You can copy (upload) configuration files to a TFTP server for storage. This section includes this information: • Preparing to Download or Upload a Configuration File By Using TFTP, page B-11 • Downloading the Configuration File By Using TFTP, page B-12 • Uploading the Configuration File By Using TFTP, page B-12 Preparing to Download or Upload a Configuration File By Using TFTP Before you begin downloading or uploading a configuration file by using TFTP, do these tasks: • Ensure that the workstation acting as the TFTP server is properly configured. On a Sun workstation, make sure that the /etc/inetd.conf file contains this line: tftp dgram udp wait root /usr/etc/in.tftpd in.tftpd -p -s /tftpboot Make sure that the /etc/services file contains this line: tftp 69/udp Note You must restart the inetd daemon after modifying the /etc/inetd.conf and /etc/services files. To restart the daemon, either stop the inetd process and restart it, or enter a fastboot command (on the SunOS 4.x) or a reboot command (on Solaris 2.x or SunOS 5.x). For more information on the TFTP daemon, refer to the documentation for your workstation. • Ensure that the switch has a route to the TFTP server. The switch and the TFTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the TFTP server by using the ping command.B-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files • Ensure that the configuration file to be downloaded is in the correct directory on the TFTP server (usually /tftpboot on a UNIX workstation). • For download operations, ensure that the permissions on the file are set correctly. The permission on the file should be world-read. • Before uploading the configuration file, you might need to create an empty file on the TFTP server. To create an empty file, enter the touch filename command, where filename is the name of the file you will use when uploading it to the server. • During upload operations, if you are overwriting an existing file (including an empty file, if you had to create one) on the server, ensure that the permissions on the file are set correctly. Permissions on the file should be world-write. Downloading the Configuration File By Using TFTP To configure the switch by using a configuration file downloaded from a TFTP server, follow these steps: Step 1 Copy the configuration file to the appropriate TFTP directory on the workstation. Step 2 Verify that the TFTP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using TFTP” section on page B-11. Step 3 Log into the switch through the console port or a Telnet session. Step 4 Download the configuration file from the TFTP server to configure the switch. Specify the IP address or host name of the TFTP server and the name of the file to download. Use one of these privileged EXEC commands: • copy tftp:[[[//location]/directory]/filename] system:running-config • copy tftp:[[[//location]/directory]/filename] nvram:startup-config The configuration file downloads, and the commands are executed as the file is parsed line-by-line. This example shows how to configure the software from the file tokyo-confg at IP address 172.16.2.155: Switch# copy tftp://172.16.2.155/tokyo-confg system:running-config Configure using tokyo-confg from 172.16.2.155? [confirm] y Booting tokyo-confg from 172.16.2.155:!!! [OK - 874/16000 bytes] Uploading the Configuration File By Using TFTP To upload a configuration file from a switch to a TFTP server for storage, follow these steps: Step 1 Verify that the TFTP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using TFTP” section on page B-11. Step 2 Log into the switch through the console port or a Telnet session.B-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Step 3 Upload the switch configuration to the TFTP server. Specify the IP address or host name of the TFTP server and the destination filename. Use one of these privileged EXEC commands: • copy system:running-config tftp:[[[//location]/directory]/filename] • copy nvram:startup-config tftp:[[[//location]/directory]/filename] The file is uploaded to the TFTP server. This example shows how to upload a configuration file from a switch to a TFTP server: Switch# copy system:running-config tftp://172.16.2.155/tokyo-confg Write file tokyo-confg on host 172.16.2.155? [confirm] y # Writing tokyo-confg!!! [OK] Copying Configuration Files By Using FTP You can copy configuration files to or from an FTP server. The FTP protocol requires a client to send a remote username and password on each FTP request to a server. When you copy a configuration file from the switch to a server by using FTP, the Cisco IOS software sends the first valid username in this list: • The username specified in the copy command if a username is specified. • The username set by the ip ftp username username global configuration command if the command is configured. • Anonymous. The switch sends the first valid password in this list: • The password specified in the copy command if a password is specified. • The password set by the ip ftp password password global configuration command if the command is configured. • The switch forms a password named username@switchname.domain. The variable username is the username associated with the current session, switchname is the configured host name, and domain is the domain of the switch. The username and password must be associated with an account on the FTP server. If you are writing to the server, the FTP server must be properly configured to accept your FTP write request. Use the ip ftp username and ip ftp password commands to specify a username and password for all copies. Include the username in the copy command if you want to specify only a username for that copy operation. If the server has a directory structure, the configuration file is written to or copied from the directory associated with the username on the server. For example, if the configuration file resides in the home directory of a user on the server, specify that user's name as the remote username. For more information, refer to the documentation for your FTP server.B-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files This section includes this information: • Preparing to Download or Upload a Configuration File By Using FTP, page B-14 • Downloading a Configuration File By Using FTP, page B-14 • Uploading a Configuration File By Using FTP, page B-16 Preparing to Download or Upload a Configuration File By Using FTP Before you begin downloading or uploading a configuration file by using FTP, do these tasks: • Ensure that the switch has a route to the FTP server. The switch and the FTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the FTP server by using the ping command. • If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make sure that the current FTP username is the one that you want to use for the FTP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new FTP username by using the ip ftp username username global configuration command during all copy operations. The new username is stored in NVRAM. If you are accessing the switch through a Telnet session and you have a valid username, this username is used, and you do not need to set the FTP username. Include the username in the copy command if you want to specify a username for only that copy operation. • When you upload a configuration file to the FTP server, it must be properly configured to accept the write request from the user on the switch. For more information, refer to the documentation for your FTP server. Downloading a Configuration File By Using FTP Beginning in privileged EXEC mode, follow these steps to download a configuration file by using FTP: Command Purpose Step 1 Verify that the FTP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using FTP” section on page B-14. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode on the switch. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6). Step 4 ip ftp username username (Optional) Change the default remote username. Step 5 ip ftp password password (Optional) Change the default password.B-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 and to load and run those commands on the switch: Switch# copy ftp://netadmin1:mypass@172.16.101.101/host1-confg system:running-config Configure using host1-confg from 172.16.101.101? [confirm] Connected to 172.16.101.101 Loading 1112 byte file host1-confg:![OK] Switch# %SYS-5-CONFIG: Configured from host1-config by ftp from 172.16.101.101 This example shows how to specify a remote username of netadmin1. The software copies the configuration file host2-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the switch startup configuration. Switch# configure terminal Switch(config)# ip ftp username netadmin1 Switch(config)# ip ftp password mypass Switch(config)# end Switch# copy ftp: nvram:startup-config Address of remote host [255.255.255.255]? 172.16.101.101 Name of configuration file[rtr2-confg]? host2-confg Configure using host2-confg from 172.16.101.101?[confirm] Connected to 172.16.101.101 Loading 1112 byte file host2-confg:![OK] [OK] Switch# %SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by ftp from 172.16.101.101 Step 6 end Return to privileged EXEC mode. Step 7 copy ftp:[[[//[username[:password]@]location]/directory] /filename] system:running-config or copy ftp:[[[//[username[:password]@]location]/directory] /filename] nvram:startup-config Using FTP, copy the configuration file from a network server to the running configuration or to the startup configuration file. Command PurposeB-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Uploading a Configuration File By Using FTP Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using FTP: This example shows how to copy the running configuration file named switch2-confg to the netadmin1 directory on the remote host with an IP address of 172.16.101.101: Switch# copy system:running-config ftp://netadmin1:mypass@172.16.101.101/switch2-confg Write file switch2-confg on host 172.16.101.101?[confirm] Building configuration...[OK] Connected to 172.16.101.101 Switch# This example shows how to store a startup configuration file on a server by using FTP to copy the file: Switch# configure terminal Switch(config)# ip ftp username netadmin2 Switch(config)# ip ftp password mypass Switch(config)# end Switch# copy nvram:startup-config ftp: Remote host[]? 172.16.101.101 Name of configuration file to write [switch2-confg]? Write file switch2-confg on host 172.16.101.101?[confirm] ![OK] Command Purpose Step 1 Verify that the FTP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using FTP” section on page B-14. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6). Step 4 ip ftp username username (Optional) Change the default remote username. Step 5 ip ftp password password (Optional) Change the default password. Step 6 end Return to privileged EXEC mode. Step 7 copy system:running-config ftp:[[[//[username[:password]@]location]/directory] /filename] or copy nvram:startup-config ftp:[[[//[username[:password]@]location]/directory] /filename] Using FTP, store the switch running or startup configuration file to the specified location. B-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files Copying Configuration Files By Using RCP The Remote Copy Protocol (RCP) provides another method of downloading, uploading, and copying configuration files between remote hosts and the switch. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is connection-oriented. To use RCP to copy files, the server from or to which you will be copying files must support RCP. The RCP copy commands rely on the rsh server (or daemon) on the remote system. To copy files by using RCP, you do not need to create a server for file distribution as you do with TFTP. You only need to have access to a server that supports the remote shell (rsh). (Most UNIX systems support rsh.) Because you are copying a file from one place to another, you must have read permission on the source file and write permission on the destination file. If the destination file does not exist, RCP creates it for you. The RCP requires a client to send a remote username with each RCP request to a server. When you copy a configuration file from the switch to a server, the Cisco IOS software sends the first valid username in this list: • The username specified in the copy command if a username is specified. • The username set by the ip rcmd remote-username username global configuration command if the command is configured. • The remote username associated with the current TTY (terminal) process. For example, if the user is connected to the router through Telnet and was authenticated through the username command, the switch software sends the Telnet username as the remote username. • The switch host name. For a successful RCP copy request, you must define an account on the network server for the remote username. If the server has a directory structure, the configuration file is written to or copied from the directory associated with the remote username on the server. For example, if the configuration file is in the home directory of a user on the server, specify that user's name as the remote username. This section includes this information: • Preparing to Download or Upload a Configuration File By Using RCP, page B-17 • Downloading a Configuration File By Using RCP, page B-18 • Uploading a Configuration File By Using RCP, page B-19 Preparing to Download or Upload a Configuration File By Using RCP Before you begin downloading or uploading a configuration file by using RCP, do these tasks: • Ensure that the workstation acting as the RCP server supports the remote shell (rsh). • Ensure that the switch has a route to the RCP server. The switch and the server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the RCP server by using the ping command. • If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make sure that the current RCP username is the one that you want to use for the RCP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new RCP username by using the ip rcmd remote-username username global configuration command to be used during all copy operations. The new username is stored in NVRAM. If you are accessing the switch through a Telnet session and you have a valid username, this username is used, and you do not need to set the RCP username. Include the username in the copy command if you want to specify a username for only that copy operation. B-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files • When you upload a file to the RCP server, it must be properly configured to accept the RCP write request from the user on the switch. For UNIX systems, you must add an entry to the .rhosts file for the remote user on the RCP server. For example, suppose that the switch contains these configuration lines: hostname Switch1 ip rcmd remote-username User0 If the switch IP address translates to Switch1.company.com, the .rhosts file for User0 on the RCP server should contain this line: Switch1.company.com Switch1 For more information, refer to the documentation for your RCP server. Downloading a Configuration File By Using RCP Beginning in privileged EXEC mode, follow these steps to download a configuration file by using RCP: This example shows how to copy a configuration file named host1-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 and load and run those commands on the switch: Switch# copy rcp://netadmin1@172.16.101.101/host1-confg system:running-config Configure using host1-confg from 172.16.101.101? [confirm] Connected to 172.16.101.101 Loading 1112 byte file host1-confg:![OK] Switch# %SYS-5-CONFIG: Configured from host1-config by rcp from 172.16.101.101 Command Purpose Step 1 Verify that the RCP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using RCP” section on page B-17. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5). Step 4 ip rcmd remote-username username (Optional) Specify the remote username. Step 5 end Return to privileged EXEC mode. Step 6 copy rcp:[[[//[username@]location]/directory]/filename] system:running-config or copy rcp:[[[//[username@]location]/directory]/filename] nvram:startup-config Using RCP, copy the configuration file from a network server to the running configuration or to the startup configuration file. B-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files This example shows how to specify a remote username of netadmin1. Then it copies the configuration file host2-confg from the netadmin1 directory on the remote server with an IP address of 172.16.101.101 to the startup configuration: Switch# configure terminal Switch(config)# ip rcmd remote-username netadmin1 Switch(config)# end Switch# copy rcp: nvram:startup-config Address of remote host [255.255.255.255]? 172.16.101.101 Name of configuration file[rtr2-confg]? host2-confg Configure using host2-confg from 172.16.101.101?[confirm] Connected to 172.16.101.101 Loading 1112 byte file host2-confg:![OK] [OK] Switch# %SYS-5-CONFIG_NV:Non-volatile store configured from host2-config by rcp from 172.16.101.101 Uploading a Configuration File By Using RCP Beginning in privileged EXEC mode, follow these steps to upload a configuration file by using RCP: This example shows how to copy the running configuration file named switch2-confg to the netadmin1 directory on the remote host with an IP address of 172.16.101.101: Switch# copy system:running-config rcp://netadmin1@172.16.101.101/switch2-confg Write file switch-confg on host 172.16.101.101?[confirm] Building configuration...[OK] Connected to 172.16.101.101 Switch# Command Purpose Step 1 Verify that the RCP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using RCP” section on page B-17. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5). Step 4 ip rcmd remote-username username (Optional) Specify the remote username. Step 5 end Return to privileged EXEC mode. Step 6 copy system:running-config rcp:[[[//[username@]location]/directory]/filename] or copy nvram:startup-config rcp:[[[//[username@]location]/directory]/filename] Using RCP, copy the configuration file from a switch running or startup configuration file to a network server.B-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Configuration Files This example shows how to store a startup configuration file on a server: Switch# configure terminal Switch(config)# ip rcmd remote-username netadmin2 Switch(config)# end Switch# copy nvram:startup-config rcp: Remote host[]? 172.16.101.101 Name of configuration file to write [switch2-confg]? Write file switch2-confg on host 172.16.101.101?[confirm] ![OK] Clearing Configuration Information You can clear the configuration information from the startup configuration. If you reboot the switch with no startup configuration, the switch enters the setup program so that you can reconfigure the switch with all new settings. Clearing the Startup Configuration File To clear the contents of your startup configuration, use the erase nvram: or the erase startup-config privileged EXEC command. Caution You cannot restore the startup configuration file after it has been deleted. Deleting a Stored Configuration File To delete a saved configuration from Flash memory, use the delete flash:filename privileged EXEC command. Depending on the setting of the file prompt global configuration command, you might be prompted for confirmation before you delete a file. By default, the switch prompts for confirmation on destructive file operations. For more information about the file prompt command, refer to the Cisco IOS Command Reference for Release 12.1. Caution You cannot restore a file after it has been deleted. B-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Working with Software Images This section describes how to archive (download and upload) software image files, which contain the system software, Cisco IOS code, and the web management HTML files. Note Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software image files. For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. You download a switch image file from a TFTP, FTP, or RCP server to upgrade the switch software. You can replace the current image with the new one or keep the current image in Flash memory after a download. You upload a switch image file to a TFTP, FTP, or RCP server for backup purposes. You can use this uploaded image for future downloads to the same switch or another of the same type. The protocol you use depends on which type of server you are using. The FTP and RCP transport mechanisms provide faster performance and more reliable delivery of data than TFTP. These improvements are possible because FTP and RCP are built on and use the Transmission Control Protocol/Internet Protocol (TCP/IP) stack, which is connection-oriented. This section includes this information: • Image Location on the Switch, page B-21 • tar File Format of Images on a Server or Cisco.com, page B-22 • Copying Image Files By Using TFTP, page B-23 • Copying Image Files By Using FTP, page B-26 • Copying Image Files By Using RCP, page B-30 Note For a list of software images and the supported upgrade paths, refer to the release notes that shipped with your switch. Image Location on the Switch The Cisco IOS image is stored as a .bin file in a directory that shows the version number. A subdirectory contains the HTML files needed for web management. The image is stored on the system board Flash memory (flash:). You can use the show version privileged EXEC command to see the software version that is currently running on your switch. In the display, check the line that begins with System image file is... . It shows the directory name in Flash memory where the image is stored. You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images you might have stored in Flash memory.B-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images tar File Format of Images on a Server or Cisco.com Software images located on a server or downloaded from Cisco.com are provided in a tar file format, which contains these files: • An info file, which serves as a table of contents for the tar file • One or more subdirectories containing other images and files, such as Cisco IOS images and web management files This example shows some of the information contained in the info file. Table B- 3 provides additional details about this information: system_type:0x00000000:c3750-i5-mz.121.11-AX image_family:C3750 stacking_number:1.0 info_end: version_suffix:i5-121.11-AX version_directory:c3750-i5-mz.121.11-AX image_system_type_id:0x00000000 image_name:c3750-i5-mz.121.11-AX.bin ios_image_file_size:3973632 total_image_file_size:5929472 image_feature:LAYER_3|MIN_DRAM_MEG=64 image_family:C3750 stacking_number:1.0 board_ids:0x401100c4 0x00000000 0x00000001 0x00000003 0x00000002 0x00008000 0x00008002 0x40110000 info_end: Table B-3 info File Description Field Description version_suffix Specifies the Cisco IOS image version string suffix version_directory Specifies the directory where the Cisco IOS image and the HTML subdirectory are installed image_name Specifies the name of the Cisco IOS image within the tar file ios_image_file_size Specifies the Cisco IOS image size in the tar file, which is an approximate measure of how much Flash memory is required to hold just the Cisco IOS image total_image_file_size Specifies the size of all the images (the Cisco IOS image and the HTML files) in the tar file, which is an approximate measure of how much Flash memory is required to hold them image_feature Describes the core functionality of the image image_min_dram Specifies the minimum amount of DRAM needed to run this image image_family Describes the family of products on which the software can be installedB-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Copying Image Files By Using TFTP You can download a switch image from a TFTP server or upload the image from the switch to a TFTP server. You download a switch image file from a server to upgrade the switch software. You can overwrite the current image with the new one or keep the current image after a download. You upload a switch image file to a server for backup purposes; this uploaded image can be used for future downloads to the same or another switch of the same type. Note Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software image files. For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. This section includes this information: • Preparing to Download or Upload an Image File By Using TFTP, page B-23 • Downloading an Image File By Using TFTP, page B-24 • Uploading an Image File By Using TFTP, page B-25 Preparing to Download or Upload an Image File By Using TFTP Before you begin downloading or uploading an image file by using TFTP, do these tasks: • Ensure that the workstation acting as the TFTP server is properly configured. On a Sun workstation, make sure that the /etc/inetd.conf file contains this line: tftp dgram udp wait root /usr/etc/in.tftpd in.tftpd -p -s /tftpboot Make sure that the /etc/services file contains this line: tftp 69/udp Note You must restart the inetd daemon after modifying the /etc/inetd.conf and /etc/services files. To restart the daemon, either stop the inetd process and restart it, or enter a fastboot command (on the SunOS 4.x) or a reboot command (on Solaris 2.x or SunOS 5.x). For more information on the TFTP daemon, refer to the documentation for your workstation. • Ensure that the switch has a route to the TFTP server. The switch and the TFTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the TFTP server by using the ping command. • Ensure that the image to be downloaded is in the correct directory on the TFTP server (usually /tftpboot on a UNIX workstation). • For download operations, ensure that the permissions on the file are set correctly. The permission on the file should be world-read.B-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images • Before uploading the image file, you might need to create an empty file on the TFTP server. To create an empty file, enter the touch filename command, where filename is the name of the file you will use when uploading the image to the server. • During upload operations, if you are overwriting an existing file (including an empty file, if you had to create one) on the server, ensure that the permissions on the file are set correctly. Permissions on the file should be world-write. Downloading an Image File By Using TFTP You can download a new image file and replace the current image or keep the current image. Beginning in privileged EXEC mode, follow Steps 1 through 3 to download a new image from a TFTP server and overwrite the existing image. To keep the current image, skip Step 3. The download algorithm verifies that the image is appropriate for the switch model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device whether or not it is the same as the new one, downloads the new image, and then reloads the software. Command Purpose Step 1 Copy the image to the appropriate TFTP directory on the workstation. Make sure the TFTP server is properly configured; see the “Preparing to Download or Upload an Image File By Using TFTP” section on page B-23. Step 2 Log into the switch through the console port or a Telnet session. Step 3 archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar Download the image file from the TFTP server to the switch, and overwrite the current image. • The /overwrite option overwrites the software image in Flash memory with the downloaded image. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //location, specify the IP address of the TFTP server. • For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Step 4 archive download-sw /leave-old-sw /reload tftp:[[//location]/directory]/image-name.tar Download the image file from the TFTP server to the switch, and keep the current image. • The /leave-old-sw option keeps the old software version after a download. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //location, specify the IP address of the TFTP server. • For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.B-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. If you specify the /leave-old-sw, the existing files are not removed. If there is not enough space to install the new image and keep the current running image, the download process stops, and an error message is displayed. The algorithm installs the downloaded image on the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the BOOT environment variable is updated to point to the newly installed image. If you kept the old image during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old image. All the files in the directory and the directory are removed. Caution For the download and upload algorithms to operate properly, do not rename image names. Uploading an Image File By Using TFTP You can upload an image from the switch to a TFTP server. You can later download this image to the switch or to another switch of the same type. The upload feature is available only if the HTML pages associated with the Cluster Management Suite (CMS) have been installed with the existing image. Beginning in privileged EXEC mode, follow these steps to upload an image to a TFTP server: The archive upload-sw privileged EXEC command builds an image file on the server by uploading these files in order: info, the Cisco IOS image, and the HTML files. After these files are uploaded, the upload algorithm creates the tar file format. Caution For the download and upload algorithms to operate properly, do not rename image names. Command Purpose Step 1 Make sure the TFTP server is properly configured; see the “Preparing to Download or Upload an Image File By Using TFTP” section on page B-23. Step 1 Log into the switch through the console port or a Telnet session. Step 2 archive upload-sw tftp:[[//location]/directory]/image-name.tar Upload the currently running switch image to the TFTP server. • For //location, specify the IP address of the TFTP server. • For /directory/image-name.tar, specify the directory (optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. The image-name.tar is the name of the software image to be stored on the server.B-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Copying Image Files By Using FTP You can download a switch image from an FTP server or upload the image from the switch to an FTP server. You download a switch image file from a server to upgrade the switch software. You can overwrite the current image with the new one or keep the current image after a download. You upload a switch image file to a server for backup purposes. You can use this uploaded image for future downloads to the switch or another switch of the same type. Note Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software image files. For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. This section includes this information: • Preparing to Download or Upload an Image File By Using FTP, page B-26 • Downloading an Image File By Using FTP, page B-27 • Uploading an Image File By Using FTP, page B-29 Preparing to Download or Upload an Image File By Using FTP You can copy images files to or from an FTP server. The FTP protocol requires a client to send a remote username and password on each FTP request to a server. When you copy an image file from the switch to a server by using FTP, the Cisco IOS software sends the first valid username in this list: • The username specified in the archive download-sw or archive upload-sw privileged EXEC command if a username is specified. • The username set by the ip ftp username username global configuration command if the command is configured. • Anonymous. The switch sends the first valid password in this list: • The password specified in the archive download-sw or archive upload-sw privileged EXEC command if a password is specified. • The password set by the ip ftp password password global configuration command if the command is configured. • The switch forms a password named username@switchname.domain. The variable username is the username associated with the current session, switchname is the configured host name, and domain is the domain of the switch. The username and password must be associated with an account on the FTP server. If you are writing to the server, the FTP server must be properly configured to accept the FTP write request from you.B-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Use the ip ftp username and ip ftp password commands to specify a username and password for all copies. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username only for that operation. If the server has a directory structure, the image file is written to or copied from the directory associated with the username on the server. For example, if the image file resides in the home directory of a user on the server, specify that user's name as the remote username. Before you begin downloading or uploading an image file by using FTP, do these tasks: • Ensure that the switch has a route to the FTP server. The switch and the FTP server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the FTP server by using the ping command. • If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make sure that the current FTP username is the one that you want to use for the FTP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new FTP username by using the ip ftp username username global configuration command. This new name will be used during all archive operations. The new username is stored in NVRAM. If you are accessing the switch through a Telnet session and you have a valid username, this username is used, and you do not need to set the FTP username. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username for that operation only. • When you upload an image file to the FTP server, it must be properly configured to accept the write request from the user on the switch. For more information, refer to the documentation for your FTP server. Downloading an Image File By Using FTP You can download a new image file and overwrite the current image or keep the current image. Beginning in privileged EXEC mode, follow Steps 1 through 7 to download a new image from an FTP server and overwrite the existing image. To keep the current image, skip Step 7. Command Purpose Step 1 Verify that the FTP server is properly configured by referring to the “Preparing to Download or Upload an Image File By Using FTP” section on page B-26. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6). Step 4 ip ftp username username (Optional) Change the default remote username. Step 5 ip ftp password password (Optional) Change the default password. Step 6 end Return to privileged EXEC mode. B-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images The download algorithm verifies that the image is appropriate for the switch model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device, whether or not it is the same as the new one, downloads the new image, and then reloads the software. Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. If you specify the /leave-old-sw, the existing files are not removed. If there is not enough space to install the new image and keep the running image, the download process stops, and an error message is displayed. Step 7 archive download-sw /overwrite /reload ftp:[[//username[:password]@location]/directory] /image-name.tar Download the image file from the FTP server to the switch, and overwrite the current image. • The /overwrite option overwrites the software image in Flash memory with the downloaded image. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //username[:password], specify the username and password; these must be associated with an account on the FTP server. For more information, see the “Preparing to Download or Upload an Image File By Using FTP” section on page B-26. • For @location, specify the IP address of the FTP server. • For directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Step 8 archive download-sw /leave-old-sw /reload ftp:[[//username[:password]@location]/directory] /image-name.tar Download the image file from the FTP server to the switch, and keep the current image. • The /leave-old-sw option keeps the old software version after a download. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //username[:password], specify the username and password. These must be associated with an account on the FTP server. For more information, see the “Preparing to Download or Upload an Image File By Using FTP” section on page B-26. • For @location, specify the IP address of the FTP server. • For directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Command PurposeB-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images The algorithm installs the downloaded image onto the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the BOOT environment variable is updated to point to the newly installed image. If you kept the old image during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old software image. All the files in the directory and the directory are removed. Caution For the download and upload algorithms to operate properly, do not rename image names. Uploading an Image File By Using FTP You can upload an image from the switch to an FTP server. You can later download this image to the same switch or to another switch of the same type. The upload feature is available only if the HTML pages associated with the Cluster Management Suite (CMS) have been installed with the existing image. Beginning in privileged EXEC mode, follow these steps to upload an image to an FTP server: Command Purpose Step 1 Verify that the FTP server is properly configured by referring to the “Preparing to Download or Upload a Configuration File By Using FTP” section on page B-14. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username or password (see Steps 4, 5, and 6). Step 4 ip ftp username username (Optional) Change the default remote username. Step 5 ip ftp password password (Optional) Change the default password. Step 6 end Return to privileged EXEC mode. Step 7 archive upload-sw ftp:[[//[username[:password]@]location]/directory]/ image-name.tar Upload the currently running switch image to the FTP server. • For //username:password, specify the username and password. These must be associated with an account on the FTP server. For more information, see the “Preparing to Download or Upload an Image File By Using FTP” section on page B-26. • For @location, specify the IP address of the FTP server. • For /directory/image-name.tar, specify the directory (optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. The image-name.tar is the name of the software image to be stored on the server.B-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images The archive upload-sw command builds an image file on the server by uploading these files in order: info, the Cisco IOS image, and the HTML files. After these files are uploaded, the upload algorithm creates the tar file format. Caution For the download and upload algorithms to operate properly, do not rename image names. Copying Image Files By Using RCP You can download a switch image from an RCP server or upload the image from the switch to an RCP server. You download a switch image file from a server to upgrade the switch software. You can overwrite the current image with the new one or keep the current image after a download. You upload a switch image file to a server for backup purposes. You can use this uploaded image for future downloads to the same switch or another of the same type. Note Instead of using the copy privileged EXEC command or the archive tar privileged EXEC command, we recommend using the archive download-sw and archive upload-sw privileged EXEC commands to download and upload software image files. For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. This section includes this information: • Preparing to Download or Upload an Image File By Using RCP, page B-30 • Downloading an Image File By Using RCP, page B-32 • Uploading an Image File By Using RCP, page B-34 Preparing to Download or Upload an Image File By Using RCP RCP provides another method of downloading and uploading image files between remote hosts and the switch. Unlike TFTP, which uses User Datagram Protocol (UDP), a connectionless protocol, RCP uses TCP, which is connection-oriented. To use RCP to copy files, the server from or to which you will be copying files must support RCP. The RCP copy commands rely on the rsh server (or daemon) on the remote system. To copy files by using RCP, you do not need to create a server for file distribution as you do with TFTP. You only need to have access to a server that supports the remote shell (rsh). (Most UNIX systems support rsh.) Because you are copying a file from one place to another, you must have read permission on the source file and write permission on the destination file. If the destination file does not exist, RCP creates it for you.B-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images RCP requires a client to send a remote username on each RCP request to a server. When you copy an image from the switch to a server by using RCP, the Cisco IOS software sends the first valid username in this list: • The username specified in the archive download-sw or archive upload-sw privileged EXEC command if a username is specified. • The username set by the ip rcmd remote-username username global configuration command if the command is entered. • The remote username associated with the current TTY (terminal) process. For example, if the user is connected to the router through Telnet and was authenticated through the username command, the switch software sends the Telnet username as the remote username. • The switch host name. For the RCP copy request to execute successfully, an account must be defined on the network server for the remote username. If the server has a directory structure, the image file is written to or copied from the directory associated with the remote username on the server. For example, if the image file resides in the home directory of a user on the server, specify that user’s name as the remote username. Before you begin downloading or uploading an image file by using RCP, do these tasks: • Ensure that the workstation acting as the RCP server supports the remote shell (rsh). • Ensure that the switch has a route to the RCP server. The switch and the server must be in the same subnetwork if you do not have a router to route traffic between subnets. Check connectivity to the RCP server by using the ping command. • If you are accessing the switch through the console or a Telnet session and you do not have a valid username, make sure that the current RCP username is the one that you want to use for the RCP download. You can enter the show users privileged EXEC command to view the valid username. If you do not want to use this username, create a new RCP username by using the ip rcmd remote-username username global configuration command to be used during all archive operations. The new username is stored in NVRAM. If you are accessing the switch through a Telnet session and you have a valid username, this username is used, and there is no need to set the RCP username. Include the username in the archive download-sw or archive upload-sw privileged EXEC command if you want to specify a username only for that operation. • When you upload an image to the RCP to the server, it must be properly configured to accept the RCP write request from the user on the switch. For UNIX systems, you must add an entry to the .rhosts file for the remote user on the RCP server. For example, suppose the switch contains these configuration lines: hostname Switch1 ip rcmd remote-username User0 If the switch IP address translates to Switch1.company.com, the .rhosts file for User0 on the RCP server should contain this line: Switch1.company.com Switch1 For more information, refer to the documentation for your RCP server.B-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Downloading an Image File By Using RCP You can download a new image file and replace or keep the current image. Beginning in privileged EXEC mode, follow Steps 1 through 6 to download a new image from an RCP server and overwrite the existing image. To keep the current image, skip Step 6. Command Purpose Step 1 Verify that the RCP server is properly configured by referring to the “Preparing to Download or Upload an Image File By Using RCP” section on page B-30. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5). Step 4 ip rcmd remote-username username (Optional) Specify the remote username. Step 5 end Return to privileged EXEC mode. Step 6 archive download-sw /overwrite /reload rcp:[[[//[username@]location]/directory]/image-na me.tar] Download the image file from the RCP server to the switch, and overwrite the current image. • The /overwrite option overwrites the software image in Flash memory with the downloaded image. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //username, specify the username. For the RCP copy request to execute successfully, an account must be defined on the network server for the remote username. For more information, see the “Preparing to Download or Upload an Image File By Using RCP” section on page B-30. • For @location, specify the IP address of the RCP server. • For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.B-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images The download algorithm verifies that the image is appropriate for the switch model and that enough DRAM is present, or it aborts the process and reports an error. If you specify the /overwrite option, the download algorithm removes the existing image on the Flash device whether or not it is the same as the new one, downloads the new image, and then reloads the software. Note If the Flash device has sufficient space to hold two images and you want to overwrite one of these images with the same version, you must specify the /overwrite option. If you specify the /leave-old-sw, the existing files are not removed. If there is not enough room to install the new image an keep the running image, the download process stops, and an error message is displayed. The algorithm installs the downloaded image onto the system board Flash device (flash:). The image is placed into a new directory named with the software version string, and the BOOT environment variable is updated to point to the newly installed image. If you kept the old software during the download process (you specified the /leave-old-sw keyword), you can remove it by entering the delete /force /recursive filesystem:/file-url privileged EXEC command. For filesystem, use flash: for the system board Flash device. For file-url, enter the directory name of the old software image. All the files in the directory and the directory are removed. Caution For the download and upload algorithms to operate properly, do not rename image names. Step 7 archive download-sw /leave-old-sw /reload rcp:[[[//[username@]location]/directory]/image-na me.tar] Download the image file from the RCP server to the switch, and keep the current image. • The /leave-old-sw option keeps the old software version after a download. • The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. • For //username, specify the username. For the RCP copy request to execute, an account must be defined on the network server for the remote username. For more information, see the “Preparing to Download or Upload an Image File By Using RCP” section on page B-30. • For @location, specify the IP address of the RCP server. • For /directory]/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive. Command PurposeB-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Uploading an Image File By Using RCP You can upload an image from the switch to an RCP server. You can later download this image to the same switch or to another switch of the same type. The upload feature is available only if the HTML pages associated with the Cluster Management Suite (CMS) have been installed with the existing image. Beginning in privileged EXEC mode, follow these steps to upload an image to an RCP server: The archive upload-sw privileged EXEC command builds an image file on the server by uploading these files in order: info, the Cisco IOS image, and the HTML files. After these files are uploaded, the upload algorithm creates the tar file format. Caution For the download and upload algorithms to operate properly, do not rename image names. Command Purpose Step 1 Verify that the RCP server is properly configured by referring to the “Preparing to Download or Upload an Image File By Using RCP” section on page B-30. Step 2 Log into the switch through the console port or a Telnet session. Step 3 configure terminal Enter global configuration mode. This step is required only if you override the default remote username (see Steps 4 and 5). Step 4 ip rcmd remote-username username (Optional) Specify the remote username. Step 5 end Return to privileged EXEC mode. Step 6 archive upload-sw rcp:[[[//[username@]location]/directory]/image-na me.tar] Upload the currently running switch image to the RCP server. • For //username, specify the username; for the RCP copy request to execute, an account must be defined on the network server for the remote username. For more information, see the “Preparing to Download or Upload an Image File By Using RCP” section on page B-30. • For @location, specify the IP address of the RCP server. • For /directory]/image-name.tar, specify the directory (optional) and the name of the software image to be uploaded. Directory and image names are case sensitive. • The image-name.tar is the name of software image to be stored on the server.B-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software Images Copying an Image File from One Stack Member to Another For switch stacks, the archive download-sw and archive upload-sw privileged EXEC commands can only be used through the stack master. Software images downloaded to the stack master are automatically downloaded to the rest of the stack members. To upgrade a switch with an incompatible software image, use the archive copy-sw privileged EXEC command to copy the software image from an existing stack member to the incompatible switch. That switch automatically reloads and joins the stack as a fully functioning member. Beginning in privileged EXEC mode from the stack member that you want to upgrade, follow these steps to copy the running image file from the Flash memory from a different stack member. Command Purpose Step 1 archive copy-sw source-stack-member-number /force-reload /destination-system destination-stack-member-number Copy the running image file from a stack member, and then unconditionally reload the updated stack member. For source-stack-member-number, specify the stack member number of the stack member from which you want to copy its running image file. The stack member number range is from 1 through 9. For destination-stack-member-number, specify the stack member number of the stack member to which you want to copy its running image file. If you do not specify this stack member number, the default is to copy the running image file to all stack members. Step 2 reload slot stack-member-number Reset the stack member and put this configuration change into effect.B-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with Software ImagesC-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 A P P E N D I X C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 This appendix lists some of the command-line interface (CLI) commands that are displayed when you enter the question mark (?) at the Catalyst 3750 switch prompt but are not supported in this release, either because they are not tested, or because of Catalyst 3750 hardware limitations. This is not a complete list. The unsupported commands are listed by software feature and command mode. Access Control Lists Unsupported Privileged EXEC Commands access-enable [host] [timeout minutes] access-template [access-list-number | name] [dynamic-name] [source] [destination] [timeout minutes] clear access-template [access-list-number | name] [dynamic-name] [source] [destination]. Unsupported Global Configuration Commands access-list rate-limit acl-index {precedence | mask prec-mask} access-list dynamic extended C-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 ARP Commands ARP Commands Unsupported Global Configuration Commands arp ip-address hardware-address smds arp ip-address hardware-address srp-a arp ip-address hardware-address srp-b Unsupported Interface Configuration Commands arp probe ip probe proxy FallBack Bridging Unsupported Privileged EXEC Commands clear bridge [bridge-group] multicast [router-ports | groups | counts] [group-address] [interface-unit] [counts] clear vlan statistics show bridge [bridge-group] circuit-group [circuit-group] [src-mac-address] [dst-mac-address] show bridge [bridge-group] multicast [router-ports | groups] [group-address] show bridge vlan show interfaces crb show interfaces {ethernet | fastethernet} [interface | slot/port] irb show subscriber-policy range Unsupported Global Configuration Commands bridge bridge-group acquire bridge bridge-group address mac-address {forward | discard} [interface-id] bridge bridge-group aging-time seconds bridge bridge-group bitswap_l3_addresses bridge bridge-group bridge ip bridge bridge-group circuit-group circuit-group pause milliseconds bridge bridge-group circuit-group circuit-group source-based bridge cmf bridge crbC-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 FallBack Bridging bridge bridge-group domain domain-name bridge irb bridge bridge-group mac-address-table limit number bridge bridge-group multicast-source bridge bridge-group protocol dec bridge bridge-group route protocol bridge bridge-group subscriber policy policy subscriber-policy policy [[no | default] packet [permit | deny]] Unsupported Interface Configuration Commands bridge-group bridge-group cbus-bridging bridge-group bridge-group circuit-group circuit-number bridge-group bridge-group input-address-list access-list-number bridge-group bridge-group input-lat-service-deny group-list bridge-group bridge-group input-lat-service-permit group-list bridge-group bridge-group input-lsap-list access-list-number bridge-group bridge-group input-pattern-list access-list-number bridge-group bridge-group input-type-list access-list-number bridge-group bridge-group lat-compression bridge-group bridge-group output-address-list access-list-number bridge-group bridge-group output-lat-service-deny group-list bridge-group bridge-group output-lat-service-permit group-list bridge-group bridge-group output-lsap-list access-list-number bridge-group bridge-group output-pattern-list access-list-number bridge-group bridge-group output-type-list access-list-number bridge-group bridge-group sse bridge-group bridge-group subscriber-loop-control bridge-group bridge-group subscriber-trunk bridge bridge-group lat-service-filtering frame-relay map bridge dlci broadcast interface bvi bridge-group x25 map bridge x.121-address broadcast [options-keywords]C-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 HSRP HSRP Unsupported Global Configuration Commands interface Async interface BVI interface Dialer interface Group-Async interface Lex interface Multilink interface Virtual-Template interface Virtual-Tokenring Unsupported Interface Configuration Commands mtu standby mac-refresh seconds standby use-bia IGMP Snooping Commands Unsupported Global Configuration Commands ip igmp snooping report-suppression ip igmp snooping source-only-learning ip igmp snooping tcn Interface Commands Unsupported Privileged EXEC Commands show interfaces [interface-id | vlan vlan-id] [crb | fair-queue | irb | mac-accounting | precedence | irb | random-detect | rate-limit | shape]| C-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 IP Multicast Routing Unsupported Interface Configuration Commands switchport broadcast level switchport multicast level switchport unicast level Note These commands have been replaced by the storm-control {broadcast | multicast | unicast} level level [.level] interface configuration command. IP Multicast Routing Unsupported Privileged EXEC Commands clear ip rtp header-compression [type number] The debug ip packet command displays packets received by the switch CPU. It does not display packets that are hardware-switched. The debug ip mcache command affects packets received by the switch CPU. It does not display packets that are hardware-switched. The debug ip mpacket [detail] [access-list-number [group-name-or-address] command affects only packets received by the switch CPU. Because most multicast packets are hardware-switched, use this command only when you know that the route will forward the packet to the CPU. debug ip pim atm show frame-relay ip rtp header-compression [interface type number] The show ip mcache command displays entries in the cache for those packets that are sent to the switch CPU. Because most multicast packets are switched in hardware without CPU involvement, you can use this command, but multicast packet information is not displayed. The show ip mpacket commands are supported but are only useful for packets received at the switch CPU. If the route is hardward-switched, the command has no effect because the CPU does not receive the packet and cannot display it. show ip pim vc [group-address | name] [type number] show ip rtp header-compression [type number] [detail] Unsupported Global Configuration Commands ip pim accept-rp {address | auto-rp} [group-access-list-number] ip pim message-interval secondsC-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 IP Unicast Routing Unsupported Interface Configuration Commands frame-relay ip rtp header-compression [active | passive] frame-relay map ip ip-address dlci [broadcast] compress frame-relay map ip ip-address dlci rtp header-compression [active | passive] ip igmp helper-address ip-address ip multicast helper-map {group-address | broadcast} {broadcast-address | multicast-address} extended-access-list-number ip multicast rate-limit {in | out} [video | whiteboard] [group-list access-list] [source-list access-list] kbps ip multicast ttl-threshold ttl-value (instead, use the ip multicast boundary access-list-number interface configuration command) ip multicast use-functional ip pim minimum-vc-rate pps ip pim multipoint-signalling ip pim nbma-mode ip pim vc-count number ip rtp compression-connections number ip rtp header-compression [passive] IP Unicast Routing Unsupported Privileged EXEC or User EXEC Commands clear ip accounting [checkpoint] clear ip bgp address flap-statistics clear ip bgp prefix-list show cef [drop | not-cef-switched] show ip accounting [checkpoint] [output-packets | access-violations] show ip bgp dampened-paths show ip bgp inconsistent-as show ip bgp regexp regular expression show ip prefix-list regular expressionC-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 IP Unicast Routing Unsupported Global Configuration Commands ip accounting-list ip-address wildcard ip as-path access-list ip accounting-transits count ip cef accounting [per-prefix] [non-recursive] ip cef traffic-statistics [load-interval seconds] [update-rate seconds]] ip flow-aggregation ip flow-cache ip flow-export ip gratituitous-arps ip local ip prefix-list ip reflexive-list router egp router-isis router iso-igrp router mobile router odr router static Unsupported Interface Configuration Commands ip accounting ip load-sharing [per-packet] ip mtu bytes ip route-cache ip verify ip unnumbered type number All ip security commandsC-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 IP Unicast Routing Unsupported BGP Router Configuration Commands address-family vpnv4 default-information originate neighbor advertise-map neighbor allowas-in neighbor default-originate neighbor description network backdoor table-map Unsupported VPN Configuration Commands All Unsupported Route Map Commands match route-type set as-path {tag | prepend as-path-string} set automatic-tag set dampening half-life reuse suppress max-suppress-time set default interface interface-id [interface-id.....] set interface interface-id [interface-id.....] set ip default next-hop ip-address [ip-address.....] set ip destination ip-address mask set ip precedence value set ip qos-group set metric-type internal set origin set metric-type internal set tag tag-valueC-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 MSDP MSDP Unsupported Privileged EXEC Commands show access-expression show exception show location show pm LINE show smf [interface-id] show subscriber-policy [policy-number] show template [template-name] Unsupported Global Configuration Commands ip msdp default-peer ip-address | name [prefix-list list] (Because BGP/MBGP is not supported, use the ip msdp peer command instead of this command.) RADIUS Unsupported Global Configuration Commands aaa nas port extended radius-server attribute nas-port radius-server configure radius-server extended-portnames SNMP Unsupported Global Configuration Commands snmp-server enable informs snmp-server enable traps flash insertion snmp-server enable traps flash removalC-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 Spanning Tree Spanning Tree Unsupported Global Configuration Commands spanning-tree etherchannel guard misconfig spanning-tree pathcost method {long | short} Unsupported Interface Configuration Commands spanning-tree stack-port VLAN Unsupported vlan-config Commands private-vlan Unsupported User EXEC Commands show vlan ifindex show vlan private-vlan VTP Unsupported Privileged EXEC Commands vtp {password password | pruning | version number}private-vlan Note This command has been replaced by the vtp global configuration command.C-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 Miscellaneous Miscellaneous Unsupported Global Configuration Commands errdisable detect cause dhcp-rate-limit errdisable recovery cause dhcp-rate-limit errdisable recovery cause unicast floodC-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Appendix C Unsupported Commands in Cisco IOS Release 12.1(14)EA1 MiscellaneousIN-1 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 I N D E X Numerics 802.1D See STP 802.1Q and trunk ports 11-3 configuration limitations 12-19 encapsulation 12-16 native VLAN for untagged traffic 12-23 trunk mode 3-11 802.1S See MSTP 802.1W See RSTP 802.1X See port-based authentication 802.3AD See EtherChannel 802.3Z flow control 11-15 A abbreviating commands 2-4 ABRs 29-30 AC (command switch) 6-11, 6-21 access-class command 26-18 access control entries See ACEs access-denied response, VMPS 12-28 access groups applying ACLs to interfaces 26-19 IP 26-20 Layer 2 26-19 Layer 3 26-20 accessing clusters, switch 6-14 CMS 3-30 command switches 6-12 HTTP port 3-31 member switches 6-14 stack members 5-16 switch clusters 6-14 access lists See ACLs access ports defined 11-2 in switch clusters 6-10 accounting with RADIUS 9-28 with TACACS+ 9-11, 9-17 ACEs and QoS 27-7 defined 26-2 Ethernet 26-2 IP 26-2 ACLs ACEs 26-2 any keyword 26-12Index IN-2 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 ACLs (continued) applying on bridged packets 26-38 on multicast packets 26-40 on routed packets 26-39 on switched packets 26-37 time ranges to 26-16 to an interface 26-19 to QoS 27-7 classifying traffic for QoS 27-37 comments in 26-18 compiling 26-21 configuring with VLAN maps 26-36 defined 26-1, 26-7 examples of 26-21, 27-37 extended IP configuring for QoS classification 27-38 creating 26-10 matching criteria 26-7 hardware and software handling 26-20 host keyword 26-12 IP applying to interface 26-19 applying to interfaces 26-19 creating 26-7 fragments and QoS guidelines 27-29 implicit deny 26-9, 26-13, 26-15 implicit masks 26-9 matching criteria 26-7 named 26-14 terminal lines, setting on 26-18 undefined 26-20 violations, logging 26-15 limiting actions 26-37 logging messages 26-10 log keyword 26-15 MAC extended 26-26, 27-39 matching 26-7, 26-20 monitoring 26-41 ACLs (continued) named 26-14 number per QoS class map 27-29 numbers 26-8 port 26-2 precedence of 26-2 QoS 27-7, 27-37 router 26-2 standard IP configuring for QoS classification 27-37 creating 26-9 matching criteria 26-7 supported features 26-20 support for 1-6 time ranges 26-16 unsupported features 26-6 using router ACLs with VLAN maps 26-36 VLAN maps configuration guidelines 26-29 configuring 26-29 active router 30-1 address aliasing 18-2 addresses displaying the MAC address table 7-27 dynamic accelerated aging 15-9 changing the aging time 7-23 default aging 15-9 defined 7-22 learning 7-22 removing 7-24 MAC discovering 7-28 multicast group address range 31-3 STP address management 15-9 static adding and removing 7-26 defined 7-22Index IN-3 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 address resolution 7-28, 29-9 Address Resolution Protocol See ARP See ARP table adjacency tables, with CEF 29-66 administrative distances defined 29-79 OSPF 29-35 routing protocol defaults 29-68 advertisements CDP 20-1 IGRP 29-25 RIP 29-20 VTP 12-19, 13-3 aggregate addresses, BGP 29-61 aggregated ports See EtherChannel aggregate policers 27-45 aggregate policing 1-7 aggregator template 5-7, 8-1 aging, accelerating 15-9 aging time accelerated for MSTP 16-21 for STP 15-9, 15-23 MAC address table 7-23 maximum for MSTP 16-22 for STP 15-23 alarms, RMON 23-3 allowed-VLAN list 12-21 alternate routes, IGRP 29-26 Apply button 3-29 area border routers See ABRs ARP 1-4, 7-28 configuring 29-10 defined 29-9 encapsulation 29-11 static cache configuration 29-10 ARP table address resolution 7-28 managing 7-28 ASBRs 29-30 AS-path filters, BGP 29-55 attributes, RADIUS vendor-proprietary 9-31 vendor-specific 9-29 audience xxxiii authentication EIGRP 29-43 HSRP 30-8 local mode with AAA 9-37 NTP associations 7-5 RADIUS key 9-21 login 9-23 See also port-based authentication TACACS+ defined 9-11 key 9-13 login 9-14 authentication keys, and routing protocols 29-80 authoritative time source, described 7-2 authorization with RADIUS 9-27 with TACACS+ 9-11, 9-16 authorized ports with 802.1X 10-4 autoconfiguration 4-3Index IN-4 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 automatic discovery adding member switches 6-19 considerations beyond a non-candidate device 6-8 brand new switches 6-10 connectivity 6-5 different VLANs 6-7 management VLANs 6-8 non-CDP-capable devices 6-6 non-cluster-capable devices 6-6 routed ports 6-9 creating a cluster standby group 6-21 in switch clusters 6-5 See also CDP automatic QoS See QoS automatic recovery, clusters 6-11 See also HSRP autonegotiation duplex mode 1-3 interface configuration guidelines 11-13 mismatches 34-12 autonomous system boundary routers See ASBRs autonomous systems, in BGP 29-49 Auto-RP, described 31-5 autosensing, port speed 1-3 auxiliary VLAN See voice VLAN availability, features 1-5 B BackboneFast described 17-8 enabling 17-17 support for 1-5 bandwidth graphs 3-9 banners configuring login 7-21 message-of-the-day login 7-20 default configuration 7-19 when displayed 7-19 BGP aggregate addresses 29-61 aggregate routes, configuring 29-61 CIDR 29-61 clear commands 29-64 community filtering 29-57 configuring neighbors 29-59 default configuration 29-47 described 29-46 enabling 29-49 monitoring 29-64 multipath support 29-52 neighbors, types of 29-49 path selection 29-52 peers, configuring 29-59 prefix filtering 29-56 resetting sessions 29-51 route dampening 29-63 route maps 29-54 route reflectors 29-62 routing domain confederation 29-61 show commands 29-64 supernets 29-61 support for 1-8 Version 4 29-46 binding cluster group and HSRP group 30-9 blocking packets 19-5 booting boot loader, function of 4-2 boot process 4-1 manually 4-13 specific image 4-14Index IN-5 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 boot loader accessing 4-15 described 4-2 environment variables 4-15 prompt 4-15 trap-door mechanism 4-2 bootstrap router (BSR), described 31-5 Border Gateway Protocol See BGP BPDU error-disabled state 17-3 filtering 17-3 RSTP format 16-10 BPDU filtering described 17-3 enabling 17-15 support for 1-5 BPDU guard described 17-3 enabling 17-14 support for 1-5 bridged packets, ACLs on 26-38 bridge groups See fallback bridging bridge protocol data unit See BPDU broadcast flooding 29-17 broadcast packets directed 29-14 flooded 29-14 broadcast storm-control command 19-3 broadcast storms 19-1, 29-14 browser configuration 3-1 buttons, CMS 3-29 C cables, monitoring for unidirectional links 21-1 Cancel button 3-29 candidate switch adding 6-19 automatic discovery 6-5 defined 6-4 HC 6-21 passwords 6-19 requirements 6-4 standby group 6-21 See also command switch, cluster standby group, and member switch caution, described xxxiv CC (command switch) 6-21 CDP and trusted boundary 27-34 automatic discovery in switch clusters 6-5 configuring 20-2 default configuration 20-2 described 20-1 disabling for routing device 20-3, 20-4 enabling and disabling on an interface 20-4 on a switch 20-3 monitoring 20-5 overview 20-1 support for 1-4 switch stack considerations 20-2 transmission timer and holdtime, setting 20-2 updates 20-2 CEF 29-66 CGMP as IGMP snooping learning method 18-7 clearing cached group entries 31-51 enabling server support 31-33 joining multicast group 18-2 overview 31-7 server support only 31-7 switch support of 1-3 change notification, CMS 3-31 CIDR 29-61Index IN-6 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Cisco 7960 IP Phone 14-1 Cisco Discovery Protocol See CDP Cisco Express Forwarding See CEF Cisco Group Management Protocol See CGMP Cisco IOS File System See IFS Cisco StackWise technology 1-2 See also stacks, switch CiscoWorks 2000 1-4, 25-5 classless interdomain routing See CIDR classless routing 29-7 class maps for QoS configuring 27-40 described 27-7 displaying 27-64 class of service See CoS clearing interfaces 11-22 CLI abbreviating commands 2-4 command modes 2-1 described 1-4 editing features enabling and disabling 2-7 keystroke editing 2-7 wrapped lines 2-8 error messages 2-5 filtering command output 2-9 getting help 2-3 history changing the buffer size 2-5 described 2-5 disabling 2-6 recalling commands 2-6 CLI (continued) managing clusters 6-24 no and default forms of commands 2-4 client mode, VTP 13-3 clock See system clock Cluster Management Suite See CMS clusters switch home page 3-2 clusters, switch accessing 6-14 adding member switches 6-19 automatic discovery 6-5 automatic recovery 6-11 benefits 1-2 command switch configuration 6-18 compatibility 6-4 creating 6-18 creating a cluster standby group 6-21 described 6-1 managing through CLI 6-24 through SNMP 6-25 planning 6-4 planning considerations automatic discovery 6-5 automatic recovery 6-11 CLI 6-24 host names 6-14 IP addresses 6-14 passwords 6-15 RADIUS 6-17 SNMP 6-15, 6-25 switch-specific features 6-17 switch stacks 6-15 TACACS+ 6-17Index IN-7 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 clusters, switch (continued) redundancy 6-21 troubleshooting 6-23 verifying 6-22 See also candidate switch, command switch, cluster standby group, member switch, and standby command switch cluster standby group and HSRP group 30-9 automatic recovery 6-13 considerations 6-12 creating 6-21 defined 6-2 requirements 6-3 virtual IP address 6-12 See also HSRP cluster tree described 3-6 icons 3-6 CMS accessing 3-30 benefits 1-2 change notification 3-31 cluster tree 3-6 described 1-2, 1-4, 3-1 different versions of 3-33 displaying system messages 3-19 error checking 3-31 features 3-3 Front Panel images 3-7 Front Panel view 3-5 interaction modes 3-25 launching 3-2 menu bar 3-16 online help 3-27 requirements 3-30 saving configuration changes 3-32 toolbar 3-20 tool tips 3-26 CMS (continued) Topology view 3-11 verifying configuration changes 3-31 window components 3-28 wizards 3-26 collapsed cluster view 3-12 command-line interface See CLI command modes 2-1 commands abbreviating 2-4 no and default 2-4 setting privilege levels 9-8 command switch accessing 6-12 active (AC) 6-11, 6-21 command switch with HSRP disabled (CC) 6-21 configuration conflicts 34-12 defined 6-2 enabling 6-18 passive (PC) 6-11, 6-21 password privilege levels 6-24 priority 6-11 recovery from command-switch failure 6-11 from failure 34-9 from lost member connectivity 34-12 redundant 6-11, 6-21 replacing with another switch 34-11 with cluster member 34-9 requirements 6-3 standby (SC) 6-11, 6-21 See also candidate switch, cluster standby group, member switch, and standby command switch community list, BGP 29-58Index IN-8 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 community strings configuring 6-15, 25-8 for cluster switches 25-4 in clusters 6-15 overview 25-4 SNMP 6-15 compatibility, software See stacks, switch config.text 4-12 configuration, switch, saving changes 3-32 configuration conflicts, recovering from lost member connectivity 34-12 configuration examples, network 1-11 configuration files clearing the startup configuration B-20 creating using a text editor B-11 default name 4-12 deleting a stored configuration B-20 described B-9 downloading automatically 4-12 preparing B-11, B-14, B-17 reasons for B-9 using FTP B-14 using RCP B-18 using TFTP B-12 guidelines for creating and using B-10 invalid combinations when copying B-5 limiting TFTP server access 25-15 obtaining with DHCP 4-7 password recovery disable considerations 9-5 specifying the filename 4-13 system contact and location information 25-15 types and location B-10 configuration files (continued) uploading preparing B-11, B-14, B-17 reasons for B-9 using FTP B-16 using RCP B-19 using TFTP B-12 configuration settings, saving 4-10 configure terminal command 11-7 config-vlan mode 2-2, 12-7 conflicts, configuration 34-12 connections, secure remote 9-38 connectivity problems 34-13, 34-15 consistency checks in VTP version 2 13-4 console port, connecting to 2-10 conventions command xxxiv for examples xxxiv publication xxxiv text xxxiv corrupted software, recovery steps with XMODEM 34-2 CoS in Layer 2 frames 27-2 override priority 14-5 trust priority 14-5 CoS input queue threshold map for QoS 27-14 CoS output queue threshold map for QoS 27-16 CoS-to-DSCP map for QoS 27-47 counters, clearing interface 11-22 crashinfo file 34-21 cross-stack EtherChannel configuration guidelines 28-12 configuring on Layer 2 interfaces 28-12 on Layer 3 physical interfaces 28-15 described 28-2 illustration 28-3 support for 1-5Index IN-9 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 cross-stack UplinkFast, STP described 17-5 enabling 17-17 fast-convergence events 17-7 Fast Uplink Transition Protocol 17-6 normal-convergence events 17-7 support for 1-5 cryptographic software image Kerberos 9-32 SSH 9-38 switch stack considerations 5-2, 5-11, 9-38 CWDM GBIC modules, wavelength colors on CMS 3-8 D daylight saving time 7-14 debugging enabling all system diagnostics 34-18 enabling for a specific feature 34-17 redirecting error message output 34-18 using commands 34-17 default commands 2-4 default configuration 802.1X 10-11 auto-QoS 27-18 banners 7-19 BGP 29-47 booting 4-12 CDP 20-2 DNS 7-18 EIGRP 29-40 EtherChannel 28-10 fallback bridging 33-4 HSRP 30-4 IGMP 31-27 IGMP filtering 18-19 IGMP snooping 18-5 IGRP 29-26 initial switch information 4-3 default configuration (continued) IP addressing, IP routing 29-5 IP multicast routing 31-9 Layer 2 interfaces 11-12 MAC address table 7-23 MSDP 32-4 MSTP 16-13 MVR 18-15 NTP 7-4 optional spanning-tree features 17-12 OSPF 29-31 password and privilege level 9-2 RADIUS 9-20 RIP 29-20 RMON 23-3 RSPAN 22-11 SNMP 25-6 SPAN 22-11 standard QoS 27-27 STP 15-13 switch stacks 5-15 system message logging 24-4 system name and prompt 7-16 TACACS+ 9-13 UDLD 21-3 VLAN, Layer 2 Ethernet interfaces 12-19 VLANs 12-8 VMPS 12-29 voice VLAN 14-3 VTP 13-7 default gateway 4-10, 29-12 default networks 29-69 default routes 29-69 default routing 29-2 deleting VLANs 12-10 description command 11-17 designing your network, examples 1-11 desktop template 5-7, 8-1 destination addresses, in ACLs 26-11Index IN-10 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 destination-IP address based forwarding, EtherChannel 28-8 destination-MAC address forwarding, EtherChannel 28-8 detecting indirect link failures, STP 17-8 device discovery protocol 20-1 device icons, Front Panel view 3-6 device information 3-14 Device Manager 3-4 See also Switch Manager device pop-up menu Front Panel view 3-21 Topology view 3-23 DHCP-based autoconfiguration client request message exchange 4-4 configuring client side 4-3 DNS 4-6 relay device 4-6 server-side 4-5 TFTP server 4-5 example 4-8 lease options for IP address information 4-5 for receiving the configuration file 4-5 overview 4-3 relationship to BOOTP 4-4 relay support 1-8 support for 1-4 Differentiated Services architecture, QoS 27-1 Differentiated Services Code Point 27-2 Diffusing Update Algorithm (DUAL) 29-39 directed unicast requests 1-4 directories changing B-4 creating and removing B-4 displaying the working B-4 discovery, clusters See automatic discovery display options, Topology view 3-16 Disqualification Code option 3-25 Distance Vector Multicast Routing Protocol See DVMRP distance-vector protocols 29-3 distribute-list command 29-78 DNS and DHCP-based autoconfiguration 4-6 default configuration 7-18 displaying the configuration 7-19 overview 7-17 setting up 7-18 support for 1-4 documentation feedback xxxvi obtaining CD-ROM xxxv world wide web xxxv ordering xxxvi related xxxv document conventions xxxiv domain names DNS 7-17 VTP 13-8 Domain Name System See DNS downloading configuration files preparing B-11, B-14, B-17 reasons for B-9 using FTP B-14 using RCP B-18 using TFTP B-12 image files deleting old image B-25 preparing B-23, B-26, B-30 reasons for B-21 using FTP B-27 using RCP B-32 using TFTP B-24Index IN-11 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 DSCP 1-7, 27-2 DSCP input queue threshold map for QoS 27-14 DSCP output queue threshold map for QoS 27-16 DSCP-to-CoS map for QoS 27-50 DSCP-to-DSCP-mutation map for QoS 27-51 DTP 1-6, 12-17 DUAL finite state machine, EIGRP 29-39 duplex mode, configuring 11-13 DVMRP autosummarization configuring a summary address 31-47 disabling 31-49 connecting PIM domain to DVMRP router 31-39 enabling unicast routing 31-43 interoperability with Cisco devices 31-37 with IOS software 31-7 mrinfo requests, responding to 31-42 neighbors advertising the default route to 31-41 discovery with Probe messages 31-37 displaying information 31-42 prevent peering with nonpruning 31-45 rejecting nonpruning 31-44 overview 31-7 routes adding a metric offset 31-49 advertising all 31-49 advertising the default route to neighbors 31-41 caching DVMRP routes learned in report messages 31-43 changing the threshold for syslog messages 31-46 deleting 31-51 displaying 31-51 favoring one over another 31-49 limiting the number injected into MBONE 31-46 limiting unicast route advertisements 31-37 routing table 31-7 source distribution tree, building 31-7 DVMRP (continued) support for 1-8 tunnels configuring 31-39 displaying neighbor information 31-42 dynamic access mode 3-10 dynamic access ports characteristics 12-4 configuring 12-31 defined 11-3 dynamic addresses See addresses dynamic auto trunking mode 12-18 dynamic desirable trunking mode 12-18 Dynamic Host Configuration Protocol See DHCP-based autoconfiguration dynamic port VLAN membership described 12-29 reconfirming 12-32 troubleshooting 12-33 types of connections 12-31 dynamic routing 29-3 Dynamic Trunking Protocol See DTP E EBGP 29-45 editing features enabling and disabling 2-7 keystrokes used 2-7 wrapped lines 2-8 EIGRP and IGRP 29-41 authentication 29-43 components 29-39 configuring 29-41 default configuration 29-40 definition 29-39Index IN-12 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 EIGRP (continued) interface parameters, configuring 29-42 monitoring 29-44 support for 1-8 elections See stack master enable password 9-4 enable secret password 9-4 encryption for passwords 9-4 Enhanced IGRP See EIGRP environment variables function of 4-16 equal-cost routing 1-8, 29-67 error checking, CMS 3-31 error messages during command entry 2-5 EtherChannel 802.3AD, described 28-6 automatic creation of 28-5, 28-6 channel groups binding physical and logical interfaces 28-4 numbering of 28-4 configuration guidelines 28-11 configuring Layer 2 interfaces 28-12 Layer 3 physical interfaces 28-15 Layer 3 port-channel logical interfaces 28-14 configuring Layer 2 interfaces 28-12 default configuration 28-10 described 28-2 displaying status 28-22 forwarding methods 28-7, 28-17 interaction with STP 28-11 with VLANs 28-11 EtherChannel (continued) LACP described 28-6 displaying status 28-22 hot-standby ports 28-20 interaction with other features 28-7 modes 28-7 port priority 28-21 system priority 28-20 LACP, support for 1-3 Layer 3 interface 29-4 load balancing 28-7, 28-17 logical interfaces, described 28-4 number of interfaces per 28-2 PAgP aggregate-port learners 28-18 compatibility with Catalyst 1900 28-19 described 28-5 displaying status 28-22 interaction with other features 28-6 learn method and priority configuration 28-18 modes 28-5 silent mode 28-6 support for 1-3 port-channel interfaces described 28-4 numbering of 28-4 port groups 11-5 stack changes, effects of 28-9 support for 1-3 Ethernet VLANs adding 12-8 defaults and ranges 12-8 modifying 12-8 events, RMON 23-3Index IN-13 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 examples conventions for xxxiv network configuration 1-11 expanded cluster view 3-11 expanded stack view 3-13 expert mode 3-26 express setup 3-2 extended-range VLANs configuration guidelines 12-13 configuring 12-12 creating 12-13 defined 12-1 extended system ID MSTP 16-15 STP 15-4, 15-16 Extensible Authentication Protocol over LAN 10-1 exterior routes, IGRP 29-25 external BGP See EBGP external neighbors, BGP 29-49 F failover support 1-5 fallback bridging and protected ports 33-4 bridge groups creating 33-4 described 33-2 displaying 33-11 function of 33-2 number supported 33-5 removing 33-5 bridge table clearing 33-11 displaying 33-11 configuration guidelines 33-4 connecting interfaces with 11-6 default configuration 33-4 fallback bridging (continued) described 33-1 frame forwarding flooding packets 33-2 forwarding packets 33-2 overview 33-1 stack changes, effects of 33-3 STP disabling on an interface 33-11 forward-delay interval 33-10 hello BPDU interval 33-9 interface priority 33-7 maximum-idle interval 33-10 path cost 33-8 VLAN-bridge spanning-tree priority 33-7 VLAN-bridge STP 33-2 support for 1-8 SVIs and routed ports 33-1 VLAN-bridge STP 15-12, 33-2 fan fault indication 3-6 Fast Uplink Transition Protocol 17-6 feedback to Cisco Systems, web xxxvi FIB 29-66 fiber-optic, detecting unidirectional links 21-1 files copying B-5 crashinfo description 34-21 displaying the contents of 34-21 location 34-21 deleting B-6 displaying the contents of B-8 tar creating B-6 displaying the contents of B-7 extracting B-8 image file format B-22Index IN-14 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 file system displaying available file systems B-2 displaying file information B-3 local file system names B-1 network file system names B-5 setting the default B-3 filtering in a VLAN 26-29 non-IP traffic 26-26 show and more command output 2-9 filtering show and more command output 2-9 filters, IP See ACLs, IP Flash device, number of B-1 flash updates, IGRP 29-26 flooded traffic, blocking 19-6 flow-based packet classification 1-7 flowcharts QoS classification 27-6 QoS egress queueing and scheduling 27-15 QoS ingress queueing and scheduling 27-13 QoS policing and marking 27-9 flow control 1-3, 11-15 forward-delay time MSTP 16-21 STP 15-23 Forwarding Information Base See FIB forwarding non-routable protocols 33-1 Front Panel images, CMS 3-7 Front Panel view cluster tree 3-6 command switch 3-5 described 3-5 pop-up menus 3-21 port icons 3-7 port LEDs 3-9 RPS LED 3-8 switch images 3-7 FTP accessing MIB files A-3 configuration files downloading B-14 overview B-13 preparing the server B-14 uploading B-16 image files deleting old image B-29 downloading B-27 preparing the server B-26 uploading B-29 G get-bulk-request operation 25-3 get-next-request operation 25-3, 25-5 get-request operation 25-3, 25-5 get-response operation 25-3 Gigabit modules See SFPs global configuration mode 2-2 graphs, bandwidth 3-9 guest VLAN and 802.1X 10-8 guide audience xxxiii purpose of xxxiii guide mode 1-2, 3-25 H hardware limitations and Layer 3 interfaces 11-18 HC (candidate switch) 6-21 hello time MSTP 16-20 STP 15-22 help, for the command line 2-3 Help button, CMS 3-29Index IN-15 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Help Contents 3-27 history changing the buffer size 2-5 described 2-5 disabling 2-6 recalling commands 2-6 history table, level and number of syslog messages 24-10 host name list, CMS 3-28 host names abbreviations appended to 6-21 in clusters 6-14 hosts, limit on dynamic ports 12-33 Hot Standby Router Protocol See HSRP HP OpenView 1-4 HSRP authentication string 30-8 automatic cluster recovery 6-13 binding to cluster group 30-9 cluster standby group considerations 6-12 command-switch redundancy 1-1, 1-5 configuring 30-3 default configuration 30-4 definition 30-1 guidelines 30-4 monitoring 30-10 overview 30-1 priority 30-6 routing redundancy 1-8 switch stack considerations 30-2 timers 30-8 tracking 30-6 See also clusters, cluster standby group, and standby command switch HTTP access 3-31 Hypertext Transfer Protocol See HTTP access I IBPG 29-45 ICMP redirect messages 29-12 support for 1-8 unreachable messages 26-19 unreachables and ACLs 26-20 ICMP ping executing 34-14 overview 34-13 ICMP Router Discovery Protocol See IRDP icons cluster tree 3-6 colors cluster tree 3-6 Topology view 3-15 Front Panel view 3-7 toolbar 3-20 Topology view 3-14 IDS appliances and ingress RSPAN 22-21 and ingress SPAN 22-14 IEEE 802.1P 14-1 IFS 1-4 IGMP configuring the switch as a member of a group 31-27 statically connected member 31-32 controlling access to groups 31-28 default configuration 31-27 deleting cache entries 31-51 displaying groups 31-51 fast switching 31-32 host-query interval, modifying 31-30Index IN-16 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 IGMP (continued) joining multicast group 18-2 join messages 18-2 leave processing, enabling 18-9 leaving multicast group 18-4 multicast reachability 31-27 overview 31-2 queries 18-3 support for 1-3 Version 1 changing to Version 2 31-29 described 31-3 Version 2 changing to Version 1 31-29 described 31-3 maximum query response time value 31-31 pruning groups 31-31 query timeout value 31-31 IGMP filtering configuring 18-19 default configuration 18-19 described 18-19 monitoring 18-22 support for 1-3 IGMP groups, setting the maximum number 18-21 IGMP profile applying 18-20 configuration mode 18-19 configuring 18-20 IGMP snooping and address aliasing 18-2 and stack changes 18-5 configuring 18-5 default configuration 18-5 definition 18-2 enabling and disabling 18-6 global configuration 18-6 Immediate Leave 18-4 in the switch stack 18-5 IGMP snooping (continued) method 18-6 monitoring 18-10 support for 1-3 VLAN configuration 18-6 IGP 29-30 IGRP advertisements 29-25 alternate routes 29-26 configuring 29-27 default configuration 29-26 described 29-25 exterior routes 29-25 flash updates 29-26 interior routes 29-25 load balancing 29-26 poison-reverse updates 29-26 split horizon 29-29 support for 1-8 system routes 29-25 traffic sharing 29-27 unequal-cost load balancing 29-26 Immediate-Leave, IGMP 18-4 initial configuration defaults 1-9 See also hardware installation guide interaction modes, CMS 3-25 interface number 11-7 range macros 11-10 interface command 11-6, 11-7 interface configuration mode 2-3 interfaces configuration guidelines 11-13 configuring 11-7 configuring duplex mode 11-13 configuring speed 11-13 counters, clearing 11-22 described 11-17Index IN-17 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 interfaces (continued) descriptive name, adding 11-17 displaying information about 11-21 flow control 11-15 management 1-4 monitoring 11-21 naming 11-17 physical, identifying 11-6 range of 11-8 restarting 11-22 shutting down 11-22 supported 11-6 types of 11-1 interfaces range macro command 11-10 interface types 11-6 Interior Gateway Protocol See IGP Interior Gateway Routing Protocol See IGRP interior routes, IGRP 29-25 internal BGP See IBGP internal neighbors, BGP 29-49 Internet Control Message Protocol See ICMP Internet Group Management Protocol See IGMP Inter-Switch Link See ISL inter-VLAN routing 1-8, 29-2 Intrusion Detection System See IDS inventory, cluster 6-22 IOS File System See IFS ip access group command 26-20 IP ACLs applying to an interface 26-19 extended, creating 26-10 for QoS classification 27-7 implicit deny 26-9, 26-13, 26-15 implicit masks 26-9 logging 26-15 named 26-14 standard, creating 26-9 undefined 26-20 virtual terminal lines, setting on 26-18 IP addresses candidate or member 6-4, 6-14 classes of 29-6 cluster access 6-2 command switch 6-3, 6-12, 6-14 default configuration 29-5 discovering 7-28 entering in browser window 3-2 for IP routing 29-5 MAC address association 29-9 monitoring 29-18 redundant clusters 6-12 standby command switch 6-12, 6-14 See also IP information IP broadcast address 29-16 ip cef distributed command 29-66 IP directed broadcasts 29-14 ip igmp profile command 18-19 IP information assigned manually 4-9 through DHCP-based autoconfiguration 4-3 default configuration 4-3Index IN-18 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 IP multicast routing addresses all-hosts 31-3 all-multicast-routers 31-3 host group address range 31-3 administratively-scoped boundaries, described 31-35 and IGMP snooping 18-2 Auto-RP adding to an existing sparse-mode cloud 31-14 benefits of 31-14 clearing the cache 31-51 configuration guidelines 31-10 filtering incoming RP announcement messages 31-17 overview 31-5 preventing candidate RP spoofing 31-17 preventing join messages to false RPs 31-16 setting up in a new internetwork 31-14 using with BSR 31-22 bootstrap router configuration guidelines 31-10 configuring candidate BSRs 31-20 configuring candidate RPs 31-21 defining the IP multicast boundary 31-19 defining the PIM domain border 31-18 overview 31-5 using with Auto-RP 31-22 Cisco implementation 31-2 configuring basic multicast routing 31-10 IP multicast boundary 31-35 default configuration 31-9 enabling multicast forwarding 31-11 PIM mode 31-11 group-to-RP mappings Auto-RP 31-5 BSR 31-5 IP multicast routing (continued) MBONE deleting sdr cache entries 31-51 described 31-34 displaying sdr cache 31-52 enabling sdr listener support 31-34 limiting DVMRP routes advertised 31-46 limiting sdr cache entry lifetime 31-35 SAP packets for conference session announcement 31-34 Session Directory (sdr) tool, described 31-34 monitoring packet rate loss 31-52 peering devices 31-52 tracing a path 31-52 multicast forwarding, described 31-6 PIMv1 and PIMv2 interoperability 31-9 protocol interaction 31-2 reverse path check (RPF) 31-6 routing table deleting 31-51 displaying 31-52 RP assigning manually 31-12 configuring Auto-RP 31-14 configuring PIMv2 BSR 31-18 monitoring mapping information 31-23 using Auto-RP and BSR 31-22 stacking stack master functions 31-8 stack member functions 31-8 statistics, displaying system and network 31-51 See also CGMP See also DVMRP See also IGMP See also PIMIndex IN-19 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 IP phones and QoS 14-1 automatic classification and queueing 27-18 configuring 14-4 ensuring port security with QoS 27-34 trusted boundary for QoS 27-34 IP precedence 27-2 IP-precedence-to-DSCP map for QoS 27-48 IP protocols in ACLs 26-11 routing 1-8 IP routes, monitoring 29-81 IP routing connecting interfaces with 11-6 enabling 29-19 IP unicast routing address resolution 29-9 administrative distances 29-68, 29-79 ARP 29-9 assigning IP addresses to Layer 3 interfaces 29-6 authentication keys 29-80 broadcast address 29-16 flooding 29-17 packets 29-14 storms 29-14 classless routing 29-7 configuring static routes 29-68 default addressing configuration 29-5 gateways 29-12 networks 29-69 routes 29-69 routing 29-2 directed broadcasts 29-14 dynamic routing 29-3 enabling 29-19 EtherChannel Layer 3 interface 29-4 IGP 29-30 IP unicast routing (continued) inter-VLAN 29-2 IP addressing classes 29-6 configuring 29-5 IRDP 29-13 Layer 3 interfaces 29-4 MAC address and IP address 29-9 passive interfaces 29-77 protocols distance-vector 29-3 dynamic 29-3 link-state 29-3 proxy ARP 29-9 redistribution 29-70 reverse address resolution 29-9 routed ports 29-4 static routing 29-2 steps to configure 29-5 subnet mask 29-6 subnet zero 29-7 supernet 29-7 UDP 29-16 with SVIs 29-4 See also BGP See also EIGRP See also IGRP See also OSPF See also RIP IRDP configuring 29-13 definition 29-13 support for 1-8 ISL and trunk ports 11-3 encapsulation 1-6, 12-16 trunk mode 3-10Index IN-20 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 J Java Plug-in 3-2 Java plug-in configuration 3-1 join messages, IGMP 18-2 K KDC described 9-32 See also Kerberos Kerberos authenticating to boundary switch 9-35 KDC 9-35 network services 9-35 configuration examples 9-32 configuring 9-36 credentials 9-32 cryptographic software image 9-32 described 9-32 KDC 9-32 operation 9-34 realm 9-33 server 9-33 support for 1-7 switch as trusted third party 9-32 terms 9-33 TGT 9-34 tickets 9-32 key distribution center See KDC L LACP See EtherChannel Layer 2 frames, classification with CoS 27-2 Layer 2 interfaces, default configuration 11-12 Layer 2 traceroute and ARP 34-16 and CDP 34-16 described 34-15 IP addresses and subnets 34-16 MAC addresses and VLANs 34-16 multicast traffic 34-16 multiple devices on a port 34-16 supported switches 34-15 unicast traffic 34-15 usage guidelines 34-16 Layer 2 trunks 12-17 Layer 3 features 1-8 Layer 3 interfaces assigning IP addresses to 29-6 changing from Layer 2 mode 29-6 types of 29-4 Layer 3 packets, classification methods 27-2 leave processing, IGMP 18-9 LEDs port 3-9, 3-10 port modes 3-9 RPS 3-8 legend, CMS icons and labels 3-20 line configuration mode 2-3 Link Aggregation Control Protocol See EtherChannel See LACP link information 3-14 link pop-up menu, Topology view 3-22 links, unidirectional 21-1 link state advertisements (LSAs) 29-34 link-state protocols 29-3 lists, CMS 3-29 load balancing, IGRP 29-26 logging messages, ACL 26-10 Logical Link Content window 3-23Index IN-21 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 login authentication with RADIUS 9-23 with TACACS+ 9-14 login banners 7-19 log messages See system message logging Long-Reach Ethernet (LRE) technology 1-12, 1-20 loop guard described 17-11 enabling 17-18 support for 1-5 M MAC addresses aging time 7-23 and VLAN association 7-23 building the address table 7-22 default configuration 7-23 discovering 7-28 displaying 7-27 dynamic learning 7-22 removing 7-24 in ACLs 26-26 IP address association 29-9 static adding 7-27 characteristics of 7-26 removing 7-27 MAC address notification, support for 1-8 MAC address-to-VLAN mapping 12-28 MAC extended access lists applying to Layer 2 interfaces 26-28 configuring for QoS 27-39 creating 26-26 defined 26-26 for QoS classification 27-5 manageability features 1-4 management access in-band browser session 1-4 CLI session 1-4 SNMP 1-4 out-of-band console port connection 1-4 management options benefits clustering 1-3 CMS 1-2 switch stacks 1-2 CLI 2-1 CMS 3-1 overview 1-4 management VLAN considerations in switch clusters 6-8 discovery through different management VLANs 6-8 mapping tables for QoS configuring CoS-to-DSCP 27-47 DSCP 27-47 DSCP-to-CoS 27-50 DSCP-to-DSCP-mutation 27-51 IP-precedence-to-DSCP 27-48 policed-DSCP 27-49 described 27-10 marking action in policy map 27-42 action with aggregate policers 27-45 described 27-3, 27-8 matching, ACLs 26-7 maximum aging time MSTP 16-22 STP 15-23 maximum hop count, MSTP 16-22 maximum-paths command 29-52, 29-67 membership mode, VLAN port 3-10, 12-3Index IN-22 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 member switch adding 6-19 automatic discovery 6-5 defined 6-2 managing 6-24 passwords 6-14 recovering from lost connectivity 34-12 requirements 6-4 See also candidate switch, cluster standby group, and standby command switch menu bar described 3-16 variations 3-16 messages logging ACL violations 26-15 system 3-19 to users through banners 7-19 metrics, in BGP 29-53 metric translations, between routing protocols 29-74 MIBs accessing files with FTP A-3 location of files A-3 overview 25-1 SNMP interaction with 25-5 supported A-1 mini-point-of-presence See POP mirroring traffic for analysis 22-1 mismatches, autonegotiation 34-12 Mode button 3-9 modes port 3-9 VLAN port membership 3-10 Modify button 3-29 module number 11-7 monitoring access groups 26-41 ACL configuration 26-41 BGP 29-64 cables for unidirectional links 21-1 CDP 20-5 CEF 29-67 EIGRP 29-44 fallback bridging 33-11 features 1-8 HSRP 30-10 IGMP filters 18-22 snooping 18-10 interfaces 11-21 IP address tables 29-18 multicast routing 31-50 routes 29-81 MSDP peers 32-19 multicast router interfaces 18-11 MVR 18-18 network traffic for analysis with probe 22-2 OSPF 29-38 port blocking 19-15 protection 19-15 RP mapping information 31-23 source-active messages 32-19 speed and duplex mode 11-14 traffic flowing among switches 23-1 traffic suppression 19-15 VLAN filters 26-41 maps 26-41 VLANs 12-16 VMPS 12-33 VTP 13-16Index IN-23 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 MSDP benefits of 32-3 clearing MSDP connections and statistics 32-19 controlling source information forwarded by switch 32-12 originated by switch 32-8 received by switch 32-14 default configuration 32-4 dense-mode regions sending SA messages to 32-17 specifying the originating address 32-18 filtering incoming SA messages 32-14 SA messages to a peer 32-12 SA requests from a peer 32-11 join latency, defined 32-6 meshed groups configuring 32-16 defined 32-16 originating address, changing 32-18 overview 32-1 peer-RPF flooding 32-2 peers configuring a default 32-4 monitoring 32-19 peering relationship, overview 32-1 requesting source information from 32-8 shutting down 32-16 source-active messages caching 32-6 clearing cache entries 32-19 defined 32-2 filtering from a peer 32-11 filtering incoming 32-14 filtering to a peer 32-12 limiting data with TTL 32-14 monitoring 32-19 restricting advertised sources 32-9 support for 1-8 MSTP boundary ports configuration guidelines 16-14 described 16-5 BPDU filtering described 17-3 enabling 17-15 BPDU guard described 17-3 enabling 17-14 CIST, described 16-3 configuration guidelines 16-13, 17-12 configuring forward-delay time 16-21 hello time 16-20 link type for rapid convergence 16-23 maximum aging time 16-22 maximum hop count 16-22 MST region 16-14 path cost 16-19 port priority 16-18 root switch 16-15 secondary root switch 16-17 switch priority 16-20 CST defined 16-3 operations between regions 16-4 default configuration 16-13 default optional feature configuration 17-12 displaying status 16-24 enabling the mode 16-14 extended system ID effects on root switch 16-15 effects on secondary root switch 16-17 unexpected behavior 16-16 instances supported 15-10 interface state, blocking to forwarding 17-2 interoperability and compatibility among modes 15-11Index IN-24 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 MSTP (continued) interoperability with 802.1D described 16-6 restarting migration process 16-23 IST defined 16-3 master 16-3 operations within a region 16-3 loop guard described 17-11 enabling 17-18 mapping VLANs to MST instance 16-14 MST region CIST 16-3 configuring 16-14 described 16-2 hop-count mechanism 16-5 IST 16-3 supported spanning-tree instances 16-2 optional features supported 1-5 overview 16-2 Port Fast described 17-2 enabling 17-13 preventing root switch selection 17-10 root guard described 17-10 enabling 17-18 root switch configuring 16-16 effects of extended system ID 16-15 unexpected behavior 16-16 shutdown Port Fast-enabled port 17-3 stack changes, effects of 16-6 status, displaying 16-24 multicast groups Immediate Leave 18-4 joining 18-2 leaving 18-4 static joins 18-9 multicast packets ACLs on 26-40 blocking 19-6 multicast router interfaces, monitoring 18-11 multicast router ports, adding 18-8 Multicast Source Discovery Protocol See MSDP multicast storm-control command 19-3 multicast storms 19-1 Multicast VLAN Registration See MVR multiple links in Topology view 3-23 Multiple Spanning Tree Protocol See MSTP MVR and address aliasing 18-15 configuring interfaces 18-17 default configuration 18-15 described 18-12 in the switch stack 18-14 modes 18-16 monitoring 18-18 setting global parameters 18-15 support for 1-3 N named IP ACLs 26-14 native VLAN configuring 12-23 default 12-23Index IN-25 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 negotiate trunk mode 3-11 neighbor discovery/recovery, EIGRP 29-39 neighboring devices, types of 3-14 neighbors, BGP 29-59 network configuration examples cost-effective wiring closet 1-13 high-performance wiring closet 1-13 increasing network performance 1-11 large network 1-18 providing network services 1-12 redundant Gigabit backbone 1-14 small to medium-sized network 1-17 network design performance 1-11 services 1-12 network management CDP 20-1 RMON 23-1 SNMP 25-1 Network Time Protocol See NTP no commands 2-4 non-IP traffic filtering 26-26 nontrunking mode 12-18 normal-range VLANs configuration modes 12-6 defined 12-1 no switchport command 11-3 note, described xxxiv not-so-stubby areas See NSSA NSSA, OSPF 29-34 NTP associations authenticating 7-5 defined 7-2 enabling broadcast messages 7-7 peer 7-6 server 7-6 default configuration 7-4 displaying the configuration 7-11 overview 7-2 restricting access creating an access group 7-9 disabling NTP services per interface 7-10 source IP address, configuring 7-10 stratum 7-2 support for 1-4 synchronizing devices 7-6 time services 7-2 synchronizing 7-2 O OK button 3-29 online help 3-27 Open Shortest Path First See OSPF optimizing system resources 8-1 options, management 1-4 OSPF area parameters, configuring 29-34 configuring 29-32Index IN-26 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 OSPF (continued) default configuration metrics 29-35 route 29-35 settings 29-31 described 29-30 interface parameters, configuring 29-33 LSA group pacing 29-37 monitoring 29-38 router IDs 29-37 route summarization 29-35 support for 1-8 virtual links 29-35 out-of-profile markdown 1-7 overheating indication, switch 3-6 P packet modification, with QoS 27-17 PAgP See EtherChannel parallel paths, in routing tables 29-67 passive interfaces configuring 29-77 OSPF 29-35 passwords default configuration 9-2 disabling recovery of 9-5 encrypting 9-4 for security 1-6 in clusters 6-15, 6-19 in CMS 3-30 overview 9-1 recovery of 34-4 passwords (continued) setting enable 9-3 enable secret 9-4 Telnet 9-6 with usernames 9-7 VTP domain 13-8 path cost MSTP 16-19 STP 15-20 PBR defined 29-74 enabling 29-76 fast-switched policy-based routing 29-77 local policy-based routing 29-77 PC (passive command switch) 6-11, 6-21 peers, BGP 29-59 performance, network design 1-11 performance features 1-3 per-VLAN spanning-tree plus See PVST+ physical ports 11-2 PIM default configuration 31-9 dense mode overview 31-4 rendezvous point (RP), described 31-4 RPF lookups 31-7 displaying neighbors 31-52 enabling a mode 31-11 overview 31-3 router-query message interval, modifying 31-26 shared tree and source tree, overview 31-23 shortest path tree, delaying the use of 31-25Index IN-27 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 PIM (continued) sparse mode join messages and shared tree 31-4 overview 31-4 prune messages 31-5 RPF lookups 31-7 support for 1-8 versions interoperability 31-9 troubleshooting interoperability problems 31-23 v2 improvements 31-4 PIM-DVMRP, as snooping method 18-7 ping character output description 34-14 executing 34-14 overview 34-13 poison-reverse updates, IGRP 29-26 policed-DSCP map for QoS 27-49 policers configuring for each matched traffic class 27-42 for more than one traffic class 27-45 described 27-3 displaying 27-64 number of 27-29 types of 27-8 policing described 27-3 token-bucket algorithm 27-9 policy-based routing See PBR policy maps for QoS characteristics of 27-42 configuring 27-42 described 27-7 displaying 27-64 POP 1-20 port ACLs defined 26-2 types of 26-4 Port Aggregation Protocol See EtherChannel See PAgP port-based authentication authentication server defined 10-2 RADIUS server 10-2 client, defined 10-2 configuration guidelines 10-12 configuring 802.1X authentication 10-13 guest VLAN 10-19 host mode 10-18 manual re-authentication of a client 10-16 periodic re-authentication 10-15 quiet period 10-16 RADIUS server 10-15 RADIUS server parameters on the switch 10-14 switch-to-client frame-retransmission number 10-17 switch-to-client retransmission time 10-17 default configuration 10-11 described 10-1 device roles 10-2 displaying statistics 10-20 EAPOL-start frame 10-3 EAP-request/identity frame 10-3 EAP-response/identity frame 10-3 encapsulation 10-2 guest VLAN configuration guidelines 10-8 described 10-8 initiation and message exchange 10-3 method lists 10-13Index IN-28 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 port-based authentication (continued) multiple-hosts mode, described 10-18 per-user ACLs AAA authorization 10-13 configuration tasks 10-9 described 10-9 RADIUS server attributes 10-9 ports authorization state and dot1x port-control command 10-4 authorized and unauthorized 10-4 voice VLAN 10-6 port security and voice VLAN 10-6 described 10-6 interactions 10-6 multiple-hosts mode 10-18 resetting to default values 10-20 stack changes, effects of 10-10 statistics, displaying 10-20 switch as proxy 10-2 RADIUS client 10-2 topologies, supported 10-5 upgrading from a previous release 10-12 VLAN assignment AAA authorization 10-13 characteristics 10-7 configuration tasks 10-8 described 10-7 voice VLAN described 10-6 PVID 10-6 VVID 10-6 port blocking 1-3, 19-5 port-channel See EtherChannel Port Fast described 17-2 enabling 17-13 mode, spanning tree 12-30 support for 1-5 port icons, Front Panel view 3-7 port LEDs described 3-10 DUPLX 3-9 port modes 3-9 SPEED 3-9 STACK 3-9 STAT 3-9 port membership modes, VLAN 3-10, 12-3 port modes described 3-9 LEDs 3-9 port pop-up menu, Front Panel view 3-22 port priority MSTP 16-18 STP 15-19 ports 802.1Q trunk 3-11 access 11-2 blocking 19-5 dynamic access 3-10, 12-4 ISL trunk 3-10 negotiate trunk 3-11 protected 19-4 routed 11-3 secure 19-7 static-access 3-10, 12-3, 12-11 switch 11-2 trunks 12-3, 12-16 VLAN assignments 12-11Index IN-29 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 port security aging 19-13 and QoS trusted boundary 27-34 and stacking 19-14 configuring 19-10 default configuration 19-9 described 19-7 displaying 19-15 on trunk ports 19-11 sticky learning 19-8 violations 19-8 with other features 19-9 port-shutdown response, VMPS 12-28 preferential treatment of traffic See QoS prefix lists, BGP 29-56 preventing unauthorized access 9-1 priority HSRP 30-6 overriding CoS 14-5 trusting CoS 14-5 private VLAN edge ports See protected ports privileged EXEC mode 2-2 privilege levels changing the default for lines 9-9 command switch 6-24 exiting 9-10 logging into 9-10 mapping on member switches 6-24 overview 9-2, 9-8 setting a command with 9-8 protected ports 1-6, 19-4 protocol-dependent modules, EIGRP 29-40 Protocol-Independent Multicast Protocol See PIM proxy ARP configuring 29-11 definition 29-9 with IP routing disabled 29-12 pruning, VTP enabling 13-14 enabling on a port 12-23 examples 13-5 overview 13-4 pruning-eligible list changing 12-23 for VTP pruning 13-5 VLANs 13-14 publications for products, technologies, and network solutions xxxvii PVST+ 802.1Q trunking interoperability 15-11 described 15-10 instances supported 15-10 Q QoS auto-QoS categorizing traffic 27-18 configuration and defaults display 27-26 configuration guidelines 27-22 described 27-18 disabling 27-23 displaying generated commands 27-23 displaying the initial configuration 27-26 effects on running configuration 27-22 egress queue defaults 27-19 enabling for VoIP 27-22 example configuration 27-24 ingress queue defaults 27-19 list of generated commands 27-20Index IN-30 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 QoS (continued) basic model 27-3 classification class maps, described 27-7 defined 27-3 flowchart 27-6 forwarding treatment 27-3 in frames and packets 27-2 IP ACLs, described 27-5, 27-7 MAC ACLs, described 27-5, 27-7 options for IP traffic 27-5 options for non-IP traffic 27-5 policy maps, described 27-7 trust DSCP, described 27-5 trusted CoS, described 27-5 trust IP precedence, described 27-5 class maps configuring 27-40 displaying 27-64 configuration guidelines auto-QoS 27-22 standard QoS 27-29 configuring aggregate policers 27-45 auto-QoS 27-18 default port CoS value 27-33 DSCP maps 27-47 DSCP trust states bordering another domain 27-35 egress queue characteristics 27-57 ingress queue characteristics 27-52 IP extended ACLs 27-38 IP standard ACLs 27-37 MAC ACLs 27-39 policy maps 27-42 port trust states within the domain 27-31 trusted boundary 27-34 default auto configuration 27-18 default standard configuration 27-27 displaying statistics 27-64 QoS (continued) egress queues allocating buffer space 27-57 buffer allocation scheme, described 27-15 configuring shaped weights for SRR 27-61 configuring shared weights for SRR 27-62 described 27-4 displaying the threshold map 27-60 flowchart 27-15 mapping DSCP or CoS values 27-59 scheduling, described 27-4 setting WTD thresholds 27-57 WTD, described 27-16 enabling globally 27-30 flowcharts classification 27-6 egress queueing and scheduling 27-15 ingress queueing and scheduling 27-13 policing and marking 27-9 implicit deny 27-7 ingress queues allocating bandwidth 27-55 allocating buffer space 27-54 buffer and bandwidth allocation, described 27-14 configuring shared weights for SRR 27-55 configuring the priority queue 27-56 described 27-3 displaying the threshold map 27-53 flowchart 27-13 mapping DSCP or CoS values 27-53 priority queue, described 27-14 scheduling, described 27-3 setting WTD thresholds 27-53 WTD, described 27-14 IP phones automatic classification and queueing 27-18 detection and trusted settings 27-18, 27-34 limiting bandwidth on egress interface 27-63Index IN-31 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 QoS (continued) mapping tables CoS-to-DSCP 27-47 displaying 27-64 DSCP-to-CoS 27-50 DSCP-to-DSCP-mutation 27-51 IP-precedence-to-DSCP 27-48 policed-DSCP 27-49 types of 27-10 marked-down actions 27-43 marking, described 27-3, 27-8 overview 27-1 packet modification 27-17 policers configuring 27-43, 27-45 described 27-8 displaying 27-64 number of 27-29 types of 27-8 policies, attaching to an interface 27-9 policing described 27-3, 27-8 token bucket algorithm 27-9 policy maps characteristics of 27-42 configuring 27-42 displaying 27-64 QoS label, defined 27-3 queues configuring egress characteristics 27-57 configuring ingress characteristics 27-52 location of 27-11 SRR, described 27-12 WTD, described 27-11 rewrites 27-17 support for 1-7 QoS (continued) trust states bordering another domain 27-35 described 27-5 trusted device 27-34 within the domain 27-31 quality of service See QoS queries, IGMP 18-3 R RADIUS attributes vendor-proprietary 9-31 vendor-specific 9-29 configuring accounting 9-28 authentication 9-23 authorization 9-27 communication, global 9-21, 9-29 communication, per-server 9-21 multiple UDP ports 9-21 default configuration 9-20 defining AAA server groups 9-25 displaying the configuration 9-31 identifying the server 9-21 in clusters 6-17 limiting the services to the user 9-27 method list, defined 9-20 operation of 9-19 overview 9-18 suggested network environments 9-18 support for 1-7 tracking services accessed by user 9-28 range macro 11-10 of interfaces 11-8 rapid convergence 16-8Index IN-32 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 rapid per-VLAN spanning-tree plus See rapid PVST+ rapid PVST+ 802.1Q trunking interoperability 15-11 described 15-10 instances supported 15-10 Rapid Spanning Tree Protocol See RSTP RARP 29-9 rcommand command 6-24 RCP configuration files downloading B-18 overview B-17 preparing the server B-17 uploading B-19 image files deleting old image B-33 downloading B-32 preparing the server B-30 uploading B-34 reconfirmation interval, VMPS, changing 12-32 recovery procedures 34-1 redundancy EtherChannel 28-2 HSRP 30-1 STP backbone 15-8 multidrop backbone 17-5 path cost 12-26 port priority 12-24 redundant clusters See cluster standby group redundant links and UplinkFast 17-16 redundant power system See RPS Refresh button 3-29 reliable transport protocol, EIGRP 29-39 reloading software 4-17 Remote Authentication Dial-In User Service See RADIUS Remote Copy Protocol See RCP Remote Network Monitoring See RMON Remote SPAN See RSPAN 22-1 resets, in BGP 29-51 resetting a UDLD-shutdown interface 21-5 restricting access NTP services 7-8 overview 9-1 passwords and privilege levels 9-2 RADIUS 9-18 TACACS+ 9-10 retry count, VMPS, changing 12-32 reverse address resolution 29-9 Reverse Address Resolution Protocol See RARP RFC 1058, RIP 29-20 1112, IP multicast and IGMP 18-2 1157, SNMPv1 25-2 1163, BGP 29-45 1166, IP addresses 29-6 1253, OSPF 29-30 1267, BGP 29-45 1305, NTP 7-2 1587, NSSAs 29-30 1757, RMON 23-2 1771, BGP 29-45 1901, SNMPv2C 25-2 1902 to 1907, SNMPv2 25-2 2236, IP multicast and IGMP 18-2 2273-2275, SNMPv3 25-2Index IN-33 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 RIP advertisements 29-20 authentication 29-23 configuring 29-21 default configuration 29-20 described 29-20 hop counts 29-20 split horizon 29-23 summary addresses 29-23 support for 1-8 RMON default configuration 23-3 displaying status 23-6 enabling alarms and events 23-3 groups supported 23-2 overview 23-1 statistics collecting group Ethernet 23-6 collecting group history 23-5 support for 1-8 root guard described 17-10 enabling 17-18 support for 1-5 root switch MSTP 16-15 root switch, STP 15-16 route calculation timers, OSPF 29-36 route dampening, BGP 29-63 routed packets, ACLs on 26-39 routed ports configuring 29-4 defined 11-3 in switch clusters 6-9 IP addresses on 11-18, 29-4 route-map command 29-76 route maps BGP 29-54 policy-based routing 29-75 router ACLs defined 26-2 types of 26-3 route reflectors, BGP 29-62 router ID, OSPF 29-37 route selection, BGP 29-52 route summarization, OSPF 29-35 routing default 29-2 dynamic 29-3 redistribution of information 29-70 static 29-2 routing domain confederation, BGP 29-61 Routing Information Protocol See RIP routing protocol administrative distances 29-68 RPS LED 3-8 RSPAN and stack changes 22-10 characteristics 22-9 configuration guidelines 22-17 default configuration 22-11 destination ports 22-8 displaying status 22-24 in a switch stack 22-2 interaction with other features 22-9 monitored ports 22-6 monitoring ports 22-8 overview 1-8, 22-1 received traffic 22-5 session limits 22-11 sessions creating 22-18 defined 22-4 limiting source traffic to specific VLANs 22-23 specifying monitored ports 22-18 with ingress traffic enabled 22-21Index IN-34 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 RSPAN (continued) source ports 22-6 transmitted traffic 22-6 VLAN-based 22-7 RSTP active topology, determining 16-7 BPDU format 16-10 processing 16-11 designated port, defined 16-7 designated switch, defined 16-7 interoperability with 802.1D described 16-6 restarting migration process 16-23 topology changes 16-11 overview 16-7 port roles described 16-7 synchronized 16-9 proposal-agreement handshake process 16-8 rapid convergence cross-stack rapid convergence 16-9 described 16-8 edge ports and Port Fast 16-8 point-to-point links 16-8, 16-23 root ports 16-8 root port, defined 16-7 See also MSTP running configuration, saving 4-10 S SC (standby command switch) 6-11, 6-21 scheduled reloads 4-17 SDM described 8-1 switch stack consideration 5-7 templates configuring 8-4 number of 8-1 SDM mismatch mode 5-7, 8-2 SDM template aggregator 8-1 configuring 8-3 desktop 8-1 secure MAC addresses and switch stacks 19-14 deleting 19-12 maximum number of 19-8 types of 19-7 secure ports and switch stacks 19-14 configuring 19-7 secure remote connections 9-38 Secure Shell See SSH security, port 19-7 security features 1-6 sequence numbers in log messages 24-8 server mode, VTP 13-3 service-provider network MSTP and RSTP 16-1 set-request operation 25-5 setup program, failed command switch replacement 34-9, 34-11 severity levels, defining in system messages 24-9 SFPs numbering of 11-7 security and identification 34-13 shaped round robin See SRR show access-lists hw-summary command 26-21 show and more command output, filtering 2-9Index IN-35 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 show cdp traffic command 20-5 show cluster members command 6-24 show configuration command 11-17 show forward command 34-19 show interfaces command 11-14, 11-17 show platform forward command 34-19 show running-config command displaying ACLs 26-19, 26-30, 26-33 interface description in 11-17 shutdown command on interfaces 11-22 Simple Network Management Protocol See SNMP small form-factor pluggable modules See SFPs SNAP 20-1 SNMP accessing MIB variables with 25-5 agent described 25-4 disabling 25-7 authentication level 25-10, 25-11 community strings configuring 25-8 for cluster switches 25-4 overview 25-4 configuration examples 25-16 default configuration 25-6 engine ID 25-7 groups 25-7, 25-9 host 25-7 in-band management 1-4 in clusters 6-15 informs and trap keyword 25-12 described 25-5 differences from traps 25-5 enabling 25-15 limiting access by TFTP servers 25-15 limiting system log messages to NMS 24-10 SNMP (continued) manager functions 1-4, 25-3 managing clusters with 6-25 MIBs location of A-3 supported A-1 notifications 25-5 overview 25-1, 25-5 status, displaying 25-17 system contact and location 25-15 trap manager, configuring 25-14 traps described 25-3, 25-5 differences from informs 25-5 enabling 25-12 enabling MAC address notification 7-24 overview 25-1, 25-5 types of 25-12 users 25-7, 25-9 versions supported 25-2 SNMPv1 25-2 SNMPv2C 25-2 SNMPv3 25-2 snooping, IGMP 18-2 software compatibility See stacks, switch software images location in Flash B-21 recovery procedures 34-2 scheduling reloads 4-17 tar file format, described B-22 See also downloading and uploading source addresses, in ACLs 26-11 source-and-destination-IP address based forwarding, EtherChannel 28-8 source-and-destination MAC address forwarding, EtherChannel 28-8 source-IP address based forwarding, EtherChannel 28-8 source-MAC address forwarding, EtherChannel 28-8Index IN-36 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 SPAN and stack changes 22-10 configuration guidelines 22-11 default configuration 22-11 destination ports 22-8 displaying status 22-24 interaction with other features 22-9 monitored ports 22-6 monitoring ports 22-8 overview 1-8, 22-1 received traffic 22-5 session limits 22-11 sessions configuring ingress forwarding 22-15, 22-22 creating 22-12 defined 22-4 limiting source traffic to specific VLANs 22-16 removing destination (monitoring) ports 22-13 specifying monitored ports 22-12 with ingress traffic enabled 22-14 source ports 22-6 transmitted traffic 22-6 VLAN-based 22-7 spanning tree and native VLANs 12-19 Spanning Tree Protocol See STP SPAN traffic 22-5 speed, configuring on interfaces 11-13 split horizon IGRP 29-29 RIP 29-23 SRR configuring shaped weights on egress queues 27-61 shared weights on egress queues 27-62 shared weights on ingress queues 27-55 SRR (continued) described 27-12 shaped mode 27-12 shared mode 27-12 support for 1-7 SSH 1-4 configuring 9-38 cryptographic software image 9-38 described 9-38 displaying settings 9-38 switch stack considerations 5-11, 9-38 stack changes, effects on 802.1X port-based authentication 10-10 ACL configuration 26-6 CDP 20-2 cross-stack EtherChannel 28-12 EtherChannel 28-9 fallback bridging 33-3 HSRP 30-2 IGMP snooping 18-5 IP routing 29-3 MAC address tables 7-23 MSTP 16-6 multicast routing 31-8 MVR 18-12 port security 19-14 SDM template selection 8-2 SNMP 25-1 SPAN and RSPAN 22-10 STP 15-12 switch clusters 6-15 system message log 24-2 VLANs 12-6 VTP 13-6Index IN-37 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 stack master bridge ID (MAC address) 5-6 defined 5-1 election 5-5 re-election 5-5 See also stacks, switch stack member accessing CLI of specific member 5-16 configuring member number 5-15 priority value 5-16 defined 5-1 displaying information of 5-16 hot-swappable 5-10 number 5-6 priority value 5-7 See also stacks, switch stack member number 11-7 stack protocol version 5-8 stacks, switch accessing CLI of specific member 5-16 assigning information member number 5-15 priority value 5-16 benefits 1-2 bridge ID 5-6 CDP considerations 20-2 compatibility, software 5-7 configuration file 5-9 configuration scenarios 5-12 default configuration 5-15 default settings 5-15 description of 5-1 displaying information of 5-16 hot-swappable 5-10 HSRP considerations 30-2 in clusters 6-15 MAC address considerations 7-23 management connectivity 5-11 stacks, switch (continued) managing 5-1 membership 5-3 merged 5-3 MSTP instances supported 15-10 multicast routing, stack master and member roles 31-8 partitioned 5-3, 34-8 See also stack master and stack member software compatibility 5-7 software image version 5-8 stack protocol version 5-8 STP bridge ID 15-3 instances supported 15-10 root port selection 15-3 stack root switch election 15-3 system messages hostnames in the display 24-1 remotely monitoring 24-2 system prompt consideration 7-16 system-wide configuration considerations 5-10 upgrading B-35 StackWise technology, Cisco 1-2 See also stacks, switch Standby Command Configuration window 6-22 standby command switch configuring 6-21 considerations 6-12 defined 6-2 priority 6-11 requirements 6-3 virtual IP address 6-12 See also cluster standby group and HSRP standby group, cluster See cluster standby group and HSRP standby ip command 30-5 standby router 30-1 standby timers, HSRP 30-8Index IN-38 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 startup configuration booting manually 4-13 specific image 4-14 clearing B-20 configuration file automatically downloading 4-12 specifying the filename 4-13 default boot configuration 4-12 static access mode 3-10 static access ports assigning to VLAN 12-11 defined 11-3, 12-3 static addresses See addresses static IP routing 1-8 static MAC addressing 1-6 static routes, configuring 29-68 static routing 29-2 static VLAN membership 12-2 statistics 802.1X 10-20 CDP 20-5 interface 11-21 IP multicast routing 31-51 OSPF 29-38 QoS ingress and egress 27-64 RMON group Ethernet 23-6 RMON group history 23-5 SNMP input and output 25-17 VTP 13-16 status bar change notification 3-31 error notification 3-31 sticky learning 19-8 storm control configuring 19-3 described 19-1 displaying 19-15 support for 1-3 thresholds 19-1 STP 802.1D and bridge ID 15-4 802.1D and multicast addresses 15-9 802.1T and VLAN identifier 15-4 accelerating root port selection 17-4 BackboneFast described 17-8 enabling 17-17 BPDU filtering described 17-3 enabling 17-15 BPDU guard described 17-3 enabling 17-14 BPDU message exchange 15-3 configuration guidelines 15-14, 17-12 configuring forward-delay time 15-23 hello time 15-22 maximum aging time 15-23 path cost 15-20 port priority 15-19 root switch 15-16 secondary root switch 15-18 spanning-tree mode 15-15 switch priority 15-21 counters, clearing 15-24Index IN-39 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 STP (continued) cross-stack UplinkFast described 17-5 enabling 17-17 default configuration 15-13 default optional feature configuration 17-12 designated port, defined 15-4 designated switch, defined 15-4 detecting indirect link failures 17-8 disabling 15-16 displaying status 15-24 extended system ID effects on root switch 15-16 effects on the secondary root switch 15-18 overview 15-4 unexpected behavior 15-16 features supported 1-5 inferior BPDU 15-3 instances supported 15-10 interface state, blocking to forwarding 17-2 interface states blocking 15-6 disabled 15-7 forwarding 15-6, 15-7 learning 15-7 listening 15-7 overview 15-5 interoperability and compatibility among modes 15-11 limitations with 802.1Q trunks 15-11 load sharing overview 12-24 using path costs 12-26 using port priorities 12-24 loop guard described 17-11 enabling 17-18 modes supported 15-10 multicast addresses, effect of 15-9 STP (continued) optional features supported 1-5 overview 15-2 path costs 12-26, 12-27 Port Fast described 17-2 enabling 17-13 port priorities 12-25 preventing root switch selection 17-10 protocols supported 15-10 redundant connectivity 15-8 root guard described 17-10 enabling 17-18 root port, defined 15-3 root port selection on a switch stack 15-3 root switch configuring 15-16 effects of extended system ID 15-4, 15-16 election 15-3 unexpected behavior 15-16 shutdown Port Fast-enabled port 17-3 stack changes, effects of 15-12 status, displaying 15-24 superior BPDU 15-3 timers, described 15-22 UplinkFast described 17-4 enabling 17-16 VLAN-bridge 15-12 stratum, NTP 7-2 stub areas, OSPF 29-34 subnet mask 29-6 subnet zero 29-7 success response, VMPS 12-28 summer time 7-14 SunNet Manager 1-4 supernet 29-7Index IN-40 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 SVIs and IP unicast routing 29-4 and router ACLs 26-3 connecting VLANs 11-5 defined 11-4 routing between VLANs 12-2 switch clustering technology 6-1 See also clusters, switch 1-3 See clusters, switch switch console port 1-4 Switch Database Management See SDM switched packets, ACLs on 26-37 Switched Port Analyzer See SPAN switched ports 11-2 Switch Manager 3-33 switchport block multicast command 19-6 switchport block unicast command 19-6 switchport command 11-12 switchport protected command 19-5 switch priority MSTP 16-20 STP 15-21 switch software features 1-1 switch virtual interface See SVI synchronization, BGP 29-49 syslog See system message logging system clock configuring daylight saving time 7-14 manually 7-12 summer time 7-14 time zones 7-13 displaying the time and date 7-12 overview 7-2 See also NTP system message logging default configuration 24-4 defining error message severity levels 24-9 disabling 24-4 displaying the configuration 24-13 enabling 24-5 facility keywords, described 24-13 level keywords, described 24-10 limiting messages 24-10 message format 24-2 overview 24-1 sequence numbers, enabling and disabling 24-8 setting the display destination device 24-5 stack changes, effects of 24-2 synchronizing log messages 24-6 syslog facility 1-8 timestamps, enabling and disabling 24-8 UNIX syslog servers configuring the daemon 24-11 configuring the logging facility 24-12 facilities supported 24-13 system messages on CMS 3-19 system name default configuration 7-16 default setting 7-16 manual configuration 7-16 See also DNS system prompt default setting 7-16 manual configuration 7-17 system resources, optimizing 8-1 system routes, IGRP 29-25 T tables, CMS 3-29 tabs, CMS 3-29Index IN-41 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 TAC toll-free telephone numbers xxxvii website xxxvi TACACS+ accounting, defined 9-11 authentication, defined 9-11 authorization, defined 9-11 configuring accounting 9-17 authentication key 9-13 authorization 9-16 login authentication 9-14 default configuration 9-13 displaying the configuration 9-17 identifying the server 9-13 in clusters 6-17 limiting the services to the user 9-16 operation of 9-12 overview 9-10 support for 1-6 tracking services accessed by user 9-17 tar files creating B-6 displaying the contents of B-7 extracting B-8 image file format B-22 technical assistance case priority definitions xxxvii opening a case xxxvii TAC website xxxvi toll-free telephone numbers xxxvii Telnet accessing management interfaces 2-10 from a browser 2-11 number of connections 1-4 setting a password 9-6 templates, SDM 8-1 Terminal Access Controller Access Control System Plus See TACACS+ terminal lines, setting a password 9-6 TFTP configuration files downloading B-12 preparing the server B-11 uploading B-12 configuration files in base directory 4-6 configuring for autoconfiguration 4-5 image files deleting B-25 downloading B-24 preparing the server B-23 uploading B-25 limiting access by servers 25-15 TFTP server 1-4 threshold, traffic level 19-2 time See NTP and system clock time-range command 26-16 time ranges in ACLs 26-16 timestamps in log messages 24-8 time zones 7-13 Token Ring VLANs support for 12-5 VTP support 13-4 toolbar 3-20 tool tips 3-26 Topology view collapsed cluster view 3-12 described 3-4, 3-11 device icons 3-15 device information 3-14 display options 3-16 expanded cluster view 3-11 expanded stack view 3-13 icons 3-14 link information 3-14Index IN-42 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 Topology view (continued) multiple links 3-23 neighboring devices 3-14 pop-up menus 3-22 TOS 1-7 traceroute, Layer 2 and ARP 34-16 and CDP 34-16 described 34-15 IP addresses and subnets 34-16 MAC addresses and VLANs 34-16 multicast traffic 34-16 multiple devices on a port 34-16 supported switches 34-15 unicast traffic 34-15 usage guidelines 34-16 traffic blocking flooded 19-6 fragmented 26-5 unfragmented 26-5 traffic policing 1-7 traffic suppression 19-1 transparent mode, VTP 13-3, 13-12 trap-door mechanism 4-2 traps configuring MAC address notification 7-24 configuring managers 25-12 defined 25-3 enabling 7-24, 25-12 notification types 25-12 overview 25-1, 25-5 troubleshooting connectivity problems 34-13, 34-15 detecting unidirectional links 21-1 determining packet forwarding 34-19 displaying crash information 34-21 PIMv1 and PIMv2 interoperability problems 31-23 SFP security and identification 34-13 show forward command 34-19 troubleshooting (continued) with CiscoWorks 25-5 with debug commands 34-17 with ping 34-13 with system message logging 24-1 trunking encapsulation 1-6 trunk ports configuring 12-20 defined 11-3, 12-3 encapsulation 12-20, 12-25, 12-27 secure MAC addresses on 19-10 trunks allowed-VLAN list 12-21 configuring 12-20, 12-25, 12-27 ISL 12-16 load sharing setting STP path costs 12-26 using STP port priorities 12-24, 12-25 native VLAN for untagged traffic 12-23 parallel 12-26 pruning-eligible list 12-23 to non-DTP device 12-17 understanding 12-17 trusted boundary for QoS 27-34 trusted port states between QoS domains 27-35 classification options 27-5 ensuring port security for IP phones 27-34 support for 1-7 within a QoS domain 27-31 twisted-pair Ethernet, detecting unidirectional links 21-1 type-of-service See TOS U UDLD default configuration 21-3 echoing detection mechanism 21-2Index IN-43 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 UDLD (continued) enabling globally 21-4 per interface 21-4 link-detection mechanism 21-1 neighbor database 21-2 overview 21-1 resetting an interface 21-5 status, displaying 21-5 support for 1-5 UDP, configuring 29-16 unauthorized ports with 802.1X 10-4 unequal-cost load balancing, IGRP 29-26 unicast storm control command 19-3 unicast storms 19-1 unicast traffic, blocking 19-6 UniDirectional Link Detection protocol See UDLD UNIX syslog servers daemon configuration 24-11 facilities supported 24-13 message logging configuration 24-12 unrecognized Type-Length-Value (TLV) support 13-4 upgrading software images See downloading UplinkFast described 17-4 enabling 17-16 support for 1-5 uploading configuration files preparing B-11, B-14, B-17 reasons for B-9 using FTP B-16 using RCP B-19 using TFTP B-12 uploading (continued) image files preparing B-23, B-26, B-30 reasons for B-21 using FTP B-29 using RCP B-34 using TFTP B-25 User Datagram Protocol See UDP user EXEC mode 2-2 username-based authentication 9-7 V verifying changes in CMS 3-31 version-dependent transparent mode 13-4 version mismatch (VM) mode 5-9 virtual IP address cluster standby group 6-12, 6-21 command switch 6-12, 6-21 See also IP addresses virtual router 30-1, 30-2 vlan.dat file 12-4 VLAN 1, disabling on a trunk port 12-22 VLAN 1 minimization 12-21 VLAN ACLs See VLAN maps vlan-assignment response, VMPS 12-28 VLAN configuration at bootup 12-7 saving 12-7 VLAN configuration mode 2-2, 12-7 VLAN database and startup configuration file 12-7 and VTP 13-1 VLAN configuration saved in 12-7 VLANs saved in 12-4Index IN-44 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 vlan database command 12-7 VLAN filtering, and SPAN 22-7 vlan global configuration command 12-7 VLAN ID, discovering 7-28 VLAN management domain 13-2 VLAN Management Policy Server See VMPS VLAN map entries, order of 26-29 VLAN maps applying 26-33 common uses for 26-33 configuration example 26-34 configuration guidelines 26-29 configuring 26-29 creating 26-30 defined 26-2 denying access example 26-35 denying and permitting packets 26-31 displaying 26-41 examples 26-35 support for 1-6 with router ACLs 26-41 VLAN membership confirming 12-32 modes 3-10, 12-3 VLAN Query Protocol See VQP VLANs adding 12-8 adding to VLAN database 12-8 aging dynamic addresses 15-9 allowed on trunk 12-21 and spanning-tree instances 12-3, 12-13 configuration guidelines, extended-range VLANs 12-13 configuration guidelines, normal-range VLANs 12-6 configuration options 12-6 configuring 12-1 configuring IDs 1006 to 4094 12-13 connecting through SVIs 11-5 VLANs (continued) creating in config-vlan mode 12-9 creating in VLAN configuration mode 12-10 default configuration 12-8 deleting 12-10 described 11-2, 12-1 displaying 12-16 extended-range 12-1, 12-12 features 1-5 illustrated 12-2 internal 12-13 in the switch stack 12-6 limiting source traffic with RSPAN 22-23 limiting source traffic with SPAN 22-16 modifying 12-8 native, configuring 12-23 normal-range 12-1, 12-4 number supported 1-5 parameters 12-5 port membership modes 3-10, 12-3 static-access ports 12-11 STP and 802.1Q trunks 15-11 supported 12-3 Token Ring 12-5 traffic between 12-2 VLAN-bridge STP 15-12, 33-2 VTP modes 13-3 VLAN Trunking Protocol See VTP VLAN trunks 12-16, 12-17 VMPS administering 12-33 configuration example 12-34 configuration guidelines 12-30 default configuration 12-29 description 12-28Index IN-45 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 VMPS (continued) dynamic port membership described 12-29 reconfirming 12-32 troubleshooting 12-33 entering server address 12-30 mapping MAC addresses to VLANs 12-28 monitoring 12-33 reconfirmation interval, changing 12-32 reconfirming membership 12-32 retry count, changing 12-32 voice-over-IP 14-1 voice VLAN Cisco 7960 phone, port connections 14-1 configuration guidelines 8-4, 14-3 configuring IP phones for data traffic override CoS of incoming frame 14-5 trust CoS priority of incoming frame 14-5 configuring ports for voice traffic in 802.1P priority tagged frames 14-5 802.1Q frames 14-4 connecting to an IP phone 14-4 default configuration 14-3 described 14-1 displaying 14-6 VQP 1-5, 12-28 VTP adding a client to a domain 13-15 advertisements 12-19, 13-3 and extended-range VLANs 13-2 and normal-range VLANs 13-2 client mode, configuring 13-11 configuration global configuration mode 13-7 guidelines 13-8 privileged EXEC mode 13-7 requirements 13-9 saving 13-7 VLAN configuration mode 13-8 VTP (continued) configuration mode options 13-7 configuration requirements 13-9 configuration revision number guideline 13-15 resetting 13-15 configuring client mode 13-11 server mode 13-9 transparent mode 13-12 consistency checks 13-4 default configuration 13-7 described 13-1 disabling 13-12 domain names 13-8 domains 13-2 modes client 13-3, 13-11 server 13-3, 13-9 transitions 13-3 transparent 13-3, 13-12 monitoring 13-16 passwords 13-8 pruning disabling 13-14 enabling 13-14 examples 13-5 overview 13-4 support for 1-6 pruning-eligible list, changing 12-23 server mode, configuring 13-9 statistics 13-16 support for 1-6 Token Ring support 13-4 transparent mode, configuring 13-12 using 13-1 version, guidelines 13-9 version 1 13-4Index IN-46 Catalyst 3750 Switch Software Configuration Guide 78-15164-02 VTP (continued) version 2 configuration guidelines 13-9 disabling 13-13 enabling 13-13 overview 13-4 W web-based management software See CMS weighted tail drop See WTD window components, CMS 3-28 wizards 1-2, 3-26 WTD described 27-11 setting thresholds egress queue-sets 27-57 ingress queues 27-53 support for 1-7 X XMODEM protocol 34-2 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Catalyst 3750 Switch System Message Guide Cisco IOS Release 12.1(14)EA1 July 2003 Customer Order Number: DOC-7815166= Text Part Number: 78-15166-02THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Catalyst 3750 Switch System Message Guide Copyright © 2003 Cisco Systems, Inc. All rights reserved. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)iii Catalyst 3750 Switch System Message Guide 78-15166-02 C O N T E N T S Preface v Audience v Purpose v Conventions v Related Publications vi Obtaining Documentation vi Cisco.com vi Documentation CD-ROM vii Ordering Documentation vii Documentation Feedback vii Obtaining Technical Assistance viii Cisco.com viii Technical Assistance Center viii Cisco TAC Website ix Cisco TAC Escalation Center ix Obtaining Additional Publications and Information ix C H A P T E R 1 System Message Overview 1-1 How to Read System Messages 1-1 Error Message Traceback Reports 1-4 C H A P T E R 2 Message and Recovery Procedures 2-1 ACLMGR Messages 2-2 CFGMGR Messages 2-5 CMP Messages 2-7 DTP Messages 2-8 EC Messages 2-9 ETHCNTR Messages 2-13 EXPRESS_SETUP Messages 2-14 GBIC (SFP) Security Messages 2-14 HARDWARE Messages 2-16 HLFM Messages 2-17 IMAGEMGR Messages 2-18Contents iv Catalyst 3750 Switch System Message Guide 78-15166-02 PLATFORM Messages 2-19 PLATFORM _IPC Messages 2-20 PLATFORM_PBR Messages 2-21 PLATFORM_PM Messages 2-23 PLATFORM_RPC Messages 2-23 PLATFORM_SPAN Messages 2-25 PLATFORM_UCAST Messages 2-26 PLATFORM_VLAN Messages 2-27 PM Messages 2-28 QOSMGR Messages 2-35 SDM Messages 2-39 SFP Messages 2-40 SPAN Messages 2-40 SPANTREE Messages 2-40 SPANTREE_FAST Messages 2-46 SPANTREE_VLAN_SWITCH Messages 2-47 STACKMGR Messages 2-47 SUPERVISOR Messages 2-49 SUPQ Messages 2-49 SW_VLAN Messages 2-51 TCAMMGR Messages 2-55 UDLD Messages 2-57 UFAST_MCAST_SW Messages 2-58 VQPCLIENT Messages 2-59 IN D E Xv Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Audience This guide is for the networking professional managing the Catalyst 3750 switch or switch stack, hereafter referred to as the switch. Before using this guide, you should have experience working with the Cisco IOS and the switch software features. Purpose This guide describes only the Catalyst 3750-specific system messages that you might encounter. For a complete list of Cisco IOS system error messages, refer to the Cisco IOS Software System Error Messages, Cisco IOS Release 12.1. This guide does not describe how to install your switch or how to configure software features on your switch. It also does not provide detailed information about commands that have been created or changed for use by the switch. For hardware installation information, refer to the hardware installation guide that shipped with your switch. For software information, refer to the software configuration guide and the command reference for this release. Conventions This publication uses these conventions to convey instructions and information: Command descriptions use these conventions: • Commands and keywords are in boldface text. • Arguments for which you supply values are in italic. • Square brackets ([ ]) mean optional elements. • Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements. • Braces and vertical bars within square brackets ([{ | }]) mean a required choice within an optional element.vi Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Related Publications Interactive examples use these conventions: • Terminal sessions and system displays are in screen font. • Information you enter is in boldface screen font. • Nonprinting characters, such as passwords or tabs, are in angle brackets (< >). Notes use this convention and symbol: Note Means reader take note. Notes contain helpful suggestions or references to materials not in this manual. Related Publications These documents provide complete information about the switch and are available from this Cisco.com site: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/index.htm You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the “Obtaining Documentation” section on page vi. • Release Notes for the Catalyst 3750 Switch (not orderable but available on Cisco.com) • Catalyst 3750 Switch Software Configuration Guide (order number DOC-7815164=) • Catalyst 3750 Switch Command Reference (order number DOC-7815165=) • Catalyst 3750 Switch System Message Guide (order number DOC-7815166=) • Cluster Management Suite (CMS) online help (available only from the switch CMS software) • Catalyst 3750 Switch Hardware Installation Guide (order number DOC-7815136=) • Cisco Small Form-Factor Pluggable Modules Installation Notes (not orderable but available on Cisco.com) Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL: http://www.cisco.com International Cisco websites can be accessed from this URL: http://www.cisco.com/public/countries_languages.shtmlvii Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Obtaining Documentation Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription. Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html All users can order monthly or quarterly subscriptions through the online Subscription Store: http://www.cisco.com/go/subscription Ordering Documentation You can find instructions for ordering documentation at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways: • Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace: http://www.cisco.com/en/US/partner/ordering/index.shtml • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387). Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can e-mail your comments to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments.viii Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Obtaining Technical Assistance Obtaining Technical Assistance Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities. Cisco.com Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. Cisco.com provides a broad range of features and services to help you with these tasks: • Streamline business processes and improve productivity • Resolve technical issues with online support • Download and test software packages • Order Cisco learning materials and merchandise • Register for online skill assessment, training, and certification programs To obtain customized information and service, you can self-register on Cisco.com at this URL: http://tools.cisco.com/RPF/register/register.do Technical Assistance Center The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two types of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The type of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable. We categorize Cisco TAC inquiries according to urgency: • Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration. There is little or no impact to your business operations. • Priority level 3 (P3)—Operational performance of the network is impaired, but most business operations remain functional. You and Cisco are willing to commit resources during normal business hours to restore service to satisfactory levels. • Priority level 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively impacted by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. • Priority level 1 (P1)—An existing network is “down,” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.ix Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Obtaining Additional Publications and Information Cisco TAC Website The Cisco TAC website provides online documents and tools to help troubleshoot and resolve technical issues with Cisco products and technologies. To access the Cisco TAC website, go to this URL: http://www.cisco.com/tac All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register: http://tools.cisco.com/RPF/register/register.do If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL: http://www.cisco.com/tac/caseopen If you have Internet access, we recommend that you open P3 and P4 cases online so that you can fully describe the situation and attach any necessary files. Cisco TAC Escalation Center The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case. To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml Before calling, please check with your network operations center to determine the Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number. Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. • The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: http://www.cisco.com/en/US/products/products_catalog_links_launch.html • Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: http://www.ciscopress.comx Catalyst 3750 Switch System Message Guide 78-15166-02 Preface Obtaining Additional Publications and Information • Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL: http://www.cisco.com/go/packet • iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL: http://www.cisco.com/go/iqmagazine • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html • Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL: http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.htmlC H A P T E R 1-1 Catalyst 3750 Switch System Message Guide 78-15166-02 1 System Message Overview This guide describes the Catalyst 3750-specific system messages. During operation, the system software sends these messages to the console (and, optionally, to a logging server on another system). Not all system messages indicate problems with your system. Some messages are purely informational, whereas others can help diagnose problems with communications lines, internal hardware, or the system software. This guide also includes error messages that appear when the system fails. Note For information about system messages that are not Catalyst 3750 platform-specific, refer to the Cisco IOS Software System Messages for Cisco IOS Release 12.1. This chapter contains these sections: • How to Read System Messages, page 1-1 • Error Message Traceback Reports, page 1-4 How to Read System Messages System log messages can contain up to 80 characters and a percent sign (%), which follows the optional sequence number or timestamp information, if configured. Messages are displayed in this format: seq no:timestamp: %facility-severity-MNEMONIC:description (hostname-n) By default, a switch sends the output from system messages to a logging process. In a switch stack, stack members append their hostnames to the output from system messages and redirect the output to the logging process on the stack master. Each system message begins with a percent sign (%) and is structured as follows: %FACILITY-SEVERITY-MNEMONIC: Message-text • FACILITY is a code consisting of two or more uppercase letters that show the facility to which the message refers. A facility can be a hardware device, a protocol, or a module of the system software. Table 1-1 lists Catalyst 3750-specific facility codes. These messages are described in Chapter 2, “Message and Recovery Procedures,” in alphabetical order by facility code with the most severe (lowest number) errors described first.1-2 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 1 System Message Overview How to Read System Messages Table 1-1 Facility Codes Facility Code Description Location ACLMGRR ACL Manager “ACLMGR Messages” section on page 2-2 CFGMGE Configuration Manager “CFGMGR Messages” section on page 2-5 CMP Cluster Membership Protocol “CMP Messages” section on page 2-7 DTP Dynamic Trunking Protocol “DTP Messages” section on page 2-8 EC EtherChannel “EC Messages” section on page 2-9 ETHCNTR Ethernet Controller “ETHCNTR Messages” section on page 2-13 EXPRESS_SETUP Express Setup “EXPRESS_SETUP Messages” section on page 2-14 GBIC_SECURITY GBIC (SFP) module security Note These errors refer to small-form factor pluggable (SFP) modules. “GBIC (SFP) Security Messages” section on page 2-14 HARDWARE Hardware “HARDWARE Messages” section on page 2-16 HLFM HULC Local Forwarding Manage “HLFM Messages” section on page 2-17 IMAGMGR Image Manager “IMAGEMGR Messages” section on page 2-18 PLATFORM Low-level platform-specific “PLATFORM Messages” section on page 2-19 PLATFORM_IPC Platform Inter-Process Communication (IPC) protocol “PLATFORM _IPC Messages” section on page 2-20 PLATFORM_PBR Policy based routing “PLATFORM_PBR Messages” section on page 2-21 PLATFORM_PM Potr manager “PLATFORM_PM Messages” section on page 2-23 PLATFORM_RPC Platform remote procedure call (RPC) “PLATFORM_RPC Messages” section on page 2-23 PLATFORM_SPAN Platform Switched Port Analyzer (SPAN) “PLATFORM_SPAN Messages” section on page 2-25 PLATFORM_UCAST Unicast routing “PLATFORM_UCAST Messages” section on page 2-26 PLATFORM_VLAN VLAN “PLATFORM_VLAN Messages” section on page 2-27 PM Port manager “PM Messages” section on page 2-28 QOSMGR QoS manager “QOSMGR Messages” section on page 2-341-3 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 1 System Message Overview How to Read System Messages • SEVERITY is a single-digit code from 0 to 7 that reflects the severity of the condition. The lower the number, the more serious the situation. Table 1- 2 lists the message severity levels. SDM Switch database manager “SDM Messages” section on page 2-39 SFP Small form-factor pluggable (SPF) identification “SFP Messages” section on page 2-39 SPAN Switch Port Analyzer (SPAN) “SPAN Messages” section on page 2-39 SPANTREE Spanning tree “SPANTREE Messages” section on page 2-40 SPANTREE_FAST Spanning-tree fast convergence “SPANTREE_FAST Messages” section on page 2-45 SPANTREE_VLAN_SW Spanning-tree VLAN switch “SPANTREE_VLAN_SWITCH Messages” section on page 2-46 STACKMGR Stack manager “STACKMGR Messages” section on page 2-46 SUPERVISOR_ASIC Supervisor ASIC) “SUPERVISOR Messages” section on page 2-48 SUPQ Supervisor queue “SUPQ Messages” section on page 2-48 SW_VLAN VLAN manager “SW_VLAN Messages” section on page 2-50 TCAMMGR Ternary content addressable memory manager “TCAMMGR Messages” section on page 2-54 UDLD UniDirectional Link Detection (UDLD) “UDLD Messages” section on page 2-56 UFAST_MCAST Uplink fast packet transmission “UFAST_MCAST_SW Messages” section on page 2-57 VQPCLIENT VLAN Query Protocol (VQP) client “VQPCLIENT Messages” section on page 2-58 Table 1-1 Facility Codes (continued) Facility Code Description Location Table 1-2 Message Severity Levels Severity Level Description 0 – emergency System is unusable. 1 – alert Immediate action required. 2 – critical Critical condition. 3 – error Error condition. 4 – warning Warning condition. 5 – notification Normal but significant condition. 6 – informational Informational message only. 7 – debugging Message that appears during debugging only.1-4 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 1 System Message Overview Error Message Traceback Reports • MNEMONIC is a code that uniquely identifies the message. • Message-text is a text string describing the condition. This portion of the message sometimes contains detailed information about the event, including terminal port numbers, network addresses, or addresses that correspond to locations in the system memory address space. Because the information in these variable fields changes from message to message, it is represented here by short strings enclosed in square brackets ([ ]). A decimal number, for example, is represented as [dec]. Table 1-3 lists the variable fields in messages. All syslog messages generated by a switch other than the master switch are displayed ending with (Switch-x) where Switch-x is the number of the stack member generating the message. Syslog messages generated by the master switch are displayed with no hostname string. This example shows a partial switch system message for a stack master and a stack member switch (hostname Switch-2): 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to up 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down 2 *Mar 1 18:46:11: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) 18:47:02: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) *Mar 1 18:48:50.483 UTC: %SYS-5-CONFIG_I: Configured from console by vty2 (10.34.195.36) 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up (Switch-2) 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/1, changed state to up (Switch-2) 00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/2, changed state to up (Switch-2) 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down (Switch-2) 00:00:48: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/1, changed state to down 2 (Switch-2) Error Message Traceback Reports Some messages describe internal errors and contain traceback information. This information is very important and should be included when you report a problem to your technical support representative. This sample message includes traceback information: -Process= "Exec", level= 0, pid= 17 -Traceback= 1A82 1AB4 6378 A072 1054 1860 Table 1-3 Representation of Variable Fields in Messages Representation Type of Information [dec] Decimal integer [char] Single character [chars] Character string [enet] Ethernet address (for example, 0000.FEED.00C0) [hex] Hexadecimal integer [inet] Internet addressC H A P T E R 2-1 Catalyst 3750 Switch System Message Guide 78-15166-02 2 Message and Recovery Procedures This chapter describes the Catalyst 3750-specific system messages in alphabetical order by facility. Within each facility, the messages are listed by severity levels 0 to 7: 0 is the highest severity level, and 7 is the lowest severity level. Each message is followed by an explanation and a recommended action. Note The messages listed in this chapter do not include the hostname or the date/time stamp designation that displays only if the software is configured for system log messaging. The chapter includes these message facilities: • ACLMGR Messages, page 2-2 • CFGMGR Messages, page 2-5 • CMP Messages, page 2-7 • DTP Messages, page 2-8 • EC Messages, page 2-9 • ETHCNTR Messages, page 2-13 • EXPRESS_SETUP Messages, page 2-14 • GBIC (SFP) Security Messages, page 2-14 • HARDWARE Messages, page 2-16 • HLFM Messages, page 2-17 • IMAGEMGR Messages, page 2-18 • PLATFORM Messages, page 2-19 • PLATFORM _IPC Messages, page 2-20 • PLATFORM_PBR Messages, page 2-21 • PLATFORM_PM Messages, page 2-23 • PLATFORM_RPC Messages, page 2-23 • PLATFORM_SPAN Messages, page 2-25 • PLATFORM_UCAST Messages, page 2-26 • PLATFORM_VLAN Messages, page 2-27 • PM Messages, page 2-28 • QOSMGR Messages, page 2-342-2 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures ACLMGR Messages • SDM Messages, page 2-39 • SFP Messages, page 2-39 • SPAN Messages, page 2-39 • SPANTREE Messages, page 2-40 • SPANTREE_FAST Messages, page 2-45 • SPANTREE_VLAN_SWITCH Messages, page 2-46 • STACKMGR Messages, page 2-46 • SUPERVISOR Messages, page 2-48 • SUPQ Messages, page 2-48 • SW_VLAN Messages, page 2-50 • TCAMMGR Messages, page 2-54 • UDLD Messages, page 2-56 • UFAST_MCAST_SW Messages, page 2-57 • VQPCLIENT Messages, page 2-58 ACLMGR Messages This section contains the access control list (ACL) manager messages. Most messages in this section are the result of a switch memory shortage, which includes hardware memory and label space but not CPU memory. Both kinds of memory shortages are described. Error Message ACLMGR-2-NOMAP: Cannot create ACL Manager data structures for VLAN Map [chars] Explanation This message means that the ACL manager was unable to allocate the data structures needed to describe a VLAN map in a form that can be loaded into hardware. This error is most likely caused by lack of free memory. [chars] is the VLAN map name. Recommended Action Reduce other system activity to ease memory demands. Error Message ACLMGR-2-NOVLB: Cannot create memory block for VLAN [dec] Explanation This message means that the ACL manager was unable to save per-VLAN information needed for its correct operation. Some per-interface features, such as access groups or VLAN maps, will not be configured correctly. [dec] is the VLAN number. Recommended Action Use a less complicated configuration that requires less memory. 2-3 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures ACLMGR Messages Error Message ACLMGR-2-NOVMR: Cannot create VMR data structures for access list [chars] Explanation This message means that the ACL Manager was unable to allocate the value-mask result (VMR) data structures needed to describe an ACL in a form that can be loaded into hardware. This error is most likely caused by lack of available memory. [chars] is the access-list name. Recommended Action Use a less complicated configuration that requires less memory. Error Message ACLMGR-3-ACLTCAMFULL: Acl Tcam Full. Drop packets on Output Acl label [dec] on [chars] [chars] Explanation This message means that there are too many ACLs configured for the platform-specific ACL TCAM table to support. [dec] is the label number, and [chars] represents the layer. The first [chars] is for Layer 3; the second for Layer 2. If only one layer of TCAM is full, only one string is displayed, and the other string is NULL. Recommended Action Reduce the number of IP or MAC access lists to be applied to interfaces. Error Message ACLMGR-3-AUGMENTFAIL: Augmenting of access-map [chars] on [chars] label [dec] failed Explanation This message means that the system ran out of CPU DRAM when attempting to merge internally required elements with the configured access maps. The first [chars] is the access-map name, the second [chars] is the direction in which the map was applied (input or output), and [dec] is the label number. Recommended Action Reduce other system activity to ease memory demands. Error Message ACLMGR-3-INSERTFAIL: Insert of access-map [chars] #[dec] into [chars] label [dec] failed Explanation This message means that the system ran out of CPU memory when trying to merge sections of an access map. The first [chars] is the map name, and the second [chars] is the direction in which the map was applied. The first [dec] is the entry number, and the second [dec] is the label number. Recommended Action Reduce other system activity to ease memory demands. For example, remove any ACLs that have been defined but are not now used. Use simpler ACLs with fewer access control entries (ACEs). Use fewer VLANs, and remove any unneeded VLANs from the VLAN database. Error Message ACLMGR-3-MAXRECURSION: Too many ([dec]) levels of recursion while merging ACLs (code [dec]). Explanation This message means that the configuration is too complicated for the platform-specific ACL merge code to support. The most likely cause is too many separate access lists in a single VLAN map or policy map. The first [dec] is the number of levels of recursion. The second [dec] is an internal code number of the merge stage that encountered the problem. Recommended Action Reduce the number of IP or MAC access lists (considered separately) in any one VLAN or policy map to fewer than the number of levels reported by this log message. 2-4 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures ACLMGR Messages Error Message ACLMGR-3-MERGEFAIL: [chars] ACL merge error [dec] ([chars]) on [chars] label [dec] Explanation This message means that the ACL manager was unable to complete the merge of the configured features into a form suitable for loading into the hardware. Packets potentially affected by this feature will be sent to the CPU for processing instead. The most likely cause is specifying an ACL that is too large or too complex for the system. The first [chars] is the ACL-type error (ip or mac), the first [dec] is the error code, the second [chars] is the message string for the preceding error code, the second [dec] is the label number, and the third [chars] is either input or output. Recommended Action Specify a smaller and less complicated configuration. Error Message ACLMGR-3-NOLABEL: Cannot allocate [chars] label for interface [chars] Explanation This message means that the ACL manager was unable to allocate a label for the features on this interface. This means that the hardware cannot be programmed to implement the features, and packets for this interface will be filtered in software. There is a limit of 256 labels per direction. The first [chars] is the direction (input or output); the second [chars] is the interface name. Recommended Action Use a simpler configuration. Use the same ACLs on multiple interfaces, if possible. Error Message ACLMGR-2-NOMAP: Cannot create ACL Manager data structures for VLAN Map [chars] Explanation This message means that the ACL manager could not allocate the data structures needed to describe a VLAN Map in a form that can be loaded into hardware. The likely cause is lack of free memory. Recommended Action Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration. Error Message ACLMGR-2-NOVLB: Cannot create memory block for VLAN [dec] Explanation This message means that the ACL manager was unable to save per-VLAN information needed for its correct operation. This can result in incorrect configuration of per-interface features, such as access groups or VLAN maps. [dec] is the VLAN ID. Recommended Action Use a less complicated configuration that requires less memory. Error Message ACLMGR-2-NOVMR: Cannot create VMR data structures for access list [chars] Explanation This message means that the ACL manager could not allocate the data structures needed to describe an ACL in a form that can be loaded into hardware. The likely cause is lack of free memory. [chars] is the access-list name. Recommended Action Use a less complicated configuration that requires less memory.2-5 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures CFGMGR Messages Error Message ACLMGR-3-RELOADED: Reloading [chars] label [dec] feature Explanation This message means that the ACL manager is now able to load more of the configured features on this label into the hardware. One or more features had previously been unloaded because of lack of space. [chars] is the direction (input or output), and [dec] is the label number. Recommended Action No action is required. Error Message ACLMGR-3-UNLOADING: Unloading [chars] label [dec] feature Explanation This message means that the ACL manager was unable to fit the complete configuration into the hardware, so some features will be applied in software. This prevents some or all of the packets in a VLAN from being forwarded in hardware and requires them to be forwarded by the CPU. Multicast packets might be dropped entirely instead of being forwarded. [chars] is the direction (input or output), and [dec] is the label number. Recommended Action Use a simpler configuration. Use the same ACLs on multiple interfaces, if possible. CFGMGR Messages This section contains configuration manager messages. Error Message CFGMGR-1-UNABLE_TO_SEND_RUN_CFG: unable to send running-cfg, bits: [hex], retrying... Explanation This message means that the system is unsuccessfully attempting to distribute the running configuration to the stack member switches. [hex] is the bit representation of the switch number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message CFGMGR-1-UNABLE_TO_SEND_STARTUP_CFG: unable to send startup-cfg, bits: [hex], retrying... Explanation This message means that the system is unsuccessfully attempting to distribute the startup configuration file to the stack member switches. [hex] is the bit representation of the switch number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-6 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures CFGMGR Messages Error Message CFGMGR-3-ERROR_APPLYING_STARTUP_CFG: Error Applying Startup Config to Running Config Explanation This message means that the system encountered an error when it was automatically applying the startup-configuration to the running-configuration. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message CFGMGR-4-SLAVE_WRITING_STARTUP_CFG: only master can do that Explanation This message means that a stack member switch (slave) attempted to write to the startup configuration file; only the stack master can write to the startup configuration file. Recommended Action No action is required. Error Message CFGMGR-6-APPLYING_RUNNING_CFG: as new master Explanation This message means that a new stack master is applying the backed-up running configuration. Recommended Action No action is required. Error Message CFGMGR-6-SPURIOUS_SLAVE_ADD: CFG MGR Recvd Spurious New Slave Notification: [int] Explanation This message means that configuration manager received a notification about adding a stack member switch (slave) that already exists in the stack. [int] is the switch number. Recommended Action If the error message recurs, copy the message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message CFGMGR-6-UNABLE_TO_NVGEN_BUSY_RUNNING_CFG: config file busy, retrying... Explanation This message means that the stack master is temporarily unable to generate the stack running configuration because another process is generating the configuration file. Recommended Action No action is required. The action will be tried again. Error Message CFGMGR-6-UNABLE_TO_NVGEN_RUNNING_CFG: config file too large... Explanation This message means that the stack master is unable to generate the stack running configuration because the configuration file is too large. Recommended Action Remove some configuration commands. 2-7 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures CMP Messages CMP Messages This section contains the Cluster Membership Protocol (CMP) messages. Error Message CMP-5-ADD: The Device is added to the cluster (Cluster Name: [chars], CMDR IP Address [IP_address]) Explanation This message means that the device is added to the cluster. [chars] is the cluster name, and [inet] is the Internet address of the command switch. Recommended Action No action is required. Error Message CMP-5-MEMBER_CONFIG_UPDATE: Received member configuration from member [dec] Explanation This message means that the active or standby command switch received a member configuration. [dec] is the member number of the sender. Recommended Action No action is required. Error Message CMP-5-MGMT_VLAN_CHNG: The management vlan has been changed to [dec] Explanation This message means that the management VLAN has changed. [dec] is the new management VLAN number. Recommended Action No action is required. Error Message CMP-5-NBR_UPD_SIZE_TOO_BIG: Number of neighbors in neighbor update is [int], maximum number of neighbors allowed in neighbor update is [int] Explanation This message means that the number of cluster neighbors in the clustering neighbor update packet exceeds the number of neighbors supported by the clustering module. The first [int] is the new number of neighbors, and the second [int] the maximum number of neighbors. Recommended Action No action is required. Error Message CMP-5-REMOVE: The Device is removed from the cluster (Cluster Name: [chars]) Explanation This message means that the device is removed from the cluster. [chars] is the cluster name. Recommended Action No action is required. 2-8 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures DTP Messages DTP Messages This section contains the Dynamic Trunking Protocol (DTP) messages. Error Message DTP-4-MEM_UNAVAIL: Memory was not available to perform the trunk negotiation action Explanation This message means that the system is unable to negotiate trunks because of a lack of memory. Recommended Action Reduce other system activity to ease memory demands. Error Message DTP-4-TMRERR: An internal timer error occurred when trunking on interface [chars] Explanation This message means that a timer used by the trunking protocol unexpectedly expired. [chars] is the trunked interface. Recommended Action This problem is corrected internally and has no long-term ramifications. However, if more problems with trunking occur, reload the switch by using the reload privileged EXEC command. Error Message DTP-4-UNKN_ERR: An unknown operational error occurred Explanation This message means that the system is unable to negotiate trunks because an internal operation generated an unexpected error. Recommended Action Reload the switch by using the reload privileged EXEC command. Error Message DTP-5-ILGLCFG: Illegal config (on, isl--on,dot1q) on [chars] Explanation This message means that one end of the trunk link is configured as on with ISL encapsulation and that the other end is configured as on with 802.1Q encapsulation. [chars] is the interface. Recommended Action This configuration is illegal and will not establish a trunk between two switches. You must change the encapsulation type so that both ends of the trunk match. Error Message DTP-5-NONTRUNKPORTON: Port [chars] has become non-trunk Explanation This message means that the interface changed from a trunk port to an access port. [chars] is the interface that changed. Recommended Action This message is provided for information only.2-9 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures EC Messages Error Message DTP-5-TRUNKPORTCHG: Port [chars] has changed from [chars] trunk to [chars] trunk Explanation This message means that the encapsulation type of the trunk port has changed. The first [chars] is the interface, the second is the original encapsulation type, and the third [chars] is the new encapsulation type. Recommended Action This message is provided for information only. Error Message DTP-5-TRUNKPORTON: Port [chars] has become [chars] trunk Explanation This message means that the interface has changed from an access port to a trunk port. The first [chars] is the interface, and the second [chars] is the encapsulation type. Recommended Action This message is provided for information only. EC Messages This section contains the EtherChannel and Port Aggregation Protocol (PAgP) messages. Error Message EC-4-NOMEM: Not enough memory available for [chars] Explanation This message means that the EtherChannel could not obtain the memory it needed to initialize the required data structures. [chars] is the name of the data structure. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message EC-5-BUNDLE: Interface [chars] joined port-channel [chars] Explanation This message means that the listed interface joined the specified EtherChannel. The first [chars] is the physical interface, and the second [chars] is the EtherChannel interface. Recommended Action No action is required. Error Message EC-5-CANNOT_ALLOCATE_AGGREGATOR: Aggregator limit reached, cannot allocate aggregator for group [dec] Explanation This message means that a new aggregator cannot be allocated in the group. [dec] is the affected group. Recommended Action Change the port attributes of the ports in the group so that they match and join the same aggregator.2-10 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures EC Messages Error Message EC-5-CANNOT_BUNDLE1: Port-channel [chars] is admin-down, port [chars] will remain stand-alone. Explanation This message means that the EtherChannel is administratively shut down. The first [chars] is the EtherChannel interface, and the second [chars] is the physical interface, which can be a switch port or a routed port. Recommended Action Enable the EtherChannel by using the no shutdown interface configuration command. Error Message EC-5-CANNOT_BUNDLE2: [chars] is not compatible with [chars] and will be suspended ([chars]) Explanation This message means that the interface has different interface attributes than other ports in the EtherChannel. For the interface to join the bundle (EtherChannel), change the interface attributes to match the EtherChannel attributes. The first [chars] is the interface to be bundled, the second [chars] is the physical interface (a switch port or a routed port) that is already in the bundle, and the third [chars] is the reason for the incompatibility. Recommended Action Change the interface attributes to match the EtherChannel attributes. Error Message EC-5-CANNOT_BUNDLE_LACP: [chars] is not compatible with aggregators in channel [dec] and cannot attach to them ([chars]) Explanation This message means that the port has different port-attributes than the port channel or ports within the port-channel. For the port to join the bundle, change the ports attributes so that they match the port. [chars] is the incompatible port. [chars] is the short interface name, such as Gi0/1, [dec] is the channel group number, and the last [chars] is the reason. Recommended Action Match the port-attributes to the port-channel. Error Message EC-5-CANNOT_BUNDLE_QOS: Removed [chars] from port channel because a QoS policy cannot be supported across multiple DFC cards. Explanation This message means that the port cannot join the port channel because the quality of service (QoS) policy attached to the port channel cannot support multiple Distributed Forwarding Cards (DFC). [chars] is the affected port. Recommended Action Place the port in another port channel, or remove the QoS policy from the port channel. Error Message EC-5-ERRPROT: Channel protocol mismatch for interface [chars] in group [dec]: the interface can not be added to the channel group Explanation This message means that the interface cannot be added to the channel-group with the specified mode. [chars] is the interface, and [dec] is the channel-group. Recommended Action Change the channel-group or the mode for the interface.2-11 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures EC Messages Error Message EC-5-ERRPROT2: Command rejected: the interface [chars] is already part of a channel with a different type of protocol enabled Explanation This message means that the interface cannot be selected for the specified protocol because it is already part of a channel with a different type of protocol enabled. [chars] is the interface. Recommended Action Remove the interface from the channel group. Error Message EC-5-ERRPROT3: Command rejected: the interface [chars] is already part of a channel Explanation This message means that the interface cannot be unselected for the specified protocol because it is already part of a channel group. [chars] is the interface. Recommended Action Remove the interface from the channel group. Error Message EC-5-L3DONTBNDL1: [chars] suspended: PAgP not enabled on the remote port. Explanation This message means that PAgP is enabled on the Layer 3 interface, but the partner port is not enabled for PAgP. In this mode, the port is placed in a suspended state. [chars] is the Layer 3 interface. Recommended Action Enable PAgP on the remote side by using the channel-group interface configuration command. Error Message EC-5-L3DONTBNDL2: [chars] suspended: incompatible partner port with [chars] Explanation This message means that an interface cannot join an EtherChannel group because the local group capability and the partner group capability must be the same as that of the interfaces in the group. In this case, the ports in the partner’s bundle (EtherChannel) do not all have the same group capability. [chars] is the physical interface, which can be a switch port or a routed port. Recommended Action Ensure that the partner group capability is the same for all the ports in the group. Error Message EC-5-L3DONTBNDL3: [chars] suspended: LACP currently not enabled on the remote port. Explanation This message means that LACP is enabled on the Layer 3 interface, but the remote port does not have LACP enabled, so the local port is put into a suspended state. [chars] is the suspended port. Recommended Action Enable LACP on remote port.2-12 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures EC Messages Error Message EC-5-L3PORTDOWN: Shutting down [chars] as its port-channel is admin-down Explanation This message means that the Layer 3 port administrative state is controlled by the administrative state of its EtherChannel. If the EtherChannel administrative state is down, the port administrative state is also forced to be down. [chars] is the Layer 3 interface. Recommended Action Enable the aggregate port administrative-state by entering the no shutdown interface configuration command on the aggregation interface. Error Message EC-5-L3STAYDOWN: [chars] will remain down as its port-channel [chars] is admin-down Explanation This message means that on Layer 3 interfaces and aggregation interfaces, the administrative state of the aggregation interface overrides the administrative status of the Layer 3 interface. If the aggregation interface is administratively down, all interfaces in the aggregation interface are forced to be down. [chars] is the Layer 3 interface. Recommended Action Enter the no shutdown interface configuration command on the aggregation interface. Error Message EC-5-NOLACP: Invalid EC mode, LACP not enabled Explanation This message means that the EtherChannel mode cannot be set because Link Aggregation Control Protocol (LACP) is not included in the software image. Recommended Action Install a software image that includes LACP, and set the EC mode to on. Error Message EC-5-NOPAGP: Invalid EC mode, PAgP not enabled Explanation This message means that PAgP is not included in the Cisco IOS image and that the EtherChannel mode cannot be set to desirable or auto. Recommended Action Obtain an image with PAgP included, or set the mode to on by using the channel-group channel-group-number mode on interface configuration command. Error Message EC-5-STAYDOWN: no-shut not allowed on [chars]. Module [dec] not online Explanation This message means that an interface with an EtherChannel configuration cannot be enabled by using the no shutdown interface configuration command because it is a member of an EtherChannel group and that EtherChannel group has been administratively shut down. The interface has an EtherChannel configuration, but no information is available yet about its port channel. [chars] is the interface, and [dec] is the module. Recommended Action No action is required. Wait until the module is online to determine the port-channel setting of the EtherChannel. 2-13 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures ETHCNTR Messages Error Message EC-5-UNBUNDLE: Interface [chars] left the port-channel [chars] Explanation This message means that the listed interface left the specified EtherChannel. The first [chars] is the physical interface, which can be a switch port or a routed port, and the second [chars] is the EtherChannel. Recommended Action No action is required. Error Message EC-5-UNSUITABLE: [chars] will not join any port-channel, [chars] Explanation This message means that one of the interfaces cannot join the EtherChannel because it is configured for PortFast, as a VLAN Membership Policy Server (VMPS), for 802.1X, as a voice VLAN, or as a Switched Port Analyzer (SPAN) destination port. All of these are unsuitable configurations for EtherChannels. The first [chars] is the interface name, and the second [chars] describes the details of the unsuitable configuration. Recommended Action Reconfigure the port; remove the unsuitable configuration. ETHCNTR Messages This section contains the Ethernet controller messages. These messages are a result of a failure of the switch software when trying to program the hardware. Most of these errors lead to incorrect switch behavior, and you should call your Cisco technical support representative. Error Message ETHCNTR-3-HALF_DUX_COLLISION_EXCEED_THRESHOLD: Collision at [chars] exceed threshold. Consider as loop-back. Explanation This message means that the collisions at a half-duplex port exceeded the threshold, and the port is considered as a loopback. [chars] is the port where the threshold was exceeded. Recommended Action No action is required. The port goes into error-disabled mode until the problem is resolved. Error Message ETHCNTR-3-LOOP_BACK_DETECTED: Loop-back detected on [chars]. Explanation This message means that a loopback condition might be the result of a balun cable incorrectly connected into a port. [chars] is the interface name. Recommended Action Check the cables. If a balun cable is connected and the loopback condition is desired, no action is required. Otherwise, connect the correct cable, and enable the port. Error Message ETHCNTR-3-NO_HARDWARE_RESOURCES: Not enough hardware resources. Shutting down [chars] Explanation This message means that there are too many VLANs and routed ports configured. [chars] is the short interface name, such as Gi0/1, or the VLAN name, such as VLAN0002. Recommended Action Reduce the total number of VLANs and routed ports to less than 1023. To preserve configuration and connections across reboots, save the configuration.2-14 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures EXPRESS_SETUP Messages EXPRESS_SETUP Messages This section contains messages for the Express Setup feature. Error Message EXPRESS_SETUP-3-UNABLE_TO_RESET_CONFIG: [chars] Explanation This message means the system is unable to reset the configuration. [chars] is a text string that explains why the reset failed. For example, error renaming config file, error removing config file, or error removing private config file. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message EXPRESS_SETUP-6-CONFIG_IS_RESET: [chars] Explanation This message means the configuration is reset. [chars] is a text message that clarifies the reset event, such as The configuration is reset and the system will now reboot. Recommended Action No action is required. Error Message EXPRESS_SETUP-6-MODE_ENTERED: Explanation Express setup mode is now active. Recommended Action No action is required. Error Message EXPRESS_SETUP-6-MODE_EXITED Explanation Express setup mode is no longer active. Recommended Action No action is required. GBIC (SFP) Security Messages This section contains the Cisco Gigabit Interface Converter (GBIC) and small form-factor pluggable (SFP) module security messages. These modules have a serial EEPROM that contains the serial number, security code, and cyclic redundancy check (CRC). When the module is inserted into the switch, the software reads the EEPROM to recompute the security code and CRC. The software generates an error message if the CRC is invalid or if the recomputed security code does not match the one stored in the EEPROM. Note The Catalyst 3750 supports SFP modules and does not support GBIC modules. Although the error message text refers to GBIC interfaces and modules, on the Catalyst 3750 the messages actually refer to the SFP interfaces and modules.2-15 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures GBIC (SFP) Security Messages Error Message GBIC_SECURITY_UNIQUE-3-DUPLICATE_GBIC: GBIC interface [dec]/[dec] is a duplicate of GBIC interface [dec]/[dec] Explanation This message means that the SFP module was identified as a Cisco SFP module, but its vendor ID and serial number match that of another interface on the system. The first [dec]/[dec] is the interface of the duplicate SPF module, and the second [dec]/[dec] is the interface of the existing module. Recommended Action Cisco SFP modules are assigned unique serial numbers. Verify that the module was obtained from Cisco or a supported vendor. Error Message GBIC_SECURITY-4-GBIC_INTERR: Internal error occurred in setup for GBIC interface [chars] Explanation This message means that the system could not allocate resources or had some other problem during the setup for the specified SFP interface. [chars] is the interface in which the SFP module is installed. Recommended Action Reload the switch by using the reload privileged EXEC command. If the problem persists, call your Cisco technical support representative. Error Message GBIC_SECURITY_CRYPT-4-ID_MISMATCH: Identification check failed for GBIC interface [chars] Explanation This message means that the SFP module was identified as a Cisco SFP module, but the system was unable to verify its identity. [chars] is the interface in which the module is installed. Recommended Action Check the list of supported SFP modules for this version of the system software. An upgrade might be required for newer modules. Otherwise, verify that the module was obtained from Cisco or a supported vendor. Error Message GBIC_SECURITY_CRYPT-4-UNRECOGNIZED_VENDOR: GBIC interface [chars] manufactured by an unrecognized vendor Explanation This message means that the SFP module was identified as a Cisco SFP module, but the system was unable to match its manufacturer with one of the known list of Cisco SFP vendors. [chars] is the interface in which the module is installed. Recommended Action Check the list of supported SFP modules for this version of the system software. An upgrade might be required for newer modules. Error Message GBIC_SECURITY_CRYPT-4-VN_DATA_CRC_ERROR: GBIC interface [chars] has bad crc Explanation This message means that the SFP module was identified as a Cisco SFP module, but it does not have a valid CRC in the EEPROM data. [chars] is the interface in which the module is installed. Recommended Action Check the list of supported SFP modules for this version of the system software. An upgrade might be required for newer modules. Even if unrecognized, the module might still operate properly, perhaps with limited functionality. 2-16 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures HARDWARE Messages Error Message GBIC_SECURITY_UNIQUE-4-DUPLICATE_SN: GBIC interface [dec]/[dec] has the same serial number as another GBIC interface Explanation This message means that the SFP module was identified as a Cisco SFP module, but its serial number matches that of another interface on the system. [dec]/[dec] is the interface in which the duplicate module is installed. Recommended Action Cisco SFP modules are assigned unique serial numbers. Verify that the module was obtained from Cisco or a supported vendor. HARDWARE Messages This section contains hardware messages. Error Message HARDWARE-3-ASICNUM_ERROR: Port-ASIC number [dec] is invalid Explanation This message means that the port ASIC number used is invalid. Each port ASIC is identified by an ID. [dec] is the ASIC number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message HARDWARE-3-INDEX_ERROR: Index value [dec] is invalid Explanation This message means that the index into the hardware table is out-of-range. [dec] is the index value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message HARDWARE-3-INTRNUM_ERROR: Port-ASIC Interrupt number [dec] is invalid Explanation This message means that the interrupt ID used in a port ASIC is invalid. [dec] is the interrupt number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message HARDWARE-3-PORTNUM_ERROR: port number [dec] is invalid Explanation This message means that the port number used is invalid. Each interface in a given port ASIC is identified by an index value. [dec] is the port number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-17 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures HLFM Messages Error Message HARDWARE-3-STATS_ERROR: Statistics ID [dec] is invalid Explanation This message means that the statistics ID used is out of range. The statistics supported by the port ASIC are identified by an ID. [dec] is the statistics ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. HLFM Messages This section contains messages from the local forwarding manager. Error Message HLFM-3-MACFREE_ERROR: MAC address [enet], vlan [dec] is still referenced; cannot free Explanation This message means an attempt was made to free a MAC address before releasing all references to it. [enet] is the MAC address, and [dec] is the VLAN ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message HLFM-3-MAP_ERROR: IP address [IP_address] not in mac tables, mac-address [enet], vlan [dec] Explanation This message means that the IP address and MAC address tables are out of sync. [IP_address] is the IP address, [enet] is the MAC address, and [dec] is the VLAN ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message HLFM-3-MOD_SD: Failed to modify Station Descriptor with index [dec], vlan [dec], di [dec], error [dec], mad [dec], ref-count [dec] Explanation This message means that the forwarding manager attempted to modify a station descriptor that is no longer in use or is invalid. The first [dec] is the station index, the second [dec] is the VLAN ID, the third [dec] is the destination index, the fourth [dec] is the error code, the fifth [dec] is the MAC address descriptor, and the sixth [dec] is the ref-count for this MAC address descriptor. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-18 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures IMAGEMGR Messages IMAGEMGR Messages This section contains image manager messages, related to image compatibility within the stack. Error Message IMAGEMGR-6-AUTO_ADVISE_SW_INITIATED: Auto-advise-software process initiated for systems [bits: [hex]] Explanation This message means that systems with incompatible software have been detected in the switch stack. Auto-advise software informs you when not all switches in the stack are running the same software version. The stack master then attempts to upgrade all switches running different versions to the version that the master is running. The stack determines whether or not software is available to be copied to the incompatible systems and if so, advises you how to copy it. Otherwise, the system informs you that the software on the switch stack needs to be updated. [bits [hex]] is the bit representation of the switch number. Recommended Action No action is required. Error Message IMAGEMGR-6-AUTO_ADVISE_SW: [chars] Explanation This message means that a line of output from the auto-advise-software process is being displayed. [chars] is a text message reporting status of the upgrade process. Recommended Action No action is required. Error Message IMAGEMGR-6-AUTO_COPY_SW_INITIATED: Auto-copy-software process initiated for systems [bits: [hex]] Explanation This message means that systems with incompatible software have been detected in the switch stack. The stack now determines whether or not software is available to be copied to the incompatible systems and whether or not it is appropriate to copy the software automatically. [bits [hex]] is the bit representation of the switch number. Recommended Action No action is required. Error Message IMAGEMGR-6-AUTO_COPY_SW: [chars] Explanation This message means that a line of output from the auto-copy-software process is being displayed. [chars] is a text message reporting status of the upgrade process. Recommended Action No action is required. 2-19 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM Messages Error Message IMAGEMGR-6-AUTO_DOWNLOAD_SW_INITIATED: Auto-download-software process initiated for systems [bits: [hex]] Explanation This message means that systems with incompatible software have been detected in the switch stack. The stack now attempts to download software from a previously configured location and to install it to make the systems compatible. [bits [hex]] is the bit representation of the switch number. Recommended Action No action is required. Error Message IMAGEMGR-6-AUTO_DOWNLOAD_SW: [chars] Explanation This message means that a line of output from the auto-download-software process is being displayed. [chars] is a text message reporting the status of the upgrade process. Recommended Action No action is required. PLATFORM Messages This section contains low-level platform specific messages. Error Message PLATFORM-1-CRASHED: [chars] Explanation This message means that the system is attempting to display the failure message from the previous failure. [chars] is the description of the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM-3-NO_HARDWARE_RESOURCES: Not enough hardware resources. Shutting down [chars] Explanation This message means that there are too many VLANs and routed ports. [chars] is the short interface name, such as Gi0/1 or the VLAN name, such as VLAN0002. Recommended Action Reduce the total number of VLANs and routed ports to be less than 1023. To preserve configurations and connections across reboots, save the configuration.2-20 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM _IPC Messages Error Message PLATFORM-3-PW_REC_HRPC_BAD_LENGTH: Received incompatible length (=[dec]) in set-password-recovery HRPC message from box [dec]. Explanation This message means that the system received an incompatible length parameter in the set-password-recovery HRPC message. This can be caused by a stack operating with incompatible software versions on different stack members. The first [dec] is the length and the second [dec] is the switch. Recommended Action Make sure that all stack members are running compatible software images. If the problem persists, copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative and provide the representative with the gathered information. Error Message PLATFORM-3-PW_REC_HRPC_NOT_ON_MASTER: Set-password-recovery HRPC msg from box [dec] received on master. Explanation This message means that the stack master has received a set-password-recovery HRPC message. These messages should be received on stack member switches only. [dec] is the switch. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM-3-PW_REC_HRPC_ONLY_ON_MASTER: Get-password-recovery HRPC msg from box [dec] received on slave. Explanation This message means that a stack member switch has received a get-password-recovery HRPC message. These messages should only be received by the stack master. [dec] is the switch. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. PLATFORM _IPC Messages This section contains the Catalyst 3750 Inter-Process Communication (IPC) protocol messages. The IPC protocol handles communication between the stack master switch and stack member switches. Error Message PLATFORM_IPC-3-COMMON: [chars] Explanation This message means that there has been an IPC failure. [chars] describes the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-21 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_PBR Messages Error Message PLATFORM_IPC-3-MASTER: [chars] Explanation This message means that there has been an IPC failure on the stack master. [chars] describes the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_IPC-3-SLAVE: [chars] Explanation This message means that there has been an IPC failure on a stack member (slave) switch. [chars] describes the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_IPC-3-STACK_EVENT: [chars] Explanation This message means that there has been an IPC failure in the stack. [chars] describes the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. PLATFORM_PBR Messages This section contains Policy Based Routing (PBR) messages. Error Message PLATFORM_PBR-4-CPU_SUPPORTED_ACTION: Set action in sequence [dec] of route-map [chars] supported by forwarding to CPU Explanation This message means that the route-map attached to an interface for policy-based routing contains an action that is not supported in hardware, so the packets are forwarded to the CPU for processing. The route-map actions that invoke this forwarding are set interface, set ip default next-hop, set default interface, or set ip df. [dec] is the action number, and [chars] is the route-map. Recommended Action Reconfigure the route-map to use set ip next-hop action instead, if possible.2-22 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_PBR Messages Error Message PLATFORM_PBR-3-INSTALL_FAIL: Policy route-map [chars] not installed in hardware Explanation This message means that the PBR manager was unable to install the complete route-map in hardware, so the packets are forwarded to the CPU for processing. [chars] is the route-map. Recommended Action Simplify route-map configurations. For example, use the same route-map on multiple interfaces. Error Message PLATFORM_PBR-3-NO_LABEL: Cannot allocate label for route-map [chars] Explanation This message means that the PBR manager could not allocate a label for this route-map. As a result, the hardware cannot be programmed to implement policy routing. There is a limit of 247 labels for policy routing. [chars] is the route-map. Recommended Action Simplify the configuration with label sharing. Use the same route-maps on multiple interfaces, if possible. Error Message PLATFORM_PBR-2-NO_RMAP: Cannot create PBR data structures for route-map [chars] Explanation This message means that the PBR manager could not allocate the internal data structures for this route-map. A likely cause is lack of available memory. [chars] is the route-map. Recommended Action Simplify the configuration that requires less memory. Error Message PLATFORM_PBR-4-RETRY_INSTALL: Route-map [chars] installed in hardware upon retry Explanation This message means that the PBR manager was able to fit the complete configuration into the hardware. One or more route-maps previously failed to load because of lack of resources. [chars] is the route-map. Recommended Action No action is required. Error Message PLATFORM_PBR-4-SDM_MISMATCH: [chars] requires sdm template routing Explanation This message means that the routing template is not enabled. [chars] is the text string PBR. Recommended Action Modify the SDM template to enable the routing template. Use the sdm prefer routing configuration command, and then reload the switch by using the reload privileged EXEC command.2-23 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_PM Messages Error Message PLATFORM_PBR-3-UNSUPPORTED_RMAP: Route-map [chars] not supported for Policy-Based Routing Explanation This message means that the route-map attached to an interface for policy routing contains an action that is not supported on this platform. This is a hardware limitation. [chars] is the route-map. Recommended Action Reconfigure the route-map to use permit entries and set ip next-hop actions only. PLATFORM_PM Messages This section contains platform Port Manager (PM) messages. Error Message PLATFORM_PM-3-IFCOUNTERROR: Unit number [dec] of interface [chars] is more than max allowed value of [dec] Explanation This message means that there are too many interfaces configured for the interface type. [dec] is the interface count, [chars] is the interface, and [dec] is the maximum number of interfaces. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_PM-3-INTVLANINUSE: internal vlan-id [dec] allocated for interface [chars] is still in use Explanation This message means that an internal VLAN ID allocated for an interface is still in use. [dec] is the VLAN ID, and [chars] is the interface. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_PM-3-NOINTVLAN: internal vlan of interface [chars] is not active for vlan-id [dec] Explanation This message means that internal vlan_data is not active for the given VLAN ID. [chars] is the interface, and [dec] is the VLAN ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-24 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_RPC Messages PLATFORM_RPC Messages This section contains the Catalyst remote procedure call (RPC) messages. The RPC function in the switch stack allows instances of code running on the various systems in a stack collective to communicate with each other by using a virtual function-call mechanism. Error Message PLATFORM_RPC-0-RESOURCE_CRASH: [chars] Explanation This message means that the system is unable to allocate memory for RPC. [chars] describes the error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_RPC-3-BAD_CLASS: Bad Class in RPC message: [int] Explanation This message means that there is a missing entry in the class table for message class. [int] is the number of the missing message class. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_RPC-3-MSG_THROTTLED: RPC Msg Dropped by throttle mechanism: type [int], class [int], max_msg [int], total throttled [int] Explanation This message means that there are too many outgoing messages queued for a message class. An RSP message was dropped. The first [int] is the message type, the second [int] is the message class, the third [int] is the maximum number of messages that can be queued before throttling occurs, and the last [int] is the total number of messages that have been throttled. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_RPC-3-PERSISTENT_UNABLE_TO_SEND: System is consistently unable to send RPC message: [chars], paks_outstanding: [int] Explanation This message means that the system is experiencing a persistent low-level transport failure in sending RPC messages. [chars] is a description of the error returned by the low-level packet-sending driver that triggered the error (usually one of these: fifo full, fifo empty, out of buf, out of mem, null pointer, misc failure), and [int] is the number of packets outstanding (packets from the RPC code to the driver that have not yet been sent). Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-25 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_SPAN Messages Error Message PLATFORM_RPC-3-RESP_FAIL: Unexpected response or failure, class [dec], req [dec], switch [dec], error [dec], [chars] Explanation This message means that the platform received an unexpected response. The first [dec] is RPC request class, the second [dec] is the RPC request number, the third [dec] is the destination switch number, the fourth [dec] is the returned error number, and [chars] is an optional comment. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_RPC-3-SEND_FAIL: Failed to send RPC message in class [dec], req [dec], [chars] Explanation This message means that there is a local resource error or that too many outgoing messages are queued for the message class. The first [dec] is RPC request class, the second [dec] is the RPC request number, and [chars] is an optional comment. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_RPC-3-UNABLE_TO_SEND: System is unable to send RPC message: [chars], paks_outstanding: [int] Explanation This message means that the system had a low-level transport failure when trying to send an RPC message. [chars] is a description of the error returned by the low-level packet sending driver that triggered the error (usually one of these: fifo full, fifo empty, out of buf, out of mem, null pointer, misc failure), and [int] is the number of packets outstanding (packets from the RPC code to the driver that have not yet been sent). Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. PLATFORM_SPAN Messages This section contains the Switched Port Analyzer (SPAN) messages. Error Message PLATFORM_SPAN-3-PACKET_DROP: Decreases egress SPAN rate Explanation This message means that egress SPAN rates are falling because SPAN is enabled with multicast routing or fallback bridging. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-26 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_UCAST Messages PLATFORM_UCAST Messages This section contains platform unicast routing messages. Error Message PLATFORM_UCAST-3-ADJ: [chars] Explanation This message means that the adjacency module for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-ARP: [chars] Explanation This message means that ARP module for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-CEF: [chars] Explanation This message means that the Cisco Express Forwarding (CEF) module for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-DYNAMIC: [chars] Explanation This message means that the dynamic address tracking mechanism for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-ERROR: [chars] Explanation This message means that an internal unicast routing error occurred. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-27 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PLATFORM_VLAN Messages Error Message PLATFORM_UCAST-3-HSRP: [chars] Explanation This message means that Hot Standby Router Protocol (HSRP) module for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-INTERFACE: [chars] Explanation This message means that a unicast routing interface error occurred. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_UCAST-3-RPC: [chars] Explanation This message means that the RPC module for unicast routing encountered an error. [chars] describes the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. PLATFORM_VLAN Messages This section contains platform VLAN messages. Error Message PLATFORM_VLAN-3-LOCK_FAIL: Failed to lock vlan-id [dec], associated mapped vlan id value [dec] Explanation This message means that the VLAN lock operation failed. This can occur if the VLAN is already active in the system or if the VLAN ID is not active. The first [dec] is the VLAN ID, and the second [dec] is the mapped-vlan-id (MVID). Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-28 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PLATFORM_VLAN-3-MVID_ERROR: Mapped Vlan ID value [dec] associated with vlan-id [dec] is invalid Explanation This message means that an active VLAN is not correctly associated with a mapped-vlan-id (MVID). The first [dec] is the VLAN ID, and the second [dec] is the MVID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PLATFORM_VLAN-3-UNLOCK_FAIL: Failed to unlock vlan-id [dec], associated mapped vlan id value [dec] Explanation This message means that the switch failed to unlock a VLAN ID. The most likely cause is that the VLAN is already unlocked. The first [dec] is the VLAN ID, and the second [dec] is the MVID. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. PM Messages This section contains the port manager messages. The port manager is a state machine that controls all the logical and physical interfaces. All features, such as VLANs, UDLD, and so forth, work with the port manager to provide switch functions. Error Message PM-2-LOW_SP_MEM: Switch process available memory is less than [dec] bytes Explanation This message means that the available memory for the switch processor is low. This can occur when too many Layer 2 VLANs are configured. [dec] is the available memory. Recommended Action Remove features from the system to reduce memory usage. Error Message PM-2-NOMEM: Not enough memory available for [chars] Explanation This message means that the port manager subsystem could not obtain the memory it needed to initialize the specified operation. [chars] is the port manager operation. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-29 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PM-2-VLAN_ADD: Failed to add VLAN [dec] - [chars]. Explanation This message means that the software failed to add the VLAN to the VLAN Trunking Protocol (VTP) database. [dec] is the VLAN ID, and [chars] specifies the reason for the failure. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_APP_ID: an invalid application id ([dec]) was detected Explanation This message means that the port manager detected an invalid request. [dec] is the application ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_APP_REQ: an invalid [chars] request by the ’[chars]’ application was detected Explanation This message means that the port manager detected an invalid request. The first [chars] is the invalid request, and the second [chars] is the application making the request. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_CARD_COOKIE: an invalid card cookie was detected Explanation This message means that the port manager detected an invalid request. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-30 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PM-4-BAD_CARD_SLOT: an invalid card slot ([dec]) was detected Explanation This message means that the port manager detected an invalid request. [dec] is the slot number. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_COOKIE: [chars] was detected Explanation This message means that the port manager detected an invalid request. [chars] is the invalid request. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_HA_ENTRY_EVENT: Invalid Host access entry event ([dec]) is received Explanation This message means that an invalid host access entry event was received; the host access table entry event should be an add, delete, or update event. [dec] is the event that is received. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_PORT_COOKIE: an invalid port cookie was detected Explanation This message means that the port manager detected an invalid request. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-31 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PM-4-BAD_PORT_NUMBER: an invalid port number ([dec]) was detected Explanation This message means that the port manager detected an invalid request. [dec] is the port number. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_VLAN_COOKIE: an invalid vlan cookie was detected Explanation This message means that the port manager detected an invalid request. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-BAD_VLAN_ID: an invalid vlan id ([dec]) was detected Explanation This message means that the port manager detected an invalid request. [dec] is the VLAN ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-ERR_DISABLE: [chars] error detected on [chars], putting [chars] in err-disable state Explanation This message means that the port manager detected a misconfiguration or misbehavior and placed the interface in an error-disabled state. A recovery is attempted after the configured retry time (the default is 5 minutes). The first [chars] is the error, and the second and third [chars] are the affected interfaces. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-32 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PM-4-ERR_RECOVER: Attempting to recover from [chars] err-disable state on [chars] Explanation This message means that the port manager is attempting to bring the interface up after taking it down to the error-disabled state. The first [chars] is the error, and the second [chars] is the affected interface. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-EXT_VLAN_INUSE: VLAN [dec] currently in use by [chars] Explanation This message means that the port manager failed to allocate the VLAN for external use because the VLAN is being used by another feature. [dec] is the VLAN that is being used, and [chars] is the feature that is using it. Recommended Action Reconfigure the feature (for example, the routed port) to use another internal VLAN or to request another available VLAN. Error Message PM-4-EXT_VLAN_NOTAVAIL: VLAN [dec] not available in Port Manager Explanation This message means that the port manager failed to allocate the requested VLAN. The VLAN is probably being used as an internal VLAN by other features. [dec] is the requested VLAN. Recommended Action Try to configure a different VLAN on the device. Error Message PM-4-INACTIVE: putting [chars] in inactive state because [chars] Explanation This message means that the port manager has been blocked from creating a virtual port for the switch port and VLAN, causing the port to be in an inactive state. The reason for this condition is specified in the error message. The first [chars] is the interface name, and the second [chars] is the reason. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show tech-support output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-INT_FAILUP: [chars] failed to come up. No internal VLAN available Explanation This message means that the port manager failed to allocate an internal VLAN, and therefore the interface cannot be enabled. [chars] is the interface name. Recommended Action Remove the extended-range VLAN by using the no vlan vlan-id global configuration command to free up resources.2-33 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures PM Messages Error Message PM-4-INT_VLAN_NOTAVAIL: Failed to allocate internal VLAN in Port Manager Explanation This message means that the port manager failed to find any available internal VLAN. Recommended Action Delete some extended-range VLANs created by users or remove some features (such as routed ports) that require internal VLAN allocation. To delete extended-range VLANs, use the no vlan vlan-id global configuration command. To delete a routed port, use the no switchport interface configuration command. Error Message PM-4-INVALID_HOST_ACCESS_ENTRY: Invalid Host access entry type ([dec]) is received Explanation This message means that an invalid host access entry type was received; the host access entry should be a configured or dynamic type. [dec] is the entry type that is received. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-LIMITS: Virtual port count for [chars] exceeded the recommended limit of [dec] Explanation This message means that the virtual port count exceeded the recommended limit of 1200 virtual ports per module and 4500 per switch. [chars] is the module name (for example, switch or the module number), and [dec] is the recommended limit. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-NO_SUBBLOCK: No PM subblock found for [chars] Explanation This message means that the port manager failed to find the subblock for this interface. [chars] is the interface name. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-34 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures QOSMGR Messages Error Message PM-4-TOO_MANY_APP: application ’[chars]’ exceeded registration limit Explanation This message means that the port manager detected an invalid request. [chars] is the application. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-UNKNOWN_HOST_ACCESS: Invalid Host access value ([dec]) is received Explanation This message means that the host access table is being accessed with an invalid host access value. [dec] is the value that is received. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message PM-4-VMPS_CFG: Dynamic access VLAN [dec] same as voice vlan on [chars]. Explanation This message means that the access VLAN ID on the VMPS server is the same as the voice VLAN ID on the interface. [dec] is the access VLAN ID, and [chars] is the physical interface. Recommended Action Assign the access VLAN on the VMPS server to a different VLAN ID from the voice VLAN ID. QOSMGR Messages This section contains the quality of service (QoS) manager messages. An incorrect QoS setting causes these messages. Error Message QOSMGR-3-FEATURE_NOT_FOUND: Cannot find feature for [chars] Explanation This message means that an internal software error has occurred. [chars] is the description of the feature that the software cannot find. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. 2-35 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures QOSMGR Messages Error Message QOSMGR-3-FILTERTYPE_INVALID: Internal Error Invalid Policy filtertype [dec] Explanation This message means that an internal software error has occurred. [dec] is the invalid filter type identification. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message IQOSMGR-3-MERGE_RES_COUNT: Internal Error Invalid count Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-NO_POLICER_QOSLABEL: Creating port Class Label Failed Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-NO_VMR_QOSLABEL: qm_generate_vmrs have no qos label Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-NULL_POLICER: Internal Error Invalid Policer Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information.2-36 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures QOSMGR Messages Error Message QOSMGR-3-POLICER_RES_COUNT: Internal Error Invalid Policer count Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-POLICYMAP_NOT_FOUND: Cannot find policymap for [chars] Explanation This message means that an internal software error has occurred. [chars] is the policy map name. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-QUEUE_PTR_ERROR: queue pointers out of order [hex] [hex] [hex] [hex] Explanation This message means that an internal software error has occurred. [hex] [hex] [hex] [hex] are the software-computed queue pointer values. The parameters provide error details for Cisco Technical Support. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-RESERVE_COUNT_ERROR: Reserved Count Exceeding total [dec] Explanation This message means that an internal software error has occurred in the allocated reserved buffers. [dec] is the reserved count computed by the software. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information.2-37 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures QOSMGR Messages Error Message QOSMGR-3-RESOURCE_INTERNAL: Internal Error in resource allocation Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-3-VMRSEQ_INVALID: Internal Error Invalid VMR sequence Explanation This message means that an internal software error has occurred. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show running-config privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message text or from the show running-config output, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message QOSMGR-4-ACTION_NOT_SUPPORTED: Action is not supported in policymap [chars] Explanation This message means that an action other than the set, trust, and police policy-map class configuration commands was configured in a policy map. This is a hardware limitation. [chars] is the name of the policy map. Recommended Action Configure only the supported actions of set, trust, and police when in policy-map class configuration mode. Error Message QOSMGR-4-CLASS_NOT_SUPPORTED: Classification is not supported in classmap [chars] Explanation This message means that an unsupported match class-map configuration command was configured in a policy map and attached to an egress interface or that more than one match command was configured. This is a hardware limitation. [chars] is the class-map name. Recommended Action Reconfigure the class map or the policy map. Use only the match ip dscp dscp-list class-map configuration command in a policy map that is attached to an egress interface. Only one match per class map is supported. Error Message QOSMGR-4-COMMAND_FAILURE: Execution of [chars] command failed Explanation This message means that the command to configure a QoS setting failed. This is possibly due to lack of hardware resources. [chars] is the description of the command. Recommended Action Check if any other messages indicate resource failure. If other messages indicate that the hardware resources are exceeded, retry the command with a smaller configuration. You can also call your Cisco support representative and provide the representative with gathered information. 2-38 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures QOSMGR Messages Error Message QOSMGR-4-HARDWARE_NOT_SUPPORTED: Hardware limitation has reached for policymap [chars] Explanation This message means that the policy map configuration has exceeded the limitation of the hardware. You configured more QoS ACL entries than the number specified in the Switch Database Management (sdm) template. [chars] is the policy-map name. Recommended Action Reconfigure the class map or the policy map, and reduce the number of QoS ACLs. Error Message QOSMGR-4-MATCH_NOT_SUPPORTED: Match type is not supported in classmap [chars] Explanation This message means that an unsupported match type was entered. Only the access-group acl-index-or-name, ip dscp dscp-list, and ip precedence ip-precedence-list match types are supported with the match class-map configuration command. [chars] is the name of the class map. Recommended Action Reconfigure the class map; use only the match access-group, match ip dscp, and match ip precedence class-map configuration commands within the class map. Error Message QOSMGR-4-NOT_SUPPORTED: Action ’[chars]’ is not supported for a policymap attached to output side. Explanation This message means that a set or trust policy-map class configuration command was configured in a policy map and attached to an egress interface. A warning message is logged, and the actions do not take affect. This is a hardware limitation. [chars] is either the set or trust action. Recommended Action Do not configure a set or trust policy-map class configuration command in a policy map and attach it to an egress interface. These policy-map actions are supported only on ingress interfaces. Error Message QOSMGR-4-POLICER_PLATFORM_NOT_SUPPORTED: Policer configuration has exceeded hardware limitation for policymap [chars] Explanation This message means that the policy-map configuration has exceeded the limitation of the hardware. You configured more policers together in all policy maps (by using the police or police aggregate policy-map class configuration command) than supported by hardware. [chars] is the policy-map name. Recommended Action Reconfigure the class maps or the policy maps, or delete the policy map from some interfaces. Error Message QOSMGR-4-POLICER_POLICY_NOT_SUPPORTED: Number of policers has exceeded per policy hardware limitation for policymap [chars] Explanation This message means that the policy-map configuration has exceeded the limitation of the hardware. You configured more policers in a policy map (by using the police or police aggregate policy-map class configuration command) than supported. [chars] is the policy-map name. Recommended Action Reconfigure the class map or the policy map, and reduce the number of policers. 2-39 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SDM Messages SDM Messages This section contains the Switch Database Manager (SDM) messages. Error Message SDM-6-MISMATCH_ADVISE: [chars] Explanation This message means that a stack member cannot support the SDM template that the stack master is using. Switches in the SDM mismatch state are not functional stack members. This error follows the STACKMGR-6-SWITCH_ADDED_SDM error message if it reports SDM_MISMATCH. [chars] displays mismatch information and recommended corrective actions. Recommended Action Downgrade the SDM template of the master switch to make it compatible with the stack member switches. For example, if the master switch uses aggregrator routing, the error message recommends downgrading the master to desktop routing by using the sdm prefer vlan desktop global configuration command. SFP Messages This section contains the small form-factor pluggable (SFP) module identification message. Error Message SFP-4-CHECK_SUM_FAILED:SFP EEPROM data check sum failed for SFP interface [chars]. Explanation This message means that the SFP module was identified as a Cisco SFP module, but the system was unable to read vendor-data information to verify its accuracy. [chars] is the interface in which the module is installed. Recommended Action Remove and re-insert the SFP module. If it continues to fail after re-insertion, it might be defective. SPAN Messages This section contains the Switched Port Analyzer (SPAN) messages. Error Message SPAN-3-MEM_UNAVAIL: Memory was not available to perform the SPAN operation Explanation This message means that the system was unable to perform a SPAN operation because of a lack of memory. Recommended Action Reduce other system activity to ease the memory demands. 2-40 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE Messages Error Message SPAN-3-UNKN_ERR: An internal error occurred during a SPAN operation. Explanation This message means that SPAN detected an error in its internal operation. Recommended Action The error might be transient. Try the SPAN operation again. If a second attempt also fails, reload the switch by using the reload privileged EXEC command to complete the operation. Error Message SPAN-3-UNKN_ERR_PORT: An internal error occurred when configuring SPAN on port [chars] Explanation This message means that SPAN detected an error in its internal operation. [chars] is the interface. Recommended Action The error might be transient. Try the SPAN operation again. If the second attempt also fails, reload the switch by using the reload privileged EXEC command to complete the operation. SPANTREE Messages This section contains the spanning-tree messages. Error Message SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on port [chars] with BPDU Guard enabled. Disabling port. Explanation This message means that a bridge protocol data unit (BPDU) was received on an interface that has the spanning tree BPDU guard feature enabled. As a result, the interface was administratively shut down. [chars] is the name of the interface. Recommended Action Either remove the device sending BPDUs, or disable the BPDU guard feature. The BPDU guard feature can be locally configured on the interface or globally configured on all ports that have PortFast enabled. To disable BPDU guard on an interface, use the no spanning-tree bpduguard enable interface configuration command. To disable BPDU guard globally, use the no spanning-tree portfast bpduguard default global configuration command. After you have removed the device or disabled BPDU guard, re-enable the interface by entering the no shutdown interface configuration command. Error Message SPANTREE-2-BLOCK_PVID_LOCAL: Blocking [chars] on [chars]. Inconsistent local vlan. Explanation This message means that the spanning-tree port associated with the listed spanning-tree instance and interface will be held in the spanning-tree blocking state until the port VLAN ID (PVID) inconsistency is resolved. The listed spanning-tree instance is that of the native VLAN ID of the listed interface. The first [chars] is the interface, and the second [chars] is the spanning-tree instance. Recommended Action Verify that the configuration of the native VLAN ID is consistent on the interfaces on each end of the 802.1Q trunk connection. When corrected, spanning tree automatically unblocks the interfaces, as appropriate.2-41 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE Messages Error Message SPANTREE-2-BLOCK_PVID_PEER: Blocking [chars] on [chars]. Inconsistent peer vlan. Explanation This message means that the spanning-tree port associated with the listed spanning-tree instance and interface will be held in the spanning-tree blocking state until the port VLAN ID (PVID) inconsistency is resolved. The listed spanning-tree instance is that of the native VLAN ID of the interface on the peer switch to which the listed interface is connected. The first [chars] is the interface, and the second [chars] is the spanning-tree instance. Recommended Action Verify that the configuration of the native VLAN ID is consistent on the interfaces on each end of the 802.1Q trunk connection. When interface inconsistencies are corrected, spanning tree automatically unblocks the interfaces. Error Message SPANTREE-2-CHNL_MISCFG: Detected loop due to etherchannel misconfiguration of [chars] [chars] Explanation This message means that a misconfiguration of a channel group has been detected. For example, the ports on one side of the EtherChannel either are not configured to be in the channel or failed to bundle into the channel and the other side has successfully bundled the ports into the EtherChannel. The first [chars] is the port, and the second [chars] is the VLAN. Recommended Action Identify the local ports using the show interfaces status err-disabled privileged EXEC command, and then check the EtherChannel configuration on the remote device by using the show etherchannel summary privileged EXEC command on the remote device. After the configuration is correct, enter the shutdown and then no shutdown interface configuration commands on the associated port-channel interfaces. Error Message SPANTREE-2-LOOPGUARD_BLOCK: Loop guard blocking port [chars] on [chars]. Explanation This message means that the spanning-tree message age timer has expired because no bridge protocol data units (BPDUs) were received from the designated bridge. Because this condition could be caused by a unidirectional-link failure, the interface is put into the blocking state and marked as loop-guard-inconsistent to prevent possible loops from being created. The first [chars] is the name of this port, and the second [chars] is the spanning-tree mode displayed in the show spanning-tree privileged EXEC command. Recommended Action Enter the show spanning-tree inconsistentports privileged EXEC command to review the list of interfaces with loop-guard inconsistencies. Determine why devices connected to the listed ports are not sending BPDUs. One reason might be that they are not running the STP. If so, you should disable loop guard on the inconsistent interfaces by using the spanning-tree guard none interface configuration command or by starting STP on the remote side of the links. Error Message SPANTREE-2-LOOPGUARD_CONFIG_CHANGE: Loop guard [chars] on port [chars] on [chars]. Explanation This message means that the spanning-tree loop-guard configuration for the listed interface has been changed. If enabled, the interface is placed into the blocking state. It is marked as loop-guard-inconsistent when the message-age timer expires because no BPDUs were received 2-42 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE Messages from the designated bridge. This feature is mainly used to detect unidirectional links. The first [chars] is the loop-guard state (enable or disable), the second [chars] is the interface name, and the third [chars] is the spanning-tree instance. Recommended Action Verify that this is the desired configuration for the listed interface. Correct it if this is not the desired configuration; otherwise, no further action is required. Error Message SPANTREE-2-LOOPGUARD_UNBLOCK: Loop guard unblocking port [chars] on [chars]. Explanation This message means that the listed interface has received a BPDU, and therefore, if the inconsistency was caused by a unidirectional link failure, the problem no longer exists. The loop-guard-inconsistency is cleared for the interface, which is taken out of the blocking state, if appropriate. The first [chars] is the name of this port, and the second [chars] is the spanning-tree mode displayed in the show spanning-tree privileged EXEC command. Recommended Action No action is required. Error Message SPANTREE-2-PVSTSIM_FAIL: Superior PVST BPDU received on VLAN [dec] port [chars], claiming root [dec]:[enet]. Invoking root guard to block the port Explanation This message means that root guard blocked a port that might cause a spanning-tree loop. When a PVST+ switch is connected to an MST switch, the IST root (MSTOO) becomes the root for all PVST+ spanning trees. A loop can occur if any of the PVST+ spanning trees have a better root than IST. To prevent the loop, root guard blocks the port on the MST switch that receives the superior message from the PVST+ side. The first [dec] is the VLAN ID, [chars] is the short interface name, such as Gi0/1, the second [dec] is the root bridge priority, and [enet] is the root bridge MAC address. Recommended Action When STP converges after a new switch or switch port is added to the topology, root guard might temporarily block the port and then automatically restore it. If the port remains blocked, identify the root bridge from this error message, and configure a less favorable priority for the VLAN spanning tree. There could be other superior PVST roots, and the port cannot recover until all such roots are cleared. Alternatively, try disabling and then enabling the VLAN port. Error Message SPANTREE-2-RECV_1Q_NON_1QTRUNK: Received 802.1Q BPDU on non 802.1Q trunk [chars] [chars]. Explanation This message means that the listed interface on which a Shared Spanning Tree Protocol (SSTP) BPDU was received was in trunk mode but was not using 802.1Q encapsulation. The first [chars] is the port, and the second [chars] is the VLAN. Recommended Action Verify that the configuration and operational state of the listed interface and that of the interface to which it is connected are in the same mode (access or trunk). If the mode is trunk, verify that both interfaces have the same encapsulation (ISL or 802.1Q). If the encapsulation types are different, use the switchport trunk encapsulation interface configuration command to make them consistent. When the encapsulation is consistent, spanning tree automatically unblocks the interface.2-43 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE Messages Error Message SPANTREE-2-RECV_BAD_TLV: Received SSTP BPDU with bad TLV on [chars] [chars]. Explanation This message means that the listed interface received an SSTP BPDU without the VLAN ID tag. The BPDU is discarded. The first [chars] is the port, and the second [chars] is the VLAN that received the SSTP BPDU. Recommended Action If the message recurs, copy the message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id [dec] on [chars] [chars]. Explanation This message means that the listed interface received an SSTP BPDU that is tagged with a VLAN ID that does not match the VLAN ID on which the BPDU was received. This occurs when the native VLAN is not consistently configured on both ends of an 802.1Q trunk. [dec] is the VLAN ID, the first [chars] is the port, and the second [chars] is the VLAN. Recommended Action Verify that the configurations of the native VLAN ID is consistent on the interfaces on each end of the 802.1Q trunk connection. When the configurations are consistent, spanning tree automatically unblocks the interfaces. Error Message SPANTREE-2-ROOTGUARD_BLOCK: Root guard blocking port [chars] on [chars]. Explanation This message means that on the listed interface a BPDU was received that advertises a superior spanning-tree root bridge (lower bridge ID, lower path cost, and so forth) than that in use. The interface is put into blocking state and marked as root-guard inconsistent to prevent a suboptimal spanning-tree topology from forming. The first [chars] is the name of this port, and the second [chars] is the spanning-tree mode displayed in the output of the show spanning-tree privileged EXEC command. Recommended Action Enter the show spanning-tree inconsistentports privileged EXEC command to review the list of interfaces with root-guard inconsistencies. Determine why devices connected to the listed ports are sending BPDUs with a superior root bridge, and take action to prevent more occurrences. When the inaccurate BPDUs have been stopped, the interfaces automatically recover and resume normal operation. Make sure that it is appropriate to have root guard enabled on the interface. Error Message SPANTREE-2-ROOTGUARD_CONFIG_CHANGE: Root guard [chars] on port [chars] on [chars]. Explanation This message means that the spanning-tree root guard configuration for the listed interface has changed. If enabled, any BPDU received on this interface that advertises a superior spanning-tree root bridge (lower bridge ID, lower path cost, and so forth) to that already in use causes the interface to be put into the blocking state and marked as root-guard inconsistent. The first [chars] is the root-guard state (enable or disable), the second [chars] is the interface, and the third [chars] is the spanning-tree instance. Recommended Action Verify that this is the desired configuration for the listed interface. Correct it if it is not the desired configuration; otherwise, no action is required.2-44 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE Messages Error Message SPANTREE-2-ROOTGUARD_UNBLOCK: Root guard unblocking port [chars] on [chars]. Explanation This message means that the listed interface is no longer receiving BPDUs advertising a superior root bridge (lower bridge ID, lower path cost, and so forth). The root-guard inconsistency is cleared for the interface, and the blocking state is removed from the interface. The first [chars] is the name of this port, and the second [chars] is the spanning-tree mode displayed in show spanning-tree privileged EXEC command. Recommended Action No action is required. Error Message SPANTREE-2-UNBLOCK_CONSIST_PORT: Unblocking [chars] on [chars]. Port consistency restored. Explanation This message means that the port VLAN ID or port type inconsistencies have been resolved and spanning tree will unblock the listed interface of the listed spanning-tree instance as appropriate. The first [chars] is the interface, and the second [chars] is the spanning-tree instance. Recommended Action No action is required. Error Message SPANTREE-3-BAD_PORTNUM_SIZE: Rejected an attempt to set the port number field size to [dec] bits (valid range is [dec] to [dec] bits). Explanation This message means that an error occurred in the platform-specific code that caused it to request more or less bits than are possible. The spanning-tree port identifier is a 16-bit field, which is divided evenly between the port priority and port number, with each subfield being 8 bits. This allows the port number field to represent port numbers between 1 and 255. However, on systems with more than 255 ports, the size of port number portion of the port ID must be increased to support the number of ports. This is performed by the STP subsystem at system initialization because the maximum number of ports on a particular platform will not change. This error occurs because of an error in the platform-specific code, which causes it to request more or less bits than are possible. The first [dec] is the number of bits for the port number, and the second and third [dec] describe the valid range. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show version privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show version command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SPANTREE-3-PORT_SELF_LOOPED: [chars] disabled.- received BPDU src mac ([enet]) same as that of interface Explanation This message means that a BPDU was received on the listed interface with a source MAC address that matches the one assigned to the listed interface. This means that a port might be looped back to itself, possibly because of an installed diagnostic cable. The interface will be administratively shut down. [chars] is the interface that received the BPDU, and [enet] is the source MAC address. Recommended Action Check the interface configuration and any cable connected to the interface. When the problem is resolved, re-enable the interface by entering the no shutdown interface configuration command.2-45 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE_FAST Messages Error Message SPANTREE-5-EXTENDED_SYSID: Extended SysId [chars] for type [chars] Explanation This message means that the extended system ID feature is either enabled or disabled for the given type of spanning tree. If enabled, the spanning-tree instance identifier is stored in the lower portion of the bridge ID priority field and limits the allowed values for the bridge priority from 0 to 61440, in increments of 4096. If disabled, the bridge ID priority field consists only of the configured priority, but some spanning-tree features might not be available on a given platform (for example, support for 4096 VLANs). On some platforms, this feature might be mandatory. The first [chars] is the extended system ID state (enable or disable), and the second [chars] is the spanning-tree instance. Recommended Action No action is required. Error Message SPANTREE-7-BLOCK_PORT_TYPE: Blocking [chars] on [chars]. Inconsistent port type. Explanation This message means that the listed interface is being held in the spanning-tree blocking state until the port-type inconsistency is resolved. The first [chars] is the interface, and the second [chars] is the spanning-tree instance. Recommended Action Verify that the configuration and operational states of the listed interface and those of the interface to which it is connected are in the same mode (access or trunk). If the mode is trunk, verify that both interfaces have the same encapsulation (ISL or 802.1Q). When these parameters are consistent, spanning tree automatically unblocks the interface. Error Message SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk [chars] [chars]. Explanation This message means that an SSTP BPDU was received on the listed interface, which is not an operational trunking interface. The first [chars] is the port name, and the second [chars] is the VLAN name. Recommended Action Verify that the configuration and operational state of the listed interface and that of the interface to which it is connected are in the same mode (access or trunk). If the mode is trunk, verify that both interfaces have the same encapsulation (none, ISL, or 802.1Q). When these parameters are consistent, spanning tree automatically unblocks the interface. SPANTREE_FAST Messages This section contains the spanning-tree fast-convergence message. Error Message SPANTREE_FAST-7-PORT_FWD_UPLINK: [chars] [chars] moved to Forwarding (UplinkFast). Explanation This message means that the listed interface has been selected as the new path to the root switch for the listed spanning-tree instance. The first [chars] is the spanning-tree instance, and the second [chars] is the interface. Recommended Action No action is required.2-46 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SPANTREE_VLAN_SWITCH Messages SPANTREE_VLAN_SWITCH Messages The section contains the per-VLAN spanning-tree-specific message. Error Message SPANTREE_VLAN_SW-2-MAX_INSTANCE: Platform limit of [dec] STP instances exceeded. No instance created for [chars] (port [chars]). Explanation This message means that the number of currently active VLAN spanning-tree instances has reached a platform-specific limit. No additional VLAN instances will be created until the number of existing instances drops below the platform limit. [dec] is the spanning-tree instance limit, and the first [chars] is the smallest VLAN number of those VLANs that are unable to have STP instances created. Recommended Action Reduce the number of currently active spanning-tree instances by either disabling some of the currently active spanning-tree instances or deleting the VLANs associated with them. You must manually enable the spanning trees that could not be created because of limited instances. STACKMGR Messages This section contains stack manager system messages. These messages are related to the status of switches within the stack. Error Message STACKMGR-6-HDM_GET_DEVICE_RECORD_FAIL: Device Manager could not get device record. Explanation This message means that this switch could not get the device record for some or all other switches in the stack. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message STACKMGR-6-MASTER_ELECTED: Switch [dec] has been elected as MASTER of the stack Explanation This message means that the specified switch has been elected stack master. [dec] is the switch number of the elected stack master. Recommended Action No action is required. Error Message STACKMGR-6-MASTER_READY: Master Switch [dec] is READY Explanation This message means that the stack master is ready for use. [dec] is the stack master switch number. Recommended Action No action is required. 2-47 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures STACKMGR Messages Error Message STACKMGR-6-MSG_FAIL: Failed to retrieve stack message from port-asic [dec] in direction [dec] Explanation This message means that stack manager module failed to retrieve stack messages. The first [dec] is the ASIC ID, and the second [dec] is the direction. Recommended Action No action is required. Error Message STACKMGR-6-NORECORD: Switch removed event for switch [dec] with no switch record Explanation This message means that notifier module of the stack manager received switch removed event for which there is no switch record. [dec] is the switch number. Recommended Action No action is required. Error Message STACKMGR-6-STACK_LINK_CHANGE: Stack Port [chars] Switch [dec] has changed to state [chars] Explanation This message means that the specified stack port status has changed state to up or down. The first [chars] is the stack port (1 or 2), [dec] is the switch number, and the second [chars] is the new state (up or down). Recommended Action No action is required. Error Message STACKMGR-6-SWITCH_ADDED: Switch [dec] has been ADDED to the stack Explanation This message means that the specified stack member switch has been added to the stack. [dec] is the switch number. Recommended Action No action is required. Error Message STACKMGR-6-SWITCH_ADDED_SDM: Switch [dec] has been ADDED to the stack (SDM_MISMATCH) Explanation This message means that the specified switch has been added to the stack. [dec] is the switch number. SDM_MISMATCH means that the added switch cannot support the SDM template that the stack master is using. Subsequent SDM-6-MISMATCH_ADVISE messages explain the mismatch and recommend corrective actions. Recommended Action No action is required unless SDM_MISMATCH is displayed. For SDM_MISMATCH corrective actions, see SDM-6-MISMATCH_ADVISE. Error Message STACKMGR-6-SWITCH_ADDED_VM: Switch [dec] has been ADDED to the stack (VERSION_MISMATCH) Explanation This message means that a switch that has been added to the stack has a different software version. [dec] is the switch number. Recommended Action No action is required. 2-48 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SUPERVISOR Messages Error Message STACKMGR-6-SWITCH_READY: Switch [dec] is READY Explanation This message means that the switch is ready. [dec] is the switch number. Recommended Action No action is required. Error Message STACKMGR-6-SWITCH_REMOVED: Switch [dec] has been REMOVED from the stack Explanation This message means that the specified switch has been removed from the stack. [dec] is the switch number. Recommended Action No action is required. SUPERVISOR Messages This section contains the supervisor ASIC error message. This ASIC controls the CPU and the switch send and receive ports. Error Message SUPERVISOR-3-FATAL: [chars] Explanation This message means that an internal error occurred in the supervisor ASIC. [chars] is the detailed error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. SUPQ Messages This section contains the supervisor queue error messages. These messages are related to CPU and send and receive queues. Error Message SUPQ-3-THROTTLE_CPU_QUEUE: Invalid application ID [dec] used for throttling Explanation This message means that an application has passed an invalid application ID for throttle check. [dec] is the internal application identifier. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-49 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SUPQ Messages Error Message SUPQ-4-CPUHB_RECV_STARVE: [chars] Explanation This message means that the system has detected that messages directed to the CPU are delayed. [chars] is the detailed error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SUPQ-4-CPUHB_SLOW_TRANSMIT: [chars] Explanation This message means that the system is warning you about a slowdown of the transmit interface. [chars] is the detailed error message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SUPQ-4-CPUHB_TX_FAIL:CPU Heartbeat TX Failed Explanation This message means that the system is warning you about the transmit interface discarding the heartbeat message. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SUPQ-4-PORT_QUEUE_STUCK: Port queue Stuck for asic [dec] port [dec] queue [dec] Explanation This message means that the system has detected that an interface queue is not being cleared in a reasonable time. The first [dec] is the ASIC, the second [dec] is the interface, and the third [dec] is the queue number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SUPQ-4-RECV_QUEUE_STUCK: Receive queue Stuck for asic [dec] queue [dec] Explanation This message means that the system has detected that the receive queue is not being cleared in a reasonable time. The first [dec] is the ASIC, and the second [dec] is the queue number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-50 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SW_VLAN Messages SW_VLAN Messages This section contains the VLAN manager messages. The VLAN manager receives information from the VTP and enables the proper VLAN membership on all interfaces through the port manager. Error Message SW_VLAN-3-VLAN_PM_NOTIFICATION_FAILURE: VLAN Manager synchronization failure with Port Manager over [chars] Explanation This message means that the VLAN manager dropped a notification from the port manager because of a lack of ready pool space. [chars] is the type of port manager notification. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-3-VTP_PROTOCOL_ERROR: VTP protocol code internal error: [chars] Explanation This message means that the VTP code encountered an unexpected error while processing a configuration request, a packet, or a timer expiration. [chars] is the internal error. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-BAD_PM_VLAN_COOKIE_RETURNED: VLAN manager unexpectedly received a bad PM VLAN cookie from the Port Manager, VLAN indicated: [dec] Explanation This message means that the VLAN manager received an upcall and a VLAN cookie from the port manager, which translated to a bad VLAN number. [dec] is the VLAN ID. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-BAD_STARTUP_VLAN_CONFIG_FILE: Failed to configure VLAN from startup-config. Fallback to use VLAN configuration file from non-volatile memory Explanation This message means that the VLAN software did not use the VLAN configuration from the startup-configuration file. It will use the binary VLAN configuration file in NVRAM memory. Recommended Action No action is required. 2-51 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SW_VLAN Messages Error Message SW_VLAN-4-BAD_VLAN_CONFIGURATION_FILE: VLAN configuration file contained incorrect verification word: [hex] Explanation This message means that the VLAN configuration file read by the VLAN manager did not begin with the correct value. The VLAN configuration file is invalid, and it has been rejected. [hex] is the incorrect verification value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-BAD_VLAN_CONFIGURATION_FILE_VERSION: VLAN configuration file contained unknown file version: [dec] Explanation This message means that the VLAN configuration file read by the VLAN manager contained an unrecognized file version number, which might mean an attempt to regress to an older version of the VLAN manager software. [dec] is the file version number. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-BAD_VLAN_TIMER_ACTIVE_VALUE: Encountered incorrect VLAN timer active value: [chars] Explanation This message means that, because of a software error, a VLAN timer was detected as active when it should have been inactive or as inactive when it should have been active. [chars] is the VLAN timer active value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-EXT_VLAN_CREATE_FAIL: Failed to create VLANs [chars]: [chars] Explanation The message means that the software failed to create VLANs. The first [chars] is the Layer 2 VLAN list, and the second [chars] describes the reason for the failure. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-52 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SW_VLAN Messages Error Message SW_VLAN-4-EXT_VLAN_INTERNAL_ERROR: Extended VLAN manager received an internal error [dec] from [chars]: [chars] Explanation This message means that an unexpected error code was received by the VLAN manager from the extended-range VLAN configuration software. [dec] is the error code. The first [chars] is the function, and the second [chars] describes the error code. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-EXT_VLAN_INVALID_DATABASE_DATA: Extended VLAN manager received bad data of type [chars]: value [dec] from function [chars] Explanation This message means that invalid data was received by the extended-range VLAN manager from an extended-range VLAN configuration database routine. The first [chars] is the data type, [dec] is the number received, and the second [chars] is the function name. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-IFS_FAILURE: VLAN manager encountered file operation error: call = [chars] / file = [chars] / code = [dec] ([chars]) / bytes transferred = [dec] Explanation This message means that the VLAN manager received an unexpected error return from a Cisco IOS file system (IFS) call while reading the VLAN database. The first [chars] is the name of the function call, and the second [chars] is the file name. [dec] is the error code, the third [chars] is the textual interpretation of the error code, and the second [dec] is the number of bytes transferred. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-NO_PM_COOKIE_RETURNED: VLAN manager unexpectedly received a null [chars] type cookie from the Port Manager, data reference: [chars] Explanation This message means that the VLAN manager queried the port manager for a reference cookie but received a NULL pointer instead. The first [chars] is the type of port manager cookie, and the second [chars] is the interface or VLAN that is the source of the problem. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-53 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures SW_VLAN Messages Error Message SW_VLAN-4-STARTUP_EXT_VLAN_CONFIG_FILE_FAILED: Failed to configure extended range VLAN from startup-config. Error [chars] Explanation This message means that the VLAN software failed to use an extended-range VLAN configuration from the startup configuration file. All extended-range VLAN configurations are lost after the system boots up. [chars] is a description of the error code. Recommended Action No action is required. Error Message SW_VLAN-4-VTP_INTERNAL_ERROR: VLAN manager received an internal error [dec] from vtp function [chars]: [chars] Explanation This message means that the VLAN manager received an unexpected error code from the VTP configuration software. [dec] is the error code, the first [chars] is the VTP function, and the second [chars] is the error-code description. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-VTP_INVALID_DATABASE_DATA: VLAN manager received bad data of type [chars]: value [dec] from vtp database function [chars] Explanation This message means that the VLAN manager received invalid data from a VTP configuration database routine. The first [chars] is the data type; [dec] is the inappropriate value that was received, and the second [chars] is the VTP database function. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-4-VTP_INVALID_EVENT_DATA: VLAN manager received bad data of type [chars]: value [dec] while being called to handle a [chars] event Explanation This message means that the VLAN manager received invalid data from the VTP configuration software. The first [chars] is the data type, [dec] is the value of that data, and the second [chars] is the VTP event. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information.2-54 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures TCAMMGR Messages Error Message SW_VLAN-4-VTP_USER_NOTIFICATION: VTP protocol user notification: [chars] Explanation This message means that the VTP code encountered an unusual diagnostic situation. [chars] is a description of the situation. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message SW_VLAN-6-OLD_CONFIG_FILE_READ: Old version [dec] VLAN configuration file detected and read OK. Version [dec] files will be written in the future. Explanation This message means that the VLAN software detected an old version of the VLAN configuration file format. It interpreted the file without a problem, but it will create files using the new format in the future. The first [dec] is the old version number, and the second [dec] is the new version number. Recommended Action No action is required. Error Message SW_VLAN-6-VTP_MODE_CHANGE: VLAN manager changing device mode from [chars] to [chars]. Explanation This message means that an automatic VTP mode device change occurred upon receipt of a VLAN configuration database message containing more than a set number of VLANs. The first [chars] is the previous mode, and the second [chars] is the current mode. Recommended Action No action is required. TCAMMGR Messages This section contains the Ternary Content Addressable Memory Manager (TCAMMGR) messages. Error Message TCAMMGR-3-GROW_ERROR: cam region [dec] can not grow Explanation This message means that the specified CAM region is configured as a static region with a fixed number of entries, and a caller requested to add more CAM entries. [dec] is the CAM region. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-55 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures TCAMMGR Messages Error Message TCAMMGR-3-HANDLE_ERROR: cam handle [hex] is invalid Explanation This message means that the CAM handle used by the caller is not valid. [hex] is the handle value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message TCAMMGR-3-INDEX_ERROR: cam value/mask index [dec] is invalid Explanation This message means that the CAM index used by the caller is not valid. [dec] is the index value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message TCAMMGR-3-MOVE_ERROR: cam entry move from index [int] to index [int] failed Explanation This message means that moving a CAM entry from one index to another failed. [int] is the index value. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message TCAMMGR-3-REGION_ERROR: cam region [dec] is invalid Explanation This message means that the CAM region is not valid. [dec] is the region. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message TCAMMGR-3-REGMASK_ERROR: invalid cam region [dec] mask [dec] pair Explanation This message means that a caller attempted to install an entry with an invalid mask for the region. Only a predetermined set of masks is allowed in a region. The first [dec] is the region, and the second [dec] is the mask. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information.2-56 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures UDLD Messages UDLD Messages This section contains UniDirectional Link Detection (UDLD) messages. Error Message UDLD-3-UDLD_IDB_ERROR: UDLD error handling [chars] interface: [chars] Explanation This message means that a software error occurred in UDLD processing associated with a specific interface. The first [chars] is the event, and the second [chars] is the interface. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message UDLD-3-UDLD_INTERNAL_ERROR: UDLD internal error: [chars] Explanation This message means that a software check failed during UDLD processing. [chars] is a description of the internal error. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message UDLD-3-UDLD_INTERNAL_IF_ERROR: UDLD internal error, interface [chars]: [chars] Explanation This message means that a software check failed during UDLD processing. The first [chars] is the interface, and the second [chars] is a description of the error. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message UDLD-4-UDLD_PORT_DISABLED: UDLD disabled interface [chars], [chars] detected Explanation This message means that the UDLD Protocol disabled an interface because it detected connections between neighbors that were functioning only in one direction, which might potentially cause spanning-tree loops or interfere with connectivity. The cause is likely to be hardware related, either due to a bad port, a bad cable, or a misconfigured cable. The first [chars] is the interface, and the second [chars] is the error detected. Recommended Action Try to correct the configuration or locate the bad cable. If you are not successful, copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. 2-57 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures UFAST_MCAST_SW Messages If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message UDLD-6-UDLD_PORT_RESET: UDLD reset interface [chars] Explanation This message means that the UDLD Protocol detected a unidirectional connection between neighbors. Reset the port that was disabled by UDLD by using the udld reset privileged EXEC command or through a hardware action such as a link-state change. [chars] is the interface. Recommended Action Copy the error message exactly as it appears on the console or in the system log. Enter the show tech-support privileged EXEC command to gather data that might provide information about the error. If you cannot determine the nature of the error from the error message or from the show tech-support command display, call your Cisco technical support representative, and provide the representative with the gathered information. UFAST_MCAST_SW Messages This section contains Uplink Fast Packet Transmission (UFAST) messages. Error Message UFAST_MCAST_SW-3-PROC_START_ERROR: No process available for transmitting UplinkFast packets. Explanation This message means that UplinkFast packets will not be transmitted because the process could not be created. Recommended Action UplinkFast will not work unless you reload the switch software. If this problem persists even after reload, contact your Cisco Technical Support representative, and provide the configuration and technical support information. Error Message UFAST_MCAST_SW-4-MEM_NOT_AVAILABLE: No memory is available for transmitting UplinkFast packets on Vlan [dec]. Explanation This message means that UplinkFast packets will not be transmitted on VLAN [dec] due to memory limitations. [dec] is the VLAN ID. Recommended Action Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration.2-58 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures VQPCLIENT Messages VQPCLIENT Messages This section contains VLAN Query Protocol (VQP) Client messages. Error Message VQPCLIENT-2-CHUNKFAIL: Could not allocate memory for VQP Explanation This message means that an error occurred when the system tried to allocate memory for the VQP client. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message VQPCLIENT-2-DENY: Host [enet] denied on interface [chars] Explanation This message means that the VLAN Membership Policy Server (VMPS) has denied access for the given host MAC address to an interface. [enet] is the host MAC address, and [chars] is the interface name. Recommended Action No action is normally required. If you think that the host should have been allowed access, verify the configuration on the VMPS. Error Message VQPCLIENT-2-INITFAIL: Platform-specific VQP initialization failed. Quitting Explanation This message means that an error occurred during initialization of the VQP client platform-specific code. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message VQPCLIENT-2-IPSOCK: Could not obtain IP socket Explanation This message means that an error occurred when the system attempted to open an IP socket to the VMPS. Recommended Action If the error message recurs, copy the message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. Error Message VQPCLIENT-2-PROCFAIL: Could not create process for VQP. Quitting Explanation This message means that an error occurred while creating a process for the VQP client. Recommended Action Copy the error message exactly as it appears on the console or in the system log, call your Cisco technical support representative, and provide the representative with the gathered information. 2-59 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures VQPCLIENT Messages Error Message VQPCLIENT-2-SHUTDOWN: Interface [chars] shutdown by VMPS Explanation This message means that the VMPS has directed that an interface be shut down. [chars] is the interface name. Recommended Action No action is normally required. If you think that the port should not have been shut down, then verify the configuration on the VMPS. Error Message VQPCLIENT-2-TOOMANY: Interface [chars] shutdown by active host limit Explanation This message means that the system has shut down an interface because too many hosts have requested access to that port. [chars] is the interface name. Recommended Action To reactivate the port, remove the excess hosts, and enter a no shutdown interface configuration command on the interface. Error Message VQPCLIENT-3-THROTTLE: Throttling VLAN change on [chars] Explanation This message means that an attempt was made to change the VLAN assignment for an interface more often than once every 10 seconds. The VLAN change is denied. [chars] is the name of the interface. Recommended Action No action is normally required. If the message recurs, verify the VMPS configuration. Verify that unexpected hosts are not connected to the port. Error Message VQPCLIENT-3-VLANNAME: Invalid VLAN ([chars]) in response Explanation This message means that the VMPS has specified a VLAN name that is unknown to the switch. [chars] is the invalid VLAN name. Recommended Action Make sure that the VLAN exists on the switch. Verify the VMPS configuration. Error Message VQPCLIENT-3-IFNAME: Invalid interface ([chars]) in response Explanation This message means that the VMPS has sent an unsolicited response with an unknown interface name. [chars] is the name of the unknown interface. Recommended Action Verify the VMPS configuration. Error Message VQPCLIENT-7-NEXTSERV: Trying next VMPS Explanation This message means that the system has lost connectivity with the current VMPS and is changing to the next server in its list. Recommended Action This is a debug message only. No action is required. 2-60 Catalyst 3750 Switch System Message Guide 78-15166-02 Chapter 2 Message and Recovery Procedures VQPCLIENT Messages Error Message VQPCLIENT-7-PROBE: Probing primary server [IP_address] Explanation This message means that the system is trying to reestablish connectivity with the primary VMPS at the given IP address. Recommended Action This is a debug message only. No action is required. Error Message VQPCLIENT-7-RECONF: Reconfirming VMPS responses Explanation This message means that the switch is reconfirming all responses with the VMPS. Recommended Action This is a debug message only. No action is required. IN-1 Catalyst 3750 Switch System Message Guide 78-15166-02 I N D E X A abbreviations char, variable field 1-4 chars, variable field 1-4 dec, variable field 1-4 enet, variable field 1-4 hex, variable field 1-4 inet, variable field 1-4 Access Control List manager messages See ACLMGR messages ACLMGR messages 2-2 audience v C CFGMGR messages 2-5 Cisco Technical Assistance Center viii Cluster Membership Protocol messages See CMP messages CMP messages 2-7 codes 1-1 conventions command v for examples vi publication v text v D date/time stamp designations 2-1 documentation feedback vii obtaining CD-ROM vii world wide web vi ordering vii documentation, related vi document conventions v DTP messages 2-8 Dynamic Trunking Protocol messages See DTP messages E EC messages 2-9 ETHCNTR messages 2-13 EtherChannel controller messages See ETHCNTR messages EtherChannel messages See EC messages examples, conventions for vi EXPRESS_SETUP messages 2-14 F facility codes description 1-2 in system messages 1-1 table 1-2 feedback to Cisco Systems, web vii format of system messages 1-1Index IN-2 Catalyst 3750 Switch System Message Guide 78-15166-02 G GBIC security messages 2-14 Gigabit Interface Converter (SPF) security messages See GBIC guide audience v purpose of v H hardware messages 2-16 HLFM messages 2-17 hostnames in system messages 1-1 I image manager messages 2-18 See IMAGEMGR IMAGEMGR messages 2-18 inter-process communication protocol messages See Platform IPC messages L local forwarding manager messages See HLFM M message codes 1-2 message mnemonic code 1-4 messages ACL Manager 2-2 CFGMGR, Configuration Manager messages See CFGMGR messages CMP 2-7 DTP 2-8, 2-9 ETHCNTR 2-13 EXPRESS_SETUP 2-14 GBIC security 2-14 hardware 2-16 HLFM 2-17 IMAGEMGR 2-18 PAgP platform 2-19 platform IPC 2-20 platform PBR 2-21 platform PM 2-23 platform RPC 2-23 platform SPAN 2-25 platform UCAST 2-26 platform VLAN 2-27 PM 2-28 QOSMGR 2-35 SDM 2-39 SFP 2-40 SPAN 2-40 SPANTREE 2-40 SPANTREE_FAST 2-46 SPANTREE_VLAN_SWITCH 2-47 stack manager 2-47 STACKMGR 2-47 SUPERVISOR 2-49 supervisor ASIC 2-49 SUPQ 2-49 TCAMMGR 2-55 UDLD 2-57 UFAST_MCAST_SW 2-58 VQPCLIENT 2-59 message severity levels description 1-3 table 1-3 message text definition 1-4 mmemonic code 1-4Index IN-3 Catalyst 3750 Switch System Message Guide 78-15166-02 N notes date/time stamp designation 2-1 described vi P PAgP messages See EC messages Platform IPC messages 2-20 Platform messages 2-19 Platform PBR messages 2-21 Platform PM messages 2-23 Platform RPC messages 2-23 Platform SPAN messages 2-25 Platform UCAST messages 2-26 Platform VLAN messages 2-27 PM messages 2-28 policy-based routing messages See Platform PBR messages Port Aggregation Protocol messages See PAgP messages port manager messages See PM messages port manager messages, platform See Platform PM messages publications, related vi publications for products, technologies, and network solutions ix Q QOSMGR messages 2-35 quality of service manager messages See QOSMGR messages R remote procedure call messages See Platform RPC messages S SDM messages 2-39 security device manager messages See SDM messages severity levels description 1-3 table 1-3 SFP messages 2-40 SFP security messages See GBIC security messages. small form factor pluggable messages See SFP messages SPAN messages 2-40 spanning tree fast convergence See SPANTREE_FAST messages spanning tree messages See SPANTREE messages spanning tree per-VLAN messages See SPANTREE_VLAN_SWITCH messages SPANTREE_FAST messages 2-46 SPANTREE_VLAN_SWITCH Messages 2-47 SPANTREE Messages 2-40 stack manager messages 2-47 See STACKMGR messages STACKMGR messages 2-47 supervisor ASIC messages 2-49 SUPERVISOR messages 2-49 supervisor queue messages See SUPQ messages SUPQ messages 2-49 switched port analyzer messages See SPAN messagesIndex IN-4 Catalyst 3750 Switch System Message Guide 78-15166-02 switched port analyzer messages, platform See Platform SPAN messages system message format 1-1 T tables message severity levels 1-3 variable fields 1-4 TAC inquiries viii toll-free telephone numbers ix website ix TCAM manager messages 2-55 TCAMMGR messages 2-55 technical assistance Cisco.com viii TAC viii TAC website ix toll-free telephone numbers ix ternary content addressable memory manager messages See TCAMMGR messages timestamp information 1-1 traceback reports 1-4 U UDLD messages 2-57 UFAST_MCAST_SW messages 2-58 unicast routing messages See Platform UCAST messages UniDirectional Link Detection messages See UDLD messages uplink fast packet transmission messages See UFAST_MCAST_SW messages V variable fields definition 1-4 table 1-4 VLAN manager messages messages SW_VLAN 2-51 VLAN Query Protocol Client messages See VQPCLIENT messages VQPCLIENT messages 2-59 VTP messages See SW_VLAN messages Corporate Headquarters: Copyright © 2003 Cisco Systems, Inc. All rights reserved. Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 July 2003 The Cisco IOS Release 12.1(14)EA1 runs on all Catalyst 3750 switches. Catalyst 3750 switches support stacking through Cisco StackWise technology. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. These release notes include important information about this Cisco IOS release and any limitations, restrictions, and caveats that apply to it. Verify that these release notes are correct for your switch: • If you are installing a new switch, refer to the Cisco IOS release label on the rear panel of your switch. • If your switch is on, use the show version privileged EXEC command. See the “Determining the Software Version and Feature Set” section on page 4. • If you are upgrading to a new release, refer to the software upgrade filename for the software version. For the complete list of Catalyst 3750 switch documentation, see the “Related Documentation” section on page 30. You can download the switch software from these sites: • http://www.cisco.com/kobayashi/sw-center/sw-lan.shtml (for registered Cisco.com users with a login password) • http://www.cisco.com/public/sw-center/sw-lan.shtml (for nonregistered Cisco.com users) This software release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future software releases become available, they will be posted to Cisco.com (previously Cisco Connection Online [CCO]) in the Cisco IOS software area. Note If you are upgrading a switch that uses the 802.1X feature, you must re-enable 802.1X after upgrading the software. For more information, see the “Cisco IOS Notes” section on page 20.2 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Contents Contents This information is in the release notes: • “System Requirements” section on page 2 • “Downloading Software” section on page 4 • “Installation Notes” section on page 7 • “New Features” section on page 13 • “Limitations and Restrictions” section on page 15 • “Important Notes” section on page 20 • “Open Caveats” section on page 22 • “Resolved Caveats” section on page 26 • “Documentation Updates” section on page 30 • “Related Documentation” section on page 30 • “Obtaining Documentation” section on page 31 • “Obtaining Technical Assistance” section on page 32 System Requirements These are the system requirements for this software release: • “Hardware Supported” section on page 2 • “Software Compatibility” section on page 3 Hardware Supported Table 1 lists the hardware supported by this software release. Table 1 Supported Hardware Switch Description Catalyst 3750G-12S 1 1. New hardware supported in this release 12 small form-factor pluggable (SFP) module slots Catalyst 3750-24TS 24 10/100 Ethernet ports and 2 SFP module slots Catalyst 3750G-24T 24 10/100/1000 Ethernet ports Catalyst 3750G-24TS 24 10/100/1000 Ethernet ports and 4 SFP module slots Catalyst 3750-48TS 48 10/100 Ethernet ports and 4 SFP module slots SFP modules 1000BASE-T 1 , 1000BASE-SX, 1000BASE-LX and 1000BASE-ZX 1 Redundant power system Cisco RPS 300 redundant power system for the Catalyst 3750G-24TS, 3750G-24T, and 3750-48TS switch models (not supported on the Catalyst 3750-24TS switch) Cisco RPS 675 redundant power system for the entire Catalyst 3750 switch family3 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 System Requirements Software Compatibility For information about the recommended platforms for web-based management, operating systems and browser support, Java plug-in guidelines and installation procedures, refer to the Catalyst 3750 Switch Hardware Installation Guide. Creating Clusters with Different Releases of Cisco IOS Software When a cluster consists of a mixture of Catalyst switches, the Catalyst 3750 must be the command switch. The Catalyst 3750 switch can be part of a cluster as a standalone switch or as a switch stack. In a cluster, a switch stack is treated as a single entity. When the command switch is a Catalyst 3750 switch, all standby command switches must also be Catalyst 3750 switches. The Catalyst 3750 switch that has the latest software should be the command switch. If the command switch is a Catalyst 3750 Gigabit Ethernet switch and the standby command switch is a Catalyst 3750 Fast Ethernet switch, command switch port speeds are reduced if the standby command switch takes over. Table 2 lists the cluster capabilities and software versions for the switches. The switches are listed in the order of highest to lowest end switch. A lower-end switch cannot be the command switch of a switch listed above it in the table (for example, a Catalyst 2950 switch cannot be the command switch of a cluster that has Catalyst 2970 or Catalyst 3550 switches). Some versions of the Catalyst 2900 XL software do not support clustering, and if you have a cluster with switches that are running different versions of Cisco IOS software, software features added on the latest release might not be reflected on switches running the older versions. For example, if you start CMS on a Catalyst 2900 XL switch running Release 11.2(8)SA6, the windows and functionality can be different from a switch running Release 12.0(5)WC(1) or later. Table 2 Switch Software and Cluster Capability Switch Cisco IOS Release Cluster Capability Catalyst 3750 12.1(11)AX or later Member or command switch Catalyst 3550 12.1(4)EA1 or later Member or command switch Catalyst 2970 12.1(11)AX or later Member or command switch Catalyst 2950 12.1(5.2)WC(1) or later Member or command switch Catalyst 2955 12.1(12c)EA1 or later Member or command switch Catalyst 2940 12.1(13)AY or later Member or command switch Catalyst 3500 XL 12.0(5.1)XU or later Member or command switch Catalyst 2900 XL (8-MB switches) 12.0(5.1)XU or later Member or command switch Catalyst 2900 XL (4-MB switches) 11.2(8.5)SA6 (recommended) Member switch only 1 1. Catalyst 2900 XL (4-MB) switches appear in the front-panel and topology views of the Cluster Management Suite (CMS). However, CMS does not support configuration or monitoring of these switches. Catalyst 1900 and 2820 9.00(-A or -EN) or later Member switch only4 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Downloading Software Note The CMS is not forward-compatible, which means that if a member switch is running a software version that is newer than the release running on the command switch, the new features are not available on the member switch. If the member switch is a new device supported by a software release that is later than the software release on the command switch, the command switch cannot recognize the member switch, and it is displayed as an unknown device in the Front Panel view. You cannot configure any parameters or generate a report through CMS for that member; instead, you must launch the Device Manager application to configure and to obtain reports for that member. Downloading Software These are the procedures for downloading software: • “Determining the Software Version and Feature Set” section on page 4 • “Determining Which Files to Use” section on page 5 • “Upgrading a Switch by Using CMS” section on page 5 • “Upgrading a Switch by Using the CLI” section on page 5 • “Recovering from a Software Failure” section on page 6 Note Before downloading software, read this section for important information. Determining the Software Version and Feature Set The Cisco IOS image is stored as a .bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board Flash device (flash:). You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line displays C3750-I5-M for the enhanced multilayer image (EMI) or C3750-I9-M for the standard multilayer software image (SMI). Note Although the show version output always shows the software image running on the switch (Layer 2 or Layer 2/3), the model name shown at the end of this display is the factory configuration (SMI or EMI) and does not change if you upgrade the software image. You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in Flash memory.5 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Downloading Software Determining Which Files to Use The upgrade procedures in these release notes describe how to perform the upgrade by using a combined .tar file. This file contains both the Cisco IOS image file and the files needed for the CMS. You must use the combined .tar file to upgrade the switch through the CMS. To upgrade the switch through the CLI, use the .tar file and the archive download-sw privileged EXEC command. Table 3 lists the software filenames for this software release. Upgrading a Switch by Using CMS You can upgrade switch software by using CMS. From the menu bar, select Administration > Software Upgrade. For detailed instructions, click Help. Upgrading a Switch by Using the CLI This procedure is for copying the combined .tar file to the Catalyst 3750 switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image. To download software, and if necessary, the TFTP server application, follow these steps: Step 1 Use Table 3 on page 5 to identify the file that you want to download. Step 2 Download the software image file. • If you have a SmartNet support contract, go to this URL and log in to download the appropriate files: http://www.cisco.com/kobayashi/sw-center/sw-lan.shtml Table 3 Cisco IOS Software Image Files for Catalyst 3750 Switches Filename Description c3750-i9-tar.121-14.EA1.tar Cisco IOS SMI image file and CMS files. This image has Layer 2+ and basic Layer 3 routing features including access control lists (ACLs), quality of service (QoS), static routing, and the Routing Information Protocol (RIP). c3750-i5-tar.121-14.EA1.tar Cisco IOS EMI image file and CMS files. This image has both Layer 2+ and full Layer 3 routing features (IP unicast routing, IP multicast routing, and fallback bridging). The EMI includes protocols such as the Interior Gateway Routing Protocol (IGRP), Enhanced IGRP (EIGRP), Open Shortest Path First (OSPF) Protocol, and Border Gateway Protocol (BGP). c3750-i9k2-tar.121-14.EA1.tar Cisco IOS SMI crypto image file and CMS files. This image has the Kerberos, SSH, and Layer 2+, and basic Layer 3 routing features. c3750-i5k2-tar.121-14.EA1.tar Cisco IOS EMI crypto image file and CMS files. This image has the Kerberos, SSH, Layer 2+, and full Layer 3 features.6 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Downloading Software • If you do not have a SmartNet contract, go to this URL and follow the instructions to register on Cisco.com and download the appropriate files: http://www.cisco.com/public/sw-center/sw-lan.shtml To download the SMI and EMI files, select Catalyst 3750 software. To obtain authorization and to download the crypto software files, select Catalyst 3750 3DES Cryptographic Software. Step 3 Copy the image to the appropriate TFTP directory on the workstation, and make sure the TFTP server is properly configured. For more information, refer to Appendix B in the software configuration guide for this release. Step 4 Log in to the switch through the console port or a Telnet session. Step 5 Ensure that you have IP connectivity to the TFTP server by using this privileged EXEC command: Switch# ping tftp-server-address For more information about assigning an IP address and default gateway to the switch, refer to the Catalyst 3750 Switch Software Configuration Guide. Step 6 Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by using this privileged EXEC command: archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar The /overwrite option overwrites the software image in Flash memory with the downloaded one. The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved. For //location, specify the IP address of the TFTP server. For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive. This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch: Switch# archive download-sw /overwrite tftp://198.30.20.19/c3750-i9-tar.121-14.EA1.tar You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option. Recovering from a Software Failure Switch software can be corrupted during an upgrade, by downloading the wrong file to the switch, and by deleting the image file. In all of these cases, the switch does not pass the power-on self-test (POST), and there is no connectivity. You can use the XMODEM protocol to recover from this failure. For detailed recovery procedures, refer to the “Troubleshooting” chapter in the software configuration guide for this release.7 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Installation Notes You can assign IP information to your switch by using these methods: • The Express Setup program (See the procedure that follows). • The setup program (Refer to the Catalyst 3750 Switch Hardware Installation Guide.) • The Dynamic Host Configuration Protocol (DHCP)-based autoconfiguration (Refer to the Catalyst 3750 Switch Software Configuration Guide.) • Manually assigning an IP address (Refer to the Catalyst 3750 Switch Software Configuration Guide.) Note If you are upgrading a switch that uses the 802.1X feature, you must re-enable 802.1X after upgrading the software. For more information, see the “Cisco IOS Notes” section on page 20. Using Express Setup to Configure a Switch Express Setup is a browser-based program that you can use to set up and configure the switch. You assign the IP information so that the switch can connect to local routers and the Internet. The IP address is also required if you plan to further configure the switch. You do not create a username with Express Setup. Express Setup provides the minimum configuration to configure a switch. To create a username for the switch, use the Cluster Management Suite (CMS) or the command-line interface (CLI). Note To use Express Setup, you must have Cisco IOS Release 12.1(14)EA1 or later running on your switch. This section provides a quick step-by-step setup procedure for a standalone switch and includes these steps: • Starting Express Setup, page 8 • Configuring the Switch Settings, page 10 • Clearing the Switch IP Address and Configuration, page 13 • Where to Go Next, page 13 Caution Do not start Express Setup when there are any devices connected to the switch or connect a switch that is already in Express Setup mode to any device other than the PC or workstation that is being used to configure it. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch. Before using Express Setup to configure a switch, refer to the switch hardware installation guide for this information: • Removing the switch and AC power cord from the shipping container • Getting an Ethernet (Category 5) straight-through cable to connect the switch to your PC or workstation • Powering on the switch8 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Note The illustrations in this section show the Catalyst 2940 switch, but the Mode button, LEDs, and switch ports are similar on your switch. Starting Express Setup Before starting Express Setup, verify that the switch has passed the power-on self-test (POST). The SYST and STAT LEDs are green if the switch has passed POST. For information about troubleshooting a POST failure, refer to the switch hardware installation guide. You cannot start Express Setup until POST has completed. Follow these steps to start the Express Setup program: Step 1 Verify that no devices are connected to the switch. Step 2 Press and hold the Mode button, as shown in Figure 1, until the four LEDs next to the Mode button turn green. This takes approximately 2 seconds. Note If all of the Mode LEDs begin to blink after you have held the Mode button for 2 seconds, a configuration already exists on the switch and the switch cannot go into Express Setup mode. Release the button. For more information, see the “Clearing the Switch IP Address and Configuration” section on page 13. Caution If you continue to hold the button for 8 more seconds, the switch configuration is deleted and the switch reloads. Figure 1 Starting Express Setup Step 3 When the LEDs turn green, release the Mode button. Step 4 Connect the Ethernet cable (not included) to a 10/100 Ethernet port on the front panel of the switch, as shown in Figure 2. 1 Mode button 1x 2x 3x 4x 5x SYST STAT DPLX SPD MODE 89489 19 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Caution Do not connect the switch to any device other than the PC or workstation being used to configure it. Figure 2 Connecting the Switch and PC or Workstation Ethernet Ports Step 5 Connect the other end of the cable to the Ethernet port on the PC or workstation. Verify that the port status LED on the switch Ethernet port is green. Step 6 Wait approximately 30 seconds after the port LED turns green, and launch a web browser on your PC or workstation. Step 7 Enter the IP address 10.0.0.1 in the browser, as shown in Figure 3, and press Enter. Figure 3 Entering the IP Address The Express Setup home page appears, as shown in Figure 4. 1 Switch 3 PC or workstation 2 Ethernet cable 9 1 100Base-FX SFP 1x 2x 3x 4x 5x 6x 7x 8x Catalyst 2940 SERIES SYST STAT DPLX SPD MODE 1 89491 3 210 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Figure 4 Express Setup Home Page If the Express Setup does not run, or the Express Setup home page does not appear in your browser: • Did you wait 30 seconds after connecting the switch and PC or workstation before entering the IP address in your browser? If not, wait 30 seconds and re-enter 10.0.0.1 and press Enter. • Did you enter the wrong address in your web browser, or is there an error message displayed in the browser window? Re-enter 10.0.0.1 and press Enter. • Did you connect a crossover instead of a straight-through Ethernet cable between an Ethernet port of the switch and the Ethernet port of the PC or workstation, as shown Figure 2? If not, reconnect the cable to the Ethernet port on the switch and PC or workstation. Wait 30 seconds before entering 10.0.0.1 in the browser. • Did you verify that POST successfully ran before starting Express Setup? If not, make sure that only the SYST and STAT LEDs are green before pressing the Mode button to begin Express Setup. Note The rest of this section explains how to configure a switch by using the Express Setup web page. To configure the switch by using the CLI-based setup program, refer to the switch hardware installation guide. Configuring the Switch Settings The Management Interface field displays VLAN1-Default. This is the management interface through which you manage the switch and to which you assign IP information.11 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Follow these steps to configure your switch with Express Setup: Step 1 Contact your system administrator and obtain the IP address, the IP subnet mask, and the default gateway for your switch. Step 2 Enter the IP address of the switch in the IP Address field. Step 3 Click the drop-down arrow in the IP Subnet Mask field, and select an IP Subnet Mask. Step 4 Enter the IP address for the default gateway in the Default Gateway field. A gateway (router or dedicated network device) is a system that connects a network on one subnet to one or more networks on a different subnet. Note You must specify a default gateway if the management workstation and the switch are on different IP segments. Step 5 Enter your password in the Switch Password field. The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end. Step 6 Enter your password again in the Confirm Switch Password field. You do not enter a username for the switch. After the switch is configured with an IP address, you can use CMS to configure a username. Step 7 (Optional) Enter a host name for the switch in the Host Name field. The host name is limited to 31 characters; embedded spaces are not allowed. Step 8 (Optional) Enter the name of your system contact in the System Contact field. This identifies the system administrator for the switch or network. Step 9 (Optional) Enter your system location in the System Location field. This identifies the physical location of the switch. Step 10 (Optional) Click Enable in the Telnet Access field if you are going to use Telnet to manage the switch by using the CLI. If you enable Telnet access, you must enter a Telnet password: a. Enter a password in the Telnet Password field. The Telnet password can be from 1 to 25 alphanumeric characters, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end. b. Enter the Telnet password again in the Confirm Telnet Password field. Step 11 (Optional) Click Enable to configure Simple Network Management Protocol (SNMP). Enable SNMP only if you plan to manage switches by using Cisco Works or another SNMP-based network-management system. If you enable SNMP, you must enter a community string in either the SNMP Read Community field, the SNMP Write Community field, or both. SNMP community strings authenticate access to MIB objects. Embedded spaces are not allowed in SNMP community strings. If you set the SNMP read community, users can access MIB objects, but cannot modify them. If you set the SNMP write community, users can access and modify MIB objects. Step 12 Click Save to save your settings to the switch, or click Cancel to clear your settings. After you save your settings, the switch exits Express Setup mode. Your switch is now configured with the new IP address. You can install the switch in your production network.12 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Installation Notes Verifying Switch IP Address (Optional) After you have installed the switch in your network, follow these steps to verify the IP address configured on your switch: Step 1 Launch a web browser on a PC or workstation that is connected the network. Step 2 Enter the IP address of your switch (for example: 172.20.139.142.) The switch home page appears, as shown in Figure 5. Figure 5 Switch Home Page Re-Running Express Setup If you did not click Save at the end of the “Configuring the Switch Settings” section on page 10 section, you can re-run Express Setup by clicking Express Setup on the Switch home page. If you have entered a wrong IP address or need to change the IP address of your switch, you can clear the IP address on your switch by following the steps in the “Clearing the Switch IP Address and Configuration” section on page 13.13 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 New Features Clearing the Switch IP Address and Configuration If you have configured a new switch with a wrong IP address, or all the switch LEDs start blinking when you are trying to enter Express Setup mode, you can clear the IP address that is configured on the switch. Note This procedure clears the IP address and all configuration information stored on the switch. Do not follow this procedure unless you want to completely reconfigure the switch. To clear the IP address and the switch configuration information, follow these steps: Step 1 Press and hold the Mode button, as shown in Figure 1 on page 8. The switch LEDs begin blinking after about 2 seconds. Step 2 Continue holding down the Mode button. The LEDs stop blinking after 8 additional seconds, and then the switch reboots. Note These steps only works on a previously configured switch. Where to Go Next After you have saved your configuration to the switch, you can install the switch (refer to the switch hardware installation guide) or further configure it (refer to the switch software configuration guide). New Features These are the new supported hardware and the new software features provided this release: • “New Hardware Features” section on page 13 • “New Software Features” section on page 13 New Hardware Features For a list of all supported hardware, see the “Hardware Supported” section on page 2. New Software Features Cisco IOS release 12.1(14)EA1 contains these new features or enhancements: • Express Setup for quickly configuring a switch for the first time with basic IP information, contact information, switch and Telnet passwords, and SNMP information through a browser-based program. For more information, see Using Express Setup to Configure a Switch, page 7. • IEEE 802.1S Multiple Spanning Tree Protocol (MSTP) for grouping VLANs into a spanning-tree instance and for providing multiple forwarding paths for data traffic14 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 New Features • Rapid per-VLAN Spanning-Tree plus (Rapid-PVST+) based on IEEE 802.1W Rapid Spanning Tree Protocol (RSPT) for rapid convergence of the spanning tree upon network failure and topology changes • Trusted boundary to detect the presence of a Cisco IP phone, to trust the Class of Service (CoS) value received, and to ensure port security • Automatic quality of service (QoS) to simplify the deployment of existing QoS features by classifying traffic and configuring ingress and egress queues (voice over IP only) • Link Aggregation Control Protocol (LACP) to facilitate the automatic creation of EtherChannels by exchanging packets between Ethernet interfaces. LACP is defined in IEEE 802.3AD. • Support for these new security features: – 802.1X with per-user access control lists for providing different levels of network access and service to an 802.1X-authenticated user – 802.1X with VLAN assignment for restricting 802.1X-authenticated users to a specified VLAN – 802.1X with port security for controlling access to 802.1X ports – 802.1X with voice VLAN to detect the presence of a Cisco IP phone and permit the IP phone access to voice VLAN irrespective of the authorized or unauthorized state of the port – 802.1X with guest VLAN to provide limited services to clients that might not be 802.1X-compliant • SPAN and RSPAN support of Intrusion Detection Systems (IDS) to monitor, repel, and report network security violations • VLAN1 minimization for reducing the risk of spanning-tree loops or storms by allowing VLAN1 to be disabled on any individual VLAN trunk link. With this feature enabled, no user traffic is sent or received on the trunk. The switch CPU continues to send and receive control protocol frames. • Port security enhancements, including support for CISCO-PORT-SECURITY-MIB, trunk ports and sticky MAC addresses, and the maximum number of secure MAC addresses specified in the SDM template • Automatic media-dependent interface crossover (Auto MDIX) capability on 10/100 and 10/100/1000 Mbps interfaces that enables the interface to automatically detect the required cable connection type (straight through or crossover) and configure the connection appropriately • Support for standard and extended IP access control lists (ACLs) and extended MAC ACLs in the inbound direction on Layer 2 interfaces (port ACLs). • In-band management access through SNMPv3. SNMP version 3 AuthPriv mode requires the cryptographic (encrypted) version of the switch software image SMI and EMI. • A new show interface capability privileged EXEC command to display configuration capability of a port • Support for the 10/100/1000BASE-T and 1000BASE-ZX SFP modules • Border Gateway Protocol (BGP) Version 4 (requires the enhanced multilayer image) • Policy-based routing (PBR) for configuring defined policies for traffic flows • Support for the Catalyst 3750G-12S • In-band management access for up to five simultaneous, encrypted Secure Shell (SSH) connections for multiple CLI-based sessions over the network (requires the cryptographic [that is, supports encryption] versions of the SMI and EMI) • Kerberos security system to authenticate requests for network resources by using a trusted third party (requires the cryptographic [that is, supports encryption] versions of the SMI and EMI)15 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Limitations and Restrictions • Layer 2 traceroute to identify the physical path that a packet takes from a source device to a destination device For a detailed list of key features for this software release, refer to the Catalyst 3750 Switch Software Configuration Guide. Limitations and Restrictions You should review this section before you begin working with the switch. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software. These are the limitations and restrictions: • “Cisco IOS Limitations and Restrictions” section on page 15 • “Cluster Limitations and Restrictions” section on page 18 • “CMS Limitations and Restrictions” section on page 19 Cisco IOS Limitations and Restrictions These limitations apply to Cisco IOS configuration: • Non-reverse-path forwarded (RPF) IP multicast traffic to a group that is bridged in a VLAN is leaked onto a trunk port in the VLAN even if the port is not a member of the group in the VLAN, but it is a member of the group in some other VLAN. Because unnecessary traffic is sent on the trunk port, it needlessly reduces the bandwidth of the port. There is no workaround for this problem because non-RPF traffic is continuous in certain topologies. As long as the trunk port is a member on a trunk port in at least one VLAN, this problem for the non-RPF traffic occurs. (CSCdu25219) • If a bridge group contains a VLAN that has a static MAC address configured, all non-IP traffic in the bridge group with this MAC address destination is sent to all ports in the bridge group. The workaround is to remove the VLAN from the bridge group or to remove the static MAC address from the VLAN. (CSCdw81955) • If the number of multicast routes and Internet Group Management Protocol (IGMP) groups are more than the maximum number specified with the show sdm prefer global configuration command, the traffic received on unknown groups is flooded in the received VLAN even though the show ip igmp snooping multicast-table privileged EXEC command output shows otherwise. The workaround is to reduce the number of multicast routes and IGMP snooping groups to less than the maximum supported value. (CSCdy09008) • An egress SPAN copy of routed unicast traffic might show an incorrect destination MAC address on both local and remote SPAN sessions. This limitation does not apply to bridged packets. The workaround for local SPAN is to use the replicate option. For a remote SPAN session, there is no workaround. This is a hardware limitation. (CSCdy72835) • Egress SPAN routed packets (both unicast and multicast) show the incorrect source MAC address. For remote SPAN packets, the source MAC address should be the MAC address of the egress VLAN, but instead the packet shows the MAC address of the remote SPAN (RSPAN) VLAN. For local SPAN packets with native encapsulation on the destination port, the packet shows the MAC address of VLAN 1. This problem does not appear with local SPAN when the encapsulation replicate option is used. This limitation does not apply to bridged packets. The workaround is to use the encapsulate replicate keywords in the monitor session global configuration command. Otherwise, there is no workaround. This is a hardware limitation. (CSCdy81521)16 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Limitations and Restrictions • IGMP filtering is applied to packets that are forwarded through hardware. It is not applied to packets that are forwarded through software. Hence, with multicast routing enabled, the first few packets are sent from a port even when IGMP filtering is set to deny those groups on that port. There is no workaround. (CSCdy82818) • A static IP address might be removed when the previously acquired Dynamic Host Configuration Protocol (DHCP) IP address lease expires. This problem occurs under these conditions: – When the switch is booted without a configuration (no config.text file in Flash memory). – When the switch is connected to a DHCP server that is configured to give an address to it (the dynamic IP address is assigned to VLAN 1). – When an IP address is configured on VLAN 1 before the dynamic address lease assigned to VLAN 1 expires. The workaround is to reconfigure the static IP address. (CSCea71176) • The Catalyst 3750 switch treats frames received with mixed encapsulation (802.1Q and Inter-Switch Link [ISL]) as frames with FCS errors, increments the error counters, and causes the LED to blink amber. This happens when an ISL-unaware device receives an ISL-encapsulated packet and forwards the frame to an 802.1Q trunk interface. There is no workaround. (CSCdz33708) • IP-option software-forwarded traffic is sometimes leaked unnecessarily on a trunk port. Suppose the trunk port in question is member of an IP multicast group in VLAN X, but it is not a member in VLAN Y. In VLAN Y, there is another port that has membership to the group, and VLAN Y is the output interface for the multicast route entry corresponding to the group. IP options traffic received on an input interface VLAN (other than VLAN Y) is unnecessarily sent on the trunk port in VLAN Y because the trunk port is forwarding in VLAN Y (even though the port has no group membership in VLAN Y). There is no workaround. (CSCdz42909) • Known unicast (secured addresses) are flooded within a bridge group under these conditions: If secure addresses are learned or configured on a port and the VLAN on this port is part of a bridge group, non-IP traffic destined to the secure addresses is flooded within the bridge group. The workaround is to disable fallback bridging. To remove an interface from a bridge group and to remove the bridge group, use the no bridge-group bridge-group interface configuration command. Another workaround is to disable port security on all ports in all VLANs participating in fallback bridging by using the no switchport port-security interface configuration command. (CSCdz80499) • When you use the ip access-group interface configuration command with a router ACL to deny access to a group in a VLAN, multicast data to the group that is received in the VLAN is always flooded in the VLAN regardless of IGMP group membership in the VLAN. This provides reachability to directly connected clients, if any, in the VLAN. The workaround is to not apply a router ACL set to deny access to a VLAN interface. Apply the security through other means; for example, apply VLAN maps to the VLAN instead of using a router ACL for the group. (CSCdz86110) • SNAP-encapsulated IP packets are dropped without an error message being reported at the interface. The switch does not support SNAP-encapsulated IP packets. There is no workaround. (CSCdz89142) • The switch does not create an adjacency table entry when the ARP timeout value is 15 seconds and the ARP request times out. The workaround is to not set an ARP timeout value lower than 120 seconds. (CSCea21674)17 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Limitations and Restrictions • If a Catalyst 3750 switch stack is connected to a designated bridge and the root port of the switch stack is on a different switch than the alternate root port, changing the port priority of the designated ports on the designated bridge has no effect on the root port selection for the Catalyst 3750 switch stack. There is no workaround. (CSCea40988) • A route map that contains an ACL with a DSCP clause cannot be applied to a Layer 3 interface. The Catalyst 3750 rejects this configuration and issues an error message saying that the route map is unsupported. There is no workaround. (CSCea52915) • If the stack master is power cycled immediately after entering the ip mroute global configuration command, there is a slight chance that this configuration change will be lost after the stack master switchover. This occurs because the stack master did not have time to propagate the running configuration to all the stack members before it was powered down. This problem might also affect other configuration commands. There is no workaround. (CSCea71255) • If there are a large number of SVIs, routes, or both on a fully populated nine-member switch stack, an error message like the following might appear when you reload the switch stack or add a switch to the stack: %SYS-2-MALLOCFAIL: Memory allocation of 4252 bytes failed from 0x179C80, alignment 0 Pool: I/O Free: 77124 Cause: Memory fragmentation Alternate Pool: None Free: 0 Cause: No Alternate pool This error message indicates a temporary memory shortage that normally recovers by itself. You can verify that the switch stack has recovered by entering the show cef line user EXEC commend and verifying that the line card states are up and sync. No workaround is required because the problem is self-correcting. (CSCea71611) • During periods of very high traffic, when two RSPAN source sessions are configured, the VLAN ID of packets in one RSPAN session might overwrite the VLAN ID of the other RSPAN session. If this occurs, packets intended for one RSPAN VLAN are incorrectly sent to the other RSPAN VLAN. This problem does not affect RSPAN destination sessions. The workaround is to configure only one RSPAN source session. (CSCea72326) • Some switch queues are disabled if the buffer size or threshold level is set too low with the mls qos queue-set output global configuration command. The ratio of buffer size to threshold level should be greater than 10 to avoid disabling the queue. The workaround is to choose compatible buffer sizes and threshold levels. (CSCea76893) • A Gigabit Ethernet connection between a SGMII (Serial Gigabit Media Independent Interface) port (3/4, 7/8, 11/12, 15/16, 19/20, and 23/24) and an Intel Pro/1000T Server Adapter NIC might loose connectivity on the Catalyst 3750G-24T and Catalyst 3750G-24TS switches. The link activates correctly, but might subsequently stop exchanging data. This is an Intel product defect. The workaround is to use RGMII (Reduced Gigabit Media Independent Interface) ports (1/2, 5/6, 9/10, 13/14, 17/18, and 21/22) instead of SGMII ports. Alternatively, use the speed 1000 interface configuration command to force the speed of the port to 1000. (CSCea77032) • When an IP phone is connected to the switch, the Port VLAN ID (PVID) and the Voice VLAN ID (VVID) both learn its MAC address. However, after dynamic MAC addresses are deleted, only the VVID relearns the phone MAC address. MAC addresses are deleted manually or automatically for a topology change or when port security or an 802.1X feature is enabled or disabled. There is no workaround. (CSCea80105) • After changing the access VLAN on a port that has 802.1X enabled, the IP phone address is removed. Because learning is restricted on 802.1X capable ports, it takes approximately 30 seconds before the address is relearned. No workaround is necessary. (CSCea85312)18 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Limitations and Restrictions • The egress SPAN data rate might degrade when fallback bridging or multicast routing is enabled. The amount of degradation depends on the processor loading. Typically, the switch can egress SPAN up to 40,000 packets per second (64-byte packets). As long as the total traffic being monitored is below this limit, there is no degradation. However, if the traffic being monitored exceeds the limit, only a portion of the source stream is spanned. When this occurs, the following console message appears: Decreased egress SPAN rate. In all cases, normal traffic is not affected; the degradation limits only how much of the original source stream can be egress spanned. If fallback bridging and multicast routing are disabled, egress SPAN is not degraded. There is no workaround. If possible, disable fallback bridging and multicast routing. If possible, use ingress SPAN to observe the same traffic. (CSCeb01216) • A Catalyst 3750 switch might not be able to pass Vine (Advanced Research Projects Agency) ARPA frames over bridge groups. The workaround is to use Subnetwork Access Protocol (SNAP) frames. (CSCeb10032) • If a 10/100BASE-T port configured for forced 100 mbps full-duplex mode is connected to a link partner that is auto-negotiating, the link partner comes up in 100 mbps full-duplex mode. However, if the same link partner is connected to a Gigabit port configured for forced 100 mbps full-duplex mode, the link comes up in 100 mbps half-duplex mode. The reason for this inconsistent behavior is that the 10/100 port auto-negotiates even if both speed and duplex mode are fixed, whereas the Gigabit port does not. This is a hardware limitation. No workaround is necessary. (CSCeb14068) • On Catalyst 3750 switches running Cisco IOS 12.1(14)EA1 software, some IGMP report and query packets with IP options might not be ingress-spanned. Packets that are susceptible to this problem are IGMP packets containing 4 bytes of IP options (IP header length of 24). An example of such packets would be IGMP reports and queries having the router alert IP option. Ingress-spanning of such packets is not accurate and can vary with traffic rate. Typically, very few or none of these packets are spanned. There is no workaround. (CSCeb23352) • If the number of VLANs times the number of trunk ports exceeds the recommended limit of 13,000, the switch can fail. The workaround is to reduce the number of VLANs or trunks. (CSCeb31087) Cluster Limitations and Restrictions These limitations apply to cluster configuration: • When there is a transition from the cluster active command switch to the standby command switch, Catalyst 1900, Catalyst 2820, and Catalyst 2900 4-MB switches that are cluster members might lose their cluster configuration. You must manually add these switches back to the cluster. (CSCds32517, CSCds44529, CSCds55711, CSCds55787, CSCdt70872) • When a Catalyst 2900 XL or Catalyst 3500 XL cluster command switch is connected to a Catalyst 3550 or to a Catalyst 3750 switch, the command switch does not find any cluster candidates beyond the Catalyst 3550 or the Catalyst 3750 switch if it is not a member of the cluster. You must add the Catalyst 3550 or the Catalyst 3750 switch to the cluster. You can then see any cluster candidates connected to it. (CSCdt09918) • If both the active command-switch and the standby command switch fail at the same time, the cluster is not automatically recreated. Even if there is a third passive command switch, it might not recreate all cluster members because it might not have all the latest cluster configuration information. You must manually recreate the cluster if both the active and standby command switches simultaneously fail. (CSCdt43501)19 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Limitations and Restrictions CMS Limitations and Restrictions These limitations apply to CMS configuration: • Host names and Domain Name System (DNS) server names that contain commas on a cluster command switch, member switch, or candidate switch can cause CMS to behave unexpectedly. You can avoid this instability in the interface by not using commas in host names or DNS names. Do not enter commas when entering multiple DNS names in the IP Configuration tab of the IP Management window in CMS. • Access control entries (ACEs) that contain the host keyword precede all other ACEs in standard access control lists (ACLs). You can reposition the ACEs in a standard ACL with one restriction: No ACE with the any keyword or a wildcard mask can precede an ACE with the host keyword. • CMS performance degrades if the Topology View is open for several hours on a Solaris machine. The cause might be a memory leak. The workaround is to close the browser, reopen it, and launch CMS again. (CSCds29230) • If you are printing a Topology View or Front Panel View that contains many devices and are running Solaris 2.6 with JDK1.2.2, you might get an Out of Memory error message. The workaround is to close the browser, re-open it, and launch CMS again. Before you perform any other task, bring up the view that you want to print, and click Print in the CMS menu. (CSCds80920) • If a PC running CMS has low memory and CMS is running continuously for 2 to 3 days, the PC runs out of memory. The workaround is to relaunch CMS. (CSCdv88724) • When a VLAN or a range of VLANs is already configured and you specify a VLAN filter for a SPAN session, the current configuration for that session is overwritten with the new entry. Although the CLI appends new entries after the existing ones, CMS recreates the whole session, overwrites the current entry, and provides only a single VLAN filter per entry. The workaround is to use the CLI. It is the only method for specifying multiple VLANs for filtering in a SPAN session. (CSCdw93904) • When you add a new member with a username and password that is different from the existing cluster members username and password, CMS produces an exception error because of an authentication failure. The workaround is to add the new member without any username and password. When the new member is added to the cluster, remove the existing username and password from the Username and Password fields, enter a new username and password, and then apply it to all cluster members. (CSCdz07957) • When the Link Graphs application has run for hours displaying packet drop and error information, sometimes the X-axis crosses the Y-axis at a negative y value instead of at y = 0. This condition occurs with all supported operating systems, browsers, and Java plug-ins. There is no workaround. (CSCdz32584) • CMS temporarily halts while starting. This occurs only when using Windows 98 and these combinations of Netscape browser and Java run-time environment: – Netscape 4.75 and JRE 1.3.1 or 1.4.0 – Netscape 6.2 and JRE 1.3.1 The workaround is to click once outside of the CMS Window. CMS then proceeds. (CSCdz72175) • The SNMP dialog box changes size after clicking Apply or Refresh. This behavior has no affect on SNMP functionality. There is no workaround. (CSCdz84255) • When you enable log scaling for link graphs, the Y-axis scale becomes illegible. There is no workaround. (CSCdz81086)20 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Important Notes • The CMS window does not return to full size after you resize elements when using Netscape version 6.xx on Solaris and Linux. This is a Netscape browser problem. There is no workaround. (CSCea01179) • CMS files that are downloaded from the switch to the local client machine are not cached on the local drive. As the result. the CMS files are downloaded every time CMS is invoked. There is no workaround. (CSCea26211) • CMS sometimes halts after you click Apply when using Netscape 4.7 on the Japanese version of Windows 98 or Windows ME. The workaround is to use Microsoft Internet Explorer or Netscape 6.0 or later. (CSCea27408) • The icons on the CMS menu toolbar become blank. This can happen when you unlock the PC with CMS running or interrupt the in-display screen saver. The workaround is to resize the CMS browser window so that the screen refreshes. (CSCea80753) • Changing the password or current authentication while CMS is running causes HTTP requests to fail. The workaround is to close all browser sessions and then relaunch CMS. (CSCeb33995) Important Notes These are the important notes related to this software release: • “Switch Stack Notes” section on page 20 • “Cisco IOS Notes” section on page 20 • “Cluster Notes” section on page 21 • “CMS Notes” section on page 21 Switch Stack Notes These notes apply to switch stacks. • Always power off a switch before adding or removing it from a switch stack. • Cisco IOS Release 12.1(14)EA1 is not backward-compatible with Cisco IOS Release 12.1(11)AX. If you add a switch running 12.1(14)EA1 to an existing stack running Cisco IOS Release 12.1(11)EA1, the added switch changes to version-mismatch state and cannot be configured for normal operation. You can either downgrade the new switch to the same version running on the stack master or upgrade the entire stack. Cisco IOS Notes This note applies to Cisco IOS. • The 802.1X feature in Cisco IOS Release 12.1(14)EA1 is not fully backward-compatible with the same feature in Cisco IOS Release 12.1(11)AX. If you are upgrading a switch running Cisco IOS Release 12.1(11)AX that has 802.1X configured, you must re-enable 801.1X after the upgrade by using the dot1x system-auth-control global configuration command. This global command does not exist in Cisco IOS Release 12.1(11)AX. Failure to re-enable 801.1X weakens security because some hosts can then access the network without authentication.21 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Important Notes Cluster Notes There are no cluster configuration notes to report. CMS Notes These notes apply to CMS configuration: • If you use CMS on Windows 2000, it might not apply configuration changes if you change the enable password from the CLI during your CMS session. You have to restart CMS and enter the new password when prompted. Platforms other than Windows 2000 prompt you for the new enable password when it is changed. • CMS does not display QoS classes that are created through the CLI if these classes have multiple match statements. When using CMS, you cannot create classes that match more than one match statement. CMS does not display policies that have such classes. • If you use Internet Explorer Version 5.5 and select a URL with a nonstandard port at the end of the address (for example, www.add.com:84), you must enter http:// as the URL prefix. Otherwise, you cannot launch CMS. • Within an ACL, you can change the sequence of ACEs that have the host keyword. However, because such ACEs are independent of each other, the change has no effect on the way the ACL filters traffic. • If you use the Netscape browser to view the CMS GUI and you resize the browser window while CMS is initializing, CMS does not resize to fit the window. Resize the browser window again when CMS is not busy. • CMS does not start if the temporary directory on your computer runs out of memory. This problem can occur because of a bug in the 1.2.2 version of the Java plug-in. The plug-in creates temporary files in the directory whenever it runs CMS, and the directory eventually runs out of plug-in space. The workaround is to remove all the jar_cache*.tmp files from the temporary directory. The path to the directory is different for different operating systems: Solaris: /var/tmp Windows NT and Windows 2000: \TEMP Windows 95 and 98: \Windows\Temp • In the Front Panel view or the Topology view, CMS does not display error messages in read-only mode for these switches: – Catalyst 2900 XL or Catalyst 3500 XL member switches running Cisco IOS Release 12.0(5)WC2 or earlier – Catalyst 2950 member switches running Cisco IOS Release 12.0(5)WC2 or earlier – Catalyst 3550 member switches running Cisco IOS Release 12.1(6)EA1 or earlier In the Front Panel view, if the switch is running one of the previously listed software releases, the device LEDs do not appear. In the Topology view, if the member is a Long-Reach Ethernet (LRE) switch, the customer premises equipment (CPE) connected to the switch does not appear. The Bandwidth and Link graphs also do not appear in these views. To view switch information, you need to upgrade the member switch software. For information about upgrading switch software, see the “Downloading Software” section on page 4.22 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Open Caveats Open Caveats These are the open caveats with possible unexpected activity in this software release: • “Open Cisco IOS Caveats” section on page 22 • “Open CMS Caveats” section on page 25 Open Cisco IOS Caveats These are the severity 3 Cisco IOS configuration caveats: • CSCdz30046 When multicast VLAN registration (MVR) groups are added or deleted, the receiver port that joined the groups after the addition still receives traffic even after the group is deleted. The correct behavior is that MVR data traffic to the group should stop flowing to the receiver port immediately after the no mvr group ip-address global configuration command is entered. The workaround is to disable MVR by using the no mvr global configuration command and then to re-enable it by using the mvr command. Add and delete the groups that have problems by using the mvr group ip-address and the no mvr group ip-address global configuration commands. • CSCea26207 If the stack master is reloaded immediately after adding multiple VLANs, the new stack master might fail. The workaround is to wait a few minutes after adding VLANs before reloading the stack master. • CSCea75390 When two RSPAN sessions are active at the same time, packets might swap VLAN IDs during periods of very high traffic. Packets with swapped VLAN IDs can be egressed spanned on VLAN 1. There is no workaround. • CSCea84802 While booting up a nine-member switch stack with a large number of SNMP traps enabled, some of the stack members might not come up fully and become operational. There are two possible scenarios: – The stack member stays in the initializing state. Use the show switch user EXEC command to detect this condition. Normally a switch joining the switch stack transitions from Initializing to Ready within 1 minute. – The stack member comes up in the ready state, but all ports on the stack member remain in the linkdown state even though link partners indicate a linkup state. The workaround is to reboot the whole switch stack using one of these methods: – Use the reload privileged EXEC command on the stack master. – Power cycle the stack master. • CSCea90131 Under the these conditions, the Catalyst 3750 might report a false security violation after an 802.1X supplicant is authenticated and assigned a new VLAN by the RADIUS server: – 802.1X, port security, and voice VLAN are configured on a stack member port. – Maximum number of secure addresses have been learned on the port before it is authenticated.23 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Open Caveats – The VLAN assigned by the RADIUS server is different than the access VLAN configured on the port. This problem does not prevent traffic from being forwarded to the 802.1X client, but the show port-security privileged EXEC command might indicate that the port is SecureDown when it is actually SecureUp and forwarding traffic correctly. The workaround is to restart the interfaces that appear to be out of sync by using the shutdown and then no shutdown interface configuration commands. • CSCeb01226 Gigabit Ethernet ports might have FCS errors when operating at Gigabit speeds on the Catalyst 3750G-24T and Catalyst 3750G-24TS switches. The FCS error rate for this condition is very low. The workaround is to restart the ports by using the shutdown and then no shutdown interface configuration commands. • CSCeb13978 A Distance Vector Multicast Routing Protocol (DVMRP) tunnel can remain down after reloading the switch. There is no workaround. • CSCeb14406 Distance Vector Multicast Routing Protocol (DVMRP) does not forward packets correctly. There is no workaround. • CSCeb29898 After booting up a switch stack that has more than 300 VLANs and the maximum number of static EtherChannel groups (12), all interfaces that are part of an EtherChannel might stay down. This occurs because the remote switch detects an EtherChannel misconfiguration and disables its ports. This problem can occur in either PVST+ or Rapid-PVST+ mode. The workaround is to restart the EtherChannel ports or configure automatic recovery: – Use the shutdown and no shutdown interface configuration commands on the remote switch to restart all err-disabled interfaces – Use the errdisable recovery cause channel-misconfig global configuration command to enable automatic link recovery on the remote switch, and use the errdisable recovery interval global configuration command to configure a short recovery interval. • CSCeb35263 After switches are added to or removed from a switch stack, the reconfiguration processes can defer normal CPU processes, such as CLI command handling, and make them unresponsive. The duration of the reconfiguration process depends on the size and nature of the running configuration, but the delay is not significant until the switch configuration exceeds several thousand lines. After the update finishes, CLI responsiveness returns. There is no workaround other than removing commands from the switch configuration. • CSCeb35422 On a voice VLAN port with both 802.1X and port security enabled, dynamic secure addresses might not get deleted when the port is changed from multihost mode to single-host mode. This means that addresses learned in the multihost mode are still allowed after changing to single-host mode. This problem occurs under the following conditions: – The port is in authorized state.24 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Open Caveats – The port learns the MAC address of multiple hosts. – VLAN assignment is not enabled for the authorized host. The workaround is to disable and then re-enable port security on the port. • CSCeb37125 If a switch stack is running fallback bridging and the switches in the switch stack have routed ports in the bridge-group, fallback bridging might not work. This occurs when the TCAM is full and a switch is added or deleted from the switch stack. The workaround is to stop traffic to free up space in TCAM and then to reload the whole switch stack. Then enable the traffic 1 minute after the switch stack comes back up. • CSCeb40267 If a Catalyst 3750 switch loaded with Cisco IOS Release 12.1(14)EA1 software is added to a switch stack running Cisco IOS Release 12.1(11)AX software, the stack member changes to version mismatch (as expected). If an SNMP application traverses the CISCO-FLASH-MIB, a stack member in version mismatch state can fail. The workaround is to avoid traversing the CISCO-FLASH-MIB while the switch stack is being upgraded from Cisco IOS Release 12.1(11)AX to Cisco IOS Release 12.1(14)EA1. • CSCeb42949 A Catalyst 3750 switch does not work with the User Registration Tool (URT). The PC attempting to connect to the network can log in successfully, but is not allowed to pass traffic after the port is moved to the user VLAN. The MAC address for that device shows BLOCKED. There is no workaround. • CSCeb42953 If an IP phone is connected to a port on the stack master, and 802.1X port security and voice VLAN are configured on the port, disabling port security causes the IP phone MAC address to be deleted from the MAC address table on all stack members. The MAC address table on the stack master retains the phone MAC address. There is no workaround. • CSCeb54159 If an interface on a Catalyst 3750 switch is mapped to queue-set 2, and you disable and then re-enable multilayer QoS globally using the mls qos global configuration command, the interface is no longer mapped to the correct egress queue-set. The workaround is to reconfigure the interface queue-set by using the no queue-set interface configuration command followed by the queue-set 2 interface configuration command. • CSCeb56226 If an 802.1X port is configured for forced-unauthorized port control mode and voice VLAN, after you remove the voice VLAN and disable 802.1X on the port, the port no longer passes traffic. The workaround is to restart the port by using the shutdown and then the no shutdown interface configuration commands.25 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Open Caveats • CSCeb66720 When CDP is disabled on a stack member interface and that interface is converted to a routed port or switch port, CDP is re-enabled on the stack member interfaces. Having CDP enabled on a stack member but not on the stack master can cause the 802.1X voice VLAN and inline power features to fail on the stack member. The workaround is to enable and then disable CDP on the interface. • CSCeb69078 Executing remote commands on a Catalyst 3750-12S switch that is unpacking and copying a new software image to Flash memory can cause the software upgrade to fail. The workaround is to reload the switch to re-enable Flash operations, and then repeat the software upgrade procedure. Open CMS Caveats These are the severity 3 CMS configuration caveats: • CSCdz01037 CMS fails when a switch is running the crypto software image and the vty lines have been configured to use only secure shell (SSH) using the transport input ssh and line vty 0 15 global configuration commands. The workaround is to allow SSH and Telnet access through the vty lines by using the transport input ssh telnet and line vty 0 15 global configuration commands. • CSCeb05183 The Port Settings table displays meaningless information in the columns for interface description and duplex cells. This problem occurs for some of the Catalyst 2820 and Catalyst 1900 switches. There is now workaround. • CSCeb23334 CMS does not validate configuration values for STP port priority before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS Release 12.1 or later. There is no workaround. Make sure that configuration values are valid. • CSCeb23416 CMS does not validate configuration values for STP port path cost before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS Release 12.1 or later. There is no workaround. Make sure that configuration values are valid for the switch type. • CSCeb23592 CMS does not validate configuration values for STP bridge parameters before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later. There is no workaround. Make sure that configuration values are valid.26 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Resolved Caveats • CSCeb25630 The Link Graphs bar chart for Packet Drops & Errors might display erroneous errors for Ethernet interfaces. The workaround is to use the show interfaces or show interfaces counter privileged EXEC commands command. • CSCeb38514 Sometimes a switch stack icon disappears from the topology view. This can occur if one of the switch stack members goes down or a switch stack member is disconnected from the stack. The workaround is to close the CMS browser and launch CMS again. • CSCeb38967 LOTR and TRS When CMS is operating in read-only mode, an error is reported if help is launched from the QoS Graph dialog box. There is no workaround. • CSCeb40625 CMS does not apply shaped bandwidth weights that are invalid. Shaped weights are invalid if the sum of their reciprocals is greater than 1 and the weight of a queue is 0. There is no workaround. Resolved Caveats These are the caveats that have been resolved in this release. • “Cisco IOS Caveats Resolved in Release 12.1(14)EA1” section on page 26 • “Cisco CMS Caveats Resolved in Release 12.1(14)EA1” section on page 29 Cisco IOS Caveats Resolved in Release 12.1(14)EA1 These Cisco IOS caveats were resolved in Release 12.1(14)EA1: • CSCdy29217 After the stack master failover and when the previous stack master rejoins the stack, some Layer 3 configuration on routed port interfaces belonging to the previous stack master are no longer lost (for example, the IP address, bridge groups, and so forth). This problem previously occurred under these conditions: – When the configuration of the switch stack has been modified but not saved. – The stack master fails, and a new switch in the switch stack is elected to become the new stack master. – The previous stack master rejoins the switch stack. – There is at least one port on the previous stack master physically configured as a routed port with some Layer 3 configuration.27 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Resolved Caveats • CSCdy40828 If the switch stack is a designated bridge in the LAN and another switch is connected to the switch stack through redundant links and has one of these redundant ports in a blocking state, the spanning-tree state topology is now the same after configuration changes in the LAN. For example, if the root bridge has ports that go down and then come back up, the switch stack remains a designated bridge after the spanning-tree state stabilizes. • CSCdz29910 While in the interface-range configuration mode, if you use the no channel-group interface configuration command or change the channel-group mode by using the channel-group command, an assert-fail message with traceback information no longer appears. • CSCdz41019 In a switch stack, if the stack master is reloaded at the same time that an EtherChannel link on a stack member goes down, the new stack master no longer fails shortly after being elected. • CSCdz60348 When an output ACL for a VLAN is full, the switch no longer drops all the packets routed or sent to that VLAN. This problem no longer occurs for Layer 3 features, such as unicast routing, multicast routing, and fallback bridging. • CSCdz69741 If there is a lot of SNMP polling activity and MAC notification traps being sent on the switch, entering the mac-address-table notification history-size value global configuration command to change the MAC address notification table history size no longer causes the switch to fail. • CSCdz71127 See CSCea02355. • CSCdz79082 A broadcast storm no longer occurs in a bridge group under these conditions: – When a port in the VLAN in which fallback bridging is enabled receives a non-IP packet with the bridge protocol data unit (BPDU) indicator bit set in the ISL header. – The destination MAC address has not been learned in the bridge group and at least one port in the VLAN is in the blocking state. • CSCea02137 When an undefined aggregate policer is configured in a policy-map, the switch no longer generates the wrong aggregate policer for it. • CSCea02355 and CSCdz71127 Cisco routers and switches running Cisco IOS software and configured to process Internet Protocol version 4 (IPv4) packets are vulnerable to a Denial of Service (DoS) attack. A rare sequence of crafted IPv4 packets sent directly to the device might cause the input interface to stop processing traffic when the input queue is full. No authentication is required to process the inbound packet. Processing of IPv4 packets is enabled by default. Devices running only IP version 6 (IPv6) are not affected. A workaround is available. Cisco has made software available, free of charge, to correct the problem. This advisory is available at http://www.cisco.com/warp/public/707/cisco-sa-20030717-blocked.shtml28 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Resolved Caveats • CSCea02851 When you are in policy-map class configuration mode and configure an aggregate policer with the police aggregate policy-map class configuration command, causing the number of aggregate policers to exceed 63, the aggregate policer is no longer retained in the policy map. • CSCea21883 Under some heavy load conditions with bridge groups and SPAN enabled (where the packets are dropped at the port because of flooding), the %SUPQ-4-CPUHB_RECV_STARVE message no longer appears. During this condition, the port output rate is no longer reduced to recover from the condition. • CSCea35481 An extended access list with permit or forward actions using Layer 4 information no longer incorrectly forwards fragmented packets. All packets are correctly forwarded now. • CSCea54285 You can now set the VTP mode to transparent (3) by using SNMP. • CSCea67031 The switch no longer take several minutes to generate and optimize the forwarding rules after you configure a complex VLAN map. For example, a complex VLAN map might contain multiple sequences that use the same VLAN map ACL, where the individual ACL clauses include one or more deny clauses (nonterminating–not the last deny). During the optimization process, the switch now responds to commands. • CSCea75726 When snooping is disabled and a spanning tree loop exists, incoming IGMP report and leave messages no longer generate a storm of such messages in the network. • CSCea86944 Gigabit Ethernet ports configured for RGMII mode (1/2, 5/6, 9/10, 13/14, 17/18, and 21/22) no longer fail an internal loopback test during system startup on the Catalyst 3750G-24T and Catalyst 3750G-24TS switches. • CSCea88723 A routed port that uses an IP ACL no longer filters packets incorrectly after an administrative shutdown and restart. The problem previously occurred after the following sequence: – An IP ACL is applied to a routed port by using the ip access-group interface configuration command. – The routed port is shut down by using the shutdown interface configuration command. – The ACL is modified or another interface is changed between routed port and switched port by using the switchport and no switchport interface configuration commands. – The routed port is re-enabled by entering the no shutdown interface configuration command. • CSCeb05555 The RSPAN feature no longer incorrectly spans all local link control packets with a destination MAC address of 0100.0CCC.CCCC on trunk ports that carry the RSPAN VLAN. Therefore, trunk ports carrying the RSPAN VLAN no longer combine control packets from RSPAN source ports with normal local control packets. The following list describes problems that previously occurred with selected protocols: – Cisco Discovery Protocol (CDP) could provide incorrect information. For example, CDP could incorrectly list a neighbor switch that is actually a neighbor on the RSPAN source port.29 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Resolved Caveats – Dynamic Trunking Protocol (DTP) could fail to work properly on trunks that are carrying the RSPAN VLAN. – Port Aggregration Protocol (PAgP) could fail to work properly on EtherChannels that are carrying the RSPAN VLAN. – VLAN Trunking Protocol (VTP) could incorrectly propagate VTP pruning messages on the wrong interface. For example, a pruning message intended for an RSPAN source port could also appear on the trunk port carrying the RSPAN VLAN. – Unidirectional Link Detection Protocol (UDLD) and any other protocol that uses 0100.00CC.CCCC as the destination MAC address could not operate properly on trunk ports that carry the RSPAN VLAN. • CSCeb43979 On Catalyst 3750 switches, the rate of traffic routed through the default route is no longer reduced by using software routing rather than hardware routing. • CSCeb48939 A switch configured for Rapid Spanning-tree (802.1w) no longer sends a Topology Change Notification (TCN) if an interface is reconfigured by using the spanning-tree portfast interface configuration command. Cisco CMS Caveats Resolved in Release 12.1(14)EA1 These CMS caveats were resolved in Release 12.1(14)EA1: • CSCdz52326 In the Voice VLAN window, you can now configure a voice VLAN when the VLAN mode is set to dynamic desirable or dynamic auto. • CSCea01123 All Simple Network Management Protocol (SNMP) traps are now shown on the SNMP Trap Managers tab. For example, suppose you click the Administration > SNMP > Trap Managers tab, create a trap manager, click the vlancreate and vlandelete checkboxes along with other traps, and click Apply. When you select the new trap manager entry in the Current Managers list, the vlancreate and vlandelete options are now shown. • CSCea12761 In the Topology View, when you right-click a device in an expanded switch stack to display the Device Properties window, the model number of the stack master no longer shows in all switches. • CSCea13508 From the Users and Passwords window (Administration > Users and Passwords), there is now a provision for enabling or disabling the login for console or vty lines. • CSCea15587 Whenever a given VLAN has multiple router ports associated with it, the IGMP Router tab on the IGMP Report window (Reports > Multicast > IGMP Report) now shows all router ports on a given VLAN.30 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Documentation Updates • CSCea16267 When you select the Device > QoS > Policies window and try to modify a policy, you no longer receive a null-pointer exception error that prevents you from modifying the policy. The error previously occurred when a policy class had an ACL match statement that was deleted. • CSCea26106 You can now create or modify an EtherChannel when the ports in the EtherChannel do not meet the following requirements: – Port group members must belong to the same set of VLANs and must be all static-access or all trunk ports. The native VLAN ID, trunk VLANs, and pruning VLANs must be the same for trunk ports. – Port monitoring (also known as Switched Port Analyzer [SPAN]), port security, 802.1X should not be enabled on the port. – Dynamic-access ports cannot be grouped. • CSCea80729 The Refresh button of the CMS Inventory Report now updates the System Uptime. Documentation Updates These are corrections for the Catalyst 3750 Switch Software Configuration Guide and Catalyst 3750 Switch Command Reference: • The command syntax for the udld interface configuration command is incorrect in the command reference and the software configuration guide. The correct syntax is udld port [aggressive | disable]; the syntax and usage guidelines incorrectly include the enable option. Also, the usage guidelines should use udld port, not just udld, when referring to this command. • The command syntax for the mac address-table static global configuration command is incorrect in the command reference for this release. The correct syntax is mac address-table static mac-addr vlan vlan-id interface interface-id. These changes will be included in the next version of the documentation. Related Documentation These documents provide complete information about the switch and are available at Cisco.com: http://www.cisco.com/univercd/cc/td/doc/product/lan/cat3750/index.htm You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the “Obtaining Documentation” section on page 31. • Catalyst 3750 Switch Software Configuration Guide (order number DOC-7815164=) • Catalyst 3750 Switch Command Reference (order number DOC-7815165=) • Catalyst 3750 Switch System Message Guide (order number DOC-7815166=) • Cluster Management Suite (CMS) online help (available only from the switch CMS software) • Catalyst 3750 Switch Hardware Installation Guide (order number DOC-7815136=) • Cisco Small Form-Factor Pluggable Modules Installation Notes (not orderable but available on Cisco.com)31 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Obtaining Documentation Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: http://www.cisco.com/univercd/home/home.htm You can access the Cisco website at this URL: http://www.cisco.com International Cisco websites can be accessed from this URL: http://www.cisco.com/public/countries_languages.shtml Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription. Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool: http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html All users can order monthly or quarterly subscriptions through the online Subscription Store: http://www.cisco.com/go/subscription Ordering Documentation You can find instructions for ordering documentation at this URL: http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm You can order Cisco documentation in these ways: • Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace: http://www.cisco.com/en/US/partner/ordering/index.shtml • Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).32 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Obtaining Technical Assistance Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can e-mail your comments to bug-doc@cisco.com. You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA 95134-9883 We appreciate your comments. Obtaining Technical Assistance Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities. Cisco.com Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. Cisco.com provides a broad range of features and services to help you with these tasks: • Streamline business processes and improve productivity • Resolve technical issues with online support • Download and test software packages • Order Cisco learning materials and merchandise • Register for online skill assessment, training, and certification programs To obtain customized information and service, you can self-register on Cisco.com at this URL: http://tools.cisco.com/RPF/register/register.do Technical Assistance Center The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two types of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The type of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable.33 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Obtaining Technical Assistance We categorize Cisco TAC inquiries according to urgency: • Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration. There is little or no impact to your business operations. • Priority level 3 (P3)—Operational performance of the network is impaired, but most business operations remain functional. You and Cisco are willing to commit resources during normal business hours to restore service to satisfactory levels. • Priority level 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operations are negatively impacted by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation. • Priority level 1 (P1)—An existing network is “down,” or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation. Cisco TAC Website The Cisco TAC website provides online documents and tools to help troubleshoot and resolve technical issues with Cisco products and technologies. To access the Cisco TAC website, go to this URL: http://www.cisco.com/tac All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register: http://tools.cisco.com/RPF/register/register.do If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL: http://www.cisco.com/tac/caseopen If you have Internet access, we recommend that you open P3 and P4 cases online so that you can fully describe the situation and attach any necessary files. Cisco TAC Escalation Center The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case. To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml Before calling, please check with your network operations center to determine the Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.34 Release Notes for the Catalyst 3750 Switch Cisco IOS Release 12.1(14)EA1 OL-4215-01 Obtaining Additional Publications and Information Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. • The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: http://www.cisco.com/en/US/products/products_catalog_links_launch.html • Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: http://www.ciscopress.com • Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL: http://www.cisco.com/go/packet • iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL: http://www.cisco.com/go/iqmagazine • Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL: http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html • Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL: http://www.cisco.com/en/US/learning/le31/learning_recommended_training_list.html This document is to be used with the documentation listed in the “Related Documentation” section. Copyright © 2003 Cisco Systems, Inc. All rights reserved. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R) Sun Install Check is a legacy application that is no longer supported. Running Sun Install Check does not produce results that are based on current recommendations for your system. Caution – Do not use Sun Install Check software. To obtain custom and comprehensive patch or risk analysis for your system, see other service offerings available from Sun: http://www.sun.com/service/consulting Sun™ Install Check ToolSun Microsystems, Inc. www.sun.com Part No. 817-0440-13, Rev. A August 2006 Accessing Sun Documentation You can view, print, or purchase a broad selection of Sun documentation, including localized versions, at: http://www.sun.com/documentation Contacting Sun Technical Support If you have technical questions about this product that are not answered in this document, go to: http://www.sun.com/service/contacting Sun Welcomes Your Comments Sun is interested in improving its documentation and welcomes your comments and suggestions. You can submit your comments by going to: http://www.sun.com/hwdocs/feedback Please include the title and part number of your document with your feedback: Sun Install Check Tool, part number 817-0440-13 Copyright 2006 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Portions may be derived from Berkeley BSD systems, licensed from U. of CA. Sun, Sun Microsystems, the Sun logo, Java, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and in other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and in other countries. U.S. Government Rights—Commercial use. Government users are subject to the Sun Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its supplements. Copyright 2006 Sun Microsystems, Inc. Tous droits réservés. Distribué par des licences qui en restreignent l’utilisation. Tout logiciel tiers, sa technologie relative aux polices de caractères comprise, est protégé par un copyright et licencié par des fournisseurs de Sun. Des parties de ce produit peuvent dériver des systèmes Berkeley BSD licenciés par l’Université de Californie. Sun, Sun Microsystems, le logo Sun, Java, et Solaris sont des marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux États-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux États-Unis et dans d’autres pays. Sun Microsystems, Inc. www.sun.com Submit comments about this document at: http://www.sun.com/hwdocs/feedback Sun Fire™ Visual Grid System Installation and User’s Guide Part No. 817-2365-10 November 2003, Revision APlease Recycle Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, U.S.A. All rights reserved. Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.sun.com/patents and one or more additional patents or pending patent applications in the U.S. and in other countries. This document and the product to which it pertains are distributed under licenses restricting their use, copying, distribution, and decompilation. No part of the product or of this document may be reproduced in any form by any means without prior written authorization of Sun and its licensors, if any. Third-party software, including font technology, is copyrighted and licensed from Sun suppliers. Parts of the product may be derived from Berkeley BSD systems, licensed from the University of California. UNIX is a registered trademark in the U.S. and in other countries, exclusively licensed through X/Open Company, Ltd. Sun, Sun Microsystems, the Sun logo, Sun Fire, Java, Java 3D, and Solaris are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and in other countries. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. in the U.S. and in other countries. Products bearing SPARC trademarks are based upon an architecture developed by Sun Microsystems, Inc. The OPEN LOOK and Sun™ Graphical User Interface was developed by Sun Microsystems, Inc. for its users and licensees. Sun acknowledges the pioneering efforts of Xerox in researching and developing the concept of visual or graphical user interfaces for the computer industry. Sun holds a non-exclusive license from Xerox to the Xerox Graphical User Interface, which license also covers Sun’s licensees who implement OPEN LOOK GUIs and otherwise comply with Sun’s written license agreements. OpenGL is a registered trademark of Silicon Graphics, Inc. U.S. Government Rights—Commercial use. Government users are subject to the Sun Microsystems, Inc. standard license agreement and applicable provisions of the FAR and its supplements. DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. Copyright 2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, California 95054, Etats-Unis. Tous droits réservés. Sun Microsystems, Inc. a les droits de propriété intellectuels relatants à la technologie incorporée dans le produit qui est décrit dans ce document. En particulier, et sans la limitation, ces droits de propriété intellectuels peuvent inclure un ou plus des brevets américains énumérés à http://www.sun.com/patents et un ou les brevets plus supplémentaires ou les applications de brevet en attente dans les Etats-Unis et dans les autres pays. Ce produit ou document est protégé par un copyright et distribué avec des licences qui en restreignent l’utilisation, la copie, la distribution, et la décompilation. Aucune partie de ce produit ou document ne peut être reproduite sous aucune forme, par quelque moyen que ce soit, sans l’autorisation préalable et écrite de Sun et de ses bailleurs de licence, s’il y ena. Le logiciel détenu par des tiers, et qui comprend la technologie relative aux polices de caractères, est protégé par un copyright et licencié par des fournisseurs de Sun. Des parties de ce produit pourront être dérivées des systèmes Berkeley BSD licenciés par l’Université de Californie. UNIX est une marque déposée aux Etats-Unis et dans d’autres pays et licenciée exclusivement par X/Open Company, Ltd. Sun, Sun Microsystems, le logo Sun, Sun Fire, Java, Java 3D, et Solaris sont des marques de fabrique ou des marques déposées de Sun Microsystems, Inc. aux Etats-Unis et dans d’autres pays. Toutes les marques SPARC sont utilisées sous licence et sont des marques de fabrique ou des marques déposées de SPARC International, Inc. aux Etats-Unis et dans d’autres pays. Les produits protant les marques SPARC sont basés sur une architecture développée par Sun Microsystems, Inc. L’interface d’utilisation graphique OPEN LOOK et Sun™ a été développée par Sun Microsystems, Inc. pour ses utilisateurs et licenciés. Sun reconnaît les efforts de pionniers de Xerox pour la recherche et le développement du concept des interfaces d’utilisation visuelle ou graphique pour l’industrie de l’informatique. Sun détient une license non exclusive de Xerox sur l’interface d’utilisation graphique Xerox, cette licence couvrant également les licenciées de Sun qui mettent en place l’interface d ’utilisation graphique OPEN LOOK et qui en outre se conforment aux licences écrites de Sun. OpenGL est une marque déposée de Silicon Graphics, Inc. LA DOCUMENTATION EST FOURNIE "EN L’ÉTAT" ET TOUTES AUTRES CONDITIONS, DECLARATIONS ET GARANTIES EXPRESSES OU TACITES SONT FORMELLEMENT EXCLUES, DANS LA MESURE AUTORISEE PAR LA LOI APPLICABLE, Y COMPRIS NOTAMMENT TOUTE GARANTIE IMPLICITE RELATIVE A LA QUALITE MARCHANDE, A L’APTITUDE A UNE UTILISATION PARTICULIERE OU A L’ABSENCE DE CONTREFAÇON.iii Contents Preface xi 1. Sun Fire Visual Grid System Overview 1 Overview 1 Installation Kit 2 Installation Process Overview 3 Technical Support 3 2. Sun Fire Visual Grid System Software Requirements 5 Operating Environment Requirements 5 Sun Fire Visual Grid Software Packages 6 Software Packages 7 Software Package Locations 7 Software Patches 8 Sun OpenGL for Solaris Software 9 Sun OpenGL for Solaris Software Packages 9 Sun OpenGL for Solaris Patches 10 Other Software Requirements 10iv Sun Fire Visual Grid System Installation and User’s Guide • November 2003 3. Sun Fire Visual Grid System Hardware Requirements 11 Graphics Accelerator Hardware 11 Network Hardware 12 Myrinet Networking Cards 12 Ethernet Networking Cards 13 USB Card 13 Serial Port 13 Keyboard, Video, and Mouse Extenders 14 Supported Configurations 14 4. Installing the Sun Fire Visual Grid System 15 System Configuration Examples 16 Site Hardware Preparation 18 Administration Workstation 19 Setting Up an Ethernet Network 19 Installing a Myrinet Card 21 Installing the Myrinet PCI Cards in a Sun Fire 4800/6800 21 Installing the Myrinet PCI Cards in a Sun Fire V880z 23 Cabling the Master and Slaves 24 Installing a USB Card 25 Installing the Software 27 Redirecting the Slave Console Output 31 Upgrading the Sun Fire Visual Grid Software 32 Interchanging a Master and Slave 34 Changing a Master to a Slave Computer 34 Removing a Slave Computer 35 Configuring the Frame Buffer Attributes 36Contents v 5. System Administration 37 dzadmin Administration Tool 37 Administration Tool Overview 38 Using Xinerama and dzadmin 40 The System Administration Tool Menus 41 File Menu 41 Actions Menu 42 Starting the dzadmin System Administration Tool 43 Using the dzadmin System Administration Tool 45 dzstatus Status Tool 48 Sun Fire Visual Grid Limitations 49 Framelock and Genlock 49 6. Security 51 dzdaemon Daemon 51 Role-Based Access 52 A. Troubleshooting 53 Log Files 53 General Troubleshooting Information 54 Verifying the Myrinet Software 55 Index 57vi Sun Fire Visual Grid System Installation and User’s Guide • November 2003vii Figures FIGURE 4-1 Configuration of One Sun Fire 6800 Master and Two Slaves 16 FIGURE 4-2 Configuration of One Sun Fire V880z Master and One Slave 17 FIGURE 4-3 Installing a Myrinet PCI Card in the Sun Fire 6800 I/O Assembly 22 FIGURE 4-4 Installing Myrinet Cards in the Sun Fire V880z 23 FIGURE 4-5 Installing a PCI USB Card in the Sun Fire 6800 I/O Assembly 26 FIGURE 5-1 Sun Fire Visual Grid Software Administration Tool 38 FIGURE 5-2 Sun Fire Visual Grid Software Administration Tool File Menu 41 FIGURE 5-3 Sun Fire Visual Grid Software Administration Tool Actions Menu 42 FIGURE 5-4 Sun Fire Visual Grid Software Administration Tool 44 FIGURE 5-5 Master Machine Configuration Panel 46 FIGURE 5-6 Slave Machine Configuration Panel 47viii Sun Fire Visual Grid System Installation and User’s Guide • November 2003ix Tables TABLE 2-1 Sun Fire Visual Grid Software CD Directories 6 TABLE 2-2 Sun Fire Visual Grid Software Packages 7 TABLE 2-3 Location of Sun Fire Visual Grid Software Packages 7 TABLE 2-4 Patches for the Solaris 8 Operating Environments 8 TABLE 2-5 Package Names for Sun OpenGL Version 1.3 9 TABLE 2-6 Location of Sun OpenGL for Solaris Software Patches 10 TABLE 3-1 Supported Configuration Summary 14 TABLE 5-1 File Menu 41 TABLE 5-2 Actions Menu 42 TABLE 6-1 TCP and UDP Protocols 52x Sun Fire Visual Grid System Installation and User’s Guide • November 2003xi Preface This document describes the installation of the Sun Fire™ Visual Grid system consisting of the networking interconnect of Sun Fire 4800/6800 Visual Grid computers and Sun Fire V880z Visual Grid computers through Sun XVR-4000 graphics accelerators. Note – The procedures in this manual should only be performed by experienced system administrators. How This Book Is Organized Chapter 1 provides an overview of the Sun Fire Visual Grid system and an overview of the installation process. Chapter 2 describes the Sun Fire Visual Grid system software requirements. Chapter 3 describes the Sun Fire Visual Grid hardware requirements and supported system configurations. Chapter 4 describes installing the Sun Fire Visual Grid interconnect and Sun Fire Visual Grid software. Chapter 5 describes the dzadmin configuration tool, which administrators use to configure a Sun Fire Visual Grid system. Chapter 6 provides security information through the Sun Fire Visual Grid software daemon program (dzdaemon). Appendix A provides troubleshooting information.xii Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Using UNIX Commands This document might not contain information on basic UNIX® commands and procedures such as shutting down the system, booting the system, and configuring devices. See the following for this information:
Software documentation that you received with your system
Solaris™ operating environment documentation, which is at: http://docs.sun.com Typographic Conventions Typeface * * The settings on your browser might differ from these settings. Meaning Examples AaBbCc123 The names of commands, files, and directories; on-screen computer output Edit your.login file. Use ls -a to list all files. % You have mail. AaBbCc123 What you type, when contrasted with on-screen computer output % su Password: AaBbCc123 Book titles, new words or terms, words to be emphasized. Replace command-line variables with real names or values. Read Chapter 6 in the User’s Guide. These are called class options. You must be superuser to do this. To delete a file, type rm filename.Preface xiii Shell Prompts Accessing Sun Documentation You can view, print, or purchase a broad selection of Sun documentation, including localized versions, at: http://www.sun.com/documentation Contacting Sun Technical Support If you have technical questions about this product that are not answered in this document, go to: http://www.sun.com/service/contacting Shell Prompt C shell machine-name% C shell superuser machine-name# Bourne shell and Korn shell $ Bourne shell and Korn shell superuser #xiv Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Sun Welcomes Your Comments Sun is interested in improving its documentation and welcomes your comments and suggestions. You can submit your comments by going to: http://www.sun.com/hwdocs/feedback Please include the title and part number of your document with your feedback: Sun Fire Visual Grid System Installation and User’s Guide, part number 817-2365-10.1 C H A P T E R 1 Sun Fire Visual Grid System Overview This chapter provides an overview of the Sun Fire Visual Grid system.
“Overview” on page 1
“Installation Kit” on page 2
“Installation Process Overview” on page 3
“Technical Support” on page 3 The Sun Fire Visual Grid system consists of the Sun Fire 4800/6800, the Sun Fire V880z, and the Sun Fire Visual Grid software and networking interconnect. Overview The Sun Fire Visual Grid system enables a host (master) computer to use remote (slave) computers for rendering to displays using Sun XVR-4000 graphics accelerators. The system runs over a high-speed, networked Sun Fire Visual Grid interconnect. The Sun Fire Visual Grid software makes this connection transparent to the master running the application; the application functions as if the Sun XVR-4000 graphics accelerators are located local to the master. Thus, the software enables large numbers of displays to be addressable from a single computer in this system without modifying application software, and often with little or no performance degradation or change in user experience. Local Sun XVR-4000 graphics accelerators installed in the master can also be used in conjunction with Sun XVR-4000 graphics accelerators installed in the slaves.2 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 The Sun Fire Visual Grid software implements a pseudo-frame-buffer device on a master host that acts as a proxy for a physical frame buffer device on a remote Sun Fire V880z slave host. One or more remote slave hosts are connected to the master host in such a way that the remote frame buffers on the slave hosts appear to existing APIs (Application Program Interfaces, such as X Windows, Sun OpenGL® 1.3 for Solaris, and Java 3D™) and application software as if they were local frame buffer devices on the master host. In complex display environments, up to 16 slave computers can be connected to the master computer, each with one or two remote Sun XVR-4000 graphics accelerators, each of which could drive two monitors or projectors, for a total of 64. For configurations beyond the limits listed in “Supported Configurations” on page 14, see Support Services at: http://www.sun.com/service/online The Sun Fire Visual Grid interconnect for 3D graphics is a Myrinet PCI network card. The Gigabit Ethernet is also supported for the X Windows portion of the network. Refer to the following documentation for detailed server hardware service information (select “Servers” at http://www.sun.com/documentation):
Sun Fire 6800/4810/4800/3800 Systems Service Manual (805-7363)
Sun Fire V880 Server Service Manual (806-6597)
Sun Fire V880 Server Owner’s Manual (806-6592)
Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide (817-2400) Installation Kit The Sun Fire Visual Grid system installation kit includes:
Sun Fire Visual Grid software CD
Myrinet network cards (six for each networked slave system)
Myrinet networking cables (three for each slave)
USB card (included if the installation includes a Sun Fire 4800/6800)
Sun Fire Visual Grid System Installation and User’s Guide, this document The Sun Fire Visual Grid system uses the Sun XVR-4000 graphics accelerator to render the system graphics. If necessary, for the latest Sun XVR-4000 graphics accelerator CD and software patches, go to: http://sunsolve.sun.comChapter 1 Sun Fire Visual Grid System Overview 3 Installation Process Overview 1. Verify the Sun Fire Visual Grid system software requirements (Chapter 2). 2. Verify the hardware and network requirements (Chapter 3). 3. Verify that the site is properly prepared for the hardware installation and establish an administration workstation (Chapter 4, “Site Hardware Preparation” on page 18 and “Administration Workstation” on page 19). 4. Set up an Ethernet network for the Sun Fire Visual Grid system (Chapter 4, “Setting Up an Ethernet Network” on page 19). 5. Install the Myrinet cards (Chapter 4, “Installing a Myrinet Card” on page 21). 6. Install a USB card, where applicable (Chapter 4, “Installing a USB Card” on page 25). 7. Install the Sun Fire Visual Grid software (Chapter 4, “Installing the Software” on page 27). 8. Use the dzadmin configuration tool to configure a Sun Fire Visual Grid system (Chapter 5). Technical Support For assistance and other information not found in this document concerning the Sun Fire Visual Grid system, see Support Services at: http://www.sun.com/service/online For the most up-to-date version of the installation and user’s guide, select “Servers” at: http://www.sun.com/documentation For the latest software patches, go to: http://sunsolve.sun.com4 Sun Fire Visual Grid System Installation and User’s Guide • November 20035 C H A P T E R 2 Sun Fire Visual Grid System Software Requirements This chapter describes the Sun Fire Visual Grid system software requirements.
“Operating Environment Requirements” on page 5
“Sun Fire Visual Grid Software Packages” on page 6
“Sun OpenGL for Solaris Software” on page 9
“Other Software Requirements” on page 10 Operating Environment Requirements
Master (Sun Fire V880z): Solaris 8 2/02 operating environment, or a subsequent compatible version of the Solaris 8 operating environment
Master (Sun Fire 4800/6800): Solaris 8 2/02 operating environment, or a subsequent compatible version of the Solaris 8 operating environment
Slave (Sun Fire V880z): Solaris 8 2/02 operating environment, or a subsequent compatible version of the Solaris 8 operating environment6 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Sun Fire Visual Grid Software Packages TABLE 2-1 lists the Sun Fire Visual Grid software CD files and directories. The packages are located in the cdrom/cdrom0/ directory: TABLE 2-1 Sun Fire Visual Grid Software CD Directories Directory (or file) name Description License Binary Code License Sun_Visual_Grid_Software/1.0 /Solaris_8/Packages/ Sun Fire Visual Grid software for Solaris 8 operating environment Sun_Visual_Grid_Software/1.0 /Solaris_8/Patches/ Sun Fire Visual Grid software patches Java/1.4/Packages/ Sun J2SE runtime Myrinet/1.6.4/Packages/ Myrinet drivers and software OpenGL/1.3/Packages/ Sun OpenGL 1.3 for Solaris Docs/ Sun Fire Visual Grid system documentation Copyright U.S. version of copyright FR_Copyright French version of copyright install Product installation script uninstall Product removal script README Product information README.first Important product release informationChapter 2 Sun Fire Visual Grid System Software Requirements 7 Software Packages TABLE 2-2 lists the Sun Fire Visual Grid software packages. Software Package Locations The Sun Fire Visual Grid software packages are located in the directories listed in TABLE 2-3. The packages are located in the cdrom/cdrom0/ directory: TABLE 2-2 Sun Fire Visual Grid Software Packages Package Name Description SUNWdz-admin Sun Fire Visual Grid Administration Tools SUNWdz-driver-64 Sun Fire Visual Grid Device Driver (64-bit) SUNWdz-network Sun Fire Visual Grid OpenGL connectivity libraries SUNWdz-xwindow Sun Fire Visual Grid Window System Support SUNWdz-runtime Sun Fire Visual Grid System Software SUNWmyril Myrinet Network Libraries, Utilities, and Documentation SUNWmyrir Myrinet Network System Software SUNWmyrix Myrinet Network System Software/Device Driver (64-bit) SUNWj3rt J2SDK 1.4 runtime environment SUNWdz-man Sun Fire Visual Grid man pages TABLE 2-3 Location of Sun Fire Visual Grid Software Packages Software Packages Directory Location Solaris 8 software Sun_Visual_Grid_Software/1.0/Solaris_8/Packages/ Sun J2SE runtime Java/1.4/Packages/ Myrinet drivers and software Myrinet/1.6.4/Packages/ Sun OpenGL 1.3 for Solaris OpenGL/1.3/Packages/8 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Software Patches TABLE 2-4 lists the Sun Fire Visual Grid software patches required; these are all installed automatically by the Sun Fire Visual Grid software install script. The Solaris 8 operating environment patch bundle found on the Sun patch web site (http://sunsolve.sun.com) may have newer versions of these patches, which are preferable. The patches are located in the following directory: cdrom/cdrom0/Sun_Visual_Grid_Software/1.0/Solaris_8/Patches/ TABLE 2-4 Patches for the Solaris 8 Operating Environments Patches Installation 110380-04 Automatically installed by the Sun Fire Visual Grid install script. 110934-10 Automatically installed by the Sun Fire Visual Grid install script. 110842-08 Automatically installed by the Sun Fire Visual Grid install script. 109896-21 Automatically installed by the Sun Fire Visual Grid install script if the computer is a Sun Fire 4800 or Sun Fire 6800. A kernel patch update is also installed since it is a prerequisite to this patch. The Sun Fire V880z does not require this patch. 108652-74 Automatically installed by the Sun Fire Visual Grid install script.Chapter 2 Sun Fire Visual Grid System Software Requirements 9 Sun OpenGL for Solaris Software The Sun Fire Visual Grid software is supported in Sun OpenGL Version 1.3, and subsequent compatible Sun OpenGL versions, for Solaris operating environments. Each computer in the Sun Fire Visual Grid system requires this version of Sun OpenGL for Solaris. These software packages are bundled and automatically installed as part of the Sun Fire Visual Grid software. Two OpenGL 1.3 patches are also required; these are also bundled and automatically installed as part of the Sun Fire Visual Grid software. Sun OpenGL for Solaris Software Packages TABLE 2-5 lists the Sun OpenGL 1.3 for Solaris software package names and descriptions. The packages are located in the following directory: cdrom/cdrom0/OpenGL/1.3/Packages/ TABLE 2-5 Package Names for Sun OpenGL Version 1.3 Package Name Description SUNWgldoc Sun OpenGL for Solaris Documentation and Man Pages SUNWgldp Sun OpenGL for Solaris Device Pipeline Support SUNWgldpx Sun OpenGL for Solaris 64-bit Device Pipeline Support SUNWglh Sun OpenGL for Solaris Header Files SUNWglrt Sun OpenGL for Solaris Runtime Libraries SUNWglrtu Sun OpenGL for Solaris Platform Specific Runtime Libraries SUNWglrtx Sun OpenGL for Solaris 64-bit Runtime Libraries SUNWglsr Sun OpenGL for Solaris Runtime Generic Software SUNWglsrx Sun OpenGL for Solaris 64-bit Optimized SW Rasterizer SUNWglsrz Sun OpenGL for Solaris Optimized SW Rasterizer10 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Sun OpenGL for Solaris Patches TABLE 2-6 lists the directory locations of the Sun OpenGL for Solaris software packages. The packages are located in the cdrom/cdrom0/ directory Updated versions of Sun OpenGL for Solaris are available at: http://www.sun.com/software/graphics/OpenGL/ Other Software Requirements Each Sun Fire Visual Grid computer containing a Sun XVR-4000 graphics accelerator requires all of the Sun XVR-4000 graphics accelerator software installed. See the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide. Each computer also requires a Java™ Runtime Environment (JRE) version 1.4 or 1.4.x, where x is any version number. The JRE version 1.4 is bundled with the Sun Fire Visual Grid software; if a JRE version 1.4.X is not found on the target system, it is automatically installed during the software installation process. If a correct version of the JRE is found already installed on the target system, the bundled JRE will not be installed; the Sun Fire Visual Grid software will automatically use the already installed JRE. Note – Each computer must have the same version of the Sun Fire Visual Grid software packages running on it. If not, the dzadmin tool generates an error. Upgrade the Sun Fire Visual Grid software on each computer. TABLE 2-6 Location of Sun OpenGL for Solaris Software Patches Software Patches Directory Location Sun OpenGL 1.3 patch (32-bit) OpenGL/1.3/Packages/113886-15 Sun OpenGL 1.3 patch (64-bit) OpenGL/1.3/Packages/113887-1511 C H A P T E R 3 Sun Fire Visual Grid System Hardware Requirements This chapter describes the Sun Fire Visual Grid system hardware requirements and supported system configurations.
“Graphics Accelerator Hardware” on page 11
“Network Hardware” on page 12
“Supported Configurations” on page 14 See the diagrams in “System Configuration Examples” on page 16 for examples on hardware networking configurations. Graphics Accelerator Hardware Only the Sun XVR-4000 graphics accelerator is supported by the Sun Fire Visual Grid system. A system can have other frame buffers installed; they cannot, however, be used in conjunction with the Sun Fire Visual Grid software.12 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Network Hardware Each slave must be connected to the master by at least two separate networks—a Gigabit Ethernet network connection for X protocol data and a Myrinet network for OpenGL data. The Ethernet connection can pass through a switch, but the Myrinet connections must be point-to-point. For security and performance reasons, consider isolating the Sun Fire Visual Grid system Gigabit Ethernet network from the main corporate network (see Chapter 6). Sun Fire Visual Grid software includes software that aggregates bandwidth across three point-to-point Myrinet links between the master host and each slave host. This makes it possible to increase bandwidth beyond what is possible for a single Myrinet card. A total of six Myrinet cards are required for each slave—three are installed in the slave computer and three in the master computer. A Myrinet fiber cable is used to attach each pair of Myrinet cards in point-to-point fashion, without a network switch; therefore, three Myrinet cables are required between each master and slave. The Myrinet cards and cables are part of the installation kit (“Installation Kit” on page 2). Note – The Gigabit Ethernet gear (if required) or cables are not included as a standard part of the Sun Fire Visual Grid installation kit. Myrinet Networking Cards
Every slave must have exactly three Myrinet PCI network cards, and they should be plugged into the same distribution of 66/33 Mhz PCI bus slots.
For a Sun Fire 4800/6800 master, each slave must be connected to a separate I/O assembly on the master.
Myrinet connections must be point-to-point; a Myrinet switch is not supported at this time.
Myrinet driver packages for Solaris that are delivered as part of the Sun Fire Visual Grid software distribution must be installed. The installation script performs this installation automatically. Note – Do not download the Myrinet driver packages directly from the Myricom web site.Chapter 3 Sun Fire Visual Grid System Hardware Requirements 13
Do not install other non-Sun Myrinet cards in any of the master or slaves. The only exception would be installation in a separate system domain in a Sun Fire 4800/6800 master. Myricom Myrinet Card Requirements
Six Myrinet-2000-Fiber/PCI interface PCI short cards (Myricom part no. M3F-PCI64C-2) for each slave computer. Three are for the slave and three are for the master.
Myrinet-2000-Fiber cables (50/125 multimode fiber pairs with LC connectors) 25 meters in length (Myricom part no. M3F-CB-25M) for each slave computer. If necessary for a particular installation configuration, longer cable lengths should function without problems. Ethernet Networking Cards
A Gigabit Ethernet network for the master-slave connection is required. Any Sun-supported Gigabit Ethernet network card is acceptable.
Sun standard Gigabit Ethernet network cards are supported.
Each slave has a built-in fiber Gigabit Ethernet adapter. USB Card For a Sun Fire 4800/6800 master, you must install a USB card into one of the PCI slots so that the keyboard and mouse can be attached. This keyboard and mouse is used when running X Windows. The Sun Fire V880z already has USB ports for a keyboard and mouse. A USB card that fits into a Sun Fire 4800/6800 PCI slot is included in the Sun Fire Visual Grid system installation kit. The USB card is only supported for a keyboard and mouse, and other USB 1.0 and USB 1.1 functionality. USB 2.0 is not officially supported with this card, although it should function properly. Serial Port For a master Sun Fire 4800/6800, you can obtain serial port capability by using an Edgeport Standard Serial Converter (Edgeport model number 301-1000-04), which is a USB-to-RS232 serial converter.14 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Keyboard, Video, and Mouse Extenders A keyboard and mouse extender device is required for a Sun Fire 4800/6800. Otherwise, the keyboard and mouse cables will not reach far enough to connect to that computer. Some installations might also need video extenders, which provide remote access to the video some distance away from a Sun Fire V880z, typically over fiber links. This equipment must be purchased separately and is not included in the Sun Fire Visual Grid system installation kit. For help obtaining the equipment, contact your Sun service representative. Supported Configurations TABLE 3-1 lists the supported system configurations. For networking diagram examples, see “System Configuration Examples” on page 16. For configurations beyond the limits in TABLE 3-1, see Support Services at: http://www.sun.com/service/online Sun Fire 4800 and Sun Fire 6800 Configurations For Sun Fire 4800 and Sun Fire 6800 Visual Grid configurations only, the single Sun XVR-4000 graphics accelerator option enables configurations with an odd number of frame buffers. In this configuration, however, you can only have one Sun Fire V880z slave with one Sun XVR-4000 graphics accelerator. TABLE 3-1 Supported Configuration Summary Master Computer Slave Computer Sun Fire V880z with one Sun XVR-4000 graphics accelerator (4-6 CPUs) One Sun Fire V880z with two Sun XVR-4000 graphics accelerators (2 CPUs) Sun Fire V880z with two Sun XVR-4000 graphics accelerators (4 CPUs) One Sun Fire V880z with two Sun XVR-4000 graphics accelerators (2 CPUs) Sun Fire 4800 Up to two Sun Fire V880z computers with one or two Sun XVR-4000 graphics accelerators (2 CPUs) Sun Fire 6800 Up to four Sun Fire V880z computers with one or two Sun XVR-4000 graphics accelerators (2 CPUs)15 C H A P T E R 4 Installing the Sun Fire Visual Grid System This chapter describes how to install the Sun Fire Visual Grid system.
“System Configuration Examples” on page 16
“Site Hardware Preparation” on page 18
“Installing a Myrinet Card” on page 21
“Installing a USB Card” on page 25
“Installing the Software” on page 27
“Upgrading the Sun Fire Visual Grid Software” on page 32
“Interchanging a Master and Slave” on page 34
“Configuring the Frame Buffer Attributes” on page 3616 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 System Configuration Examples FIGURE 4-1 shows an example of a Sun Fire Visual Grid system networked configuration for one Sun Fire 6800 master and two slaves. FIGURE 4-1 Configuration of One Sun Fire 6800 Master and Two Slaves C Application Myrinet Myrinet OpenGL Xserver USB extender Sun Fire V880z Sun Fire 6800 Keyboard Mouse Ethernet USB extender DZGL DZGL Xlib XVR-4000 XVR-4000 3 ?ber cables 3 ?ber cables Xlib Monitor Monitor Gigabit Sun Fire V880z DZGL Xlib XVR-4000 XVR-4000 Monitor Monitor Slave 0 Slave 1 MasterChapter 4 Installing the Sun Fire Visual Grid System 17 FIGURE 4-1 shows an example of a Sun Fire Visual Grid system networked configuration for one Sun Fire V880z master and one slave. FIGURE 4-2 Configuration of One Sun Fire V880z Master and One Slave C Application Myrinet OpenGL Xserver Sun Fire V880z Sun Fire V880z Monitor DZGL DZGL Xlib Xlib XVR-4000 XVR-4000 XVR-4000 3 ?ber cables Monitor Monitor Ethernet Gigabit Master Slave18 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Site Hardware Preparation You need to complete specific hardware prerequisites for a Sun Fire Visual Grid system installation before attempting to go through the software installation procedure. These requirements are described below: Note – All of the following necessary items must be in place before proceeding with the Sun Fire Visual Grid software installation procedure.
Make sure that there is an administration workstation available during the installation process which has network access to the master computer. The administration workstation should be a separate computer from the master and slaves. It should be capable of running X Windows and have remote access (rsh or rlogin) to the master. The master should have remote access (rsh or rlogin) to each slave. The administration workstation should be able to log into both master and slaves. See “Administration Workstation” on page 19.
Configure the Gigabit Ethernet network on the master and slave computers, ensuring that each slave can be reached through a ping from the master over the gigabit link, and vice versa. See “Setting Up an Ethernet Network” on page 19.
Install the Myrinet cards into the master and each slave. Properly cable the Myrinet cards from the master to each of the cards in the slaves. See “Installing a Myrinet Card” on page 21. Until the Myrinet drivers are installed during the software installation process, the Myrinet boards are “invisible” to the systems. See “Verifying the Myrinet Software” on page 55.
If the master does not have USB ports, as in the case of a Sun Fire 4800 or Sun Fire 6800, you must install a USB card in the master for the keyboard and mouse. Installing a USB card is not necessary with a Sun Fire V880z, because it already provides USB ports for the keyboard and mouse. See “Installing a USB Card” on page 25.
Install the appropriate hardware to co-locate the master (host) keyboard and mouse remotely with the displays, if this is going to be a part of the final installation. This is required for a Sun Fire 4800 or Sun Fire 6800 installation because without extender hardware the keyboard and mouse do not reach the displays. See “Keyboard, Video, and Mouse Extenders” on page 14.Chapter 4 Installing the Sun Fire Visual Grid System 19 Administration Workstation A separate workstation is required to administer the Sun Fire Visual Grid software during system installation. This administration workstation must be on the same network as the master in the Sun Fire Visual Grid system configuration (see “System Configuration Examples” on page 16). The administration workstation is used to run the software administration tool, dzadmin, to configure the grid (see Chapter 5). Setting Up an Ethernet Network Using a Gigabit Ethernet network is required for better X Window performance. The Sun Fire Visual Grid system has built-in fiber Gigabit Ethernet hardware. Note – These instructions provide a simple method to configure a Gigabit Ethernet network local to the Sun Fire Visual Grid system. If you prefer that your network administrator configure the network instead of using these instructions, contact your Sun service representative. For each master and slave on the network, take the following steps: 1. Determine which IP network addresses to use for the Gigabit Ethernet. If the systems are already on a corporate network, then the Gigabit Ethernet network should be on a different subnet. For simplicity, you may want to use a different class B address. For example, if the system is on the corporate network as 195.131.45.155, you might choose the Gigabit Ethernet address somewhere in 195.132.*.*. Each associated master/slave Gigabit Ethernet connection should have the same class B address (for example, 195.132.*.*). If there is a switch handling the Gigabit Ethernet network between the master and slave systems, then each system in the Sun Fire Visual Grid system installation can share the same class B address space on the Gigabit Ethernet network. When there are multiple master/slave point-to-point Gigabit Ethernet connections (for example, a switch is not being used between the master and slave machines and there is more than one slave machine), you must assign a different class B address space to each master/slave pair. 2. Add the Gigabit Ethernet name and IP address of all master and slaves on this subnetwork to the /etc/hosts file of each system.20 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 3. Create a file /etc/hostname.xxx, where xxx is the name of the Gigabit Ethernet port. On a Sun Fire V880z, the built-in Gigabit Ethernet port is ge0, therefore, the file is /etc/hostname.ge0. On a Sun Fire Enterprise class server, the port may be gen or cen depending on the adapter type. The /etc/hostname.xxx file should contain a single line with the name of this server on the Gigabit Ethernet network. This name should be unique from the nodename or any other network name of this server. So the master machine might be called “master” and each slave “slaven”, where n is the slave number. 4. Create the file /etc/notrouter. Type: The file has no contents. 5. Edit the /etc/nsswitch.conf file to check the local hosts file first. For example, if /etc/nsswitch.conf is configured for nis, find the line: Edit the line to read: 6. Enable the Gigabit Ethernet port. To do this, reboot the server. 7. Verify the installation. Using the example nodenames above, it should be possible to use the ping master command from each slave, and the command ping slaven for each slave from the master. Use the ifconfig -a command on each master/slave computer to display the Gigabit Ethernet adapter. # touch /etc/notrouter hosts: nis [NOTFOUND=return] files hosts: files nis [NOTFOUND=return] filesChapter 4 Installing the Sun Fire Visual Grid System 21 Installing a Myrinet Card This section provides information for installing the Myrinet hardware and software. The following describes how to install the Myrinet PCI cards into a Sun Fire 4800/6800 and a Sun Fire V880z. Installing the Myrinet PCI Cards in a Sun Fire 4800/6800 On a Sun Fire 4800/6800, the Myrinet cards attached to a particular slave must be completely contained within one I/O assembly. The PCI slots are numbered on the side of the I/O assembly boat, and the PCI busses are marked as well. There are two PCI busses that feed into the PCI slots. Install the three cards so that at least one of them is attached to each of the two PCI buses. The power requirement of a Myrinet card is approximately 11 Watts. See the Sun Fire 6800/4810/4800/3800 Systems Service Manual for procedures on how to shut down these systems safely before installing or removing any internal boards, and how to reboot the system after installation. 1. Shut down your system and remove the Sun Fire 4800/6800 PCI I/O assembly. a. Loosen the four I/O assembly captive Phillips screws and pull the ejector levers outward (FIGURE 4-3). b. Slide out the I/O assembly and place it on an ESD mat close to the system. 2. Attach the antistatic wrist strap to your wrist and connect the strap to the I/O assembly. 3. Lay the I/O assembly on its side. Locate the PCI slot numbers where the Myrinet cards are to be installed. 4. Position the Myrinet card in the I/O assembly (FIGURE 4-3). 5. Guide the Myrinet card into the I/O assembly PCI slot (slot 7 in this example) (FIGURE 4-3). a. Insert the faceplate end of the Myrinet card into the appropriate opening in the I/O assembly back panel. b. Guide the opposite end of the Myrinet card into the card slot.22 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 c. Secure the faceplate to the I/O assembly with the two Phillips screws. FIGURE 4-3 Installing a Myrinet PCI Card in the Sun Fire 6800 I/O Assembly 6. Insert and secure filler boards into any other open slots. 7. Replace the I/O assembly into the Sun Fire 4800/6800 chassis. a. Line up the I/O assembly with the chassis I/O assembly opening and slide the assembly into the chassis. b. Simultaneously press the two ejector levers inward. Then tighten the four captive Phillips screws snugly by hand. 8. Install the Myrinet cards in the Sun Fire V880z. See “Installing the Myrinet PCI Cards in a Sun Fire V880z” on page 23. Note – When the Sun Fire Visual Grid software is installed, the Myrinet cards are recognized by the Myrinet software bundled with Sun Fire Visual Grid software. Ejector levers (2) Captive screws (4) Myrinet card Sun Fire 6800 I/O assemblyChapter 4 Installing the Sun Fire Visual Grid System 23 Installing the Myrinet PCI Cards in a Sun Fire V880z On a Sun Fire V880z that is powered down, install each Myrinet card in a separate PCI bus. The Sun Fire V880z has nine PCI slots and three PCI buses. The PCI slots are numbered from the bottom up, starting at 0 and ending at 8. The numbering scheme can be found on the inside of the left door that closes over the PCI slots. Refer to the following hardware documentation for detailed installation and service information:
Sun Fire V880 Server Service Manual (806-6597)
Sun Fire V880 Server Owner’s Manual (806-6592) 1. Identify the slots where you want to install the Myrinet cards. One card should be installed in one of the PCI slots numbers 0-3 (33 MHz bus), one installed into one of the PCI slots numbered 4-6 (33 MHz bus), and one installed into one the PCI slots numbered 7-8 (66 MHz bus). The 66 MHz slots are physically the highest two PCI slots. 2. Remove the PCI filler panel from the back of the system. a. Pinch the PCI card retaining clip until it releases from the top of the filler panel and rotate the clip outward. b. Slide the filler panel out from the rear panel. FIGURE 4-4 Installing Myrinet Cards in the Sun Fire V880z Myrinet card Sun Fire V880z PCI slot 0 server24 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 3. Insert the Myrinet cards into the appropriate slots on the I/O board (FIGURE 4-4). a. Insert the faceplate side of the Myrinet card into the appropriate opening on the rear panel. At the same time, insert the other end of the card into the corresponding groove on the PCI card bracket. b. Push the card into the slot on the I/O board until the card is fully seated. Cabling the Master and Slaves  Connect one end of each Myrinet networking fiber cable (three cables per slave) from each Myrinet card in the master to a Myrinet card in the slave. There are six Myrinet cards for each networked slave—three in the master, three in the slave. Ensure that the fiber cables connecting the master with each Myrinet card in each slave are properly attached. All connections are point-to-point and there is no network switch involved. See “System Configuration Examples” on page 16. When cabling the Myrinet cards, the green LED on the cards illuminates once a connection is established over the fiber cabling. If the LED does not light and both master and slave computers are powered on, then there is a problem with the fiber cables, the connection, or device seating. Note – You must only use the Myrinet drivers bundled with the Sun Fire Visual Grid software. Do not use other Myrinet drivers, such as Myrinet drivers available on Myricom’s web site. See “Verifying the Myrinet Software” on page 55.Chapter 4 Installing the Sun Fire Visual Grid System 25 Installing a USB Card This procedure only applies to the Sun Fire 4800/6800. Installing a USB card is not necessary with a Sun Fire V880z, since it already provides USB ports for the keyboard and mouse. The USB card can be installed into any PCI slot. Refer to the Sun Fire 6800/4810/4800/3800 Systems Service Manual (805-7363) for proper procedures on how to shut down the computer safely before installing or removing any internal boards and how to reboot after installation. For a complete set of documentation, select “Servers” at: http://www.sun.com/documentation Installing a USB Card in a Sun Fire 4800/6800 1. Shut down your system and remove the Sun Fire 4800/6800 PCI I/O assembly. Refer to the Sun Fire 6800/4810/4800/3800 Systems Service Manual for details on removing and replacing PCI I/O assemblies. a. Loosen the four I/O assembly captive Phillips screws and pull the ejector levers outward (FIGURE 4-5). b. Slide out the I/O assembly and place it on an ESD mat close to the system. 2. Attach the antistatic wrist strap and connect it to the I/O assembly. 3. Place the I/O assembly on its side. 4. Position the USB card in the I/O assembly (FIGURE 4-5). 5. Guide the USB card into the I/O assembly slot 7 (FIGURE 4-5). Choose any available slot for the card. a. Insert the faceplate end of the USB card into the appropriate opening in the I/O assembly back panel. b. Guide the opposite end of the USB card into the card slot. c. Secure the faceplate to the I/O assembly with the two Phillips screws.26 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 FIGURE 4-5 Installing a PCI USB Card in the Sun Fire 6800 I/O Assembly 6. Insert and secure filler boards into any other open slots. 7. Replace the I/O assembly into the Sun Fire 4800/6800 chassis. a. Line up the I/O assembly with the chassis I/O assembly opening and slide the assembly into the chassis. b. Simultaneously press the two ejector levers inward and tighten the four captive Phillips screws snugly by hand. Note – In order for the USB PCI card to be recognized by Solaris 8 update 7, you must always reboot the Sun Fire 4800/6800 with the -r flag. Ejector levers (2) Captive screws (4) PCI USB card Slot 7 Sun Fire 6800 I/O assemblyChapter 4 Installing the Sun Fire Visual Grid System 27 Installing the Software This section is for first time setup only. Please make sure that you have completed the site preparation requirements (“Site Hardware Preparation” on page 18) before proceeding further. Note – Once the Sun Fire Visual Grid system hardware and software are installed and configured for the first time, upgrading the software is simple. The process is detailed in “Upgrading the Sun Fire Visual Grid Software” on page 32. 1. If necessary, install the correct version of the Solaris operating environment on each system and upgrade to the proper Solaris operating environment patch level. See “Operating Environment Requirements” on page 5 and “Software Patches” on page 8 in Chapter 2. Note – The patches required for Sun Fire Visual Grid system are automatically installed when you run the install script (this is a later step). Refer to the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for Sun XVR-4000 graphics accelerator software installation procedures. 2. Before starting the software installation, verify that each slave can bring up the X Window system. For example, log in and start an X Window session (for example, CDE or GNOME) on each Sun XVR-4000 graphics accelerator. A keyboard and mouse be plugged into the USB ports of each slave system, even after the Sun Fire Visual Grid software installation is complete. If not, the X server on the slaves will not be able to start. If necessary, upgrade to the latest Sun XVR-4000 graphics accelerator drivers. See the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for instructions. Sun OpenGL for Solaris software is bundled with the Sun Fire Visual Grid software. 3. Become superuser and set the frame buffer attributes to the same values for each Sun XVR-4000 graphics accelerator in each system. Note – This step is required only if you plan to run your system in Xinerama mode. If not, this step is optional. If you run your system in Xinerama mode, the frame buffer attributes must be set to the same values for each Sun XVR-4000 graphics accelerator in each system. To do this, type the following on each master and slave that has a Sun XVR-4000 graphics28 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 accelerator installed: Where zulun refers to zulu0, zulu1, and so on, as the devices appear in the /dev/fbs directory on each computer. This step is to ensure that the frame buffers are all set with the same properties. Later, after the installation is complete, these settings can be customized for the particular installation. 4. On each slave, make the master the loghost for the slave by modifying the slave system /etc/hosts file. Also, modify the /etc/syslog.conf file on each slave so that the console output is redirected to the master console output. If you do not modify these two files, the slave console output is written on the screen, obscuring the window system when this slave is run as a Sun Fire Visual Grid slave computer. See “Redirecting the Slave Console Output” on page 31. 5. Remotely log in to each slave and run the following: These commands bring down the login screen if it is currently running. These commands cause the login screen for the X Window system not to come up automatically whenever the X Window system is exited or when the Sun Fire Visual Grid system comes up after a reboot. The login screen is not necessary on the slave since the master initiates the X Window system on the slave. 6. Install the software packages on the master and on each slave. For Sun Fire 4800/6800 computers: a. Insert the Sun Fire Visual Grid software CD into the CD-ROM drive, become superuser, go to the following directory and install the required patches. Type: b. Reboot. c. Install the Sun Fire Visual Grid software. Type: # fbconfig -dev /dev/fbs/zulun -defaults # /usr/dt/bin/dtconfig -d # /usr/dt/bin/dtconfig -kill # cd /cdrom/cdrom0/ # ./install_patches # ./installChapter 4 Installing the Sun Fire Visual Grid System 29 d. Respond to the installation prompts. You need to know whether you are installing the software on a master or slave. For Sun Fire V880z computers: a. Insert the Sun Fire Visual Grid software CD into the CD-ROM drive, become superuser, go to the following directory and install: b. Respond to the installation prompts. You need to know whether you are installing the software on a master or slave. 7. Reboot the master and each slave. No special boot flags are required on a Sun Fire V880z. The Sun Fire 4800/6800, however, requires the -r flag for the boot command to recognize the PCI USB board. 8. With the dzadmin software administration tool, create your system configuration and install it on the master. You should remotely log in (rlogin) to the master computer from the administration workstation and then run dzadmin. When you are finished with this step, exit the dzadmin tool. Carefully follow the directions the first time using this tool. See “dzadmin Administration Tool” on page 37. 9. Modify /etc/dt/config/Xservers on the master to match the multi-display installation created in the administration tool (dzadmin). The Xservers file controls on what frame buffers X Windows appears. The dzadmin tool appends a string to the end of the /etc/dt/config/Xservers file when the dzadmin install button is pushed. Uncomment that line by removing the pound sign (#) in front of it; comment out the old entry by adding a “#” in front of it. Every installation with the dzadmin tool appends a new commented-out X servers string to the end of the Xservers file. Note – The Xservers file on the slave system is always ignored by the software. See the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for more details on how to modify the Xservers file. # cd /cdrom/cdrom0/ # ./install30 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 10. Bring up the window system login screen in Sun Fire Visual Grid mode. If the window system is running on the master, log out of the session. On the master, from a remote shell, run the following as superuser: The window system is reset to the new settings. The X window login screen should now appear. (The command-line output from dzstartup might list an error condition; ignore this message.) 11. On the master, log in through the X Window login screen. After the window system appears across the frame buffers, run an OpenGL program on each display to verify the installation. For example, type the following: If the window system is running in Xinerama mode, there is only one logical display, which enables you to move the program window across the different displays. In a non-Xinerama installation, separately test each display. Installation is now complete. See Appendix A, Troubleshooting, or contact your Sun service representative if installation problems occur: http://www.sun.com/service/online # /usr/sbin/dzstartup start # /usr/dt/bin/dtconfig -reset % setenv DISPLAY :0.0 % /usr/openwin/demo/GL/ogl_install_checkChapter 4 Installing the Sun Fire Visual Grid System 31 Redirecting the Slave Console Output On each slave, modify the /etc/syslog.conf file so that the output from the console goes to the master console output. If this is not done, console messages appear on the slave screen, obscuring rendering. Modify the /etc/syslog.conf file on each slave as follows. 1. Comment (#) the following line in the file: # *.err;kern.notice;auth.notice /dev/sysmsg 2. Add the following line to the file right after the commented out line: *.err;kern.notice;auth.notice @loghost 3. Comment (#) the following line in the file: # user.err /dev/sysmsg 4. Add the following line to the file right after the commented out line: user.err @loghost Ensure that the line being replaced is a comment. Add the additional line after the replaced line as shown is this sample /etc/syslog.conf file: On each slave, designate the master as the loghost. Modify the /etc/hosts file by removing the loghost notation from the slave line to the master line, and by making the master the loghost. Ensure that there is a line in the /etc/hosts file that contains the master IP address. This line should have been added during the Gigabit Ethernet network installation process. Example original /etc/hosts file: # *.err;kern.notice;auth.notice /dev/sysmsg *.err;kern.notice;auth.notice @loghost # user.err /dev/sysmsg user.err @loghost 127.0.0.1 localhost 10.5.28.254 slavehost loghost 11.5.28.254 dzslave0 ## slave gigabit ethernet 11.5.28.28 dzmaster ## master gigabit ethernet32 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Example modified /etc/hosts file: These changes, combined with the /etc/syslog.conf change described earlier in this section, redirects each slave console output to the master in the /var/adm/messages file. For these changes to take effect, reboot the slave, or more preferably, run the syslog script as superuser in /etc/init.d: See Appendix A for troubleshooting information. Upgrading the Sun Fire Visual Grid Software If the Sun Fire Visual Grid software is being installed for the first time, follow the procedures in “Site Hardware Preparation” on page 18 and “Installing the Software” on page 27. If you are upgrading the software in an existing Sun Fire Visual Grid software installation, follow the directions in this section. The Sun Fire Visual Grid software packages are specific to the Solaris 8 operating environment. The installation script automatically detects the operating environment and installs the correct packages and patches. In addition to Sun Fire Visual Grid software, these packages automatically install the correct version of OpenGL 1.3, a recent OpenGL 1.3 patch, a Java 1.4 runtime environment, and the drivers for the Myrinet cards, as necessary. The entire release is bundled into a single executable that is run from the command line and is menu driven. Note – Install the software upgrade from the command line and not while the Sun Fire Visual Grid software window system is running. 127.0.0.1 localhost 10.5.28.254 slavehost 11.5.28.254 dzslave0 ## slave gigabit ethernet 11.5.28.28 dzmaster loghost ## master gigabit ethernet # /etc/init.d/syslog stop # /etc/init.d/syslog startChapter 4 Installing the Sun Fire Visual Grid System 33 1. Insert the Sun Fire Visual Grid software CD into the CD-ROM drive, become superuser, go to the following directory, and type: Respond to the installation prompts. You need to know whether you are installing the software on a master or slave. If a trustedhosts file already exists on the systems for security reasons (see Chapter 6), the script acknowledges this and retains the trustedhosts settings. Note – All master and slave computers must be upgraded. If only a subset of the machines are upgraded, and an attempt is made to run the Sun Fire Visual Grid software, the software issues an error message at run time and exit. To remove previously installed Sun Fire Visual Grid software packages, use the ./uninstall command, and respond to the removal prompts. An uninstall completely removes the previous installation. However, the install script only installs components that have been updated since the last release, and does not reinstall the other components on the computer. 2. After completing the installation, reboot each master and slave. Previous state settings, such as an installed system configuration file, remain in effect from release to release. The system should just appear with the previous settings after the software upgrade. # cd /cdrom/cdrom0 # ./install34 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Interchanging a Master and Slave In some complex configurations, it might be desirable to use the same computer interchangably as a master and a slave. Select the master option when installing software on any computer that may be a master computer, even if it will initially serve as a slave computer. You select master or slave when responding to the software installation script. See Step 6 in “Installing the Software” on page 27. Modify the trustedhosts file (/etc/openwin/dz/trustedhosts) on each computer to contain all the hosts that may be required. Or, alternatively, remove the trustedhosts file on a computer to enable any computer to administer/control it. On a slave computer, the trustedhosts file, at a minimum, contains “localhost” and the Gigabit Ethernet hostname of the master computer. On a master, it contains, at a minimum, “localhost” and the output of uname -n on the master. The union of these names is required for a computer’s trustedhosts file to be either a master or a slave. Run the following command sequences from the administration workstation. Changing a Master to a Slave Computer To stop a computer from being a master (if you are changing master computers), do the following steps. 1. On the master computer, type: Where backup file is the filename you selected as the backup file. 2. Perform any necessary Myrinet recabling after you have executed the above commands. 3. Once a computer is no longer a master, you can add it as a slave to another master computer by running dzadmin on the new master. # /etc/init.d/dtlogin stop (stops the X server) # /usr/sbin/dzstartup stop (stops the Sun Fire Visual Grid service) # mv /etc/openwin/dz/system.dzcfg backup fileChapter 4 Installing the Sun Fire Visual Grid System 35 4. Once the new configuration is complete in dzadmin, select Actions -> Configure Myrinet Hardware from the administration tool Actions menu. This automatically reconfigures the Sun Fire Visual Grid system to the new Myrinet hardware setup. See “The System Administration Tool Menus” on page 41 for a description of the menus. 5. Select Install to install the configuration. Manually update the /etc/dt/config/Xservers file on the new master computer. Occasionally, you may need to reboot any computer that was part of the Myrinet recabling before dzadmin successfully installs a new installation on the new master computer. 6. Verify that the old master computer is no longer designated as a master. To do this, run /usr/sbin/dzstatus on the old master computer. Removing a Slave Computer To stop a computer from being a slave, do the following steps. Perform this if you are keeping the same master computer but removing or changing slave computers: 1. On the master computer, type: 2. Perform any necessary Myrinet recabling after you have executed the above commands. 3. Run dzadmin on the master computer and remove this slave computer from the configuration. 4. Select Install to install the configuration. Manually update the /etc/dt/config/Xservers file on the master. 5. Run dzstartup start. 6. Restart X window by running /etc/init.d/dtlogin start. Occasionally, you may need to reboot any computer that was part of the Myrinet recabling before dzadmin successfully installs a new installation on the new master computer. 7. Verify that the slave computer is no longer designated as a slave. To do this, run /usr/sbin/dzstatus on the slave computer. # /etc/init.d/dtlogin stop # dzstartup stop36 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Configuring the Frame Buffer Attributes Once a Sun Fire Visual Grid system installation has been successfully completed, you can configure all of the remote frame buffers from the master machine. To see a list of frame buffers recognized by the system, type the following on the master machine: All the frame buffers with dzfb in the name are Sun Fire Visual Grid frame buffers. The following command lists the properties of the first Sun Fire Visual Grid frame buffer: The following command lists the possible commands: Using fbconfig to administer a Sun Fire Visual Grid frame buffer is no different than using fbconfig to administer a local Sun XVR-4000 graphics accelerator. Most fbconfig changes require restarting the X server. Log out of the X Window system on the master and log back in. The Sun Fire Visual Grid software automatically restarts the X server on the slaves during this process. When a slave is running in Xinerama mode, the entire slave system is addressed as a single device from the master system (for example, dzfb0). So using fbconfig on a single device affects both of the slave frame buffers. The fbconfig -list lists only a single device for the slave when it is running in Xinerama mode. Refer to the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for details on the effect of various fbconfig commands on the Sun XVR-4000 graphics accelerator. # fbconfig -list # fbconfig -dev /dev/fbs/dzfb0 -propt # fbconfig -dev /dev/fbs/dzfb0 -help37 C H A P T E R 5 System Administration This chapter describes the dzadmin configuration tool that system administrators use to configure a Sun Fire Visual Grid system.
“dzadmin Administration Tool” on page 37
“The System Administration Tool Menus” on page 41
“Starting the dzadmin System Administration Tool” on page 43
“Using the dzadmin System Administration Tool” on page 45
“dzstatus Status Tool” on page 48
“Sun Fire Visual Grid Limitations” on page 49
“Framelock and Genlock” on page 49 dzadmin Administration Tool The dzadmin program is the system administration configuration tool that system administrators use to configure a Sun Fire Visual Grid system. The dzadmin tool is a Graphical User Interface (GUI) (FIGURE 5-1). You must run dzadmin on a Sun Fire Visual Grid system master with a slave present. The dzadmin tool dynamically queries the master and slaves for the available hardware; these details appear in the tool GUI. The Sun Fire Visual Grid system achieves communication between master and slave machines by running a network aware daemon, called dzdaemon, on each machine. dzdaemon always comes up automatically when a system is rebooted.38 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Administration Tool Overview The Sun Fire Visual Grid system master is configured using the Master Machine Configuration panel of the Sun Fire Visual Grid System Administration window (FIGURE 5-1). From the dzadmin System Administration window menu system (Actions -> Add Slave), you can add slaves to the configuration. The addition of each slave adds a new slave panel to the Slave Machine Configurations panel. From this panel, you can set the characteristics of each slave (FIGURE 5-1). As each slave is added, the tool automatically queries the frame buffer information from that slave. The information appears in the Slave Machine Configurations panel. The Messages panel provides feedback about the tool’s progress and reports any problems. FIGURE 5-1 Sun Fire Visual Grid Software Administration Tool Once a configuration has been generated, you can save it as a file for later use or you can install it onto the master for immediate operation (from either Actions menu or pressing the Install button). Save a configuration by saving it as a user-named file. To load a file into the GUI, select Load from the File menu (File -> Load). A newly installed configuration becomes the default system configuration. The dzadmin toolChapter 5 System Administration 39 overwrites the previous configuration file in /etc/dz/openwin/system.dzcfg. To be safe, save an existing installation to a file before installing another configuration. The newly installed configuration takes effect after you modify the /etc/dt/config/Xservers file and restart the existing X session. The Xservers file determines which screens and what command line arguments the X server will use. Once the configuration in dzadmin has changed, it is important to modify the Xservers file before restarting the X server, or the system will not come up properly. When the Install button was pressed on the dzadmin administration tool, it appended a commented-out sample line to the bottom of the Xservers file that corresponds to the particular configuration in the tool. Comment out the existing line in the file (adding a pound sign “#” to the front of the line) and then uncomment the newly appended line (removing # in front of the line) before restarting the X server. Alternatively, the following command, as superuser, causes the new configuration to come up immediately, and causes the X server to restart if the configuration has changed: If the X session is being started from the command line, you must run /usr/sbin/dzstartup start in between invocations of X sessions. That is, you must run the start command again if the device configuration changes (for example, if slave machines were added or deleted, or a frame buffer was added to a slave). You also must run start if the user changes from Xinerama mode to nonXinerama mode or vice versa. When you select the Install option in the Actions menu, it automatically prompts the user to save the configuration to a user-named file. A new installation automatically overwrites the previously installed system.dzcfg file. To recover it, refer back to the backup file you created while installing it. To be safe, save an existing installation to a file by saving it before installing another configuration. master# /usr/sbin/dzstartup start40 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Using Xinerama and dzadmin In an ordinary multiscreen system without Sun Fire Visual Grid software, it is possible to switch to or from Xinerama mode by modifying the Xservers file and restarting the windowing system. The X servers file is located at /etc/dt/config/Xservers. The Xservers file, if it does not already exist, is automatically created by the Sun Fire Visual Grid software package installation. In a Sun Fire Visual Grid system, when switching back and forth between Xinerama and non-Xinerama mode, you must modify the Xservers file in the same way. And you must check or uncheck the Xinerama box in the Frame Buffers panel located within the slave panel in the dzadmin tool. This is extra step is necessary because in Xinerama mode, Sun Fire Visual Grid software sees a pair of frame buffers in a slave as a single device on the master. The single device displays twice the resolution of the individual devices. You must set the frame buffer attributes of a system running in Xinerama mode to the same values. See “Upgrading the Sun Fire Visual Grid Software” on page 32 for more details.Chapter 5 System Administration 41 The System Administration Tool Menus There are two menus on the Sun Fire Visual Grid software administration tool (dzadmin) menu bar: File and Actions. File Menu FIGURE 5-2 shows the File menu. FIGURE 5-2 Sun Fire Visual Grid Software Administration Tool File Menu TABLE 5-1 describes the File menu items. TABLE 5-1 File Menu Menu Item Description New Creates a new, blank configuration file. Open... Opens the file menu to select a particular configuration file to load. Open Installed Configuration Loads and displays the currently installed master configuration. Save Saves the configuration file to disk. This does not install the configuration file. Save As. Saves the configuration file to disk by a selected filename. This does not install the configuration file. Exit Exits the system administration tool.42 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 Actions Menu FIGURE 5-3 shows the Actions menu. FIGURE 5-3 Sun Fire Visual Grid Software Administration Tool Actions Menu TABLE 5-2 describes the Actions menu items. TABLE 5-2 Actions Menu Menu Item Description Add Slave Adds a slave to the configuration. Remove Slave Removes a slave from a configuration. Configure Myrinet Hardware Automatically reconfigures the Sun Fire Visual Grid system to a new Myrinet hardware setup. Install Installs the configuration file. Shutdown Stops the daemon on both master and slave computers.Chapter 5 System Administration 43 Starting the dzadmin System Administration Tool The dzadmin tool does not make any dynamic changes to the system configuration until the user installs the system configuration. Therefore, you can use the tool to create new configuration profiles while the Sun Fire Visual Grid system is in use by other users. Run dzadmin on the master by setting the DISPLAY environment variable so that you can become host (xhost) to the administration workstation. The application displays on the screen of the administration workstation. To start the dzadmin tool: 1. Become superuser and set the administration workstation DISPLAY environment variable. Type: Where master is the master host and admin is the name of the administration workstation. 2. Start dzadmin. Type: The Sun Fire Visual Grid software administration tool then appears on the administration workstation screen (FIGURE 5-4). admin# rlogin master master# setenv DISPLAY admin:0.0 master# /usr/sbin/dzadmin&44 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 The administration tool consists of three panels: Master Machine Configuration, Slave Machine Configuration, and Messages. FIGURE 5-4 Sun Fire Visual Grid Software Administration Tool 3. Go to “Using the dzadmin System Administration Tool” on page 45.Chapter 5 System Administration 45 Using the dzadmin System Administration Tool 1. Start the dzadmin administration tool See “Starting the dzadmin System Administration Tool” on page 43. 2. Enter the master nodename in the Master Machine field. a. Enter the master nodename, or enter localhost. To find the master machine nodename, type: b. Press Enter or Tab to move to the next field. Caution – Do not enter the master Gigabit Ethernet nodename in the master field. This can cause a security problem for secure setups. After you fill in the Master Machine field (FIGURE 5-5), dzadmin queries the hardware on the master computer. If a current Sun Fire Visual Grid system.dzcfg installation file exists on this master, a dialog box appears prompting you to load it into the tool. If the file is not installed, you will enter the information in the steps of this procedure. host% uname -n46 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 FIGURE 5-5 Master Machine Configuration Panel Note – The X server options in the /etc/dt/config/Xservers file must be manually edited to match the options in the dzadmin tool after the Install button has been pressed. See Step 7. 3. Configure the X server options for the master machine. Choose the required color depth and select Xinerama, if required. If you select Xinerama here, all the displays are combined into one large flat X screen.Chapter 5 System Administration 47 4. Add the required number of slave machines one at a time. a. From the administration tool menu bar, choose Actions -> AddSlaves. A Slave Machine Configurations panel displays for each computer (FIGURE 5-6). A (1) indicates the first slave, a (2) indicates the second slave, and so on. FIGURE 5-6 Slave Machine Configuration Panel b. In each slave panel, enter the name of the slave using its Gigabit Ethernet nodename in the Machine Name field, and press Enter or Tab. The hardware on the slaves is dynamically queried, and appears as configurable options in the dzadmin tool. c. Adjust the Slaves Machine Configuration panel as required. For example, you may want to select color depth, Xinerama, or particular frame buffers on the slave. 5. After you add all the slaves to the configuration, install the configuration. Press the Install button on the Master Machine Configuration Panel (FIGURE 5-5). Note – You are prompted to save the configuration in a user-named file as a backup before installation. Install the new configuration, in addition to saving it to a file, or the configuration does not take effect.48 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 6. Exit dzadmin. Choose File -> Exit from the administration tool menu bar. 7. Make necessary changes to the /etc/dt/config/Xservers file. The Xservers file controls which frame buffers the window system and X Windows appear on. The dzadmin tool appends a string to the end of the /etc/dt/config/Xservers file when the dzadmin Install button is pushed. Uncomment the appended line string at the end of the file by removing the pound sign (#) in front of it, and comment out the old entry above it by adding a “#” in front of the line. See Chapter 5 of the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for more details on how to modify the Xservers file. 8. If a window session is currently running, log out and log back in. The window system restarts with the configuration changes you have made. Or, if you are not already logged in, select Reset from the Options menu from the desktop login screen, this causes the session to use the new settings. dzstatus Status Tool The dzstatus program, found in /usr/sbin, queries dzdaemon on the local host and prints its status. dzdaemon is a daemon that runs in the background as part of the Sun Fire Visual Grid system. It exchanges set up and connection initiation information among computers in the system. dzstatus reports whether the local dzdaemon is designated as a master or slave in the Sun Fire Visual Grid system, and what network transport layer is being used for passing 3D graphics protocol. This information can be useful in diagnosing configuration problems. See Appendix A for troubleshooting information. Note – The format of the dzstatus output is subject to change without notice. Care should be taken in writing scripts that parse the output.Chapter 5 System Administration 49 Sun Fire Visual Grid Limitations GLX (indirect) rendering on the master is supported (for example, master:0.2), but the network connection used is TCP and not Myrinet. It is never correct to set the display for indirect rendering to the slave display (for example, slave:0.0). Only six concurrent OpenGL applications can simultaneously use the high-speed Myrinet connection. The seventh and subsequent concurrent OpenGL applications fall back to using the slower Gigabit Ethernet connection. Applications using the slower link do not automatically migrate to the Myrinet connection if space becomes available when one of the first six applications terminates. The application must be restarted to use the faster network. This is only a performance limitation, functionality is not affected. Framelock and Genlock For the Sun Fire Visual Grid system, framelock and genlock are configured as if all the frame buffers were installed in the same host; therefore, the software setup and cabling requirements do not change. All of the fbconfig commands are issued on the master machine. The only difference is the device names, dzfbn is the device name for the Sun Fire Visual Grid frame buffers (instead of zulun). See the Sun Fire V880z Server and Sun XVR-4000 Graphics Accelerator Installation and User’s Guide for details on how to framelock and/or genlock multiple Sun XVR-4000 graphics accelerators.50 Sun Fire Visual Grid System Installation and User’s Guide • November 200351 C H A P T E R 6 Security This chapter describes the Sun Fire Visual Grid software security measures used by the dzdaemon program.
“dzdaemon Daemon” on page 51
“Role-Based Access” on page 52 dzdaemon Daemon The Sun Fire Visual Grid software uses a daemon (dzdaemon) running on each computer in the installation to set up and control the Sun Fire Visual Grid system. This dzdaemon is responsible for the following:
Installing and modifying configuration files on the master computer
Running dtlogin -kill on the slave computers
Starting X window on the slave computers
Starting oglserver on the slave computers
Configuring and installing the dzfb devices on the master computer
Configuring the Myrinet network The dzdaemon daemon architecture has access to the system resources required by the Sun Fire Visual Grid system. The architecture includes an optional trusted hosts system to restrict which computers on a network can communicate with dzdaemon. The Sun Fire Visual Grid software installation script prompts the user to create trusted hosts files, although this option can be declined. On the slave computers the trusted hosts file (/etc/openwin/dz/trustedhosts) is a text file that should contain the names (or IP addresses) of the Gigabit Ethernet connection to the master computer (or set of masters if the configuration is changed regularly) and localhost. The name or IP address referring to the master in the slave52 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 trustedhosts file should be the same connection over which the master sends X protocol to the slave. On the master, the trustedhosts file should simply contain the name (uname -n output) or IP address of that master and localhost. The Sun Fire Visual Grid system uses the following port numbers for master-slave communication over TCP and UDP protocols: These ports have been registered with the Internet Assigned Numbers Authority (IANA) and can be referenced at: http://www.iana.org/assignments/port-numbers Role-Based Access The Sun Fire Visual Grid system can provide role-based access to users of dzadmin. This enables users other than root to modify the system setup using dzadmin. To give a user the ability to run dzadmin:  Add the following line (all on one line) to the /etc/user_attr file: Where username is the name of the user to whom you are granting access. TABLE 6-1 TCP and UDP Protocols Program Protocol Port dzdaemon 3866/tcp DZDAEMON Port dzdaemon 3866/udp DZDAEMON Port dzoglserver 3867/tcp DZOGLSERVER Port dzoglserver 3867/udp DZOGLSERVER Port username::::auths=solaris.dz.admin;profiles=Visual Grid Administration53 A P P E N D I X A Troubleshooting This appendix provides troubleshooting information.
“Log Files” on page 53
“General Troubleshooting Information” on page 54
“Verifying the Myrinet Software” on page 55 For additional technical support, see Support Services at: http://www.sun.com/service/online Log Files For information about installation problems, view the log files. The following log files can be helpful in debugging installation problems: /var/dt/Xerrors /var/dt/dzlog /tmp/dz_daemon_out /var/dt/dz/master.* /var/adm/messages The file /tmp/dzdaemon_out on each computer might contain the output and errors from the local dzdaemon.54 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 General Troubleshooting Information
If dzstartup reports problems, review the log file /var/dt/dzlog. Try running /usr/sbin/dzstartup start on the master.
X startup errors are logged in /var/dt/Xerrors. If X fails to start, try starting from the command line using Xsun -dev /dev/fbs/dzfb0. Since X takes control of the local keyboard run this test from a shell that you log on to remotely from the administration workstation. Test out each dzfb device independently in this manner.
If the slave needs to be rebooted, the system administrator might have to start and - reset the Sun Fire Visual Grid system from the master as shown below (preferably from a shell window on the administration workstation using rlogin to communicate to the master computer).
When installing a system from scratch, start without using Xinerama mode. When the installation is complete, you can switch to Xinerama mode using the dzadmin tool.
Running /usr/sbin/dzstatus returns the current status of dzdaemon. This should return DESIGNATED_MASTER on the master machine, and DESIGNATED_SLAVE on the slave machine. If not, either reboot the machine with the improper designation, or preferably, run dzstartup start from the master.
A keyboard and mouse must always be plugged into the USB ports on the Sun Fire V880z slave, otherwise the X server fails to come up properly.
If you are using a trustedhosts file on the slave, make sure that the file contains at least a “localhost” entry and the hostname of the master system Gigabit Ethernet connection (not the master system 100 Mbit/sec connection). See Chapter 6 for more details.
A Sun Fire 4800 or Sun Fire 6800 often requires a -r flag to the boot command (boot -r) in order to recognize the USB card, and to recognize the keyboard and mouse. This flag, however, causes the X server to fail to start. You can discover if this is the problem by:
Looking for an error message in the /var/dt/Xerrors file that contains the string VUIDGFORMAT.
Confirming that there is no keyboard or mouse entry in the /dev/usb directory, as there should be with properly functioning USB card software. # /usr/sbin/dzstartup start # /usr/dt/bin/dtconfig -resetAppendix A Troubleshooting 55 Verifying the Myrinet Software The Myrinet software is installed in three packages (SUNWmyril, SUNWmyrir, and SUNWmryix) as part of the overall Sun Fire Visual Grid software installation. The Myrinet cards should appear in the “Primary 3D Network” panel the first time that the dzadmin tool is run. To manually verify the installation after the Sun Fire Visual Grid software has been installed, type: The output should list each of the boards installed in the local server. # cd /opt/SUNWmyri/bin # ./gm_board_info56 Sun Fire Visual Grid System Installation and User’s Guide • November 200357 Index A Actions menu, 42 administration tool GUI, 44 administration workstation, 19 C cabling master and slaves, 24 CD software, 6, 7 configuration examples, 16 configuring frame buffer attributes, 36 D documentation, 2 dzadmin Actions menu, 42 File menu, 41 starting, 43 using, 45 dzadmin administration tool, 37 dzadmin administration tool overview, 38 dzadmin and Xinerama, 40 dzdaemon daemon, 51 dzfb, frame buffers, 36 dzstatus status tool, 48 E Ethernet network, setting up, 19 extenders, keyboard and mouse, 14 F fbconfig, 36, 49 File menu, 41 frame buffer attributes, configuring, 36 framelock and genlock, 49 G genlock and framelock, 49 H hardware requirements, 12 I I/O assembly, Sun Fire 4800/6800, 21, 25 installation kit, 2 installation overview, 3 interchanging master and slave, 3458 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 K keyboard and mouse extenders, Sun Fire 4800/6800, 14 L log files, troubleshooting, 53 M master and slave, interchanging, 34 menus, system administration tool, 41, 42 Myrinet cables, 13 Myrinet card installation Sun Fire 4800/6800, 21 Sun Fire V880z, 23 Myrinet cards, 12, 13 Myrinet cards, cabling, 24 N networking hardware, 12 Myrinet cables, 13 Myrinet cards, 12, 13 serial port, Sun Fire 4800/6800, 13 USB card, Sun Fire 4800/6800, 13 O OpenGL 1.3 patches, 10 OpenGL 1.3 software package locations, 9 OpenGL 1.3 software package names, 9 operating environment requirements, 5 overview, 1 P patches OpenGL 1.3, 10 Sun Fire Visual Grid software, 8 PCI I/O assembly, Sun Fire 4800/6800, 21, 25 R redirecting slave console output, 31 role-based access, 52 S security, software, 51 serial port, Sun Fire 4800/6800, 13 site preparation, 18 slave console output, redirecting, 31 software installation, 27 software package locations, 7 software packages CD directory names, 6, 7 software patches, 8 OpenGL 1.3, 10 Sun Fire Visual Grid software, 8 software requirements, 5 starting dzadmin, 43 Sun Fire 4800/6800 I/O assembly, 21, 25 keyboard and mouse extenders, 14 Myrinet card installation, 21 USB card installation, 25 Sun Fire V880z, Myrinet card installation, 23 Sun Fire Visual Grid software installation, 27 patches, 8 security, 51 software packages, 6, 7 troubleshooting, 53 upgrade, 32 Sun Fire Visual Grid system administration tool GUI, 44 administration tool overview, 38 administration workstation, 19 cabling Myrinet cards, 24 con?guration examples, 16 con?guring frame buffer attributes, 36 documentation, 2 dzadmin administration tool, 37, 41, 42 dzadmin overview, 38 dzdaemon, 51 dzstatus tool, 48 framelock and genlock, 49 hardware requirements, 11Index 59 installation, 15 installation kit, 2 installation overview, 3 limitations, 49 Myrinet card installation, 21, 23 networking hardware requirements, 12 OpenGL packages, 9 overview, 1 role-based access, 52 site preparation, 18 software installation, 27 software packages, 6, 7 Sun XVR-4000 graphics accelerator, 1, 11 supported con?gurations, 14 technical support, 3 USB card installation, 25 Sun XVR-4000 graphics accelerator framelock and genlock, 49 overview, 1 software requirements, 10 Xservers ?le, 48 supported configurations, 14 system administration, 37 system administration tool menus, 41, 42 system administration tool overview, 38 T TCP and UDP protocols, 52 technical support, 3 troubleshooting, 53 general information, 54 log ?les, 53 verifying Myrinet software, 55 U upgrading Sun Fire Visual Grid software, 32 USB card installation, Sun Fire 4800/6800, 25 USB card, Sun Fire 4800/6800, 13 using dzadmin, 45 V verifying Myrinet software, 55 X Xinerama, 4060 Sun Fire Visual Grid System Installation and User’s Guide • November 2003 SPARC T4-1 Server Product Notes Part No.: E22987-04 December 2011Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation vii 1. Late Breaking Information 1 Preinstalled Software 1 Oracle Solaris OS, Firmware, and Software Information 2 Required Patches and Patch Updates 2 Oracle Solaris 10 OS Patches 3 Oracle Solaris 11 OS Package Updates 3 2. Known Product Issues 5 Hardware Issues 5 Direct I/O Support 5 Use Links Labeled SPARC T3 to Download sas2ircu Documentation for SPARC T4 Servers 6 Sun Type 6 Keyboards Are Not Supported By SPARC T4 Series Servers 6 Caution Needed When Removing a SATA Data Cable From a Backplane Connector 6 Caution Needed When Handling the Connector Board 6 I/O Performance Might Degrade When Using More Than Two Ports Across Multiple Sun Dual 10 GbE SFP+ PCIe Cards (CR 6943558) 7 Enable Flow Control (Include System Reboot) 8 Enable Flow Control (Without System Reboot) 8iv SPARC T4-1 Server Product Notes • December 2011 Server Panics When Booting From a USB Thumbdrive Attached to the Front USB Ports (CR 6983185) 8 PSH Might Not Clear a Retired Cache Line on a Replaced Motherboard (CR 7031216) 9 PCIe Correctable Errors Might Be Reported (CR 7051331) 9 L2 Cache Uncorrectable Errors Might Lead to an Entire Processor Being Faulted (CR 7065563) 10 L2 Cache UEs Are Sometimes Reported as Core Faults Without Any Cache Line Retirements (CR 7071237) 13 Upon a Reboot After an Unrecoverable Hardware Error, CPUs Might Not Start (CR 7075336) 13 reset /SYS Operations Can Cause the SAS Controller to Disappear (CR 7082665) 14 SAS Command Might Fail to Complete When Certain SAS Devices Are Put Under Heavy Load (CR 7088469) 16 Rebooting an SDIO-SAS HBA Guest Domain Might Generate ereport.io.pciex.pl.re (CR 7048307) 16 Oracle Solaris OS Issues 17 Cannot Boot Oracle Solaris 10 10/09 OS (U8) From the Internal DVD 17 Spurious Interrupt Message in System Console (CR 6963563) 17 Spurious Error Message During Initial Oracle Solaris OS Installation (CR 6971896) 17 When diag-switch? is Set to true, Oracle Solaris OS Fails to Update EEPROM for Automatic Rebooting (CR 6982060) 18 Memory Allocation Issues With Emulex 8Gb HBAs In a Magma IO Expansion Box (CR 6982072) 19 Fault Management Sometimes Sends Resolved Cases to the SP (CR 6983432) 20 Gigabit Ethernet (nxge) Driver Not Loading on Systems With Oracle Solaris 10 10/09 OS and a Solaris 10 9/10 Patchset or Solaris 10 8/11 Patchset (CR 6995458) 21 The cfgadm Command Fails for Certain HBAs (CR 7044759) 22 Watchdog Timeouts Seen With Heavy Workloads and Maximum Memory Configurations (CR 7083001) 23Contents v ereport.fm.fmd.module Generated During a Reboot of an SDIO Domain (CR 7085231) 24 Benign Error Message: mptsas request inquiry page 0x83 for target:a, lun:0 failed! (CR 7092982) 25 Oracle VTS dtlbtest hangs when the CPU Threading Mode is Set to maxipc (CR 7094158) 25 Firmware Issues 25 Timestamp for an Oracle ILOM Fault/Critical Event Might Be Off by One Hour (CR 6943957) 25 e1000g Driver Generates Spurious ereports When Installing Oracle Solaris OS Over a Sun PCIe Dual Gigabit Ethernet Adapter (CR 6958011) 26 Missing Interrupt Causes USB Hub Hotplug Thread to Hang, Resulting In Process Hangs (CR 6968801) 26 sas2ircu Message That RAID Volume Sizes Other Than “MAX” Are Not Supported Needs Clarification (CR 6983210) 27 Units Used to Define the MIB Power Management Time Limit Are Reported in Seconds (CR 6993008) 27 Message From cpustat Refers to Processor Documentation Incorrectly (CR 7046898) 27 reboot disk Command Occasionally Fails When disk Argument Picks Up Extra Characters (CR 7050975) 28 Explicit Processor Binding Might Block Strand Retirement (CR 7071974) 28 Blue LED On Drive Does Not Light When The Drive Is Ready To Remove (CR 7082700) 28 Documentation Issues 29 Hardware RAID Guidelines are Missing from Administration Guide 29vi SPARC T4-1 Server Product Notes • December 2011vii Using This Documentation This document contains late-breaking information and known issues for Oracle’s SPARC T4-1 server. ¦ “Related Documentation” on page vii ¦ “Feedback” on page viii ¦ “Support and Accessibility” on page viii Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 server http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1 Oracle Solaris OS and other systems software http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Oracle Integrated Lights Out Manager (ILOM) 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0viii SPARC T4-1 Server Product Notes • December 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 C H A P T E R 1 Late Breaking Information These product notes contain important and late-breaking information about Oracle’s SPARC T4-1 server. ¦ “Preinstalled Software” on page 1 ¦ “Oracle Solaris OS, Firmware, and Software Information” on page 2 ¦ “Required Patches and Patch Updates” on page 2 Preinstalled Software The preinstalled Oracle Solaris OS is installed on a ZFS file system as described in the following table. Note – Refer to the Customer Information Sheet shipped with your server to identify which version of Oracle Solaris OS is preinstalled. Software Location Function Oracle Solaris 11 OS or Oracle Solaris 10 8/11 OS Root disk Slice 0 (and on Slice 3 in the ABE) Operating system Oracle VM Server for SPARC 2.1 /opt/SUNWldm Manages logical domains Electronic Prognostics 1.2 /opt/ep Provides early warning of the potential for specific FRU faults2 SPARC T4-1 Server Product Notes • December 2011 Oracle Solaris OS, Firmware, and Software Information Note – The download of the Solaris 10 8/11 SPARC Bundle is identified by the number 13058415 at http://support.oracle.com. Required Patches and Patch Updates Note – Oracle Solaris 11 OS uses package updates rather than patches. TABLE 1-1 Supported Versions of the Oracle Solaris OS, Firmware, and Software Software Supported Versions Host OS (preinstalled) • Oracle Solaris 11. • Oracle Solaris 10 8/11 OS. Must install the patches listed in “Required Patches and Patch Updates” on page 2 * . * Refer to the README file provided with the patches for additional information, including patch installation instructions. Earlier host OS (installed by customer) • Oracle Solaris 11. • Oracle Solaris 10 8/11 OS. Must install the patches listed in “Required Patches and Patch Updates” on page 2. • Solaris 10 9/10 OS with the Solaris 10 8/11 SPARC Bundle, followed by the patches listed in “Required Patches and Patch Updates” on page 2. • Solaris 10 10/09 OS with the Solaris 10 8/11 SPARC Bundle, followed by the patches listed in “Required Patches and Patch Updates” on page 2. System firmware 8.1.1.c (Includes Oracle Integrated Lights Out Manager 3.0) Oracle VM Server for SPARC (LDoms) 2.1 Electronic Prognostics on the server host 1.2Chapter 1 Late Breaking Information 3 Oracle Solaris 10 OS Patches You should install the patches listed in TABLE 1-2 before using the server with the Oracle Solaris 10 8/11 OS. In addition to installing the minimum required patches listed in TABLE 1-2, you should download and install “Recommended OS Patchset Solaris 10 SPARC”. This patchset contains Oracle Solaris 10 OS patches that address current Sun Alerts. If you want to use an earlier version of the Oracle Solaris OS, you must install the Solaris 10 8/11 SPARC Bundle. After installing the Solaris 10 8/11 SPARC Bundle, you must then install the required patches listed in TABLE 1-2. Oracle Solaris 11 OS Package Updates No package updates are required at this time to use Oracle Solaris 11 OS with this server. You should install an Oracle Solaris 11 Support Repository Update (SRU), if one is available. Use the pkg command or the package manager GUI to download any available SRU from: https://pkg.oracle.com/solaris/support TABLE 1-2 Minimum Required Patchset for Oracle Solaris 10 8/11 147440-03 147149-01 147153-01 147707-01 147159-034 SPARC T4-1 Server Product Notes • December 20115 C H A P T E R 2 Known Product Issues This section describes issues that are known to affect Oracle’s SPARC T4-1 servers at the time of this release. The issue descriptions are organized as follows. ¦ “Hardware Issues” on page 5 ¦ “Oracle Solaris OS Issues” on page 17 ¦ “Firmware Issues” on page 25 ¦ “Documentation Issues” on page 29 Hardware Issues This section describes issues related to SPARC T4-1 server components. Direct I/O Support Only certain PCIe cards can be used as direct I/O endpoint devices on an I/O domain. You can still use other cards in your Oracle VM Server for SPARC environment, but they cannot be used with the Direct I/O feature. Instead, they can be used for service domains and for I/O domains that have entire root complexes assigned to them. For the most up-to-date list of supported PCIe cards, refer to: https://support.oracle.com/CSP/main/article?cmd=show&type= NOT&doctype=REFERENCE&id=1325454.16 SPARC T4-1 Server Product Notes • December 2011 Use Links Labeled SPARC T3 to Download sas2ircu Documentation for SPARC T4 Servers To download sas2ircu documentation for SPARC T4-1 and T4-2 servers from the current LSI web site, you must use links labeled SPARC T3-1 and T3-2. The firmware and documentation are the same for both sets of servers. This is the web site for downloading sas2ircu documentation from LSI: http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx Sun Type 6 Keyboards Are Not Supported By SPARC T4 Series Servers Sun Type 6 keyboards cannot be used with SPARC T4 series servers. Caution Needed When Removing a SATA Data Cable From a Backplane Connector When disconnecting the SATA data cable from the disk backplane, pull the cable straight back, in a perpendicular direction away from the backplane. Caution – Do not rock or twist the cable in any other direction. Doing so could damage the integrity of the data cable connection. Caution Needed When Handling the Connector Board Use caution when handling the connector board to avoid pressing your hand against the pointed end of the guide pin that’s located below the mounting bracket. The guide pin is indicated by an arrow in the following figure.Chapter 2 Known Product Issues 7 I/O Performance Might Degrade When Using More Than Two Ports Across Multiple Sun Dual 10 GbE SFP+ PCIe Cards (CR 6943558) Excessive packet loss might occur when three or more ports are used across multiple Sun Dual 10GbE SFP+ PCIe cards on a SPARC T4-1 server. This is likely to significantly degrade transmit and receive performance. When only two ports are used, packet loss is minimal and transmit/receive performance is as expected. Tip – If performance is unsatisfactory, consider performing the workaround. Workaround: Use one of the following procedures to enable flow control for the interfaces. This will greatly reduce packet loss and improve performance.8 SPARC T4-1 Server Product Notes • December 2011 Enable Flow Control (Include System Reboot) 1. Add the following lines in /kernel/drv/ixgbe.conf 2. Reboot the system to have these changes take effect. Enable Flow Control (Without System Reboot) 1. Add the following lines in /kernel/drv/ixgbe.conf 2. Unplumb all the ixgbe interfaces. 3. Issue the update_drv ixgbe command. 4. Plumb all the ixgbe interfaces again. Server Panics When Booting From a USB Thumbdrive Attached to the Front USB Ports (CR 6983185) When attempting to boot a USB thumbdrive inserted in either front USB port (USB2 or USB3), the server might panic. Workaround: Use the server’s rear USB ports (USB0 or USB1) whenever booting from an external USB device. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;Chapter 2 Known Product Issues 9 PSH Might Not Clear a Retired Cache Line on a Replaced Motherboard (CR 7031216) When a motherboard is replaced to repair a faulty CPU, PSH might not clear retired cache lines on the replacement FRU. In such cases, the cache line remains disabled. Workaround: Manually clear the disabled cache line by running the following command: PCIe Correctable Errors Might Be Reported (CR 7051331) In rare cases, PCIe devices might generate I/O errors that are identified and reported by PSH. For example: # fmadm repaired /SYS/MB/CMP0 --------------- ------------------------------------ -------------- --------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ -------------- --------- Aug 10 13:03:23 a7d43aeb-61ca-626a-f47b-c05635f2cf5a PCIEX-8000-KP Major Host : dt214-154 Platform : ORCL,SPARC-T3-1B Chassis_id : Product_sn : Fault class : fault.io.pciex.device-interr-corr 67% fault.io.pciex.bus-linkerr-corr 33% Affects : dev:////pci@400/pci@1/pci@0/pci@c dev:////pci@400/pci@1/pci@0/pci@c/pci@0 faulted but still in service FRU : "/SYS/MB" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000:serial=1005LCB- 1052D9008K:part=541-424304:revision=50/chassis=0/motherboard=0) 67% "FEM0" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000/chassis= 0/motherboard=0/hostbridge=0/pciexrc=0/pciexbus=1/pciexdev=0/pciexfn= 0/pciexbus=2/pciexdev=12/pciexfn=0/pciexbus=62/pciexdev=0) 33% faulty Description : Too many recovered bus errors have been detected, which indicates a problem with the specified bus or with the specified transmitting device. This may degrade into an unrecoverable fault. Refer to http://sun.com/msg/PCIEX-8000-KP for more information.10 SPARC T4-1 Server Product Notes • December 2011 These errors might be an indication of a faulty or incorrectly seated device. Or these errors might be invalid. Workaround: Ensure that the device is properly seated. If the errors continue, apply patch 147705-01 or higher. L2 Cache Uncorrectable Errors Might Lead to an Entire Processor Being Faulted (CR 7065563) An L2 cache uncorrectable error might lead to an entire processor being faulted when only specific core strands should be faulted. Workaround: Schedule a service call with Volume migration (relocating all RAID volume disk members from one Sun SPARC T5120 or T5220 chassis) is not supported. If you must perform this operation, contact your service provider to replace the processor. Until it is replaced, you can return the strands related to the functioning cores to service using the following procedure. This will restore as much system functionality as the active cores provide. 1. Identify the faulty core. Type: The following example shows the detector portion of the fmdump output for a SPARC T4-1 server. Response : One or more device instances may be disabled Impact : Loss of services provided by the device instances associated with this fault Action : If a plug-in card is involved check for badly-seated cards or bent pins. Otherwise schedule a repair procedure to replace the affected device. Use fmadm faulty to identify the device or contact Sun for support. # fmdump -eV -c ereport.cpu.generic-sparc.l2tagctl-ucChapter 2 Known Product Issues 11 Note – Key elements in the example are highlighted for emphasis. They would not be highlighted in the actual output. In this example, the faulted component is indicated by the following FMRI values: ¦ Chassis = 0 ¦ Motherboard = 0 ¦ Chip = 0 ¦ Core = 6 These FMRI values correspond to the NAC name: /SYS/MB/CMP0/CORE6 The following table shows the NAC name equivalents for all CMP cores in a SPARC T4-1 server: detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = hc hc-root = hc-list-sz = 4 hc-list = (array of embedded nvlists) (start hc-list[0]) nvlist version: 0 hc-name = chassis hc-id = 0 (end hc-list[0]) (start hc-list[1]) nvlist version: 0 hc-name = motherboard hc-id = 0 (end hc-list[1]) (start hc-list[2]) nvlist version: 0 hc-name = chip hc-id = 0 (end hc-list[2]) (start hc-list[3]) nvlist version: 0 hc-name = core hc-id = 6 (end hc-list[3]) (end detector)12 SPARC T4-1 Server Product Notes • December 2011 Note – In SPARC T4-1 servers, chassis, motherboard, and chip values are always 0. 2. Halt the Oracle Solaris OS and power off the server. Refer to the Administration Guide for information on powering off the server when the OS is running. 3. At the Oracle ILOM prompt, change directory to the faulty core. The following step continues the example shown above where the ID of the faulty core is 6. FMRI Values for SPARC T4-1 Servers Corresponding NAC Names chassis=0/motherboard=0/chip=0/core=0 /SYS/MB/CMP0/CORE0 chassis=0/motherboard=0/chip=0/core=1 /SYS/MB/CMP0/CORE1 chassis=0/motherboard=0/chip=0/core=2 /SYS/MB/CMP0/CORE2 chassis=0/motherboard=0/chip=0/core=3 /SYS/MB/CMP0/CORE3 chassis=0/motherboard=0/chip=0/core=4 /SYS/MB/CMP0/CORE4 chassis=0/motherboard=0/chip=0/core=5 /SYS/MB/CMP0/CORE5 chassis=0/motherboard=0/chip=0/core=6 /SYS/MB/CMP0/CORE6 chassis=0/motherboard=0/chip=0/core=7 /SYS/MB/CMP0/CORE7 -> cd /SYS/MB/CMP0/CORE6 /SYS/MB/CMP0/CORE6 -> show /SYS/MB/CMP0/CORE6 Targets: P0 P1 P2 P3 P4 P5 P6 P7 L2CACHE L1CACHE Properties: type = CPU Core component_state = EnabledChapter 2 Known Product Issues 13 4. Disable the faulty core. 5. Power on the server, and restart the Oracle Solaris OS. Refer to the Administration Guide for information on powering on the server from the Oracle ILOM prompt. 6. Override the FMA diagnosis manually. The faulty component’s UUID value is provided in the first line of fmdump output. L2 Cache UEs Are Sometimes Reported as Core Faults Without Any Cache Line Retirements (CR 7071237) When a processor cache line encounters an uncorrectable error (UE) the fault manager is supposed to attempt to retire the cache line involved in the error. Because of this defect, the fault manager might not retire the faulty cache line and instead report the entire chip as faulted. Workaround: Schedule a replacement of the FRU containing the faulty component. For additional information about UEs in processor cache lines, search for message ID SUN4V-8002-WY on the Oracle support site, http://support.oracle.com. Upon a Reboot After an Unrecoverable Hardware Error, CPUs Might Not Start (CR 7075336) In rare cases, if the server or sever module experiences a serious problem that results in a panic, when the server is rebooted, a number of CPUs might not start even though the CPUs are not faulty. Commands: cd set show -> set component_state = disabled # fmadm repair uuid-of-fault14 SPARC T4-1 Server Product Notes • December 2011 Example of the type of error displayed: Workaround: Log in to Oracle ILOM on the SP and then power cycle by typing: reset /SYS Operations Can Cause the SAS Controller to Disappear (CR 7082665) During an Oracle ILOM reset /SYS command, a SAS controller might not initialize correctly. In such cases it might lose contact with the target disk devices. This is an example of the error message you might see: If a data disk is not available after performing a reset /SYS, you can use the OBP command probe-scsi-all to verify if your SAS controllers are present. The following example shows the output that you should see with probe-scsi-all: rebooting... Resetting... ERROR: 63 CPUs in MD did not start -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS {0} ok boot disk Boot device: /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 File and args: ERROR: boot-read fail Can’t locate boot device {0} ok {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50005ba000f SASAddress 5000c50005ba000d PhyNum 0Chapter 2 Known Product Issues 15 If you are missing either of the following lines, you might be experiencing this error (CR 7082665): ¦ /pci@400/pci@2/pci@0/pci@4/scsi@0 ¦ /pci@400/pci@1/pci@0/pci@4/scsi@0 As an alternative test of this error condition, you can use the format(1) command in Oracle Solaris to list all disks available to the operating system. If one of your data disks is not present after performing a reset /SYS and booting the operating system, you may be experiencing this error (CR 7082665). Workaround: At the Oracle ILOM prompt first type the stop /SYS command and then the start /SYS command. If the issue persists beyond several power cycles, contact your authorized Oracle Service Provider. Target a Unit 0 Removable Read Only device TSSTcorp CDDVDW TS-T633A SR00 SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f76db7 SASAddress 5000c50016f76db5 PhyNum 1 Target c Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f765ef SASAddress 5000c50016f765ed PhyNum 2 Target d Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7833b SASAddress 5000c50016f78339 PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST914603SSUN146G 0868 286739329 Blocks, 146 GB SASDeviceName 5000c50016f777df SASAddress 5000c50016f777dd PhyNum 0 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7818b SASAddress 5000c50016f78189 PhyNum 2 Target b Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f758ff SASAddress 5000c50016f758fd PhyNum 3 Target c Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7703f SASAddress 5000c50016f7703d PhyNum 1 {0} ok16 SPARC T4-1 Server Product Notes • December 2011 SAS Command Might Fail to Complete When Certain SAS Devices Are Put Under Heavy Load (CR 7088469) When certain SAS devices are placed under heavy load, a SCSI Bus Reset might occur. The SCSI bus reset will result in one or more WARNING messages being written to the system log file, /var/adm/messages. The following is an example of the WARNING message you might see: Workaround: No work around needed. The system will retry the failed command automatically. Contact your authorized Oracle service provider if the following message is seen: Rebooting an SDIO-SAS HBA Guest Domain Might Generate ereport.io.pciex.pl.re (CR 7048307) When a guest domain is configured using SDIO (Static Direct I/O) and an onboard SAS2 controller (/SYS/MB/SASHBA0 or /SYS/MB/SASHBA1) eReports of type ereport.io.pciex.pl.re will be generated at the time the guest is bound and started. Similar eReports might occur intermittently when the guest domain reboots. Workaround: If the problem persists or occurs outside of rebooting an SDIO-SAS HBA guest domain, contact your authorized Oracle Service Provider for additional assistance. Otherwise, you can safely ignore this message. scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_handle_event_sync: IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_handle_event: IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_check_scsi_io: IOCStatus=0x4b IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /scsi_vhci (scsi_vhci0): /scsi_vhci/disk@g5000c5003bee5ae3 (sd6): Command failed to complete (4) on path mpt_sas3/disk@w5000c5003bee5ae1,0 scsi: [ID 107833 kern.warning] WARNING: /scsi_vhci/disk@g5000c5003bee5ae3 (sd6): SCSI transport failed: reason ’reset’: retrying command SCSI transport failed: reason ’reset’: giving upChapter 2 Known Product Issues 17 Oracle Solaris OS Issues This section describes issues related to the Oracle Solaris OS in this release. Cannot Boot Oracle Solaris 10 10/09 OS (U8) From the Internal DVD The internal DVD cannot be used to boot the Oracle Solaris U8 release. Note – Later updates of Oracle Solaris 10 do not have this limitation. Workaround: Remote cdrom/DVD (Storage part of rKVMS) can be used to boot the DVD media itself or the iso image. An external USB DVD drive can also be used to boot the media. Spurious Interrupt Message in System Console (CR 6963563) During the normal operation of the server, and when running the Oracle VTS system exerciser, you might see the following message in the system console: Workaround: You can safely ignore this message. Spurious Error Message During Initial Oracle Solaris OS Installation (CR 6971896) The miniroot is a bootable root file system that includes the minimum Oracle Solaris OS software required to boot the server and configure the OS. The miniroot runs only during the installation process. date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info]18 SPARC T4-1 Server Product Notes • December 2011 When the server boots the miniroot for the initial configuration, you might see the following messages in the system console: The messages indicate the Xsun server in the Oracle Solaris OS miniroot cannot find a supported driver for the AST graphics device in the service processor. These messages are legitimate, as the miniroot contains only the Xsun environment, and the AST framebuffer (astfb) is supported only in the Xorg environment. The Xorg environment is included in the installed system, so the graphics device might be used when running the installed Oracle Solaris OS. Workaround: You can safely ignore this message. When diag-switch? is Set to true, Oracle Solaris OS Fails to Update EEPROM for Automatic Rebooting (CR 6982060) When installing the Oracle Solaris OS to a device when the OBP diag-switch? parameter is set to true, the Oracle Solaris OS installer fails to update the bootdevice parameter with the new device path where the OS was installed. Therefore, this new device path will not be used during the subsequent automatic system reboots. Under these conditions, the server will display the following error message and you will not be able to reboot from the device: On previous systems, the OBP diag-device parameter used to set the new device path to the boot device when the diag-switch? parameter was set to true. On SPARC T4 systems, the diag-device parameter is no longer supported and the Oracle Solaris OS installer warns that setting the OBP boot-device parameter is not possible. Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error. Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebootingChapter 2 Known Product Issues 19 Workaround: From the Oracle ILOM prompt, set the OBP diag-switch? parameter to false: Note – The change to the /HOST/bootmode script will take effect with the next system poweron. Alternatively, you can set this parameter at the OBP ok prompt: Memory Allocation Issues With Emulex 8Gb HBAs In a Magma IO Expansion Box (CR 6982072) Memory allocation errors might occur when four or more 8Gb FC PCI-Express HBA, Emulex cards are used in a Magma IO expansion box connected to an Oracle SPARC T4 series server. The following is an example of the types of messages that might be logged in /var/adm/messages with this configuration: -> set /HOST/bootmode script="setenv diag-switch? false" ok setenv diag-switch? false date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs22: ERROR: 301: Memory alloc failed. (BPL Pool buffer[1760]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs20: ERROR: 301: Memory alloc failed. (BPL Pool buffer[2765]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs24: ERROR: 301: Memory alloc failed. (BPL Pool buffer[3437]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs22: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs22: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs22: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs20: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs20: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs24: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs24: ERROR: 201:20 SPARC T4-1 Server Product Notes • December 2011 Workaround: Limit the number of 8Gb FC PCI-Express HBA, Emulex cards in a Magma IO expansion box to no more than three. Fault Management Sometimes Sends Resolved Cases to the SP (CR 6983432) This defect will result in previously diagnosed and repaired PSH faults from the host to reappear in Oracle ILOM when the host reboots. It manifests itself as an incorrect report of a PSH diagnosed fault represented through the Oracle ILOM CLI, BUI, and fault LED. You can identify this defect by checking to see if the same PSH fault was reported from the host as well. If it was reported only by Oracle ILOM and not from the host, it is probably an example of this defect. Recovery Action: Use the Oracle ILOM diagnostic and repair tools to identify the error condition and correct it. The following example illustrates how to diagnose and repair a PSH fault diagnosed by the host. This example is based on the Oracle ILOM fault management shell.You could instead use the Oracle ILOM CLI or BUI to accomplish the same results. 1. Display the fault information Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2011-09-16/15:38:19 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Major Fault class : fault.cpu.generic-sparc.strand FRU : /SYS/MB (Part Number: 7015272) (Serial Number: 465769T+1130Y6004M) Description : A fault has been diagnosed by the Host Operating System. Response : The service required LED on the chassis and on the affected FRU may be illuminated. Impact : No SP impact. Check the Host OS for more information.Chapter 2 Known Product Issues 21 2. Check for faults on the host. 3. Verify that the fault shown by Oracle ILOM was repaired on the host. 4. Flush the previously faulty component from the host resource cache. 5. Repair the fault in Oracle ILOM. Gigabit Ethernet (nxge) Driver Not Loading on Systems With Oracle Solaris 10 10/09 OS and a Solaris 10 9/10 Patchset or Solaris 10 8/11 Patchset (CR 6995458) A problem in the Oracle Solaris 10 10/09 package installation process prevents the nxge alias definition for SPARC T4 servers from being entered in /etc/driver_aliases. Without this alias being properly defined, the nxge cannot be attached. Recovery Action: To correct this problem, perform the steps described below. Action : The administrator should review the fault on the Host OS. Please refer to the Details section of the Knowledge Article for additional information. # fmadm faulty # <-- Host displays no faults # fmdump TIME UUID SUNW-MSG-ID Sep 16 08:38:19.5582 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Sep 16 08:40:47.8191 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-4M Repaired Sep 16 08:40:47.8446 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-6U Resolved # # fmadm flush /SYS/MB fmadm: flushed resource history for /SYS/MB # faultmgmtsp> fmadm repair /SYS/MB faultmgmtsp> fmadm faulty No faults found faultmgmtsp>22 SPARC T4-1 Server Product Notes • December 2011 Note – You must be logged in as root to edit the driver_aliases file. 1. Add the following entry to /etc/driver_aliases: 2. Reboot the system. 3. Configure the network interfaces. The cfgadm Command Fails for Certain HBAs (CR 7044759) The cfgadm command fails for some HBA devices (such as SGX-SAS6-EXT-Z, SGXSAS6-INT-Z, SG-SAS6-REM-Z). For example: Workaround: Disable the fault management daemon before running the svcadm unconfigure command. After completing the cfadm task, re-enable the fault management daemon: nxge "SUNW,niusl-kt" # cfgadm -c unconfigure Slot1 cfgadm: Component system is busy, try again: unconfigure failed WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 # svcadm disable fmd # ps -ef |grep fmd ... # cfgadm -c unconfigure PCI-EM0 # svcadm enable fmdChapter 2 Known Product Issues 23 Watchdog Timeouts Seen With Heavy Workloads and Maximum Memory Configurations (CR 7083001) With certain unusual heavy workloads, especially where a highly processorintensive workload is bound to CPU 0, the host may appear to suddenly reset back to OBP without any sign of there having been a crash or a panic, and the Oracle ILOM event log will contain a "Host watchdog expired" entry. The problem is more seen on select systems with full memory configurations. If you see this sort of sudden reset, display the SP event log using this command from the Oracle ILOM CLI: If you are encountering 7083001, you’ll see an entry labeled "Host watchdog expired". Workaround: If you encounter 7083001, contact your authorized service provider to see if a fix is available. You can also work around this problem by extending the watchdog period by adding this entry to the Oracle Solaris /etc/system file: This will extend the watchdog timeout period to 1 minute (60000 milliseconds). In extreme cases, you can also disable the watchdog timeout altogether by adding this entry to the /etc/system file: A reboot is required for any /etc/system modification to take effect. If it is not desirable to reboot the system immediately after editing /etc/system, an additional temporary workaround that will take effect immediately can be applied. To apply this temporary workaround, execute the following command as root: This command will create a temporary processor set containing only CPU 0, preventing application workloads from using this processor and preventing this issue from occurring. -> show /SP/logs/event/list set watchdog_timeout = 60000 set watchdog_enabled = 0 # psrset -c -F 024 SPARC T4-1 Server Product Notes • December 2011 Note – If any threads had been bound to CPU 0, they will be unbound. This temporary processor set will be removed on the next operating system reboot, at which point the /etc/system workaround described above will take effect. ereport.fm.fmd.module Generated During a Reboot of an SDIO Domain (CR 7085231) The server module might generate an ereport.fm.fmd.module message during a reboot of an SDIO domain. This ereport indicates that an error occurred on one of the fmd modules but the fmdump command does not display a valid message (msg). For example: Workaround: You can safety ignore ereport.fm.fmd.module ereports. # fmdump -eV -c ereport.fm.fmd.module TIME CLASS Sep 27 2011 06:27:19.954801492 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = ORCL,SPARC-T4-1 server-id = c193-133 (end authority) mod-name = etm mod-version = 1.2 (end detector) ena = 0x425fc9b065404001 msg = cannot open write-only transport <=== __ttl = 0x1 __tod = 0x4e81cf37 0x38e91d54Chapter 2 Known Product Issues 25 Benign Error Message: mptsas request inquiry page 0x83 for target:a, lun:0 failed! (CR 7092982) You might see the following error message in /var/adm/messages when the system boots: Workaround: You can safely ignore this message. Oracle VTS dtlbtest hangs when the CPU Threading Mode is Set to max-ipc (CR 7094158) The Oracle VTS component stress dtlbtest hangs when Oracle VM for SPARC is set to max-ipc threading mode. This issue is not specific to any processor type and can happen when both the following cases are true: ¦ Only one CPU per core is online. ¦ The total number of online CPUs is less than or equal to 128. Workaround: Do not run the Oracle VTS Processor test in high stress mode when Oracle VM for SPARC is set to max-ipc mode. Firmware Issues This section describes issues related to the system firmware. Timestamp for an Oracle ILOM Fault/Critical Event Might Be Off by One Hour (CR 6943957) The timestamp reported in an email generated in an Oracle ILOM Fault/critical event might be one hour later than the timestamp recorded in the event log. Recovery Action: Check the timestamp recorded in the event log. If it does not match the timestamp reported in the email, use the event log time. mptsas request inquiry page 0x83 for target:a, lun:0 failed!26 SPARC T4-1 Server Product Notes • December 2011 e1000g Driver Generates Spurious ereports When Installing Oracle Solaris OS Over a Sun PCIe Dual Gigabit Ethernet Adapter (CR 6958011) When installing the Oracle Solaris OS on domains controlled through Sun PCIe Dual Gigabit Ethernet (UTP or MMF) adapters, the e1000g Gigabit Ethernet driver might generate false error reports on the static direct I/O (SDIO) and primary domains. The following is an example of these spurious reports: Workaround: You can safely ignore these ereports. Missing Interrupt Causes USB Hub Hotplug Thread to Hang, Resulting In Process Hangs (CR 6968801) This CR is closed as a duplicate of CR 7024581. When running Oracle VTS on T4 series platforms, it is possible (although rare) for a Oracle VTS test to hang. If this happens, it might cause other processes and commands to hang, including fmadm and prtconf. The hung processes cannot be killed. Workaround: Reboot the system. If the problem repeats, contact your authorized service provider. Avoid running Oracle VTS in production environments. date time ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 ena = 0x298a9f62243802 detector = (embedded nvlist) nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600 source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a0Chapter 2 Known Product Issues 27 sas2ircu Message That RAID Volume Sizes Other Than “MAX” Are Not Supported Needs Clarification (CR 6983210) If you attempt to create a RAID volume smaller than ”MAX”, the following series of messages is returned: It is true that RAID volumes smaller than “MAX” are not supported. However, if you want to create a volume below “MAX” size for non-production use, the software will allow you to do so. This is not clear from the message. Workaround: Ignore the messages and answer yes for the question “Do you want to continue with volume creation (YES/NO)?”. Units Used to Define the MIB Power Management Time Limit Are Reported in Seconds (CR 6993008) The MIB should report the sunHwCtrlPowerMgmtBudgetTimelimit in milliseconds, but the value displayed is in seconds. Workaround: Understand that the value reported for sunHwCtrlPowerMgmtBudgetTimelimit is in seconds. Message From cpustat Refers to Processor Documentation Incorrectly (CR 7046898) A message displayed by the cpustat command says: You are about to create an IR volume. WARNING: Proceeding with this operation may cause data loss or data corruption. Are you sure you want to proceed (YES/NO)? yes WARNING: Volume created with size other than ’MAX’ is not supported. Do you want to continue with volume creation (YES/NO)? n SAS2IRCU: you must answer "YES" or "yes" to proceed; operation aborted! SAS2IRCU: Error executing command CREATE. SPARC T4 Supplement to Oracle SPARC Architecture 201128 SPARC T4-1 Server Product Notes • December 2011 This document and web site listed in this message are not available. reboot disk Command Occasionally Fails When disk Argument Picks Up Extra Characters (CR 7050975) When running the reboot disk command, extraneous characters are occasionally added to the disk argument before it reaches the OpenBoot PROM (OBP). This results in a failure to boot. Recovery Action: Repeat the boot request. Explicit Processor Binding Might Block Strand Retirement (CR 7071974) The explicit assignment of specific process(es) to CPU strands, either by binding or by use of the High-IPC feature, might cause a situation in which the fault manager’s attempt to retire a strand is rejected because the strand is marked as busy. Workaround: Remove the explicit binding of any process to the CPU strand diagnosed as faulty. Blue LED On Drive Does Not Light When The Drive Is Ready To Remove (CR 7082700) When you attempt to unconfigure a drive for removal, the drive’s blue LED that indicates the drive is ready for removal might not light. This happens after you place a drive in a slot in place of a drive that had a different WWID. Workaround: If you inserted a drive after booting the server, realize that the blue LED will not perform this function until the server has booted again. User’s Manual" for descriptions of these events. Documentation for Sun processors can be found at: http://www.sun.com/processors/manualsChapter 2 Known Product Issues 29 Documentation Issues This section describes issues related to product documentation. Hardware RAID Guidelines are Missing from Administration Guide The following points are important to understand when configuring RAID volumes on a SPARC T4-1 server: ¦ Before configuring and using RAID disk volumes on a SPARC T4-1 server, ensure that you have installed the latest patches for your operating system from here: https://pkg.oracle.com/solaris/support ¦ Volume migration (relocating all RAID volume disk members from one T4-1 server to another) is not supported. If you must perform this operation, contact your authorized Oracle service provider. Caution – Creating RAID volumes using the on-board disk controllers destroys all data on member disks. This information is not provided in the current version of the SPARC T4 Series Servers Administration Guide.30 SPARC T4-1 Server Product Notes • December 2011 SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices Part No.: E23433-01, October 2011Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents 1. Third Party Technology Notices and Licenses 1 Third Party Technology 1 Third Party Notices and Licenses 2iv SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices • October 20111 C H A P T E R 1 Third Party Technology Notices and Licenses This chapter contains the following: ¦ “Third Party Technology” on page 1 ¦ “Third Party Notices and Licenses” on page 2 Third Party Technology The following third party technology may be included in or distributed with this product. The notices provided below in “Third Party Notices and Licenses” on page 2 are based on information made available to Oracle by the third party licensors listed. Some software is expressly licensed only under the license terms indicated. Such software is licensed separately and not under the terms of the Oracle license. Additionally, software whose license terms require separate licensing of the software under open source terms, including without limitation the GPL, the LGPL and the Mozilla license, will be understood to be separately licensed under the relevant open source license and not under the terms of the Oracle license. ¦ “Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software” on page 2 ¦ “Preboot Execution Environment (PXE)” on page 22 SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices • October 2011 Third Party Notices and Licenses Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software Use of any of this software is governed by the terms of the license below: The software and all copies shall remain the property of Intel. Intel retains the right to use, copy, modify, sublicense, and distribute the software. Marking requirement – US Government sales. All copies of Object Code distributed directly or indirectly to the US government are governed by a legend substantially similar to the following: The enclosed software products and documentation were developed at private expense, and are provided with “RESTRICTED RIGHTS”. Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et seq. or its successor. The use of this product by the government constitutes an acknowledgment of Intel’s proprietary rights in the product. If you are acquiring this software on behalf of the U.S. government, the Government shall have only “Restricted Rights” in the software and related documentation as defined in the Federal Acquisition Regulations (FARs) in Clause 52.227.19 (c) (2). If you are acquiring the software on behalf of the Department of Defense, the software shall be classified as “Commercial Computer Software” and the Government shall have only “Restricted Rights” as defined in Clause 252.227- 7013 (c) (1) of DFARs. Notwithstanding the foregoing, the authors grant the U.S. Government and others acting in its behalf permission to use and distribute the software in accordance with the terms specified in this license. Preboot Execution Environment (PXE) The enclosed software products and documentation were developed at private expense, and are provided with “Restricted Rights.” Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et. seq. or its successor. The use of this product by the government constitutes acknowledgment of Intel’s proprietary rights in the product. SPARC T4-1 Server Safety and Compliance Guide Compliance Model No.: SERP2 Part No.: E22991-01 October 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Declaration of Conformity 1 Regulatory Compliance Statements 3 Safety Agency Compliance Statements 5iv SPARC T4-1 Server Safety and Compliance Guide • October 20111 Declaration of Conformity English To receive a copy of the latest Declaration of Conformity (DoC) for the product, either contact your local Oracle sales representative or send an email to: Compliance_Request_WW@oracle.com. Français Pour recevoir une copie de la dernière déclaration de conformité pour le produit, contactez votre représentant commercial local Oracle ou envoyez un courriel à l'adresse suivante : Compliance_Request_WW@oracle.com. Deutsch Wenn Sie eine Kopie der neuesten Konformitatserklarung fur das Produkt erhalten mochten, wenden Sie sich entweder an den Oracle-Vertriebsbeauftragten vor Ort, oder fordern Sie sie per E-Mail unter der folgenden Adresse an: Compliance_Request_WW@oracle.com. Italiano Per ricevere una copia della Dichiarazione di conformità (DoC, Declaration of Conformity) più recente del prodotto, contattare il rappresentante delle vendite Oracle locale oppure inviare un messaggio di posta elettronica all'indirizzo: Compliance_Request_WW@oracle.com. Português (Brasil) Para receber uma cópia da mais recente Declaração de Conformidade (DoC) do produto, entre em contato com o representate de vendas local da Oracle ou envie um email para: Compliance_Request_WW@oracle.com. Español Para recibir una copia de la Declaración de conformidad más reciente del producto, póngase en contacto con su representante local de ventas de Oracle o envíe un mensaje de correo electrónico a: Compliance_Request_WW@oracle.com.2 SPARC T4-1 Server Safety and Compliance Guide • October 20113 Regulatory Compliance Statements Your Sun product from Oracle is marked to indicate its compliance class: ¦ Federal Communications Commission (FCC) — USA ¦ Industry Canada Equipment Standard for Digital Equipment (ICES-003) — Canada ¦ Voluntary Control Council for Interference (VCCI) — Japan ¦ Bureau of Standards Metrology and Inspection (BSMI) — Taiwan ¦ Certi?cation and Accreditation Administration of the People’s Republic of China (CNCA) — China ¦ Korea Communications Commission (KCC) — Korea Please read the appropriate section that corresponds to the marking on your Sun product before attempting to install the product. FCC Class A Notice This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if it is not installed and used in accordance with the instruction manual, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user will be required to correct the interference at his own expense. Modifications: Any modi?cations made to this device that are not approved by Oracle may void the authority granted to the user by the FCC to operate this equipment. ICES-003 Class A Notice - Avis NMB-003, Classe A This Class A digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada.4 SPARC T4-1 Server Safety and Compliance Guide • October 2011 BSMI Class A Notice The following statement is applicable to products shipped to Taiwan and marked as Class A on the product compliance label. CCC Class A Notice The following statement is applicable to products shipped to China and marked with “Class A” on the product’s compliance label. Korean Class A Notice The following is the Korean Class A Broadcasting and Telecommunication Products for Business Purpose Statement.5 Safety Agency Compliance Statements Read this section before beginning any procedure. The following text provides safety precautions to follow when installing a Sun product. Safety Precautions For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Never push objects of any kind through openings in the equipment. Dangerous voltages may be present. Conductive foreign objects could produce a short circuit that could cause fire, electric shock, or damage to your equipment. ¦ This product is intended for restricted access whereby access is controlled through the use of a means of security (for example, key, lock, tool, badge access) and personnel authorized for access have been instructed on the reasons for the restrictions and any precautions that need to be taken. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symbols The following symbols may appear in this book: Caution – There is a risk of personal injury and equipment damage. Follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and may cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. Depending on the type of power switch your device has, one of the following symbols may be used: On – Applies AC power to the system. Off – Removes AC power from the system.6 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Standby – The On/Standby switch is in the standby position. Modifications to Equipment Do not make mechanical or electrical modifications to the equipment. Oracle is not responsible for regulatory compliance of a modified Sun product. Placement of a Sun Product Caution – Do not block or cover the openings of your Sun product. Never place a Sun product near a radiator or heat register. Failure to follow these guidelines can cause overheating and affect the reliability of your Sun product. Noise Level Product: SPARC T4-1 server In compliance with the requirements defined in ISO 7779, the workplace-dependent noise level of this product is less than 70 db (A). SELV Compliance Safety status of I/O connections comply to SELV requirements. Power Cord Connection Caution – Sun products are designed to work with power systems having a grounded neutral (grounded return for DC-powered products). To reduce the risk of electric shock, do not plug Sun products into any other type of power system. Contact your facilities manager or a qualified electrician if you are not sure what type of power is supplied to your building. Caution – Not all power cords have the same current ratings. Do not use the power cord provided with your equipment for any other products or use. Household extension cords do not have overload protection and are not meant for use with computer systems. Do not use household extension cords with your Sun product. The following caution applies only to devices with a Standby power switch: Caution – The power switch of this product functions as a standby type device only. The power cord serves as the primary disconnect device for the system. Be sure to plug the power cord into a grounded power outlet that is nearby the system and is readily accessible. Do not connect the power cord when the power supply has been removed from the system chassis. The following caution applies only to devices with multiple power cords:Safety Agency Compliance Statements 7 Caution – For products with multiple power cords, all power cords must be disconnected to completely remove power from the system. Battery Warning Caution – There is danger of explosion if batteries are mishandled or incorrectly replaced. On systems with replaceable batteries, replace only with the same manufacturer and type or equivalent type recommended by the manufacturer per the instructions provided in the product service manual. Do not disassemble batteries or attempt to recharge them outside the system. Do not dispose of batteries in fire. Dispose of batteries properly in accordance with the manufacturer’s instructions and local regulations. Note that on Sun CPU boards, there is a lithium battery molded into the real-time clock. These batteries are not customer replaceable parts. Caution – For product installed in California, USA: This product may contain a time-of-day battery which may contain perchlorate where special handling may apply. See http://www.dtsc.ca.gov/hazardouswaste/perchlorate. Energy Storage Module Caution Caution – There is a danger of shock or equipment damage if energy storage modules are mishandled or incorrectly replaced. When replacing the energy storage modules, use only replacement modules that have been provided by Oracle, following the instructions provided in the product service manual. Do not disassemble modules or attempt to recharge them outside of the system. Do not dispose of the modules; instead, return them to Oracle in accordance with Oracle procedures for the product System Unit Cover You must remove the cover of your Sun computer system unit to add cards, memory, or internal storage devices. Be sure to replace the cover before powering on your computer system. Caution – Do not operate Sun products without the cover in place. Failure to take this precaution may result in personal injury and system damage.8 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Rack System Instructions The following or similar rack-mount instructions are included with the installation instructions: ¦ Elevated Operating Ambient – If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Therefore, consideration should be given to installing the equipment in an environment compatible with the maximum ambient temperature (Tma) specified by the manufacturer. ¦ Reduced Air Flow – Installation of the equipment in a rack should be such that the amount of air flow required for safe operation of the equipment is not compromised. ¦ Mechanical Loading – Mounting of the equipment in the rack should be such that a hazardous condition is not achieved due to uneven mechanical loading. ¦ Circuit Overloading – Consideration should be given to the connection of the equipment to the supply circuit and the effect that overloading of the circuits might have on overcurrent protection and supply wiring. Appropriate consideration of equipment nameplate ratings should be used when addressing this concern. ¦ Reliable Earthing – Reliable earthing of rack-mounted equipment should be maintained. Particular attention should be given to supply connections other than direct connections to the branch circuit (for example, use of power strips). Caution – Slide/rail mounted equipment must not be used as a shelf or workspace. Rack System Warning The following warnings apply to Racks and Rack Mounted systems. Caution – For safety, equipment should always be loaded from the bottom up. That is, install the equipment that will be mounted in the lowest part of the rack first, then the next higher systems, etc. Caution – To prevent the rack from tipping during equipment installation, the anti-tilt bar on the rack must be deployed. Caution – To prevent extreme operating temperature within the rack insure that the maximum temperature does not exceed the product’s ambient rated temperatures. Caution – To prevent extreme operating temperatures due to reduced airflow consideration should be made to the amount of air flow that is required for a safe operation of the equipment.Safety Agency Compliance Statements 9 Caution – Take adequate precautions when moving a rack or library that contains rack-installed equipment. The weight of some rack equipment may have altered the rack or library center of gravity and could cause an overbalance/tip condition during a move. Caution – For tape libraries, ensure that the equipment to be installed in the rack has UL Listing, CSA or C-UL Certification, and is CE marked. Laser Compliance Notice Your Oracle or Sun product may contain Class 1M Laser Transceivers. Caution – Class 1M laser radiation when open. Do not view directly with optical instruments. CD and DVD Devices The following caution applies to CD, DVD, and other optical devices. Caution – Use of controls, adjustments, or the performance of procedures other than those specified herein may result in hazardous radiation exposure.10 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Conformité aux normes de sécurité Veuillez lire attentivement cette section avant de commencer. Ce texte traite des mesures de sécurité qu’il convient de prendre pour l’installation d’un produit Sun. Mesures de sécurité Pour votre sécurité, nous vous recommandons de suivre scrupuleusement les mesures de sécurité ci-dessous lorsque vous installez votre matériel: ¦ Suivez tous les avertissements et toutes les instructions inscrites sur le matériel. ¦ Assurez-vous que la tension et la fréquence de votre source d'alimentation correspondent à la tension et à la fréquence indiquées sur l'étiquette de la tension électrique nominale du matériel ¦ N'introduisez jamais d'objets quels qu'ils soient dans les ouvertures de l'équipement. Vous pourriez vous trouver en présence de hautes tensions dangereuses. Tout objet étranger conducteur risque de produire un court-circuit pouvant présenter un risque d'incendie ou de décharge électrique, ou susceptible d'endommager le matériel. ¦ Ce produit est destiné à être utilisé dans des zones à accès limité, dans lesquelles les accès sont contrôlés au moyen de systèmes de sécurité (par exemple, à clé, verrou, dispositif ou badge). Le personnel autorisé à accéder à ces zones doit avoir été préalablement informé des raisons justifiant la limitation des accès et de toutes les précautions à prendre. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symboles Vous trouverez ci-dessous la signification des différents symboles utilisés: Attention – Vous risquez d'endommager le matériel ou de vous blesser. Veuillez suivre les instructions. Attention – Surfaces brûlantes. Evitez tout contact. Les surfaces sont brûlantes. Vous risquez de vous blesser si vous les touchez. Attention – Tensions dangereuses. Pour réduire les risques de décharge électrique et de danger physique, observez les consignes indiquées. Selon le type d'interrupteur marche/arrêt dont votre appareil est équipé, l'un des symboles suivants sera utilisé: Marche – Met le système sous tension alternative.Safety Agency Compliance Statements 11 Arret – Met le système hors tension alternative. Veilleuse – L'interrupteur Marche/Veille est sur la position de veille. Modification du matériel N'apportez aucune modification mécanique ou électrique au matériel. Oracle décline toute responsabilité quant à la non-conformité éventuelle d'un produit Sun modifié. Positionnement d’un produit Sun Attention – Evitez d'obstruer ou de recouvrir les orifices de votre produit Sun. N'installez jamais un produit Sun près d'un radiateur ou d'une source de chaleur. Si vous ne respectez pas ces consignes, votre produit Sun risque de surchauffer et son fonctionnement en sera altéré. Niveau de pression acoustique Produit : SPARC T4-1 server Conformément à la norme ISO 7779, le niveau sonore de ce produit sur le lieu de travail est inférieur à 70 db(A). Conformité SELV Le niveau de sécurité des connexions E/S est conforme aux normes SELV. Connexion du cordon d’alimentation Attention – Les produits Sun sont conçus pour fonctionner avec des systèmes d'alimentation équipés d'un conducteur neutre relié à la terre (conducteur neutre pour produits alimentés en CC). Pour réduire les risques de décharge électrique, ne branchez jamais les produits Sun sur une source d'alimentation d'un autre type. Contactez le gérant de votre bâtiment ou un électricien agréé si vous avez le moindre doute quant au type d'alimentation fourni dans votre bâtiment. Attention – Tous les cordons d'alimentation ne présentent pas les mêmes caractéristiques électriques. Les cordons d'alimentation à usage domestique ne sont pas protégés contre les surtensions et ne sont pas conçus pour être utilisés avec des ordinateurs. N'utilisez jamais de cordon d'alimentation à usage domestique avec les produits Sun. L'avertissement suivant s'applique uniquement aux systèmes équipés d'un interrupteur Veille:12 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Attention – L'interrupteur d'alimentation de ce produit fonctionne uniquement comme un dispositif de mise en veille. Le cordon d'alimentation constitue le moyen principal de déconnexion de l'alimentation pour le système. Assurez-vous de le brancher dans une prise d'alimentation mise à la terre près du système et facile d'accès. Ne le branchez pas lorsque l'alimentation électrique ne se trouve pas dans le châssis du système. L'avertissement suivant s'applique uniquement aux systèmes équipés de plusieurs cordons d'alimentation: Attention – Pour mettre un système équipé de plusieurs cordons d'alimentation hors tension, il est nécessaire de débrancher tous les cordons d'alimentation. Mise en garde relative aux batteries Attention – Les batteries risquent d’exploser en cas de manipulation maladroite ou de remplacement incorrect. Pour les systèmes dont les batteries sont remplaçables, effectuez les remplacements uniquement selon le modèle du fabricant ou un modèle équivalent recommandé par le fabricant, conformément aux instructions fournies dans le manuel de service du système. N’essayez en aucun cas de démonter les batteries, ni de les recharger hors du système. Ne les jetez pas au feu. Mettez-les au rebut selon les instructions du fabricant et conformément à la législation locale en vigueur. Notez que sur les cartes processeur de Sun, une batterie au lithium a été moulée dans l'horloge temps réel. Les batteries ne sont pas des pièces remplaçables par le client. Avertissement - Module de stockage d’énergie Attention – Si vous manipulez ou remplacez les modules de stockage d’énergie incorrectement, vous risquez de les endommager ou de vous exposer à un choc électrique. Remplacez les modules de stockage d’énergie uniquement par les modules de remplacement que Oracle fournit, en veillant à respecter les instructions indiquées dans le manuel d’entretien du produit. Ne démontez pas les modules. N’essayez pas de les recharger hors du système. Ne jetez pas les modules, mais retournezles à Oracle conformément aux procédures Oracle relatives au produit. Couvercle de l'unité Pour ajouter des cartes, de la mémoire ou des périphériques de stockage internes, vous devez retirer le couvercle de votre système Sun. Remettez le couvercle supérieur en place avant de mettre votre système sous tension.Safety Agency Compliance Statements 13 Attention – Ne mettez jamais des produits Sun sous tension si leur couvercle supérieur n'est pas mis en place. Si vous ne prenez pas ces précautions, vous risquez de vous blesser ou d'endommager le système. Instructions de montage en rack Les instructions de montage en rack suivantes ou similaires à celles-ci sont fournies avec les instructions d'installation : ¦ Température ambiante de fonctionnement élevée : en cas d'installation dans un châssis fermé ou contenant plusieurs appareils, la température ambiante de fonctionnement au niveau du rack peut être supérieure à la température ambiante de la pièce. En conséquence, il convient de veiller à installer le matériel dans un environnement compatible avec la température ambiante maximale (Tma), spécifiée par le fabricant. ¦ Débit d'air réduit : l'installation du matériel dans un rack doit être effectuée de façon à ne pas compromettre le débit d'air nécessaire pour un fonctionnement sûr de ce matériel. ¦ Charge mécanique : le montage de l'équipement en rack doit être réalisé de manière à éviter toute situation dangereuse résultant d'une charge déséquilibrée. ¦ Surcharge de circuit : il convient de prendre les précautions nécessaires pour la connexion du matériel au circuit d'alimentation et de réfléchir aux conséquences d'une éventuelle surcharge des circuits sur la protection de surintensité et sur le câblage d'alimentation. En l'occurrence, les valeurs nominales de la plaque signalétique du matériel doivent être prises en compte. ¦ Mise à la terre fiable : une mise à la terre fiable du matériel monté en rack doit être assurée. Une attention toute particulière est requise pour les raccordements d'alimentation autres que ceux effectués directement sur le circuit principal (par exemple, en cas d'utilisation de blocs multiprises). Attention – L’équipement monté sur glissière/rail ne doit servir ni d’étagère ni d’espace de travail. Mise en garde relative au système en rack La mise en garde suivante s'applique aux racks et aux systèmes montés en rack. Attention – Pour des raisons de sécurité, le matériel doit toujours être chargé du bas vers le haut. En d'autres termes, vous devez installer, en premier, le matériel qui doit se trouver dans la partie la plus inférieure du rack, puis installer le matériel sur le niveau suivant, etc. Attention – Afin d'éviter que le rack ne penche pendant l'installation du matériel, tirez la barre antibasculement du rack.14 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Attention – Pour éviter des températures de fonctionnement extrêmes dans le rack, assurez-vous que la température maximale ne dépasse pas la fourchette de températures ambiantes du produit déterminée par le fabricant. Attention – Afin d'empêcher des températures de fonctionnement extrêmes provoquées par une aération insuffisante, assurez-vous de fournir une aération appropriée pour un fonctionnement du matériel en toute sécurité. Attention – Prenez les précautions adéquates pour déplacer un rack ou une bibliothèque qui contient du matériel installé en rack. Le poids de certains équipements en rack ayant pu modifier le centre de gravité du rack ou de la bibliothèque pourrait provoquer un effet de contrepoids ou de déséquilibre durant le déplacement. Attention – Pour les bibliothèques de bandes, vérifiez que le matériel à installer dans le rack est homologué UL, CSA ou C-UL, et porte la mention CE. Avis de conformité des appareils laser Your Oracle or Sun product may contain Class 1M Laser Transceivers. Attention – Rayonnement laser de classe 1M à l’ouverture. Ne pas regarder directement à l’aide d’instruments optiques. Périphériques CD et DVD L'avertissement suivant s'applique aux périphériques CD, DVD et autres périphériques optiques: Attention – L'utilisation de contrôles et de réglages ou l'application de procédures autres que ceux spécifiés dans le présent document peuvent entraîner une exposition à des radiations dangereuses.Safety Agency Compliance Statements 15 Einhaltung sicherheitsbehördlicher Vorschriften Lesen Sie vor dem Ausführen von Arbeiten diesen Abschnitt. Im folgenden Text werden Sicherheitsvor-kehrungen beschrieben, die Sie bei der Installation eines Sun-Produkts beachten müssen. Sicherheitsvorkehrungen Treffen Sie zu Ihrem eigenen Schutz bei der Installation des Geräts die folgenden Sicherheitsvorkehrungen: ¦ Beachten Sie alle auf den Geräten angebrachten Warnhinweise und Anweisungen. ¦ Stellen Sie sicher, dass Spannung und Frequenz der Stromversorgung den Nennleistungen auf dem am Gerät angebrachten Etikett entsprechen. ¦ Führen Sie niemals Fremdobjekte in die Öffnungen am Gerät ein. Es können gefährliche Spannungen anliegen. Leitfähige Fremdobjekte können einen Kurzschluss verursachen, der einen Brand, Strom-schlag oder Geräteschaden herbeiführen kann. ¦ Dieses Produkt unterliegt Zugangsbeschränkungen. Der Zugang wird mithilfe eines Sicherheitsmechanismus kontrolliert (z. B. einem Schlüssel, einer Sperre, einem Tool oder eines Werksausweises) und das autorisierte Zugangspersonal wurde über die Gründe für die Beschränkungen und die zu treffenden Sicherheitsmaßnahmen unterrichtet. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symbole Die Symbole in diesem Handbuch haben folgende Bedeutung: Achtung – Gefahr von Verletzung und Geräteschaden. Befolgen Sie die Anwei-sungen. Achtung – Heiße Oberfläche. Nicht berühren, da Verletzungsgefahr durch heiße Oberfläche besteht. Achtung – Gefährliche Spannungen. Befolgen Sie die Anweisungen, um Stromschläge und Verletzungen zu vermeiden. Je nach Netzschaltertyp an Ihrem Gerät kann eines der folgenden Symbole verwendet werden: Ein – Versorgt das System mit Wechselstrom. Aus– Unterbricht die Wechselstromzufuhr zum Gerät.16 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Wartezustand – Der Ein-/Standby-Netz-schalter befindet sich in der Standby-Position. Modifikationen des Geräts Nehmen Sie keine elektrischen oder mechanischen Gerätemodifikationen vor. Oracle ist für die Einhaltung der Sicherheitsvorschriften von modifizierten Sun-Produkten nicht haftbar. Aufstellung von Sun-Geräten Achtung – Geräteöffnungen Ihres Sun-Produkts dürfen nicht blockiert oder abgedeckt werden. SunGeräte sollten niemals in der Nähe von Heizkörpern oder Heißluft-klappen aufgestellt werden. Die Nichtbeach-tung dieser Richtlinien kann Überhitzung verursachen und die Zuverlässigkeit Ihres Sun-Geräts beeinträchtigen. Lautstärke Produkt: SPARC T4-1 server Gemäß den Vorgaben in der Norm ISO 7779 beträgt der Geräuschpegel dieses Geräts in Abhängigkeit vom Arbeitsplatz unter 70 db(A). SELV-Konformität Der Sicherheitsstatus der E/A-Verbindungen entspricht den SELV-Anforderungen. Anschluss des Netzkabels Achtung – Sun-Geräte sind für Stromversorgungssysteme mit einem geerdeten neutralen Leiter (geerdeter Rückleiter bei gleichstrombetriebenen Geräten) ausgelegt. Um die Gefahr von Stromschlägen zu vermeiden, schließen Sie das Gerät niemals an andere Stromversor-gungssysteme an. Wenden Sie sich an den zuständigen Gebäudeverwalter oder an einen qualifizierten Elektriker, wenn Sie nicht sicher wissen, an welche Art von Stromversor-gungssystem Ihr Gebäude angeschlossen ist. Achtung – Nicht alle Netzkabel verfügen über die gleichen Nennwerte. Herkömmliche, im Haushalt verwendete Verlängerungskabel besitzen keinen Überlastschutz und sind daher für Computersysteme nicht geeignet. Verwenden Sie bei Ihrem Sun-Produkt keine HaushaltsVerlängerungskabel. Die folgende Warnung gilt nur für Geräte mit Standby-Netzschalter:Safety Agency Compliance Statements 17 Achtung – Beim Netzschalter dieses Geräts handelt es sich nur um einen Ein/Standby-Schalter. Zum völligen Abtrennen des Systems von der Stromversorgung dient hauptsächlich das Netzkabel. Stellen Sie sicher, dass das Netzkabel an eine frei zugängliche geerdete Steckdose in der Nähe des Systems ange-schlossen ist. Schließen Sie das Stromkabel nicht an, wenn die Stromversorgung vom Systemchassis entfernt wurde. Die folgende Warnung gilt nur für Geräte mit mehreren Netzkabeln: Achtung – Bei Produkten mit mehreren Netz-kabeln müssen alle Netzkabel abgetrennt wer-den, um das System völlig von der Stromver-sorgung zu trennen. Warnung bezüglich Batterien Achtung – Bei unsachgemäßer Handhabung oder nicht fachgerechtem Austausch der Batterien besteht Explosionsgefahr. Verwen-den Sie bei Systemen mit austauschbaren Batterien ausschließlich Ersatzbatterien desselben Typs und Herstellers bzw. einen entsprechenden, vom Hersteller gemäß den Anweisungen im Service-Handbuch des Produkts empfohlenen Batterietyp. Versuchen Sie nicht, die Batterien auszubauen oder außerhalb des Systems wiederaufzuladen. Werfen Sie die Batterien nicht ins Feuer. Entsorgen Sie die Batterien entsprechend den Anweisungen des Herstellers und den vor Ort geltenden Vorschriften. CPU-Karten von Sun verfügen über eine Echtzeituhr mit integrier-ter Lithiumbatterie. Diese Batterie darf nur von einem qualifizierten Servicetechniker aus-gewechselt werden. Sicherheitshinweise zum Energiespeichermodul Achtung – Bei unsachgemäßer Handhabung oder unsachgemäßem Austausch von Energiespeichermodulen besteht die Gefahr eines Stromschlags oder Geräteschadens. Verwenden Sie beim Austausch von Energiespeichermodulen nur Ersatzmodule, die von Oracle bereitgestellt wurden, und folgen Sie den im Service Manual zum Produkt enthaltenen Anweisungen. Versuchen Sie auf keinen Fall, Module auszubauen oder diese außerhalb des Systems wiederaufzuladen. Entsorgen Sie die Module bitte nicht. Geben Sie sie stattdessen an Oracle gemäß den OracleVerfahren für das Produkt zurück. Gehäuseabdeckung Sie müssen die Abdeckung Ihres Sun-Computersystems entfernen, um Karten, Speicher oder interne Speichergeräte hinzuzufügen. Bringen Sie vor dem Einschalten des Systems die Gehäuseabdeckung wieder an.18 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Achtung – Nehmen Sie Sun-Geräte nicht ohne Abdeckung in Betrieb. Die Nichtbeachtung dieses Warnhinweises kann Verletzungen oder Geräteschaden zur Folge haben. Anweisungen zur Rack-Montage Die folgenden oder ähnlichen Anweisungen zur Rack-Montage wurden in die Installationsanweisungen aufgenommen: ¦ Erhöhte Betriebsumgebungstemperatur - Wenn das Rack in einer geschlossenen Rack-Baugruppe oder in einer Multi-unit-Rack-Baugruppe installiert ist, kann die Betriebsumgebungstemperatur der RackUmgebung höher sein als die Umgebungstemperatur des Raumes. Deshalb sollte berücksichtigt werden, das Gerät in einer Umgebung zu installieren, die kompatibel zu der vom Hersteller angegebenen maximalen Umgebungstemperatur (Tma) ist. ¦ Reduzierter Luftstrom - Die Installation des Geräts in einem Rack sollte so erfolgen, dass die Luftstrommenge, die für den sicheren Betrieb des Geräts erforderlich ist, nicht beeinträchtigt wird. ¦ Mechanische Belastung - Die Montage des Geräts im Rack sollte so erfolgen, dass bei einer ungleichmäßigen mechanischen Belastung keine gefährliche Betriebsbedingung entstehen kann. ¦ Stromkreisüberlastung - Der Anschluss des Geräts an den Speisestromkreis und die Wirkung, die ein Überlasten der Stromkreise auf das Überstromschutz-Gerät und die Speisestromkreisverkabelung haben kann, sollten sorgfältig geprüft und berücksichtigt werden. Beim Behandeln dieses Aspekts sollten besonders die Lastangaben auf dem Leistungsschild des Geräts sorgfältig geprüft werden. ¦ Zuverlässige Erdung - Ausrüstung, die in Racks montiert ist, muss zuverlässig geerdet sein. Besonders müssen hierbei die Stromanschluss-leitungen und weniger die direkten Verbindungen zum Abzweigstromkreis beachtet werden (z. B. durch die Verwendung von Adapterleisten). Achtung – Verwenden Sie Geräte in Steckplätzen bzw. auf Schienen nicht als Regal oder Arbeitsbereich. Warnungen bezüglich in Racks eingebauter Systeme Die folgenden Warnungen gelten für Racks und in Racks eingebaute Systeme: Achtung – Aus Sicherheitsgründen sollten sämtliche Geräte von unten nach oben in Racks eingebaut werden. Installieren Sie also zuerst die Geräte, die an der untersten Position im Rack eingebaut werden, gefolgt von den Systemen, die an nächsthöherer Stelle eingebaut werden, usw. Achtung – Verwenden Sie beim Einbau den Kippschutz am Rack, um ein Umkippen zu vermeiden.Safety Agency Compliance Statements 19 Achtung – Um extreme Betriebstemperaturen im Rack zu vermeiden, stellen Sie sicher, dass die Maximaltemperatur die Nennleistung der Umgebungstemperatur für das Produkt nicht überschreitet Achtung – Um extreme Betriebstemperaturen durch verringerte Luftzirkulation zu vermei-den, sollte die für den sicheren Betrieb des Geräts erforderliche Luftzirkulation eingesetzt werden. Achtung – Treffen Sie ausreichende Vorkehrungen, wenn Sie ein Rack oder eine Bibliothek bewegen, die rackmontierte Geräte enthält. Durch das Gewicht mancher Ausrüstungsteile im Rack wurde möglicherweise der Schwerpunkt des Racks bzw. der Bibliothek verändert, was zu einem Ungleichgewicht bzw. Umkippen eines Ausrüstungsteils während einer Bewegung führen kann. Achtung – Stellen Sie bei Bandbibliotheken sicher, dass auf den im Rack zu installierenden Geräten das UL-Prüfzeichen, die CSA- bzw C-UL-Zertifizierung, und die CE-Kennzeichnung angebracht sind. Hinweis zur Laser-Konformität Your Oracle or Sun product may contain Class 1M Laser Transceivers. Achtung – In geöffnetem Zustand Laser-Strahlung der Klasse 1M. Nicht mit optischen Instrumenten direkt in den Strahl schauen. CD- und DVD-Geräte Die folgende Warnung gilt für CD-, DVD- und andere optische Geräte: Achtung – Die hier nicht aufgeführte Verwendung von Steuerelementen, Anpassungen oder Ausführung von Vorgängen kann eine gefährliche Strahlenbelastung verursachen.20 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Dichiarazioni di conformità alle norme di sicurezza Leggere la presente sezione prima di iniziare qualsiasi procedura. Il seguente testo descrive le misure precauzionali da adottare durante l'installazione dei prodotti Sun. Misure precauzionali Osservare le seguenti misure precauzionali durante l'installazione dell'apparecchiatura: ¦ Seguire tutte le avvertenze e le istruzioni riportate sull'apparecchiatura. ¦ Verificare che la tensione e la frequenza della sorgente di alimentazione corrispondano ai valori di tensione e frequenza riportati sull'apposita targhetta dell'apparecchiatura. ¦ Non inserire mai oggetti di alcun tipo nelle aperture dell'apparecchiatura. I componenti interni possono essere attraversati da corrente ad alta tensione. I corpi estranei di materiale conduttore possono produrre un corto circuito e provocare incendi, scosse elettriche o danni all'apparecchiatura. ¦ L'accesso al presente prodotto deve essere limitato attraverso l'impiego di misure di sicurezza (tramite chiave, blocco, uso di attrezzi o di tesserini distintivi) e il personale autorizzato all'accesso deve essere informato delle ragioni alla base delle restrizioni e delle precauzioni necessarie. ¦ Non collegare direttamente il prodotto a cavi di comunicazione metallici esterni. Per il collegamento del prodotto a cavi di comunicazione metallici esterni, utilizzare sempre un dispositivo di protezione atto a tale scopo, quale un interruttore o un router. In alternativa, utilizzare cavi di comunicazione ottici non metallici in uscita dall'edificio. ¦ Non collegare direttamente il prodotto a cavi di alimentazione esterni. ¦ Per l'alimentazione CA, collegare il prodotto esclusivamente a un sistema di distribuzione dell'alimentazione interno che utilizzi appositi interruttori differenziali a limitazione di corrente. ¦ Per l'alimentazione CC, collegare il prodotto esclusivamente a sistemi di alimentazione dotati di messa a terra e che siano circoscritti al singolo edificio. Simboli In questo documento possono essere riportati i seguenti simboli: Attenzione – Rischio di danni alle persone o alle apparecchiature. Seguire le istruzioni. Attenzione – Superficie molto calda. Evitare il contatto. Le superfici sono molto calde e, in caso di contatto, possono provocare ustioni. Attenzione – Componenti attraversati da alta tensione. Per ridurre il rischio di scosse elettriche e per garantire l'incolumità personale, attenersi alle istruzioni. A seconda del tipo di interruttore di alimentazione presente sul dispositivo, potrebbe essere utilizzato uno dei seguenti simboli: Acceso – Applica al sistema la corrente alternata. Spento – Interrompe il flusso di corrente alternata al sistema.Safety Agency Compliance Statements 21 Standby – L'interruttore di accensione/standby è in posizione di attesa. Modifiche all'apparecchiatura Non modificare i componenti elettrici o meccanici dell'apparecchiatura. Oracle non sarà responsabile della conformità ai regolamenti di un prodotto Sun modificato. Collocazione dei prodotti Sun Attenzione – Non ostruire o coprire le prese d'aria del prodotto Sun. Non posizionare il prodotto Sun accanto a caloriferi o altre fonti di calore. La mancata osservanza delle presenti linee guida può causare il surriscaldamento del prodotto Sun, compromettendone l'affidabilità. Livello di rumore Prodotto: SPARC T4-1 server In conformità ai requisiti definiti nella normativa ISO 7779, il livello di rumore prodotto nell'ambiente di lavoro dal presente apparecchio è inferiore a 70 db (A). Conformità SELV Lo stato di sicurezza dei collegamenti I/O è conforme ai requisiti della normativa SELV. Collegamento del cavo di alimentazione Attenzione – I prodotti Sun sono progettati per operare con sistemi di alimentazione dotati di un conduttore neutro con messa a terra (ritorno attraverso la terra per i prodotti alimentati a corrente continua). Per ridurre il rischio di scosse elettriche, non collegare i prodotti Sun a sistemi di alimentazione di tipo diverso. In caso di dubbi sul tipo di rete elettrica utilizzata nell'edificio, contattare un responsabile della struttura o un elettricista qualificato. Attenzione – Non tutti i cavi di alimentazione supportano gli stessi valori di corrente. Non utilizzare il cavo di alimentazione fornito con l'apparecchiatura per altri prodotti o impieghi. Le prolunghe per uso domestico sono prive di protezione contro il sovraccarico di corrente e non sono destinate all'uso con i computer. Non utilizzare prolunghe per uso domestico con il prodotto Sun. L'avvertenza seguente si applica solo ai dispositivi dotati di interruttore di alimentazione con funzione di standby: Attenzione – L'interruttore di alimentazione del presente prodotto funziona solo come dispositivo di standby. Il cavo di alimentazione agisce da dispositivo di disconnessione primario del sistema. Collegare sempre il cavo di alimentazione a una presa di corrente con messa a terra situata in prossimità del sistema e facilmente accessibile. Non collegare il cavo di alimentazione quando l'alimentatore è stato rimosso dallo chassis.22 SPARC T4-1 Server Safety and Compliance Guide • October 2011 L'avvertenza seguente si applica solo ai dispositivi con più cavi di alimentazione: Attenzione – Per i prodotti con più di un cavo di alimentazione, è necessario disconnettere tutti i cavi per interrompere il flusso di corrente elettrica al sistema. Avviso relativo alle batterie Attenzione – Se maneggiate o sostituite in modo non corretto, le batterie possono dare luogo a esplosioni. Nei sistemi con batterie sostituibili, utilizzare solo batterie dello stesso produttore e tipo o di tipo equivalente consigliate dal produttore, come da istruzioni fornite nel manuale di manutenzione del prodotto. Non disassemblare o tentare di ricaricare le batterie all'esterno del sistema. Non gettare le batterie nel fuoco. Attenersi alle istruzioni del produttore e alle normative locali per lo smaltimento delle batterie. Le schede CPU Sun sono dotate di batteria al litio integrata nel clock di tempo reale. Questo tipo di batterie non è sostituibile da parte dell'utente. Avvertenza relativa al modulo di alimentazione Attenzione – Se maneggiati o sostituiti in modo non corretto, i moduli di alimentazione possono causare scosse elettriche e danni alle apparecchiature. Per la sostituzione dei moduli di alimentazione, utilizzare solo moduli sostitutivi forniti da Oracle e seguire le istruzioni disponibili nel manuale del prodotto. Non disassemblare o tentare di ricaricare i moduli all'esterno del sistema. Non smaltire i moduli. Restituirli a Oracle in base alle procedure Oracle relative al prodotto. Copertura dell'unità centrale È necessario rimuovere la copertura dell'unità centrale Sun per aggiungere schede, memoria o dispositivi di memorizzazione interni. Riapplicare sempre la copertura prima di accendere il computer. Attenzione – Non utilizzare mai i prodotti Sun senza l'apposita copertura. La mancata osservanza di questa precauzione può causare danni alle persone o al sistema. Istruzioni relative ai sistemi rack Le seguenti istruzioni (o istruzioni di natura simile) relative alle unità installabili in rack sono incluse nelle istruzioni per l'installazione. ¦ Ambiente di esercizio sopraelevato – Se l'installazione viene eseguita in un assembly composto da più unità in rack, la temperatura di esercizio dell'ambiente rack può essere superiore a quella del locale. È pertanto necessario installare l'apparecchiatura in ambienti compatibili con i requisiti di temperatura ambientale massima (Tma) specificati dal produttore.Safety Agency Compliance Statements 23 ¦ Riduzione del flusso d'aria – L'installazione dell'apparecchiatura in rack deve avvenire in modo da non ostruire il flusso d'aria necessario al corretto funzionamento dell'apparecchiatura. ¦ Carico meccanico – L'installazione dell'apparecchiatura in rack deve essere effettuata in modo da evitare condizioni di pericolo dovute a carichi meccanici non uniformi. ¦ Sovraccarico dei circuiti – È necessario prestare attenzione ai collegamenti dell'apparecchiatura al circuito di alimentazione e agli effetti di eventuali sovraccarichi del circuito sulla protezione contro la sovracorrente e sui cavi di alimentazione. Tenere in considerazione i valori di classificazione riportati sulle etichette delle apparecchiature durante questa fase dell'installazione. ¦ Affidabilità della messa a terra – È necessario mantenere un livello di affidabilità adeguato della messa a terra per le apparecchiature installate in rack. Prestare particolare attenzione alle connessioni di alimentazione diverse dai collegamenti diretti al circuito derivato (ad esempio, quando si utilizzano strisce di alimentazione). Attenzione – L'apparecchiatura con montaggio su guide di scorrimento non deve essere utilizzata come piano di appoggio o area di lavoro. Avviso relativo ai sistemi rack Le avvertenze seguenti si applicano ai sistemi rack o installati in rack. Attenzione – Per motivi di sicurezza, è opportuno caricare sempre le apparecchiature dal basso verso l'alto, ovvero installare prima le apparecchiature da collocare nella parte inferiore del rack e procedere quindi verso l'alto per l'installazione dei sistemi successivi. Attenzione – Per impedire l'inclinazione delle apparecchiature durante l'installazione, utilizzare la barra antipendenza. Attenzione – Per evitare temperature di esercizio estreme all'interno del rack, verificare che la temperatura massima non superi il limite imposto per l'ambiente di utilizzo del prodotto. Attenzione – Per evitare temperature di esercizio estreme dovute a riduzioni del flusso d'aria, è necessario prestare attenzione alla quantità d'aria necessaria all'utilizzo sicuro dell'apparecchiatura.24 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Attenzione – Per spostare un rack o una libreria che contiene apparecchiatura montata in rack, adottare le precauzioni necessarie. Il peso di alcune apparecchiature su rack potrebbe aver modificato il centro di gravità della libreria o del rack e potrebbe causare uno sbilanciamento o una condizione di pericolo durante lo spostamento. Attenzione – Per le librerie a nastro, verificare che l'apparecchiatura da installare nel rack disponga di una certificazione UL, CSA o C-UL e che sia dotata di marchio CE. Conformità alle certificazioni laser Il prodotto Oracle o Sun potrebbe contenere ricetrasmettitori laser di classe 1M. Attenzione – Se aperto, emette radiazioni laser di classe 1M. Evitare la visualizzazione diretta con strumenti ottici. CD e DVD L'avvertenza seguente si applica a CD, DVD e altri dispositivi ottici. Attenzione – L'uso di controlli, regolazioni o l'esecuzione di procedure diverse da quelle qui specificate può causare l'esposizione a radiazioni nocive.Safety Agency Compliance Statements 25 Normas de Conformidade da Agência de Segurança Leia esta seção antes de começar qualquer procedimento. Este texto traz medidas de segurança que devem ser adotadas na instalação do produto Sun. Medidas de segurança Para sua proteção, siga as medidas de segurança a seguir para instalar seu equipamento. ¦ Tome todas as precauções e siga todas as instruções indicadas no equipamento. ¦ Verifique se a tensão e a frequência de sua fonte de alimentação são iguais à tensão e à frequência descritas na etiqueta de classificação elétrica do equipamento. ¦ Jamais insira qualquer tipo de objeto nas aberturas do equipamento. Pode haver tensões perigosas. Objetos estranhos, condutores de eletricidade, podem provocar curto circuito, causando incêndio, choque elétrico ou danos em seu equipamento. ¦ O acesso a este produto deve ser restrito e controlado por dispositivos de segurança (por exemplo: chave, trava, ferramenta, autorização por crachá eletrônico), e o pessoal com acesso autorizado deve estar ciente dos motivos das restrições e tomar todas as precauções necessárias. ¦ Não conecte este produto diretamente a cabos metálicos de comunicação instalados ao ar livre. Para conectar o produto a cabos metálicos de comunicação instalados ao ar livre, sempre utilize um dispositivo de proteção próprio para conexões diretas a esses tipos de cabos (um interruptor ou um roteador) ou utilize cabos óticos não metálicos para comunicação na parte externa da área edificada. ¦ Não conecte este produto diretamente a cabos elétricos instalados ao ar livre. ¦ No caso de corrente alternada, conecte o produto somente a um sistema interno de distribuição de energia elétrica que utilize disjuntores limitadores próprios para corrente alternada. ¦ No caso de corrente direta, conecte o produto somente a sistemas elétricos aterrados que estejam totalmente contidos em uma área edificada. Símbolos Estes símbolos constam deste manual: Atenção – Existe risco de lesão física e dano do equipamento. Siga as instruções. Atenção – Superfície quente. Evite o contato. Superfícies quentes que podem provocar queimaduras se tocadas. Atenção – Tensão perigosa. Para evitar choques elétricos e danos à saúde, siga as instruções. Dependendo do tipo de chave de força do seu dispositivo, um destes símbolos pode ser usado. Ligado – Aplica energia AC ao sistema. Desligado – Elimina energia AC do sistema.26 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Standby – A chave Ligar/Standby está na posição standby. Modificações no equipamento Não faça modificações elétricas nem mecânicas no equipamento. A Oracle não se responsabiliza pela conformidade normativa de um produto Sun modificado. Instalação de produto Sun Atenção – Não bloqueie nem cubra qualquer abertura de seu produto Sun. Jamais instale um produto Sun próximo a um radiador ou registro de aquecimento. A não observância dessas orientações pode provocar superaquecimento e afetar a confiabilidade de seu produto Sun. Nível de ruído Produto: SPARC T4-1 server De acordo com as exigências estabelecidas em ISO 7779, o nível de ruído dependendo do local de operação deste produto deve ficar abaixo de 70 db (A). Conformidade SELV Status de segurança das conexões de entrada/saída e as exigências da SELV. Conexão dos cabos de energia Atenção – Os produtos Sun são produzidos para operar em sistemas de energia com fio neutro aterrado (cabo de retorno aterrado para produtos que operem com energia CC). Para reduzir o risco de choque elétrico, não conecte os produtos Sun a qualquer outro tipo de sistema de energia. Contate o gerente de manutenção ou um eletricista qualificado se você não tiver certeza do tipo de energia elétrica fornecida no seu prédio. Atenção – Nem todos os cabos de força têm a mesma classificação de corrente. Não use o cabo de força fornecido com seu equipamento em qualquer outro produto ou para qualquer outro uso. Os cabos de extensão domésticos não são protegidos contra sobrecargas e não são destinados ao uso em sistemas de computação. Não use cabos de extensão domésticos em seu produto Sun. Estas precauções devem ser observadas apenas em dispositivos com chave de força Standby: Atenção – A chave de força deste produto funciona somente como dispositivo do tipo standby. O cabo de força serve como dispositivo de desconexão primária do sistema. Certifique-se de ligar o cabo de força em tomada com fio neutro aterrado próxima ao sistema e prontamente acessível. Não conecte o cabo de força se o dispositivo de alimentação de energia tiver sido removido do chassi do sistema.Safety Agency Compliance Statements 27 Estas precauções devem ser observadas apenas em dispositivos com vários cabos de força: Atenção – No caso de produtos com vários cabos de força, todos os cabos devem ser desconectados para eliminar totalmente a energia do sistema. Alerta sobre baterias Atenção – As baterias podem explodir se manuseadas ou substituídas incorretamente. Nos sistemas com bateria substituível, substitua a bateria somente por outra do mesmo fabricante ou tipo, ou de tipo equivalente recomendado pelo fabricante, de acordo com as instruções do manual de atendimento ao cliente. Não desmonte a bateria nem tente recarregá-la fora do sistema. Não descarte a bateria no fogo. Descarte as baterias corretamente, de acordo com as instruções do fabricante e as normas locais. Observe que as placas de CPU da Sun têm baterias de lítio moldadas no clock de tempo real. Essas baterias não podem ser substituídas pelo cliente. Atenção – For product installed in California, USA: This product may contain a time-of-day battery which may contain perchlorate where special handling may apply. See http://www.dtsc.ca.gov/hazardouswaste/perchlorate. Aviso do módulo de armazenamento de energia Atenção – Haverá risco de choque ou dano ao equipamento se os módulos de armazenamento de energia forem mal utilizados ou substituídos de forma incorreta. Ao trocar os módulos de armazenamento de energia, use somente módulos de substituição fornecidos pela Oracle, de acordo com as instruções do manual de serviço do produto. Não desmonte os módulos ou tente recarregá- los fora do sistema. Não descarte os módulos; devolva-os para a Oracle de acordo com os procedimentos do produto. Gabinete da unidade do sistema Você deve remover o gabinete da unidade do sistema de computação para inserir placas, memória ou dispositivos internos de armazenamento. Recoloque o gabinete antes de ligar o sistema de computação. Atenção – Não opere os produtos Sun sem o gabinete colocado. A não observância desse procedimento pode resultar em lesões físicas e danos ao sistema.28 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Instruções do sistema de gabinete Estas instruções de montagem de gabinete ou outras similares estão incluídas nas instruções de instalação: ¦ Temperatura ambiente operacional elevada – Se o equipamento for instalado em gabinete fechado ou gabinete com várias unidades, a temperatura do ambiente operacional pode ficar acima do ambiente da sala. Portanto, deve-se considerar a instalação do equipamento em ambiente compatível com a temperatura ambiente máxima especificada pelo fabricante. ¦ Fluxo de ar reduzido – O equipamento deve ser instalado no gabinete de forma a não comprometer o fluxo de ar necessário para uma operação segura. ¦ Carga mecânica – O equipamento deve ser montado no gabinete de forma a evitar condições de risco decorrentes de carga mecânica irregular. ¦ Circuito sobrecarregado – Deve-se atentar para a conexão do equipamento com o circuito de energia e os possíveis efeitos da sobrecarga na proteção contra corrente excessiva e na fiação de força. Consultar a classificação correta da placa de identificação do equipamento ao tratar dessa questão. ¦ Aterramento confiável – Deve-se manter um aterramento confiável para o equipamento montado em gabinete. Deve-se atentar especificamente para as conexões de energia além das conexões diretas com o circuito de ramal (por exemplo, uso de tiras de força). Atenção – Os equipamentos montados sobre corrediças/trilhos não devem ser utilizados como prateleira ou área de trabalho. Alerta sobre o sistema de gabinete Estes alertas se aplicam aos gabinetes e sistemas montados em gabinetes. Atenção – Por questão de segurança, o equipamento sempre deve ser carregado de baixo para cima. Ou seja, instalar primeiro o equipamento que será montado na parte inferior do gabinete, em seguida, os sistemas das partes superiores e assim por diante. Atenção – Para evitar a inclinação do gabinete durante a instalação do equipamento, usar a barra anti-inclinação. Atenção – Para evitar temperatura operacional excessiva dentro do gabinete, certifique-se de que a temperatura máxima não ultrapasse as temperaturas ambientais estabelecidas para o produto. Atenção – Para evitar temperatura operacional excessiva em virtude do fluxo reduzido de ar, deve-se verificar o fluxo de ar exigido para a operação segura do equipamento.Safety Agency Compliance Statements 29 Atenção – Tome medidas adequadas ao mover um rack ou biblioteca com equipamento instalado em rack. O peso de alguns equipamentos em rack pode alterar o centro de gravidade do rack ou da biblioteca e levar a uma condição de desequilíbrio durante uma movimentação. Atenção – Em bibliotecas de fitas, confirme se o equipamento a ser instalado no rack está na Listagem UL ou tem certificação CSA ou C-UL e se tem a marcação CE. Nota de conformidade para a tecnologia laser Seu produto Oracle ou Sun pode conter Transceivers a Laser Class 1M. Atenção – Há incidência de radiação laser de classe 1M quando aberto. Não olhar diretamente com instrumentos óticos. Dispositivos de CD e DVD Os cuidados a seguir se aplicam a dispositivos de CD, DVD e outros dispositivos óticos. Atenção – O uso de controles, a realização de ajustes ou a adoção de procedimentos não especificados neste documento podem provocar exposição perigosa à radiação.30 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Normativas de seguridad Lea esta sección antes de realizar cualquier operación. En ella se explican las medidas de seguridad que debe tomar al instalar un producto de Sun. Medidas de seguridad Para su protección, tome las medidas de seguridad siguientes durante la instalación del equipo: ¦ Siga todos los avisos e instrucciones indicados en el equipo. ¦ Asegúrese de que el voltaje y frecuencia de la fuente de alimentación coincidan con el voltaje y frecuencia indicados en la etiqueta de clasificación eléctrica del equipo. ¦ No introduzca objetos de ningún tipo por las rejillas del equipo, ya que puede quedar expuesto a voltajes peligrosos. Los objetos conductores extraños pueden producir cortocircuitos y, en consecuencia, incendios, descargas eléctricas o daños en el equipo. ¦ Este producto se ha concebido para un acceso restringido y, por tanto, éste se controla mediante mecanismos de seguridad (p. ej., acceso con clave, bloqueo, herramienta y tarjeta de identificación). Las personas con acceso autorizado están al corriente de los motivos de esta restricción y de las precauciones que se deben tomar. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Símbolos En este documento aparecen los siguientes símbolos: Precaución – Existe el riesgo de que se produzcan lesiones personales y daños en el equipo. Siga las instrucciones. Precaución – Superficie caliente. Evite todo contacto. Las superficies están calientes y pueden causar lesiones personales si se tocan. Precaución – Voltaje peligroso. Para reducir el riesgo de descargas eléctricas y lesiones personales, siga las instrucciones. En función del tipo de interruptor de alimentación del que disponga el dispositivo, se utilizará uno de los símbolos siguientes: Encendido – Suministra alimentación de CA al sistema.Safety Agency Compliance Statements 31 Apagado – Corta la alimentación de CA del sistema. Espera – El interruptor de encendido/espera está en la posición de espera. Modificaciones en el equipo No realice modificaciones de tipo mecánico ni eléctrico en el equipo. Oracle no se hace responsable del cumplimiento de normativas en caso de que un producto Sun se haya modificado. Colocación de un producto Sun Precaución – No obstruya ni tape las rejillas del producto Sun. Nunca coloque un producto Sun cerca de radiadores ni fuentes de calor. Si no sigue estas indicaciones, el producto Sun podría sobrecalentarse y la fiabilidad de su funcionamiento se vería afectada. Nivel de ruido Producto: SPARC T4-1 server En conformidad con la norma ISO 7779, el nivel de emisión de ruido de este producto en el puesto de trabajo es inferior a los 70 db(A). Cumplimiento de la normativa para instalaciones SELV Las condiciones de seguridad de las conexiones de entrada y salida cumplen los requisitos para instalaciones SELV (del inglés Safe Extra Low Voltage, voltaje bajo y seguro). Conexión del cable de alimentación Precaución – Los productos Sun se han diseñado para funcionar con sistemas de alimentación que cuenten con un conductor neutro a tierra (con conexión a tierra de regreso para los productos con alimentación de CC). Para reducir el riesgo de descargas eléctricas, no conecte ningún producto Sun a otro tipo de sistema de alimentación. Póngase en contacto con el encargado de las instalaciones de su empresa o con un electricista cualificado en caso de que no esté seguro del tipo de alimentación del que se dispone en el edificio. Precaución – No todos los cables de alimentación tienen la misma clasificación eléctrica. Los alargadores de uso doméstico no cuentan con protección frente a sobrecargas y no están diseñados para su utilización con sistemas informáticos. No utilice alargadores de uso doméstico con el producto Sun. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de un interruptor de alimentación de espera:32 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Precaución – El interruptor de alimentación de este producto funciona solamente como un dispositivo de espera. El cable de alimentación hace las veces de dispositivo de desconexión principal del sistema. Asegúrese de que conecta el cable de alimentación a una toma de tierra situada cerca del sistema y de fácil acceso. No conecte el cable de alimentación si la unidad de alimentación no se encuentra en el bastidor del sistema. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de varios cables de alimentación: Precaución – En los productos que cuentan con varios cables de alimentación, debe desconectar todos los cables de alimentación para cortar por completo la alimentación eléctrica del sistema. Advertencia sobre las baterías Precaución – Si las baterías no se manipulan o reemplazan correctamente, se corre el riesgo de que estallen. En los sistemas que cuentan con baterías reemplazables, reemplácelas sólo con baterías del mismo fabricante y el mismo tipo, o un tipo equivalente recomendado por el fabricante, de acuerdo con las instrucciones descritas en el manual de servicio del producto. No desmonte las baterías ni intente recargarlas fuera del sistema. No intente deshacerse de las baterías echándolas al fuego. Deshágase de las baterías correctamente de acuerdo con las instrucciones del fabricante y las normas locales. Tenga en cuenta que en las placas CPU de Sun, hay una batería de litio incorporada en el reloj en tiempo real. Los usuarios no deben reemplazar este tipo de baterías. Advertencia relativa al módulo de almacenamiento de energía Precaución – Existe un peligro de electrocuciones o daños en el equipo si se manipulan o sustituyen incorrectamente los módulos de almacenamiento de energía. Cuando cambie los módulos de almacenamiento de energía, utilice exclusivamente módulos de sustitución que hayan sido suministrados por Oracle, de conformidad con las instrucciones indicadas en el manual de servicio del producto. No desmonte módulos ni intente recargarlos fuera del sistema. No elimine los módulos. En su lugar, devuélvalos a Oracle de conformidad con los procedimientos de Oracle para el producto. Cubierta de la unidad del sistema Debe extraer la cubierta de la unidad del sistema informático Sun para instalar tarjetas, memoria o dispositivos de almacenamiento internos. Vuelva a colocar la cubierta antes de encender el sistema informático. Precaución – No ponga en funcionamiento los productos Sun que no tengan colocada la cubierta. De lo contrario, puede sufrir lesiones personales y ocasionar daños en el sistema.Safety Agency Compliance Statements 33 Instrucciones para el montaje en armario Las siguientes instrucciones de montaje en armario u otras similares se incluyen en las instrucciones de instalación: ¦ Temperatura de funcionamiento elevada - si se instala en un armario cerrado o con más unidades, la temperatura ambiente de funcionamiento del entorno del armario puede ser superior a la de la habitación. Por tanto, el equipo debería instalarse en un entorno compatible con la temperatura ambiente máxima (Tma) especificada por el fabricante. ¦ Flujo de aire reducido - para instalar el equipo en un armario hay que asegurarse de que se mantendrá el flujo de aire necesario para el correcto funcionamiento del equipo. ¦ Carga mecánica - el montaje del equipo en el armario debería realizarse de modo que no se dé una situación de peligro debido a una carga mecánica irregular. ¦ Sobrecarga del circuito - debe prestarse atención a la conexión del equipo al circuito de alimentación y a las consecuencias que puede tener la sobrecarga de los circuitos en la protección de sobrecorriente y el cableado de alimentación. En caso de sobrecarga, es recomendable tener en cuenta la potencia del equipo que aparece en la placa de identificación. ¦ Puesta a tierra fiable - debería mantenerse una puesta a tierra fiable del equipo montado en un armario. Debería prestarse especial atención a las conexiones de suministro que no sean las directas al circuito derivado (p. ej., las regletas de distribución). Precaución – Los equipos instalados por deslizamiento o sobre raíles no deben utilizarse como estantería o espacio de trabajo. Advertencia sobre el sistema en bastidor Las advertencias siguientes se aplican a los sistemas montados en bastidor y a los propios bastidores. Precaución – Por seguridad, siempre deben montarse los equipos de abajo arriba. A saber, primero debe instalarse el equipo que se situará en el bastidor inferior; a continuación, el que se situará en el siguiente nivel, etc. Precaución – Para evitar que el bastidor se vuelque durante la instalación del equipo, debe extenderse la barra antivolcado del bastidor. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema en el bastidor, asegúrese de que la temperatura máxima no sea superior a la temperatura ambiente establecida como adecuada para el producto.34 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema debido a una circulación de aire reducida, debe considerarse la magnitud de la circulación de aire requerida para que el equipo funcione de forma segura. Precaución – Al mover un bastidor o una librería que contiene un equipo instalado en bastidor, tome las precauciones necesarias. El peso de algunos equipos instalados en bastidor puede haber alterado el centro de gravedad de la librería o del bastidor y podría ocasionar pérdida de equilibrio o volcarse durante su traslado. Precaución – Para librerías de cintas, compruebe que el equipo que vaya a instalarse en el bastidor tenga la certificación UL Listing, CSA o C-UL, y la marca CE. Aviso de cumplimiento de la normativa para la utilización de láser Your Oracle or Sun product may contain Class 1M Laser Transceivers. Precaución – Radiación láser Clase 1M si se abre. No mirar directamente con instrumentos ópticos. Dispositivos de CD y DVD La siguiente medida se aplica a los dispositivos de CD y DVD, así como a otros dispositivos ópticos: Precaución – La utilización de controles, ajustes o procedimientos distintos a los aquí especificados puede dar lugar a niveles de radiación peligrosos.Safety Agency Compliance Statements 3536 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 3738 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 3940 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4142 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4344 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4546 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4748 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4950 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5152 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5354 SPARC T4-1 Server Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5556 SPARC T4-1 Server Safety and Compliance Guide • October 2011 Nordic Lithium Battery Cautions Norge Advarsel – Litiumbatteri — Eksplosjonsfare. Ved utskifting benyttes kun batteri som anbefalt av apparatfabrikanten. Brukt batteri returneres apparatleverandøren. Sverige Varning – Explosionsfara vid felaktigt batteribyte. Använd samma batterityp eller en ekvivalent typ som rekommenderas av apparattillverkaren. Kassera använt batteri enligt fabrikantens instruktion. Danmark Advarsel! – Litiumbatteri — Eksplosionsfare ved fejlagtig håndtering. Udskiftning må kun ske med batteri af samme fabrikat og type. Levér det brugte batteri tilbage til leverandøren. Suomi Varoitus – Paristo voi räjähtää, jos se on virheellisesti asennettu. Vaihda paristo ainoastaan laitevalmistajan suosittelemaan tyyppiin. Hävitä käytetty paristo valmistajan ohjeiden mukaisesti. Nordic Grounded Socket Cautions English Caution – The appliance must be connected to a grounded socket. Norge Advarsel – Apparatet må tilkoples jordet stikkontakt. Sverige Varning – Apparaten skall anslutas till jordat uttag.Safety Agency Compliance Statements 57 Suomi Varoitus – Laite on liitettävä suojamaadoituskoskettimilla varustettuun pistorasiaan.58 SPARC T4-1 Server Safety and Compliance Guide • October 2011 SPARC T4 Series Servers Security Guide Part No. E24876-01 October 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents SPARC T4 Series Servers Security 1 Understanding Security Principles 1 Planning a Secure Environment 2 Hardware Security 2 Software Security 3 Firmware Security 4 Oracle ILOM Firmware 4 Maintaining a Secure Environment 4 Hardware Controls 4 Asset Tracking 5 Software and Firmware 5 Local and Remote Access 5 Data Security 6 Network Security 6iv SPARC T4 Series Servers Security Guide • October 20111 SPARC T4 Series Servers Security This document provides general security guidelines for the T4-1, T4-1B, T4-2, and T4-4 servers. This guide is intended to help you ensure security when using these servers with other Oracle hardware products such as network switches and network interface cards. The following sections are in this chapter: ¦ “Understanding Security Principles” on page 1 ¦ “Planning a Secure Environment” on page 2 ¦ “Maintaining a Secure Environment” on page 4 Understanding Security Principles There are four basic security principles: access, authentication, authorization, and accounting. ¦ Access Physical and software controls are necessary to protect your hardware or data from intrusion. ¦ For hardware, access limits usually mean physical access limits. ¦ For software, access is limited through both physical and virtual means. ¦ Firmware cannot be changed except through the Oracle update process. ¦ Authentication All platform operating systems provide authentication features that can be set up to ensure that users are who they say they are. Authentication provides varying degrees of security through measures such as badges and passwords. ¦ Authorization2 SPARC T4 Series Servers Security Guide • October 2011 Authorization allows company personnel to work only with hardware and software that they are trained and qualified to use. To this end, system administrators create systems of Read/Write/Execute permissions to control user access to commands, disk space, devices, and applications. ¦ Accounting Oracle software and hardware features allow customer IT to monitor login activity and maintain hardware inventories. ¦ User logins can be monitored through system logs. System Administrator and Service accounts in particular have access to powerful commands and should be carefully monitored through system logs. Logs are typically maintained for a long period, so it is essential to periodically retire log files when they exceed a reasonable size, in accordance with the customer company policy. ¦ Customer IT assets are usually tracked through serial numbers. Oracle part numbers are electronically recorded on all cards, modules, and mother boards, and can be used for inventory purposes. Planning a Secure Environment Use the following notes before and during the installation and configuration of a server and related equipment. Hardware Security Physical hardware can be secured fairly simply: limit access to the hardware and record serial numbers. ¦ Restrict access ¦ Install servers and related equipment in a locked, restricted access room. ¦ If equipment is installed in a rack with a locking door, always lock the rack door until you have to service the components within the rack. ¦ Hot-plug or hot-swap devices are removed easily and especially require restricted accessibility. ¦ Store spare field-replaceable units (FRUs) or customer-replaceable units (CRUs) in a locked cabinet. Restrict access to the locked cabinet to authorized personnel. ¦ Record serial numbers ¦ Security-mark all significant items of computer hardware such as FRUs. Use special ultraviolet pens or embossed labels.SPARC T4 Series Servers Security 3 ¦ Keep a record of the serial numbers of all your hardware. ¦ Keep hardware activation keys and licenses in a secure location that is easily accessible to the system manager in system emergencies. The printed documents might be your only proof of ownership. Software Security Most hardware security is implemented through software measures. ¦ When a new system is installed, change all default passwords. Most types of equipment use default passwords, such as changeme, that are widely known and would allow unauthorized access to the equipment. Also, devices such as network switches can have multiple user accounts by default. Be sure to change all account passwords. ¦ Limit use of the root superuser account. Oracle Integrated Lights Out Manager (Oracle ILOM) accounts such as ilom-operator and ilom-admin should be used instead whenever possible. ¦ Use a dedicated network for service processors to separate them from the general network. ¦ Protect access to USB consoles. Devices such as system controllers, power distribution units (PDUs), and network switches can have USB connections, which can provide more powerful access than SSH connections. ¦ Refer to the documentation that came with your software to enable any security features available for the software. ¦ A server can boot securely with WAN Boot or iSCSI Boot. For information, refer to the Oracle Solaris Installation Guide: Network-Based Installations book for your Oracle Solaris release. The Oracle Solaris Security Guidelines document provides information on: ¦ How to harden Oracle Solaris ¦ How to use Oracle Solaris security features when configuring your systems ¦ How to operate securely when you add applications and users to a system ¦ How to protect network-based applications Oracle Solaris Security Guidelines documents can be found at: ¦ http://www.oracle.com/technetwork/indexes/documentation/index.h tml#sys_sw4 SPARC T4 Series Servers Security Guide • October 2011 Firmware Security Ordinary user accounts cannot edit the OpenBoot PROM (OBP) or other Oracle firmware. The Oracle Solaris Operating System uses a controlled firmware update process to prevent unauthorized firmware modifications. Only the superuser can use the update process. For information for setting OBP security variables, refer to the OpenBoot 4.x Command Reference Manual at: ¦ http://download.oracle.com/docs/cd/E19455-01/816-1177-10/cfg-va r.html#pgfId-17069 Oracle ILOM Firmware Oracle Integrated Lights Out Manager (Oracle ILOM) is system management firmware that is preinstalled on some SPARC servers. Oracle ILOM enables you to actively manage and monitor components installed in your system. The way you use Oracle ILOM affects the security of your system. To understand more about using this firmware when setting up passwords, managing users, and applying security-related features, including Secure Shell (SSH), Secure Socket Layer (SSL), and RADIUS authentication, refer to Oracle ILOM documentation: ¦ http://www.oracle.com/pls/topic/lookup?ctx=E19860-01 Maintaining a Secure Environment Oracle hardware and software provide a number of security features controlling hardware and tracking assets. Hardware Controls Some Oracle systems can be set up to be turned on and off by software commands. In addition, the power distribution units (PDUs) for some system cabinets can be enabled and disabled remotely by software commands. Authorization for these commands is typically set up during system configuration and is usually limited to system administrators and service personnel. Refer to your system or cabinet documentation for further information.SPARC T4 Series Servers Security 5 Asset Tracking Oracle serial numbers are embedded in firmware located on option cards and system mother boards. These serial numbers can be read through local area network connections for inventory tracking. Wireless radio frequency identification (RFID) readers can further simplify asset tracking. An Oracle white paper, How to Track Your Oracle Sun System Assets by Using RFID is available at: ¦ http://www.oracle.com/technetwork/articles/systems-hardware-arc hitecture/o11-001-rfid-oracle-214567.pdf Software and Firmware ¦ Always install the latest released version of the software or firmware on your equipment. Devices such as network switches contain firmware and might require patches and firmware updates. ¦ Install any necessary security patches for your software. Local and Remote Access Follow these guidelines to ensure the security of local and remote access to your systems: ¦ Create a banner to state that unauthorized access is prohibited. ¦ Use access control lists where appropriate. ¦ Set time-outs for extended sessions and set privilege levels. ¦ Use authentication, authorization, and accounting (AAA) features for local and remote access to a switch. ¦ If possible, use the RADIUS and TACACS+ security protocols: – RADIUS (Remote Authentication Dial In User Service) is a client/server protocol that secures networks against unauthorized access. – TACACS+ (Terminal Access Controller Access-Control System) is a protocol that permits a remote access server to communicate with an authentication server to determine if a user has access to the network. ¦ Use the port mirroring capability of the switch for intrusion detection system (IDS) access. ¦ Implement port security to limit access based upon a MAC address. Disable auto-trunking on all ports.6 SPARC T4 Series Servers Security Guide • October 2011 ¦ Limit remote configuration to specific IP addresses using SSH instead of Telnet. Telnet passes user names and passwords in clear text, potentially allowing everyone on the LAN segment to see login credentials. Set a strong password for SSH. ¦ Early versions of SNMP are not secure and transmit authentication data in unencripted text. Only version 3 of SNMP can provide secure transmissions. ¦ Some products come out of the box with PUBLIC set as the default SNMP community string. Attackers can query a community to draw a very complete network map and possibly modify management information base (MIB) values. If SNMP is necessary, change the default SNMP community string to a strong community string. ¦ Enable logging and send logs to a dedicated secure log host. ¦ Configure logging to include accurate time information, using NTP and timestamps. ¦ Review logs for possible incidents and archive them in accordance with the security policy. ¦ If your system controller uses a browser interface, be sure to log out after using it. Data Security Follow these guidelines to maximize data security: ¦ Back up important data using devices such as external hard drives, pen drives, or memory sticks. Store the backed up data in a second, off-site, secure location. ¦ Use data encryption software to keep confidential information on hard drives secure. ¦ When disposing of an old hard drive, physically destroy the drive or completely erase all the data on the drive. Deleting all the files or reformatting the drive will remove only the address tables on the drive - information can still be recovered from a drive after deleting files or reformatting the drive. (Use disk wiping software to completely erase all data on a drive.) Network Security Follow these guidelines to maximize your network security: ¦ Most switches allow you to define virtual local area networks (VLANs). If you use your switch to define VLANs, separate sensitive clusters of systems from the rest of the network. This decreases the likelihood that users will gain access to information on these clients and servers.SPARC T4 Series Servers Security 7 ¦ Manage switches out-of-band (separated from data traffic). If out-of-band management is not feasible, then dedicate a separate VLAN number for in-band management. ¦ Keep Infiniband hosts secure. An Infiniband fabric is only as secure as its least secure Infiniband host. ¦ Note that partitioning does not protect an Infiniband fabric. Partitioning only offers Infiniband traffic isolation between virtual machines on a host. ¦ Maintain a switch configuration file off-line and limit access only to authorized administrators. The configuration file should contain descriptive comments for each setting. ¦ Use static VLAN configuration, when possible. ¦ Disable unused switch ports and assign them an unused VLAN number. ¦ Assign a unique native VLAN number to trunk ports. ¦ Limit the VLANs that can be transported over a trunk to only those that are strictly required. ¦ Disable VLAN Trunking Protocol (VTP), if possible. Otherwise, set the following for VTP: management domain, password and pruning. Then set VTP into transparent mode. ¦ Disable unnecessary network services, such as TCP small servers or HTTP. Enable necessary network services and configure these services securely. ¦ Different switches will offer different levels of port security features. Use these port security features if they are available on your switch: ¦ MAC Locking: This involves tying a Media Access Control (MAC) address of one or more connected devices to a physical port on a switch. If you lock a switch port to a particular MAC address, superusers cannot create backdoors into your network with rogue access points. ¦ MAC Lockout: This disables a specified MAC address from connecting to a switch. ¦ MAC Learning: Use the knowledge about each switch port’s direct connections so the switch can set security based on current connections.8 SPARC T4 Series Servers Security Guide • October 2011 1 This guide describes how to quickly power on and boot Oracle’s SPARC T4-1 server for the first time using the preinstalled Oracle Solaris Operating System (Oracle Solaris OS). Detailed installation information can be found in the SPARC T4-1 Server Installation Guide, which is available at the Oracle documentation web site: http://download.oracle.com/docs/cd/E22985_01 Shipping Contents Safety and Compliance Information Before performing an installation, refer to the following documents for safety information regarding the SPARC T4-1 server: ¦ Important Safety Information for Sun Hardware Systems - Printed document included in the shipping kit. ¦ SPARC T4-1 Server Safety and Compliance Manual - Available online at the Oracle documentation web site. Quantity Item 1 Server 2 AC power cords 1 RJ-45 to DB-9 crossover adapter 1 Antistatic wrist strap 1 Rail rackmounting kit 1 Cable management arm Various documents SPARC T4-1 Server Getting Started Guide2 ?Install Optional Components Before installing the server into the rack, you must first install any optional components that you ordered with the server, such as DIMMs and PCIe cards. Refer to the SPARC T4-1 Server Service Manual for instructions on installing optional components. ?Prepare to Install the Server Setting up the server for the first time takes about 45 to 75 minutes. Plan for additional time if you are also installing optional hardware and rackmounting kits. Caution – Do not apply power until instructed to do so. – This system includes a service processor (SP) that is used to configure and boot the host server. To properly configure the host server and view SP messages, do not apply AC power to the server until the SP and host networking connections are made, as described in this guide. 1. Choose the best way to set up the server for your environment. The instructions in this guide work for any networking environment and require a terminal device for connecting to a serial port. If you have a networking environment running DHCP, you can configure your system using the Ethernet management port by following the instructions in the installation guide. 2. Obtain a terminal device. You configure the server through the SP using the built-in serial and network management ports, not through a graphical interface and keyboard. To communicate with the SP, you need a terminal device, which can be a terminal, a terminal server, or a laptop running terminal emulation software. 3. Gather your configuration information. Refer to the installation guide for a checklist. ? Install the Server For quick installation and configuration, follow these steps. For more detailed information, refer to the complete online product documentation set. 1. Confirm that you received all the parts needed for setting up the server. See “Shipping Contents” for details. 2. Place the server in its intended location. For rackmounting instructions, refer to the installation guide. 3. Connect a serial cable between the server’s SER MGT port and a terminal device. This connection provides the initial communication with the SP. Set up the server to communicate using 9600 baud, 8 bit, no parity, 1 stop bit. For DTE-to-DTE communication, use the supplied RJ-45 crossover adapters with a standard RJ-45 cable to set up a null modem configuration so that the transmit and receive signals are crossed over.3 FIGURE 1 Server Connections 4. (Optional) Connect an Ethernet cable between the server’s NET MGT port and the network to which future connections to the SP and host will be made. Configure the system for the first time through the SER MGT port. After the initial configuration, you can set up communication between the SP and host through this Ethernet interface. 5. Connect an Ethernet cable between one of the server’s NET ports and the network to which the server will communicate. 6. Connect the power cords to the power supplies and to separate power sources. Connect the server’s power supplies to separate power sources to provide power redundancy. The system can operate with one power connection, but having only one power source reduces the redundancy. When the power cords are connected, the SP initializes and the power supply LEDs illuminate. After a few minutes, the SP login prompt displays on the terminal device. At this time, the host is not initialized or powered on.4 7. At the terminal device, log in to the SP as root with a password of changeme. After a brief delay, the Oracle Integrated Lights Out Manager (Oracle ILOM) prompt (->) is displayed. For optimal security, change the root password. Refer to the Oracle ILOM documentation for more information about administration tasks such as changing passwords, adding accounts, and setting account privileges. Note – By default, the SP is configured to use DHCP to obtain an IP address. If, instead, you plan to assign a static IP address to the SP, refer to the installation guide for instructions. 8. Power on the server and redirect the host output to display on the serial terminal device. The server initialization takes approximately 20 minutes to complete. 9. When prompted, follow the onscreen instructions and type the configuration information for your system. If you are not sure how to respond, accept the default and make changes later when the Oracle Solaris OS is running. After you confirm the configuration information, the server reboots and displays the Oracle Solaris login prompt. 10. Log in to the server. Use the following commands to display information about the system: ¦ showrev – Displays the host name and system architecture information. Use the -a option to display the patches that are installed. ¦ psrinfo – Displays information about the number and status of the processors and cores in the host. Refer to the Oracle Solaris OS man pages and documentation for more details about these commands. ?Check for Latest Patches and Firmware Later versions of OS patches and server firmware might be available for your server. Some server features are enabled only when certain versions of patches or firmware are installed. Refer to the SPARC T4-1 Server Product Notes for details about required versions and patches. For updates, go to the My Oracle Support web site: https://support.oracle.com SUNSP00144FAC732F login: root Password: changeme . . . -> -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. . . .5 Related Documentation Feedback Provide feedback on this document at: http://www.oracle.com/goto/docfeedback Support and Accessibility Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 server http://download.oracle.com/docs/cd/E22985_01 Oracle ILOM http://download.oracle.com/docs/cd/E19860-01 Oracle Solaris and other system software http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Description Links Access electronic support through My Oracle Support. https://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility. http://www.oracle.com/us/corporate/accessibility6 Copyright © 2011, Oracle and/or its affiliates. All rights reserved. Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Part Number: E22992-02 Mfg. Number: 7040411 October 2011 SPARC T4-1 Server Installation Guide Part No. E22988-02 October 2011Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation vii Confirming Server and Site Specifications 1 Server Overview 1 Front Panel Components 3 Front Panel System LEDs and Buttons 4 Rear Panel Components 6 Rear Panel System LED and Button 7 Confirming Specifications 8 Physical Specifications 9 Minimum Clearance for Service Access 9 Electrical and Power Specifications 10 Environmental Specifications 11 Acoustic Noise Emissions 12 Airflow Considerations 13 Preparing for Installation 15 Shipping Kit Inventory List 15 Handling Precautions 17 ESD Precautions 17 Tools Needed for Installation 18 Installing the Server 19iv SPARC T4-1 Server Installation Guide • October 2011 Rack Compatibility 19 ? Stabilize the Rack 21 Installing Slide Rails 22 Slide Rail Assemblies 22 ? Install the Slide Rail Assemblies 25 ? Install the Server 29 (Optional) Installing the CMA 31 ? Install the CMA 31 ? Verify Correct Operation of the Slide Rails and the CMA 36 Connecting Cables 39 Cabling Requirements 39 Identifying Ports 41 USB Ports 41 SER MGT Port 41 NET MGT Port 42 Gigabit Ethernet Ports 43 Video Port 44 Connecting Data and Management Ports 45 ? Connect the SER MGT Port Cable 45 ? Connect the NET MGT Port Cable 46 ? Connect the Ethernet Network Cables 47 ? Connect Other Data Cables 48 ? Secure Cables in the CMA 49 Powering On the Server for the First Time 51 Oracle ILOM System Console 51 ? Connect a Terminal or Emulator to the SER MGT Port 52 ? Power On the Server for the First Time 53Contents v ? Verify Functionality 55 Assigning a Static IP Address to the SP 55 ? Assign a Static IP Address to the SP 55 Oracle Solaris OS Configuration Parameters 57 Glossary 59 Index 65vi SPARC T4-1 Server Installation Guide • October 2011vii Using This Documentation This installation guide provides instructions, background information, and reference material to help you install Oracle’s SPARC T4-1 Server. ¦ “Related Documentation” on page vii ¦ “Feedback” on page viii ¦ “Support and Accessibility” on page viii Related Documentation Feedback Provide feedback on this documentation at: Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 Server http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1 Oracle ILOM 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle Solaris OS and other systems software http://www.oracle.com/technetwork/indexes/documentation/index.ht ml#sys_sw Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0viii SPARC T4-1 Server Installation Guide • October 2011 http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 Confirming Server and Site Specifications This chapter explains how to verify that the server and the installation site are ready for the installation to take place. It contains these topics: Server Overview This topic provides a high-level introduction to the main components and capabilities of the server. Step Description Links 1. Review the product notes for any late-breaking news. SPARC T4-1 Server Product Notes 2. Review the server features, components, LEDs, and external I/O ports. “Server Overview” on page 1 “Front Panel Components” on page 3 “Front Panel System LEDs and Buttons” on page 4 “Rear Panel Components” on page 6 “Rear Panel System LED and Button” on page 7 3. Review the server specifications and site requirements. “Confirming Specifications” on page 8 4. Prepare the information and tools needed to install the server. “Preparing for Installation” on page 152 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Oracle’s SPARC T4-1 Server Component Description Chassis Rack-mountable server with a 2RU form-factor. CPU One T4 2.85 GHz multicore processor. Memory Sixteen DDR3 DIMM memory slots supporting 4, 8, or 16 GB modules. Storage devices For internal storage, the server provides: • Eight 2.5-inch drive bays, accessible through the front panel. • A slot-loading DVD+/-RW drive on front panel. USB ports Four external USB 2.0 ports (two each on the front and rear panels). Video ports One high-density DB-15 video port (rear panel). PCI Express 2.0 I/O slots Six standard half-length, low-profile PCIe 2.0 slots. Two of the six slots are capable of accepting either a PCIe card or a XAUI card. Ethernet ports Four 10/100/1000 Mbps, RJ-45-based, autonegotiating Ethernet ports (rear panel). SP Oracle Integrated Lights Out Manager (ILOM) with RJ-45 serial and Ethernet interfaces. Power supplies Two hot-swappable power supplies Cooling fans Six sets (N+1) of hot-pluggable counter-rotating fan modules.Confirming Server and Site Specifications 3 Related Information ¦ SPARC T4-1 Server Service Manual ¦ Oracle ILOM documentation ¦ “Front Panel Components” on page 3 ¦ “Front Panel System LEDs and Buttons” on page 4 ¦ “Rear Panel Components” on page 6 ¦ “Rear Panel System LED and Button” on page 7 Front Panel Components The following figure shows the components that are accessible on the server front panel. FIGURE: Components on the Server Front Panel Figure Legend 1 System controls and indicators 8 Hard drive HDD5 2 RFID tag 9 Hard drive HDD6 3 Hard drive HDD0 10 Hard drive HDD7 4 Hard drive HDD1 11 SATA DVD module 5 Hard drive HDD2 12 USB port 2 6 Hard drive HDD3 13 USB port 3 7 Hard drive HDD44 SPARC T4-1 Server Installation Guide • October 2011 Related Information ¦ “Server Overview” on page 1 ¦ “Front Panel System LEDs and Buttons” on page 4 ¦ “Rear Panel Components” on page 6 ¦ “Rear Panel System LED and Button” on page 7 Front Panel System LEDs and Buttons The following figure shows the layout of the system LEDs and the power control button on the front panel. FIGURE: Front Panel System LEDs and Power Buttons Figure Legend 1 Locator LED and button 5 Power Supply Service Required LED 2 Fault - Service Required LED 6 System Overterperature Fault - Service Required LED 3 Power OK LED 7 Top Fan Fault - Service Required LED 4 Power ON/Standby buttonConfirming Server and Site Specifications 5 Related Information ¦ “Front Panel Components” on page 3 ¦ “Rear Panel Components” on page 6 ¦ “Rear Panel System LED and Button” on page 7 TABLE: Front Panel System LED Descriptions LED or Button Icon or Label Description Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rabidly. There are two methods for turning a Locator LED on: • Issuing the ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button. Service Required LED (amber) Steady on light indicates that a fault has been detected in the system and that service is required. Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The SP might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Blink – System is running in standby mode and can be quickly returned to full operation. • Slow blink – A transitional activity is taking place. • Fast blink – SP is booting. Power button The recessed Power button toggles the system on or off. • Press and release to turn the system on. • Press and release to shut the system down in a normal manner. • Press and hold for more than 5 seconds to perform an emergency shutdown. Power Supply Fault LED (amber) REAR PS Indicates that a power supply fault has been detected and that service is required. Overtemp LED (amber) Indicates that an overtemperature condition within the chassis has been detected and that service is required. Fan Fault LED (amber) TOP FAN Indicates that a fan module fault has been detected and that service is required.6 SPARC T4-1 Server Installation Guide • October 2011 Rear Panel Components The following figure shows the components that are accessible on the server rear panel. FIGURE: Components on the Server Rear Panel Related Information ¦ “Front Panel Components” on page 3 ¦ “Front Panel System LEDs and Buttons” on page 4 ¦ “Rear Panel System LED and Button” on page 7 Figure Legend 1 Power supply 0 12 Gbit Ethernet port NET3 2 Power supply 1 13 USB port 0 3 Locator LED button 14 USB port 1 4 Service Required LED 15 VGA video port 5 Power OK LED 16 PCIe slot 3 6 SP SER MGT port 17 PCIe or XAUI slot 0 7 SP NET MGT port 18 PCIe slot 4 8 Gbit Ethernet port NET0 19 PCIe or XAUI slot 1 9 Gbit Ethernet port NET1 20 PCIe slot 5 10 Gbit Ethernet port NET2 21 PCIe slot 2 11 Gbit Ethernet port NET2Confirming Server and Site Specifications 7 Rear Panel System LED and Button The following figure shows location of the system LEDs and the locator button on the rear panel. FIGURE: Rear Panel System LEDs Figure Legend 1 Locator LED and button 3 Power OK LED 2 Fault - Service Required LED8 SPARC T4-1 Server Installation Guide • October 2011 Related Information ¦ “Front Panel Components” on page 3 ¦ “Front Panel System LEDs and Buttons” on page 4 ¦ “Rear Panel Components” on page 6 Confirming Specifications This section contains physical and environmental specifications for the server. ¦ “Physical Specifications” on page 9 ¦ “Minimum Clearance for Service Access” on page 9 ¦ “Electrical and Power Specifications” on page 10 ¦ “Environmental Specifications” on page 11 ¦ “Acoustic Noise Emissions” on page 12 TABLE: Rear Panel System LED Descriptions LED or Button Icon or Label Description Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rabidly. There are two methods for turning a Locator LED on: • Issuing the ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button. Service Required LED (amber) Steady on light indicates that a fault has been detected in the system and that service is required. Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The SP might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Blink – System is running in standby mode and can be quickly returned to full operation. • Slow blink – A transitional activity is taking place. • Fast blink – SP is booting.Confirming Server and Site Specifications 9 ¦ “Airflow Considerations” on page 13 Physical Specifications Related Information ¦ “Server Overview” on page 1 ¦ “Minimum Clearance for Service Access” on page 9 Minimum Clearance for Service Access Related Information ¦ “Server Overview” on page 1 ¦ “Physical Specifications” on page 9 Electrical and Power Specifications Use the specifications in only as a general planning guide. To determine power values based on expected worksloads, use the SPARC T4-1 power calculator located at this online site: TABLE: System Specifications Measure U.S. Metric Width 17.6 in. 447.0 mm Depth 26.5 in. 673.1 mm Height (2 rack units) 3.49 in. 88.65 mm Weight, approximate (with 2 power supplies and 8 HDDs, but without PCI cards and rackmount hardware) 60 lb 27.2 kg TABLE: Minimum Clearances Needed Description Clearance Clearance, front of server 36 in. (91 cm) Clearance, rear of server 36 in. (91 cm)10 SPARC T4-1 Server Installation Guide • October 2011 http://www.oracle.com/goto/powercalculators/ General Specifications Operating input voltage ranges (input voltage tolerance +/- 10%) 100 to 120 VAC, 50/60 Hz 200 to 240 VAC, 50-60 Hz Maximum operating input current at 100 VAC* 8.57 A Maximum operating input current at 200 VAC* 4.2 A Maximum operating input power at 100 VAC* 771 W Maximum operating input power at 200 VAC* 762 W Maximum heat dissipation at 100 VAC 2142.3 BTU/hr 2455.2 KJ/hr Maximum heat dissipation at 200 VAC 2317 BTU/hr 2444 KJ/hr Maximum standby power at 100 VAC 22 W Maximum standby power at 200 VAC 20 W Maximum Server Configuration Specification Under Nominal Temperature and Voltage Conditions: One T4 processor, sixteen 16-GByte DDR3 DIMMs, eight HDDs, and six I/O cards. Idle AC input power at 100 VAC 468 W Idle AC input power at 200 VAC 460 W Peak AC input power running SpecJBB at 100 VAC 682 W Peak AC input power running SpecJBB at 200 VAC 679 W Minimum Server Configuration Specification Under Nominal Temperature and Voltage Conditions: One T4 processor, four 4-GByte DDR3 DIMMs, no HDDs, and no I/O cards. Idle AC input power at 100 VAC 290 WConfirming Server and Site Specifications 11 Related Information ¦ “Airflow Considerations” on page 13 Environmental Specifications Install and operate the server in a site with an ambient temperature range of 21°C (69.8°F) to 23°C (73.4°F), which is an optimal range for server reliability. At 22°C (71.6°F) it is easy to maintain safe relative humidity levels. Operating in this temperature range provides a buffer if the environmental support systems fail. Operating the server in a site with ambient relative humidity levels between 45% and 50% prevents corrosion, provides an operating time buffer in the event of environmental control system failure, and helps avoid failures caused by static discharges that occur when relative humidity is too low. Note – Electrostatic discharge is easily generated and less easily dissipated in areas where the relative humidity is below 35%, and becomes critical when levels drop below 30%. The server has been tested to meet all functional requirements when operating in the operating environmental limits listed in the table below (all values are for a single, non-rackmounted server). Idle AC input power at 200 VAC 282 W Peak AC input power running SpecJBB at 100 VAC 381 W Peak AC input power running SpecJBB at 200 VAC 390 W Parameter Value Operating temperature 5 ° C to 35 ° C (41 ° F to 95 ° F) Non-operating temperature -40 ° C to 65 ° C (-40 ° F to 149 ° F) Operating humidity 10% to 90% relative humidity, 27 ° C (80.6 ° F) maximum web bulb, noncondensing Non-operating humidity Up to 93% relative humidity, 38 ° C (100.4 ° F) maximum web bulb, noncondensing Operating altitude Up to 3000 m (10,000 ft), maximum ambient temperature is derated by 2 degrees C for every 1 km (3.6 degree F per 3,280 ft)12 SPARC T4-1 Server Installation Guide • October 2011 Related Information ¦ “Acoustic Noise Emissions” on page 12 ¦ “Airflow Considerations” on page 13 Acoustic Noise Emissions Declared noise emissions for the SPARC T4-1 server are in accordance with ISO 9296 standards. Related Information ¦ SPARC T4-1 Server Safety and Compliance Guide ¦ “Environmental Specifications” on page 11 Non-operating altitude Up to 12,000 m (40,000 ft) Operating vibration 0.15 G (vertical), 0.10 G (horizontal), 5 – 500 Hz, swept-sine Non-operating vibration 0.5 G (vertical), 0.25 G (horizontal), 5 – 500 Hz, swept-sine Operating shock 3.0 G, 11 ms, half-sine Non-operating shock • Roll-off: 1-inch roll-off free fall, front to back rolling directions • Threshold: 25 mm threshold height at 0.75 m/s impact velocity TABLE: Acoustic Noise Emissions for the SPARC T4-1 Server Description Mode Specification LwAd Operating acoustic noise 7.1 B* * 1 B = 10 dB LwAm Operating acoustic noise (bystander positions) 63 dB Parameter ValueConfirming Server and Site Specifications 13 Airflow Considerations The servers have been tested to meet all functional requirements when operating in the operating environmental limits presented in “Environmental Specifications” on page 11. In addition to having proper environmental conditions, keeping the server’s internal temperatures within a safe operating range depends on having sufficient airflow into and out of the chassis. ¦ Ensure unobstructed airflow through the chassis. ¦ Ensure that inlet air enters at the front of the server and exits from the back. Ensure that the inlet air is within . ¦ Ensure that the server ventilation openings used for intake and outflow of air provide an open area that is at least 60% of the open area perforations across the front and rear of the server. This 60% minimum open area equates to the following measurements: ¦ Allow a minimum of 5 mm (0.2 in) clearance from the ventilation opening at the front of the server and 80 mm (3.1 in) at the rear of the server when mounted. These clearance values are based on the preceding inlet and exhaust impedance (available open area) and assume a uniform distribution of the open area across the inlet and exhaust areas. Clearance values greater than these are recommended for improved cooling performance. Note – The combination of inlet and exhaust restrictions such as cabinet doors and the spacing of the server from the doors can affect the cooling performance of the server and should be evaluated by the user. ¦ Take care to prevent recirculation of exhaust air within a rack or cabinet. ¦ Manage cables to minimize interfering with the server exhaust vent. Related Information ¦ “Minimum Clearance for Service Access” on page 9 ¦ “Environmental Specifications” on page 11 ¦ “Acoustic Noise Emissions” on page 12 Metric Units US Units 224.4 cm2 (425 mm x 88 mm) 34.8 in 2 (16.7 in x 3.5 in)14 SPARC T4-1 Server Installation Guide • October 201115 Preparing for Installation This chapter identifies steps you must take to prepare for the installation. It contains these topics: ¦ “Server Overview” on page 1 ¦ “Front Panel Components” on page 3 ¦ “Front Panel System LEDs and Buttons” on page 4 ¦ “Rear Panel Components” on page 6 ¦ “Rear Panel System LED and Button” on page 7 ¦ “Confirming Specifications” on page 8 ¦ “Handling Precautions” on page 17 ¦ “ESD Precautions” on page 17 ¦ “Tools Needed for Installation” on page 18 Shipping Kit Inventory List Note – When you receive your server, place it in the environment where you will install it. Leave it in its shipping crate at its final destination for 24 hours. This resting period prevents thermal shock and condensation. Verify that you have received all of the components that ship with your server.16 SPARC T4-1 Server Installation Guide • October 2011 ¦ SPARC T4-1 server ¦ 2 AC power cords ¦ RJ-45 to DB-9 crossover adapter for the SER MGT port ¦ Antistatic wrist strap ¦ Rackmount kit ¦ Cable management arm (if ordered) ¦ SPARC T4-1 Server Getting Started Guide with license and safety documents ¦ Optional components (for example, PCIe cards) that are packaged separately from the other items Related Information ¦ “Server Overview” on page 1 ¦ “Preparing for Installation” on page 15Preparing for Installation 17 Handling Precautions Caution – Deploy the antitilt bar on the equipment rack before beginning an installation. Caution – The server weighs approximately 60 lb (25. kg). Two people are required to lift and mount the server into a rack. Caution – When completing a two-person procedure, always communicate your intentions clearly before, during, and after each step to minimize confusion. Related Information ¦ “ESD Precautions” on page 17 ESD Precautions Electronic equipment is susceptible to damage by static electricity. Use a grounded antistatic wrist strap, foot strap, or equivalent safety equipment to prevent electrostatic damage (ESD) when you install or service the servers.18 SPARC T4-1 Server Installation Guide • October 2011 Caution – To protect electronic components from electrostatic damage, which can permanently disable the server or require repair by service technicians, place components on an antistatic surface, such as an antistatic discharge mat, an antistatic bag, or a disposable antistatic mat. Wear an antistatic grounding strap connected to a metal surface on the chassis when you work on server components. Related Information ¦ “Handling Precautions” on page 17 Tools Needed for Installation To install the server, you must have the following tools: ¦ No. 2 Phillips screwdriver ¦ ESD mat and grounding strap You must also provide a system console device, such as one of the following: ¦ ASCII terminal ¦ Workstation ¦ Terminal server ¦ Patch panel connected to a terminal server Related Information ¦ “ESD Precautions” on page 17 ¦ “Handling Precautions” on page 1719 Installing the Server These topics describe how to install the server into a rack using the rail assembly in the rackmount kit. Perform these procedures if you purchased the rail assembly. Note – In this guide, the term rack means either an open rack or a closed cabinet. Rack Compatibility Verify that your rack is compatible with the slide rail and cable management arm options. The slide rails are compatible with a wide range of equipment racks that meet the following standards. Step Description Links 1. Verify that the rack is compatible with the server’s installation requirements. “Rack Compatibility” on page 19 2. Take antitilt precautions to ensure the rack does not tip forward when the server is installed. “Stabilize the Rack” on page 21 3. Attach the slide rails. “Install the Slide Rail Assemblies” on page 25 4. Install the server in the rack. “Install the Server” on page 29 5. (Optional) Install the CMA. “Install the CMA” on page 31 6. Verify that the slide rails and CMA (if used) operate correctly. “Verify Correct Operation of the Slide Rails and the CMA” on page 36 Item Requirement Structure Four-post rack (mounting at both front and rear). Two-post racks are not compatible.20 SPARC T4-1 Server Installation Guide • October 2011 Caution – Equipment Loading: Always load equipment into a rack from the bottom up so that the rack will not become top-heavy and tip over. Deploy your rack’s anti-tip bar to prevent the rack from tipping during equipment installation. Caution – Elevated Operating Ambient Temperature: If the server is installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment might be greater than room ambient temperature. Therefore, install the equipment only in an environment compatible with the maximum ambient temperature (Tma) specified for the server. Caution – Reduced Air Flow: Install the equipment in a rack so that the amount of air flow is adequate for the safe operation of the equipment. Caution – Mechanical Loading: Mount the equipment in the rack so that the weight is distributed evenly. A hazardous condition can exist with uneven mechanical loading. Rack horizontal opening and unit vertical pitch Conforms to ANSI/EIA 310-D-1992 or IEC 60927 standards. Rack rail mounting hole sizes Only 9.5 mm square hole and M6 round mounting holes are supported. All other sizes, including 7.2 mm, M5, or 10-32 mounting holes, are not supported. Distance between front and rear mounting planes Minimum 622 mm and maximum 895 mm (24.5 inches to 35.25 inches). Clearance depth in front of front mounting plane Distance to front cabinet door is at least 27 mm (1.06 inch). Clearance depth behind front mounting plane Distance to rear cabinet door is at least 900 mm (35.5 inches) with the cable management arm, or 770 mm (30.4 inches) without the cable management arm. Clearance width between front and rear mounting planes Distance between structural supports and cable troughs is at least 456 mm (18 inches). Server dimensions Depth (not including PSU handle): 732 mm (28.82 inches) Width (not including ears): 436.5 mm (17.19 inches) Height: 129.85 mm (5.11 inches) Item RequirementInstalling the Server 21 Caution – Circuit Overloading: Do not overload the power supply circuits. Before connecting the server to the supply circuit, review the equipment nameplate power ratings and consider the effect that circuit overloading might have on overcurrent protection and supply wiring. Caution – Reliable Earthing: Maintain reliable earthing of rackmounted equipment. Give particular attention to supply connections other than direct connections to the branch circuit (for example, use of power strips). Caution – Do not use slide rail mounted equipment as a shelf or a work space. ? Stabilize the Rack Caution – To reduce the risk of personal injury, stabilize the expansion rack cabinet and extend all anti-tilt devices before installing the server. Refer to your rack documentation for detailed instructions for the following steps. 1. Open and remove the front and rear doors from the rack cabinet. 2. To prevent the rack cabinet from tipping during the installation, stabilize the cabinet using all anti-tilt mechanisms provided. 3. If there are leveling feet beneath the rack cabinet to prevent it from rolling, extend these leveling feet fully downward to the floor. 4. Fully extend the rack cabinet’s anti-tilt legs or anti-tilt bar, which are located at the bottom front of the rack cabinet. Related Information ¦ The rack documentation ¦ SPARC T4-1 Server Safety and Compliance Guide ¦ “Rack Compatibility” on page 1922 SPARC T4-1 Server Installation Guide • October 2011 Installing Slide Rails ¦ “Slide Rail Assemblies” on page 22 ¦ “Install the Slide Rail Assemblies” on page 25 Slide Rail Assemblies Each slide rail assembly consists of a three-section slide rail and a removable mounting bracket. The slide rail attaches to the rack posts. The mounting bracket attaches to the server chassis. FIGURE: Sections of the Snap-In Slide Rail Assembly ¦ The slide rails adjust to fit rack depths from 24 in. (61 cm) to 36.5 in. (93 cm). The middle and rear sections of the slide rails have holes for mounting the rail to the rack posts. Figure Legend 1 Mounting bracket 2 Front section 3 Middle section 4 Rear sectionInstalling the Server 23 ¦ The front section extends out of the middle section, which allows the server to be positioned far enough out of the rack for many service operations to be performed. ¦ The removable mounting bracket slides 14.5 in. (37 cm) out of the slide rail, then locks in place. If you unlock the mounting bracket at this point, it slides an additional 14.5 in. (37 cm) before separating from the slide rail. There are six locks in a slide rail assembly. Four are on the mounting bracket. Two locks are on the slide rail.24 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Locating the Locks on the Slide Rail Assembly Related Information ¦ “Rack Compatibility” on page 19 ¦ “Install the Slide Rail Assemblies” on page 25Installing the Server 25 ? Install the Slide Rail Assemblies 1. Pull both mounting brackets completely out of their respective slide rails. a. Simultaneously press and hold the upper and lower lock buttons of the slide rail lock. FIGURE: Unlocking the Express Rail Slide Rail Assembly b. Pull the mounting bracket out until it stops. c. Slide the mounting bracket release button to the left, then slide the mounting bracket completely out of the slide rail.26 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Express Rail Mounting Bracket Release Button 2. Attach a mounting bracket to the right side of the server chassis. a. Position the mounting bracket against the chassis. Ensure that the slide rail lock is at the front and the keyed openings on the mounting bracket are aligned with the locating pins on the side of the chassis.Installing the Server 27 FIGURE: Attaching an Express Rail Mounting Bracket to the Chassis b. Ensure that the heads of the four locating pins protrude through the keyed openings in the mounting bracket. Slide the mounting bracket toward the front of the chassis until the bracket locks into place with an audible click. c. Verify that all four locating pins are trapped in the keyed openings and that the third locating pin from the front has engaged the mounting bracket lock. 3. Attach the second mounting bracket to the left side of the server chassis. 4. Orient the slide rails, ensuring that the ball bearing tracks (labeled FRONT) are forward.28 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Express Rail Slide Rails Orientation for Installation 5. Extend the slide rails (outer section) to fit the rack and attach the slide rails to the rack. You hear an audible click when the rails securely attach to the rack.Installing the Server 29 FIGURE: Attaching Express Slide Rails to the Rack Caution – Deploy the antitilt feature on the rack before continuing the installation. Related Information ¦ “Rack Compatibility” on page 19 ¦ “Slide Rail Assemblies” on page 22 ? Install the Server Caution – The weight of the servers on extended slide rails can be enough to overturn an equipment rack.30 SPARC T4-1 Server Installation Guide • October 2011 Caution – The server weighs approximately 60 lb (25 kg). Two people are required to lift and mount the server into a rack enclosure. 1. If the rack is equipped with an antitilt bar, verify that it has been deployed and, if not, deploy it. 2. Insert the ends of the mounting brackets into the sliding rails. FIGURE: Mounting the Chassis on the Slide Rails 3. While pressing the two green slide rail release buttons, push the server into the rack until the slide rail locks on the front of the mounting brackets engage the slide rail assemblies. You will hear a click at that point. Caution – Before continuing, verify that the server is securely mounted in the rack, and that the slide rails are locked to the mounting brackets.Installing the Server 31 Related Information ¦ “Rack Compatibility” on page 19 ¦ “Slide Rail Assemblies” on page 22 ¦ “Install the Slide Rail Assemblies” on page 25 ¦ “Install the CMA” on page 31 ¦ “Verify Correct Operation of the Slide Rails and the CMA” on page 36 (Optional) Installing the CMA ¦ “Install the CMA” on page 31 ¦ “Verify Correct Operation of the Slide Rails and the CMA” on page 36 ? Install the CMA Caution – Support the CMA during this installation. Do not allow the assembly to hang by its own weight until it is secured by all three attachment points. 1. Remove the tape from the CMA rail extension (on the left of the CMA) and remove the CMA rail extension. 2. Attach the CMA rail extension to rear left slide rail. At the rear of the rack, plug the CMA rail extension into the end of the left sliding rail assembly. The tab at the front of the rail extension clicks into place.32 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Inserting the CMA Rail Extension Into the Rear of the Left Slide Rail The right sides of the two CMA arms have hinged extensions. On the manufacturer’s instruction sheet, the smaller extension is called the CMA Connector for Inner Member. This extension attaches to the right mounting bracket. The larger extension is called the CMA Connector for Outer Member, and attaches to the right sliding rail. 3. Insert the smaller extension into the clip located at the end of the mounting bracket. Slide the smaller extension into the square hole on the middle-in-width of the clip that is located at the end of the mounting bracket.Installing the Server 33 FIGURE: Mounting the Inner CMA Connector 4. Insert the larger extension into the end of the right sliding rail.34 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Attaching the Outer CMA Connector 5. Insert the hinged plastic connector at the left side of the CMA fully into the CMA rail extension. The plastic tab on the CMA rail extension locks the hinged plastic connector in place.Installing the Server 35 FIGURE: Mounting the Left Side of the Slide Rail Related Information ¦ “Rack Compatibility” on page 19 ¦ “Slide Rail Assemblies” on page 22 ¦ “Install the Slide Rail Assemblies” on page 25 ¦ “Install the Server” on page 29 ¦ “Verify Correct Operation of the Slide Rails and the CMA” on page 3636 SPARC T4-1 Server Installation Guide • October 2011 ? Verify Correct Operation of the Slide Rails and the CMA Perform this procedure both before and after you install the server cables in the CMA. Performing the procedure before the CMA contains cables helps ensure that it extends and contracts smoothly before the cables are added. Note – The CMA includes velcro straps to secure the cables inside the CMA. Do not install the velcro straps until you have installed the CMA, connected the cables, and placed the cabling inside the CMA. Tip – Two people are needed for this procedure, one to move the server in and out of the rack, and one to observe the cables and CMA. 1. For a free-standing rack, deploy the antitilt bar. 2. Unlock the slide lock buttons at the right and left sides of the chassis.Installing the Server 37 FIGURE: Unlocking the Slide Rail Assembly 3. If the server cables have been placed inside the CMA, inspect them for binding or kinks. 4. Slowly pull the server out of the rack until the slide rails reach their stops. 5. Verify that the CMA extends fully and does not bind in the slide rails. 6. Verify that the server extends fully and locks in the maintenance position. The server should stop after approximately 15 in. (40 cm) of travel. 7. Pull both slide rail release buttons toward you simultaneously and slide the server back into the rack. The server should slide smoothly into the rack without binding.38 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: Rail Mounting Bracket Release Button 8. Verify that the CMA retracted without binding. 9. Adjust the cable straps and CMA as required to secure the cables. Related Information ¦ “Rack Compatibility” on page 19 ¦ “Slide Rail Assemblies” on page 22 ¦ “Install the Slide Rail Assemblies” on page 25 ¦ “Install the Server” on page 29 ¦ “Install the CMA” on page 3139 Connecting Cables These topics explain how to connect the data and power cables to the server: Cabling Requirements Review these cabling notes before attaching cables to the server. ¦ Minimum cable connections for the server: ¦ At least one server on-board Ethernet network connection (NET port) ¦ The SER MGT port ¦ The NET MGT port ¦ A power cable for each power supply ¦ SP management ports: There are two management ports for use with the SP. ¦ The SER MGT port uses an RJ-45 cable and is always available. This port is the default connection to the SP. ¦ The NET MGT port is the optional connection to the SP. This port becomes available after you configure network settings for the SP (through the SER MGT port). The NET MGT port uses an RJ-45 cable for a 10/100 BASE-T connection. This port does not support connections to Gigabit networks. Step Description Links 1. Review the cabling requirements. “Cabling Requirements” on page 39 2. Review I/O port connector details. “Identifying Ports” on page 41 3. Connect the management and data cables. “Connecting Data and Management Ports” on page 45 4. Secure cables in the CMA. “Secure Cables in the CMA” on page 4940 SPARC T4-1 Server Installation Guide • October 2011 ¦ Ethernet ports are labeled NET0, NET1, NET2, and NET3. The Ethernet interfaces operate at 10 Mbps, 100 Mbps, and 1000 Mbps. ¦ VGA DB-15 video port: Use the video port to attach a color monitor to the server. ¦ USB Ports: USB ports support hot-plugging. You can connect and disconnect USB cables and peripheral devices without affecting system operations. ¦ You can only perform USB hot-plug operations while the OS is running. USB hot-plug operations are not supported when the system ok prompt is displayed or before the system has completed booting. ¦ You can connect up to 126 devices to each of the four USB controllers, for a total of 504 USB devices per system. ¦ Power cables: Do not attach power cables to the power supplies until you have finished connecting the data cables, and have connected the server to a serial terminal or a terminal emulator (PC or workstation). Note – The server goes into Standby mode and the SP initializes as soon as a power cable connects a power supply to an external power source. System messages might be lost after 60 seconds if a terminal or terminal emulator is not connected to the SER MGT port before power is applied. Related Information ¦ “Connecting Cables” on page 39 ¦ “Identifying Ports” on page 41 Identifying Ports These topics provide reference information about the front and rear panel ports and pin assignments. ¦ “USB Ports” on page 41 TABLE: Ethernet Connection Transfer Rates Connection Type IEEE Terminology Transfer Rate Ethernet 10BASE-T 10 Mbit/sec Fast Ethernet 100BASE-TX 100 Mbits/sec Gigabit Ethernet 1000BASE-T 1000 Mbit/secConnecting Cables 41 ¦ “SER MGT Port” on page 41 ¦ “NET MGT Port” on page 42 ¦ “Gigabit Ethernet Ports” on page 43 ¦ “Video Port” on page 44 USB Ports Two USB ports can be accessed on the server’s front panel and two on the rear panel. FIGURE: USB Connector Related Information ¦ “Front Panel Components” on page 3 ¦ “Rear Panel Components” on page 6 SER MGT Port The SER MGT RJ-45 port, located on the rear panel, provides the default connection to the system console. Figure Legend 1 +5V supply 3 Data + 2 Data - 4 Ground42 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: SER MGT Port Related Information ¦ “Front Panel Components” on page 3 ¦ “Rear Panel Components” on page 6 ¦ “Connect the SER MGT Port Cable” on page 45 ¦ “Connect a Terminal or Emulator to the SER MGT Port” on page 52 NET MGT Port The NET MGT RJ-45 port, located on the rear panel, provides an optional Ethernet connection to the service processor. FIGURE: NET MGT Port Figure Legend 1 Clear to Send 5 Ground 2 Data Carrier Detect 6 Receive Data 3 Transmit Data 7 Data Terminal Ready 4 Ground 8 Ready to Send Figure Legend 1 Transmit Data + 5 No ConnectConnecting Cables 43 Related Information ¦ “Front Panel Components” on page 3 ¦ “Rear Panel Components” on page 6 ¦ “Connect the NET MGT Port Cable” on page 46 ¦ “Assign a Static IP Address to the SP” on page 55 Gigabit Ethernet Ports Four RJ-45 Gigabit-Ethernet connectors (NET0, NET1, NET2, NET3) are located on the rear panel. The Ethernet interfaces operate at 10 Mbit/sec, 100 Mbit/sec, and 1000 Mbit/sec. FIGURE: Gigabit Ethernet Port Related Information ¦ “Front Panel Components” on page 3 ¦ “Rear Panel Components” on page 6 ¦ “Connect the NET MGT Port Cable” on page 46 2 Transmit Data – 6 Receive Data – 3 Receive Data + 7 No Connect 4 No Connect 8 No Connect Figure Legend 1 Transmit/Receive Data 0 + 5 Transmit/Receive Data 2 – 2 Transmit/Receive Data 0 – 6 Transmit/Receive Data 1 – 3 Transmit/Receive Data 1 + 7 Transmit/Receive Data 3 + 4 Transmit/Receive Data 2 + 8 Transmit/Receive Data 3 – Figure Legend (Continued)44 SPARC T4-1 Server Installation Guide • October 2011 Video Port The server has one 15-pin VGA video port located on the server’s rear panel. FIGURE: Video Connector Related Information ¦ “Rear Panel Components” on page 6 Connecting Data and Management Ports ¦ “Connect the SER MGT Port Cable” on page 45 ¦ “Connect the NET MGT Port Cable” on page 46 ¦ “Connect the Ethernet Network Cables” on page 47 ¦ “Connect Other Data Cables” on page 48 Figure Legend 1 Red Video 9 +5V 2 Green Video 10 Sync Ground 3 Blue Video 11 Monitor ID - Bit 0 (Ground) 4 Monitor ID - Bit 2 (Ground) 12 VGA 12C Serial Data 5 Ground 13 Horizontal Sync 6 Red Ground 14 Vertical Sync 7 Green Ground 15 VGA 12C Serial Clock 8 Blue GroundConnecting Cables 45 ? Connect the SER MGT Port Cable The SER MGT port is the farthest left RJ-45 port on the rear panel. ? Connect a Category 5 cable from the SER MGT port to the terminal device. FIGURE: SER MGT port – Rear Panel This port is needed to set up the NET MGT port. When connecting a DB-9 cable, use an RJ-45 to DB-9 adapter to perform the crossovers given for each connector. Note – Use the SER MGT port only for server management. This port is the default connection between the SP and a terminal or a computer. Caution – Do not attach a modem to this port. Related Information ¦ “Connect the NET MGT Port Cable” on page 46 ¦ “Connecting Cables” on page 39 ? Connect the NET MGT Port Cable The NET MGT port is located just to the right of the SER MGT port on the rear panel.46 SPARC T4-1 Server Installation Guide • October 2011 ? Connect a Category 5 cable from the NET MGT port to your network switch or hub. FIGURE: NET MGT port – Rear Panel Note – This port is not operational until you configure the network settings (through the SER MGT port). Note – The NET MGT port is configured by default to retrieve network settings with Dynamic Host Configuration Protocol (DHCP) and allow connections using SSH. You might need to modify these settings for your network. Instructions are given in “Powering On the Server for the First Time” on page 51. Related Information ¦ “Connect the SER MGT Port Cable” on page 45 ¦ “Connecting Cables” on page 39 ? Connect the Ethernet Network Cables The server has four RJ-45 Gigabit Ethernet network connectors. They are marked NET0, NET1, NET2, and NET3.Connecting Cables 47 1. Connect a Category 5 cable from your network switch or hub to Ethernet Port 0 (NET0) on the rear of the chassis. NET0 is the farthest left port in the 4-port network cluster. FIGURE: Ethernet Network Ports – Rear Panel 2. Connect Category 5 cables from your network switch or hub to the remaining Ethernet ports (NET1, NET2, NET3), as needed. Related Information ¦ “Connecting Cables” on page 39 ? Connect Other Data Cables ? If your server configuration includes PCIe expansion modules, connect the appropriate I/O cables to their connectors.48 SPARC T4-1 Server Installation Guide • October 2011 FIGURE: PCIe and PCIe/XAUI Slot Configuration Related Information ¦ “Connecting Cables” on page 39 ? Secure Cables in the CMA 1. Once the server cables are connected and placed inside the CMA, open the velcro cable straps and wrap the straps around the CMA securing the cables inside the CMA. Figure Legend 1 PCIe or XAUI slot 0 4 PCIe slot 3 2 PCIe or XAUI slot 1 5 PCIe slot 4 3 PCIe slot 2 6 PCIe slot 5Connecting Cables 49 FIGURE: Securing the Server Cables With the CMA and Velcro Straps 2. Verify the operation of the slide rails and CMA, and cable service loops. Repeat the steps described in the procedure: “Verify Correct Operation of the Slide Rails and the CMA” on page 36. Related Information ¦ “Install the CMA” on page 31 ¦ “Verify Correct Operation of the Slide Rails and the CMA” on page 3650 SPARC T4-1 Server Installation Guide • October 201151 Powering On the Server for the First Time These topics provide instructions for booting Oracle’s SPARC T4-1 server for the first time and for enabling the NET MGT port. It consists of the following topics: Oracle ILOM System Console When you power on the system, the boot process begins under the control of the Oracle ILOM system console. The system console displays status and error messages generated by firmware-based tests that are run during system startup. Note – To see these status and error messages, connect a terminal or terminal emulator to the SER MGT port before power is applied to the server. Step Description Links 1. Review the behavior of Oracle ILOM console output when the system is powered on the first time. “Oracle ILOM System Console” on page 51 2. Connect the server to a terminal display. “Connect a Terminal or Emulator to the SER MGT Port” on page 52 3. Power on the server. “Power On the Server for the First Time” on page 53 4. Check that the server is operational. “Verify Functionality” on page 55 5. (Optional) Assign a static IP address to the SP. “Assigning a Static IP Address to the SP” on page 55 6. Review the Oracle Solaris OS configuration parameter descriptions. “Oracle Solaris OS Configuration Parameters” on page 5752 SPARC T4-1 Server Installation Guide • October 2011 After the system console finishes its low-level system diagnostics, the SP initializes and runs a suite of higher level diagnostics. When you access the SP using a device connected to the SER MGT port, you see the output of the Oracle ILOM diagnostics. By default, the SP configures the NET MGT port automatically, retrieving network configuration settings using the Dynamic Host Configuration Protocol (DHCP) and allowing connections using SSH. For a more detailed discussion on configuring the system console and connecting terminals, refer to the system administration documentation for your server. Related Information ¦ “Connect a Terminal or Emulator to the SER MGT Port” on page 52 ¦ “Power On the Server for the First Time” on page 53 ? Connect a Terminal or Emulator to the SER MGT Port A null modem configuration is needed for DTE to DTE communications. You can use the supplied RJ-45 crossover adapter with a standard RJ-45 cable to achieve the null modem configuration. 1. Connect a terminal or a terminal emulator (PC or workstation) to the SER MGT port. 2. Configure the terminal or terminal emulator with these settings: ¦ 9600 baud ¦ 8 bits ¦ No parity ¦ 1 Stop bit ¦ No handshake 3. (Optional) Connect an Ethernet cable between the server’s NET MGT port and the network to which future connections to the SP and host will be made. Related Information ¦ “Oracle ILOM System Console” on page 51 ¦ “Power On the Server for the First Time” on page 53Powering On the Server for the First Time 53 ? Power On the Server for the First Time 1. Confirm that you have completed all of the preparations for installation. See the instructions in “Confirming Server and Site Specifications” on page 1. 2. Confirm that you have completed the installation of the server in its rack. See the instructions in “Installing the Server” on page 19. 3. (Recommended) Connect an Ethernet cable between one of the server’s NET ports and the network to which the server will communicate. Note – After the initial configuration of the system, communication with the SP and host is usually performed through an Ethernet interface. 4. Plug the power cords into the power supplies and into separate power sources. To provide redundancy, plug both power supplies into separate power sources. The system can operate with only one power connection, but there is no redundancy in this case. The SP runs on the 3.3V standby voltage. As soon as AC power is connected to the server, the SP powers on, runs diagnostics, and initializes the ILOM firmware. After a few minutes, the SP login prompt appears on the terminal device. The host is not initialized or powered on yet. 5. At the terminal device, log in to the SP as root with a password of changeme. 6. Change the root password. hsotname login: root Password: changeme . . . -> ... Warning: password is set to factory default. -> set /SP/users/root password Enter new password: ******** Enter new password again: ******** ->54 SPARC T4-1 Server Installation Guide • October 2011 7. Power on the server and redirect the host output to display on the serial terminal device: After you start the HOST console, the server initialization takes approximately 20 minutes to complete. 8. Configure the OS by entering parameter values as prompted by a series of onscreen instructions. Tip – If you are not sure how to respond to a particular value, you can accept the default and make changes at another time when the OS is running. Note – You will be prompted to confirm the configuration multiple times. You will be able to change parameter values if desired at each of these confirmation points. 9. (Optional) Deploy the server for its intended use. Once the server has been configured and you have changed the default password, the server is ready for normal use. Related Information ¦ “Connect a Terminal or Emulator to the SER MGT Port” on page 52 ¦ “Connecting Cables” on page 39 ¦ “Assign a Static IP Address to the SP” on page 55 -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. To stop, type #. . . .Powering On the Server for the First Time 55 ? Verify Functionality ? After powering on the system for the first time, use the Sun Validation Test Suite (Sun VTS) software to verify the functionality and performance of the system, including network connections. Refer to the Sun VTS documentation for instructions on running these test utilities, available at: http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 Assigning a Static IP Address to the SP ¦ “Assign a Static IP Address to the SP” on page 55 ¦ “Oracle Solaris OS Configuration Parameters” on page 57 ? Assign a Static IP Address to the SP If the network your server is connected to does not support DHCP for IP addressing, perform the following procedure to update the OS configuration to static IP addressing and to assign a static IP address to the SP. 1. Set the SP to accept a Static IP Address. 2. Set the IP address for the SP. 3. Set the IP address for the SP gateway. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr'56 SPARC T4-1 Server Installation Guide • October 2011 4. Set the netmask for the SP. This example uses 255.255.255.0 to set the netmask. Your network environment subnet might require a different netmask. Use a netmask number most appropriate to your environment. 5. Use the show /SP/network command to verify that the parameters were set correctly. 6. Commit the changes to the SP network parameters. Note – You can run the show /SP/network command again (after performing the set /SP/network commitpending=true command) to verify that the parameters have been updated. Related Information ¦ “Power On the Server for the First Time” on page 53 -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0' -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'Powering On the Server for the First Time 57 Oracle Solaris OS Configuration Parameters When configuring the Oracle Solaris OS, you will be prompted for the following configuration parameters. For more information about these settings, refer to the Oracle Solaris documentation. Parameter Description Language Select a number from the displayed languages list. Locale Select a number from the displayed locale list. Terminal Type Select a terminal type that corresponds with your terminal device. Network? Select Yes. Multiple Network Interfaces Select the network interfaces that you plan to configure. If you are not sure, select the first one in the list. DHCP? Select Yes or No according to your network environment. Host Name Type the host name for the server. IP Address Type the IP address for this Ethernet interface. Subnet? Select Yes or No according to your network environment. Subnet Netmask If your answer to Subnet? was Yes, type the netmask for the subnet for your network environment. IPv6? Specify whether or not to use IPv6. If you are not sure, select No to configure the Ethernet interface for IPv4. Security Policy Select either standard UNIX security (no) or Kerberos Security (Yes). If you are not sure, select No. Confirm When prompted with this, review the onscreen information and change it if needed. Otherwise, continue. Name Service Select the name service according to your network environment. Note – If you select a name service other than None, you will be prompted for additional name service configuration information. NFSv4 Domain Name Select the type of domain name configuration according to your environment. If you are not sure, select Use the NFSv4 domain derived by the system. Time Zone (Continent) Select your continent. Time Zone (Country or Region) Select your country or region.58 SPARC T4-1 Server Installation Guide • October 2011 Related Information ¦ “Oracle ILOM System Console” on page 51 ¦ “Connect a Terminal or Emulator to the SER MGT Port” on page 52 ¦ “Power On the Server for the First Time” on page 53 Time Zone Select the time zone. Date and Time Accept the default date and time, or change the values. root Password Type the root password twice. This password is for the superuser account for the Oracle Solaris OS on this server. This password is not the SP password. Parameter Description59 Glossary A ANSI SIS American National Standards Institute Status Indicator Standard. ASR Automatic system recovery. B blade Generic term for server modules and storage modules. See server module and storage module. blade server Server module. See server module. BMC Baseboard management controller. BOB Memory buffer on board. C chassis For servers, refers to the server enclosure. For server modules, refers to the modular system enclosure. CMA Cable management arm. CMM Chassis monitoring module. The CMM is the service processor in the modular system. Oracle ILOM runs on the CMM, providing lights out management of the components in the modular system chassis. See Modular system and Oracle ILOM.60 SPARC T4-1 Server Installation Guide • October 2011 CMM Oracle ILOM Oracle ILOM that runs on the CMM. See Oracle ILOM. D DHCP Dynamic Host Configuration Protocol. disk module or disk blade Interchangeable terms for storage module. See storage module. DTE Data terminal equipment. E ESD Electrostatic discharge. F FEM Fabric expansion module. FEMs enable server modules to use the 10GbE connections provided by certain NEMs. See NEM. FRU Field-replaceable unit. H HBA Host bus adapter. host The part of the server or server module with the CPU and other hardware that runs the Oracle Solaris OS and other applications. The term host is used to distinguish the primary computer from the SP. See SP.Glossary 61 I ID PROM Chip that contains system information for the server or server module. IP Internet Protocol. K KVM Keyboard, video, mouse. Refers to using a switch to enable sharing of one keyboard, one display, and one mouse with more than one computer. M MAC or MAC address Media access controller address. Modular system The rackmountable chassis that holds server modules, storage modules, NEMs, and PCI EMs. The modular system provides Oracle ILOM through its CMM. MSGID Message identifier. N name space Top-level Oracle ILOM CMM target. NEM Network express module. NEMs provide 10/100/1000 Ethernet, 10GbE Ethernet ports, and SAS connectivity to storage modules. NET MGT Network management port. An Ethernet port on the server SP, the server module SP, and the CMM. NIC Network interface card or controller. NMI Nonmaskable interrupt.62 SPARC T4-1 Server Installation Guide • October 2011 O OBP OpenBoot PROM. Oracle ILOM Oracle Integrated Lights Out Manager. Oracle ILOM firmware is preinstalled on a variety of Oracle systems. Oracle ILOM enables you to remotely manage your Oracle servers regardless of the state of the host system. Oracle Solaris OS Oracle Solaris operating system. P PCI Peripheral component interconnect. PCI EM PCIe ExpressModule. Modular components that are based on the PCI Express industry-standard form factor and offer I/O features such as Gigabit Ethernet and Fibre Channel. POST Power-on self-test. PROM Programmable read-only memory. PSH Predictive self healing. Q QSFP Quad small form-factor pluggable. R REM RAID expansion module. Sometimes referred to as an HBA See HBA. Supports the creation of RAID volumes on drives.Glossary 63 S SAS Serial attached SCSI. SCC System configuration chip. SER MGT Serial management port. A serial port on the server SP, the server module SP, and the CMM. server module Modular component that provides the main compute resources (CPU and memory) in a modular system. Server modules might also have onboard storage and connectors that hold REMs and FEMs. SP Service processor. In the server or server module, the SP is a card with its own OS. The SP processes Oracle ILOM commands providing lights out management control of the host. See host. SSD Solid-state drive. SSH Secure shell. storage module Modular component that provides computing storage to the server modules. U UCP Universal connector port. UI User interface. UTC Coordinated Universal Time. UUID Universal unique identifier. W WWN World-wide number. A unique number that identifies a SAS target.64 SPARC T4-1 Server Installation Guide • October 201165 Index A acoustic noise emissions, 12 adapters for serial cables, 46 air?ow requirements, 13 ambient temperature range, 11 anti-tilt legs or bar, 21 B baud rate for serial terminal, 52 bits setting for serial terminal, 52 booting the system, 51 buttons, See "slide rail assembly locks" C cable management assembly, 38 cables adapters for serial data cables, 46 clearance, 9 con?guring Oracle Solaris OS, 57 CPU description, 2 D diagnostics, when run, 53 drives, 2 E environmental requirements, 11 Ethernet ports, 2 pinouts, 43 H handshaking for serial terminal, no, 52 hot-plugging USB ports, 40 humidity, ambient relative, 11 I installing mounting brackets, 25 server into rack, 19 L levers, locking, See "slide rail assembly locks" locating pins for mounting brackets, 25 locks, See "slide rail assembly locks" M memory description, 2 minimum cable connections, 39 modem not to be used with the SER MGT port, 46 mounting bracket locating pins on chassis, 25 preparation for installation, 25 removing from slide rail, 25 unlocking, 25 N network management (NET MGT) port pinouts, 42 O Oracle Solaris OS con?guration parameters, 57 P parity for serial terminal, no, 52 PCIe cards slots, 2 pinouts Ethernet ports, 43 NET MGT port, 42 USB ports, 4166 SPARC T4-1 Server Installation Guide • October 2011 video connector, 44 pins, mounting bracket locating, 25 power supplies, 2 R rack compatibility, 19 mounting holes, supported, 20 speci?cations, 19 stabilizing, 21 rackmount anti-tilt legs or bar, extending, 21 kit, 19 racks, supported, 19 safety warnings, 20 stabilizing the rack, 21 RJ-45 cable, 39 S server overview, 1 service processor powering on for the ?rst time, 53 shipping kit contents, 15 SP described, 2 speci?cations acoustic, 12 environmental requirements, 11 physical, 9 server, 8 standby voltage, 3.3v, 53 stop bit, 52 T temperature requirements, 12 U unlocking mounting bracket, 25 USB ports, 2 pinouts, 41 V VGA DB-15 video port connector, 40 video connector described, 2 pinouts, 44 SPARC T4 Series Servers Administration Guide Part No.: E22989-03 October 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation ix Understanding System Administration Resources 1 Oracle ILOM Overview 1 Platform-Specific Oracle ILOM Features 2 Oracle Solaris OS Overview 3 OpenBoot Overview 3 Oracle VM Server for SPARC Overview 4 Multipathing Software 4 Hardware Management Pack Overview 5 Source for Downloading Hardware Management Pack Software 7 Hardware Management Pack Documentation 7 Accessing the Server 9 ? Log In to Oracle ILOM 9 ? Log In to the System Console 10 ? Display the ok Prompt 11 ? Display the Oracle ILOM -> Prompt 12 ? Use a Local Graphics Monitor 13 Oracle ILOM Remote Console 14 Controlling the Server 15 ? Power On the Server (Oracle ILOM) 15iv SPARC T4 Series Servers Administration Guide • October 2011 ? Power Off the Server (Oracle ILOM) 16 ? Reset the Server (Oracle Solaris OS) 17 ? Reset the Server (Oracle ILOM) 17 ? Reset the SP to Default Values 18 Configuring Hardware RAID 19 Hardware RAID Support 19 ? Prepare to Use the FCode Utility 21 FCode Utility Commands 22 ? Create a Hardware RAID Volume 22 Hot Spare Drives in RAID Volumes (LSI) 24 Determining If a Drive Has Failed 24 Service Required Drive LEDs 24 Error Messages (System Console and Log Files) 25 ? Display Status (show-volumes Command, OBP) 26 ? Display Status (sas2ircu Utility, LSI) 26 RAID Drive Replacement Strategies 27 ? Locate Device Paths 27 Changing Server Identification Information 29 ? Change Customer Data on FRU PROMs 29 ? Change System Identifier Information 30 Configuring Policy Settings 31 ? Specify Cooldown Mode 31 ? Restore the Host Power State at Restart 32 ? Specify the Host Power State at Restart 32 ? Disable or Re-Enable the Host Power-On Delay 33 ? Specify Parallel Boot of the SP and Host 34 ? Configure Host Behavior (Keyswitch State) 34Contents v Configuring Network Addresses 37 SP Network Address Options 37 ? Disable or Re-Enable Network Access to the SP 38 ? Display the DHCP Server IP Address 38 ? Display the IP Address of the SP 39 ? Display the Host MAC Address 40 Using an In-band Connection to the SP 41 Oracle ILOM In-band (Sideband) Management 41 ? Configure SP In-band (Sideband) Access 42 Configuring Boot Mode 45 Boot Mode Overview 45 ? Configure the Host Boot Mode (Oracle VM Server for SPARC) 46 ? Change the Host Boot Mode Behavior at Reset 47 ? Manage the Host Boot Mode Script 48 ? Display Host Boot Mode Expiration Date 49 ? Override OBP Settings to Reset the Server 49 Configuring Server Behavior at Restart 51 ? Specify Behavior When the Host Resets 51 ? Specify Behavior When the Host Stops Running 52 ? Set the Boot Timeout Interval 52 ? Specify Behavior at Boot Timeout 53 ? Specify Behavior if Restart Fails 53 ? Specify Maximum Restart Attempts 54 Configuring Devices 55 ? Unconfigure a Device Manually 55 ? Reconfigure a Device Manually 55vi SPARC T4 Series Servers Administration Guide • October 2011 Monitoring the Server 57 Monitoring Faults 57 Diagnostics Overview 57 ? Discover Faults (Oracle ILOM) 59 ? Discover Faults (Oracle ILOM Fault Management Shell) 59 ? Discover Faults Using POST 61 ? Display Console History 61 ? Repair a Fault (Oracle ILOM Fault Management Shell) 63 ? Clear a Fault 64 Enabling Automatic System Recovery 65 Automatic System Recovery Overview 65 ? Enable ASR 66 ? Disable ASR 66 ? View Information on Components Affected by ASR 67 ? Display Server Components 67 ? Locate the Server 68 Updating the Firmware 71 ? Display the Firmware Version 71 ? Update the Firmware 71 ? Display OpenBoot Version 74 ? Display POST Version 74 Identifying WWN-Enabled SAS2 Devices 77 World Wide Name Syntax 77 Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command) 78 probe-scsi-all WWN Mapping Overview 79 probe-scsi-all WWN Mapping Example (SPARC T4-1) 80 probe-scsi-all WWN Mapping Example (SPARC T4-2) 83Contents vii probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs) 86 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs) 89 probe-scsi-all WWN Mapping Example (SPARC T4-1B) 92 ? Identify a Disk Slot Using prtconf (Oracle Solaris OS) 95 WWN Syntax in an OS Installation on an Individual Drive 98 WWN Syntax in an OS Installation on a RAID Volume 99 Glossary 101 Index 107viii SPARC T4 Series Servers Administration Guide • October 2011ix Using This Documentation This administration guide is for system administrators of servers in the Oracle SPARC T4 server series. The guide includes general descriptive information about the server, and detailed instructions for configuring and administering the server. To use the information in this document, you must have working knowledge of computer network concepts and terms, and advanced familiarity with the Oracle Solaris Operating System (Oracle Solaris OS). Note – The SPARC T4 Series Servers Administration Guide applies to several server and server module products. Specific examples used in this document are based on one of these servers. Your output may vary from the examples based on your product. ¦ “Related Documentation” on page ix ¦ “Feedback” on page x ¦ “Support and Accessibility” on page x Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 Server http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1x SPARC T4 Series Servers Administration Guide • October 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Oracle ILOM 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle Solaris OS and other systems software http://www.oracle.com/technetwork/indexes/documentation/index.ht ml#sys_sw Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0 Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html Documentation Links1 Understanding System Administration Resources These topics provide a summary of common tools used to administer the server. ¦ “Oracle ILOM Overview” on page 1 ¦ “Platform-Specific Oracle ILOM Features” on page 2 ¦ “Oracle Solaris OS Overview” on page 3 ¦ “OpenBoot Overview” on page 3 ¦ “Oracle VM Server for SPARC Overview” on page 4 ¦ “Multipathing Software” on page 4 ¦ “Hardware Management Pack Overview” on page 5 Oracle ILOM Overview Oracle Integrated Lights Out Manager (Oracle ILOM) is system management firmware that is preinstalled on some SPARC servers. Oracle ILOM enables you to actively manage and monitor components installed in your server. Oracle ILOM provides a browser-based interface and a command-line interface, as well as SNMP and IPMI interfaces. The ILOM service processor runs independently of the server and regardless of the server power state as long as AC power is connected to the server (or to the modular system that contains the server module). When you connect your server to AC power, the ILOM service processor immediately starts up and begins monitoring the server. All environmental monitoring and control are handled by Oracle ILOM. The -> prompt indicates that you are interacting with the Oracle ILOM SP directly. This prompt is the first prompt you see when you log in to the server through the SER MGT port or NET MGT port, regardless of the host’s power state. On a modular system, that prompt is also present when you log in to a server module either directly or through Oracle ILOM on the CMM of the modular system.2 SPARC T4 Series Servers Administration Guide • October 2011 You can also access the ILOM service processor prompt (->) from the OpenBoot ok prompt, or from the Oracle Solaris # or % prompt, provided the system console is configured to be accessible through the SER MGT and NET MGT ports. The ILOM service processor supports a total of ten concurrent sessions per server: nine SSH or web connections are available through the NET MGT port and one connection is available through the SER MGT port. For more information about how to work with Oracle ILOM features that are common to all platforms managed by Oracle ILOM, see the Oracle ILOM documentation at: http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Related Information ¦ “Platform-Specific Oracle ILOM Features” on page 2 ¦ “Log In to Oracle ILOM” on page 9 Platform-Specific Oracle ILOM Features Oracle ILOM operates on many platforms, supporting features that are common to all platforms. Some Oracle ILOM features belong to only a subset of platforms. This topic describes the difference between Oracle ILOM features supported on the SPARC T4 series servers and the common set of features described in the Oracle ILOM 3.0 base documentation. Note – To perform some procedures documented in Oracle’s ILOM 3.0 base documentation, you must create a serial connection to the server and activate the Physical Presence switch on the server. For information about creating a serial connection, see the installation guide for your server. Among the Oracle ILOM features supported on other platforms, Oracle ILOM does not support the following features on the SPARC T4 rack-mount servers: ¦ Chassis monitoring module (CMM) features, such as single signon. Note - T4 blade servers in a modular system do support the CMM features. Note – The T4-1B blade servers in a modular system do support the CMM features. ¦ The POST diagnostics user-reset trigger is not available.Understanding System Administration Resources 3 Oracle ILOM supports the following feature on this server, which may not be available on other platforms: ¦ POST diagnostics hw-change trigger. This new trigger (hw-change error-reset) is the default setting for the server, and causes POST to run each time the server is AC power-cycled, or the top cover is removed (if applicable). For more information on POST, see the service manual for your server. Related Information ¦ “Oracle ILOM Overview” on page 1 Oracle Solaris OS Overview The Oracle Solaris OS includes commands and other software resources to use for server administration. For an introduction to management tools in your Oracle Solaris release, see System Administration Guide: Basic Administration in the Oracle Solaris documentation collection. Oracle Solaris software includes SunVTS software. SunVTS tests and validates Oracle hardware by verifying the connectivity and functionality of hardware devices, controllers and peripherals. In addition to the SunVTS information in the Oracle Solaris documentation, SunVTS documentation collections are available at: http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 Related Information ¦ “OpenBoot Overview” on page 3 OpenBoot Overview The OpenBoot firmware starts the OS, validates installed hardware, and can be used for other server administration tasks below the OS level. For more information about OpenBoot commands, see the OpenBoot 4.x Command Reference Manual in the Oracle Solaris documentation collection.4 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “Oracle Solaris OS Overview” on page 3 Oracle VM Server for SPARC Overview A logical domain is a discrete logical grouping with its own operating systems, resources, and identity within a single computer system. Application software can run in logical domains. Each logical domain can be created, destroyed, reconfigured, and rebooted independently. Oracle VM Server for SPARC software enables you to create and manage as many as 32 logical domains, depending on the hardware configuration of the server on which the Oracle VM Server for SPARC Manager has been installed. You can virtualize resources and define network, storage, and other I/O devices as services that can be shared between domains. The Oracle VM Server for SPARC configurations are stored on the SP. Using Oracle VM Server for SPARC CLI commands, you can add a configuration, specify a configuration to be used, and list the configurations on the SP. You can also use the Oracle ILOM set /HOST/bootmode config=configfile command to specify an Oracle VM Server boot configuration. Related Information ¦ “Configuring Boot Mode” on page 45 ¦ Oracle VM Server for SPARC documentation http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html Multipathing Software Multipathing software enables you to define and control redundant physical paths to I/O devices such as storage devices and network interfaces. If the active path to a device becomes unavailable, the software can automatically switch to an alternate path to maintain availability. This capability is known as automatic failover. To take advantage of multipathing capabilities, you must configure the server with redundant hardware, such as redundant network interfaces or two host bus adapters connected to the same dual-ported storage array.Understanding System Administration Resources 5 For the SPARC T4 series servers, three different types of multipathing software are available: ¦ Oracle Solaris IP Network Multipathing software provides multipathing and load-balancing capabilities for IP network interfaces. For instructions on how to configure and administer Oracle Solaris IP Network Multipathing, consult the IP Network Multipathing Administration Guide provided with your specific Oracle Solaris release. ¦ VVM software includes a feature called DMP, which provides disk multipathing as well as disk load balancing to optimize I/O throughput. For information about VVM and its DMP feature, refer to the documentation provided with the VERITAS Volume Manager software. ¦ StorageTek Traffic Manager is an architecture fully integrated within the Oracle Solaris OS (beginning with the Oracle Solaris 8 release) that enables I/O devices to be accessed through multiple host controller interfaces from a single instance of the I/O device. For information about StorageTek Traffic Manager, refer to your Oracle Solaris OS documentation. Related Information ¦ “Oracle Solaris OS Overview” on page 3 ¦ “Oracle VM Server for SPARC Overview” on page 4 Hardware Management Pack Overview The Hardware Management Pack (HMP) from Oracle provides tools you can use to manage and configure Oracle servers from the host operating system. To use these tools, you must install the HMP software on your server. After installing the software, you will be able to perform the following server management tasks described in the following table.6 SPARC T4 Series Servers Administration Guide • October 2011 TABLE: Hardware Management Pack -- Server Managment Tasks Server Management Task From Host OS* * Supported host operating systems include: Oracle Solaris, Linux, Windows, and VMware Hardware Management Pack Implementation Tool Monitor Oracle hardware with host IP address Use the Hardware Management Agent and the associated Simple Network Management Protocol (SNMP) plug-ins at the operating-system level to enable in-band monitoring of your Oracle hardware. This in-band monitoring functionality enables you to use your host operating system IP address to monitor your Oracle servers without the need of connecting the Oracle ILOM management port to your network. Host OS-level management tool Monitor storage devices, including RAID arrays Use the Server Storage Management Agent at the operating-system level to enable in-band monitoring of the storage devices configured on your Oracle servers. The Server Storage Management Agent provides an operating-system daemon that gathers information about your server’s storage devices, such as hard disk drives (HDDs) and RAID arrays, and sends this information to the Oracle ILOM SP. The Storage Monitoring features in Oracle ILOM enable you to view and monitor the information provided by the Server Storage Management Agent. You can access the Storage Monitoring features in Oracle ILOM from the command-line interface (CLI). Oracle ILOM 3.0 CLI Storage Monitoring features Query, update, and validate firmware versions on supported SAS storage devices Use the fwupdate CLI tool from the host operating system to query, update, and validate firmware versions on supported storage devices such as SAS host bus adapters (HBAs), embedded SAS storage controllers, LSI SAS storage expanders, and disk drives. Host OS-level fwupdate CLI Restore, set, and view Oracle Oracle ILOM configuration settings Use the ilomconfig CLI tool from the host operating system to restore Oracle ILOM configuration settings,as well as to view and set Oracle ILOM properties associated with network management, clock configuration, and user management. Host OS-level ilomconfig CLI View or create RAID volumes on storage drives Use the raidconfig CLI tool from the host operating system to view and create RAID volumes on storage drives that are attached to RAID controllers, including storage arrays. Host OS-level raidconfig CLI Use IPMItool to access and manage Oracle servers Use the open source command-line IPMItool from the host operating system to access and manage your Oracle servers via the IPMI protocol. Host OS-level command-line IMPItoolUnderstanding System Administration Resources 7 Source for Downloading Hardware Management Pack Software You can download the Hardware Management Pack software from the following location: http://support.oracle.com Hardware Management Pack Documentation You can download Hardware Management Pack documentaton from the following location: http://www.oracle.com/pls/topic/lookup?ctx=ohmp For additional details about how to use the Storage Monitoring features in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide and the Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management CLI Procedures Guide. For additional details about accessing and managing your server via SNMP or IPMI, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 SNMP, IPMI, CIM, WSMAN, Protocol Management Reference. Links to these Oracle ILOM manuals are provided on the web site shown above. You can find the complete set of Oracle ILOM documentation at this location: http://www.oracle.com/pls/topic/lookup?ctx=ilom308 SPARC T4 Series Servers Administration Guide • October 20119 Accessing the Server These topics include information on establishing low-level communication with the server using the Oracle ILOM tool and the system console. ¦ “Log In to Oracle ILOM” on page 9 ¦ “Log In to the System Console” on page 10 ¦ “Display the ok Prompt” on page 11 ¦ “Display the Oracle ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “Oracle ILOM Remote Console” on page 14 ? Log In to Oracle ILOM This procedure assumes the default configuration of the SP as described in your server’s installation guide. Note – For a SPARC T4 server module, you can either log in directly to the modular server’s SP or you can start Oracle ILOM through the chassis’ CMM. Refer to the modular server’s installation guide for instructions on both approaches.10 SPARC T4 Series Servers Administration Guide • October 2011 ? Open an SSH session and connect to the SP by specifying its IP address. The Oracle ILOM default username is root and the default password is changeme. You are now logged in to Oracle ILOM. Perform tasks as needed. Note – To provide optimum server security, change the default server password. Related Information ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to the System Console” on page 10 ? Log In to the System Console ? At the Oracle ILOM -> prompt, type: where option can be: ¦ -f|force – Enables a user with a Console (c) role to take the console from any current user and force that user into view mode. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.16.3 r66969 Copyright 2011 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accessing the Server 11 ¦ -script – Bypasses prompt for a yes or no confirmation. Note – If the Oracle Solaris OS is not running, the server displays the ok prompt. Related Information ¦ “Display the Oracle ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “Log In to Oracle ILOM” on page 9 ? Display the ok Prompt This procedure assumes the default system console configuration. ? Choose the appropriate shutdown method from the following table to reach the ok prompt. Note – To ensure getting to the ok prompt, set the following Oracle ILOM property before performing the procedures below: -> set /HOST/bootmode script=”setenv auto-boot? false” Caution – When possible, reach the ok prompt by performing a graceful shutdown of the OS. Any other method used might result in the loss of server state data.12 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “Monitoring Faults” on page 57 ? Display the Oracle ILOM -> Prompt ? Use one of the following ways to display the Oracle ILOM -> prompt: ¦ From the system console, type the Oracle ILOM escape sequence (#.). ¦ Log in to Oracle ILOM directly from a device connected to the SER MGT port or NET MGT port. ¦ Log in to Oracle ILOM through an SSH connection. See “Log In to Oracle ILOM” on page 9. Server State What To Do OS running and responsive Shut down the server beginning at the host prompt: From a shell or command tool window, type an appropriate command (for example, the shutdown or init 0 command) as described in the Oracle Solaris system administration documentation. Then take one of the following steps: • At the Oracle ILOM prompt, type: -> stop /SYS • Use the server Power button. OS unresponsive Disable autoboot and thereset the host. (Provided the operating system software is not running and the server is already under OpenBoot firmware control.) At the Oracle ILOM prompt, type: -> set /HOST send_break_action=break Press Enter. Then type: -> start /HOST/console OS unresponsive and need to prevent auto-boot Shut down the server from Oracle ILOM and disable autoboot. At the Oracle ILOM prompt, type: -> set /HOST/bootmode script=”setenv auto-boot? false” Press Enter. Then type: -> reset /SYS -> start /HOST/consoleAccessing the Server 13 Related Information ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to Oracle ILOM” on page 9 ? Use a Local Graphics Monitor You can redirect the system console to a local graphic monitor. You cannot use a local graphics monitor to perform the initial server installation, nor can you use a local graphics monitor to view POST messages. To use a local graphics monitor: 1. Connect the monitor video cable to a video port on the server. Tighten the thumbscrews to secure the connection. Refer to your system’s documentation for any special connection instructions that might apply to your server. 2. Connect the monitor power cord to an AC outlet. 3. Connect the USB keyboard cable to one USB port. 4. Connect the USB mouse cable to another USB port on the server. 5. Display the ok prompt. See “Display the ok Prompt” on page 11. 6. At the ok prompt, set the following OBP configuration variables: 7. Make the changes take effect: The server stores the parameter changes and boots automatically. Note – Instead of using the reset-all command to store the parameter changes, you can also power cycle the server using the Power button. You can now type system commands and view system messages using your local graphics monitor. To activate the GUI interface, continue to the next step. ok setenv input-device keyboard ok setenv output-device screen ok reset-all14 SPARC T4 Series Servers Administration Guide • October 2011 8. Activate the Oracle Solaris OS GUI interface. Once the Oracle Solaris OS is installed and booted, type the following commands to display the GUI login screen. Related Information ¦ “Display the ok Prompt” on page 11. ¦ “Oracle ILOM Remote Console” on page 14 Oracle ILOM Remote Console Oracle ILOM Remote Console is a Java application that enables you to remotely redirect and control the following devices on the host server. This group of devices is commonly abbreviated as KVMS. ¦ Keyboard ¦ Video console display ¦ Mouse ¦ Serial console display ¦ Storage devices or images (CD/DVD) Oracle ILOM Remote Console is documented in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management Web Interface Procedures Guide (”Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console”). Related Information ¦ “Oracle ILOM In-band (Sideband) Management” on page 41 # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # reboot15 Controlling the Server These topics include procedures for contolling basic server operations. ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Reset the SP to Default Values” on page 18 ? Power On the Server (Oracle ILOM) 1. Log in to Oracle ILOM. “Log In to Oracle ILOM” on page 9. Note – If you have a modular system, make sure you are logged in to the desired server module. 2. At the Oracle ILOM -> prompt, type: Note – To skip being prompted for confirmation, use the start -script /SYS command. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->16 SPARC T4 Series Servers Administration Guide • October 2011 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Power Off the Server (Oracle ILOM) 1. Shut down the Oracle Solaris OS. At the Oracle Solaris prompt, type: 2. Switch from the system console prompt to the SP console prompt. 3. From the Oracle ILOM -> prompt, type: Note – To perform an immediate shutdown, use the stop -force -script /SYS command. Ensure that all data is saved before typing this command. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 106 system services are now being stopped. Sep 12 17:52:11 bur381-14 syslogd: going down on signal 15 svc.startd: The system is down. syncing file systems...done Program terminated SPARC T4-1, No Keyboard Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved. OpenBoot 4.33.1, 32256 MB memory available, Serial #95593628. Ethernet address 0:21:28:b2:a4:9c, Host ID: 85b2a49c. {0} ok {0} ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Controlling the Server 17 Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Reset the Server (Oracle Solaris OS) It is not necessary to power the server off and on to perform a reset. ? To reset the server from the Oracle Solaris prompt, type one of the following commands: or Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Reset the Server (Oracle ILOM) The Oracle ILOM reset command generates a graceful or forced hardware reset of the server. By default, the reset command gracefully resets the server. ? Type one of the following commands to reset the server. ¦ Perform a graceful reset from Oracle ILOM: # shutdown -g0 -i6 -y # reboot -> reset /SYS18 SPARC T4 Series Servers Administration Guide • October 2011 ¦ If a graceful reset is not possible, perform a forced hardware reset from Oracle ILOM: Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Override OBP Settings to Reset the Server” on page 49 ? Reset the SP to Default Values If your SP becomes corrupt, or you want to reset the SP to the factory default values, change the /SP reset_to_defaults setting then power off the host to implement the changes. This is new behavior. Previously you did not have to power off the host to reset default values to the SP. You need administrator permissions to perform this task. 1. To reset the SP to the default values, type: where value can be: ¦ all – Removes all of the SP configuration data. ¦ factory – Removes all SP configuration data as well as all log files. 2. Power off and restart the host to complete the setting change. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> reset -force /SYS -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP19 Configuring Hardware RAID These topics describe how to configure and manage RAID disk volumes using the server’s onboard SAS-2 disk controller. ¦ “Hardware RAID Support” on page 19 ¦ “Prepare to Use the FCode Utility” on page 21 ¦ “Create a Hardware RAID Volume” on page 22 ¦ “Hot Spare Drives in RAID Volumes (LSI)” on page 24 ¦ “Determining If a Drive Has Failed” on page 24 ¦ “RAID Drive Replacement Strategies” on page 27 ¦ “Locate Device Paths” on page 27 Hardware RAID Support SPARC T4 series servers contain onboard SAS2 RAID controllers, which enable the formation of logical disk volumes consisting of two or more redundant disk drives. These controllers support the following RAID levels: ¦ RAID 0 -- Data striping ¦ RAID 1 -- Data mirroring (using two disks) ¦ RAID 1e -- Enhanced mirroring (using three to eight disks) Data striping refers to the technique of distributing data files across multiple disks so that storage and retrieval can be done in parallel over multiple data channels. Striping data can significantly enhance data storage operations. Data mirroring refers to the technique of storing identical copies of data on separate disks. Mirroring critical data reduces the risk of data loss by maintaining duplicate instances of the data.20 SPARC T4 Series Servers Administration Guide • October 2011 Note – The SPARC T4-1 server has two onboard RAID controllers. SPARC T4-2 has a single onboard RAID controller. The SPARC T4-1B modular server has a single pluggable RAID Expansion Module (REM). The SPARC T4-4 server has two pluggable RAID Expansion Modules (REMs). Up to two logical volumes can be configured on each onboard RAID controller. This means up to four volumes can be created on a SPARC T4-1 server. You can choose from among three environments for creating and managing the RAID resources in your server. ¦ Fcode utility -- This utility consists of a set of special commands to display targets and manage logical volumes on your server. You access these commands through the OBP environment. The examples shown in this manual rely on Fcode commands. ¦ LSI SAS2 2008 RAID Management Utility for SPARC T4 servers -- You can use the sas2ircu commands contained in the LSI SAS2 Integrated Configuration Utility to configure and manage RAID volumes on your server. To use the sas2ircu command set, download and install the SAS2IRCU software from the following location: http://www.lsi.com/channel/support/pages/downloads.aspx?k=* ¦ Oracle Hardware Management Pack 2.2 -- You can use the raidconfig commands contained in this software’s Oracle Server CLI Tools component to create and manage RAID volumes on your server. To use these commands, download and install the latest version of the Hardware Management Pack from this location: http://www.oracle.com/us/support/044752.html You can find complete documentation for using the Hardware Management Pack software at this location: http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21 Tip – Some Hardware Management Pack 2.2 commands may have long startup or execution latencies on SPARC T4-2 and T4-4 servers. In such cases, you may prefer to use the Fcode or LSI sas2ircu commands. Related Information ¦ “Create a Hardware RAID Volume” on page 22 ¦ “Prepare to Use the FCode Utility” on page 21Configuring Hardware RAID 21 ? Prepare to Use the FCode Utility Perform the following procedure from an xterm or an equivalent terminal window that supports scrolling. Note – FCode commands produce large amounts of detailed output. An xterm and gnome terminal windows provide scroll bar functionality, which helps view such output. 1. Either apply power to the system or reset the system if power is already present and disable auto-boot in OBP. See “Display the ok Prompt” on page 11. 2. Enter the OBP environment. 3. Use the show-devs command to list the device paths on the server. Note – For a server module, the device path might be /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. Use the select command to choose the controller where you want to create a hardware RAID volume. Instead of using the entire device path for the controller, you can use a preconfigured alias for a controller. For example: To view the preconfigured aliases on your server, use the devalias command. See “Locate Device Paths” on page 27. Display the SAS addresses of any connected drives using the show-children command. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi022 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “FCode Utility Commands” on page 22 ¦ “Display the ok Prompt” on page 11 FCode Utility Commands Related Information ¦ “Create a Hardware RAID Volume” on page 22 ¦ “Prepare to Use the FCode Utility” on page 21 ? Create a Hardware RAID Volume 1. Prepare to create a RAID volume. See “Prepare to Use the FCode Utility” on page 21. 2. Use the show-children command to list the physical drives on the selected controller. FCode Command Description show-children Lists all connected physical drives and logical volumes. show-volumes Lists all connected logical volumes in detail. create-raid0-volume Creates a RAID 0 volume (minimum two targets). create-raid1-volume Creates a RAID 1 volume (exactly two targets). create-raid1e-volume Creates a RAID 1e volume (minimum three targets). delete-volume Deletes a RAID volume. activate-volume Re-activate a RAID volume after disks have been replaced. {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00Configuring Hardware RAID 23 3. Use the create-raid0-volume, create-raid1-volume, or create-raid1e-volume command to create a logical drive from the physical disks. For example, to create a RAID 0 volume with targets 9 and a, type the targets first then type the create command: For example, to create a RAID 1e volume with targets a, b, and c, type: 4. To verify creation of the volume, type: 5. Type unselect-dev to deselect the controller. Related Information ¦ “FCode Utility Commands” on page 22 ¦ “Display the ok Prompt” on page 11 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volume {0} ok show-volumes {0} ok unselect-dev24 SPARC T4 Series Servers Administration Guide • October 2011 Hot Spare Drives in RAID Volumes (LSI) You can configure two global hot spare drives to protect data on mirrored RAID volumes. If one of the drives in a RAID 1 or RAID 1E mirrored volume fails, the onboard RAID controller will replace the failed drive automatically with a hot spare drive and then resynchronize the mirrored data. Use the sas2ircu LSI utility to add global hot spare drives or HMP. Refer to the SAS2 Integrated RAID Solution User Guide for more information about adding hot spare drives. Determining If a Drive Has Failed These topics explain various ways to determine if a drive contained in a RAID volume has failed: ¦ “Service Required Drive LEDs” on page 24 ¦ “Error Messages (System Console and Log Files)” on page 25 ¦ “Display Status (show-volumes Command, OBP)” on page 26 ¦ “Display Status (sas2ircu Utility, LSI)” on page 26 Service Required Drive LEDs When a fault occurs on a drive in a SPARC T4 system, the amber Service Required LED will light on the front of the drive. This amber LED will allow you to locate the faulted drive in the system. Additionally, the front and rear panel Service Action Required LEDs also light when the system detects a hard drive fault. Refer to your service manual for the location and description of these LEDs.Configuring Hardware RAID 25 Error Messages (System Console and Log Files) When a fault occurs on a drive, error messages will be displayed on the system console. This is an example of a system console display indicating that volume 905 has been degraded with the loss of PhysDiskNum 1: You can also view these messages by reviewing the /var/adm/messages files: Refer to the View the System Message Log Files topic in your service manual for Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degraded Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded26 SPARC T4 Series Servers Administration Guide • October 2011 more information about examining these messages. ? Display Status (show-volumes Command, OBP) You can halt the system and use the show-volumes OBP command to determine if a drive has failed. 1. Halt the system and display the OBP ok prompt. See “Display the ok Prompt” on page 11. 2. Select the SAS controller device. See “Prepare to Use the FCode Utility” on page 21 for more information. 3. Type the show-volumes command to display the RAID volumes and their associated disks. In the following example, the secondary disk in a RAID 1 volume is offline. 4. Type the unselect-dev command to deselect the SAS controller device. ? Display Status (sas2ircu Utility, LSI) ? Use the LSI sas2ircu utility to display the status of the RAID volume and its associated drives. Refer to the SAS2 Integrated RAID Solution User Guide for more information about displaying and interpreting device status using the sas2ircu utility. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguring Hardware RAID 27 RAID Drive Replacement Strategies Follow the strategies described below when replacing a failed drive in a RAID volume. Note – The cfgadm instructions in the service manual are for individual drives that are not part of RAID volumes. When a drive is part of a RAID volume, you do not need to unconfigure it before hot swapping it with a new drive. ? Locate Device Paths Use this procedure to locate device paths specific to your server. 1. Display the ok prompt. See “Display the ok Prompt” on page 11. 2. From the ok prompt, type: RAID Volume Level Strategy RAID 0 If a drive fails in a RAID 0 volume, you will lose all data on that volume. Replace the failed drive with a new drive of the same capacity, recreate the RAID 0 volume, and restore the data from a backup. RAID 1 Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume. RAID 1E Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume.28 SPARC T4 Series Servers Administration Guide • October 2011 Note – This example represents devalias output for a sample T4-x server. The specific devices displayed will differ for different products. Related Information ¦ “Display the ok Prompt” on page 11 ¦ “Prepare to Use the FCode Utility” on page 21 {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok29 Changing Server Identification Information These topics describe how to store information (for purposes such as inventory control or site resource management) on the SP and FRU PROMs using the Oracle ILOM CLI interface. ¦ “Change Customer Data on FRU PROMs” on page 29 ¦ “Change System Identifier Information” on page 30 ? Change Customer Data on FRU PROMs Use the /SP customer_frudata property to store information in all FRU PROMs. This field can be used to identify a particular system to a third-party application, or for any other identifcation needs in your environment. ? At the Oracle ILOM -> prompt, type: Note – You must enclose the data string (data) in quote marks. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Change System Identifier Information” on page 30 -> set /SP customer_frudata=”data”30 SPARC T4 Series Servers Administration Guide • October 2011 ? Change System Identifier Information Use the /SP system_identifier property to store customer identification information. This string is encoded in all trap messages generated by SNMP. Assigning a unique system identifier can be useful in distinguishing which system generates which SNMP message. ? At the Oracle ILOM -> prompt, type: Note – The data string (data) must be enclosed in quote marks. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Change Customer Data on FRU PROMs” on page 29 -> set /SP system_identifier=”data”31 Configuring Policy Settings These topics describe managing configuration policies using Oracle ILOM. ¦ “Specify Cooldown Mode” on page 31 ¦ “Restore the Host Power State at Restart” on page 32 ¦ “Specify the Host Power State at Restart” on page 32 ¦ “Disable or Re-Enable the Host Power-On Delay” on page 33 ¦ “Specify Parallel Boot of the SP and Host” on page 34 ¦ “Configure Host Behavior (Keyswitch State)” on page 34 ? Specify Cooldown Mode Some SPARC T4 systems support the host cooldown mode, but not all. Setting the HOST_COOLDOWN property to enabled causes the server to enter cooldown mode while the host is powering off. The cooldown mode directs Oracle ILOM to monitor certain components to ensure that they are below a minimum temperature so as not to cause harm to the user if internal components are accessed. Once the components are below the threshold temperature, power is removed from the server, which allows the cover interlock switch to release. If the monitored temperatures take longer than 4 minutes to reach the threshold, the host tuns off. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – Server cools certain components before powering off. ¦ disabled – Component temperatures are not monitored during power off. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> set /SP/policy HOST_COOLDOWN=value32 SPARC T4 Series Servers Administration Guide • October 2011 ? Restore the Host Power State at Restart Use the /SP/policy HOST_LAST_POWER_STATE property to control the behavior of the server after an unexpected power outage. When external power is restored, the Oracle ILOM SP starts to run automatically. Normally, the host power is not turned on until you use Oracle ILOM to turn it on. Oracle ILOM records the current power state of the server in nonvolatile storage. If the HOST_LAST_POWER_STATE policy is enabled, Oracle ILOM can restore the host to the previous power state. This policy is useful in the event of a power failure, or if you physically move the server to a different location. For example, if the host server is running when power is lost and the /SP/policy HOST_LAST_POWER_STATE property is set to disabled, the host server remains off when power is restored. If the /SP/policy HOST_LAST_POWER_STATE property is set to enabled, the host server restarts when the power is restored. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – When power is restored, returns the server to the state it was in before the power was removed. ¦ disabled – Keeps the server off when power is applied (the default). If you enable HOST_LAST_POWER_STATE, you should also configure /SP/policy HOST_POWER_ON_DELAY. For further information, see “Disable or Re-Enable the Host Power-On Delay” on page 33. Related Information ¦ “Disable or Re-Enable the Host Power-On Delay” on page 33 ¦ “Specify the Host Power State at Restart” on page 32 ? Specify the Host Power State at Restart Use /SP/policy HOST_AUTO_POWER_ON to power on the host when external power is applied to the server. If this policy is set to enabled, the SP sets HOST_LAST_POWER_STATE to disabled. -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguring Policy Settings 33 ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – When power is applied, automatically powers on the host when the SP has been booted. ¦ disabled – Keeps the host power off when power is applied (the default). Related Information ¦ “Restore the Host Power State at Restart” on page 32 ¦ “Disable or Re-Enable the Host Power-On Delay” on page 33 ? Disable or Re-Enable the Host Power-On Delay Use the /SP/policy HOST_POWER_ON_DELAY property to cause the server to wait for a short time before powering on automatically. The delay is a random interval of one to five seconds. Delaying the server power on helps minimize current surges on the main power source. This power-on delay is important when multiple servers in racks power on after a power outage. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – Causes the server to wait for a short time before powering on automatically. ¦ disabled – Server powers on automatically without a delay (the default). Related Information ¦ “Specify the Host Power State at Restart” on page 32 -> set /SP/policy HOST_AUTO_POWER_ON=value -> set /SP/policy HOST_POWER_ON_DELAY=value34 SPARC T4 Series Servers Administration Guide • October 2011 ? Specify Parallel Boot of the SP and Host The /SP/policy PARALLEL_BOOT property, when enabled, allows the host to boot and power on in parallel with the SP if an auto-power policy (HOST_AUTO_POWER_ON or HOST_LAST_POWER_STATE) was on or a user presses the power button while the SP is in the process of booting. Oracle ILOM has to be running in order to allow the host to power on when the power button is pressed or the the auto-power policies are set. When this property is set to disabled, the SP boots first, then the host boots. Note – Parallel boot is not supported on server modules. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – SP and host boot concurrently. ¦ disabled – SP and host boot serially. Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 ? Configure Host Behavior (Keyswitch State) Use the /SYS keyswitch_state property to control the position of the virtual keyswitch. -> set /SP/policy PARALLEL_BOOT=valueConfiguring Policy Settings 35 ? At the Oracle ILOM -> prompt, type: where value can be: ¦ normal – The server can power itself on and start the boot process (the default). ¦ standby – Powers off host, disables power on. ¦ diag – Host power on is allowed, it overrides the settings of /HOST/diag target, resulting in Max POST being executed. ¦ locked – Host power on is allowed, however, you are prohibited from updating flash devices or setting /HOST send_break_action=break. Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> set /SYS keyswitch_state=value36 SPARC T4 Series Servers Administration Guide • October 201137 Configuring Network Addresses These topics describe managing network addresses with Oracle ILOM. ¦ “SP Network Address Options” on page 37 ¦ “Disable or Re-Enable Network Access to the SP” on page 38 ¦ “Display the DHCP Server IP Address” on page 38 ¦ “Display the IP Address of the SP” on page 39 ¦ “Display the Host MAC Address” on page 40 ¦ “Using an In-band Connection to the SP” on page 41 SP Network Address Options You can access the SP on your system in multiple ways. Consider the following options and choose the access method that is best for your environment. You can physically connect to the SP using a serial connection or a network connection. The network connection can be configured to use a static IP address or DHCP (the default). Optionally, the T4 Series servers can use an in-band network connection to the SP, rather than the default out-of-band NET MGT port. For more information on each option, see the following documentation: ¦ To use a serial connection to the SP, see: Connect a Terminal or Emulator to the SER MGT Port, in the installation guide for your server or Communicating With the Server Module During Startup in the installation guide for your server module. ¦ To assign a static IP address to the SP, see: Assign a Static IP Address to the SP, in the installation guide for your server. ¦ To use an in-band connection to the SP, see: “Oracle ILOM In-band (Sideband) Management” on page 4138 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to Oracle ILOM” on page 9 ? Disable or Re-Enable Network Access to the SP Use the /SP/network state property to enable or disable the SP’s network interface. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled (the default) ¦ disabled Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “SP Network Address Options” on page 37 ? Display the DHCP Server IP Address To display the IP address of the DHCP server that provided the dynamic IP address requested by the SP, view the dhcp_server_ip property. ? At the Oracle ILOM -> prompt, type: -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguring Network Addresses 39 Note – The list of properties might vary based on your server. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Display the Host MAC Address” on page 40 ? Display the IP Address of the SP To display the IP address of the SP, view the ipaddress property. ? At the Oracle ILOM -> prompt, type: ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 <--- DHCP server ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show -> show /SP/network /SP/network Targets:40 SPARC T4 Series Servers Administration Guide • October 2011 ? Display the Host MAC Address The /HOST macaddress property is automatically configured by the server software, so you cannot set or change the property. The value is read and determined from the server’s removable system configuration card (SCC PROM) or from the server module’s ID PROM and then stored as a property in Oracle ILOM. /HOST macaddress is the MAC address for the net0 port. The MAC addresses for each additional port increments from the /HOST macaddress. For example, net1 is equal to the value of /HOST macaddress plus one (1). ? At the Oracle ILOM -> prompt, type: interconnect ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 <--- IP address of SP ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show -> show /HOST macaddressConfiguring Network Addresses 41 Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Display the DHCP Server IP Address” on page 38 Using an In-band Connection to the SP These topics describe how to use an in-band, or sideband connection, to the SP. ¦ “Oracle ILOM In-band (Sideband) Management” on page 41 ¦ “Configure SP In-band (Sideband) Access” on page 42 Oracle ILOM In-band (Sideband) Management By default, you connect to the server’s SP using the out-of-band NET MGT port. The Oracle ILOM sideband management feature enables you to select either the NET MGT port or one of the server’s Gigabit Ethernet ports (NETn), which are in-band ports, to send and receive Oracle ILOM commands to and from the server SP. In-band ports are also called sideband ports. The advantage of using a sideband management port to manage the server’s SP is that one fewer cable connection and one fewer network switch port are needed. In configurations where numerous servers are being managed, such as data centers, sideband management can represent a significant savings in hardware and network utilization. Note – In-band connection is not recommended for server modules. When sideband management is enabled in Oracle ILOM, the following conditions might occur: ¦ Connectivity to the server SP might be lost when the SP management port configuration is changed while you are connected to the SP using a network connection, such as SSH, web, or Oracle ILOM Remote Console. ¦ In-chip connectivity between the SP and the host operating system might not be supported by the on-board host Gigabit Ethernet controller. If this condition occurs, use a different port or route to transmit traffic between the source and destination targets instead of using L2 bridging/switching.42 SPARC T4 Series Servers Administration Guide • October 2011 ¦ Server host power cycles might cause a brief interruption of network connectivity for server Gigabit Ethernet ports (NETn) that are configured for sideband management. If this condition occurs, configure the adjacent switch/bridge ports as host ports. Related Information ¦ “Configure SP In-band (Sideband) Access” on page 42 ¦ “SP Network Address Options” on page 37 ? Configure SP In-band (Sideband) Access This procedure describes how to access the SP from an in-band (or sideband) management using a host network port. If you perform this procedure using a network connection, you might lose connectivity to the server. Using a serial connection for this procedure eliminates the possibility of losing connectivity during sideband management configuration changes. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. If you logged in using the serial port, you can assign a static IP address. For instructions, see the information about assigning an IP address in the installation guide for your server. 3. View the current network settings. -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7Configuring Network Addresses 43 4. Set the SP management port to a sideband port. (where n is 0-3). For SPARC T4-1B systems, n is 0-1. For all other systems, n is 0-3. 5. Verify the change. managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set /SP/network commitpending=true -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.044 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “Oracle ILOM In-band (Sideband) Management” on page 41 ¦ “SP Network Address Options” on page 37 pendingmanagementport = /SYS/MB/NET0 sidebandmacaddress = 00:11:3T:80:44:B7 state = enabled Commands: cd set show45 Configuring Boot Mode Use the Oracle ILOM boot mode properties to specify how the host boots when correcting a problem with OpenBoot or Oracle VM Server for SPARC settings. ¦ “Boot Mode Overview” on page 45 ¦ “Configure the Host Boot Mode (Oracle VM Server for SPARC)” on page 46 ¦ “Change the Host Boot Mode Behavior at Reset” on page 47 ¦ “Manage the Host Boot Mode Script” on page 48 ¦ “Display Host Boot Mode Expiration Date” on page 49 ¦ “Override OBP Settings to Reset the Server” on page 49 Boot Mode Overview Boot mode (bootmode) properties enable you to override the default method the server uses when it boots. This ability is useful to override particular OpenBoot or Oracle VM Server settings that might be incorrect, to set up OpenBoot variables using a script, or to perform similar tasks. For example, if the OpenBoot settings have become corrupt, you can set the bootmode state property to reset_nvram then reset the server to its factory default OpenBoot settings. Service personnel might instruct you to use the bootmode script property for problem resolution. The full extent of script capabilities are not documented and exist primarily for debugging. Because bootmode is intended to be used to correct a problem with the OpenBoot or Oracle VM Server settings, the bootmode takes effect for a single boot only. Additionally, to prevent an administrator from setting a bootmode state property and forgetting about it, a bootmode state property expires if the host is not reset within 10 minutes of the bootmode state property being set.46 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “OpenBoot Overview” on page 3 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Configure the Host Boot Mode (Oracle VM Server for SPARC) Note – You must use a valid Oracle VM Server configuration name for this task. 1. Determine the valid Oracle VM Server configurations on your SP, at the Oracle ILOM -> prompt, type: 2. Set the boot mode configuration, at the Oracle ILOM -> prompt, type: where the config property takes a configname value that is a valid named logical domain configuration. For example, if you created a Oracle VM Server configuration called ldm-set1: To return the boot mode config to the factory default configuration, specify factory-default. For example: Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 -> show /HOST/domain/configs -> set /HOST/bootmode config=configname -> set /HOST/bootmode config=ldm-set1 -> set /HOST/bootmode config=factory-defaultConfiguring Boot Mode 47 ¦ “Boot Mode Overview” on page 45 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Change the Host Boot Mode Behavior at Reset The /HOST/bootmode state property controls how OpenBoot NVRAM variables are used. Normally the current settings of these variables are retained. Setting /HOST/bootmode state=reset_nvram changes the OpenBoot NVRAM variables to their default settings at the next reset. ? At the Oracle ILOM -> prompt, type: where value is one of the following: ¦ normal – At next reset, retains current NVRAM variable settings. ¦ reset_nvram – At next reset, returns OpenBoot variables to default settings. Note – state=reset_nvram will return to normal after the next server reset or 10 minutes (see expires property in “Display Host Boot Mode Expiration Date” on page 49). config and script properties do not expire and will be cleared upon the next server reset or manually by setting value to "". Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 45 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode state=value48 SPARC T4 Series Servers Administration Guide • October 2011 ? Manage the Host Boot Mode Script ? At the Oracle ILOM -> prompt, type: where script controls the host server OBP firmware method of booting. script does not affect the current /HOST/bootmode setting. value can be up to 64 bytes in length. You can specify a /HOST/bootmode setting and set the script within the same command. For example: After the server resets and OBP reads the values stored in the script, the OBP sets the OBP variable diag-switch? to the user-requested value of true. Note – If you set /HOST/bootmode script="", Oracle ILOM sets the script to empty. Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 45 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"Configuring Boot Mode 49 ? Display Host Boot Mode Expiration Date ? At the Oracle ILOM -> prompt, type: where expires is the date and time when the current boot mode will expire. Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 45 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Override OBP Settings to Reset the Server Use this procedure to override the OBP settings and initiate reboot of the control domain, which results in the host booting to the ok prompt. ? At the Oracle ILOM -> prompt, type: The host reboots and stops at the ok prompt. Related Information ¦ “Change the Host Boot Mode Behavior at Reset” on page 47 ¦ “Configuring Boot Mode” on page 45 ¦ “Boot Mode Overview” on page 45 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled -> reset /HOST/domain/control [-force] [-script]50 SPARC T4 Series Servers Administration Guide • October 201151 Configuring Server Behavior at Restart Use the following procedures to configure how Oracle ILOM should behave during the following restart scenarios. ¦ “Specify Behavior When the Host Resets” on page 51 ¦ “Specify Behavior When the Host Stops Running” on page 52 ¦ “Set the Boot Timeout Interval” on page 52 ¦ “Specify Behavior at Boot Timeout” on page 53 ¦ “Specify Behavior if Restart Fails” on page 53 ¦ “Specify Maximum Restart Attempts” on page 54 ? Specify Behavior When the Host Resets Specify if the host should continue to boot if an error is encountered. ? Set this property: where value can be: ¦ false – The host continues to boot if an error is encountered. ¦ true – The host does not continue to boot if an error is encountered. Related Information ¦ “Configuring Policy Settings” on page 31 -> set /HOST autorunonerror=value52 SPARC T4 Series Servers Administration Guide • October 2011 ? Specify Behavior When the Host Stops Running Specify what Oracle ILOM should do when the host leaves the RUNNING state (when the watchdog timer expires). ? Set this property: where value can be: ¦ none – Oracle ILOM takes no action other than to issue a warning. ¦ reset – Oracle ILOM attempts to reset the server when the Oracle Solaris watchdog timer expires (the default). ¦ dumpcore – Oracle ILOM attempts to force a core dump of the OS when the watchdog timer expires. Related Information ¦ “Display Console History” on page 61 ? Set the Boot Timeout Interval ? Set the time delay between a request to boot the host and booting the host: The default value of boottimeout is 0 (zero seconds) or no timeout. Possible values are in the range from 0 to 36000 seconds. Related Information ¦ “Specify Behavior at Boot Timeout” on page 53 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguring Server Behavior at Restart 53 ? Specify Behavior at Boot Timeout Specify what Oracle ILOM should do if the host fails to boot before the boot timeout interval. ? Specify behavior at the completion of boottimeout: where value can be: ¦ none (the default) ¦ reset Related Information ¦ “Set the Boot Timeout Interval” on page 52 ? Specify Behavior if Restart Fails Specify what Oracle ILOM should do if the host fails to reach the Oracle Solaris running state. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ powercycle ¦ poweroff (the default) Related Information ¦ “Specify Maximum Restart Attempts” on page 54 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value54 SPARC T4 Series Servers Administration Guide • October 2011 ? Specify Maximum Restart Attempts Specify how many times Oracle ILOM should attempt to restart the host. ? At the Oracle ILOM -> prompt, type: The default value of maxbootfail is 3 (three attempts). If the host does not boot successfully within the number of tries indicated by maxbootfail, the host is powered off or powercycled (depending upon the setting of bootfailrecovery). In either case, boottimeout is set to 0 (zero seconds), disabling further attempts to restart the host. Related Information ¦ “Specify Behavior if Restart Fails” on page 53 -> set /HOST maxbootfail=attempts55 Configuring Devices These topics contain information about configuring devices in the server. ¦ “Unconfigure a Device Manually” on page 55 ¦ “Reconfigure a Device Manually” on page 55 ? Unconfigure a Device Manually The Oracle ILOM firmware provides a component_state=disabled command, which enables you to unconfigure server devices manually. This command marks the specified device as disabled. Any device marked disabled, whether manually or by the system firmware, is removed from the server’s machine description prior to transfer of control to other layers of system firmware, such as OBP. ? At the Oracle ILOM -> prompt, type: Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Reconfigure a Device Manually” on page 55 ¦ “Display Server Components” on page 67 ¦ “Locate Device Paths” on page 27 ? Reconfigure a Device Manually The Oracle ILOM firmware provides a component_state=enabled command, which enables you to reconfigure server devices manually. Use this command to mark the specified device as enabled. -> set component-name component_state=disabled56 SPARC T4 Series Servers Administration Guide • October 2011 ? At the Oracle ILOM -> prompt, type: Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Unconfigure a Device Manually” on page 55 ¦ “Display Server Components” on page 67 ¦ “Locate Device Paths” on page 27 -> set component-name component_state=enabled57 Monitoring the Server The SPARC T4 series servers provide many ways to indicate faulty behavior, including LEDs, Oracle ILOM, and POST. For specific information about LEDs, and for complete troubleshooting information, refer to the service manual for your server. ¦ “Monitoring Faults” on page 57 ¦ “Enabling Automatic System Recovery” on page 65 ¦ “Display Server Components” on page 67 ¦ “Locate the Server” on page 68 Monitoring Faults These topics contain a summary of diagnostic tools and basic information about finding server faults using pre-OS tools, including Oracle ILOM and POST. For complete troubleshooting information, see the service manual for your server. ¦ “Diagnostics Overview” on page 57 ¦ “Discover Faults (Oracle ILOM)” on page 59 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 59 ¦ “Discover Faults Using POST” on page 61 ¦ “Display Console History” on page 61 ¦ “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 63 ¦ “Clear a Fault” on page 64 Diagnostics Overview You can use a variety of diagnostic tools, commands, and indicators to monitor and troubleshoot a server. See the service manual for your server for complete information about these diagnostic tools:58 SPARC T4 Series Servers Administration Guide • October 2011 ¦ LEDs – Provide a quick visual notification of the status of the server and of some of the FRUs. ¦ Oracle ILOM – This firmware runs on the SP. In addition to providing the interface between the hardware and OS, Oracle ILOM also tracks and reports the health of key server components. Oracle ILOM works closely with POST and Oracle Solaris Predictive Self-Healing technology to keep the server running even when there is a faulty component. ¦ Power-on self-test – POST performs diagnostics on server components upon server reset to ensure the integrity of those components. POST is configureable and works with Oracle ILOM to take faulty components offline if needed. ¦ Oracle Solaris OS Predictive Self-Healing – This technology continuously monitors the health of the CPU, memory, and other components, and works with Oracle ILOM to take a faulty component offline if needed. The PSH technology enables servers to accurately predict component failures and mitigate many serious problems before they occur. ¦ Log files and command interface – Provide the standard Oracle Solaris OS log files and investigative commands that can be accessed and displayed on the device of your choice. ¦ SunVTS – An application that exercises the server, provides hardware validation, and discloses possible faulty components with recommendations for repair. The LEDs, Oracle ILOM, PSH, and many of the log files and console messages are integrated. For example, when the Oracle Solaris software detects a fault, it displays the fault, and logs it, and passes information to Oracle ILOM, where it is logged. Related Information ¦ “Discover Faults (Oracle ILOM)” on page 59 ¦ “Discover Faults Using POST” on page 61 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 59 ¦ See the server service manual section detecting and managing faultsMonitoring the Server 59 ? Discover Faults (Oracle ILOM) ? At the Oracle ILOM -> prompt, type: This command displays the target, the property, and the value of the fault. For example: Related Information ¦ “Discover Faults Using POST” on page 61 ¦ “Log In to Oracle ILOM” on page 9 ¦ “Locate the Server” on page 68 ¦ “Clear a Fault” on page 64 ¦ “Enabling Automatic System Recovery” on page 65 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 59 ? Discover Faults (Oracle ILOM Fault Management Shell) The Oracle ILOM Fault Management shell provides a way to use the Oracle Solaris Fault Manager commands (fmadm, fmstat) from within Oracle ILOM, and to view both host and Oracle ILOM faults. 1. To start the captive shell, at the Oracle ILOM -> prompt, type: -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgt/shell (y/n)? y faultmgmtsp>60 SPARC T4 Series Servers Administration Guide • October 2011 2. For a list of current server faults, type: Note – If the server detects the replacement of the faulty FRU, the repair does not require a user command, and the fault will be cleared automatically. 3. Discover more information about a specific fault. Find the fault MSG-ID (SPT-8000-DH in the preceeding example), and type it in the Search Knowledge Base search window at http://support.oracle.com. 4. For information on how to repair the fault, see: “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 63. 5. To leave the Fault Management shell and return to Oracle ILOM, type: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Monitoring the Server 61 Related Information ¦ “Oracle Solaris 10 OS Feature Spotlight: Predictive Self Healing” at www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ “Log In to Oracle ILOM” on page 9 ¦ “Discover Faults (Oracle ILOM)” on page 59 ¦ “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 63 ? Discover Faults Using POST The virtual keyswitch can be used to run full POST diagnostics without having to modify the diagnostic property settings. Note that POST diagnostics can take a significant amount of time to run at server reset. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. At the Oracle ILOM -> prompt, type: The server is set to run full POST diagnostics on server reset. 3. To return to your normal diagnostic settings after running POST, at the Oracle ILOM -> prompt, type: Related Information ¦ “Discover Faults (Oracle ILOM)” on page 59 ¦ “Locate the Server” on page 68 ¦ “Clear a Fault” on page 64 ? Display Console History This topic describes displaying the host server console output buffers. -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal62 SPARC T4 Series Servers Administration Guide • October 2011 There are two console history buffers that can contain up to 1 Mbyte of information. The /HOST/console/history target writes all types of log information. The /HOST/console/bootlog target writes boot information and initialization data into the console buffer until Oracle ILOM is notified by the server that the Oracle Solaris OS is up and running. This buffer is kept until the host is booted again. Note – You must have Oracle ILOM Administrator level user permission to use this command. 1. To manage the /HOST/console/history log, at the Oracle ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 1 to 2048 lines. Specify "" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of 1 to any valid integer or "" for infinite number of lines. The default is not to pause. ¦ start_from – The options are: ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. If you type the show /HOST/console/history command without first setting any arguments with the set command, Oracle ILOM displays all lines of the console log, starting from the end. Note – Timestamps recorded in the console log reflect server time. These timestamps reflect local time, and the Oracle ILOM console log uses UTC (Coordinated Universal Time). The Oracle Solaris OS system time is independent of the Oracle ILOM time. 2. To view the /HOST/console/bootlog, at the Oracle ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is not to pause. -> set /HOST/console/history property=option [...] -> show /HOST/console/history -> show /HOST/console/bootlog propertyMonitoring the Server 63 ¦ start_from – The options are: ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. Note – Timestamps in the console log reflect server time. By default, the Oracle ILOM console log uses Greenwich Mean Time (GMT), but you can use the /SP/clock timezone command to the set the SP clock to use other timezones. The Oracle Solaris OS system time is independent of the Oracle ILOM time. Related Information ¦ “Specify the Host Power State at Restart” on page 32 ? Repair a Fault (Oracle ILOM Fault Management Shell) You can use the fmadm repair command to fix faults diagnosed by Oracle ILOM. (Faults diagnosed by Oracle ILOM, rather than the host, have message IDs starting with “SPT.”) The only time you should use the fmadm repair command in the Oracle ILOM Fault Management shell for a host-diagnosed fault is when the fault is repaired and Oracle ILOM is unaware of the repair. For example, Oracle ILOM might be down when the fault is repaired. In that case, the host would no longer display the fault, yet the fault is still displayed in Oracle ILOM. Use the the fmadm repair command to clear the fault. 1. Locate the fault: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range.64 SPARC T4 Series Servers Administration Guide • October 2011 2. To repair an Oracle ILOM-detected fault, use the fmadm repair command: Note – You can use either the NAC name (for instance, /SYS/MB) or the UUID (for instance, fa4a2f86-5156-4243-8e88-d6516db12970) of the fault with the fmadm repair command. 3. To leave the Fault Management shell and return to Oracle ILOM, type: Related Information ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 59 ? Clear a Fault ? At the Oracle ILOM -> prompt, type: Setting clear_fault_action to true clears the fault at the component and all levels below it in the /SYS tree. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit -> -> set /SYS/component clear_fault_action=trueMonitoring the Server 65 Related Information ¦ “Discover Faults (Oracle ILOM)” on page 59 ¦ “Discover Faults Using POST” on page 61 ¦ “Display Server Components” on page 67 Enabling Automatic System Recovery These topics include information about configuring your server to automatically recover from minor faults. Note – This section refers to the automatic system recovery feature, not the similarly named auto service request feature. ¦ “Automatic System Recovery Overview” on page 65 ¦ “Enable ASR” on page 66 ¦ “Disable ASR” on page 66 ¦ “View Information on Components Affected by ASR” on page 67 Automatic System Recovery Overview The server provides for ASR from failures in memory modules or PCI cards. ASR functionality enables the server to resume operation after experiencing certain nonfatal hardware faults or failures. When ASR is enabled, the system’s firmware diagnostics automatically detect failed hardware components. An autoconfiguring capability designed into the system firmware enables the system to unconfigure failed components and to restore server operation. As long as the server is capable of operating without the failed component, the ASR features enable the server to reboot automatically, without operator intervention. Note – ASR is not activated until you enable it. See “Enable ASR” on page 66. For more information about ASR, refer to the service manual for your server. Related Information ¦ “Enable ASR” on page 6666 SPARC T4 Series Servers Administration Guide • October 2011 ¦ “Disable ASR” on page 66 ¦ “View Information on Components Affected by ASR” on page 67 ? Enable ASR 1. At the Oracle ILOM -> prompt, type: 2. At the ok prompt, type: Note – For more information about OpenBoot configuration variables, refer to the service manual for your server. 3. To cause the parameter changes to take effect, type: The server permanently stores the parameter changes and boots automatically when the OpenBoot configuration variable auto-boot? is set to true (its default value). Related Information ¦ “Automatic System Recovery Overview” on page 65 ¦ “Disable ASR” on page 66 ¦ “View Information on Components Affected by ASR” on page 67 ? Disable ASR 1. At the ok prompt, type: -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? true ok reset-all ok setenv auto-boot-on-error? falseMonitoring the Server 67 2. To cause the parameter changes to take effect, type: The server permanently stores the parameter change. After you disable the ASR feature, it is not activated again until you re-enable it. Related Information ¦ “Enable ASR” on page 66 ¦ “View Information on Components Affected by ASR” on page 67 ¦ “Automatic System Recovery Overview” on page 65 ? View Information on Components Affected by ASR ? At the Oracle ILOM -> prompt, type: In the show /SYS/component component_state command output, any devices marked disabled have been manually unconfigured using the system firmware. The command output also shows devices that have failed firmware diagnostics and have been automatically unconfigured by the system firmware. Related Information ¦ “Automatic System Recovery Overview” on page 65 ¦ “Enable ASR” on page 66 ¦ “Disable ASR” on page 66 ¦ “Unconfigure a Device Manually” on page 55 ¦ “Reconfigure a Device Manually” on page 55 ? Display Server Components View real-time information about the components installed in your server using the Oracle ILOM show components command. ok reset-all -> show /SYS/component component_state68 SPARC T4 Series Servers Administration Guide • October 2011 ? At the Oracle ILOM prompt, type: Note – This is a sample of show components output. Specific components will vary based on your server. Related Information ¦ “Locate Device Paths” on page 27 ? Locate the Server In case you need to service a component, lighting the system locator LED assists in easily identifying the correct server. You do not need administrator permissions to use the set /SYS/LOCATE and show /SYS/LOCATE commands. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. Manage the Locator LED with the following commands. ¦ To turn on the Locator LED, from the ILOM service processor command prompt, type: -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | Enabled /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_BlinkMonitoring the Server 69 ¦ To turn off the Locator LED, from the ILOM service processor command prompt, type: ¦ To display the state of the Locator LED, from the ILOM service processor command prompt, type: Related Information ¦ “Monitoring Faults” on page 57 ¦ “Configuring Devices” on page 55 -> set /SYS/LOCATE value=off -> show /SYS/LOCATE70 SPARC T4 Series Servers Administration Guide • October 201171 Updating the Firmware These topics describe how to update the system firmware and view current versions of firmware for Oracle’s SPARC T4 series servers. ¦ “Display the Firmware Version” on page 71 ¦ “Update the Firmware” on page 71 ¦ “Display OpenBoot Version” on page 74 ¦ “Display POST Version” on page 74 ? Display the Firmware Version The /HOST sysfw_version property displays information about the system firmware version on the host. ? View the current setting for this property. At the Oracle ILOM -> prompt, type: Related Information ¦ “Update the Firmware” on page 71 ? Update the Firmware 1. Ensure that the Oracle ILOM SP network management port is configured. See the installation guide for your server for instructions. -> show /HOST sysfw_version72 SPARC T4 Series Servers Administration Guide • October 2011 2. Open an SSH session to connect to the SP: 3. Power off the host: 4. Set the keyswitch_state parameter to normal: 5. Type the load command with the path to the new flash image. The load command updates the SP flash image and the host firmware. The load command requires the following information: ¦ IP address of a TFTP server on the network that can access the flash image. ¦ Full path name to the flash image that the IP address can access. The command usage is as follows: load [-script] -source tftp://xxx.xxx.xx.xxx/pathname where: ¦ -script - Does not prompt for confirmation and acts as if yes was specified. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalUpdating the Firmware 73 ¦ -source - Specifies the IP address and full path name (URL) to the flash image. After the flash image has been updated, the server automatically resets, runs diagnostics, and returns to the login prompt on the serial console. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open74 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “Display the Firmware Version” on page 71 ? Display OpenBoot Version The /HOST obp_version property displays information about the version of OpenBoot on the host. ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 71 ¦ “OpenBoot Overview” on page 3 ? Display POST Version The /HOST post_version property displays information about the version of POST on the host. Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionUpdating the Firmware 75 ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 71 -> show /HOST post_version76 SPARC T4 Series Servers Administration Guide • October 201177 Identifying WWN-Enabled SAS2 Devices These topics explain how to identify SAS2 devices based on their WWN values. ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 78 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 World Wide Name Syntax The Oracle Solaris OS uses the World Wide Name (WWN) syntax in place of the locally unique tn (target ID) field in logical device names. This change affects how device names can be mapped to specific SCSI devices. The following points are key to understanding the impact of this change: ¦ Before the change to WWN nomenclature, the Oracle Solaris OS would ordinarily identify the default boot device as c0t0d0. ¦ With the change, the device identifier for the default boot device is now referred to as c0tWWNd0, where WWN is a hexadecimal value that is unique to this device throughout the world. ¦ This WWN value is assigned by the manufacturer of the device and, therefore, has a random relationship to the server’s device tree structure. Because WWN values do not conform to the traditional logical device name structure, you cannot directly identify a target device from its c#tWWNd# value. Instead, you can use one of the following alternative methods to map WWN-based device names to physical devices.78 SPARC T4 Series Servers Administration Guide • October 2011 ¦ One method consists of analyzing the output of the OBP command probe-scsi-all. You use this method when the OS is not running. See “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 78 for more information. Note – For example, you would analyze probe-scsi-all output when you want to identify a boot device. ¦ When the OS is running, you can analyze the output of the command prtconf -v. See “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 for more information. Related Information ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 78 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command) These topics explain how to map WWN values to specific SAS2 drives using the OBP command probe-scsi-all. Separate explanations are provided for each SPARC T4-x server model. ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-1)” on page 80 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-2)” on page 83 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs)” on page 86 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs)” on page 89 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-1B)” on page 92Identifying WWN-Enabled SAS2 Devices 79 probe-scsi-all WWN Mapping Overview The output displayed by probe-scsi-all lists all SCSI devices in the server and provides a basic set of information about each device. When analyzing the probe-scsi-all output, look for the following data fields: At a high level, the WWN mapping process consists of the following stages: ¦ Identify the physical location of the hard drive that is to be the target of the operation. ¦ Then identify the controller port that is attached to that physical location. ¦ Finally, find the WWN-based device name of the drive attached to that controller port. Examples of this process are provided for each of the SPARC T4 server models: ¦ SPARC T4-1 -- “probe-scsi-all WWN Mapping Example (SPARC T4-1)” on page 80 ¦ SPARC T4-2 -- “probe-scsi-all WWN Mapping Example (SPARC T4-2)” on page 83 ¦ SPARC T4-4 with four CPUs -- “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs)” on page 86 Entity Name Definition Target Each SAS drive is assigned a unique Target ID. SASDeviceName This is the WWN value assigned to the SAS drive by the manufacturer. The Oracle Solaris OS recognizes this name. SASAddress This is the WWN value assigned to a SCSI device that is recognized by the OBP firmware. PhyNum This is a hexidecimal ID of the controller port that is attached to the target drive. VolumeDeviceName (when a RAID volume is configured) This is the WWN value assigned to a RAID volume that is recognized by Oracle Solaris OS. VolumeDeviceName replaces the SASDeviceName of every SCSI device contained in the RAID volume. VolumeWWID (when a RAID volume is configured) This is the WWN-based value assigned to a RAID volume that is recognized by the OBP firmware. VolumeWWID replaces the SASAddress of every SCSI device contained in the RAID volume.80 SPARC T4 Series Servers Administration Guide • October 2011 ¦ SPARC T4-4 with two CPUs -- “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs)” on page 89 ¦ SPARC T4-1B -- “probe-scsi-all WWN Mapping Example (SPARC T4-1B)” on page 92 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 probe-scsi-all WWN Mapping Example (SPARC T4-1) The SPARC T4-1 server has two SAS2 RAID controllers on the motherboard. Each controller is connected to four slots on the disk backplane. The following table shows the PhyNum-to-disk slot mapping for the eight-slot SPARC T4-1 backplane. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-1 disk backplane. TABLE: SAS2 Controller Port Mapping for the SPARC T4-1 Disk Backplane SAS2 Controller Controller Port (PhyNum) Disk Slot SAS2 Controller Controller Port (PhyNum) Disk Slot 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLE: Physical Drive Locations in the SPARC T4-1 Disk Backplane Disk Slot 1 Disk Slot 3 Disk Slot 5 DVD Disk Slot 0 * Disk Slot 2 Disk Slot 4 Disk Slot 6 Disk Slot 7Identifying WWN-Enabled SAS2 Devices 81 The following example is based on a SPARC T4-1 server with eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive. The virtual drive consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: ¦ Controller 0 is attached to Targets 9 and b (two individual storage devices). ¦ Controller 0 is also attached to Target 523 (a RAID volume). ¦ Controller 1 is attached to Targets 9, b, c, and d (four individual storage devices). ¦ Controller 1 is also attached to Target a (a DVD unit). Note – For SPARC T4-1 servers, the second field of the device path specifies the controllers: /pci@400/pci@1 = controller 0 and /pci@400/pci@2 = controller 1. * Default boot drive ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 2 Target d Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca01201e544 SASAddress 5000cca01201e545 PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB82 SPARC T4 Series Servers Administration Guide • October 2011 In this example, the controller ports are attached to the hard drives and the DVD in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00a75dcac ¦ SASAddress = 5000cca00a75dcad If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 5, it has the following values: ¦ Controller = 1 ¦ Target = b SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 1 Target 523 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 0 0 * * Default boot drive 9 1 0 4 9 1 1 a 1 5 b 2 2 RAID Target 523 2 6 c 3 3 RAID Target 523 3 7 d 6 DVD aIdentifying WWN-Enabled SAS2 Devices 83 ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00a76e380 ¦ SASAddress = 5000cca00a76e381 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 probe-scsi-all WWN Mapping Example (SPARC T4-2) The SPARC T4-2 server has one SAS2 RAID controller on the motherboard. This controller is connected to six slots on the disk backplane. The following table shows the PhyNum-to-disk slot mapping for the six-slot SPARC T4-2 backplane. TABLE: SAS2 Controller Port Mapping for the SPARC T4-2 Disk Backplane SAS2 Controller Controller Port (PhyNum) Disk Slots and DVD 0 0 0 * * Default boot drive 1 1 2 2 3 3 4 4 5 5 6 Not connected 7 DVD84 SPARC T4 Series Servers Administration Guide • October 2011 The following example is based on a SPARC T4-2 server with six hard drives. These hard drives are deployed as four individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. The controller is attached to these devices in the following manner: ¦ Targets 9, d, e, and f (four individual storage devices). ¦ Target 389 (a RAID volume). ¦ Target a (a DVD unit). In this example, the controller ports are attached to the hard drives and the DVD in the following manner: ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 0 0 * 9 1 1 dIdentifying WWN-Enabled SAS2 Devices 85 Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c5001cb4a637 ¦ SASAddress = 5000c5001cb4a635 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 3, it has the following values: ¦ Controller = 0 ¦ Target = f ¦ PhyNum = 3 ¦ SASDeviceName = 5000c5001cb47f7f ¦ SASAddress = 5000c5001cb47f7d Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 2 2 e 3 3 f 4 4 RAID Target 389 5 5 RAID Target 389 6 Not connected -- 7 DVD a * Default boot drive SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target86 SPARC T4 Series Servers Administration Guide • October 2011 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs) The SPARC T4-4 server has two REM cards plugged into the motherboard. These modules are referred to as controllers 0 and 1. Each SAS controller is connected to a separate four-slot disk backplane. The following table shows the PhyNum-to-disk slot mapping for the two four-slot SPARC T4-4 backplanes. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-4 disk backplane. The following example is based on a SPARC T4-4 server with four CPUs and eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: TABLE: SAS2 Controller Port Mapping for the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLE: Physical Drive Locations in the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 Disk Slot 1 Disk Slot 3 Disk Slot 5 Disk Slot 7 Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 4 Disk Slot 6Identifying WWN-Enabled SAS2 Devices 87 ¦ Controller 0 is attached to Targets 9 and a (two individual storage devices). ¦ Controller 0 is also attached to Target 688 (a RAID volume). ¦ Controller 1 is attached to Targets 9, a, b, and c (four individual storage devices). Note – OBP uses a different device path for SAS controller 1 in SPARC T4-4 servers, depending on whether the server has four processors or two processors.The path for SAS controller 0 is the same for both processor configurations. In this example, the controller ports are attached to the hard drives in the following manner: ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 688 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok88 SPARC T4 Series Servers Administration Guide • October 2011 Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 1, it has the following values: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 Disk Backplane 0 Disk Backplane 1 Controller Port (PhyNum) Disk Slot ID Target Controller Port (PhyNum) Disk Slot ID Target 0 0 * * Default boot drive 9 0 4 9 1 1 a 1 5 a 2 2 RAID Target 688 2 6 b 3 3 RAID Target 688 3 7 cIdentifying WWN-Enabled SAS2 Devices 89 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs) The SPARC T4-4 server has two REM cards plugged into the motherboard. These modules are referred to as controllers 0 and 1. Each SAS controller is connected to a separate four-slot disk backplane. The following table shows the PhyNum-to-disk slot mapping for the two four-slot SPARC T4-4 backplanes. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-4 disk backplane. The following example is based on a SPARC T4-4 server with two CPUs and eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: TABLE: SAS2 Controller Port Mapping for the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLE: Physical Drive Locations in the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 Disk Slot 1 Disk Slot 3 Disk Slot 5 Disk Slot 7 Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 4 Disk Slot 690 SPARC T4 Series Servers Administration Guide • October 2011 ¦ Controller 0 is attached to Targets 9 and a (two individual storage devices). ¦ Controller 0 is also attached to Target 457 (a RAID volume). ¦ Controller 1 is attached to Targets 9, a, b, and c (four individual storage devices). Note – OBP uses a different device path for SAS controller 1 in SPARC T4-4 servers, depending on whether the server has four processors or two processors.The path for SAS controller 0 is the same for both processor configurations. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 457 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 okIdentifying WWN-Enabled SAS2 Devices 91 In this example, the controller ports are attached to the hard drives in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 1, it has the following values: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 Disk Backplane 0 Disk Backplane 1 Controller Port (PhyNum) Disk Slot ID Target Controller Port (PhyNum) Disk Slot ID Target 0 0 * * Default boot drive 9 0 4 9 1 1 a 1 5 a 2 2 RAID Target 457 2 6 b 3 3 RAID Target 457 3 7 c92 SPARC T4 Series Servers Administration Guide • October 2011 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 probe-scsi-all WWN Mapping Example (SPARC T4-1B) The SPARC T4-1B blade has two SCSI disk slots in its disk backplane. A Sun Blade 6000 RAID 0/1 SAS2 HBA REM, which is plugged into the motherboard, manages storage devices installed in these backplane slots. The following table shows the PhyNum-to-disk slot mapping for the two-slot SPARC T4-1B backplane. The following example is based on a SPARC T4-1B blade with both hard drives attached to the controller as individual storage devices. TABLE: SAS2 Controller Port Mapping for the SPARC T4-1B Disk Backplane Controller Port (PhyNum) 0 Controller Port (PhyNum) 1 Disk Slot ID 0 * * Default boot drive Disk Slot ID 1 ok probe-scsi-all /pci@400/pci@1/pci@0/pci@c/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c500231694cf SASAddress 5000c500231694cd PhyNum 0 Target a Unit 0 Disk SEAGATE ST973402SSUN72G 0603 143374738 Blocks, 73 GB SASDeviceName 5000c50003d37fcb SASAddress 5000c50003d37fc9 PhyNum 1 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 okIdentifying WWN-Enabled SAS2 Devices 93 In this example, the controller ports are attached to the hard drives in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c500231694cf ¦ SASAddress = 5000c500231694cd If you want to specify the hard drive in disk slot 1 to be the boot device, it would have the following values in this example: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000c50003d37fcb ¦ SASAddress = 5000c50003d37fc9 The following example is based on a SPARC T4-1B blade with both hard drives attached to the controller as a RAID volume. Controller Port (PhyNum) 0 Controller Port (PhyNum) 1 Target 9 (Disk Slot ID 0) Target a (Disk Slot ID 1) ok probe-scsi-all /pci@400/pci@1/pci@0/pci@2/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 377 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@294 SPARC T4 Series Servers Administration Guide • October 2011 In this example, the controller ports are attached to a RAID volume containing the hard drives installed in disk slots 0 and 1. Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 ? Identify a Disk Slot Using prtconf (Oracle Solaris OS) The procedure described below applies to SPARC T4-1 and SPARC T4-4 servers, which have eight-disk backplane configurations. The same methodology can be used for the SPARC T4-2 server and SPARC T4-1B blade systems. 1. Run the format command. The remaining steps in this example will identify the physical slot that corresponds to the device name c0t5000CCA00ABBAEB8d0. Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]Identifying WWN-Enabled SAS2 Devices 95 2. Run prtconf -v and search for the device link containing the device name c0t5000CCA00ABBAEB8d0. 3. Search the prtconf output for the name=’wwn’ entry that shows the WWN value 5000cca00abbaeb8. Note the obp-path value listed under WWN 5000cca00abbaeb8. Refer to the following table to find the controller. For SPARC T4-1 servers, the controller is identified in the second field: pci@1 = controller 0 and pci@2 = controller 1. For SPARC T4-4 servers, the controller is identified in the first field. For systems with a four-processor configuration, pci@400 = controller 0 and pci@700 = controller 1. For systems with a two-processor configuration, pci@400 = controller 0 and pci@500 = controller 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/rsd3a SPARC T4-1 Controller 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (4 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (2 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,096 SPARC T4 Series Servers Administration Guide • October 2011 Note – Because SPARC T4-2 and SPARC T4-1B systems contain only one SAS controller, only controller 0 will be listed. The following output example shows the obp-path for a SPARC T4-1 server. In this SPARC T4-1 example, the obp-path is: Based on the previous table, this disk is on controller 0. The following output example shows the obp-path for a SPARC T4-4 server. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’Identifying WWN-Enabled SAS2 Devices 97 In this SPARC T4-4 example, the obp-path is: Based on the previous table, this disk is on controller 0. 4. This phy-num value corresponds to physical disk slot 0, as shown in the following port mapping table. Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 WWN Syntax in an OS Installation on an Individual Drive The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the operating system on a specific disk drive. In this example, the device name contains the WWN value 5000CCA00A75DCAC. Note – All alpha characters in the WWN value must be capitalized. /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SAS Controller PhyNum Disk Slot SAS Controller PhyNum Disk Slot 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve98 SPARC T4 Series Servers Administration Guide • October 2011 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 78 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 99 WWN Syntax in an OS Installation on a RAID Volume The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the OS on a RAID volume. When installing software on a RAID volume, use the virtual device’s VolumeDeviceName instead of an individual device name. In this example, the RAID volume name is 3ce534e42c02a3c0. archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapIdentifying WWN-Enabled SAS2 Devices 99 Related Information ¦ “World Wide Name Syntax” on page 77 ¦ “probe-scsi-all WWN Mapping Overview” on page 79 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 78 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 95 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 98100 SPARC T4 Series Servers Administration Guide • October 2011101 Glossary A ANSI SIS American National Standards Institute Status Indicator Standard. ASR Automatic system recovery. B blade Generic term for server modules and storage modules. See server module and storage module. blade server Server module. See server module. BMC Baseboard management controller. BOB Memory buffer on board. C chassis For servers, refers to the server enclosure. For server modules, refers to the modular system enclosure. CMA Cable management arm. CMM Chassis monitoring module. The CMM is the service processor in the modular system. Oracle ILOM runs on the CMM, providing lights out management of the components in the modular system chassis. See Modular system and Oracle ILOM.102 SPARC T4 Series Servers Administration Guide • October 2011 CMM Oracle ILOM Oracle ILOM that runs on the CMM. See Oracle ILOM. D DHCP Dynamic Host Configuration Protocol. disk module or disk blade Interchangeable terms for storage module. See storage module. DTE Data terminal equipment. E ESD Electrostatic discharge. F FEM Fabric expansion module. FEMs enable server modules to use the 10GbE connections provided by certain NEMs. See NEM. FRU Field-replaceable unit. H HBA Host bus adapter. host The part of the server or server module with the CPU and other hardware that runs the Oracle Solaris OS and other applications. The term host is used to distinguish the primary computer from the SP. See SP.Glossary 103 I ID PROM Chip that contains system information for the server or server module. IP Internet Protocol. K KVM Keyboard, video, mouse. Refers to using a switch to enable sharing of one keyboard, one display, and one mouse with more than one computer. M MAC or MAC address Media access controller address. Modular system The rackmountable chassis that holds server modules, storage modules, NEMs, and PCI EMs. The modular system provides Oracle ILOM through its CMM. MSGID Message identifier. N name space Top-level Oracle ILOM CMM target. NEM Network express module. NEMs provide 10/100/1000 Ethernet, 10GbE Ethernet ports, and SAS connectivity to storage modules. NET MGT Network management port. An Ethernet port on the server SP, the server module SP, and the CMM. NIC Network interface card or controller. NMI Nonmaskable interrupt.104 SPARC T4 Series Servers Administration Guide • October 2011 O OBP OpenBoot PROM. Oracle ILOM Oracle Integrated Lights Out Manager. Oracle ILOM firmware is preinstalled on a variety of Oracle systems. Oracle ILOM enables you to remotely manage your Oracle servers regardless of the state of the host system. Oracle Solaris OS Oracle Solaris operating system. P PCI Peripheral component interconnect. PCI EM PCIe ExpressModule. Modular components that are based on the PCI Express industry-standard form factor and offer I/O features such as Gigabit Ethernet and Fibre Channel. POST Power-on self-test. PROM Programmable read-only memory. PSH Predictive self healing. Q QSFP Quad small form-factor pluggable. R REM RAID expansion module. Sometimes referred to as an HBA See HBA. Supports the creation of RAID volumes on drives.Glossary 105 S SAS Serial attached SCSI. SCC System configuration chip. SER MGT Serial management port. A serial port on the server SP, the server module SP, and the CMM. server module Modular component that provides the main compute resources (CPU and memory) in a modular system. Server modules might also have onboard storage and connectors that hold REMs and FEMs. SP Service processor. In the server or server module, the SP is a card with its own OS. The SP processes Oracle ILOM commands providing lights out management control of the host. See host. SSD Solid-state drive. SSH Secure shell. storage module Modular component that provides computing storage to the server modules. U UCP Universal connector port. UI User interface. UTC Coordinated Universal Time. UUID Universal unique identifier. W WWN World-wide number. A unique number that identifies a SAS target.106 SPARC T4 Series Servers Administration Guide • October 2011107 Index Symbols -> prompt about, 1 ways to access, 12 A Automatic System Recovery (ASR) disabling, 66 enabling, 66 viewing affected components, 67 B boot mode expiration date, 49 managing at reset, 47 managing con?guration, 46 managing script, 48 managing system, 45 Oracle VM Server (LDoms), 46 overview, 45 C cables, keyboard and mouse, 13 console history, displaying, 61 D device paths, 27 devices con?guring, 56 managing, 55 uncon?guring, 55 DHCP server, displaying IP Address, 38 diagnostics, 57 F faults bypassing, 65 clearing, 64 discovering with ILOM, 59 discovering with POST, 61 handling, 57 FCode utility commands, 22 RAID, 21 ?rmware, updating, 71 FRU data, changing, 29 H host power state managing power-on delay, 33 restoring at restart, 32 speci?ng at restart, 32 I ILOM accessing the system console, 10 default username and password, 10 logging in, 9 overview, 1 parallel boot policy, 34 platform-speci?c features, 2 prompt, 10, 12 speci?ng host power state property, 32 K keyboard, attaching, 13 keyswitch, specifying host behavior, 34 L local graphics monitor, 13 locating the server, 68108 SPARC T4 Series Servers Administration Guide • October 2011 M MAC address, displaying host, 40 multipathing software, 4 N network access, enabling or disabling, 38 network address options, 37 O ok prompt, displaying, 11 OpenBoot displaying version, 74 setting con?guration variables, 13 Oracle VM Server for SPARC overview, 4 P POST displaying version, 71, 74 running diagnostics, 61 power off, 16 power on, 15 R RAID con?guring, 19 creating volumes, 22 FCode utility, 21 support, 19 restart behavior setting the boot timeout interval, 52 specifying behavior at boot timeout, 53 specifying behavior if restart fails, 53 specifying behavior when host stops running, 52 specifying max restart attempts, 54 specifying on host reset, 51 S server controlling, 15 resetting from ILOM, 17 resetting from the OS, 17 SP, resetting, 18 SunVTS, 58 system administration overview, 1 system communication, 9 system console, logging in, 10 system identi?cation, changing, 30 SPARC T4-1 Server Service Manual Part No. E22990-02 October 2011, Revision APlease Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation xi Identifying Server Components 1 Front Components 1 Rear Components 2 Infrastructure Boards in the SPARC T4-1 Server 3 Internal System Cables 4 Illustrated Parts Breakdown 5 Motherboard Components 5 I/O Components 7 Power Distribution and Fan Module Components 9 Understanding Hard Drive Data Cable Routing 12 Cable Routing Diagram for the Onboard SAS RAID Controller 12 Cable Routing Diagram for the PCIe SAS RAID HBA 13 Detecting and Managing Faults 15 Diagnostics Overview 15 Diagnostics Process 16 Interpreting Diagnostic LEDs 20 Front Panel System Controls and LEDs 20 Rear Panel System LEDs 22 LEDs for the Ethernet Ports and NET MGT port 23 Managing Faults (Oracle ILOM) 24iv SPARC T4-1 Server Service Manual • October 2011 Oracle ILOM Troubleshooting Overview 25 ? Access the SP (Oracle ILOM) 27 ? Display FRU Information (show Command) 29 ? Check for Faults (show faulty Command) 30 ? Check for Faults (fmadm faulty Command) 31 ? Clear Faults (clear_fault_action Property) 32 Service-Related Oracle ILOM Commands 34 Understanding Fault Management Commands 36 No Faults Detected Example (show faulty Command) 37 Power Supply Fault Example (show faulty Command) 37 Power Supply Fault Example (fmadm faulty Command) 38 POST-Detected Fault Example (show faulty Command) 39 PSH-Detected Fault Example (show faulty Command) 40 Interpreting Log Files and System Messages 41 ? Check the Message Buffer 41 ? View the System Message Log Files 42 Checking if Oracle VTS Software Is Installed 43 Oracle VTS Overview 43 ? Check if Oracle VTS Is Installed 44 Managing Faults (POST) 45 POST Overview 45 Oracle ILOM Properties That Affect POST Behavior 46 ? Configure POST 49 ? Run POST With Maximum Testing 50 ? Interpret POST Fault Messages 51 ? Clear POST-Detected Faults 51 POST Output Reference 53 Managing Faults (PSH) 55Contents v PSH Overview 56 PSH-Detected Fault Example 57 ? Check for PSH-Detected Faults 57 ? Clear PSH-Detected Faults 59 Managing Components (ASR) 61 ASR Overview 62 ? Display System Components 63 ? Disable System Components 63 ? Enable System Components 64 Preparing for Service 67 Safety Information 67 Safety Symbols 67 ESD Measures 68 Antistatic Wrist Strap Use 68 Antistatic Mat 68 Tools Needed for Service 69 ? Find the Chassis Serial Number 69 ? Locate the Server 70 Understanding Component Replacement Categories 70 FRU Reference 71 Hot Service, Replaceable by Customer 72 Cold Service, Replaceable by Customer 73 Cold Service, Replaceable by Authorized Service Personnel 74 Removing Power From the System 74 ? Power Off the Server (SP Command) 75 ? Power Off the Server (Power Button - Graceful) 76 ? Power Off the Server (Emergency Shutdown) 76 ? Disconnect Power Cords 76vi SPARC T4-1 Server Service Manual • October 2011 Positioning the System for Service 77 ? Extend the Server 77 ? Release the CMA 78 ? Remove the Server From the Rack 79 Accessing Internal Components 81 ? Perform Electrostatic Discharge Prevention Measures 82 ? Remove the Top Cover 82 Servicing DIMMs 85 Memory Fault Handling Overview 85 ? Locate a Faulty DIMM Using the Remind Button 86 ? Identify Faulty DIMMs Using the show faulty Command 89 ? Remove a DIMM 89 ? Install a DIMM 91 ? Increase System Memory With Additional DIMMs 93 ? Verify DIMM Functionality 96 Memory Configuration Guidelines 98 DIMM Configuration Error Messages 101 Servicing Hard Drives 103 Hard Drive Hot-Pluggable Capabilities 103 Hard Drive Slot Configuration Reference 104 Drive Backplane Slot Configuration Reference 104 Hard Drive LEDs 105 ? Remove a Hard Drive 107 ? Install a Hard Drive 109 ? Verify the Functionality of a Hard Drive 110 Servicing the DVD/USB Assembly 113 DVD/USB Assembly Overview 113Contents vii ? Remove the DVD/USB Assembly 114 ? Install the DVD/USB Assembly 115 Servicing the Power Supplies 117 Power Supply Hot-Swap Capabilities 117 Power Supply LEDs 117 ? Locate a Faulty Power Supply 119 ? Remove a Power Supply 119 ? Install a Power Supply 120 ? Verify the Functionality of a Power Supply 122 ? Remove or Install a Power Supply Filler Panel 122 Servicing the Power Distribution Board 125 Power Distribution Board Overview 125 ? Remove the Power Distribution Board 126 ? Install the Power Distribution Board 127 Servicing the Power Supply Backplane 131 Power Supply Backplane Overview 131 ? Remove the Power Supply Backplane 132 ? Install the Power Supply Backplane 133 Servicing the Connector Board 135 Connector Board Overview 135 ? Remove the Connector Board 135 ? Install the Connector Board 137 Servicing PCIe and PCIe/XAUI Risers 141 ? Remove a PCIe or PCIe/XAUI Riser 141 ? Install a PCIe or PCIe/XAUI Riser 143viii SPARC T4-1 Server Service Manual • October 2011 Servicing PCIe Cards 145 PCIe Card Configuration Reference 145 ? Remove a PCIe or XAUI Card 146 ? Install a PCIe or XAUI Card 148 Servicing SAS PCIe RAID HBA Cards 151 ? Remove a SAS PCIe RAID HBA Card 151 ? Install a SAS PCIe RAID HBA Card 153 Servicing the Service Processor 155 Service Processor Overview 155 ? Remove the Service Processor 156 ? Install the Service Processor 157 Servicing the System Battery 161 ? Replace the System Battery 161 ? Verify the System Battery 163 Servicing Fan Modules 165 Fan Configuration Reference 165 Fan Module LEDs 166 ? Locate a Faulty Fan Module 168 ? Remove a Fan Module 169 ? Install a Fan Module 170 Servicing the Fan Power Board 173 Fan Power Board Overview 173 ? Remove the Fan Power Board 173 ? Install the Fan Power Board 176 Servicing the System Configuration PROM 179Contents ix System Configuration PROM Overview 179 ? Remove the System Configuration PROM 180 ? Install the System Configuration PROM 181 ? Verify the System Configuration PROM 185 Servicing the HDD Cage 187 Hard Drive Cage Overview 187 ? Remove the Hard Drive Cage 187 ? Install the Hard Drive Cage 190 Servicing the HDD Backplane 193 Hard Drive Backplane Overview 193 ? Remove the Hard Drive Backplane 193 ? Install the Hard Drive Backplane 196 Servicing the Front Panel Light Pipe Assemblies 201 Front Panel Light Pipe Assemblies Overview 201 ? Remove the Front Panel Light Pipe Assembly (Right or Left) 202 ? Install the Front Panel Light Pipe Assembly (Right or Left) 204 Servicing the Motherboard Assembly 207 Motherboard Servicing Overview 207 ? Remove the Motherboard Assembly 208 ? Install the Motherboard Assembly 211 Returning the Server to Operation 215 ? Replace the Top Cover 215 ? Reinstall the Server in the Rack 216 ? Return the Server to the Normal Rack Position 217 ? Reconnect the Power Cords 218 ? Power On the Server (start /SYS Command) 218x SPARC T4-1 Server Service Manual • October 2011 ? Power On the Server (Power Button) 218 Glossary 221 Index 225xi Using This Documentation This service manual contains instructions for troubleshooting, repairing, and upgrading Oracle’s SPARC T4-1 server components. ¦ “Related Documentation” on page xi ¦ “Feedback” on page xii ¦ “Support and Accessibility” on page xii Related Documentation Feedback Provide feedback on this documentation at: Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 Server http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1 Oracle ILOM 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle Solaris OS and other systems software http://www.oracle.com/technetwork/indexes/documentation/ index.html#sys_sw Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0xii SPARC T4-1 Server Service Manual • October 2011 http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 Identifying Server Components These topics identify key components of the SPARC T4-1 servers, including major boards and internal system cables, as well as front and rear panel features. ¦ “Front Components” on page 1 ¦ “Rear Components” on page 2 ¦ “Infrastructure Boards in the SPARC T4-1 Server” on page 3 ¦ “Internal System Cables” on page 4 ¦ “Illustrated Parts Breakdown” on page 5 Front Components The following figure shows the layout of the server front panel, including the power and system locator buttons and the various status and fault LEDs. Note – The front panel also provides access to internal hard drives, the removable media drive, and the two front USB ports.2 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Components Accessible From the Front Panel Related Information ¦ “Rear Components” on page 2 Rear Components The following figure shows the layout of the I/O ports, PCIe ports, 10 Gbit Ethernet (XAUI) ports (if equipped) and power supplies on the rear panel. Figure Legend 1 System controls and indicators 8 Hard drive HDD5 2 RFID tag 9 Hard drive HDD6 3 Hard drive HDD0 * * In this server’s documentation, hard drives are sometimes referred to by the initials HDD. The terms “Hard drive” and “HDD” are used for both disk drives and solid state drives. 10 Hard drive HDD7 4 Hard drive HDD1 11 SATA DVD module 5 Hard drive HDD2 12 USB port 2 6 Hard drive HDD3 13 USB port 3 7 Hard drive HDD4Identifying Server Components 3 FIGURE: Rear Panel Components and Indicators Related Information ¦ “Front Components” on page 1 Infrastructure Boards in the SPARC T4-1 Server The following table provides an overview of the circuit boards used in SPARC T4-1 servers. Figure Legend 1 Power supply 0 12 Gbit Enet port NET3 2 Power supply 1 13 USB port 0 3 Locator LED button 14 USB port 1 4 Service Required LED 15 VGA video port 5 Power OK LED 16 PCIe slot 3 6 Service processor SER MGT port 17 PCIe or XAUI slot 0 7 Service processor NET MGT port 18 PCIe slot 4 8 Gbit Enet port NET0 19 PCIe or XAUI slot 1 9 Gbit Enet port NET1 20 PCIe slot 5 10 Gbit Enet port NET2 21 PCIe slot 2 11 Gbit Enet port NET24 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Internal System Cables” on page 4 ¦ “Cable Routing Diagram for the Onboard SAS RAID Controller” on page 12 ¦ “Cable Routing Diagram for the PCIe SAS RAID HBA” on page 13 Internal System Cables The following table identifies the internal system cables used in SPARC T4-1 servers. Board Description Motherboard This board includes one CMP module, slots for 16 DIMM memory control subsystems, and a pluggable service processor module on which the Oracle Integrated Lights Out Manager (Oracle ILOM) runs. It also hosts a removable System Controller module (also called SCC), which contains all MAC addresses and host ID data. Power distribution board This board distributes main 12V power from the power supplies to the rest of the system. This board is directly connected to the connector board, and to the motherboard via a bus bar and ribbon cables. This board also supports a top cover safety interlock (“kill”) switch. Power supply backplane This board carries 12V power from the power supplies to the power distribution board over a pair of bus bars. It also delivers 3.3V standby power In SPARC T4-1 servers, the power supplies connect directly to the power distribution board. Connector board This board serves as the interconnect between the power distribution board and the fan power board, disk drive backplane, and front I/O board. Fan power board This board carries power to the system fan modules and fan module status LEDs. It also transmits status and control signals for the fan modules. Hard drive backplane This board provides connectors for the hard drive signal cables. It also serves as the interconnect for the front I/O board, Power and Locator buttons, and system/component status LEDs. Front I/O board This board connects directly to the hard drive backplane. It is packaged with the DVD drive as a single unit.Identifying Server Components 5 Related Information ¦ “Infrastructure Boards in the SPARC T4-1 Server” on page 3 Illustrated Parts Breakdown The following topics identify the components that may be individually replaced in the field. They are grouped into three functional categories: ¦ Components related to the motherboard, including the motherboard ¦ Components that support I/O functions ¦ Components related to power distribution and the fan modules Motherboard Components The following figure illustrates field-replaceable components related to the motherboard. Cable Description Top cover interlock cable This cable connects the safety interlock switch on the top cover to the power distribution board. When the top cover is removed, this connection is broken, which causes the server to power down. Power supply backplane signal cable (1 ribbon cable) This cable carries signals between the power supply backplane and the power distribution board. Motherboard signal cable (1 ribbon cable) This cable carries signals between the power distribution board and the motherboard. Hard drive data cables (2 bundled) This cable carries data and control signals between the motherboard and the hard drive backplane. SATA DVD data cable This cable carries data and control signals between the motherboard and the DVD module. Power and fan management data cables between the connector board and the fan power distribution board These cables distribute power to the fan power board as well as carry control and sensor information between the fan modules and the connector board.6 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Motherboard Components The following table identifies the components located on the motherboard and points to instructions for servicing them.Identifying Server Components 7 I/O Components The following figure illustrates field-replaceable components that support I/O functions. TABLE: Motherboard Components Item FRU Replacement Instructions Notes FRU Name (If Applicable) 1 PCIe/XAUI risers “Servicing PCIe and PCIe/XAUI Risers” on page 141 Back panel PCI cross beam must be removed to access risers. /SYS/MB/RISER0 /SYS/MB/RISER1 /SYS/MB/RISER2 2 DIMMs “Identify Faulty DIMMs Using the show faulty Command” on page 89 “Locate a Faulty DIMM Using the Remind Button” on page 86 See configuration rules before upgrading DIMMs. See “Memory Configuration Guidelines” on page 98 3 Motherboard assembly “Identifying Server Components” on page 1 The motherboard assembly must be removed to access power distribution board, power supply backplane, and connector board. /SYS/MB 4 Service Processor “Servicing the Service Processor” on page 155 The system management firmware (Oracle ILOM) runs on the Service Processor. /SYS/MB/SP 5 SCC module “Servicing the System Configuration PROM” on page 179 Contains the host ID and MAC address. /SYS/MB/SCC 6 Battery “Servicing the System Battery” on page 161 Necessary for system clock and other functions. /SYS/MB/V_VBAT 7 Removable back panel cross beam “Servicing PCIe and PCIe/XAUI Risers” on page 141 Remove this component to service PCIe/XAUI risers and cards. N/A8 SPARC T4-1 Server Service Manual • October 2011 FIGURE: I/O Components The following table identifies the I/O components in the server and points to instructions for servicing them.Identifying Server Components 9 Power Distribution and Fan Module Components The following figure illustrates field-replaceable components related to power distribution and the fan modules. TABLE: I/O Components Item FRU Replacement Instructions Notes FRU Name (If Applicable) 1 Top cover “Remove the Top Cover” on page 82 “Replace the Top Cover” on page 215 Removing top cover if the system is running will result in immediate shutdown. N/A 2 Hard drive backplane “Servicing the HDD Cage” on page 187 The HDD backplane provides data and control signal connectors for the hard drives. It also provides connection to the front panel control and status components. /SYS/SASBP 3 Hard drive cage “Servicing the HDD Backplane” on page 193 Must be removed to service hard drive backplane and front control panel light pipes. N/A 4 Right control panel light pipe assembly “Servicing the Front Panel Light Pipe Assemblies” on page 201 The metal light pipe bracket is not a FRU. N/A 5 DVD/USB module “Identifying Server Components” on page 1 Must be removed to service the hard drive backplane. /SYS/DVD /SYS/USBBD 6 Hard drives “Servicing Hard Drives” on page 103 Hard drives must be removed to service the hard drive backplane. See “Hard Drive Slot Configuration Reference” on page 104 7 Left control panel light pipe assembly “Servicing the Front Panel Light Pipe Assemblies” on page 201 Metal light pipe bracket is not a FRU. N/A10 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Power Distribution/Fan Module Components The following table identifies the power distribution and fan module components in the server and points to instructions for servicing them.Identifying Server Components 11 TABLE: Power Distribution/Fan Module Components Item FRU Replacement Instructions Notes FRU Name (If Applicable) 1 Fan modules “Servicing Fan Modules” on page 165 All six fan modules must be installed in the server. Includes the top cover interlock switch. /SYS/FANBD0/FM0 /SYS/FANBD0/FM1 /SYS/FANBD0/FM2 /SYS/FANBD0/FM3 /SYS/FANBD0/FM4 /SYS/FANBD0/FM5 /SYS/CONNBD 2 Fan power board “Servicing the Fan Power Board” on page 173 The fan power board delivers power to the fan modules and carries control and status signals for the fan modules. The fan power board is connected to the connector board. /SYS/FANBD0 3 Air duct N/A This molded plastic part directs air flow within the chassis. N/A 4 Power supplies “Servicing the Power Supplies” on page 117 Two power supplies provide N+1 redundancy. /SYS/PS0 /SYS/PS1 5 Power supply backplane “Servicing the Power Supply Backplane” on page 131 This part is bundled with the power distribution board. N/A 6 Power distribution board/bus bar “Servicing the Power Distribution Board” on page 125 The PDB distributes 12V power received from the power supplies. The bus bar is attached to the PDB by four screws. If you replace a PDB, you must transfer the bus to the new board. /SYS/PDB 7 Connector board “Servicing the Connector Board” on page 135 It is connected to the connector board though power and data cables. The data cable carries control status signals. /SYS/CONNBD12 SPARC T4-1 Server Service Manual • October 2011 Understanding Hard Drive Data Cable Routing These topics describe the correct data cable routing paths for two different hard drive management configurations: Cable Routing Diagram for the Onboard SAS RAID Controller The following figure shows the correct path for routing the two hard drive data cables from the SAS RAID controller connectors on the motherboard to the corresponding connectors on the hard drive backplane. Description Links Servers that use the onboard SAS RAID controller for storage management on the hard drives “Cable Routing Diagram for the Onboard SAS RAID Controller” on page 12 Servers that use a PCIe SAS RAID HBA for storage management on the hard drives “Cable Routing Diagram for the PCIe SAS RAID HBA” on page 13Identifying Server Components 13 FIGURE: Internal Cables for the Onboard SAS Cables Cable Routing Diagram for the PCIe SAS RAID HBA The following figure shows the correct path for routing the two hard drive data cables from the PCIe SAS RAID HBA connectors to the corresponding connectors on the hard drive backplane. Figure Legend 1 Connectors on motherboard 2 HDD data cables 3 Connectors on HDD backplane14 SPARC T4-1 Server Service Manual • October 2011 FIGURE: HDD Data Cables for the SAS 2.0 RAID HBA Related Information ¦ “Servicing SAS PCIe RAID HBA Cards” on page 151 Figure Legend 1 SAS PCIe RAID controller 2 HDD data cables 3 Connectors on HDD backplane15 Detecting and Managing Faults These topics explain how to use various diagnostic tools to monitor server status and troubleshoot faults in the server. ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Components (ASR)” on page 61 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 Diagnostics Overview You can use a variety of diagnostic tools, commands, and indicators to monitor and troubleshoot a server: ¦ LEDs – Provide a quick visual notification of the status of the server and of some of the FRUs. ¦ Oracle ILOM 3.0 – Runs on the SP. In addition to providing the interface between the hardware and OS, Oracle ILOM also tracks and reports the health of key server components. Oracle ILOM works closely with POST and PSH to keep the system running even when there is a faulty component. ¦ Power-on self-test (POST) – Performs diagnostics on system components upon system reset to ensure the integrity of those components. POST is configurable and works with Oracle ILOM to take faulty components offline if needed.16 SPARC T4-1 Server Service Manual • October 2011 ¦ PSH - Continuously monitors the health of the CPU, memory, and other components, and works with Oracle ILOM to take a faulty component offline if needed. The PSH technology enables systems to accurately predict component failures and mitigate many serious problems before they occur. ¦ Log files and command interface – Provide the standard Oracle Solaris OS log files and investigative commands that can be accessed and displayed on the device of your choice. ¦ Oracle VTS – Exercises the system, provides hardware validation, and discloses possible faulty components with recommendations for repair. The LEDs, Oracle ILOM, PSH, and many of the log files and console messages are integrated. For example, when the Oracle Solaris OS detects a fault, the software displays the fault, logs the fault, and passes the information to Oracle ILOM, where the fault is also logged. Depending on the fault, one or more LEDs might also be illuminated. The diagnostic flowchart in “Diagnostics Process” on page 16 illustrates an approach for using the server diagnostics to identify a faulty FRU. The diagnostics you use, and the order in which you use them, depend on the nature of the problem you are troubleshooting. So you might perform some actions and not others. Related Information ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 Diagnostics Process The following flowchart illustrates the diagnostic process, using different diagnostic tools through a default sequence. See also the table that follows the flowchart.Detecting and Managing Faults 17 FIGURE: Diagnostics Flowchart18 SPARC T4-1 Server Service Manual • October 2011 TABLE: Diagnostic Flowchart Reference Table Diagnostic Action Possible Outcome Additional Information Check Power OK and AC Present LEDs on the server. (Flowchart item 1) The Power OK LED is located on the front and rear of the chassis. The AC Present LED is located on the rear of the server on each power supply. If these LEDs are not on, check the power source and power connections to the server. • “Front Components” on page 1 Run the Oracle ILOM show faulty command to check for faults. (Flowchart item 2) The show faulty command displays the following kinds of faults: • Environmental and configuration faults • Oracle Solaris Predictive Self-Healing (PSH) detected faults • POST detected faults Faulty FRUs are identified in fault messages using the FRU name. • TABLE: Oracle ILOM Properties Used to Manage POST Operations on page 46 • “Check for Faults (show faulty Command)” on page 30 Check the Oracle Solaris log files for fault information. (Flowchart item 3) The Oracle Solaris message buffer and log files record system events, and provide information about faults. • If system messages indicate a faulty device, replace the FRU. • For more diagnostic information, review the Oracle VTS report. (Flowchart item 4) • “Interpreting Log Files and System Messages” on page 41 Run Oracle VTS software. (Flowchart item 4) Oracle VTS is an application you can run to exercise and diagnose FRUs. To run Oracle VTS, the server must be running the Oracle Solaris OS. • If Oracle VTS reports a faulty device, replace the FRU. • If Oracle VTS does not report a faulty device, run POST. (Flowchart item 5) • “Checking if Oracle VTS Software Is Installed” on page 43 Run POST. (Flowchart item 5) POST performs basic tests of the server components and reports faulty FRUs. • “Managing Faults (POST)” on page 45 • TABLE: Oracle ILOM Properties Used to Manage POST Operations on page 46 Determine if the fault was detected by Oracle ILOM. (Flowchart item 6) All Oracle ILOM-detected fault messages begin with the characters “SPT”. For additional information on the reported fault, including possible corrective action, sign into the Oracle support web site (http://support.oracle.com) and type the message ID contained in the fault message into the Search Knowledge Base search window. • “Check for Faults (show faulty Command)” on page 30 • “Check for Faults (fmadm faulty Command)” on page 31Detecting and Managing Faults 19 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 Determine if the fault was detected by PSH. (Flowchart item 7) If the fault message does not begin with the characters “SPT”, the fault was detected by PSH. For additional information on the reported fault, including possible corrective action, go to this web site: http://support.oracle.com Search for the message ID contained in the fault message. After you replace the FRU, perform the procedure to clear PSH-detected faults. • “Managing Faults (PSH)” on page 55 • “Clear PSH-Detected Faults” on page 59 Determine if the fault was detected by POST. (Flowchart item 8) POST performs basic tests of the server components and reports faulty FRUs. When POST detects a faulty FRU, it logs the fault and if possible, takes the FRU offline. POST detected FRUs display the following text in the fault message: Forced fail reason In a POST fault message, reason is the name of the power-on routine that detected the failure. • “Managing Faults (POST)” on page 45 • “Clear POST-Detected Faults” on page 51 Contact technical support. (Flowchart item 9) The majority of hardware faults are detected by the server’s diagnostics. In rare cases a problem might require additional troubleshooting. If you are unable to determine the cause of the problem, contact your service representative for support. TABLE: Diagnostic Flowchart Reference Table (Continued) Diagnostic Action Possible Outcome Additional Information20 SPARC T4-1 Server Service Manual • October 2011 Interpreting Diagnostic LEDs The server’s LEDs provide status information at the system level as well as for individual components. The following topics explain how to interpret the information they provide. Related Information ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Diagnostics Process” on page 16 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 Front Panel System Controls and LEDs The following table explains how to interpret the behavior of the system-level LEDs provided on the front panel. Type of LED LED Location Links Server-level LEDs Front and rear panels of the server • “Front Panel System Controls and LEDs” on page 20 • “Rear Panel System LEDs” on page 22 Component-level LEDs On or near the individual components • “LEDs for the Ethernet Ports and NET MGT port” on page 23 • “Hard Drive LEDs” on page 105 • “Power Supply LEDs” on page 117 • “Fan Module LEDs” on page 166Detecting and Managing Faults 21 TABLE: Front Panel System Controls and LEDs LED or Button Icon or Label Description Locator LED and button (white) The Locator LED can be turned on to identify a particular server. When on, it blinks rabidly. There are two methods for turning a Locator LED on: • Issuing the Oracle ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button. Service Required LED (amber) Indicates that service is required. POST and Oracle ILOM are two diagnostics tools that can detect a fault or failure resulting in this indication. The Oracle ILOM show faulty command provides details about any faults that cause this indicator to light. Under some fault conditions, individual component fault LEDs are turned on in addition to the Service Required LED. Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The SP might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Fast blink – System is running in standby mode and can be quickly returned to full function. • Slow blink – A normal, but transitory activity is taking place. Slow blinking might indicate that system diagnostics are running, or the system is booting. Power button The recessed Power button toggles the system on or off. • Press once to turn the system on. • Press once to shut the system down in a normal manner. • Press and hold for 4 seconds to perform an emergency shutdown. Power Supply Fault LED (amber) REAR PS Provides the following operational PSU indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a power supply failure event has been acknowledged and a service action is required on at least one PSU. Overtemp LED (amber) Provides the following operational temperature indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a temperature failure event has been acknowledged and a service action is required. Fan Fault LED (amber) TOP FAN Provides the following operational fan indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a fan failure event has been acknowledged and a service action is required on at least one of the fan modules.22 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Rear Panel System LEDs” on page 22 Rear Panel System LEDs The following table explains how to interpret the behavior of the system-level LEDs provided on the rear panel. Related Information ¦ “Front Panel System Controls and LEDs” on page 20 LEDs for the Ethernet Ports and NET MGT port The following table describes the status LEDs assigned to each Ethernet port. TABLE: Rear Panel Controls and Indicators LED or Button Icon or Label Description Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rabidly. There are two methods for turning a Locator LED on: • Issuing the Oracle ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button. Service Required LED (amber) Indicates that service is required. POST and Oracle ILOM are two diagnostics tools that can detect a fault or failure resulting in this indication. The Oracle ILOM show faulty command provides details about any faults that cause this indicator to light. Under some fault conditions, individual component fault LEDs are turned on in addition to the Service Required LED. Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The SP might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Fast blink – System is running in standby mode and can be quickly returned to full function. • Slow blink – A normal, but transitory activity is taking place. Slow blinking might indicate that system diagnostics are running, or the system is booting.Detecting and Managing Faults 23 The following table describes the status LEDs assigned to the NET MGT port. Related Information ¦ “Front Panel System Controls and LEDs” on page 20 ¦ “Rear Panel System LEDs” on page 22 Managing Faults (Oracle ILOM) These topics explain how to use Oracle ILOM, the SP firmware, to diagnose faults and verify successful repairs. ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 TABLE: Ethernet LEDs (NET0, NET1, NET2, NET3) LED Color Description Left LED Amber/ Green Speed indicator: • Amber on – The link is operating as a 100-Mbps connection. • Green on – The link is operating as a Gigabit connection (1000 Mbps). • Off – The link is operating as a 10-Mbps connection. Right LED Green Link/Activity indicator: • Blinking – A link is established. • Off – No link is established. TABLE: NET MGT Port LEDs LED Color Description Left LED Green Link/Activity indicator: • On or blinking – A link is established. • Off – No link is established. Right LED Green Speed indicator: • On or blinking – The link is operating as a 100-Mbps connection. • Off – The link is operating as a 10-Mbps connection.24 SPARC T4-1 Server Service Manual • October 2011 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ¦ “Service-Related Oracle ILOM Commands” on page 34 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 Oracle ILOM Troubleshooting Overview Oracle ILOM enables you to remotely run diagnostics, such as POST, that would otherwise require physical proximity to the server’s serial port. You can also configure Oracle ILOM to send email alerts of hardware failures, hardware warnings, and other events related to the server or to Oracle ILOM. The SP runs independently of the server, using the server’s standby power. Therefore, Oracle ILOM firmware and software continue to function when the server OS goes offline or when the server is powered off. Error conditions detected by Oracle ILOM, POST, and PSH are forwarded to Oracle ILOM for fault handling.Detecting and Managing Faults 25 FIGURE: Fault Reporting Through the Oracle ILOM Fault Manager The Oracle ILOM fault manager evaluates error messages the manager receives to determine whether the condition being reported should be classified as an alert or a fault. ¦ Alerts -- When the fault manager determines that an error condition being reported does not indicate a faulty FRU, the fault manager classifies the error as an alert. Alert conditions are often caused by environmental conditions, such as computer room temperature, which might improve over time. Alerts might also be caused by a configuration error, such as the wrong DIMM type being installed. If the conditions responsible for the alert go away, the fault manager detects the change and stops logging alerts for that condition. ¦ Faults -- When the fault manager determines that a particular FRU has an error condition that is permanent, that error is classified as a fault. This classification causes the Service Required LEDs to be turned on, the FRUID PROMs updated, and a fault message logged. If the FRU has status LEDs, the Service Required LED for that FRU is also turned on. A FRU identified as having a fault condition must be replaced. The SP can automatically detect when a FRU has been replaced. In many cases, the SP performs this action even if the FRU is removed while the system is not running (for example, if the system power cables are unplugged during service procedures). This function enables Oracle ILOM to sense that a fault, diagnosed to a specific FRU, has been repaired. Note – Oracle ILOM does not automatically detect hard drive replacement. PSH does not monitor hard drives for faults. As a result, the SP does not recognize hard drive faults and does not light the fault LEDs on either the chassis or the hard drive itself. Use the Oracle Solaris message files to view hard drive faults. For general information about Oracle ILOM, refer to the Oracle ILOM documentation.26 SPARC T4-1 Server Service Manual • October 2011 For detailed information about Oracle ILOM features that are specific to this server, refer to Server Administration. Related Information ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ? Access the SP (Oracle ILOM) There are two approaches to interacting with the SP: ¦ Oracle ILOM CLI shell (default) – The Oracle ILOM shell provides access to Oracle ILOM’s features and functions through a CLI. ¦ Oracle ILOM browser interface – The Oracle ILOM web interface supports the same set of features and functions as the shell. Note – Unless indicated otherwise, all examples of interaction with the SP are depicted with Oracle ILOM shell commands. Note – The CLI includes a feature that enables you to access Oracle Solaris Fault Manager commands, such as fmadm, fmdump, and fmstat, from within the Oracle ILOM shell. This feature is referred to as the Oracle ILOM faultmgmt shell. For more information about the Oracle Solaris Fault Manager commands, see the SPARC T4-1 administration documentation and the Oracle Solaris documentation. You can log into multiple SP accounts simultaneously and have separate Oracle ILOM shell commands executing concurrently under each account. 1. Establish connectivity to the SP using one of the following methods: ¦ SER MGT – Connect a terminal device (such as an ASCII terminal or laptop with terminal emulation) to the serial management port. Set up your terminal device for 9600 baud, 8 bit, no parity, 1 stop bit and no handshaking. Use a null-modem configuration (transmit and receive signals crossed over to enable DTE-to-DTE communication). The crossover adapters supplied with the server provide a null-modem configuration.Detecting and Managing Faults 27 ¦ NET MGT – Connect this port to an Ethernet network. This port requires an IP address. By default, the port is configured for DHCP, or you can assign an IP address. 2. Decide which interface to use, the Oracle ILOM CLI or the Oracle ILOM web interface. ¦ Oracle ILOM CLI – Is the default Oracle ILOM user interface and most of the commands and examples in this service manual use this interface. The default login account is root with a password of changeme. ¦ Oracle ILOM web interface – Can be used when you access the SP through the NET MGT port and have a browser. Refer to the Oracle ILOM 3.0 documentation for details. This interface is not referenced in this service manual. 3. Open an SSH session and connect to the SP by specifying its IP address. The Oracle ILOM default username is root, and the default password is changeme. Note – To provide optimum server security, change the default server password. The Oracle ILOM -> prompt indicates that you are accessing the SP with the Oracle ILOM CLI. 4. Perform Oracle ILOM commands that provide the diagnostic information you need. The following Oracle ILOM commands are commonly used for fault management: ¦ show command – Displays information about individual FRUs. See “Display FRU Information (show Command)” on page 29. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Oracle(R) Integrated Lights Out Manager Version 3.0.12.x rxxxxx Copyright (c) 2010 Oracle and/or its affiliates. All rights reserved. ->28 SPARC T4-1 Server Service Manual • October 2011 ¦ show faulty command – Displays environmental, POST-detected, and PSH-detected faults. Note – You can use fmadm faulty in the faultmgmt shell as an alternative to show faulty. See “Check for Faults (fmadm faulty Command)” on page 31 ¦ clear_fault_action property of the set command – Manually clears PSH-detected faults. See “Clear Faults (clear_fault_action Property)” on page 32. Related Information ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ¦ “Service-Related Oracle ILOM Commands” on page 34 ? Display FRU Information (show Command) ? At the Oracle ILOM prompt, type the show command. In the following example, the show command displays information about a DIMM. -> show /SYS/MB/CMP0/B0B0/CH0/D0 /SYS/MB/CMP0/B0B0/CH0/D0 Targets: T_AMB SERVICE Properties: Type = DIMM ipmi_name = B0/C0/D0 component_state = Enabled fru_name = 2048MB DDR3 SDRAM fru_description = DDR3 DIMM 2048 Mbytes fru_manufacturer = Samsung fru_version = 0 fru_part_number = **************** fru_serial_number = ****************** fault_state = OKDetecting and Managing Faults 29 Related Information ¦ Oracle ILOM 3.0 documentation ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ¦ “Service-Related Oracle ILOM Commands” on page 34 ? Check for Faults (show faulty Command) Use the show faulty command to display information about faults and alerts diagnosed by the system. See “Understanding Fault Management Commands” on page 36 for examples of the kind of information the command displays for different types of faults. ? At the Oracle ILOM prompt, type the show faulty command. clear_fault_action = (none) Commands: cd set show -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PS0 /SP/faultmgmt/0/ | class | fault.chassis.power.volt-fail faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SPT-8000-LC faults/0 | | /SP/faultmgmt/0/ | uuid | ********-****-****-****-************ faults/0 | | /SP/faultmgmt/0/ | timestamp | 2010-08-11/14:54:23 faults/0 | | /SP/faultmgmt/0/ | fru_part_number | ******* faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | ****** faults/0 | | /SP/faultmgmt/0/ | product_serial_number | ********** faults/0 | |30 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Diagnostics Process” on page 16 ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ¦ “Service-Related Oracle ILOM Commands” on page 34 ? Check for Faults (fmadm faulty Command) The following is an example of the fmadm faulty command reporting on the same power supply fault as shown in the show faulty example. See “Check for Faults (show faulty Command)” on page 30. Note that the two examples show the same UUID value. The fmadm faulty command was run from within the Oracle ILOM faultmgmt shell. Note – The characters SPT at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. 1. At the Oracle ILOM prompt, type the fmadm faulty command. 2. At the faultmgmtsp> prompt, enter the fmadm faulty command. /SP/faultmgmt/0/ | chassis_serial_number | ********** faults/0 | | /SP/faultmgmt/0/ | detector | /SYS/PS0/VOLT_FAULT faults/0 | | -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ ------------ ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------ ------- 2010-08-11/14:54:23 ********-****-****-****-************ SPT-8000-LC Critical Fault class : fault.chassis.power.volt-failDetecting and Managing Faults 31 3. Exit the faultmgmt shell. Related Information ¦ “Diagnostics Process” on page 16 ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Clear Faults (clear_fault_action Property)” on page 32 ¦ “Service-Related Oracle ILOM Commands” on page 34 ? Clear Faults (clear_fault_action Property) Use the clear_fault_action property of a FRU with the set command to manually clear Oracle ILOM-detected faults from the SP. If Oracle ILOM detects a FRU replacement, Oracle ILOM automatically clears the fault. For PSH-diagnosed faults, if the replacement of the FRU is detected by the system or you manually clear the fault on the host, the fault is also cleared from the SP. In such cases, you do note need to clear the fault manually. Description : A Power Supply voltage level has exceeded acceptible limits. Response : The service required LED on the chassis and on the affected Power Supply may be illuminated. Impact : Server will be powered down when there are insufficient operational power supplies Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> faultmgmtsp> exit ->32 SPARC T4-1 Server Service Manual • October 2011 Note – For PSH-detected faults, this procedure clears the fault from the SP but not from the host. If the fault persists in the host, clear the fault manually as described in “Clear PSH-Detected Faults” on page 59. ? At the Oracle ILOM prompt, use the set command with the clear_fault_action=True property. This example begins with an excerpt from the fmadm faulty command showing power supply 0 with a voltage failure. After the fault condition is corrected (a new power supply has been installed), the fault state is cleared. Note – In this example, the characters SPT at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. [...] faultmgmtsp> fmadm faulty ------------------- ------------------------------------ ------------ ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------ ------- 2010-08-11/14:54:23 ********-****-****-****-************ SPT-8000-LC Critical Fault class : fault.chassis.power.volt-fail Description : A Power Supply voltage level has exceeded acceptible limits. [...] -> set /SYS/PS0 clear_fault_action=true Are you sure you want to clear /SYS/PS0 (y/n)? y -> show /SYS/PS0 Targets: VINOK PWROK CUR_FAULT VOLT_FAULT FAN_FAULT TEMP_FAULT V_IN I_IN V_OUT I_OUTDetecting and Managing Faults 33 Related Information ¦ “Oracle ILOM Troubleshooting Overview” on page 25 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Service-Related Oracle ILOM Commands” on page 34 Service-Related Oracle ILOM Commands These are the Oracle ILOM shell commands most frequently used when performing service-related tasks. INPUT_POWER OUTPUT_POWER Properties: type = Power Supply ipmi_name = PSO fru_name = /SYS/PSO fru_description = Powersupply fru_manufacturer = Delta Electronics fru_version = 03 fru_part_number = ******* fru_serial_number = ****** fault_state = OK clear_fault_action = (none) Commands: cd set show34 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Oracle ILOM Troubleshooting Overview” on page 25 TABLE: Service-Related Oracle ILOM Commands Oracle ILOM Command Description help [command] Displays a list of all available commands with syntax and descriptions. Specifying a command name as an option displays help for that command. set /HOST send_break_action=break Takes the host server from the OS to either kmdb or OBP (equivalent to a Stop-A), depending on the mode Oracle Solaris software was booted. set /SYS/component clear_fault_action=true Manually clears host-detected faults. The UUID is the unique fault ID of the fault to be cleared. start /HOST/console Connects you to the host system. show /HOST/console/history Displays the contents of the system’s console buffer. set /HOST/bootmode property=value [where property is state, config, or script] Controls the host server OBP firmware method of booting. stop /SYS; start /SYS Performs a poweroff followed by poweron. stop /SYS Powers off the host server. start /SYS Powers on the host server. reset /SYS Generates a hardware reset on the host server. reset /SP Reboots the SP. set /SYS keyswitch_state=value normal | standby | diag | locked Sets the virtual keyswitch. set /SYS/LOCATE value=value [Fast_blink | Off] Turns the Locator LED on the server on or off. show faulty Displays current system faults. See “Check for Faults (show faulty Command)” on page 30. show /SYS keyswitch_state Displays the status of the virtual keyswitch. show /SYS/LOCATE Displays the current state of the Locator LED as either on or off. show /SP/logs/event/list Displays the history of all events logged in the SP event buffers (in RAM or the persistent buffers). show /HOST Displays information about the operating state of the host system, the system serial number, and whether the hardware is providing service.Detecting and Managing Faults 35 ¦ “Access the SP (Oracle ILOM)” on page 27 ¦ “Display FRU Information (show Command)” on page 29 ¦ “Check for Faults (show faulty Command)” on page 30 ¦ “Check for Faults (fmadm faulty Command)” on page 31 ¦ “Clear Faults (clear_fault_action Property)” on page 32 Understanding Fault Management Commands This topic provides the following information: ¦ “No Faults Detected Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (fmadm faulty Command)” on page 38 ¦ “POST-Detected Fault Example (show faulty Command)” on page 39 ¦ “PSH-Detected Fault Example (show faulty Command)” on page 40 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 6136 SPARC T4-1 Server Service Manual • October 2011 No Faults Detected Example (show faulty Command) When no faults have been detected, the show faulty command output looks like this: Power Supply Fault Example (show faulty Command) The following is an example of the show faulty command reporting a power supply fault. Note – The characters SPT at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. -> show faulty Target | Property | Value --------------------+------------------------+------------------- ----------------------------------------------------------------- -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PS0 /SP/faultmgmt/0/ | class | fault.chassis.power.volt-fail faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SPT-8000-LC faults/0 | | /SP/faultmgmt/0/ | uuid | ********-****-****-****-************ faults/0 | | /SP/faultmgmt/0/ | timestamp | 2010-08-11/14:54:23 faults/0 | | /SP/faultmgmt/0/ | fru_part_number | ******* faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | ****** faults/0 | | /SP/faultmgmt/0/ | product_serial_number | ********** faults/0 | | /SP/faultmgmt/0/ | chassis_serial_number | **********Detecting and Managing Faults 37 Related Information ¦ “Power Supply Fault Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (fmadm faulty Command)” on page 38 ¦ “POST-Detected Fault Example (show faulty Command)” on page 39 ¦ “PSH-Detected Fault Example (show faulty Command)” on page 40 ¦ “Service-Related Oracle ILOM Commands” on page 34 Power Supply Fault Example (fmadm faulty Command) The following is an example of the fmadm faulty command reporting on the same power supply fault as shown in the show faulty example. See “Power Supply Fault Example (show faulty Command)” on page 37. Both examples show the same UUID value. The fmadm faulty command was run from within the Oracle ILOM faultmgmt shell. Note – The characters SPT at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. faults/0 | | /SP/faultmgmt/0/ | detector | /SYS/PS0/VOLT_FAULT faults/0 | | -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2010-08-11/14:54:23 ********-****-****-****-************ SPT-8000-LC Critical Fault class : fault.chassis.power.volt-fail Description : A Power Supply voltage level has exceeded acceptible limits. Response : The service required LED on the chassis and on the affected Power Supply may be illuminated.38 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “No Faults Detected Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (show faulty Command)” on page 37 ¦ “POST-Detected Fault Example (show faulty Command)” on page 39 ¦ “PSH-Detected Fault Example (show faulty Command)” on page 40 ¦ “Service-Related Oracle ILOM Commands” on page 34 POST-Detected Fault Example (show faulty Command) The following is an example of the show faulty command displaying a fault that was detected by POST. These kinds of faults are identified by the message Forced fail reason, where reason is the name of the power-on routine that detected the fault. Related Information ¦ “No Faults Detected Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (fmadm faulty Command)” on page 38 ¦ “PSH-Detected Fault Example (show faulty Command)” on page 40 Impact : Server will be powered down when there are insufficient operational power supplies Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit -> show faulty Target | Property | Value --------------------+------------------------+-------------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0/CMP0/B0B0/CH0/D0 /SP/faultmgmt/0 | timestamp | Oct 12 16:40:56 /SP/faultmgmt/0/ | timestamp | Oct 12 16:40:56 faults/0 | | /SP/faultmgmt/0/ | sp_detected_fault | /SYS/PM0/CMP0/B0B0/CH0/D0 faults/0 | | Forced fail(POST)Detecting and Managing Faults 39 ¦ “Service-Related Oracle ILOM Commands” on page 34 PSH-Detected Fault Example (show faulty Command) The following is an example of the show faulty command displaying a fault that was detected by PSH. These kinds of faults are identified by the absence of the characters SPT at the beginning of the message ID. Related Information ¦ “No Faults Detected Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (show faulty Command)” on page 37 ¦ “Power Supply Fault Example (fmadm faulty Command)” on page 38 ¦ “POST-Detected Fault Example (show faulty Command)” on page 39 -> show faulty Target | Property | Value ------------------+-----------------------+-------------------------------- /SP/faultmgmt/0 | fru | /SYS/MB /SP/faultmgmt/0/ | class | fault.cpu.generic-sparc.strand faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SUN4V-8002-6E faults/0 | | /SP/faultmgmt/0/ | uuid | *******-****-****-****-*********** faults/0 | | 7a8a /SP/faultmgmt/0/ | timestamp | 2010-08-13/15:48:33 faults/0 | | /SP/faultmgmt/0/ | chassis_serial_number | ********** faults/0 | | /SP/faultmgmt/0/ | product_serial_number | ********** faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | *******-********** faults/0 | | /SP/faultmgmt/0/ | fru_part_number | 541-3857-07 faults/0 | | /SP/faultmgmt/0/ | mod-version | 1.16 faults/0 | | /SP/faultmgmt/0/ | mod-name | eft faults/0 | | /SP/faultmgmt/0/ | fault_diagnosis | /HOST faults/0 | | /SP/faultmgmt/0/ | severity | Major faults/0 | |40 SPARC T4-1 Server Service Manual • October 2011 ¦ “Service-Related Oracle ILOM Commands” on page 34 Interpreting Log Files and System Messages With the Oracle Solaris OS running on the server, you have the full complement of Oracle Solaris OS files and commands available for collecting information and for troubleshooting. If POST or PSH do not indicate the source of a fault, check the message buffer and log files for notifications of faults. Hard drive faults are usually captured by the Oracle Solaris message files. ¦ “Check the Message Buffer” on page 41 ¦ “View the System Message Log Files” on page 42 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 ? Check the Message Buffer The dmesg command checks the system buffer for recent diagnostic messages and displays them. 1. Log in as superuser.Detecting and Managing Faults 41 2. Type: Related Information ¦ “View the System Message Log Files” on page 42 ? View the System Message Log Files The error logging daemon, syslogd, automatically records various system warnings, errors, and faults in message files. These messages can alert you to system problems such as a device that is about to fail. The /var/adm directory contains several message files. The most recent messages are in the /var/adm/messages file. After a period of time (usually every week), a new messages file is automatically created. The original contents of the messages file are rotated to a file named messages.1. Over a period of time, the messages are further rotated to messages.2 and messages.3, and then deleted. 1. Log in as superuser. 2. Type: 3. If you want to view all logged messages, type: Related Information “Check the Message Buffer” on page 41 # dmesg # more /var/adm/messages # more /var/adm/messages*42 SPARC T4-1 Server Service Manual • October 2011 Checking if Oracle VTS Software Is Installed Oracle VTS is a validation test suite that you can use to test this server. These topics provide an overview and a way to check if the Oracle VTS software is installed. For comprehensive Oracle VTS information, refer to the SunVTS 6.1 and Oracle VTS 7.0 documentation. ¦ “Oracle VTS Overview” on page 43 ¦ “Check if Oracle VTS Is Installed” on page 44 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 Oracle VTS Overview Oracle VTS is a validation test suite that you can use to test this server. The Oracle VTS software provides multiple diagnostic hardware tests that verify the connectivity and functionality of most hardware controllers and devices for this server. The software provides these kinds of test categories: ¦ Audio ¦ Communication (serial and parallel) ¦ Graphic and video ¦ Memory ¦ Network ¦ Peripherals (hard disk drives, CD-DVD devices, and printers) ¦ ProcessorDetecting and Managing Faults 43 ¦ Storage Use the Oracle VTS software to validate a system during development, production, receiving inspection, troubleshooting, periodic maintenance, and system or subsystem stressing. You can run the Oracle VTS software through a web browser, a terminal interface, or a CLI. You can run tests in a variety of modes for online and offline testing. The Oracle VTS software also provides a choice of security mechanisms. The Oracle VTS software is provided on the preinstalled Oracle Solaris OS that shipped with the server, however, Oracle VTS might not be installed. Related Information ¦ Oracle VTS documentation ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Check if Oracle VTS Is Installed” on page 44 ? Check if Oracle VTS Is Installed 1. Log in as superuser. 2. Check for the presence of Oracle VTS packages using the pkginfo command. ¦ If information about the packages is displayed, then Oracle VTS software is installed. ¦ If you receive messages reporting ERROR: information for package was not found, then the Oracle VTS software is not installed. You must install the software before you can use it. You can obtain the Oracle VTS software from the following places: ¦ Oracle Solaris OS media kit (DVDs) ¦ As a download from the web Related Information ¦ “Oracle VTS Overview” on page 43 ¦ Oracle VTS documentation # pkginfo -l SUNvts SUNWvtsr SUNWvtsts SUNWvtsmn44 SPARC T4-1 Server Service Manual • October 2011 Managing Faults (POST) These topics explain how to use POST as a diagnostic tool. ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 53 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (PSH)” on page 55 ¦ “Managing Components (ASR)” on page 61 POST Overview POST is a group of PROM-based tests that run when the server is powered on or is reset. POST checks the basic integrity of the critical hardware components in the server (CMP, memory, and I/O subsystem). You can also run POST as a system-level hardware diagnostic tool. Use the Oracle ILOM set command to set the parameter keyswitch_state to diag. You can also set other Oracle ILOM properties to control various other aspects of POST operations. For example, you can specify the events that cause POST to run, the level of testing POST performs, and the amount of diagnostic information POST displays. These properties are listed and described in “Oracle ILOM Properties That Affect POST Behavior” on page 46.Detecting and Managing Faults 45 If POST detects a faulty component, the component is disabled automatically. If the system is able to run without the disabled component, the system boots when POST completes its tests. For example, if POST detects a faulty processor core, the core is disabled. Once POST completes its test sequence, the system boots and runs using the remaining cores. Related Information ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 53 Oracle ILOM Properties That Affect POST Behavior These Oracle ILOM properties determine how POST performs its operations. See also the flowchart that follows the table. Note – The value of keyswitch_state must be normal when individual POST parameters are changed. TABLE: Oracle ILOM Properties Used to Manage POST Operations Parameter Values Description /SYS keyswitch_state normal The system can power on and run POST (based on the other parameter settings). This parameter overrides all other commands. diag The system runs POST based on predetermined settings. standby The system cannot power on. locked The system can power on and run POST, but no flash updates can be made. /HOST/diag mode off POST does not run. normal Runs POST according to diag level value.46 SPARC T4-1 Server Service Manual • October 2011 service Runs POST with preset values for diag level and diag verbosity. /HOST/diag level max If diag mode = normal, runs all the minimum tests plus extensive processor and memory tests. min If diag mode = normal, runs minimum set of tests. /HOST/diag trigger none Does not run POST on reset. hw-change (Default) Runs POST following an AC power cycle and when the top cover is removed. power-on-reset Only runs POST for the first power on. error-reset (Default) Runs POST if fatal errors are detected. all-resets Runs POST after any reset. /HOST/diag verbosity normal POST output displays all test and informational messages. min POST output displays functional tests with a banner and pinwheel. max POST output displays all test, informational, and some debugging messages. debug POST output displays extensive debugging messages, including devices being tested and the debug results of each test. none No POST output is displayed. TABLE: Oracle ILOM Properties Used to Manage POST Operations Parameter Values DescriptionDetecting and Managing Faults 47 FIGURE: Flowchart of Oracle ILOM Properties Used to Manage POST Operations Related Information ¦ “POST Overview” on page 45 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 5348 SPARC T4-1 Server Service Manual • October 2011 ? Configure POST 1. Access the Oracle ILOM prompt. See “Access the SP (Oracle ILOM)” on page 27. 2. Set the virtual keyswitch to the value that corresponds to the POST configuration you want to run. The following example sets the virtual keyswitch to normal, which configures POST to run according to other parameter values. For possible values for the keyswitch_state parameter, see “Oracle ILOM Properties That Affect POST Behavior” on page 46. 3. If the virtual keyswitch is set to normal, and you want to define the mode, level, verbosity, or trigger, set the respective parameters. Syntax: set /HOST/diag property=value See “Oracle ILOM Properties That Affect POST Behavior” on page 46 for a list of parameters and values. 4. To see the current values for settings, use the show command. -> set /SYS keyswitch_state=normal Set ‘keyswitch_state' to ‘Normal' -> set /HOST/diag mode=normal -> set /HOST/diag verbosity=max -> show /HOST/diag /HOST/diag Targets: Properties: level = min mode = normal trigger = hw-change error-reset verbosity = normal Commands: cd set show ->Detecting and Managing Faults 49 Related Information ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 53 ? Run POST With Maximum Testing 1. Access the Oracle ILOM prompt: See “Access the SP (Oracle ILOM)” on page 27. 2. Set the virtual keyswitch to diag so that POST runs in service mode. 3. Reset the system so that POST runs. There are several ways to initiate a reset. The following example shows a reset by using commands that power cycle the host. Note – The server takes about one minute to power off. Use the show /HOST command to determine when the host has been powered off. The console displays status=Powered Off. 4. Switch to the system console to view the POST output. 5. If you receive POST error messages, learn how to interpret them. See “Interpret POST Fault Messages” on page 51. -> set /SYS/keyswitch_state=diag Set ‘keyswitch_state' to ‘Diag' -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /HOST/console50 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 53 ? Interpret POST Fault Messages 1. Run POST. See “Run POST With Maximum Testing” on page 50. 2. View the output and watch for messages that look similar to the POST syntax. See “POST Output Reference” on page 53 3. To obtain more information on faults, run the show faulty command. See “Check for Faults (show faulty Command)” on page 30. Related Information ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Clear POST-Detected Faults” on page 51 ¦ “POST Output Reference” on page 53 ? Clear POST-Detected Faults Use this procedure if you suspect that a fault was not automatically cleared. This procedure describes how to identify a POST-detected fault and, if necessary, manually clear the fault. In most cases, when POST detects a faulty component, POST logs the fault and automatically takes the failed component out of operation by placing the component in the ASR blacklist. See “Managing Components (ASR)” on page 61). Usually, when a faulty component is replaced, the replacement is detected when the SP is reset or power cycled. The fault is automatically cleared from the system.Detecting and Managing Faults 51 1. Replace the faulty FRU. 2. At the Oracle ILOM prompt, type the show faulty command to identify POST-detected faults. POST-detected faults are distinguished from other kinds of faults by the text: Forced fail. No UUID number is reported. For example: 3. Take one of the following actions based on the output: ¦ No fault is reported – The system cleared the fault and you do not need to manually clear the fault. Do not perform the subsequent steps. ¦ Fault reported – Go to Step 4. 4. Use the component_state property of the component to clear the fault and remove the component from the ASR blacklist. Use the FRU name that was reported in the fault in Step 2. The fault is cleared and should not show up when you run the show faulty command. Additionally, the System Fault (Service Required) LED is no longer lit. 5. Reset the server. You must reboot the server for the component_state property to take effect. 6. At the Oracle ILOM prompt, type the show faulty command to verify that no faults are reported. -> show faulty Target | Property | Value ----------------------+------------------------+----------------------------- /SP/faultmgmt/0 | fru | /SYS/MB/CMP0/B0B0/CH0/D0 /SP/faultmgmt/0 | timestamp | Dec 21 16:40:56 /SP/faultmgmt/0/ | timestamp | Dec 21 16:40:56 faults/0 | | /SP/faultmgmt/0/ | sp_detected_fault | /SYS/MB/CMP0/B0B0/CH0/D0 faults/0 | | Forced fail(POST) -> set /SYS/MB/CMP0/B0B0/CH0/D0 component_state=Enabled -> show faulty Target | Property | Value --------------------+------------------------+------------------ ->52 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “POST Output Reference” on page 53 POST Output Reference POST error messages use the following syntax: In this syntax, n = the node number, c = the core number, s = the strand number. Warning messages use the following syntax: Informational messages use the following syntax: In the following example, POST reports an uncorrectable memory error affecting DIMM locations /SYS/MB/CMP0/B0B0/CH0/D0 and /SYS/MB/CMP0/B0B1/CH0/D0. The error was detected by POST running on node 0, core 7, strand 2. n:c:s > ERROR: TEST = failing-test n:c:s > H/W under test = FRU n:c:s > Repair Instructions: Replace items in order listed by H/W under test above n:c:s > MSG = test-error-message n:c:s > END_ERROR WARNING: message INFO: message 2010-07-03 18:44:13.359 0:7:2>Decode of Disrupting Error Status Reg (DESR HW Corrected) bits 00300000.00000000 2010-07-03 18:44:13.517 0:7:2> 1 DESR_SOCSRE: SOC (non-local) sw_recoverable_error. 2010-07-03 18:44:13.638 0:7:2> 1 DESR_SOCHCCE: SOC (non-local) hw_corrected_and_cleared_error. 2010-07-03 18:44:13.773 0:7:2> 2010-07-03 18:44:13.836 0:7:2>Decode of NCU Error Status Reg bitsDetecting and Managing Faults 53 00000000.22000000 2010-07-03 18:44:13.958 0:7:2> 1 NESR_MCU1SRE: MCU1 issued a Software Recoverable Error Request 2010-07-03 18:44:14.095 0:7:2> 1 NESR_MCU1HCCE: MCU1 issued a Hardware Corrected-and-Cleared Error Request 2010-07-03 18:44:14.248 0:7:2> 2010-07-03 18:44:14.296 0:7:2>Decode of Mem Error Status Reg Branch 1 bits 33044000.00000000 2010-07-03 18:44:14.427 0:7:2> 1 MEU 61 R/W1C Set to 1 on an UE if VEU = 1, or VEF = 1, or higher priority error in same cycle. 2010-07-03 18:44:14.614 0:7:2> 1 MEC 60 R/W1C Set to 1 on a CE if VEC = 1, or VEU = 1, or VEF = 1, or another error in same cycle. 2010-07-03 18:44:14.804 0:7:2> 1 VEU 57 R/W1C Set to 1 on an UE, if VEF = 0 and no fatal error is detected in same cycle. 2010-07-03 18:44:14.983 0:7:2> 1 VEC 56 R/W1C Set to 1 on a CE, if VEF = VEU = 0 and no fatal or UE is detected in same cycle. 2010-07-03 18:44:15.169 0:7:2> 1 DAU 50 R/W1C Set to 1 if the error was a DRAM access UE. 2010-07-03 18:44:15.304 0:7:2> 1 DAC 46 R/W1C Set to 1 if the error was a DRAM access CE. 2010-07-03 18:44:15.440 0:7:2> 2010-07-03 18:44:15.486 0:7:2> DRAM Error Address Reg for Branch 1 = 00000034.8647d2e0 2010-07-03 18:44:15.614 0:7:2> Physical Address is 00000005.d21bc0c0 2010-07-03 18:44:15.715 0:7:2> DRAM Error Location Reg for Branch 1 = 00000000.00000800 2010-07-03 18:44:15.842 0:7:2> DRAM Error Syndrome Reg for Branch 1 = dd1676ac.8c18c045 2010-07-03 18:44:15.967 0:7:2> DRAM Error Retry Reg for Branch 1 = 00000000.00000004 2010-07-03 18:44:16.086 0:7:2> DRAM Error RetrySyndrome 1 Reg for Branch 1 = a8a5f81e.f6411b5a 2010-07-03 18:44:16.218 0:7:2> DRAM Error Retry Syndrome 2 Reg for Branch 1 = a8a5f81e.f6411b5a 2010-07-03 18:44:16.351 0:7:2> DRAM Failover Location 0 for Branch 1 = 00000000.00000000 2010-07-03 18:44:16.475 0:7:2> DRAM Failover Location 1 for Branch 1 = 00000000.00000000 2010-07-03 18:44:16.604 0:7:2> 2010-07-03 18:44:16.648 0:7:2>ERROR: POST terminated prematurely. Not all system components tested. 2010-07-03 18:44:16.786 0:7:2>POST: Return to VBSC 2010-07-03 18:44:16.795 0:7:2>ERROR: 2010-07-03 18:44:16.839 0:7:2> POST toplevel status has the following failures: 2010-07-03 18:44:16.952 0:7:2> Node 0 -------------------------------54 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “POST Overview” on page 45 ¦ “Oracle ILOM Properties That Affect POST Behavior” on page 46 ¦ “Configure POST” on page 49 ¦ “Run POST With Maximum Testing” on page 50 ¦ “Interpret POST Fault Messages” on page 51 ¦ “Clear POST-Detected Faults” on page 51 Managing Faults (PSH) The following topics describe the Oracle Solaris PSH feature: ¦ “PSH Overview” on page 56 ¦ “PSH-Detected Fault Example” on page 57 ¦ “Check for PSH-Detected Faults” on page 57 ¦ “Clear PSH-Detected Faults” on page 59 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 2010-07-03 18:44:17.051 0:7:2> /SYS/MB/CMP0/BOB0/CH1/D0 (J1001) 2010-07-03 18:44:17.145 0:7:2> /SYS/MB/CMP0/BOB1/CH1/D0 (J3001) 2010-07-03 18:44:17.241 0:7:2>END_ERRORDetecting and Managing Faults 55 PSH Overview PSH enables the server to diagnose problems while the Oracle Solaris OS is running and mitigate many problems before they negatively affect operations. The Oracle Solaris OS uses the fault manager daemon, fmd(1M), which starts at boot time and runs in the background to monitor the system. If a component generates an error, the daemon correlates the error with data from previous errors and other relevant information to diagnose the problem. Once diagnosed, the fault manager daemon assigns a Universal Unique Identifier (UUID) to the error. This value distinguishes this error across any set of systems. When possible, the fault manager daemon initiates steps to self-heal the failed component and takes the component offline. The daemon also logs the fault to the syslogd daemon and provides a fault notification with a MSG-ID. You can use the MSG-ID to get additional information about the problem from the knowledge article database. The PSH technology covers the following server components: ¦ CPU ¦ Memory ¦ I/O subsystem The PSH console message provides the following information about each detected fault: ¦ Type ¦ Severity ¦ Description ¦ Automated response ¦ Impact ¦ Suggested action for a system administrator If PSH detects a faulty component, use the fmadm faulty command to display information about the fault. Alternatively, you can use the Oracle ILOM command show faulty for the same purpose. Related Information ¦ “PSH-Detected Fault Example” on page 57 ¦ “Check for PSH-Detected Faults” on page 57 ¦ “Clear PSH-Detected Faults” on page 5956 SPARC T4-1 Server Service Manual • October 2011 PSH-Detected Fault Example When a PSH fault is detected, an Oracle Solaris console message similar to the following example is displayed. Note – The Service Required LED is also turned on for PSH-diagnosed faults. Related Information ¦ “PSH Overview” on page 56 ¦ “Check for PSH-Detected Faults” on page 57 ¦ “Clear PSH-Detected Faults” on page 59 ? Check for PSH-Detected Faults The fmadm faulty command displays the list of faults detected by PSH. You can run this command either from the host or through the Oracle ILOM fmadm shell. As an alternative, you can display fault information by running the Oracle ILOM command show. SUNW-MSG-ID: SUN4V-8000-DX, TYPE: Fault, VER: 1, SEVERITY: Minor EVENT-TIME: Wed Jun 17 10:09:46 EDT 2009 PLATFORM: SUNW,system_name, CSN: -, HOSTNAME: server48-37 SOURCE: cpumem-diagnosis, REV: 1.5 EVENT-ID: f92e9fbe-735e-c218-cf87-9e1720a28004 DESC: The number of errors associated with this memory module has exceeded acceptable levels. Refer to http://sun.com/msg/SUN4V-8000-DX for more information. AUTO-RESPONSE: Pages of memory associated with this memory module are being removed from service as errors are reported. IMPACT: Total system memory capacity will be reduced as pages are retired. REC-ACTION: Schedule a repair procedure to replace the affected memory module. Use fmdump -v -u to identify the module.Detecting and Managing Faults 57 1. Check the event log. In this example, a fault is displayed, indicating the following details: ¦ Date and time of the fault (Aug 13 11:48:33). ¦ EVENT-ID, which is unique for every fault (21a8b59e-89ff-692a-c4bc-f4c5cccca8c8). ¦ MSG-ID, which can be used to obtain additional fault information (SUN4V-8002-6E). ¦ Faulted FRU. The information provided in the example includes the part number of the FRU (part=511127809) and the serial number of the FRU (serial=1005LCB-1019B100A2). The FRU field provides the name of the FRU (/SYS/MB for motherboard in this example). 2. Use the MSG-ID to obtain more information about this type of fault: a. Obtain the MSG-ID from console output or from the Oracle ILOM show faulty command. # fmadm faulty TIME EVENT-ID MSG-ID SEVERITY Aug 13 11:48:33 f92e9fbe-735e-c218-cf87-9e1720a28004 SUN4V-8002-6E Major Platform : sun4v Chassis_id : Product_sn : Fault class : fault.cpu.generic-sparc.strand Affects : cpu:///cpuid=**/serial=********************* faulted and taken out of service FRU : "/SYS/MB" (hc://:product-id=*****:product-sn=**********:server-id=***-******-*****: chassis-id=********:**************-**********:serial=******:revision=05/ chassis=0/motherboard=0) faulty Description : The number of correctable errors associated with this strand has exceeded acceptable levels. Refer to http://sun.com/msg/SUN4V-8002-6E for more information. Response : The fault manager will attempt to remove the affected strand from service. Impact : System performance may be affected. Action : Schedule a repair procedure to replace the affected resource, the identity of which can be determined using ’fmadm faulty’.58 SPARC T4-1 Server Service Manual • October 2011 b. Sign into the Oracle support site: http://support.oracle.com c. Type the MSG-ID in the Search Knowledge Base search window. The following example shows the knowledge article information provided for MSG-ID SUN4V-8002-6E. 3. Follow the suggested actions to repair the fault. Related Information ¦ “PSH Overview” on page 56 ¦ “PSH-Detected Fault Example” on page 57 ¦ “Clear PSH-Detected Faults” on page 59 ? Clear PSH-Detected Faults When PSH detects faults, the faults are logged and displayed on the console. In most cases, after the fault is repaired, the server detects the corrected state and automatically repairs the fault. However, you should verify this repair. In cases where the fault condition is not automatically cleared, you must clear the fault manually. 1. After replacing a faulty FRU, power on the server. Correctable strand errors exceeded acceptable levels Type Fault Severity Major Description The number of correctable errors associated with this strand has exceeded acceptable levels. Automated Response The fault manager will attempt to remove the affected strand from service. Impact System performance may be affected. Suggested Action for System Administrator Schedule a repair procedure to replace the affected resource, the identity of which can be determined using fmadm faulty. Details There is no more information available at this time.Detecting and Managing Faults 59 2. At the host prompt, determine whether the replaced FRU still shows a faulty state. ¦ If no fault is reported, you do not need to do anything else. Do not perform the subsequent steps. ¦ If a fault is reported, continue to Step 3. 3. Clear the fault from all persistent fault records. In some cases, even though the fault is cleared, some persistent fault information remains and results in erroneous fault messages at boot time. To ensure that these messages are not displayed, type the following Oracle Solaris command: For the UUID in the example shown in Step 2, type this command: # fmadm faulty TIME EVENT-ID MSG-ID SEVERITY Aug 13 11:48:33 21a8b59e-89ff-692a-c4bc-f4c5cccca8c8 SUN4V-8002-6E Major Platform : sun4v Chassis_id : Product_sn : Fault class : fault.cpu.generic-sparc.strand Affects : cpu:///cpuid=**/serial=********************* faulted and taken out of service FRU : "/SYS/MB" (hc://:product-id=*****:product-sn=**********:server-id=***-******-*****: chassis-id=********:**************-**********:serial=******:revision=05/ chassis=0/motherboard=0) faulty Description : The number of correctable errors associated with this strand has exceeded acceptable levels. Refer to http://sun.com/msg/SUN4V-8002-6E for more information. Response : The fault manager will attempt to remove the affected strand from service. Impact : System performance may be affected. Action : Schedule a repair procedure to replace the affected resource, the identity of which can be determined using ’fmadm faulty’. # fmadm repair UUID # fmadm repair 21a8b59e-89ff-692a-c4bc-f4c5cccc60 SPARC T4-1 Server Service Manual • October 2011 4. Use the clear_fault_action property of the FRU to clear the fault. Related Information ¦ “PSH Overview” on page 56 ¦ “PSH-Detected Fault Example” on page 57 ¦ “Check for PSH-Detected Faults” on page 57 Managing Components (ASR) These topics explain the role played by ASR and how to manage the components that ASR controls. ¦ “ASR Overview” on page 62 ¦ “Display System Components” on page 63 ¦ “Disable System Components” on page 63 ¦ “Enable System Components” on page 64 Related Information ¦ “Diagnostics Overview” on page 15 ¦ “Diagnostics Process” on page 16 ¦ “Interpreting Diagnostic LEDs” on page 20 ¦ “Managing Faults (Oracle ILOM)” on page 24 ¦ “Understanding Fault Management Commands” on page 36 ¦ “Interpreting Log Files and System Messages” on page 41 ¦ “Checking if Oracle VTS Software Is Installed” on page 43 ¦ “Managing Faults (POST)” on page 45 ¦ “Managing Faults (PSH)” on page 55 -> set /SYS/MB clear_fault_action=True Are you sure you want to clear /SYS/MB (y/n)? y set ’clear_fault_action’ to ’trueDetecting and Managing Faults 61 ASR Overview The ASR feature enables the server to automatically configure failed components out of operation until they can be replaced. In the server, ASR manages the following components: ¦ CPU strands ¦ Memory DIMMs ¦ I/O subsystem The database that contains the list of disabled components is the ASR blacklist (asr-db). In most cases, POST automatically disables a faulty component. After the cause of the fault is repaired (FRU replacement, loose connector reseated, and so on), you might need to remove the component from the ASR blacklist. The following ASR commands enable you to view, add, or remove components (asrkeys) from the ASR blacklist. You run these commands from the Oracle ILOM prompt. Note – The asrkeys vary from system to system, depending on how many cores and memory are present. Use the show components command to see the asrkeys on a given system. After you enable or disable a component, you must reset (or power cycle) the system for the component’s change of state to take effect. Related Information ¦ “Display System Components” on page 63 ¦ “Disable System Components” on page 63 ¦ “Enable System Components” on page 64 TABLE: ASR Commands Command Description show components Displays system components and their current state. set asrkey component_state= Enabled Removes a component from the asr-db blacklist, where asrkey is the component to enable. set asrkey component_state= Disabled Adds a component to the asr-db blacklist, where asrkey is the component to disable.62 SPARC T4-1 Server Service Manual • October 2011 ? Display System Components The show components command displays the system components (asrkeys) and reports their status. ? At the Oracle ILOM prompt, type show components. In the following example, PCIE3 is shown as disabled. Related Information ¦ “ASR Overview” on page 62 ¦ “Disable System Components” on page 63 ¦ “Enable System Components” on page 64 ? Disable System Components You disable a component by setting its component_state property to Disabled. This action adds the component to the ASR blacklist. 1. At the Oracle ILOM prompt, set the component_state property to Disabled. -> show components Target | Property | Value --------------------+------------------------+------------------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 | | /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | Enabled PCIE4 | | /SYS/MB/RISER2/ | component_state | Enabled PCIE2 | | /SYS/MB/RISER2/ | component_state | Enabled PCIE5 | | /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled /SYS/MB/NET3 | component_state | Enabled /SYS/MB/PCIE | component_state | Enabled -> set /SYS/MB/CMP0/B0B0/CH0/D0 component_state=DisabledDetecting and Managing Faults 63 2. Reset the server so that the ASR command takes effect. Note – In the Oracle ILOM shell, there is no notification when the system is powered off. Powering off takes about a minute. Use the show /HOST command to determine if the host has powered off. Related Information ¦ “View the System Message Log Files” on page 42 ¦ “ASR Overview” on page 62 ¦ “Display System Components” on page 63 ¦ “Enable System Components” on page 64 ? Enable System Components You enable a component by setting its component_state property to Enabled. This action removes the component from the ASR blacklist. 1. At the Oracle ILOM prompt, set the component_state property to Enabled. 2. Reset the server so that the ASR command takes effect. Note – In the Oracle ILOM shell, there is no notification when the system is powered off. Powering off takes about a minute. Use the show /HOST command to determine if the host has powered off. -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> set /SYS/MB/CMP0/B0B0/CH0/D0 component_state=Enabled -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS64 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “View the System Message Log Files” on page 42 ¦ “ASR Overview” on page 62 ¦ “Display System Components” on page 63 ¦ “Disable System Components” on page 63Detecting and Managing Faults 6566 SPARC T4-1 Server Service Manual • October 201167 Preparing for Service These topics describe how to prepare the server for servicing. ¦ “Safety Information” on page 67 ¦ “Tools Needed for Service” on page 69 ¦ “Find the Chassis Serial Number” on page 69 ¦ “Locate the Server” on page 70 ¦ “Understanding Component Replacement Categories” on page 70 ¦ “Removing Power From the System” on page 74 ¦ “Positioning the System for Service” on page 77 ¦ “Accessing Internal Components” on page 81 Safety Information For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment and described in the documentation shipped with your system. ¦ Follow all cautions and instructions marked on the equipment and described in the SPARC T4-1 Server Safety and Compliance Guide. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Follow the electrostatic discharge safety practices as described in this section. Safety Symbols You will see the following symbols in various places in the server documentation. Note the explanations provided next to each symbol.68 SPARC T4-1 Server Service Manual • October 2011 Caution – There is a risk of personal injury or equipment damage. To avoid personal injury and equipment damage, follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and might cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. ESD Measures ESD-sensitive devices, such as the motherboards, PCI cards, hard drives, and memory cards require special handling. Caution – Circuit boards and hard drives contain electronic components that are extremely sensitive to static electricity. Ordinary amounts of static electricity from clothing or the work environment can destroy the components located on these boards. Do not touch the components along their connector edges. Caution – You must disconnect both power supplies before servicing any of the components documented in this chapter. Antistatic Wrist Strap Use Wear an antistatic wrist strap and use an antistatic mat when handling components such as hard drive assemblies, circuit boards, or PCI cards. When servicing or removing server components, attach an antistatic strap to your wrist and then to a metal area on the chassis. Following this practice equalizes the electrical potentials between you and the server. Antistatic Mat Place ESD-sensitive components such as motherboards, memory, and other PCBs on an antistatic mat.Preparing for Service 69 Tools Needed for Service The following tools should be available for most service operations: ¦ Antistatic wrist strap ¦ Antistatic mat ¦ No. 1 Phillips screwdriver ¦ No. 2 Phillips screwdriver ¦ No. 1 flat-blade screwdriver (battery removal) ¦ Pen or pencil (to power on server) ? Find the Chassis Serial Number If you require technical support for your system, you will be asked to provide the server’s chassis serial number. You can find the chassis serial number on a sticker located on the front of the server and on another sticker on the side of the server. If it is not convenient to read either sticker, you can run the Oracle ILOM show /SYS command to obtain the chassis serial number. ? Type show /SYS at the Oracle ILOM prompt. -> show /SYS /SYS Targets: SERVICE LOCATE ACT PS_FAULT TEMP_FAULT FAN_FAULT ... Properties: type = Host System keyswitch_state = Normal product_name = SPARC T4-1 product_serial_number = 0723BBC006 fault_state = OK clear_fault_action = (none)70 SPARC T4-1 Server Service Manual • October 2011 ? Locate the Server You can use the Locator LEDs to pinpoint the location of a server. This procedure is helpful when you need to identify one particular server from many other servers. 1. At the Oracle ILOM command line, type: The white Locator LEDs (one on the front panel and one on the rear panel) blink. 2. After locating the server, turn the Locator LED off by pressing the Locator button. Note – Alternatively, you can turn off the Locator LED by running the Oracle ILOM set /SYS/LOCATE value=off command. Understanding Component Replacement Categories The server components and assemblies that can be replaced in the field fall into three categories: ¦ “FRU Reference” on page 71 ¦ “Hot Service, Replaceable by Customer” on page 72 ¦ “Cold Service, Replaceable by Customer” on page 73 power_state = On Commands: cd reset set show start stop -> set /SYS/LOCATE value=Fast_BlinkPreparing for Service 71 ¦ “Cold Service, Replaceable by Authorized Service Personnel” on page 74 FRU Reference The following table identifies the server components that are field-replaceable. TABLE: List of Field-replaceable Units Description Quantity FRU Name Remove and Replace Instructions Motherboard assembly 1 /SYS/MB “Servicing the Motherboard Assembly” on page 207 DIMMs 4, 8, or 16 /SYS/MB/CMP0/BOBn/CHn/Dn “Servicing DIMMs” on page 85 Power supplies (or filler panel) 1 or 2 based on power supply configuration /SYS/PSn “Servicing the Power Supplies” on page 117 PCIe cards (optional) 0 to 6 /SYS/MB/RISERn/PCIEn “Servicing PCIe Cards” on page 145 PCIe risers 1, 2, or 3 /SYS/MB/RISERn “Servicing PCIe and PCIe/XAUI Risers” on page 141 Service processor 1 /SYS/MB/SP “Servicing the Service Processor” on page 155 System battery 1 /SYS/MB/BAT “Servicing the System Battery” on page 161 System Configuration PROM 1 /SYS/MB/SCC “Servicing the System Configuration PROM” on page 179 Hard drives (“HDDs” applies to both disk and SSD technologies) 1 - 8 /SYS/HDDn “Servicing Hard Drives” on page 103 DVD/USB assembly 1 /SYS/DVD “Servicing the DVD/USB Assembly” on page 113 Fan modules 6 /SYS/FANBD/FMn “Servicing Fan Modules” on page 165 Fan power board 1 /SYS/FANBD “Servicing the Fan Power Board” on page 173 Hard Drive backplane 1 /SYS/SASBP “Servicing the HDD Backplane” on page 19372 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Preparing for Service” on page 67 ¦ “Returning the Server to Operation” on page 215 Hot Service, Replaceable by Customer The following table identifies the components that can be replaced while power is present on the server. These components can be replaced by customers. Although hot service procedures can be performed while the server is running, you should usually bring it to standby mode as the first step in the replacement procedure. Refer to “Power Off the Server (Power Button - Graceful)” on page 76 for instructions. Cold Service, Replaceable by Customer The following table identifies the components that require the server to be powered down. These components can be replaced by customers. Power Distribution Board (PDB) 1 /SYS/PDB “Servicing the Power Distribution Board” on page 125 Connector board 1 /SYS/CONNBD “Servicing the Connector Board” on page 135 Light pipe kits 1 each, left, right “Servicing the Front Panel Light Pipe Assemblies” on page 201 Hot Service Components (system can have power present) Notes Hard disk drive (HDD) Drive must be offline HDD filler Needed to preserve proper interior air flow Power supply If two power supplies are in use Fan module TABLE: List of Field-replaceable Units (Continued) Description Quantity FRU Name Remove and Replace InstructionsPreparing for Service 73 Cold service procedures require that you shut the server down and unplug the power cables that connect the power supplies to the power source. To shut the server down, perform the following steps: 1. Log in as superuser or equivalent. Tip – Depending on the reason for shutting down system power, you might want to view server status or log files. You also might want to run diagnostics before you shut down the server. 2. Notify affected users that the server will be shut down. Refer to your Oracle Solaris system administration documentation for additional information. 3. Save any open files and quit all running programs. Refer to your application documentation for specific information on these processes. 4. Shut down all logical domains. Refer to the Oracle Solaris system administration documentation for additional information. 5. Shut down the Oracle Solaris OS. Refer to the Solaris system administration documentation for additional information about logical domains. 6. Switch from the system console to the -> prompt by typing the #. (Hash Period) key sequence. 7. At the -> prompt, type the stop /SYS command. 8. Disconnect the power cables from the power supplies. Cold Service (power down system and unplug power cables) Notes SATA optical drive/USB assembly Remove any media DDR3 DIMMs System battery I/O cards (PCIe/XAUI) SP SCC Internal USB74 SPARC T4-1 Server Service Manual • October 2011 Cold Service, Replaceable by Authorized Service Personnel The following table identifies components that must be replaced by authorized service personnel. These replacement procedures can only be done when the server is powered down and power cables are unplugged. See “Cold Service, Replaceable by Customer” on page 73 for the steps involved in shutting down the server. Removing Power From the System These topics describe different methods for removing power from the chassis. ¦ “Power Off the Server (SP Command)” on page 75 ¦ “Power Off the Server (Power Button - Graceful)” on page 76 ¦ “Power Off the Server (Emergency Shutdown)” on page 76 ¦ “Disconnect Power Cords” on page 76 Authorized Service Personnel Only - Cold Service (power down system and disconnect power cables) Notes Motherboard Transfer System Configuration PROM to new motherboard. Fan power board Power Distribution Board (PDB) Configure new PDB with the chassis serial and part numbers. Power supply backplane Connector board Hard Drive backplane This requires removal of the Hard Drive cage first. Light pipe assembly This requires removal of the Hard Drive cage first.Preparing for Service 75 ? Power Off the Server (SP Command) You can use the SP to perform a graceful shutdown of the server, and to ensure that all of your data is saved and the server is ready for restart. Note – Additional information about powering off the server is provided in the SPARC T4 Series Servers Administration Guide. 1. Log in as superuser or equivalent. Depending on the type of problem, you might want to view server status or log files. You also might want to run diagnostics before you shut down the server. 2. Notify affected users that the server will be shut down. Refer to your Oracle Solaris system administration documentation for additional information. 3. Save any open files and quit all running programs. Refer to your application documentation for specific information on these processes. 4. Shut down all logical domains. Refer to the Oracle Solaris system administration documentation for additional information. 5. Shut down the Oracle Solaris OS. Refer to the Oracle Solaris system administration documentation for additional information. 6. Switch from the system console to the -> prompt by typing the #. (Hash Period) key sequence. 7. At the -> prompt, type the stop /SYS command. Note – You can also use the Power button on the front of the server to initiate a graceful server shutdown. (See “Power Off the Server (Power Button - Graceful)” on page 76.) This button is recessed to prevent accidental server power-off. Use the tip of a pen to operate this button. Related Information ¦ “Power Off the Server (Power Button - Graceful)” on page 76 ¦ “Power Off the Server (Emergency Shutdown)” on page 7676 SPARC T4-1 Server Service Manual • October 2011 ? Power Off the Server (Power Button - Graceful) This procedure places the server in the power standby mode. In this mode, the Power OK LED blinks rapidly. ? Press and release the recessed Power button. Use the tip of a pen to operate this button. Related Information ¦ “Power Off the Server (SP Command)” on page 75 ¦ “Power Off the Server (Emergency Shutdown)” on page 76 ? Power Off the Server (Emergency Shutdown) Caution – All applications and files will be closed abruptly without saving changes. File system corruption might occur. ? Press and hold the Power button for four seconds. Related Information ¦ “Power Off the Server (SP Command)” on page 75 ¦ “Power Off the Server (Power Button - Graceful)” on page 76 ? Disconnect Power Cords ? Unplug all power cords from the server. Caution – Because 3.3v standby power is always present in the system, you must unplug the power cords before accessing any cold-serviceable components. Positioning the System for Service These topics explain how to position the system so you can access the components that need servicing.Preparing for Service 77 ¦ “Extend the Server” on page 77 ¦ “Remove the Server From the Rack” on page 79 ? Extend the Server The following components can be serviced with the server in the maintenance position: ¦ Hard drives ¦ Fan modules ¦ DVD/USB module ¦ Fan power board ¦ PCIe/XAUI cards ¦ DDR3 DIMMs ¦ Motherboard battery ¦ SCC module ¦ Service processor module If the server is installed in a rack with extendable slide rails, use this procedure to extend the server to the maintenance position. 1. (Optional) Use the set /SYS/LOCATE command from the -> prompt to locate the system that requires maintenance. Once you have located the server, press the Locator LED and button to turn it off. 2. Verify that no cables will be damaged or will interfere when the server is extended. Although the CMA that is supplied with the server is hinged to accommodate extending the server, you should ensure that all cables and cords are capable of extending. 3. From the front of the server, release the two slide release latches, as shown in the following figure. Squeeze the green slide release latches to release the slide rails. -> set /SYS/LOCATE value=Fast_Blink78 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Slide Release Latches 4. While squeezing the slide release latches, slowly pull the server forward until the slide rails latch. ? Release the CMA For some service procedures, if you are using a CMA, you might need to release it to gain access to the rear of the chassis. Note – For instructions on how to install the CMA for the first time, refer to your server Installation Guide. ? Complete the following tasks to release the CMA: a. Press and hold the tab (step A). b. Swing the CMA out of the way (step B). When you have finished with the service procedure, swing the CMA closed and latch it to the left rack rail.Preparing for Service 79 ? Remove the Server From the Rack The server must be removed from the rack to remove or install the following components: ¦ Motherboard ¦ Power distribution board ¦ Power supply backplane ¦ Connector card ¦ Hard drive backplane ¦ Front panel light-pipe assemblies Caution – If necessary, use two people to dismount and carry the chassis. 1. Disconnect all the cables and power cords from the server.80 SPARC T4-1 Server Service Manual • October 2011 2. Extend the server to the maintenance position. See “Power Off the Server (SP Command)” on page 75. 3. Press the metal lever that is located on the inner side of the rail to disconnect the cable management arm (CMA) from the rail assembly, as shown in the following figure. The CMA is still attached to the cabinet, but the server chassis is now disconnected from the CMA. Caution – If necessary, use two people to dismount and carry the chassis. 4. From the front of the server, pull the release tabs forward and pull the server forward until it is free of the rack rails as shown in the following figure. A release tab is located on each rail.Preparing for Service 81 FIGURE: Release Tabs and Slide Assembly 5. Set the server on a sturdy work surface. Accessing Internal Components These topics explain how to access components contained within the chassis and the steps needed to protect against damage or injury from electrostatic discharge. ¦ “Perform Electrostatic Discharge Prevention Measures” on page 82 ¦ “Remove the Top Cover” on page 8282 SPARC T4-1 Server Service Manual • October 2011 ? Perform Electrostatic Discharge Prevention Measures Many components housed within the chassis can be damaged by electrostatic discharge. To protect these components from damage, perform the following steps before opening the chassis for service. 1. Prepare an antistatic surface to set parts on during the removal, installation, or replacement process. Place ESD-sensitive components such as the printed circuit boards on an antistatic mat. The following items can be used as an antistatic mat: ¦ Antistatic bag used to wrap a replacement part ¦ ESD mat ¦ A disposable ESD mat (shipped with some replacement parts or optional system components) 2. Attach an antistatic wrist strap. When servicing or removing server components, attach an antistatic strap to your wrist and then to a metal area on the chassis. Related Information ¦ “Safety Information” on page 67 ? Remove the Top Cover 1. Unlatch the fan module door. Pull the release tabs back to release the door. 2. Press the top cover release button and slide the top cover to the rear about a 0.5 inch (12.7 mm).Preparing for Service 83 3. Remove the top cover. Lift up and remove the cover. Related Information ¦ “Replace the Top Cover” on page 21584 SPARC T4-1 Server Service Manual • October 201185 Servicing DIMMs These topics explain how to identify, locate, and replace faulty DIMMs. They also describe procedures for upgrading memory capacity and provide guidelines for achieving and maintaining valid memory configurations. ¦ “Memory Fault Handling Overview” on page 85 ¦ “Locate a Faulty DIMM Using the Remind Button” on page 86 ¦ “Identify Faulty DIMMs Using the show faulty Command” on page 89 ¦ “Remove a DIMM” on page 89 ¦ “Install a DIMM” on page 91 ¦ “Increase System Memory With Additional DIMMs” on page 93 ¦ “Verify DIMM Functionality” on page 96 ¦ “Memory Configuration Guidelines” on page 98 ¦ “DIMM Configuration Error Messages” on page 101 Memory Fault Handling Overview A variety of features play a role in how the memory subsystem is configured and how memory faults are handled. Understanding the underlying features helps you identify and repair memory problems. The following server features manage memory faults: ¦ POST – By default, POST runs when the server is powered on. For correctable memory errors (CEs), POST forwards the error to the Oracle Solaris Predictive Self-Healing (PSH) daemon for error handling. If an uncorrectable memory fault is detected, POST displays the fault with the device name of the faulty DIMMs, and logs the fault. POST then disables the faulty DIMMs. Depending on the memory configuration and the location of the faulty DIMM, POST disables half of physical memory in the system, or half the physical memory and half the processor threads. When this offlining process occurs in normal operation, you must replace the faulty DIMMs based on the fault message86 SPARC T4-1 Server Service Manual • October 2011 and enable the disabled DIMMs with the Oracle ILOM command set device component_state=enabled where device is the name of the DIMM being enabled (for example, set /SYS/MB/CMP0/BR0/CH0/D0 component_state= enabled). ¦ Oracle Solaris Predictive Self-Healing (PSH) technology – PSH uses the Fault Manager daemon (fmd) to watch for various kinds of faults. When a fault occurs, the fault is assigned a unique fault ID (UUID), and logged. PSH reports the fault and suggests a replacement for the DIMMs associated with the fault. If you suspect the server has a memory problem, run the Oracle ILOM show faulty command. This command lists memory faults and identifies the DIMM modules associated with the fault. Related Information ¦ “POST Overview” on page 45 ¦ “PSH Overview” on page 56 ¦ “PSH-Detected Fault Example” on page 57 ¦ “Identify Faulty DIMMs Using the show faulty Command” on page 89 ¦ “Locate a Faulty DIMM Using the Remind Button” on page 86 ? Locate a Faulty DIMM Using the Remind Button Use the DIMM Remind button to identify faulty DIMMs. 1. Extend the server to the maintenance position. See “Extend the Server” on page 77. 2. Disconnect power from the server. See “Removing Power From the System” on page 74. 3. Attach an antistatic wrist strap. 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Swing the air duct up and forward to the fully open position.Servicing DIMMs 87 6. Press the DIMM Remind button on the motherboard (callout 1 in the figure). This will cause an amber LED associated with the faulty DIMM to light for a few minutes. 7. Note the DIMM next to the illuminated LED.88 SPARC T4-1 Server Service Manual • October 2011 8. Ensure that all other DIMMs are seated correctly in their slots. Related Information ¦ “Identify Faulty DIMMs Using the show faulty Command” on page 89 ? Identify Faulty DIMMs Using the show faulty Command The Oracle ILOM show faulty command displays current system faults, including DIMM failures. Figure Legend 1 Individual DIMM fault LEDsServicing DIMMs 89 ? Enter show faulty at the -> prompt. Related Information ¦ “Remove a DIMM” on page 89 ¦ “Install a DIMM” on page 91 ¦ “Verify DIMM Functionality” on page 96 ? Remove a DIMM Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – Do not leave DIMM slots empty. You must install filler panels in all empty DIMM slots. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77. 3. Attach an antistatic wrist strap. 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Swing the air duct up and forward to the fully open position. -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/MB/CMP0/B0B0/CH0/D0 /SP/faultmgmt/0 | timestamp | Dec 21 16:40:56 /SP/faultmgmt/0/ | timestamp | Dec 21 16:40:56 faults/0 /SP/faultmgmt/0/ | sp_detected_fault | /SYS/MB/CMP0/B0B0/CH0/D0 faults/0 | | Forced fail(POST)90 SPARC T4-1 Server Service Manual • October 2011 6. Press the Remind button on the motherboard to identify the DIMMs that need to be replaced. 7. Push down on the ejector tabs on each side of the DIMM until the DIMM is released. See panel 3 in the preceding figure. Caution – DIMMs and heat sinks on the motherboard may be hot. 8. Grasp the top corners of the faulty DIMM and lift it out of its slot. 9. Place the DIMM on an antistatic mat. 10. Repeat Step 7 through Step 9 for any other DIMMs you intend to remove. 11. If you do not plan to install replacement DIMMs at this time, install filler panels in the empty slots. Related Information ¦ “Install a DIMM” on page 91 ¦ “Verify DIMM Functionality” on page 96Servicing DIMMs 91 ? Install a DIMM Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77 3. Attach an antistatic wrist strap. 4. Remove the top cover. See “Remove the Top Cover” on page 82 5. Swing the air duct up and forward to the fully open position. 6. Unpack the replacement DIMMs and place them on an antistatic mat. 7. Ensure that the ejector tabs on the connector that will receive the DIMM are in the open position. FIGURE: Installing DIMMs 8. Align the DIMM notch with the key in the connector.92 SPARC T4-1 Server Service Manual • October 2011 Caution – Ensure that the orientation is correct. The DIMM might be damaged if the orientation is reversed. 9. Push the DIMM into the connector until the ejector tabs lock the DIMM in place. If the DIMM does not easily seat into the connector, check the DIMM’s orientation. 10. Repeat Step 7 through Step 9 until all new DIMMs are installed. 11. Return the air duct to the closed position. 12. Install the top cover. See “Replace the Top Cover” on page 215. 13. Slide the server into the rack. See “Reinstall the Server in the Rack” on page 216. 14. Connect the power cords. See.“Reconnect the Power Cords” on page 218. Note – As soon as the power cords are connected, standby power is applied. Depending on how the firmware is configured, the system might boot at this time. Caution – Do not leave DIMM slots empty. You must install filler panels in all empty DIMM slots. Related Information ¦ “Remove a DIMM” on page 89 ¦ “Increase System Memory With Additional DIMMs” on page 93 ¦ “Verify DIMM Functionality” on page 96Servicing DIMMs 93 ? Increase System Memory With Additional DIMMs Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. You should be familiar with the memory configuration guidelines described in “Memory Configuration Guidelines” on page 98 before adding new DIMMs to increase a server’s memory capacity. Caution – You must disconnect the power cables from the system before performing this procedure. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Unpack the new DIMMs and place them on an antistatic mat. 3. Swing the air duct up and forward to the fully open position. 4. At a DIMM slot that is to be upgraded, open the ejector tabs and remove the filler panel. Do not dispose of the filler panel. You may want to reuse it if any DIMMs are removed at another time. 5. Align the notch on the bottom edge of the DIMM with the key in the connector. This alignment ensures that the DIMM is oriented correctly. 6. Press the DIMM into the connector until the ejector tabs lock the DIMM in place.94 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Installing DIMMs Note – If the DIMM does not easily seat into the connector, do not try to force it into position. Instead, check its orientation. If the orientation is not correct, forcing the DIMM into the connector is likely to damage the DIMM, or the connector, or both. 7. Repeat Step 4 through Step 6 until all DIMMs are installed. 8. Return the air duct to the closed position. 9. Install the top cover. See “Replace the Top Cover” on page 215. 10. Slide the server into the rack. See “Reinstall the Server in the Rack” on page 216. 11. Connect the power supplies. See “Reconnect the Power Cords” on page 218. Note – As soon as the power cords are connected, standby power is applied. Depending on how the firmware is configured, the system might boot at this time. 12. Power on the server. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218. 13. Perform the following steps to verify that there are no faults:Servicing DIMMs 95 a. Set the virtual keyswitch to diag so that POST will run in Service mode. b. Power cycle the system. Note – The server takes about one minute to power off. The Oracle ILOM console does not indicate when the system is actually powered off. c. Switch to the system console to view POST output. Watch the POST output for possible fault messages. The following output is a sign that POST did not detect any faults: Note – The system might boot automatically at this point. If so, go directly to Step e. If it remains at the ok prompt go to Step d. d. If the system remains at the ok prompt, type boot. e. Return the virtual keyswitch to Normal mode. -> set /SYS keyswitch_state=Diag Set ‘keyswitch_state’ to ‘Diag’ -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /HOST/console . . . 0:7:2>INFO: 0:7:2> POST Passed all devices. 0:7:2>POST: Return to VBSC. 0:7:2>Master set ACK for vbsc runpost command and spin... -> set /SYS keyswitch_state=Normal Set ‘ketswitch_state’ to ‘Normal’96 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Remove a DIMM” on page 89 ¦ “Install a DIMM” on page 91 ¦ “Verify DIMM Functionality” on page 96 ¦ “Memory Configuration Guidelines” on page 98 ? Verify DIMM Functionality 1. Access the Oracle ILOM -> prompt. Refer to the SPARC T4 Series Servers Administration Guide for instructions. 2. Use the show faulty command to determine how to clear the fault. ¦ If show faulty indicates a POST-detected the fault go to Step 3. ¦ If show faulty output displays a UUID, which indicates a host-detected fault, skip Step 3 and go directly to Step 4. 3. Use the set command to enable the DIMM that was disabled by POST. In most cases, replacement of a faulty DIMM is detected when the SP is power cycled. In those cases, the fault is automatically cleared from the system. If show faulty still displays the fault, the set command will clear it. 4. For a host-detected fault, perform the following steps to verify the new DIMM: a. Set the virtual keyswitch to diag so that POST will run in Service mode. b. Power cycle the system. -> set /SYS/MB/CMP0/BR0/CH0/D0 component_state=Enabled -> set /SYS/keyswitch_state=Diag Set ‘keyswitch_state’ to ‘Diag’ -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYSServicing DIMMs 97 Note – Use the show /HOST command to determine when the host has been powered off. The console will display status=Powered Off. Allow approximately one minute before running this command. c. Switch to the system console to view POST output. Watch the POST output for possible fault messages. The following output indicates that POST did not detect any faults: Note – The system might boot automatically at this point. If so, go directly to Step e. If it remains at the ok prompt go to Step d. d. If the system remains at the ok prompt, type boot. e. Return the virtual keyswitch to Normal mode. f. Switch to the system console and type the Oracle Solaris OS fmadm faulty command. If any faults are reported, refer to the diagnostics instructions described in “Oracle ILOM Troubleshooting Overview” on page 25. 5. Switch to the Oracle ILOM command shell. -> start /HOST/console . . . 0:7:2>INFO: 0:7:2> POST Passed all devices. 0:7:2>POST: Return to VBSC. 0:7:2>Master set ACK for vbsc runpost command and spin... -> set /SYS keyswitch_state=Normal Set ‘ketswitch_state’ to ‘Normal’ # fmadm faulty98 SPARC T4-1 Server Service Manual • October 2011 6. Run the show faulty command. If the show faulty command reports a fault with a UUID go on to Step 7. If show faulty does not report a fault with a UUID, you are done with the verification process. 7. Switch to the system console and type the fmadm repair command with the UUID. Use the same UUID that was displayed from the output of the Oracle ILOM show faulty command. Related Information ¦ “Remove a DIMM” on page 89 ¦ “Install a DIMM” on page 91 ¦ “Increase System Memory With Additional DIMMs” on page 93 ¦ “Memory Configuration Guidelines” on page 98 Memory Configuration Guidelines Keep the following guidelines in mind when installing, upgrading, or replacing DIMMs: ¦ The motherboard contains 16 memory slots that support DDR3 DIMMs. ¦ Three DIMM capacities are supported: 4 GBytes, 8 GBytes, and 16 GBytes -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/MB/CMP0/B0B0/CH1/D0 /SP/faultmgmt/0 | timestamp | Dec 14 22:43:59 /SP/faultmgmt/0/ | sunw-msg-id | SUN4V-8000-DX faults/0 | | /SP/faultmgmt/0/ | uuid | 3aa7c854-9667-e176-efe5-e487e520 faults/0 | | 7a8a /SP/faultmgmt/0/ | timestamp | Dec 14 22:43:59 faults/0 | | # fmadm repair 3aa7c854-9667-e176-efe5-e487e520Servicing DIMMs 99 ¦ The DIMM slots are organized into four branches, with each branch connected to a separate Buffer-on-Board ASIC. These branches are shown in the following figure as BOB0 through BOB3. ¦ Each BOB ASIC supports two DIMMs through separate DDR3 channels. ¦ The DIMM slots may be populated as 1/4 full, 1/2 full, or full. Use the following figure as a guide for populating the DIMM slots. ¦ 1/4 Full -- Install DIMMs in the slots labeled 1 only. ¦ 1/2 Full -- Install DIMMs in the slots labeled 1 and 2 only. ¦ Full -- Install DIMMs in every slot (1, 2, and 3). ¦ All DIMMs in the server must be the same in the following characteristics: ¦ DIMM size -- All DIMMs must have the same capacity (all 4-GByte, all 8-GByte, or all 16-GByte). ¦ DRAM type -- The memory organization on all DIMMs must be either 1 GByte or 2 GByte. ¦ Rank -- All DIMMs must have the same number of ranks. ¦ Architecture -- All DIMMs must use either x4 or x8 memory organization. ¦ Any DIMM slot that does not have a DIMM installed must have a DIMM filler. Note – The server must have at least a 1/4-full memory configuration. If the server’s memory configuration fails to meet any of these rules, applicable error messages are reported. See “DIMM Configuration Error Messages” on page 101 for a description of these messages.100 SPARC T4-1 Server Service Manual • October 2011 FIGURE: DIMM Slot Layout on the Motherboard Related Information ¦ “Locate a Faulty DIMM Using the Remind Button” on page 86 ¦ “Identify Faulty DIMMs Using the show faulty Command” on page 89 ¦ “Remove a DIMM” on page 89 ¦ “Install a DIMM” on page 91 Figure Legend 1 For a 1/4-full configuration, populate only the slot locations labeled 1. 2 For a 1/2-full configuration, populate the slot locations labeled 1 and 2. 3 For a fully populated configuration, fill all the DIMM slots.Servicing DIMMs 101 ¦ “Increase System Memory With Additional DIMMs” on page 93 ¦ “Verify DIMM Functionality” on page 96 ¦ “DIMM Configuration Error Messages” on page 101 DIMM Configuration Error Messages When the system boots, system firmware checks the memory configuration against the rules described in “Memory Configuration Guidelines” on page 98. If it discovers any the following general error message is displayed: Please refer to the service documentation for supported memory configurations. In addition, one or more rule-specific messages will be displayed indicating the type of configuration error that has been discovered. The following table identifies and explains the various DIMM configuration error messages. Note – The messages described in this table apply to SPARC T4-1 servers. The DIMM configuration requirements for other servers in the SPARC T4 series are different in some details, so some of their configuration error messages will also be different. DIMM Configuration Error Messages Notes Not all MCUs enabled. Unsupported Config. Ensure that both MCUs are enabled. Invalid DIMM population. No DIMM is present in MCUn/BOBn Install a DIMM with the appropriate characteristics in the slot specified in the message. Not all DIMMs have the same SDRAM capacity. All DIMM components must have the same storage capacity -- all 4 GByte, all 8 GByte, or all 16 GByte. Replace any DIMMs that do not match the desired capacity. Not all DIMMs have the same device width. All DIMM components must have the same device width. Replace any DIMMs that do not match the desired width.102 SPARC T4-1 Server Service Manual • October 2011 Not all DIMMs have the same number of ranks. All DIMM components must have the same number of ranks. The supported rank arrangements are: • 1 rank -- 4 GByte, 8 Gbyte, 16 Gbyte DIMMs • 2 ranks -- 4 GByte, 8 Gbyte, 16 Gbyte DIMMs • 4 ranks -- 16 Gbyte DIMMs only Replace any DIMMs that do not match the desired rank number. Invalid DIMM population. DIMMs in the same position must be all present or absent. Memory configurations must be populated in sets of 4, 8, or 16 DIMM components distributed across the MCU branches as shown in FIGURE: DIMM Slot Layout on the Motherboard on page 100. Either add DIMM components to fill a partially populated set or remove DIMM components to empty a partial set. Note - The DIMM slots labeled set 1 in the figure must always be fully populated. Invalid DIMM population. T4-1 only supports 1/4, 1/2 or full memory configs. Add or remove DIMM components to achieve one of the supported memory configurations. DIMM population across nodes is different. This message does not apply to SPARC T4-1 servers. DRAM capacity of DIMMs is different across nodes. This message does not apply to SPARC T4-1 servers. Device width of DIMM is different across nodes. This message does not apply to SPARC T4-1 servers. Number of ranks of DIMM is different across nodes. This message does not apply to SPARC T4-1 servers. DIMM Configuration Error Messages Notes103 Servicing Hard Drives These topics describe tasks you perform when replacing hard drives. ¦ “Hard Drive Hot-Pluggable Capabilities” on page 103 ¦ “Hard Drive Slot Configuration Reference” on page 104 ¦ “Hard Drive LEDs” on page 105 ¦ “Remove a Hard Drive” on page 107 ¦ “Install a Hard Drive” on page 109 ¦ “Verify the Functionality of a Hard Drive” on page 110 Hard Drive Hot-Pluggable Capabilities The hard drives are hot-pluggable, meaning that the drives can be removed and inserted while the server is powered on. Note – The term “hard drive” is used in this documentation to mean either disk-based hard drives or solid state drives (SSDs). The term “HDD” is also sometimes used and has the same meaning. Both disk drive and SSD technologies are supported. Depending on the configuration of the data on a particular drive, the drive might also be removable while the server is online. However, to hot-plug a drive while the server is online you must take the drive offline before you can safely remove it. Taking a drive offline prevents any applications from accessing it, and removes the logical software links to it. The following situations inhibit your ability to hot-plug a drive: ¦ If the drive contains the operating system, and the operating system is not mirrored on another drive. ¦ If the drive cannot be logically isolated from the online operations of the server.104 SPARC T4-1 Server Service Manual • October 2011 If either of these conditions apply to the drive being serviced, you must take the server offline (shut down the operating system) before you replace the drive. Related Information ¦ “Hard Drive Slot Configuration Reference” on page 104 ¦ “Hard Drive LEDs” on page 105 ¦ “Servicing the HDD Backplane” on page 193 ¦ “Servicing the HDD Cage” on page 187 Hard Drive Slot Configuration Reference This topic describes the server’s hard drive slot organization. Address mapping between the Oracle Solaris OS device paths and physical hard drive slots is not fixed. For many storage administration tasks, the mapping of OS device names to physical hard drive slots must be determined before the task can be performed. See the SPARC T4 series servers administration guide for information on mapping SAS controller ports to physical drive slots. Note – The server requires at least one hard drive to be installed and operational. Drive Backplane Slot Configuration Reference The following table identifies the drive slot numbering in the SPARC T4-1 disk backplane. Related Information ¦ “Hard Drive LEDs” on page 105 ¦ “Remove a Hard Drive” on page 107 TABLE: Physical Drive Locations in the SPARC T4-1 Disk Backplane HDD1 HDD3 HDD5 DVD HDD0 HDD2 HDD4 HDD6 HDD7Servicing Hard Drives 105 ¦ “Install a Hard Drive” on page 109 ¦ “Verify the Functionality of a Hard Drive” on page 110 Hard Drive LEDs The status of each hard drive is represented by the same three LEDs. These are shown in the following figure and described in the table that follows the figure. FIGURE: Status LEDs for Hard Drives The following table explains how to interpret the hard drive status LEDs. Note – The front and rear panel Service Required LEDs are also lit when the system detects a hard drive fault. TABLE: Hard Drive Status LEDs LED Description 1 Ready to Remove (blue) Indicates that a hard drive can be removed during a hot-plug operation. 2 Service Required (amber) Indicates that the hard drive is has experienced a fault condition. 3 OK/Activity (green) Indicates the HDD’s availability for use. • On -- Read or write activity is in progress. • Off -- Drive is idle and available for use.106 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Remove a Hard Drive” on page 107 ¦ “Install a Hard Drive” on page 109 ¦ “Verify the Functionality of a Hard Drive” on page 110 ? Remove a Hard Drive Note – This is a hot service procedure that can be performed by customers while the server is running. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. Caution – The drive must be taken offline before it is removed. If it cannot be taken offline, the OS must be shut down to prevent running programs from attempting to use it. 1. Determine if you need to shut down the OS to replace the drive, and perform one of the following actions: ¦ If the drive cannot be taken offline without shutting down the OS, follow instructions in “Power Off the Server (SP Command)” on page 75. Then go to Step 3. ¦ If the drive can be taken offline without shutting down the OS, go to Step 2. 2. Take the drive offline:Servicing Hard Drives 107 a. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including drives that are not configured: This command lists dynamically reconfigurable hardware resources and shows their operational status. In this case, look for the status of the drive you plan to remove. This information is listed in the Occupant column. You must unconfigure any drive whose status is listed as configured, as described in Step b. b. Unconfigure the drive using the cfgadm -c unconfigure command. Example: Replace c0:dsk/c1t1d0 with the drive name that applies to your situation. c. Verify that the drive’s blue Ready-to-Remove LED is lit. 3. Press the drive release button to unlock the drive and pull on the latch to remove the drive. # cfgadm -al Ap_id Type Receptacle Occupant Condition c0 scsi-bus connected configured unknown c0::dsk/c1t0d0 disk connected configured unknown c0::dsk/c1t0d0 disk connected configured unknown usb0/1 unknown empty unconfigured ok usb0/2 unknown empty unconfigured ok . . . # cfgadm -c unconfigure c0::dsk/c1t1d0108 SPARC T4-1 Server Service Manual • October 2011 Caution – The latch is not an ejector. Do not force the latch too far to the right. Doing so can damage the latch. 4. Install the replacement drive or a filler tray. See “Install a Hard Drive” on page 109. Related Information ¦ “Install a Hard Drive” on page 109 ¦ “Verify the Functionality of a Hard Drive” on page 110 ? Install a Hard Drive Note – This is a hot service procedure that can be performed by customers while the server is running. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. 1. With the latch open on the replacement drive, insert the drive into the drive bay and slide it forward until it is seated. Tip – Drives are physically addressed according to the slot in which they are installed. If you are replacing a drive, install the replacement drive in the same slot as the drive that was removed.Servicing Hard Drives 109 2. Close the latch to lock the drive in place. 3. Bring the drive online. Configure the drive using the cfgadm -c configure command. In the following example, the drive at c0::dsk/c1t1d0 will be configured. 4. Verify the drive. See “Verify the Functionality of a Hard Drive” on page 110. Related Information ¦ “Remove a Hard Drive” on page 107 ¦ “Verify the Functionality of a Hard Drive” on page 110 ? Verify the Functionality of a Hard Drive 1. If the OS is shut down, and the drive you replaced was not the boot device, boot the OS. Depending on the nature of the replaced drive, you might need to perform administrative tasks to reinstall software before the server can boot. Refer to the Oracle Solaris OS administration documentation for more information. # cfgadm -c configure c0::dsk/c1t1d0110 SPARC T4-1 Server Service Manual • October 2011 2. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including any drives that are not configured: This command helps you identify the drive you installed. 3. Configure the drive using the cfgadm -c configure command. Example: Replace c0::sd1 with the drive name for your configuration. 4. Verify that the blue Ready-to-Remove LED is no longer lit on the drive that you installed. See “Hard Drive LEDs” on page 105. 5. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including any drives that are not configured: The replacement drive is now listed as configured. Example: # cfgadm -al Ap_id Type Receptacle Occupant Condition c0 scsi-bus connected configured unknown c0::dsk/c1t0d0 disk connected configured unknown c0::sd1 disk connected unconfigured unknown usb0/1 unknown empty unconfigured ok usb0/2 unknown empty unconfigured ok . . . # cfgadm -c configure c0::sd1 # cfgadm -al Ap_Id Type Receptacle Occupant Condition c0 scsi-bus connected configured unknown c0::dsk/c1t0d0 disk connected configured unknown c0::dsk/c1t1d0 disk connected configured unknown usb0/1 unknown empty unconfigured ok usb0/2 unknown empty unconfigured ok . . .Servicing Hard Drives 111 6. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not verify the drive, see “Diagnostics Process” on page 16. ¦ If the previous steps indicate that the drive is functioning properly, perform the tasks required to configure the drive. These tasks are covered in the Oracle Solaris OS administration documentation. For additional drive verification, you can run Oracle VTS. Refer to the Oracle VTS documentation for details. Related Information ¦ “Hard Drive Slot Configuration Reference” on page 104 ¦ “Hard Drive Hot-Pluggable Capabilities” on page 103 ¦ “Remove a Hard Drive” on page 107 ¦ “Install a Hard Drive” on page 109112 SPARC T4-1 Server Service Manual • October 2011113 Servicing the DVD/USB Assembly These topics explain how to remove and install DVD/USB modules. ¦ “DVD/USB Assembly Overview” on page 113 ¦ “Remove the DVD/USB Assembly” on page 114 ¦ “Install the DVD/USB Assembly” on page 115 DVD/USB Assembly Overview The DVD module and front USB board are mounted in a removable assembly that is accessed from the server’s front panel. Note – The DVD interface on the hard drive backplane uses serial SATA technology. FIGURE: DVD/USB Module114 SPARC T4-1 Server Service Manual • October 2011 ? Remove the DVD/USB Assembly Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Remove any optical disks from the DVD module and unplug any USB cables from the USB port. 3. Bring the server to the standby mode. Momentarily press the recessed Power button on the server front panel. You may need to use a pointed object, such as a stylus or pen. 4. Unplug the power cords. See “Disconnect Power Cords” on page 76. 5. Attach an antistatic wrist strap. 6. If the lower right hard drive bay contains an HDD or SDD module, remove it. This is the disk bay at location HDD7. See “Hard Drive Slot Configuration Reference” on page 104. 7. Reach in under the DVD/USB module and pull the release tab out. Use the finger indentation in the hard drive bay below the DVD/USB module to extend the release tab. 8. Slide the DVD/USB module out of the hard drive cage.Servicing the DVD/USB Assembly 115 9. Place the module on an antistatic mat. Related Information ¦ “Install the DVD/USB Assembly” on page 115 ¦ “DVD/USB Assembly Overview” on page 113 ? Install the DVD/USB Assembly Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – Be certain the DVD module you will install is of the serial ATA (SATA) type. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Slide the DVD/USB module into the front of the chassis until it seats.116 SPARC T4-1 Server Service Manual • October 2011 3. Slide the release tab back into the system. 4. If you removed a hard drive from the lower right drive bay, reinstall it. 5. Plug in the power cords. See “Reconnect the Power Cords” on page 218. 6. Power on the system. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218. Related Information ¦ “Remove the DVD/USB Assembly” on page 114 ¦ “DVD/USB Assembly Overview” on page 113117 Servicing the Power Supplies The following topics describe the tasks you perform to replace a power supply. ¦ “Power Supply Hot-Swap Capabilities” on page 117 ¦ “Locate a Faulty Power Supply” on page 119 ¦ “Remove a Power Supply” on page 119 ¦ “Install a Power Supply” on page 120 ¦ “Verify the Functionality of a Power Supply” on page 122 ¦ “Remove or Install a Power Supply Filler Panel” on page 122 Power Supply Hot-Swap Capabilities The two power supply units in your server enable you to hot-swap a power supply when needed. Related Information ¦ “Power Supply LEDs” on page 117 ¦ “Remove a Power Supply” on page 119 ¦ “Install a Power Supply” on page 120 ¦ “Verify the Functionality of a Power Supply” on page 122 ¦ “Remove or Install a Power Supply Filler Panel” on page 122 Power Supply LEDs Each power supply is provided with a set of three LEDs, as shown in the figure.118 SPARC T4-1 Server Service Manual • October 2011 FIGURE: Power Supply LEDs The following table describes the three power supply LEDs Note – If a power supply fails and you do not have a replacement available, leave the failed power supply installed to ensure proper airflow in the server. Related Information ¦ “Locate a Faulty Power Supply” on page 119 ¦ “Remove a Power Supply” on page 119 ¦ “Install a Power Supply” on page 120 ¦ “Verify the Functionality of a Power Supply” on page 122 TABLE: Power Supply Status LEDs Legend LED Icon Color 1 OK Green This LED lights when the power supply DC voltage from the PSU to the server is within tolerance. 2 Fault Amber This LED is lit when the power supply is faulty. Note - The front and rear panel Service Required LEDs are also lit if the system detects a power supply fault. 3 AC Present ~AC Green This LED turns on when AC voltage is applied to the power supply. Note - For DC models, this is the DC input OK LED. It turns on when the input DC power is present.Servicing the Power Supplies 119 ? Locate a Faulty Power Supply A faulty power supply will cause the Service Required LEDs (front and rear panels) as well as the Fault LED located on the power supply to light. ? From the rear of the server, check the power supply fault LEDs to identify which supply needs to be replaced. ? Remove a Power Supply Note – This may be a hot service procedure that can be performed by customers while the server is running. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. 1. Identify which power supply (0 or 1) requires replacement. See “Locate a Faulty Power Supply” on page 119. 2. Determine if you can hot-swap the power supply: ¦ If there are two power supplies, you can hot-swap the faulty power supply without shutting down the server. Go to Step 4. ¦ If there in only one power supply, you must shut down the server before replacing the power supply. Go to Step 3 3. Shut down the Oracle Solaris OS. See “Power Off the Server (SP Command)” on page 75 4. Disconnect the power cord from the faulty power supply. 5. Grasp the power supply handle, press the release latch and pull the power supply out of the server.120 SPARC T4-1 Server Service Manual • October 2011 Caution – If you will not be replacing the power supply immediately, install a power supply filler panel before returning power to the server. See “Remove or Install a Power Supply Filler Panel” on page 122. Related Information ¦ “Install a Power Supply” on page 120 ¦ “Verify the Functionality of a Power Supply” on page 122 ? Install a Power Supply Note – This is a hot service procedure that can be performed by customers while the server is running. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. 1. If the power supply bay contains a power supply filler panel, remove it.Servicing the Power Supplies 121 2. Align the replacement power supply with the empty power supply chassis bay. 3. Slide the power supply into the chassis until it locks into place. 4. Plug the power cord into the power supply. Note – As soon as power is applied to the server, standby power initializes the SP. Depending on the server’s OBP settings, the host server might automatically boot, or you might need to boot it manually.122 SPARC T4-1 Server Service Manual • October 2011 5. Verify the functionality of the power supply. See “Verify the Functionality of a Power Supply” on page 122. Related Information ¦ “Remove a Power Supply” on page 119 ¦ “Verify the Functionality of a Power Supply” on page 122 ? Verify the Functionality of a Power Supply 1. Verify that the power supply Power OK and AC Present LEDs are lit, and that the Fault LED is not lit. See “Power Supply LEDs” on page 117. 2. Verify that the front and rear Service Required LEDs are not lit. See “Front Panel System Controls and LEDs” on page 20. 3. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 16. ¦ If Step 1 and Step 2 indicate that no faults have been detected, return the server to operation: See “Returning the Server to Operation” on page 215. Related Information ¦ “Remove a Power Supply” on page 119 ¦ “Install a Power Supply” on page 120 ? Remove or Install a Power Supply Filler Panel This procedure describes how to remove or install a power supply filler panel.Servicing the Power Supplies 123 Note – During operation, and empty power supply bay must have a filler panel installed for proper environmental control. ? Depending on your desired task, perform one of the following tasks: ¦ Remove a filler panel – Grasp an inside edge of the filler panel and pull out the filler panel. ¦ Install a filler panel – Align the filler panel with the empty power supply bay and push it into the bay.124 SPARC T4-1 Server Service Manual • October 2011125 Servicing the Power Distribution Board The following topics explain how to remove and install power distribution boards. They also provide important safety information related to working with power distribution boards. ¦ “Power Distribution Board Overview” on page 125 ¦ “Remove the Power Distribution Board” on page 126 ¦ “Install the Power Distribution Board” on page 127 Power Distribution Board Overview The power distribution board distributes main 12V power from the power supplies to the rest of the system. It is directly connected to the connector card and to the motherboard by means of a bus bar and ribbon cable. This board also supports a top cover safety interlock (“kill”) switch. It is easier to service the power distribution board with the bus bar assembly attached. If you are replacing a faulty power distribution board, you must remove the bus bar assembly from the old board and attach the assembly to the new power distribution board. When a faulty power distribution board is replaced, the chassis serial number and part number must be programmed into the new power distribution board. This must be done in a special service mode by trained service personnel. These numbers are needed for obtaining product support. Caution – The system supplies power to the power distribution board even when the server is powered off. To avoid personal injury or damage to the server, you must disconnect all power cords before servicing the power distribution board.126 SPARC T4-1 Server Service Manual • October 2011 ? Remove the Power Distribution Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Remove the system from the rack. See “Remove the Server From the Rack” on page 79. 2. Remove the motherboard assembly. See “Remove the Motherboard Assembly” on page 208. 3. Disconnect the top cover interlock cable from the power distribution board. 4. Disconnect the two ribbon cables and the three-pin wire cable. 5. Remove the five screws that secure the power distribution board.Servicing the Power Distribution Board 127 6. Grasp the bus bar and move the bus bar/power distribution board assembly to the left, away from the connector board and then up off the three standoffs. 7. If the power distribution board will be replaced, remove the bus bar from the assembly so it can be attached to the replacement power distribution board. Related Information ¦ “Install the Power Distribution Board” on page 127 ? Install the Power Distribution Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected.128 SPARC T4-1 Server Service Manual • October 2011 Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. If you have a bus bar from a previous bus bar/power distribution assembly, attach it to the new power distribution board. 2. Lower the bus bar/power distribution board assembly into the chassis. The power distribution board fits over a set of three mushroom standoffs in the floor of the chassis. 3. Slide the power distribution board/bus bar assembly to the right, until it plugs into the connector board. 4. Install one screw to secure the power distribution board to the chassis. 5. Attach the other four screws to secure the power distribution board to the power supply backplane bus bars. 6. Connect the power supply backplane ribbon cable to its plug on the power distribution board. 7. Reconnect the two ribbon cables.Servicing the Power Distribution Board 129 8. Reconnect the three-pin wire cable from the power supply backplane to the power distribution board. 9. Reconnect the top cover interlock cable to the power distribution board. 10. Install the motherboard assembly. See “Install the Motherboard Assembly” on page 211. Note – After a new power distribution board is installed and the system is powered on, the chassis serial number and server part number must be programmed into the power distribution board. This operation is performed in a special service mode. Related Information ¦ “Remove the Power Distribution Board” on page 126130 SPARC T4-1 Server Service Manual • October 2011131 Servicing the Power Supply Backplane The following topics explain how to remove and install the power supply backplane. ¦ “Power Supply Backplane Overview” on page 131 ¦ “Remove the Power Supply Backplane” on page 132 ¦ “Install the Power Supply Backplane” on page 133 Power Supply Backplane Overview The power supply backplane carries 12V power from the power supplies to the power distribution board over a pair of bus bars. It also delivers 3.3V standby power over a three-pin wire cable. Caution – The system supplies standby power to the power distribution board even when the server is powered off. To avoid personal injury or damage to the server, you must disconnect the power cords before servicing the power supply backplane. Related Information ¦ “Remove the Power Supply Backplane” on page 132 ¦ “Install the Power Supply Backplane” on page 133132 SPARC T4-1 Server Service Manual • October 2011 ? Remove the Power Supply Backplane Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Remove the system from the rack. See “Remove the Server From the Rack” on page 79. 2. Remove the motherboard assembly. See “Remove the Motherboard Assembly” on page 208. 3. Remove the power supplies. See “Remove a Power Supply” on page 119 4. Remove the power distribution board. See “Remove the Power Distribution Board” on page 126. 5. Remove the screw securing the power supply backplane to the power supply bay.Servicing the Power Supply Backplane 133 6. Lift the power supply backplane up and off its standoffs and out of the system. 7. Place the power supply backplane on an antistatic mat. Related Information ¦ “Install the Power Supply Backplane” on page 133 ? Install the Power Supply Backplane Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards.134 SPARC T4-1 Server Service Manual • October 2011 Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Mount the power supply backplane to the front of the power supply bay. Place the backplane over its standoffs. 2. Secure the power supply backplane with a single screw. 3. Install the power distribution board. See “Install the Power Distribution Board” on page 127. 4. Install the power supplies. Slide each power supply into its bay until the power supply locks into place. 5. Install the motherboard assembly. See “Install the Motherboard Assembly” on page 211. Related Information ¦ “Remove the Power Supply Backplane” on page 132135 Servicing the Connector Board These topics explain how to remove and install the connector board. ¦ “Connector Board Overview” on page 135 ¦ “Remove the Connector Board” on page 135 ¦ “Install the Connector Board” on page 137 Connector Board Overview The connector board serves as the interconnect between the power distribution board and the fan power board, hard drive backplane, and front I/O board. Related Information ¦ “Remove the Connector Board” on page 135 ¦ “Install the Connector Board” on page 137 ? Remove the Connector Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected.136 SPARC T4-1 Server Service Manual • October 2011 Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Remove the system from the rack. See “Remove the Server From the Rack” on page 79. 3. Remove the motherboard assembly. See “Remove the Motherboard Assembly” on page 208. 4. Remove the power distribution board. See “Remove the Power Distribution Board” on page 126. 5. Disconnect the connector board end of the power and data cables that lead to the fan power board. 6. Remove the two screws that secure the connector board to the midwall.Servicing the Connector Board 137 7. Slide the connector board back to disengage it from the hard drive backplane. 8. Tilt the connector board away from the side of the chassis and lift it up and out of the system. 9. Place the connector board on an antistatic mat. Related Information ¦ “Install the Connector Board” on page 137 ? Install the Connector Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.138 SPARC T4-1 Server Service Manual • October 2011 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Using the mushroom standoff as an alignment guide, lower the connector board into the chassis. 2. Slide the connector board forward to plug it into the hard drive backplane. 3. Secure the connector board with two screws. 4. Connect the power and data cables from the fan power board. 5. Install the power distribution board. See “Install the Power Distribution Board” on page 127.Servicing the Connector Board 139 6. Install the motherboard assembly. See “Install the Motherboard Assembly” on page 211. Related Information ¦ “Remove the Connector Board” on page 135140 SPARC T4-1 Server Service Manual • October 2011141 Servicing PCIe and PCIe/XAUI Risers The following topics describe the procedures for replacing PCIe cards. ¦ “Remove a PCIe or PCIe/XAUI Riser” on page 141 ¦ “Install a PCIe or PCIe/XAUI Riser” on page 143 ? Remove a PCIe or PCIe/XAUI Riser Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77. 3. Remove the top cover. See “Remove the Top Cover” on page 82.142 SPARC T4-1 Server Service Manual • October 2011 4. Attach an antistatic wrist strap. 5. Remove the PCIe2 cross beam. Loosen the two green captive screws (panel 1). 6. Push the crossbeam to the rear and lift up (panel 2). 7. Loosen the screw that secures the riser to the motherboard (panel 3). 8. Lift the riser up to disengage the connector (panel 4). Related Information ¦ “Install a PCIe or PCIe/XAUI Riser” on page 143Servicing PCIe and PCIe/XAUI Risers 143 ? Install a PCIe or PCIe/XAUI Riser Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77. 3. Remove the top cover. See “Remove the Top Cover” on page 82. 4. Attach an antistatic wrist strap. 5. Align the riser board with the riser connector and press down to engage the connector (panel 1).144 SPARC T4-1 Server Service Manual • October 2011 6. Tighten the riser screw (panel 2). 7. Slide the crossbeam into position between the power supply bay and the side of the chassis (panel 3). 8. Tighten the two captive screws to secure the crossbeam (panel 4) Related Information ¦ “Remove a PCIe or PCIe/XAUI Riser” on page 141145 Servicing PCIe Cards These topics describe service procedures for the PCIe cards in the server. ¦ “PCIe Card Configuration Reference” on page 145 ¦ “Remove a PCIe or XAUI Card” on page 146 ¦ “Install a PCIe or XAUI Card” on page 148 PCIe Card Configuration Reference Use the following table to plan your PCIe/XAUI card configuration on SPARC T4-1 server. TABLE: PCIe and XAUI Support Slot PCIe Switch Supported Device Types FRU Name PCIe 0 or XAUI 0 * * Slots 0 and 3 are capable of accepting either PCIe or XAUI cards. You can only install one type of card. 0 PCIe (x16 physical, x8 electrical) XAUI expansion card /SYS/MB/RISER0/PCIE0 /SYS/MB/RISER0/XAUI0 PCIe 1 1 PCIe (x16 physical, x8 electrical) /SYS/MB/RISER1/PCIE1 PCIe 2 0 PCIe (x16 physical, x8 electrical) /SYS/MB/RISER2/PCIE2 PCIe 3 or XAUI 1 1 PCIe (x8 physical, x8 electrical) XAUI expansion card /SYS/MB/RISER0/PCIE3 /SYS/MB/RISER0/XAUI1 PCIe 4 0 PCIe (x8 physical, x8 electrical) /SYS/MB/RISER1/PCIE4 PCIe 5 1 PCIe (x8 physical, x8 electrical) /SYS/MB/RISER2/PCIE5146 SPARC T4-1 Server Service Manual • October 2011 Note – As a general rule, the PCIe and PCIe/XAUI slots should be populated sequentially, beginning with slot 0 and progressing to slot 5. This general rule does not apply to I/O cards that have special slot restrictions. For guidance on these restrictions, see the table, PCIe Slot Usage Rules for Certain HBA Cards in the SPARC T4-1 Server Product Notes. Related Information ¦ “Remove a PCIe or XAUI Card” on page 146 ¦ “Install a PCIe or XAUI Card” on page 148 ? Remove a PCIe or XAUI Card Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77. 3. Remove the top cover. See “Remove the Top Cover” on page 82. 4. Attach an antistatic wrist strap. 5. Disconnect any cables connected to the card.Servicing PCIe Cards 147 Note – If the riser has cards installed in both slots, disconnect all cables connected to both cards. Tip – Label the cables to ensure proper connection to the replacement card. 6. Remove the riser that contains the card to be removed. See “Remove a PCIe or PCIe/XAUI Riser” on page 141 7. With the riser placed on an antistatic surface, disengage the card from its connector and place it on an antistatic surface. The card is held in place by a retention clip, which you must rotate up before the card can be removed. 8. If you are not replacing the PCIe or XAUI card, install a filler panel in the slot. Caution – To ensure proper system cooling and EMI shielding, you must use the appropriate PCIe filler panel for the server. Related Information ¦ “Install a PCIe or XAUI Card” on page 148148 SPARC T4-1 Server Service Manual • October 2011 ? Install a PCIe or XAUI Card Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Locate the proper PCIe/XAUI slot for the card you are replacing. 3. Remove the PCIe/XAUI riser. See “Remove a PCIe or PCIe/XAUI Riser” on page 141. 4. If a PCIe filler panel is installed, remove it. 5. Install the PCIe or XAUI card into the riser. Before inserting the card, you must rotate the retention clip out of the way, as shown in panel 1. 6. Rotate the retention clip downward and press it until it is securely in place.Servicing PCIe Cards 149 7. Reinstall the PCIe/XAUI riser. See “Install a PCIe or PCIe/XAUI Riser” on page 143. 8. Connect any data cables required to the PCIe/XAUI card. Route data cables through the cable management arm. Related Information ¦ “Remove a PCIe or XAUI Card” on page 146150 SPARC T4-1 Server Service Manual • October 2011151 Servicing SAS PCIe RAID HBA Cards These topics describe service procedures for the RAID expansion modules in the server. ¦ “Remove a SAS PCIe RAID HBA Card” on page 151 ¦ “Install a SAS PCIe RAID HBA Card” on page 153 ? Remove a SAS PCIe RAID HBA Card Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Extend the server to the maintenance position. See “Extend the Server” on page 77. 2. Remove the top cover. See “Remove the Top Cover” on page 82. 3. Attach an antistatic wrist strap.152 SPARC T4-1 Server Service Manual • October 2011 4. Disconnect the data cables from the card. Note – If the riser has cards installed in both slots, disconnect all cables connected to both cards. Tip – Label the cables to ensure proper connection to the replacement card. 5. Remove the riser that contains the card. See “Remove a PCIe or PCIe/XAUI Riser” on page 141 6. With the riser placed on an antistatic surface, disengage the card from its connector and place it on an antistatic surface. The card is held in place by a retention clip, which you must rotate up before the card can be removed. 7. If you are not replacing the card, install a PCIe filler panel in the slot. Caution – To ensure proper system cooling and EMI shielding, you must use the appropriate PCIe filler panel for the server. Related Information ¦ “Install a SAS PCIe RAID HBA Card” on page 153Servicing SAS PCIe RAID HBA Cards 153 ? Install a SAS PCIe RAID HBA Card Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Unpack the SAS PCIe RAID HBA card and place it on an antistatic mat. 2. Remove the PCIe/XAUI riser that is closest to the power supplies. See “Remove a PCIe or PCIe/XAUI Riser” on page 141. 3. If a PCIe filler panel is installed, remove it. 4. Install the SAS PCIe RAID HBA card into the upper slot in the riser. Before inserting the card, you must rotate the retention clip out of the way, as shown in panel 1. 5. Rotate the retention clip downward and press it until it is securely in place. 6. Connect the internal data cables to the card.154 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Remove a SAS PCIe RAID HBA Card” on page 151155 Servicing the Service Processor The following topics describe how to remove, replace, and verify the service processor: ¦ “Service Processor Overview” on page 155 ¦ “Remove the Service Processor” on page 156 ¦ “Install the Service Processor” on page 157 Service Processor Overview The service processor plugs into a socket on the motherboard in the space between riser 2 and the right side of the chassis, as viewed from the rear. This is the riser that contains PCIe slots 2 and 5. If the service processor is replaced, the configuration settings maintained in the service processor will need to be restored. Before replacing the service processor, you should save the configuration using the Oracle ILOM backup utility. System firmware consists of both SP and host components. The SP component is located on the service processor and the host component is located on the CPU. These two components must be compatible. When the service processor is replaced, the SP firmware component on the new service processor may be incompatible with the existing host firmware component. In this case, the system firmware must be loaded as described in “Install the Service Processor” on page 157. Related Information ¦ “Remove the Service Processor” on page 156 ¦ “Install the Service Processor” on page 157156 SPARC T4-1 Server Service Manual • October 2011 ? Remove the Service Processor Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. After you replace the service processor, restoring the SP configuration will be much simpler if the configuration has been saved using the Oracle ILOM backup utility. If the configuration has not been backed up, do so now, if possible. If you want to retain the same version of the system firmware with the new service processor, note the current version before you remove the service processor. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server out of the rack. See “Extend the Server” on page 77. 3. If you can access the rear area of the server without removing the server from the rack, go to Step 4, otherwise remove the server from the rack: ¦ Unplug all cables from the server. ¦ “Remove the Server From the Rack” on page 79 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Attach an antistatic wrist strap.Servicing the Service Processor 157 6. If there are any PCIe cards installed in riser 2, remove them. This will require removing riser 2 first. See “Servicing PCIe and PCIe/XAUI Risers” on page 141 and “Servicing PCIe Cards” on page 145. 7. Grasp the scalloped depressions along the short edges of the service processor module and pull up to disengage the socketed edge of the module. The service processor’s connector is located next to the module’s edge that is closest to the riser. 8. Lift the module up and out of the chassis. Related Information ¦ “Install the Service Processor” on page 157 ? Install the Service Processor Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – The server must be fully shut down and the power cords disconnected.158 SPARC T4-1 Server Service Manual • October 2011 Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. If the server is connected to a power source, shut the server down fully and unplug any power cords. See “Removing Power From the System” on page 74. 2. Extend the server out of the rack. See “Extend the Server” on page 77. 3. If you can access the rear area of the server without removing the server from the rack, go to Step 4, otherwise remove the server from the rack: ¦ Unplug all cables from the server. ¦ “Remove the Server From the Rack” on page 79 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Tilt the service processor module and align it with the tab on the motherboard service processor support. 6. Press the module straight down until it is fully seated in its socket. Caution – If the module does not slide into the socket with relative ease, do not force it. It may be that the module’s pins are not perfectly aligned with the socket. Excessive force could damage the pins, socket, or both.Servicing the Service Processor 159 7. Return the server to an operational condition. Perform the following procedures before going on to Step 8: a. Install the top cover. See “Replace the Top Cover” on page 215. b. Install the server in the rack. See “Reinstall the Server in the Rack” on page 216. c. Connect the power cords to the server. See “Reconnect the Power Cords” on page 218. 8. Connect a terminal or a terminal emulator (PC or workstation) to the service processor SER MGT port. If the replacement service processor detects that the SP firmware is not compatible with the existing host firmware, further action will be suspended and the following message will be delivered over the SER MGT port. If you see this message, go on to Step 9. 9. Download the system firmware. a. Configure the SP’s network port to enable the firmware image to be downloaded. Refer to the Oracle ILOM documentation for network configuration instructions. b. Download the system firmware. Follow the firmware download instructions in the Oracle ILOM documentation. Unrecognized Chassis: This module is installed in an unknown or unsupported chassis. You must upgrade the firmware to a newer version that supports this chassis.160 SPARC T4-1 Server Service Manual • October 2011 Note – You can load any supported system firmware version, including the firmware revision that had been installed prior to the replacement of the service processor. c. If a backup file was created, use the Oracle ILOM restore utility to restore the configuration of the replacement service processor. Related Information ¦ “Remove the Service Processor” on page 156161 Servicing the System Battery The battery maintains system time when the server is powered off. If the server fails to maintain the proper time when it is powered off, replace the battery. ¦ “Replace the System Battery” on page 161 ¦ “Verify the System Battery” on page 163 ? Replace the System Battery Note – This is a cold service procedure that can be performed by customers. See “Cold Service, Replaceable by Customer” on page 73 for more information about cold service procedures. Caution – This procedure exposes sensitive components to electrostatic discharge. Be certain to follow the ESD precautions described in“Safety Information” on page 67. The system battery is in a spring-loaded carrier that is located between riser 0 and the power supply housing. 1. Shut down the system for service. See “Removing Power From the System” on page 74. 2. Extend the server out of the rack. See “Extend the Server” on page 77. 3. If you can access the rear area of the server without removing the server from the rack, go to Step 4, otherwise remove the server from the rack: ¦ Unplug all cables from the server. ¦ “Remove the Server From the Rack” on page 79162 SPARC T4-1 Server Service Manual • October 2011 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Remove riser 0 leftmost riser as viewed from the rear of the server). See “Servicing PCIe and PCIe/XAUI Risers” on page 141. 6. Push the top edge of the battery against the spring and lift it out of the carrier. 7. Insert the new battery into the battery carrier with the negative side (-) facing out. 8. Replace the top cover. See “Replace the Top Cover” on page 215. 9. Return the server to its operational position in the rack. See“Return the Server to the Normal Rack Position” on page 217. 10. Restore power to the server. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218.Servicing the System Battery 163 11. Use the Oracle ILOM clock command to set the day and time. The following example sets the date to June 17, 2010, the time to 16:19:56, and the timezone to GMT. Note – For additional details about setting the Oracle ILOM clock, refer to the CLI Procedures Guide for Oracle ILOM. 12. Verify that the new system battery is functioning properly. See “Verify the System Battery” on page 163. Related Information ¦ “Verify the System Battery” on page 163 ? Verify the System Battery ? Run show /SYS/MB/BAT to check the status of the system battery. In the output, the /SYS/MB/BAT status should be “OK”, as in the following example. -> set /SP/clock datetime=061716192010 -> show /SP/clock /SP/clock Targets: Properties: datetime = Wed JUN 17 16:19:56 2010 timezone = GMT (GMT) usentpserver = disabled Commands: cd set show -> show /SYS/MB/BAT /SYS/MB/BAT Targets:164 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Replace the System Battery” on page 161 Properties: type = Battery ipmi_name = MB/BAT fault_state = OK clear_fault_action = (none) Commands: cd set show ->165 Servicing Fan Modules The following topics provide the procedures related to servicing fan modules. ¦ “Locate a Faulty Fan Module” on page 168 ¦ “Remove a Fan Module” on page 169 ¦ “Fan Configuration Reference” on page 165 Fan Configuration Reference The following figure shows the fan module slot assignments.166 SPARC T4-1 Server Service Manual • October 2011 Note – All fan modules must be installed or the system will not be able to power up. Related Information ¦ “Fan Module LEDs” on page 166 ¦ “Locate a Faulty Fan Module” on page 168 ¦ “Remove a Fan Module” on page 169 ¦ “Install a Fan Module” on page 170 Fan Module LEDs The status of each fan module is displayed by a bi-color LED. These six status LEDs are located on the chassis frame to the right of the fan module bay. The LEDs are labeled with numbers that correspond to fan module labels on the midwall. When the fault manager reports a failed fan module, use the status LEDs to learn the number of the faulty fan module and use the fan locating label on the midwall to identify the fan module.Servicing Fan Modules 167 FIGURE: Fan Module LEDs When a fan module fault is detected, the front and rear panel Service Required LEDs also turn on. TABLE: Fan Module Status LEDs LED Notes Fan OK Status (green) The LED is green when the corresponding fan is operational. Service Required Status (amber) The LED is amber when the fan module is faulty. A faulty fan module will also cause the system Fan Fault LED to be lighted.168 SPARC T4-1 Server Service Manual • October 2011 If the fan fault produces an over temperature condition, the system Overtemp LED will turn on and an error message will be logged and displayed on the system console. Related Information ¦ “Fan Configuration Reference” on page 165 ¦ “Locate a Faulty Fan Module” on page 168 ¦ “Remove a Fan Module” on page 169 ¦ “Install a Fan Module” on page 170 ? Locate a Faulty Fan Module This procedure describes how to identify the faulty fan using the Fan Fault LEDs. Caution – This procedure requires you to perform actions in an area that contains live voltages. Use caution to avoid contact with cable terminals or other electrified surfaces. 1. Check the front or rear panel System Fault LED. A fan fault will cause the System Fault LED (on front and rear of server) as well as a Fan Fault LED in the array of fan status LEDs to be lighted. 2. Extend the server to the maintenance position. See “Extend the Server” on page 77. 3. Release the two fan compartment door latches and swing the door open. 4. If the color of a Fan Fault LED is amber, replace the corresponding fan module. See “Remove a Fan Module” on page 169. Related Information ¦ “Fan Configuration Reference” on page 165 ¦ “Fan Module LEDs” on page 166 ¦ “Remove a Fan Module” on page 169 ¦ “Install a Fan Module” on page 170Servicing Fan Modules 169 ? Remove a Fan Module Note – This is a hot service procedure that can be performed by customers. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. Caution – Do not remove a fan module until you have a replacement unit ready for installation. The server may be run for the time it takes to remove and install a fan module, but the fan door must not be open for more than 60 seconds. 1. Extend the server to the maintenance position. See “Extend the Server” on page 77. 2. Release the two fan compartment door latches and swing the door open. 3. Check the fan status LEDs to determine which fan module or modules need to be replaced. An amber LED identifies the faulty fan module. 4. To remove a fan module, grasp the pull tab, pull the module toward the front of the system, and then lift it up and out of the fan module compartment. 5. Check to be certain adjacent fan modules are still fully seated. You can do this by pressing down on the top of the neighboring fan modules. Caution – If you will not be able to install a new fan module within one minute, power down the system. See “Removing Power From the System” on page 74. Related Information ¦ “Fan Configuration Reference” on page 165 ¦ “Fan Module LEDs” on page 166 ¦ “Install a Fan Module” on page 170170 SPARC T4-1 Server Service Manual • October 2011 ? Install a Fan Module Note – This is a hot service procedure that can be performed by customers. See “Hot Service, Replaceable by Customer” on page 72 for more information about hot service procedures. The following procedure is based on the assumption that an empty slot exists for inserting the new fan module. If you need to remove a fan module before performing the installation procedure, see “Remove a Fan Module” on page 169. 1. Extend the server to the maintenance position. See “Extend the Server” on page 77. 2. Release the two fan compartment door latches and swing the door open. 3. Align the connector pins on the base of the new fan module with the connector on the fan module board and lower the module straight down into the slot. 4. Press down on the top of the module until it is fully seated. 5. Check the following status LEDs to verify that the new fan is functioning. ¦ The fan module status LED associated with that fan module should be green. See “Fan Module LEDs” on page 166. ¦ Both Service Required LEDs should be off. 6. Return the server to its operational position in the rack. See“Return the Server to the Normal Rack Position” on page 217. Related Information ¦ “Fan Configuration Reference” on page 165 ¦ “Fan Module LEDs” on page 166 ¦ “Remove a Fan Module” on page 169Servicing Fan Modules 171172 SPARC T4-1 Server Service Manual • October 2011173 Servicing the Fan Power Board The following topics describe the tasks you perform to replace a power supply. ¦ “Fan Power Board Overview” on page 173 ¦ “Remove the Fan Power Board” on page 173 ¦ “Install the Fan Power Board” on page 176 Fan Power Board Overview The fan power board carries power to the fan modules. It also carries status and control signals for the fan modules. Note – The SAS and SATA data cables pass through a gutter in the center of the fan power board assembly on their way to their respective connectors on the disk backplane. Related Information ¦ “Remove the Fan Power Board” on page 173 ¦ “Install the Fan Power Board” on page 176 ? Remove the Fan Power Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.174 SPARC T4-1 Server Service Manual • October 2011 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Disconnect the power cables. See “Disconnect Power Cords” on page 76. 3. Extend the server into the maintenance position. See “Extend the Server” on page 77. 4. Attach an antistatic wrist strap. 5. Remove the top cover. See “Remove the Top Cover” on page 82. 6. Remove all the fan modules as shown in panel 1.Servicing the Fan Power Board 175 7. Release the latch that’s in the middle of the fan power board assembly and swing open the access door, as shown in panel 2. 8. Disconnect the SAS and SATA data cables from their respective connectors on the disk backplane and move them out of the way, as shown in panel 3. Caution – Carefully fold the cables back over the mid-wall so that they are as clear as possible of the fan power board area. It is important to minimize the risk of damaging them when you lift the fan power board assembly out of the fan compartment. 9. Disconnect the power and data cables from the fan power board, as shown in panel 3. 10. Loosen the two captive screws that secure the fan power board to the chassis, as shown in panel 4.176 SPARC T4-1 Server Service Manual • October 2011 11. Slide the fan power board toward the front of the chassis and then lift it up and out. Related Information ¦ “Install the Fan Power Board” on page 176 ? Install the Fan Power Board Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Customer” on page 73 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Clear all cables out of the fan module compartment. These include the SAS and SATA cables that come in from the motherboard compartment and the power and signal cables that are connected to the connector board. 2. Lower the fan power board assembly into the fan compartment and slide it toward the rear of the server. Keep the access door open during this step so the way is clear for laying the SAS and SATA data cables back across the fan power board’s cable gutter.Servicing the Fan Power Board 177 3. Tighten the two captive screws to secure the board to the chassis, as shown in panel 1. 4. Connect the power and data cables that come from the connector board, as shown in panel 2. 5. Connect the SAS and SATA data cables to their respective connectors on the disk backplane, as shown in panel 2. 6. Close the fan power board access door, as shown in panel 3. 7. Install the fan modules as shown in panel 4. 8. Install the top cover. 9. Return the server to the rack. See “Reinstall the Server in the Rack” on page 216. 10. Slide the server into the rack. See “Return the Server to the Normal Rack Position” on page 217.178 SPARC T4-1 Server Service Manual • October 2011 11. Connect the power cords. See “Reconnect the Power Cords” on page 218. 12. Power on the system. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218. Related Information ¦ “Remove the Fan Power Board” on page 173179 Servicing the System Configuration PROM The following topics describe how to remove, replace, and verify the System Configuration PROM: ¦ “System Configuration PROM Overview” on page 179 ¦ “Remove the System Configuration PROM” on page 180 ¦ “Install the System Configuration PROM” on page 181 ¦ “Verify the System Configuration PROM” on page 185 System Configuration PROM Overview The System Configuration PROM stores the host ID and MAC address. If you have to replace the motherboard, be sure to move the System Configuration PROM from the old motherboard to the new motherboard. This step will ensure that the server will retain its original host ID and MAC address. Related Information ¦ “Remove the System Configuration PROM” on page 180 ¦ “Install the System Configuration PROM” on page 181 ¦ “Verify the System Configuration PROM” on page 185180 SPARC T4-1 Server Service Manual • October 2011 ? Remove the System Configuration PROM Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. Note – The System Configuration PROM is plugged into a socket on the motherboard. It includes a yellow barcode label. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server out of the rack. See “Extend the Server” on page 77. 3. If you can access the rear area of the server without removing the server from the rack, go to Step 4, otherwise remove the server from the rack: ¦ Unplug all cables from the server. ¦ “Remove the Server From the Rack” on page 79 4. Remove the top cover. See “Remove the Top Cover” on page 82. 5. Pull up on the System Configuration PROM to remove it from its socket. The System Configuration PROM has a yellow barcode label on it.Servicing the System Configuration PROM 181 Related Information ¦ “Install the System Configuration PROM” on page 181 ¦ “Verify the System Configuration PROM” on page 185 ? Install the System Configuration PROM Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.182 SPARC T4-1 Server Service Manual • October 2011 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Extend the server out of the rack. See “Extend the Server” on page 77. 3. If you can access the rear area of the server without removing the server from the rack, go to Step 5, otherwise remove the server from the rack. See “Remove the Server From the Rack” on page 79. 4. Unplug all cables from the server. 5. Remove the top cover. See “Remove the Top Cover” on page 82. 6. Align the System Configuration PROM with the socket on the motherboard. The notch on the underside of the System Configuration PROM faces the rear of the server. 7. Plug the System Configuration PROM into the socket. Gently press down on the center of the System Configuration PROM to ensure that it is fully seated.Servicing the System Configuration PROM 183 8. Install the top cover. See “Replace the Top Cover” on page 215. 9. Return the server to its operational position in the rack. See“Return the Server to the Normal Rack Position” on page 217. 10. Restore power to the server. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218. Note – As the system boots up, watch for the banner display in the console output.184 SPARC T4-1 Server Service Manual • October 2011 11. Verify that the banner display includes an Ethernet address, and Host ID value. The Ethernet address and Host ID values are read from the System Configuration PROM. Their presence in the banner verifies that the SP and the host can read the System Configuration PROM. 12. For additional verification, run specific commands to display data stored in the System Configuration PROM. ¦ Use the Oracle ILOM show command to display the MAC address: ¦ Use Oracle Solaris OS commands to display the hostid and Ethernet address: Related Information ¦ “Remove the System Configuration PROM” on page 180 ¦ “Verify the System Configuration PROM” on page 185 . . . SPARC T4-1, No Keyboard . OpenBoot X.XX, 16256 MB memory available, Serial #87304604.Ethernet address *:**:**:**:**:**, Host ID: ******** . . . -> show /HOST macaddress /HOST Properties: macaddress = **:**:**:**:**:** # hostid 8534299c # ifconfig -a lo0: flags=2001000849 mtu 8232 index 1 inet 127.0.0.1 netmask ff000000 igb0: flags=201004843 mtu 1500 index 2 inet 10.6.88.150 netmask fffffe00 broadcast 10.6.89.255 ether *:**:**:**:**:**Servicing the System Configuration PROM 185 ? Verify the System Configuration PROM The steps described below can be performed whenever you want to verify that the System Configuration PROM can be read by the SP and by the host. 1. Power cycle the host and, it boots up, watch for the banner display. The Ethernet address and Host ID values are read from the System Configuration PROM. This verifies that the Oracle ILOM and the host can read the System Configuration PROM. 2. For additional verification, run specific commands to display data stored in the System Configuration PROM. ¦ Use the Oracle ILOM show command to display the MAC address: ¦ Use Oracle Solaris OS commands to display the hostid and Ethernet address: . . . SPARC T4-1, No Keyboard . OpenBoot X.XX, 16256 MB memory available, Serial #********.Ethernet address *:**:**:**:**:**, Host ID: ******** . . . -> show /HOST macaddress /HOST Properties: macaddress = **:**:**:**:**:** # hostid 8534299c # ifconfig -a lo0: flags=2001000849 mtu 8232 index 1 inet 127.0.0.1 netmask ff000000186 SPARC T4-1 Server Service Manual • October 2011 Related Information ¦ “Remove the System Configuration PROM” on page 180 ¦ “Install the System Configuration PROM” on page 181 e1000g0: flags= 201004843 mtu 1500 index 2 inet 10.6.88.150 netmask fffffe00 broadcast 10.6.89.255 ether *:**:**:**:**:**187 Servicing the HDD Cage These topics explain how to remove and install the hard drive cage. ¦ “Hard Drive Cage Overview” on page 187 ¦ “Remove the Hard Drive Cage” on page 187 ¦ “Install the Hard Drive Cage” on page 190 Hard Drive Cage Overview The hard drive cage is not a field-replaceable unit (FRU). However, the hard drive cage must be removed when servicing either of the following components: ¦ Disk backplane ¦ Right and left light pipe assemblies Related Information ¦ “Remove the Hard Drive Cage” on page 187 ¦ “Install the Hard Drive Cage” on page 190 ? Remove the Hard Drive Cage Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.188 SPARC T4-1 Server Service Manual • October 2011 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. Note – You must remove the hard drive cage in order to remove the disk backplane or the front panel light pipe assemblies. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Disconnect all external cables. 3. Remove the server from the rack. Place the server on a hard, flat surface. See “Remove the Server From the Rack” on page 79. 4. Attach an antistatic wrist strap. 5. Remove the top cover. See “Remove the Top Cover” on page 82. 6. Remove all hard drives and the DVD/USB. See “Remove a Hard Drive” on page 107 and “Remove the DVD/USB Assembly” on page 114. Note – Make a note of the drive locations before removing them. You will need to install the hard drives in the same locations when reassembling the system. 7. Remove the No. 2 Phillips screws that secure the hard drive cage to the chassis. Two screws secure the disk cage to each side of the chassis. See panels 1 and 2 in the following figure.Servicing the HDD Cage 189 FIGURE: Removing a Hard Drive Cage 8. Remove the four center fan modules to provide easier access to the three backplane connectors. 9. Disconnect the three cables from the backplane. a. Deflect the release tab on the fan deck to expose the data cables. b. Make a note of the cable/connector configuration to ensure that the cables will be reconnected to the right connectors. Caution – The data cables are delicate. Use great care when sliding the disk cage in or out of the chassis that it does not rub against the cables. 10. Slide the hard drive cage forward to disengage the backplane from the connector board. 11. Lift the hard drive cage up and out of the chassis. 12. Set the hard drive cage on an antistatic mat. Related Information ¦ “Install the Hard Drive Cage” on page 190190 SPARC T4-1 Server Service Manual • October 2011 ? Install the Hard Drive Cage Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Position the hard drive cage in the chassis, over the chassis standoffs. This is shown in the following figure. FIGURE: Installing a Hard Drive CageServicing the HDD Cage 191 Caution – The data cables are delicate. Use great care when sliding the disk cage in or out of the chassis that it does not rub against the cables. 2. Slide the hard drive cage back until the hard drive backplane engages with the connector board. Caution – Use care when installing the hard drive cage. Be certain that the hard drive cage is aligned with the base of the chassis before sliding the cage back. 3. Connect the backplane data cables. Refer to the note you made when disconnecting the data cables to verify the correct mating of cables to connectors. 4. Reinstall the No. 2 Phillips screws that secure the hard drive cage to the chassis. Two screws secure the disk cage to each side of the chassis. 5. Install the top cover. See “Replace the Top Cover” on page 215. 6. Install the server into the rack. See “Reinstall the Server in the Rack” on page 216. 7. Install the hard drives in the same locations as they occupied before the replacement. See“Install a Hard Drive” on page 109. 8. Install the DVD/USB module. See “Install the DVD/USB Assembly” on page 115. 9. Connect the power cords. Note – As soon as the power cords are connected, standby power is applied. Depending on how the firmware is configured, the system might boot at this time. 10. Power on the system. See “Power On the Server (start /SYS Command)” on page 218. Related Information ¦ “Remove the Hard Drive Cage” on page 187192 SPARC T4-1 Server Service Manual • October 2011193 Servicing the HDD Backplane These topics explain how to remove and install the disk backplane. ¦ “Hard Drive Backplane Overview” on page 193 ¦ “Remove the Hard Drive Backplane” on page 193 ¦ “Install the Hard Drive Backplane” on page 196 Hard Drive Backplane Overview The hard drive backplane is housed in the hard drive cage. It provides data and control signal connectors for the hard drives. It also provides the interconnect for the front I/O board, power and locator buttons, and system/component status LEDs. Note – Each drive has its own Power/Activity, Fault, and Ready-to-Remove LEDs. Related Information ¦ “Remove the Hard Drive Backplane” on page 193 ¦ “Install the Hard Drive Backplane” on page 196 ? Remove the Hard Drive Backplane Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.194 SPARC T4-1 Server Service Manual • October 2011 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. Note – You must remove the hard drive cage in order to remove the disk backplane. See “Remove the Hard Drive Cage” on page 187. 1. Perform the preliminary steps required for cold service procedures. See “Cold Service, Replaceable by Customer” on page 73 for instructions. 2. Remove the server from the rack. See “Remove the Server From the Rack” on page 79. 3. Remove the top cover. See “Remove the Top Cover” on page 82. 4. Remove the hard drive cage. See “Remove the Hard Drive Cage” on page 187. 5. Remove the four No. 2 Phillips screws securing the backplane to the hard drive cage. Tip – Place the hard drive cage upright on its front face for easier access to the backplane screws.Servicing the HDD Backplane 195 FIGURE: Removing a Hard Drive Backplane 6. Remove the plastic backplane retention bracket from the backplane and set it aside for use when installing the backplane. Tip – Make note of how the alignment clip is installed so you can position it properly when installing the backplane.196 SPARC T4-1 Server Service Manual • October 2011 7. Slide the backplane down and off the hard drive cage retention hooks. 8. Place the hard drive backplane on an antistatic mat. Related Information ¦ “Install the Hard Drive Backplane” on page 196 ? Install the Hard Drive Backplane Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures.Servicing the HDD Backplane 197 Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Slide the backplane under the retention hooks on the hard drive cage. 2. Install the four No. 2 Phillips screws and tighten just enough to hold the backplane against the hard drive cage. Tip – You will complete the alignment of the backplane in the next step, so the screws cannot be too tight during that step. FIGURE: Installing a Hard Drive Backplane198 SPARC T4-1 Server Service Manual • October 2011 3. With the backplane attached to the disk cage, push up against the bottom edge of the backplane and insert the retention bracket. 4. While keeping upward pressure on the backplane, press the retention bracket against the backplane, with the pins in line with the slots just above the hooks. 5. Complete tightening the four screws that secure the backplane to the disk cage.Servicing the HDD Backplane 199 6. Install the hard drive cage. See “Install the Hard Drive Cage” on page 190. Related Information ¦ “Remove the Hard Drive Backplane” on page 193200 SPARC T4-1 Server Service Manual • October 2011201 Servicing the Front Panel Light Pipe Assemblies These topics explain how to remove and install front control panel light pipe assemblies. ¦ “Front Panel Light Pipe Assemblies Overview” on page 201 ¦ “Remove the Front Panel Light Pipe Assembly (Right or Left)” on page 202 ¦ “Install the Front Panel Light Pipe Assembly (Right or Left)” on page 204 Front Panel Light Pipe Assemblies Overview The front control panel light pipe assemblies are mounted on each side of the hard drive cage. You must remove the hard drive cage to access the screws that attach the light pipe assemblies to the hard drive cage. Related Information ¦ “Remove the Front Panel Light Pipe Assembly (Right or Left)” on page 202 ¦ “Install the Front Panel Light Pipe Assembly (Right or Left)” on page 204202 SPARC T4-1 Server Service Manual • October 2011 ? Remove the Front Panel Light Pipe Assembly (Right or Left) Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Remove the hard drive cage. See “Remove the Hard Drive Cage” on page 187. 2. Remove the three screws that secure the left or right light pipe assembly mounting plate to the hard drive cage. This step is identical for both left and right assemblies.Servicing the Front Panel Light Pipe Assemblies 203 The next steps depend on whether you are removing the right or left light pipe assembly. ¦ For the right light pipe assembly, go to Step 3. ¦ For the left light pipe assembly, go to Step 4 3. Remove the right light pipe assembly from its metal plate. This light pipe assembly is secured by two small hook-shaped clips that fit through holes in the metal plate and grip the other side of the plate. Two locator pins close to the front of the light pipe assembly help align the light pipes with the holes in the front panel flange. a. Use your thumb and index finger to grasp the light pipes near the two locator pins and gently bend the light pipes away from the mounting plate. Pull them just far enough to disengage the two hook-shaped clips from the slots. b. When the clips release their hold on the plate, remove the light pipe assembly from the metal plate. 4. Remove the left light pipe assembly from its metal plate. This light pipe assembly is secured by two small hook-shaped clips that fit through a pair of rectangular holes in the metal plate. These holes are to the left of a curved plastic spring. The hooks grip the plate through a corresponding pair of smaller holes to the right. Note – The curved plastic spring partially covers the hole used by the hook on the upper clip. This reduces access to the upper hook.204 SPARC T4-1 Server Service Manual • October 2011 a. Using the tip of a pointed object, such as the end of a paper clip or a stylus, push the hook end of the lower clip out of its hole. This is the hole that is not covered by the curved plastic spring. Tip – If possible, leave this pointed object in the lower hole to prevent the hook from sliding back in and use a different tool for the upper hook. b. Repeat Step a for the upper hook. c. When both clip hooks are out of their holes, slide the light pipe assembly toward the rear of the metal plate and remove it. Related Information ¦ “Install the Front Panel Light Pipe Assembly (Right or Left)” on page 204 ? Install the Front Panel Light Pipe Assembly (Right or Left) Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. Note – The following steps apply to both right and left light pipe assemblies.Servicing the Front Panel Light Pipe Assemblies 205 1. Align the individual light pipes with the corresponding holes in the front panel flange. 2. Lay the light pipe assembly on the metal mounting plate with its attachment hooks inserted into the corresponding holes in the plate. Note – The two locator pins will not line up with their holes until the next step. 3. Slide the assembly forward until the attachment hooks and locator pins are fully engaged. Tip – Verify that the tip of each light pipe is flush with the front surface of the flange. This is a sign that the assembly is properly installed on the mounting plate. 4. Align the screw holes in the metal mounting plate with the holes on the side of the hard drive cage. 5. Secure the light pipe assembly with the three screws. 6. Install the hard drive cage. See “Install the Hard Drive Cage” on page 190. Related Information ¦ “Remove the Front Panel Light Pipe Assembly (Right or Left)” on page 202206 SPARC T4-1 Server Service Manual • October 2011207 Servicing the Motherboard Assembly These topics explain how to remove and install the motherboard assembly. ¦ “Motherboard Servicing Overview” on page 207 ¦ “Remove the Motherboard Assembly” on page 208 ¦ “Install the Motherboard Assembly” on page 211 Motherboard Servicing Overview The motherboard assembly must be removed in order to access the following components: ¦ Power supply backplane ¦ Power distribution board ¦ Connector board Note – The server must be removed from the rack for this procedure. Caution – The server is heavy. Two people are required to remove it from the rack. If you replace the motherboard, remove and transfer the service processor and System Configuration PROM from the old board to the new. This will preserve system-specific information that is stored on these modules.The SP contains system configuration data used by Oracle ILOM and the System Configuration PROM contains the system host ID and MAC address. System firmware consists of both service processor and host components. The service processor component is located on the SP and the host component is located on the CPU. These two components must be compatible. When the motherboard is replaced, the host firmware component on the new motherboard may be incompatible with the208 SPARC T4-1 Server Service Manual • October 2011 SP firmware component on the service processor that was transferred to the new motherboard. In this case, the system firmware must be loaded as described in “Install the Motherboard Assembly” on page 211. Related Information ¦ “Remove the Motherboard Assembly” on page 208 ¦ “Install the Motherboard Assembly” on page 211 ? Remove the Motherboard Assembly Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Stop the Oracle Solaris OS to get the OBP prompt. 2. Run the printenv command and make a note of any OBP variables that have been modified. 3. Power off the server. See “Removing Power From the System” on page 74. 4. Remove the server from the rack. See “Remove the Server From the Rack” on page 79. 5. Attach an antistatic wrist strap.Servicing the Motherboard Assembly 209 6. Remove the top cover. See “Remove the Top Cover” on page 82. 7. Swing the air duct up and forward to the fully open position. 8. Remove all PCIe/XAUI riser assemblies. See “Remove a PCIe or PCIe/XAUI Riser” on page 141. Note – Note which PCIe/XAUI slots the cards occupy. Note – If riser 0 contains a SAS PCIe RAID HBA card, disconnect the data cables from the card. 9. Disconnect the motherboard end of the two ribbon cables and move them out of the way of the motherboard removal. 10. Disconnect the motherboard end of the three backplane cables and move them out of the way of the motherboard removal. Note – If riser 0 contains a SAS PCIe RAID HBA card, there will only be the SATA DVD data cable connected to the motherboard. Caution – The hard drive data cables are delicate. Ensure they are safely out of the way when servicing the motherboard. 11. If you are replacing the motherboard, remove the following components: ¦ All DIMMs. Record the memory configuration so that you can recreate it on the new motherboard. ¦ System configuration PROM. ¦ Service processor. 12. Using a No. 2 Phillips screwdriver, remove the four screws that secure the motherboard assembly to the bus bar. Caution – Use care when removing the bus bar screws to avoid touching a heat sink, which can be dangerously hot.210 SPARC T4-1 Server Service Manual • October 2011 Note – Set the four screws aside. You must use these screws to attach the motherboard to the bus bar during installation. 13. Loosen the captive screw securing the motherboard to the chassis. 14. Using the green handle, slide the motherboard toward the rear of the system approximately 1 cm (less than 1/2 inch). Tip – Note the metal tab projecting into the motherboard compartment from the rear, right corner of the chassis. In the next step, use care to avoid having this tab interfere with the removal of the motherboard. 15. Angle the motherboard up and lift out of the chassis (as shown in the figure). 16. Place the motherboard assembly on an antistatic mat. Related Information ¦ “Install the Motherboard Assembly” on page 211Servicing the Motherboard Assembly 211 ? Install the Motherboard Assembly Note – This is a cold service procedure that must be performed by qualified service personnel. See “Cold Service, Replaceable by Authorized Service Personnel” on page 74 for more information about this category of service procedures. Caution – The server must be fully shut down and the power cords disconnected. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Caution – Components inside the chassis might be hot. Use caution when servicing components inside the chassis. 1. Tilt the motherboard assembly to position it into the chassis. Tip – Note the metal tab projecting into the motherboard compartment from the rear, right corner of the chassis. In the next step, use care to avoid having this tab interfere with the installation of the motherboard.212 SPARC T4-1 Server Service Manual • October 2011 2. Hold the green handle and the back edge of the motherboard and lower it down into the chassis. 3. Slide the motherboard forward until it is aligned with the bus bar screw holes and the captive screw. 4. Tighten the captive screw that secures the motherboard. 5. Using a No. 2 Phillips screwdriver, install the four bus bar screws and tighten them until the motherboard is securely fastened to the bus bar. Note – Be certain to use the correct screws to attach the motherboard to the bus bar. Ordinarily, these would be the bus bar screws that were removed as part of the motherboard removal procedure. 6. If you are installing a new motherboard, install the following components: ¦ All DIMMs removed from the previous motherboard. Ensure that the DIMM modules are installed in the same memory configuration as they were in previously. See “Memory Configuration Guidelines” on page 98. ¦ System configuration PROM. ¦ Service processor. ¦ Internal USB drive (if used).Servicing the Motherboard Assembly 213 7. Connect the three backplane cables that were disconnected earlier. 8. Connect the two ribbon cables that were disconnected earlier. 9. Reinstall the PCIe and PCIe/XUAI risers. See “Install a PCIe or PCIe/XAUI Riser” on page 143. Note – If any internal HBA card is present, reconnect all internal cables that were disconnected earlier. 10. Install the top cover. See “Replace the Top Cover” on page 215. 11. Install the server into the rack. See “Reinstall the Server in the Rack” on page 216. 12. Attach the power cables. See “Reconnect the Power Cords” on page 218. 13. Connect a terminal or a terminal emulator (PC or workstation) to the SP SER MGT port. If the SP detects that the new host firmware component is incompatible with SP firmware component, further action will be suspended and the following message will be delivered over the SER MGT port. If you see this message, go on to Step 14. 14. Download the system firmware. a. If needed, configure the SP’s network port to enable the firmware image to be downloaded. Refer to the Oracle ILOM documentation for network configuration instructions. b. Download the system firmware. Follow the firmware download instructions in the Oracle ILOM documentation. Note – You can load any supported system firmware version, including the firmware revision that had been installed prior to the replacement of the motherboard. Unrecognized Chassis: This module is installed in an unknown or unsupported chassis. You must upgrade the firmware to a newer version that supports this chassis.214 SPARC T4-1 Server Service Manual • October 2011 15. Power on the server. See “Power On the Server (start /SYS Command)” on page 218 or “Power On the Server (Power Button)” on page 218. Related Information ¦ “Remove the Motherboard Assembly” on page 208215 Returning the Server to Operation These topics explain how to return the server to operation after you have performed service procedures. ¦ “Replace the Top Cover” on page 215 ¦ “Reinstall the Server in the Rack” on page 216 ¦ “Return the Server to the Normal Rack Position” on page 217 ¦ “Reconnect the Power Cords” on page 218 ¦ “Power On the Server (start /SYS Command)” on page 218 ¦ “Power On the Server (Power Button)” on page 218 ? Replace the Top Cover 1. Place the top cover on the chassis. Set the cover down so that it hangs over the rear of the server by about an inch (25.4 mm). 2. Slide the top cover forward until it seats.216 SPARC T4-1 Server Service Manual • October 2011 Note – If an emergency shutdown occurred when the top cover was removed, you must install the top cover and use the poweron command to restart the system. See “Power On the Server (start /SYS Command)” on page 218 for more information about the poweron command. Related Information ¦ “Power On the Server (start /SYS Command)” on page 218 ? Reinstall the Server in the Rack Caution – The chassis is heavy. To avoid personal injury, use two people to lift it and set it in the rack. 1. Place the ends of the chassis mounting brackets into the slide rails. 2. Slide the server into the rack until the brackets lock into place. The server is now in the extended maintenance position.Returning the Server to Operation 217 Related Information ¦ “Return the Server to the Normal Rack Position” on page 217 ? Return the Server to the Normal Rack Position 1. Release the slide rails from the fully extended position by pushing the release tabs on the side of each rail. 2. While pushing on the release tabs, slowly push the server into the rack. Ensure that the cables do not get in the way. 3. Reconnect the cables to the back of the server. If the CMA is in the way, disconnect the left CMA release and swing the CMA open. 4. Reconnect the CMA. Swing the CMA closed and latch it to the left rack rail. Related Information ¦ “Reinstall the Server in the Rack” on page 216218 SPARC T4-1 Server Service Manual • October 2011 ? Reconnect the Power Cords ? Reconnect the power cords to the power supplies. Note – As soon as the power cords are connected, standby power is applied. Depending on how the firmware is configured, the system might boot at this time. Related Information ¦ “Power On the Server (start /SYS Command)” on page 218 ¦ “Power On the Server (Power Button)” on page 218 ? Power On the Server (start /SYS Command) Note – If you are powering on the server following an emergency shutdown that was triggered by the top cover interlock switch, you must use start /SYS. ? Type start /SYS at the SP prompt: Related Information ¦ “Power On the Server (Power Button)” on page 218 ? Power On the Server (Power Button) ? Momentarily press and release Power button on the front panel. Use a pointed object, such as a pen or stylus, to reach the recessed button. -> start /SYSReturning the Server to Operation 219 Related Information ¦ “Power On the Server (start /SYS Command)” on page 218220 SPARC T4-1 Server Service Manual • October 2011221 Glossary C CMA cable management arm D DHCP Dynamic Host Configuration Protocol DTE data terminal equipment E ESD electrostatic discharge H HBA host bus adapter222 SPARC T4-1 Server Service Manual • October 2011 I ILOM Oracle Integrated Lights Out Manager IP Internet Protocol N NET MGT network management port NIC network interface card or controller O Oracle Solaris OS Oracle Solaris Operation System P POST power-on self-test Q QSFP quad small form-factor pluggable S SAS serial attached SCSIGlossary 223 SER MGT serial management port SP service processor SSD sold-state drive SSH Secure Shell U UI user interface UUID Universal Unique Identifier W WWN world-wide name. A unique number that identifies a SAS target.224 SPARC T4-1 Server Service Manual • October 2011225 Index A accessing the service processor, 27 accounts, Oracle ILOM, 27 antistatic wrist strap, 68 ASR blacklist, 62 B banner, 185 battery FRU name, 7 verifying, 163 blacklist, ASR, 62 boards PCIe riser, 143 button Remind, 168 C cfgadm command, 107, 110 clear_fault_action property, 32 clearing PSH-detected faults, 59 clearing POST-detected faults, 51 command setlocator, 77 components disabled automatically by POST, 62 displaying using showcomponent command, 63 con?guration reference fans, 165 PCIe cards, 145 con?guring how POST runs, 49 console command, 95 cord retainers, 71 D date and time, setting, 161 default Oracle ILOM password, 27 diag level parameter, 47 diag mode parameter, 46 diag trigger parameter, 47 diag verbosity parameter, 47 diagnostics low level, 45 running remotely, 25 DIMMs troubleshooting, 86 displaying FRU information, 29 dmesg command, 41 drives con?guration reference, 104 FRU names, 104 installing, 109 logical device names, 104 slot assignments, 104 verifying, 110 DVD drive FRU name, 9 E electrostatic discharge (ESD) preventing using an antistatic mat, 68 preventing using an antistatic wrist strap, 68 electrostatic discharge (ESD) prevention Safety Information, 68 energy storage modules (ESMs) parts breakdown, 71 environmental faults, 18 F fan module226 SPARC T4-1 Server Service Manual • October 2011 FRU name, 11 fan power board FRU name, 11 fans con?guration reference, 165 fault LEDs, 168 FRU names, 165 lead wires, 169, 170 locating faulty, 168 parts breakdown, 71 removing, 169, 170 fault messages (POST), interpreting, 51 faults clearing, 32 detected by POST, 18 detected by PSH, 18 environmental, 18 forwarded to Oracle ILOM, 25 PSH-detected fault example, 57 PSH-detected, checking for, 57 ?eld-replaceable units (FRUs) FRU names, 71 illustrated parts breakdown, 71 quantities, 71 replacing ?eld-replaceable units (FRUs), 85, 103, 113, 117, 125, 131, 135, 141, 145, 151, 155, 161, 165, 173, 179, 187, 193, 201, 207 ?ller, power supply bay, 122 fmadm command, 59 fmdump command, 57 FRU ID PROMs, 26 FRU information, displaying, 29 FRU names fans, 165 G graceful shutdown, 75 H hard disk drives (HDDs) con?guration reference, 104 hot-pluggable capabilities, 103 installing, 109 parts breakdown, 71 removing, 107 verifying, 110 hard drive backplane FRU name, 9 hostid command, 185 hot-pluggable capabilities of HDDs and SSDs, 103 hot-swapping power supplies, 117 I I/O subsystem, 45, 62 illustrated parts breakdown, 71 installing power supplies, 120 power supply ?llers, 122 the System Con?guration PROM, 157, 181 L latch slide rail, 78 lead wires, fan, 169, 170 LEDs fan fault, 168 Locator, 70 power supply fault LED, 119 Remind Power, 168 locating faulty fans, 168 power supplies, 119 locating the server, 70 Locator LEDs, 70 locator pins, fan, 169, 170 log ?les, viewing, 42 logging into Oracle ILOM, 27 logical device names, drive, 104 M maintenance position, 80 maximum testing with POST, 50 memory fault handling, 85 message buffer, checking the, 41 message identi?er, 57 messages, POST fault, 51 motherboard FRU name, 7 motherboard handles, 210Index 227 N names, FRU, 71 network management port (NET MGT), 27 Normal mode (virtual keyswitch position), 95 O of?ine, taking drives, 107 Oracle ILOM CLI, 27 web interface, 27 Oracle ILOM commands show faulty, 35 Oracle VTS checking if Oracle VTS is installed, 44 overview, 43 packages, 44 test types, 43 topics, 43 using for fault diagnosis, 18 P paddle card FRU name, 11 parts breakdown, illustrated, 71 password, default Oracle ILOM, 27 PCIe card latch, 146, 151 PCIe cards con?guration reference, 145 FRU names, 145 removing, 146, 151 PCIe riser boards removing, 143 PCIe/XAUI riser FRU name, 7 POST clearing faults, 51 con?guration examples, 49 con?guring, 49 interpreting POST fault messages, 51 running in Diag Mode, 50 See power-on self-test (POST) power distribution board FRU name, 11 power supplies, 71 fault LED, 119 hot-swap capabilities, 117 installing, 120 locating faulty units, 119 removing, 119 verifying, 122 power supply FRU name, 11 power supply ?ller, 122 power-on self-test (POST) about, 45 components disabled by, 62 faults detected by, 18 troubleshooting with, 19 using for fault diagnosis, 18 Predictive Self-Healing (PSH) faults detected by, 18 memory faults, 86 PSH Knowledge article web site, 57 PSH-detected fault example, 57 PSH-detected faults checking for, 57 clearing, 59 R redundant power supplies, 117 Remind button, 168 Remind Power LED, 168 removing fans, 169, 170 HDDs and SSDs, 107 PCIe cards, 141, 146, 151 power supplies, 119 power supply ?llers, 122 the System Con?guration PROM, 156, 180 top cover, 82 replacing system battery, 161 riser boards, PCIe, 71, 143 running POST in Diag Mode, 50 S SCC module FRU name, 7 See asrkeys (system components), 63 serial management port (SER MGT), 27 server228 SPARC T4-1 Server Service Manual • October 2011 locating, 70 service processor accessing, 27 service processor prompt, 74, 75 setkeyswitch parameter, 95 setlocator command, 77 setting the ILOM date and time, 161 show command, 29 show faulty command, 35, 51, 59 using to check for faults, 18 showcomponent command, 63 showenvironment command, 163 slide rail latch, 78 slot assignments HDDs, 104 PCIe cards, 145 SSDs, 104 Solaris log ?les, 18 Solaris OS checking log ?les for fault information, 18 ?les and commands, 41 Solaris Predictive Self-Healing (PSH) overview, 56 See Predictive Self-Healing (PSH) topics, 55 solid state drives (SSDs) con?guration reference, 104 hot-pluggable capabilities, 103 installing, 109 removing, 107 verifying, 110 stop /SYS (ILOM command), 74, 75 system battery, 71 replacing, 161 verifying, 163 system components see components System Con?guration PROM, 71 installing, 157, 181 removing, 156, 180 verifying, 185 system message log ?les, viewing, 42 T time and date, setting, 161 top cover removing, 82 troubleshooting by checking Solaris OS log ?les, 18 DIMMs, 86 using Oracle VTS, 18 using POST, 18, 19 using the show faulty command, 18 U Universal Unique Identi?er (UUID), 57 USB ports (front) FRU name, 9 V /var/adm/messages ?le, 42 verifying power supplies, 122 system battery, 163 the System Con?guration PROM, 185 viewing system message log ?les, 42 virtual keyswitch, 95 SPARC T4-1B Server Module Product Notes Part No.: E22737-03 December 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation vii 1. Late-Breaking Information 1 Supported Chassis 1 ? Identify Your Chassis Version 2 Supported Hardware Components 3 Preinstalled Software 4 Supported Versions of the OS, Firmware, and Software 5 Required Patches and Package Updates 6 Oracle Solaris 11 OS Package Updates 6 Oracle Solaris 10 OS Patches 6 ? Obtain Patches 7 Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components 8 Identifying Drive Logical Device Names and Physical Locations 8 ? Correlate WWN Device Names With Physical Locations (diskinfo Command) 9 ? Correlate WWN Device Names With Physical Locations (probe-scsiall Command) 10 Oracle Solaris Jumpstart WWN Syntax 11 Interactive Installation Example 12iv SPARC T4-1B Server Module Product Notes • December 2011 2. Known Product Issues 15 Hardware Issues 15 Sun Type 6 Keyboards are Not Supported by SPARC T4 Series Servers 15 PSH Might Not Clear a Retired Cache Line on a Replaced Motherboard (CR 7031216) 15 2-Meter USB Cable Length Limit (7048419) 16 Uncorrectable L2 Cache Errors are Sometimes Reported as Core Faults Without Any Cache Line Retirement (CR 7071237 and CR 7071974) 16 During a Reboot After an Unrecoverable Hardware Error, CPUs Might Not Start (CR 7075336) 16 Blue LED on Drive Does Not Light When the Drive is Ready to Remove (CR 7082700) 17 Firmware, OS, and Other Software Issues 17 fault.memory.memlink-uc Fault Did Not Cause Panic as Stated by System Message (CR 6940599) 17 Timestamp for an Oracle ILOM Fault/Critical Event Might Be off by One Hour (CR 6943957) 18 e1000g Driver Generates Spurious ereports When Installing Oracle Solaris OS Over a Sun PCIe Dual Gigabit Ethernet Adapter (CR 6958011) 18 When diag-switch? Is Set to true, Oracle Solaris OS Fails to Update the EEPROM for Automatic Rebooting (CR 6982060) 19 sas2ircu Message That RAID Volume Sizes Other Than MAX Are Not Supported (CR 6983210) 20 Fault Management Sometimes Sends Resolved Cases to the SP (CR 6983432) 20 Units Used to Define the MIB Power Management Time Limit are Reported in Seconds (CR 6993008) 22 Spurious Interrupt Message in System Console When Using Oracle VTS (CR 7038266) 22 Intermittent Link Training Timeout Displayed During Power Cycles (CR 7043201) 22Contents v The cfgadm Command Might Fail on SG-SAS6-REM-Z or SGX-SAS6-REM-Z HBAs (CR 7044759) 23 Message From cpustat Refers to Processor Documentation Incorrectly (CR 7046898) 23 reboot disk Command Occasionally Fails When disk Argument Picks Up Extra Characters (CR 7050975) 24 PCIe Correctable Errors Might Be Reported (CR 7051331) 24 Watchdog Timeouts Seen With Heavy Workloads and Maximum Memory Configurations (CR 7083001) 25 ereport.fm.fmd.module Generated During a Reboot of an SDIO Domain (CR 7085231) 26 Oracle VTS dtlbtest Hangs When CPU Threading Mode is Set to max-ipc (CR 7094158) 27vi SPARC T4-1B Server Module Product Notes • December 2011vii Using This Documentation This document provides important and late-breaking information for Oracle’s SPARC T4-1B server module. ¦ “Related Documentation” on page vii ¦ “Feedback” on page viii ¦ “Support and Accessibility” on page viii Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1B server module http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1B Sun Blade 6000 modular system http://www.oracle.com/pls/topic/lookup?ctx=sb6000 Oracle Integrated Lights Out Manager (Oracle ILOM) 3.0 http://www.oracle.com/technetwork/documentation/sys-mgmtnetworking-190072.html Oracle Solaris OS and other system software http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Oracle VTS software http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 SAS-1/SAS-2 compatibility http://www.oracle.com/pls/topic/lookup?ctx=E22513_01viii SPARC T4-1B Server Module Product Notes • December 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 C H A P T E R 1 Late-Breaking Information These sections provide important information and late-breaking news about the server module: ¦ “Supported Chassis” on page 1 ¦ “Supported Hardware Components” on page 3 ¦ “Preinstalled Software” on page 4 ¦ “Supported Versions of the OS, Firmware, and Software” on page 5 ¦ “Required Patches and Package Updates” on page 6 ¦ “Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components” on page 8 ¦ “Identifying Drive Logical Device Names and Physical Locations” on page 8 Supported Chassis Several versions of the Sun Blade 6000 modular system have been available. The latest two versions support SAS-1 and SAS-2 modular components. Gen2-capable PCIe EMs and NEMs connected to this server module through the chassis run at Gen2 speeds. Gen1-capable devices run at Gen1 speeds. This server module is supported in the following chassis models: ¦ Latest model (A90-D) Sun Blade 6000 modular system – Requires CMM software release 4.0 or later.2 SPARC T4-1B Server Module Product Notes • December 2011 ¦ Previous model (A90-B) Sun Blade 6000 modular system – Requires CMM software release 3.3 or later. This server module is only supported in this modular system with these modular components: ¦ SPARC T3-1B server module ¦ Sun Blade T6320 server module ¦ Sun Blade T6340 server module ¦ Sun Blade X6270 M2 server module ¦ Sun Blade X6270 server module ¦ Sun Blade X6275 M2 server module ¦ Sun Blade Storage Module M2 To determine your chassis version, see “Identify Your Chassis Version” on page 2. ? Identify Your Chassis Version ? View the CMM on the rear of the modular system (chassis). ¦ Left – CMM on the previous model (A90-B) chassis ¦ Right – CMM on the latest model (A90-D) chassis For more details about the chassis, refer to the Sun Blade 6000 modular system documentation.Chapter 1 Late-Breaking Information 3 Supported Hardware Components Hardware Component Description NEMs NEM 7100091 or 7011713 – Sun Blade 6000 Virtualized 40 GbE NEM Requires: • For 1GbE connectivity – no FEM required. • For 10GbE connectivity – FEM 7100283 or 7100633. • For SAS2 storage connectivity – REM SG- or SGX- SAS6-REM-Z This NEM’s documentation is at: http://www.oracle.com/pls/topic/lookup?ctx=E21077-01 NEM 2073A – Sun Blade 6000 Ethernet Switched Network Express Module 24p 10GbE NEM Requires: • For 10GbE network connectivity – FEM 4871A-Z. • For storage connectivity – REM SG-SAS6-REM-Z. This NEM’s documentation is at: http://www.oracle.com/pls/topic/lookup?ctx=E19285-01 NEM 4338A – Sun Blade 6000 Virtualized MultiFabric 10GbE M2 NEM Requires: • For 1GbE connectivity – no FEM required. • For 10GbE connectivity – FEM 7100283 or 7100633. • For SAS2 storage connectivity – REM SG- or SGX- SAS6-REM-Z. This NEM’s documentation is at: http://www.oracle.com/pls/topic/lookup?ctx=E19530-01 NEM 4250A – Sun Blade 6000 Network Express Module 10-port 1 GbE PassThrough NEM Provides GbE connectivity – no FEM required. REMs REM SG(X)-SAS6-REM-Z – Sun StorageTek 6 Gb SAS REM HBA Prior to installation, update firmware on SAS-1 components. See “Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components” on page 8. This REM’s documentation is at: http://www.oracle.com/pls/topic/lookup?ctx=E19946-01 FEMs FEM 7100283 or 7100633 – PCI-E Pass-Through FEM Supported. FEM X4871A-Z – Sun Dual 10GbE PCIe 2.0 FEM Supported. This FEM’s documentation is at: http://www.oracle.com/pls/topic/lookup?ctx=E19539-014 SPARC T4-1B Server Module Product Notes • December 2011 Preinstalled Software The preinstalled OS is ready to be configured at the appropriate point when you first apply power to the server. Review “Required Patches and Package Updates” on page 6 to find out if the preinstalled OS requires package updates. You can reinstall the OS and install patches instead of using the preinstalled OS. See “Supported Versions of the OS, Firmware, and Software” on page 5. Refer to the Oracle Solaris documentation for instructions on installing and configuring the Oracle Solaris OS. Software Location Function One of the following: • Oracle Solaris 11 OS • Oracle Solaris 10 8/11 OS Note - Mandatory package updates and patches are not preinstalled. You must obtain and install them before you put the server module into production. See “Required Patches and Package Updates” on page 6. On ZFS with the root partition (/) on drive 0, slice 0 OS. Oracle VM Server for SPARC 2.1 /opt/SUNWldm Manages logical domains. Electronic Prognostics (EP) 1.2 /opt/ep Provides early warning of the potential for specific FRU faults. Oracle VTS 7.0 PS11 /usr/sunvts Provides hardware validation tests.Chapter 1 Late-Breaking Information 5 Supported Versions of the OS, Firmware, and Software Software Supported Versions Host OS • Oracle Solaris 11 OS • Oracle Solaris 10 8/11 OS (requires mandatory patches). • Oracle Solaris 10 9/10 OS (requires patches) • Oracle Solaris 10 10/09 OS (requires patches) For OS patch and package update information, see “Required Patches and Package Updates” on page 6. For information about the preinstalled OS, see “Preinstalled Software” on page 4. System firmware 8.1.2.b (or later) (includes Oracle ILOM 3.0). Oracle VM Server for SPARC (LDoms) 2.1 plus patches. The patches are included and preinstalled on the preinstalled OS. Oracle Electronic Prognostics (EP) 1.2 This software provides early warning of the potential for specific FRU faults. Oracle VTS • 7.0 PS11 (minimum) • 7.0 PS12 • 7.0 PS13 Note - For the most reliable test coverage of the various modular components in the chassis, use Oracle VTS 7.0 PS12 or higher.6 SPARC T4-1B Server Module Product Notes • December 2011 Required Patches and Package Updates If you use the preinstalled OS, or if you reinstall the OS on the server module, you might need to install certain patches or package updates before you put the server module into production. Note – Oracle Solaris 11 OS uses package updates rather than patches. Oracle Solaris 11 OS Package Updates No package updates are required at this time to use Oracle Solaris 11 OS with this server. You should install an Oracle Solaris 11 Support Repository Update (SRU), if one is available. Use the pkg command or the package manager GUI to download any available SRU from: https://pkg.oracle.com/solaris/support Oracle Solaris 10 OS Patches TABLE 1-1 Oracle Solaris 10 8/11 OS Required Patches Installation Order OS or Patch 1 Oracle Solaris 10 8/11 OS 2 These mandatory patches: • 147440-04 (or higher) • 147149-01 (or higher) • 147153-01 (or higher) • 147707-01 (or higher) • 147159-03 (or higher) 3 Recommended OS Patchset Solaris 10 SPARCChapter 1 Late-Breaking Information 7 Note – For current information about required patches and updates for optional hardware and software, refer to the documentation for each product. ? Obtain Patches 1. Sign into My Oracle Support: http://support.oracle.com 2. Select the Patches & Updates tab. 3. Search for a patch using the Patch Search panel. When searching for a patch using the Patch Name or Number field, you must specify the complete name or number of the patch. For example: ¦ Solaris 10 8/11 Patch Bundle ¦ 13058415 ¦ 147159-03 To search using a patch number without the revision number (two last digits), use % in place of the revision number. For example: 14159-% 4. Once you locate the patch, access the README and download the patch from the site. The patch README provides the patch installation instructions. TABLE 1-2 Oracle Solaris 10 9/10 OS and Oracle Solaris 10 10/09 OS Required Patches Installation Order OS or Patch 1 Oracle Solaris 10 9/10 OS or Oracle Solaris 10 10/09 OS 2 Solaris 10 8/11 Patch Bundle (13058415) 3 These mandatory patches: • 147440-04 (or higher) • 147149-01 (or higher) • 147153-01 (or higher) • 147707-01 (or higher) • 147159-03 (or higher) 4 Recommended OS Patchset Solaris 10 SPARC8 SPARC T4-1B Server Module Product Notes • December 2011 Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components Before you insert a SAS-2 component into the chassis, you must upgrade the firmware of your SAS-1 components (SAS-1 NEMs and storage modules) to a firmware version that supports SAS-1/SAS-2 coexistence. At a minimum, all SAS expanders for SAS-1 NEMs and Sun Blade 6000 storage modules must be upgraded to firmware revision 5.04.03 (or later). This firmware revision enables SAS-1/SAS-2 devices to coexist in the Sun Blade 6000 modular system chassis. Using older firmware revisions might result in SAS-2 devices hanging. Refer to the SAS-1/SAS-2 Compatibility Upgrade Guide for details. This guide is available at: http://www.oracle.com/pls/topic/lookup?ctx=E22513_01 Identifying Drive Logical Device Names and Physical Locations The Oracle Solaris OS now uses the worldwide number (WWN) in place of the target ID field (tn) in drive logical device names for SAS-2 storage controllers. This change affects how you correlate a drive’s logical name with the drive’s physical location. These points are key to understanding the impact of this change: ¦ Before the change to using WWNs, drives were known to the OS by a logical name such as c0t0d0. This logical name mapped to the drive’s physical location. With the change, the device identifier for drives now has this form: cntWWNdn, where WWN is a unique hexadecimal value. An example of a logical device name is: c0t5000C50033438DBBd0 This WWN value does not map in a predictable way to the physical location of the drive.Chapter 1 Late-Breaking Information 9 ¦ The OBP and the OS use different WWN numbers to identify a drive. This is explained further in “Correlate WWN Device Names With Physical Locations (diskinfo Command)” on page 9. ¦ Here are some examples of situations when you must correlate a logical device name with a drive’s physical location: ¦ When downloading the OS over a network, you must specify the logical device name of the drive in slot 0 (the default boot device). In addition, if you use Oracle Solaris Jumpstart, you must use a specific WWN syntax. See “Oracle Solaris Jumpstart WWN Syntax” on page 11. ¦ If you run the format command, you must select one of the logical device names presented. To ensure you select the correct drive, you must correlate a logical device name with the physical drive. ¦ If you view a system message that lists a drive’s logical device name, you might need to identify the slot in which the drive is installed. To correlate drive logical device names with physical locations or the other way around: ¦ From the Oracle Solaris 10 8/10 OS, use the diskinfo command. See “Correlate WWN Device Names With Physical Locations (diskinfo Command)” on page 9. ¦ At the OBP ok prompt, use the probe-scsi-all command. See “Correlate WWN Device Names With Physical Locations (probe-scsi-all Command)” on page 10. ? Correlate WWN Device Names With Physical Locations (diskinfo Command) The diskinfo command, a new disk and slot identification utility, was introduced in Oracle Solaris 10 8/11 OS and in the kernel patch 144500-19 (or later). If you do not have access to the OS, for example, if the server module is not booted, see “Correlate WWN Device Names With Physical Locations (probe-scsi-all Command)” on page 10. If your OS does not provide the diskinfo command, refer to the SPARC and Netra SPARC T4 Series Servers Administration Guide for alternative methods. 1. Log into the OS. 2. Type: # diskinfo -a Enclosure path: 1114BD0ACC-physical-hba-010 SPARC T4-1B Server Module Product Notes • December 2011 3. Use the output under the Label and Disk Name columns to correlate a drive’s physical location with its corresponding logical device name. For this server module: ¦ /SYS/HDD0 represents a drive in slot 0. ¦ /SYS/HDD1 represents a drive in slot 1. In this example, the drive installed in slot 0 has a logical device name of c0t5000C50033438DBBd0. Note – The diskinfo command provides a variety of disk information depending on the command options you specify. For more information, type diskinfo -h and refer to the diskinfo(1M) man page. ? Correlate WWN Device Names With Physical Locations (probe-scsi-all Command) If you have access to the OS, you might be able to use the diskinfo command instead. See “Correlate WWN Device Names With Physical Locations (diskinfo Command)” on page 9. 1. At the ok prompt, type: Chassis Serial Number: 1114BD0ACC-physical-hba-0 Chassis Model: ORCL,SPARC-T4-1B Label Disk name Vendor Product Vers ---------- ---------------------- -------- ---------------- ---- /SYS/HDD0 c0t5000C50033438DBBd0 SEAGATE ST930003SSUN300G 0B70 /SYS/HDD1 c0t5000C50005C15803d0 SEAGATE ST930003SSUN300G 0468 {0} ok probe-scsi-all /pci@400/pci@1/pci@0/pci@c/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c50033438dbb SASAddress 5000c50033438db9 PhyNum 0 <=HD,slot 0 Target bChapter 1 Late-Breaking Information 11 2. In output, look for the following disk identifiers: ¦ LSI,sas@0 – Controller (REM) on the server module. ¦ SASDeviceName – WWN that the Oracle Solaris OS recognizes. ¦ SASAddress – WWN that the OBP references. ¦ PhyNum – Physical slot that the drive occupies. 3. Use the values in the output to construct the resulting Oracle Solaris logical device name as expressed by cntndn. This example is based on the previous output: ¦ cn = c0 n is the SAS controller number, 0 in this example. ¦ tn = t5000c50033438dbb n is the SASDeviceName value. ¦ dn = d0 n is 0 for all embedded SCSI devices. The resulting logical device name is c0t5000c50033438dbbd0. Oracle Solaris Jumpstart WWN Syntax The Oracle Solaris syntax requires all WWN alpha characters to be capitalized. Note – Only the WWN portion of the logical device name requires capitalized alpha characters. The c0 and d0 portion are not capitalized. Unit 0 Disk SEAGATE ST930003SSUN300G 0468 585937500 Blocks, 300 GB SASDeviceName 5000c50005c15803 SASAddress 5000c50005c15801 PhyNum 1 <=HD,slot 1 Target c Unit 0 Encl Serv device SUN NEM Hydra II SOL 0308 SASAddress 5080020000bb193d PhyNum 24 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.0012 SPARC T4-1B Server Module Product Notes • December 2011 This Jumpstart profile example shows how to use the WWN syntax when installing the OS on a specific drive. Interactive Installation Example In an interactive installation, you are asked to specify one or more drives as the targets for the OS installation. This step ensures that sufficient storage capacity is provided for the installation. Specify the drive with the WWN value that corresponds to the drive on which you want to install the software. These WWN values are illustrated in the following interactive example. The drive selected as the installation target is located in drive slot 0, the default boot location. Note – If you prefer to use some other disk, specify it instead of the one in HDD slot 0. # install_type flash_install boot_device c0t5000C50033438DBBd0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/la test.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000C50005C15803d0 286090 MB [X] c0t5000C50033438DBBd0 286090 MB (F4 to edit) Total Selected: 286090 MBChapter 1 Late-Breaking Information 13 Note – You might need to label new and replacement drives using the format utility before you can install the OS on the drives. Suggested Minimum: 5032 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_Help14 SPARC T4-1B Server Module Product Notes • December 201115 C H A P T E R 2 Known Product Issues These sections describe known issues for the server module: ¦ “Hardware Issues” on page 15 ¦ “Firmware, OS, and Other Software Issues” on page 17 Hardware Issues These are the known hardware issues and workarounds. Sun Type 6 Keyboards are Not Supported by SPARC T4 Series Servers Sun Type 6 keyboards cannot be used with SPARC T4 series servers. PSH Might Not Clear a Retired Cache Line on a Replaced Motherboard (CR 7031216) When the enclosure is replaced to repair faulty cache on the motherboard, PSH might not clear the cache on the replacement. The cache line remains disabled. Workaround: Manually clear the disabled cache line by typing these commands: # fmadm repaired fmri | label # fmadm replaced fmri | label16 SPARC T4-1B Server Module Product Notes • December 2011 2-Meter USB Cable Length Limit (7048419) The server module has three USB ports: ¦ Port 1 and 2, accessible through a dongle that is attached to the front UCP connector. ¦ Port 5, located on the rear of the motherboard (intended for a USB flash drive). Workaround: If you connect USB devices to ports 1 or 2, ensure that the cable does not exceed 2 meters (approximately 6.5 feet). Uncorrectable L2 Cache Errors are Sometimes Reported as Core Faults Without Any Cache Line Retirement (CR 7071237 and CR 7071974) When a processor cache line encounters an uncorrectable error, the fault manager should retire the cache line that is involved in the error. However, the fault manager might not succeed in retiring the faulty cache line and instead report the entire core or processor as faulted. Workaround: Schedule a replacement of the enclosure (motherboard). For additional information about this issue, search for message ID SUN4V-8002-WY at the Oracle support site: http://support.oracle.com. During a Reboot After an Unrecoverable Hardware Error, CPUs Might Not Start (CR 7075336) In rare cases, a server or sever module might experience a serious problem that results in a panic. When the server or server module is rebooted, a number of CPUs might not start even though the CPUs are not faulty. Here is an example of the type of error displayed: rebooting... Resetting... ERROR: 63 CPUs in MD did not startChapter 2 Known Product Issues 17 Workaround: Log into Oracle ILOM on the SP and power cycle the host: Blue LED on Drive Does Not Light When the Drive is Ready to Remove (CR 7082700) When you attempt to unconfigure a drive for removal, the drive’s blue LED, which indicates the drive is ready for removal, might not light. This situation occurs after you replace a drive in a slot with a drive that has a different WWID. Workaround: If you inserted a drive after booting the server, reboot the server for the blue LED to work properly. Firmware, OS, and Other Software Issues The following notes describe know issues for the firmware, OS, and other software. fault.memory.memlink-uc Fault Did Not Cause Panic as Stated by System Message (CR 6940599) When a fault.memory.memlink-uc interconnect fault is detected, the server should shut down to protect memory integrity. On intermittent occasions, this fault has been reported during boot operations without the server shutting down. Although this irregular behavior might indicate that the system was able to recover from the memory link error and restore a healthy boot-up state, the safest course is to power down then power up the server. -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS18 SPARC T4-1B Server Module Product Notes • December 2011 Recovery Action: Log into Oracle ILOM on the SP power cycle the host: Timestamp for an Oracle ILOM Fault/Critical Event Might Be off by One Hour (CR 6943957) The timestamp reported in an email generated in an Oracle ILOM fault/critical event might be one hour later than the timestamp recorded in the event log. Workaround: Check the timestamp recorded in the event log. If that timestamp does not match the timestamp reported in the email, use the event log time. e1000g Driver Generates Spurious ereports When Installing Oracle Solaris OS Over a Sun PCIe Dual Gigabit Ethernet Adapter (CR 6958011) When installing the Oracle Solaris OS on domains controlled through Sun PCIe Dual Gigabit Ethernet (UTP or MMF) adapters, the e1000g driver might generate false error reports on the static direct I/O (SDIO) and primary domains. For example: -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS date time ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 ena = 0x298a9f62243802 detector = (embedded nvlist) nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600Chapter 2 Known Product Issues 19 Workaround: You can safely ignore these ereports. When diag-switch? Is Set to true, Oracle Solaris OS Fails to Update the EEPROM for Automatic Rebooting (CR 6982060) When installing the Oracle Solaris OS while the OBP diag-switch? parameter is set to true, the OS installer fails to update the bootdevice parameter with the new device path where the OS was installed. Therefore, this new device path will not be used during the subsequent automatic system reboots. Under these conditions, the server displays these error message and you are unable to reboot from the device: On previous servers and server modules, the OBP diag-device parameter used to set the new device path to the boot device when the diag-switch? parameter was set to true. On SPARC T4 servers and server modules, the diag-device parameter is no longer supported and the Oracle Solaris OS installer warns that setting the OBP boot-device parameter is not possible. Workaround: From the Oracle ILOM prompt, set the OBP diag-switch? parameter to false: Alternatively, you can set this parameter at the OBP ok prompt: source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a0 Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebooting -> set /HOST/bootmode script="setenv diag-switch? false" ok setenv diag-switch? false20 SPARC T4-1B Server Module Product Notes • December 2011 sas2ircu Message That RAID Volume Sizes Other Than MAX Are Not Supported (CR 6983210) If you attempt to create a RAID volume smaller than MAX, the following series of messages is returned: RAID volumes smaller than MAX are not supported. However, if you want to create a volume below MAX size for nonproduction use, the software allows you to do so. This situation is not clear from the message. Workaround: Ignore the messages and answer yes for the question “Do you want to continue with volume creation (YES/NO)?”. Fault Management Sometimes Sends Resolved Cases to the SP (CR 6983432) Previously diagnosed and repaired PSH faults from the host reappear in Oracle ILOM when the host reboots. An incorrect report of a PSH-diagnosed fault appears in the Oracle ILOM CLI and web interface, and the fault LED illuminates. You can identify this issue by checking to see if the same PSH fault was also reported from the host. If the fault was reported only by Oracle ILOM and not from the host, it is probably an example of this issue. Recovery Action: Use the Oracle ILOM diagnostic and repair tools to identify the error condition and correct it. This example illustrates how to diagnose and repair a PSH fault diagnosed by the host. This example is based on the Oracle ILOM fault management shell.You could instead use the Oracle ILOM CLI or web interface to accomplish the same results. You are about to create an IR volume. WARNING: Proceeding with this operation may cause data loss or data corruption. Are you sure you want to proceed (YES/NO)? yes WARNING: Volume created with size other than ’MAX’ is not supported. Do you want to continue with volume creation (YES/NO)? n SAS2IRCU: you must answer "YES" or "yes" to proceed; operation aborted! SAS2IRCU: Error executing command CREATE.Chapter 2 Known Product Issues 21 1. Display the fault information. 2. Check for faults on the host. 3. Verify that the fault shown by Oracle ILOM was repaired on the host. 4. Flush the previously faulty component from the host resource cache. faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2011-09-16/15:38:19 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Major Fault class : fault.cpu.generic-sparc.strand FRU : /SYS/MB (Part Number: 7015272) (Serial Number: 465769T+1130Y6004M) Description : A fault has been diagnosed by the Host Operating System. Response : The service required LED on the chassis and on the affected FRU may be illuminated. Impact : No SP impact. Check the Host OS for more information. Action : The administrator should review the fault on the Host OS. Please refer to the Details section of the Knowledge Article for additional information. # fmadm fault # <-- Host displays no faults # fmdump TIME UUID SUNW-MSG-ID Sep 16 08:38:19.5582 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Sep 16 08:40:47.8191 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-4M Repaired Sep 16 08:40:47.8446 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-6U Resolved # # fmadm flush /SYS/MB fmadm: flushed resource history for /SYS/MB #22 SPARC T4-1B Server Module Product Notes • December 2011 5. Repair the fault in Oracle ILOM. Units Used to Define the MIB Power Management Time Limit are Reported in Seconds (CR 6993008) The MIB should report the sunHwCtrlPowerMgmtBudgetTimelimit in milliseconds, but the value displayed is in seconds. Workaround: Understand that the value reported for sunHwCtrlPowerMgmtBudgetTimelimit is in seconds. Spurious Interrupt Message in System Console When Using Oracle VTS (CR 7038266) During normal operation and when running the Oracle VTS system exerciser, you might see this message in the system console: Workaround: You can safely ignore this message. Intermittent Link Training Timeout Displayed During Power Cycles (CR 7043201) On occasion during a power cycle, the server module might display the following warning message: [CPU 0:0:0] NOTICE: MCU0: Link init failed: TS0 Timeout The server module automatically retries the training sequence operation without error. Workaround: You can safely ignore this message. faultmgmtsp> fmadm repair /SYS/MB faultmgmtsp> fmadm faulty No faults found faultmgmtsp> date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x3,0x02,or 0x04Chapter 2 Known Product Issues 23 The cfgadm Command Might Fail on SG-SAS6- REM-Z or SGX-SAS6-REM-Z HBAs (CR 7044759) The cfgadm command might fail on SG-SAS6-REM-Z or SGX-SAS6-REM-Z HBA devices. Workaround: Disable the fault management daemon before running the cfgadm unconfigure command. After completing the cfadm task, re-enable the fault management daemon: Message From cpustat Refers to Processor Documentation Incorrectly (CR 7046898) A message displayed by the cpustat command says: The document and website listed in this message are not available. # cfgadm -c unconfigure Slot1 cfgadm: Component system is busy, try again: unconfigure failed WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 # svcadm disable fmd # ps -ef |grep fmd ... # cfgadm -c unconfigure PCI-EM0 # svcadm enable fmd See the “SPARC T4 User’s Manual” for descriptions of these events. Documentation for Sun processors can be found at: http://www.sun.com/processors/manuals24 SPARC T4-1B Server Module Product Notes • December 2011 reboot disk Command Occasionally Fails When disk Argument Picks Up Extra Characters (CR 7050975) When running the reboot disk command, extraneous characters are occasionally added to the disk argument before it reaches the OBP. This situation results in a failure to boot. Recovery Action: Repeat the boot request. PCIe Correctable Errors Might Be Reported (CR 7051331) In rare cases, PCIe Gen2 devices in the server module might report I/O errors that are identified and reported by predictive self-healing (PSH). For example: --------------- ------------------------------------ -------------- --------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ -------------- --------- Aug 10 13:03:23 a7d43aeb-61ca-626a-f47b-c05635f2cf5a PCIEX-8000-KP Major Host : dt214-154 Platform : ORCL,SPARC-T3-1B Chassis_id : Product_sn : Fault class : fault.io.pciex.device-interr-corr 67% fault.io.pciex.bus-linkerr-corr 33% Affects : dev:////pci@400/pci@1/pci@0/pci@c dev:////pci@400/pci@1/pci@0/pci@c/pci@0 faulted but still in service FRU : "/SYS/MB" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000:serial=1005LCB- 1052D9008K:part=541-424304:revision=50/chassis=0/motherboard=0) 67% "FEM0" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000/chassis= 0/motherboard=0/hostbridge=0/pciexrc=0/pciexbus=1/pciexdev=0/pciexfn= 0/pciexbus=2/pciexdev=12/pciexfn=0/pciexbus=62/pciexdev=0) 33% faulty Description : Too many recovered bus errors have been detected, which indicates a problem with the specified bus or with the specified transmitting device. This may degrade into an unrecoverable fault. Refer to http://sun.com/msg/PCIEX-8000-KP for more information.Chapter 2 Known Product Issues 25 These errors might be an indication of a faulty or incorrectly seated PCI EM. Or these errors might be erroneous. Workaround: Ensure that the PCI EM is properly seated and functioning. If the errors continue, apply the Oracle Solaris 10 8/11 OS patch 147705-01 (or higher). Watchdog Timeouts Seen With Heavy Workloads and Maximum Memory Configurations (CR 7083001) With certain unusual heavy workloads, especially where a highly processorintensive workload is bound to cpu 0, the host might appear to suddenly reset back to OBP without any sign of there having been a crash or a panic. The Oracle ILOM event log contains a host watchdog expired entry. The problem is more likely to occur on systems with full memory configurations. If you see this sort of sudden reset, display the SP event log using this command from the Oracle ILOM CLI: If you see an entry labeled Host watchdog expired, you are experiencing this issue. Workaround: Contact your authorized service provider to see if a fix is available. There are two ways you can work around this issue: ¦ You can extend the watchdog period by adding this entry to the Oracle Solaris /etc/system file: This extends the watchdog timeout period to 1 minute (60000 milliseconds). Response : One or more device instances may be disabled Impact : Loss of services provided by the device instances associated with this fault Action : If a plug-in card is involved check for badly-seated cards or bent pins. Otherwise schedule a repair procedure to replace the affected device. Use fmadm faulty to identify the device or contact Sun for support. -> show /SP/logs/event/list set watchdog_timeout = 6000026 SPARC T4-1B Server Module Product Notes • December 2011 ¦ In extreme cases, you can disable the watchdog timeout altogether by adding this entry to the /etc/system file: Whenever you modify the /etc/system file you must reboot the system for the changes to take effect. If you do not want to reboot the system immediately after editing /etc/system, you can apply an additional temporary workaround that takes effect immediately. To apply this temporary workaround, as root type: This command creates a temporary processor set containing only CPU 0, preventing application workloads from using this processor and preventing this issue from occurring. Note – If any threads were bound to CPU 0, they will be unbound. This temporary processor set is removed on the next operating system reboot, at which point the /etc/system file workaround takes effect. ereport.fm.fmd.module Generated During a Reboot of an SDIO Domain (CR 7085231) The server module might generate an ereport.fm.fmd.module message during a reboot of an SDIO domain. This ereport indicates that an error occurred on one of the fmd modules but the fmdump command does not display a valid message (msg). For example: set watchdog_enabled = 0 # psrset -c -F 0 # fmdump -eV -c ereport.fm.fmd.module TIME CLASS Sep 27 2011 06:27:19.954801492 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmdChapter 2 Known Product Issues 27 Workaround: You can safety ignore ereport.fm.fmd.module ereports. Oracle VTS dtlbtest Hangs When CPU Threading Mode is Set to max-ipc (CR 7094158) This issue is fixed in Oracle VTS 7.0 PS13. The Oracle VTS processor test called dtlbtest hangs when Oracle VM for SPARC max-ipc threading mode is set. This issue is not specific to any processor type, and happens when both the following cases are true: ¦ Only one CPU or strand per core is enabled or online. ¦ The total number of online CPU per strand is less than or equal to 128. Workaround: Do one of the following: ¦ Update to Oracle VTS 7.0 PS13 ¦ Do not run the Oracle VTS dtlbtest with the Oracle VM for SPARC threading mode set to max-ipc mode. authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = ORCL,SPARC-T4-1B server-id = c193-133 (end authority) mod-name = etm mod-version = 1.2 (end detector) ena = 0x425fc9b065404001 msg = cannot open write-only transport <=== __ttl = 0x1 __tod = 0x4e81cf37 0x38e91d5428 SPARC T4-1B Server Module Product Notes • December 2011 SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices Part No.: E23433-01, October 2011Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents 1. Third Party Technology Notices and Licenses 1 Third Party Technology 1 Third Party Notices and Licenses 2iv SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices • October 20111 C H A P T E R 1 Third Party Technology Notices and Licenses This chapter contains the following: ¦ “Third Party Technology” on page 1 ¦ “Third Party Notices and Licenses” on page 2 Third Party Technology The following third party technology may be included in or distributed with this product. The notices provided below in “Third Party Notices and Licenses” on page 2 are based on information made available to Oracle by the third party licensors listed. Some software is expressly licensed only under the license terms indicated. Such software is licensed separately and not under the terms of the Oracle license. Additionally, software whose license terms require separate licensing of the software under open source terms, including without limitation the GPL, the LGPL and the Mozilla license, will be understood to be separately licensed under the relevant open source license and not under the terms of the Oracle license. ¦ “Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software” on page 2 ¦ “Preboot Execution Environment (PXE)” on page 22 SPARC T4 Series Servers Program Documentation Third Party Licenses and Notices • October 2011 Third Party Notices and Licenses Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software Use of any of this software is governed by the terms of the license below: The software and all copies shall remain the property of Intel. Intel retains the right to use, copy, modify, sublicense, and distribute the software. Marking requirement – US Government sales. All copies of Object Code distributed directly or indirectly to the US government are governed by a legend substantially similar to the following: The enclosed software products and documentation were developed at private expense, and are provided with “RESTRICTED RIGHTS”. Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et seq. or its successor. The use of this product by the government constitutes an acknowledgment of Intel’s proprietary rights in the product. If you are acquiring this software on behalf of the U.S. government, the Government shall have only “Restricted Rights” in the software and related documentation as defined in the Federal Acquisition Regulations (FARs) in Clause 52.227.19 (c) (2). If you are acquiring the software on behalf of the Department of Defense, the software shall be classified as “Commercial Computer Software” and the Government shall have only “Restricted Rights” as defined in Clause 252.227- 7013 (c) (1) of DFARs. Notwithstanding the foregoing, the authors grant the U.S. Government and others acting in its behalf permission to use and distribute the software in accordance with the terms specified in this license. Preboot Execution Environment (PXE) The enclosed software products and documentation were developed at private expense, and are provided with “Restricted Rights.” Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et. seq. or its successor. The use of this product by the government constitutes acknowledgment of Intel’s proprietary rights in the product. SPARC T4-1B Server Module Safety and Compliance Guide Compliance Model No.: T4BLD Part No.: E22740-01 October 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Declaration of Conformity 1 Regulatory Compliance Statements 3 Safety Agency Compliance Statements 5iv SPARC T4-1B Server Module Safety and Compliance Guide • October 20111 Declaration of Conformity English To receive a copy of the latest Declaration of Conformity (DoC) for the product, either contact your local Oracle sales representative or send an email to: Compliance_Request_WW@oracle.com. Français Pour recevoir une copie de la dernière déclaration de conformité pour le produit, contactez votre représentant commercial local Oracle ou envoyez un courriel à l'adresse suivante : Compliance_Request_WW@oracle.com. Deutsch Wenn Sie eine Kopie der neuesten Konformitatserklarung fur das Produkt erhalten mochten, wenden Sie sich entweder an den Oracle-Vertriebsbeauftragten vor Ort, oder fordern Sie sie per E-Mail unter der folgenden Adresse an: Compliance_Request_WW@oracle.com. Italiano Per ricevere una copia della Dichiarazione di conformità (DoC, Declaration of Conformity) più recente del prodotto, contattare il rappresentante delle vendite Oracle locale oppure inviare un messaggio di posta elettronica all'indirizzo: Compliance_Request_WW@oracle.com. Português (Brasil) Para receber uma cópia da mais recente Declaração de Conformidade (DoC) do produto, entre em contato com o representate de vendas local da Oracle ou envie um email para: Compliance_Request_WW@oracle.com. Español Para recibir una copia de la Declaración de conformidad más reciente del producto, póngase en contacto con su representante local de ventas de Oracle o envíe un mensaje de correo electrónico a: Compliance_Request_WW@oracle.com.2 SPARC T4-1B Server Module Safety and Compliance Guide • October 20113 Regulatory Compliance Statements Your Sun product from Oracle is marked to indicate its compliance class: ¦ Federal Communications Commission (FCC) — USA ¦ Industry Canada Equipment Standard for Digital Equipment (ICES-003) — Canada ¦ Voluntary Control Council for Interference (VCCI) — Japan ¦ Bureau of Standards Metrology and Inspection (BSMI) — Taiwan ¦ Certi?cation and Accreditation Administration of the People’s Republic of China (CNCA) — China ¦ Korea Communications Commission (KCC) — Korea Please read the appropriate section that corresponds to the marking on your Sun product before attempting to install the product. FCC Class A Notice This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if it is not installed and used in accordance with the instruction manual, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user will be required to correct the interference at his own expense. Modifications: Any modi?cations made to this device that are not approved by Oracle may void the authority granted to the user by the FCC to operate this equipment. ICES-003 Class A Notice - Avis NMB-003, Classe A This Class A digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada.4 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 BSMI Class A Notice The following statement is applicable to products shipped to Taiwan and marked as Class A on the product compliance label. CCC Class A Notice The following statement is applicable to products shipped to China and marked with “Class A” on the product’s compliance label. Korean Class A Notice The following is the Korean Class A Broadcasting and Telecommunication Products for Business Purpose Statement.5 Safety Agency Compliance Statements Read this section before beginning any procedure. The following text provides safety precautions to follow when installing a Sun product. Safety Precautions For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Never push objects of any kind through openings in the equipment. Dangerous voltages may be present. Conductive foreign objects could produce a short circuit that could cause fire, electric shock, or damage to your equipment. ¦ This product is intended for restricted access whereby access is controlled through the use of a means of security (for example, key, lock, tool, badge access) and personnel authorized for access have been instructed on the reasons for the restrictions and any precautions that need to be taken. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symbols The following symbols may appear in this book: Caution – There is a risk of personal injury and equipment damage. Follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and may cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. Depending on the type of power switch your device has, one of the following symbols may be used: On – Applies AC power to the system. Off – Removes AC power from the system.6 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Standby – The On/Standby switch is in the standby position. Modifications to Equipment Do not make mechanical or electrical modifications to the equipment. Oracle is not responsible for regulatory compliance of a modified Sun product. Placement of a Sun Product Caution – Do not block or cover the openings of your Sun product. Never place a Sun product near a radiator or heat register. Failure to follow these guidelines can cause overheating and affect the reliability of your Sun product. Noise Level Product: SPARC T4-1B server module In compliance with the requirements defined in ISO 7779, the workplace-dependent noise level of this product is less than 70 db (A). SELV Compliance Safety status of I/O connections comply to SELV requirements. Power Cord Connection Caution – Sun products are designed to work with power systems having a grounded neutral (grounded return for DC-powered products). To reduce the risk of electric shock, do not plug Sun products into any other type of power system. Contact your facilities manager or a qualified electrician if you are not sure what type of power is supplied to your building. Caution – Not all power cords have the same current ratings. Do not use the power cord provided with your equipment for any other products or use. Household extension cords do not have overload protection and are not meant for use with computer systems. Do not use household extension cords with your Sun product. The following caution applies only to devices with a Standby power switch: Caution – The power switch of this product functions as a standby type device only. The power cord serves as the primary disconnect device for the system. Be sure to plug the power cord into a grounded power outlet that is nearby the system and is readily accessible. Do not connect the power cord when the power supply has been removed from the system chassis. The following caution applies only to devices with multiple power cords:Safety Agency Compliance Statements 7 Caution – For products with multiple power cords, all power cords must be disconnected to completely remove power from the system. Battery Warning Caution – There is danger of explosion if batteries are mishandled or incorrectly replaced. On systems with replaceable batteries, replace only with the same manufacturer and type or equivalent type recommended by the manufacturer per the instructions provided in the product service manual. Do not disassemble batteries or attempt to recharge them outside the system. Do not dispose of batteries in fire. Dispose of batteries properly in accordance with the manufacturer’s instructions and local regulations. Note that on Sun CPU boards, there is a lithium battery molded into the real-time clock. These batteries are not customer replaceable parts. Caution – For product installed in California, USA: This product may contain a time-of-day battery which may contain perchlorate where special handling may apply. See http://www.dtsc.ca.gov/hazardouswaste/perchlorate. Energy Storage Module Caution Caution – There is a danger of shock or equipment damage if energy storage modules are mishandled or incorrectly replaced. When replacing the energy storage modules, use only replacement modules that have been provided by Oracle, following the instructions provided in the product service manual. Do not disassemble modules or attempt to recharge them outside of the system. Do not dispose of the modules; instead, return them to Oracle in accordance with Oracle procedures for the product System Unit Cover You must remove the cover of your Sun computer system unit to add cards, memory, or internal storage devices. Be sure to replace the cover before powering on your computer system. Caution – Do not operate Sun products without the cover in place. Failure to take this precaution may result in personal injury and system damage. Rack System Instructions The following or similar rack-mount instructions are included with the installation instructions:8 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 ¦ Elevated Operating Ambient – If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Therefore, consideration should be given to installing the equipment in an environment compatible with the maximum ambient temperature (Tma) specified by the manufacturer. ¦ Reduced Air Flow – Installation of the equipment in a rack should be such that the amount of air flow required for safe operation of the equipment is not compromised. ¦ Mechanical Loading – Mounting of the equipment in the rack should be such that a hazardous condition is not achieved due to uneven mechanical loading. ¦ Circuit Overloading – Consideration should be given to the connection of the equipment to the supply circuit and the effect that overloading of the circuits might have on overcurrent protection and supply wiring. Appropriate consideration of equipment nameplate ratings should be used when addressing this concern. ¦ Reliable Earthing – Reliable earthing of rack-mounted equipment should be maintained. Particular attention should be given to supply connections other than direct connections to the branch circuit (for example, use of power strips). Caution – Slide/rail mounted equipment must not be used as a shelf or workspace. Rack System Warning The following warnings apply to Racks and Rack Mounted systems. Caution – For safety, equipment should always be loaded from the bottom up. That is, install the equipment that will be mounted in the lowest part of the rack first, then the next higher systems, etc. Caution – To prevent the rack from tipping during equipment installation, the anti-tilt bar on the rack must be deployed. Caution – To prevent extreme operating temperature within the rack insure that the maximum temperature does not exceed the product’s ambient rated temperatures. Caution – To prevent extreme operating temperatures due to reduced airflow consideration should be made to the amount of air flow that is required for a safe operation of the equipment.Safety Agency Compliance Statements 9 Caution – Take adequate precautions when moving a rack or library that contains rack-installed equipment. The weight of some rack equipment may have altered the rack or library center of gravity and could cause an overbalance/tip condition during a move. Caution – For tape libraries, ensure that the equipment to be installed in the rack has UL Listing, CSA or C-UL Certification, and is CE marked. Laser Compliance Notice Your Oracle or Sun product may contain Class 1M Laser Transceivers. Caution – Class 1M laser radiation when open. Do not view directly with optical instruments. CD and DVD Devices The following caution applies to CD, DVD, and other optical devices. Caution – Use of controls, adjustments, or the performance of procedures other than those specified herein may result in hazardous radiation exposure.10 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Conformité aux normes de sécurité Veuillez lire attentivement cette section avant de commencer. Ce texte traite des mesures de sécurité qu’il convient de prendre pour l’installation d’un produit Sun. Mesures de sécurité Pour votre sécurité, nous vous recommandons de suivre scrupuleusement les mesures de sécurité ci-dessous lorsque vous installez votre matériel: ¦ Suivez tous les avertissements et toutes les instructions inscrites sur le matériel. ¦ Assurez-vous que la tension et la fréquence de votre source d'alimentation correspondent à la tension et à la fréquence indiquées sur l'étiquette de la tension électrique nominale du matériel ¦ N'introduisez jamais d'objets quels qu'ils soient dans les ouvertures de l'équipement. Vous pourriez vous trouver en présence de hautes tensions dangereuses. Tout objet étranger conducteur risque de produire un court-circuit pouvant présenter un risque d'incendie ou de décharge électrique, ou susceptible d'endommager le matériel. ¦ Ce produit est destiné à être utilisé dans des zones à accès limité, dans lesquelles les accès sont contrôlés au moyen de systèmes de sécurité (par exemple, à clé, verrou, dispositif ou badge). Le personnel autorisé à accéder à ces zones doit avoir été préalablement informé des raisons justifiant la limitation des accès et de toutes les précautions à prendre. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symboles Vous trouverez ci-dessous la signification des différents symboles utilisés: Attention – Vous risquez d'endommager le matériel ou de vous blesser. Veuillez suivre les instructions. Attention – Surfaces brûlantes. Evitez tout contact. Les surfaces sont brûlantes. Vous risquez de vous blesser si vous les touchez. Attention – Tensions dangereuses. Pour réduire les risques de décharge électrique et de danger physique, observez les consignes indiquées. Selon le type d'interrupteur marche/arrêt dont votre appareil est équipé, l'un des symboles suivants sera utilisé:Safety Agency Compliance Statements 11 Marche – Met le système sous tension alternative. Arret – Met le système hors tension alternative. Veilleuse – L'interrupteur Marche/Veille est sur la position de veille. Modification du matériel N'apportez aucune modification mécanique ou électrique au matériel. Oracle décline toute responsabilité quant à la non-conformité éventuelle d'un produit Sun modifié. Positionnement d’un produit Sun Attention – Evitez d'obstruer ou de recouvrir les orifices de votre produit Sun. N'installez jamais un produit Sun près d'un radiateur ou d'une source de chaleur. Si vous ne respectez pas ces consignes, votre produit Sun risque de surchauffer et son fonctionnement en sera altéré. Niveau de pression acoustique Produit : SPARC T4-1B server module Conformément à la norme ISO 7779, le niveau sonore de ce produit sur le lieu de travail est inférieur à 70 db(A). Conformité SELV Le niveau de sécurité des connexions E/S est conforme aux normes SELV. Connexion du cordon d’alimentation Attention – Les produits Sun sont conçus pour fonctionner avec des systèmes d'alimentation équipés d'un conducteur neutre relié à la terre (conducteur neutre pour produits alimentés en CC). Pour réduire les risques de décharge électrique, ne branchez jamais les produits Sun sur une source d'alimentation d'un autre type. Contactez le gérant de votre bâtiment ou un électricien agréé si vous avez le moindre doute quant au type d'alimentation fourni dans votre bâtiment. Attention – Tous les cordons d'alimentation ne présentent pas les mêmes caractéristiques électriques. Les cordons d'alimentation à usage domestique ne sont pas protégés contre les surtensions et ne sont pas conçus pour être utilisés avec des ordinateurs. N'utilisez jamais de cordon d'alimentation à usage domestique avec les produits Sun. L'avertissement suivant s'applique uniquement aux systèmes équipés d'un interrupteur Veille:12 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Attention – L'interrupteur d'alimentation de ce produit fonctionne uniquement comme un dispositif de mise en veille. Le cordon d'alimentation constitue le moyen principal de déconnexion de l'alimentation pour le système. Assurez-vous de le brancher dans une prise d'alimentation mise à la terre près du système et facile d'accès. Ne le branchez pas lorsque l'alimentation électrique ne se trouve pas dans le châssis du système. L'avertissement suivant s'applique uniquement aux systèmes équipés de plusieurs cordons d'alimentation: Attention – Pour mettre un système équipé de plusieurs cordons d'alimentation hors tension, il est nécessaire de débrancher tous les cordons d'alimentation. Mise en garde relative aux batteries Attention – Les batteries risquent d’exploser en cas de manipulation maladroite ou de remplacement incorrect. Pour les systèmes dont les batteries sont remplaçables, effectuez les remplacements uniquement selon le modèle du fabricant ou un modèle équivalent recommandé par le fabricant, conformément aux instructions fournies dans le manuel de service du système. N’essayez en aucun cas de démonter les batteries, ni de les recharger hors du système. Ne les jetez pas au feu. Mettez-les au rebut selon les instructions du fabricant et conformément à la législation locale en vigueur. Notez que sur les cartes processeur de Sun, une batterie au lithium a été moulée dans l'horloge temps réel. Les batteries ne sont pas des pièces remplaçables par le client. Avertissement - Module de stockage d’énergie Attention – Si vous manipulez ou remplacez les modules de stockage d’énergie incorrectement, vous risquez de les endommager ou de vous exposer à un choc électrique. Remplacez les modules de stockage d’énergie uniquement par les modules de remplacement que Oracle fournit, en veillant à respecter les instructions indiquées dans le manuel d’entretien du produit. Ne démontez pas les modules. N’essayez pas de les recharger hors du système. Ne jetez pas les modules, mais retournezles à Oracle conformément aux procédures Oracle relatives au produit. Couvercle de l'unité Pour ajouter des cartes, de la mémoire ou des périphériques de stockage internes, vous devez retirer le couvercle de votre système Sun. Remettez le couvercle supérieur en place avant de mettre votre système sous tension. Attention – Ne mettez jamais des produits Sun sous tension si leur couvercle supérieur n'est pas mis en place. Si vous ne prenez pas ces précautions, vous risquez de vous blesser ou d'endommager le système.Safety Agency Compliance Statements 13 Instructions de montage en rack Les instructions de montage en rack suivantes ou similaires à celles-ci sont fournies avec les instructions d'installation : ¦ Température ambiante de fonctionnement élevée : en cas d'installation dans un châssis fermé ou contenant plusieurs appareils, la température ambiante de fonctionnement au niveau du rack peut être supérieure à la température ambiante de la pièce. En conséquence, il convient de veiller à installer le matériel dans un environnement compatible avec la température ambiante maximale (Tma), spécifiée par le fabricant. ¦ Débit d'air réduit : l'installation du matériel dans un rack doit être effectuée de façon à ne pas compromettre le débit d'air nécessaire pour un fonctionnement sûr de ce matériel. ¦ Charge mécanique : le montage de l'équipement en rack doit être réalisé de manière à éviter toute situation dangereuse résultant d'une charge déséquilibrée. ¦ Surcharge de circuit : il convient de prendre les précautions nécessaires pour la connexion du matériel au circuit d'alimentation et de réfléchir aux conséquences d'une éventuelle surcharge des circuits sur la protection de surintensité et sur le câblage d'alimentation. En l'occurrence, les valeurs nominales de la plaque signalétique du matériel doivent être prises en compte. ¦ Mise à la terre fiable : une mise à la terre fiable du matériel monté en rack doit être assurée. Une attention toute particulière est requise pour les raccordements d'alimentation autres que ceux effectués directement sur le circuit principal (par exemple, en cas d'utilisation de blocs multiprises). Attention – L’équipement monté sur glissière/rail ne doit servir ni d’étagère ni d’espace de travail. Mise en garde relative au système en rack La mise en garde suivante s'applique aux racks et aux systèmes montés en rack. Attention – Pour des raisons de sécurité, le matériel doit toujours être chargé du bas vers le haut. En d'autres termes, vous devez installer, en premier, le matériel qui doit se trouver dans la partie la plus inférieure du rack, puis installer le matériel sur le niveau suivant, etc. Attention – Afin d'éviter que le rack ne penche pendant l'installation du matériel, tirez la barre antibasculement du rack. Attention – Pour éviter des températures de fonctionnement extrêmes dans le rack, assurez-vous que la température maximale ne dépasse pas la fourchette de températures ambiantes du produit déterminée par le fabricant.14 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Attention – Afin d'empêcher des températures de fonctionnement extrêmes provoquées par une aération insuffisante, assurez-vous de fournir une aération appropriée pour un fonctionnement du matériel en toute sécurité. Attention – Prenez les précautions adéquates pour déplacer un rack ou une bibliothèque qui contient du matériel installé en rack. Le poids de certains équipements en rack ayant pu modifier le centre de gravité du rack ou de la bibliothèque pourrait provoquer un effet de contrepoids ou de déséquilibre durant le déplacement. Attention – Pour les bibliothèques de bandes, vérifiez que le matériel à installer dans le rack est homologué UL, CSA ou C-UL, et porte la mention CE. Avis de conformité des appareils laser Your Oracle or Sun product may contain Class 1M Laser Transceivers. Attention – Rayonnement laser de classe 1M à l’ouverture. Ne pas regarder directement à l’aide d’instruments optiques. Périphériques CD et DVD L'avertissement suivant s'applique aux périphériques CD, DVD et autres périphériques optiques: Attention – L'utilisation de contrôles et de réglages ou l'application de procédures autres que ceux spécifiés dans le présent document peuvent entraîner une exposition à des radiations dangereuses.Safety Agency Compliance Statements 15 Einhaltung sicherheitsbehördlicher Vorschriften Lesen Sie vor dem Ausführen von Arbeiten diesen Abschnitt. Im folgenden Text werden Sicherheitsvor-kehrungen beschrieben, die Sie bei der Installation eines Sun-Produkts beachten müssen. Sicherheitsvorkehrungen Treffen Sie zu Ihrem eigenen Schutz bei der Installation des Geräts die folgenden Sicherheitsvorkehrungen: ¦ Beachten Sie alle auf den Geräten angebrachten Warnhinweise und Anweisungen. ¦ Stellen Sie sicher, dass Spannung und Frequenz der Stromversorgung den Nennleistungen auf dem am Gerät angebrachten Etikett entsprechen. ¦ Führen Sie niemals Fremdobjekte in die Öffnungen am Gerät ein. Es können gefährliche Spannungen anliegen. Leitfähige Fremdobjekte können einen Kurzschluss verursachen, der einen Brand, Strom-schlag oder Geräteschaden herbeiführen kann. ¦ Dieses Produkt unterliegt Zugangsbeschränkungen. Der Zugang wird mithilfe eines Sicherheitsmechanismus kontrolliert (z. B. einem Schlüssel, einer Sperre, einem Tool oder eines Werksausweises) und das autorisierte Zugangspersonal wurde über die Gründe für die Beschränkungen und die zu treffenden Sicherheitsmaßnahmen unterrichtet. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Symbole Die Symbole in diesem Handbuch haben folgende Bedeutung: Achtung – Gefahr von Verletzung und Geräteschaden. Befolgen Sie die Anwei-sungen. Achtung – Heiße Oberfläche. Nicht berühren, da Verletzungsgefahr durch heiße Oberfläche besteht. Achtung – Gefährliche Spannungen. Befolgen Sie die Anweisungen, um Stromschläge und Verletzungen zu vermeiden. Je nach Netzschaltertyp an Ihrem Gerät kann eines der folgenden Symbole verwendet werden: Ein – Versorgt das System mit Wechselstrom. Aus– Unterbricht die Wechselstromzufuhr zum Gerät.16 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Wartezustand – Der Ein-/Standby-Netz-schalter befindet sich in der Standby-Position. Modifikationen des Geräts Nehmen Sie keine elektrischen oder mechanischen Gerätemodifikationen vor. Oracle ist für die Einhaltung der Sicherheitsvorschriften von modifizierten Sun-Produkten nicht haftbar. Aufstellung von Sun-Geräten Achtung – Geräteöffnungen Ihres Sun-Produkts dürfen nicht blockiert oder abgedeckt werden. SunGeräte sollten niemals in der Nähe von Heizkörpern oder Heißluft-klappen aufgestellt werden. Die Nichtbeach-tung dieser Richtlinien kann Überhitzung verursachen und die Zuverlässigkeit Ihres Sun-Geräts beeinträchtigen. Lautstärke Produkt: SPARC T4-1B server module Gemäß den Vorgaben in der Norm ISO 7779 beträgt der Geräuschpegel dieses Geräts in Abhängigkeit vom Arbeitsplatz unter 70 db(A). SELV-Konformität Der Sicherheitsstatus der E/A-Verbindungen entspricht den SELV-Anforderungen. Anschluss des Netzkabels Achtung – Sun-Geräte sind für Stromversorgungssysteme mit einem geerdeten neutralen Leiter (geerdeter Rückleiter bei gleichstrombetriebenen Geräten) ausgelegt. Um die Gefahr von Stromschlägen zu vermeiden, schließen Sie das Gerät niemals an andere Stromversor-gungssysteme an. Wenden Sie sich an den zuständigen Gebäudeverwalter oder an einen qualifizierten Elektriker, wenn Sie nicht sicher wissen, an welche Art von Stromversor-gungssystem Ihr Gebäude angeschlossen ist. Achtung – Nicht alle Netzkabel verfügen über die gleichen Nennwerte. Herkömmliche, im Haushalt verwendete Verlängerungskabel besitzen keinen Überlastschutz und sind daher für Computersysteme nicht geeignet. Verwenden Sie bei Ihrem Sun-Produkt keine HaushaltsVerlängerungskabel. Die folgende Warnung gilt nur für Geräte mit Standby-Netzschalter:Safety Agency Compliance Statements 17 Achtung – Beim Netzschalter dieses Geräts handelt es sich nur um einen Ein/Standby-Schalter. Zum völligen Abtrennen des Systems von der Stromversorgung dient hauptsächlich das Netzkabel. Stellen Sie sicher, dass das Netzkabel an eine frei zugängliche geerdete Steckdose in der Nähe des Systems ange-schlossen ist. Schließen Sie das Stromkabel nicht an, wenn die Stromversorgung vom Systemchassis entfernt wurde. Die folgende Warnung gilt nur für Geräte mit mehreren Netzkabeln: Achtung – Bei Produkten mit mehreren Netz-kabeln müssen alle Netzkabel abgetrennt wer-den, um das System völlig von der Stromver-sorgung zu trennen. Warnung bezüglich Batterien Achtung – Bei unsachgemäßer Handhabung oder nicht fachgerechtem Austausch der Batterien besteht Explosionsgefahr. Verwen-den Sie bei Systemen mit austauschbaren Batterien ausschließlich Ersatzbatterien desselben Typs und Herstellers bzw. einen entsprechenden, vom Hersteller gemäß den Anweisungen im Service-Handbuch des Produkts empfohlenen Batterietyp. Versuchen Sie nicht, die Batterien auszubauen oder außerhalb des Systems wiederaufzuladen. Werfen Sie die Batterien nicht ins Feuer. Entsorgen Sie die Batterien entsprechend den Anweisungen des Herstellers und den vor Ort geltenden Vorschriften. CPU-Karten von Sun verfügen über eine Echtzeituhr mit integrier-ter Lithiumbatterie. Diese Batterie darf nur von einem qualifizierten Servicetechniker aus-gewechselt werden. Sicherheitshinweise zum Energiespeichermodul Achtung – Bei unsachgemäßer Handhabung oder unsachgemäßem Austausch von Energiespeichermodulen besteht die Gefahr eines Stromschlags oder Geräteschadens. Verwenden Sie beim Austausch von Energiespeichermodulen nur Ersatzmodule, die von Oracle bereitgestellt wurden, und folgen Sie den im Service Manual zum Produkt enthaltenen Anweisungen. Versuchen Sie auf keinen Fall, Module auszubauen oder diese außerhalb des Systems wiederaufzuladen. Entsorgen Sie die Module bitte nicht. Geben Sie sie stattdessen an Oracle gemäß den OracleVerfahren für das Produkt zurück. Gehäuseabdeckung Sie müssen die Abdeckung Ihres Sun-Computersystems entfernen, um Karten, Speicher oder interne Speichergeräte hinzuzufügen. Bringen Sie vor dem Einschalten des Systems die Gehäuseabdeckung wieder an.18 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Achtung – Nehmen Sie Sun-Geräte nicht ohne Abdeckung in Betrieb. Die Nichtbeachtung dieses Warnhinweises kann Verletzungen oder Geräteschaden zur Folge haben. Anweisungen zur Rack-Montage Die folgenden oder ähnlichen Anweisungen zur Rack-Montage wurden in die Installationsanweisungen aufgenommen: ¦ Erhöhte Betriebsumgebungstemperatur - Wenn das Rack in einer geschlossenen Rack-Baugruppe oder in einer Multi-unit-Rack-Baugruppe installiert ist, kann die Betriebsumgebungstemperatur der RackUmgebung höher sein als die Umgebungstemperatur des Raumes. Deshalb sollte berücksichtigt werden, das Gerät in einer Umgebung zu installieren, die kompatibel zu der vom Hersteller angegebenen maximalen Umgebungstemperatur (Tma) ist. ¦ Reduzierter Luftstrom - Die Installation des Geräts in einem Rack sollte so erfolgen, dass die Luftstrommenge, die für den sicheren Betrieb des Geräts erforderlich ist, nicht beeinträchtigt wird. ¦ Mechanische Belastung - Die Montage des Geräts im Rack sollte so erfolgen, dass bei einer ungleichmäßigen mechanischen Belastung keine gefährliche Betriebsbedingung entstehen kann. ¦ Stromkreisüberlastung - Der Anschluss des Geräts an den Speisestromkreis und die Wirkung, die ein Überlasten der Stromkreise auf das Überstromschutz-Gerät und die Speisestromkreisverkabelung haben kann, sollten sorgfältig geprüft und berücksichtigt werden. Beim Behandeln dieses Aspekts sollten besonders die Lastangaben auf dem Leistungsschild des Geräts sorgfältig geprüft werden. ¦ Zuverlässige Erdung - Ausrüstung, die in Racks montiert ist, muss zuverlässig geerdet sein. Besonders müssen hierbei die Stromanschluss-leitungen und weniger die direkten Verbindungen zum Abzweigstromkreis beachtet werden (z. B. durch die Verwendung von Adapterleisten). Achtung – Verwenden Sie Geräte in Steckplätzen bzw. auf Schienen nicht als Regal oder Arbeitsbereich. Warnungen bezüglich in Racks eingebauter Systeme Die folgenden Warnungen gelten für Racks und in Racks eingebaute Systeme: Achtung – Aus Sicherheitsgründen sollten sämtliche Geräte von unten nach oben in Racks eingebaut werden. Installieren Sie also zuerst die Geräte, die an der untersten Position im Rack eingebaut werden, gefolgt von den Systemen, die an nächsthöherer Stelle eingebaut werden, usw. Achtung – Verwenden Sie beim Einbau den Kippschutz am Rack, um ein Umkippen zu vermeiden.Safety Agency Compliance Statements 19 Achtung – Um extreme Betriebstemperaturen im Rack zu vermeiden, stellen Sie sicher, dass die Maximaltemperatur die Nennleistung der Umgebungstemperatur für das Produkt nicht überschreitet Achtung – Um extreme Betriebstemperaturen durch verringerte Luftzirkulation zu vermei-den, sollte die für den sicheren Betrieb des Geräts erforderliche Luftzirkulation eingesetzt werden. Achtung – Treffen Sie ausreichende Vorkehrungen, wenn Sie ein Rack oder eine Bibliothek bewegen, die rackmontierte Geräte enthält. Durch das Gewicht mancher Ausrüstungsteile im Rack wurde möglicherweise der Schwerpunkt des Racks bzw. der Bibliothek verändert, was zu einem Ungleichgewicht bzw. Umkippen eines Ausrüstungsteils während einer Bewegung führen kann. Achtung – Stellen Sie bei Bandbibliotheken sicher, dass auf den im Rack zu installierenden Geräten das UL-Prüfzeichen, die CSA- bzw C-UL-Zertifizierung, und die CE-Kennzeichnung angebracht sind. Hinweis zur Laser-Konformität Your Oracle or Sun product may contain Class 1M Laser Transceivers. Achtung – In geöffnetem Zustand Laser-Strahlung der Klasse 1M. Nicht mit optischen Instrumenten direkt in den Strahl schauen. CD- und DVD-Geräte Die folgende Warnung gilt für CD-, DVD- und andere optische Geräte: Achtung – Die hier nicht aufgeführte Verwendung von Steuerelementen, Anpassungen oder Ausführung von Vorgängen kann eine gefährliche Strahlenbelastung verursachen.20 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Dichiarazioni di conformità alle norme di sicurezza Leggere la presente sezione prima di iniziare qualsiasi procedura. Il seguente testo descrive le misure precauzionali da adottare durante l'installazione dei prodotti Sun. Misure precauzionali Osservare le seguenti misure precauzionali durante l'installazione dell'apparecchiatura: ¦ Seguire tutte le avvertenze e le istruzioni riportate sull'apparecchiatura. ¦ Verificare che la tensione e la frequenza della sorgente di alimentazione corrispondano ai valori di tensione e frequenza riportati sull'apposita targhetta dell'apparecchiatura. ¦ Non inserire mai oggetti di alcun tipo nelle aperture dell'apparecchiatura. I componenti interni possono essere attraversati da corrente ad alta tensione. I corpi estranei di materiale conduttore possono produrre un corto circuito e provocare incendi, scosse elettriche o danni all'apparecchiatura. ¦ L'accesso al presente prodotto deve essere limitato attraverso l'impiego di misure di sicurezza (tramite chiave, blocco, uso di attrezzi o di tesserini distintivi) e il personale autorizzato all'accesso deve essere informato delle ragioni alla base delle restrizioni e delle precauzioni necessarie. ¦ Non collegare direttamente il prodotto a cavi di comunicazione metallici esterni. Per il collegamento del prodotto a cavi di comunicazione metallici esterni, utilizzare sempre un dispositivo di protezione atto a tale scopo, quale un interruttore o un router. In alternativa, utilizzare cavi di comunicazione ottici non metallici in uscita dall'edificio. ¦ Non collegare direttamente il prodotto a cavi di alimentazione esterni. ¦ Per l'alimentazione CA, collegare il prodotto esclusivamente a un sistema di distribuzione dell'alimentazione interno che utilizzi appositi interruttori differenziali a limitazione di corrente. ¦ Per l'alimentazione CC, collegare il prodotto esclusivamente a sistemi di alimentazione dotati di messa a terra e che siano circoscritti al singolo edificio. Simboli In questo documento possono essere riportati i seguenti simboli: Attenzione – Rischio di danni alle persone o alle apparecchiature. Seguire le istruzioni. Attenzione – Superficie molto calda. Evitare il contatto. Le superfici sono molto calde e, in caso di contatto, possono provocare ustioni. Attenzione – Componenti attraversati da alta tensione. Per ridurre il rischio di scosse elettriche e per garantire l'incolumità personale, attenersi alle istruzioni. A seconda del tipo di interruttore di alimentazione presente sul dispositivo, potrebbe essere utilizzato uno dei seguenti simboli: Acceso – Applica al sistema la corrente alternata.Safety Agency Compliance Statements 21 Spento – Interrompe il flusso di corrente alternata al sistema. Standby – L'interruttore di accensione/standby è in posizione di attesa. Modifiche all'apparecchiatura Non modificare i componenti elettrici o meccanici dell'apparecchiatura. Oracle non sarà responsabile della conformità ai regolamenti di un prodotto Sun modificato. Collocazione dei prodotti Sun Attenzione – Non ostruire o coprire le prese d'aria del prodotto Sun. Non posizionare il prodotto Sun accanto a caloriferi o altre fonti di calore. La mancata osservanza delle presenti linee guida può causare il surriscaldamento del prodotto Sun, compromettendone l'affidabilità. Livello di rumore Prodotto: SPARC T4-1B server module In conformità ai requisiti definiti nella normativa ISO 7779, il livello di rumore prodotto nell'ambiente di lavoro dal presente apparecchio è inferiore a 70 db (A). Conformità SELV Lo stato di sicurezza dei collegamenti I/O è conforme ai requisiti della normativa SELV. Collegamento del cavo di alimentazione Attenzione – I prodotti Sun sono progettati per operare con sistemi di alimentazione dotati di un conduttore neutro con messa a terra (ritorno attraverso la terra per i prodotti alimentati a corrente continua). Per ridurre il rischio di scosse elettriche, non collegare i prodotti Sun a sistemi di alimentazione di tipo diverso. In caso di dubbi sul tipo di rete elettrica utilizzata nell'edificio, contattare un responsabile della struttura o un elettricista qualificato. Attenzione – Non tutti i cavi di alimentazione supportano gli stessi valori di corrente. Non utilizzare il cavo di alimentazione fornito con l'apparecchiatura per altri prodotti o impieghi. Le prolunghe per uso domestico sono prive di protezione contro il sovraccarico di corrente e non sono destinate all'uso con i computer. Non utilizzare prolunghe per uso domestico con il prodotto Sun.22 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 L'avvertenza seguente si applica solo ai dispositivi dotati di interruttore di alimentazione con funzione di standby: Attenzione – L'interruttore di alimentazione del presente prodotto funziona solo come dispositivo di standby. Il cavo di alimentazione agisce da dispositivo di disconnessione primario del sistema. Collegare sempre il cavo di alimentazione a una presa di corrente con messa a terra situata in prossimità del sistema e facilmente accessibile. Non collegare il cavo di alimentazione quando l'alimentatore è stato rimosso dallo chassis. L'avvertenza seguente si applica solo ai dispositivi con più cavi di alimentazione: Attenzione – Per i prodotti con più di un cavo di alimentazione, è necessario disconnettere tutti i cavi per interrompere il flusso di corrente elettrica al sistema. Avviso relativo alle batterie Attenzione – Se maneggiate o sostituite in modo non corretto, le batterie possono dare luogo a esplosioni. Nei sistemi con batterie sostituibili, utilizzare solo batterie dello stesso produttore e tipo o di tipo equivalente consigliate dal produttore, come da istruzioni fornite nel manuale di manutenzione del prodotto. Non disassemblare o tentare di ricaricare le batterie all'esterno del sistema. Non gettare le batterie nel fuoco. Attenersi alle istruzioni del produttore e alle normative locali per lo smaltimento delle batterie. Le schede CPU Sun sono dotate di batteria al litio integrata nel clock di tempo reale. Questo tipo di batterie non è sostituibile da parte dell'utente. Avvertenza relativa al modulo di alimentazione Attenzione – Se maneggiati o sostituiti in modo non corretto, i moduli di alimentazione possono causare scosse elettriche e danni alle apparecchiature. Per la sostituzione dei moduli di alimentazione, utilizzare solo moduli sostitutivi forniti da Oracle e seguire le istruzioni disponibili nel manuale del prodotto. Non disassemblare o tentare di ricaricare i moduli all'esterno del sistema. Non smaltire i moduli. Restituirli a Oracle in base alle procedure Oracle relative al prodotto. Copertura dell'unità centrale È necessario rimuovere la copertura dell'unità centrale Sun per aggiungere schede, memoria o dispositivi di memorizzazione interni. Riapplicare sempre la copertura prima di accendere il computer. Attenzione – Non utilizzare mai i prodotti Sun senza l'apposita copertura. La mancata osservanza di questa precauzione può causare danni alle persone o al sistema.Safety Agency Compliance Statements 23 Istruzioni relative ai sistemi rack Le seguenti istruzioni (o istruzioni di natura simile) relative alle unità installabili in rack sono incluse nelle istruzioni per l'installazione. ¦ Ambiente di esercizio sopraelevato – Se l'installazione viene eseguita in un assembly composto da più unità in rack, la temperatura di esercizio dell'ambiente rack può essere superiore a quella del locale. È pertanto necessario installare l'apparecchiatura in ambienti compatibili con i requisiti di temperatura ambientale massima (Tma) specificati dal produttore. ¦ Riduzione del flusso d'aria – L'installazione dell'apparecchiatura in rack deve avvenire in modo da non ostruire il flusso d'aria necessario al corretto funzionamento dell'apparecchiatura. ¦ Carico meccanico – L'installazione dell'apparecchiatura in rack deve essere effettuata in modo da evitare condizioni di pericolo dovute a carichi meccanici non uniformi. ¦ Sovraccarico dei circuiti – È necessario prestare attenzione ai collegamenti dell'apparecchiatura al circuito di alimentazione e agli effetti di eventuali sovraccarichi del circuito sulla protezione contro la sovracorrente e sui cavi di alimentazione. Tenere in considerazione i valori di classificazione riportati sulle etichette delle apparecchiature durante questa fase dell'installazione. ¦ Affidabilità della messa a terra – È necessario mantenere un livello di affidabilità adeguato della messa a terra per le apparecchiature installate in rack. Prestare particolare attenzione alle connessioni di alimentazione diverse dai collegamenti diretti al circuito derivato (ad esempio, quando si utilizzano strisce di alimentazione). Attenzione – L'apparecchiatura con montaggio su guide di scorrimento non deve essere utilizzata come piano di appoggio o area di lavoro. Avviso relativo ai sistemi rack Le avvertenze seguenti si applicano ai sistemi rack o installati in rack. Attenzione – Per motivi di sicurezza, è opportuno caricare sempre le apparecchiature dal basso verso l'alto, ovvero installare prima le apparecchiature da collocare nella parte inferiore del rack e procedere quindi verso l'alto per l'installazione dei sistemi successivi. Attenzione – Per impedire l'inclinazione delle apparecchiature durante l'installazione, utilizzare la barra antipendenza. Attenzione – Per evitare temperature di esercizio estreme all'interno del rack, verificare che la temperatura massima non superi il limite imposto per l'ambiente di utilizzo del prodotto.24 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Attenzione – Per evitare temperature di esercizio estreme dovute a riduzioni del flusso d'aria, è necessario prestare attenzione alla quantità d'aria necessaria all'utilizzo sicuro dell'apparecchiatura. Attenzione – Per spostare un rack o una libreria che contiene apparecchiatura montata in rack, adottare le precauzioni necessarie. Il peso di alcune apparecchiature su rack potrebbe aver modificato il centro di gravità della libreria o del rack e potrebbe causare uno sbilanciamento o una condizione di pericolo durante lo spostamento. Attenzione – Per le librerie a nastro, verificare che l'apparecchiatura da installare nel rack disponga di una certificazione UL, CSA o C-UL e che sia dotata di marchio CE. Conformità alle certificazioni laser Il prodotto Oracle o Sun potrebbe contenere ricetrasmettitori laser di classe 1M. Attenzione – Se aperto, emette radiazioni laser di classe 1M. Evitare la visualizzazione diretta con strumenti ottici. CD e DVD L'avvertenza seguente si applica a CD, DVD e altri dispositivi ottici. Attenzione – L'uso di controlli, regolazioni o l'esecuzione di procedure diverse da quelle qui specificate può causare l'esposizione a radiazioni nocive.Safety Agency Compliance Statements 25 Normas de Conformidade da Agência de Segurança Leia esta seção antes de começar qualquer procedimento. Este texto traz medidas de segurança que devem ser adotadas na instalação do produto Sun. Medidas de segurança Para sua proteção, siga as medidas de segurança a seguir para instalar seu equipamento. ¦ Tome todas as precauções e siga todas as instruções indicadas no equipamento. ¦ Verifique se a tensão e a frequência de sua fonte de alimentação são iguais à tensão e à frequência descritas na etiqueta de classificação elétrica do equipamento. ¦ Jamais insira qualquer tipo de objeto nas aberturas do equipamento. Pode haver tensões perigosas. Objetos estranhos, condutores de eletricidade, podem provocar curto circuito, causando incêndio, choque elétrico ou danos em seu equipamento. ¦ O acesso a este produto deve ser restrito e controlado por dispositivos de segurança (por exemplo: chave, trava, ferramenta, autorização por crachá eletrônico), e o pessoal com acesso autorizado deve estar ciente dos motivos das restrições e tomar todas as precauções necessárias. ¦ Não conecte este produto diretamente a cabos metálicos de comunicação instalados ao ar livre. Para conectar o produto a cabos metálicos de comunicação instalados ao ar livre, sempre utilize um dispositivo de proteção próprio para conexões diretas a esses tipos de cabos (um interruptor ou um roteador) ou utilize cabos óticos não metálicos para comunicação na parte externa da área edificada. ¦ Não conecte este produto diretamente a cabos elétricos instalados ao ar livre. ¦ No caso de corrente alternada, conecte o produto somente a um sistema interno de distribuição de energia elétrica que utilize disjuntores limitadores próprios para corrente alternada. ¦ No caso de corrente direta, conecte o produto somente a sistemas elétricos aterrados que estejam totalmente contidos em uma área edificada. Símbolos Estes símbolos constam deste manual: Atenção – Existe risco de lesão física e dano do equipamento. Siga as instruções. Atenção – Superfície quente. Evite o contato. Superfícies quentes que podem provocar queimaduras se tocadas. Atenção – Tensão perigosa. Para evitar choques elétricos e danos à saúde, siga as instruções. Dependendo do tipo de chave de força do seu dispositivo, um destes símbolos pode ser usado. Ligado – Aplica energia AC ao sistema. Desligado – Elimina energia AC do sistema.26 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Standby – A chave Ligar/Standby está na posição standby. Modificações no equipamento Não faça modificações elétricas nem mecânicas no equipamento. A Oracle não se responsabiliza pela conformidade normativa de um produto Sun modificado. Instalação de produto Sun Atenção – Não bloqueie nem cubra qualquer abertura de seu produto Sun. Jamais instale um produto Sun próximo a um radiador ou registro de aquecimento. A não observância dessas orientações pode provocar superaquecimento e afetar a confiabilidade de seu produto Sun. Nível de ruído Produto: SPARC T4-1B server module De acordo com as exigências estabelecidas em ISO 7779, o nível de ruído dependendo do local de operação deste produto deve ficar abaixo de 70 db (A). Conformidade SELV Status de segurança das conexões de entrada/saída e as exigências da SELV. Conexão dos cabos de energia Atenção – Os produtos Sun são produzidos para operar em sistemas de energia com fio neutro aterrado (cabo de retorno aterrado para produtos que operem com energia CC). Para reduzir o risco de choque elétrico, não conecte os produtos Sun a qualquer outro tipo de sistema de energia. Contate o gerente de manutenção ou um eletricista qualificado se você não tiver certeza do tipo de energia elétrica fornecida no seu prédio. Atenção – Nem todos os cabos de força têm a mesma classificação de corrente. Não use o cabo de força fornecido com seu equipamento em qualquer outro produto ou para qualquer outro uso. Os cabos de extensão domésticos não são protegidos contra sobrecargas e não são destinados ao uso em sistemas de computação. Não use cabos de extensão domésticos em seu produto Sun. Estas precauções devem ser observadas apenas em dispositivos com chave de força Standby: Atenção – A chave de força deste produto funciona somente como dispositivo do tipo standby. O cabo de força serve como dispositivo de desconexão primária do sistema. Certifique-se de ligar o cabo de força em tomada com fio neutro aterrado próxima ao sistema e prontamente acessível. Não conecte o cabo de força se o dispositivo de alimentação de energia tiver sido removido do chassi do sistema.Safety Agency Compliance Statements 27 Estas precauções devem ser observadas apenas em dispositivos com vários cabos de força: Atenção – No caso de produtos com vários cabos de força, todos os cabos devem ser desconectados para eliminar totalmente a energia do sistema. Alerta sobre baterias Atenção – As baterias podem explodir se manuseadas ou substituídas incorretamente. Nos sistemas com bateria substituível, substitua a bateria somente por outra do mesmo fabricante ou tipo, ou de tipo equivalente recomendado pelo fabricante, de acordo com as instruções do manual de atendimento ao cliente. Não desmonte a bateria nem tente recarregá-la fora do sistema. Não descarte a bateria no fogo. Descarte as baterias corretamente, de acordo com as instruções do fabricante e as normas locais. Observe que as placas de CPU da Sun têm baterias de lítio moldadas no clock de tempo real. Essas baterias não podem ser substituídas pelo cliente. Atenção – For product installed in California, USA: This product may contain a time-of-day battery which may contain perchlorate where special handling may apply. See http://www.dtsc.ca.gov/hazardouswaste/perchlorate. Aviso do módulo de armazenamento de energia Atenção – Haverá risco de choque ou dano ao equipamento se os módulos de armazenamento de energia forem mal utilizados ou substituídos de forma incorreta. Ao trocar os módulos de armazenamento de energia, use somente módulos de substituição fornecidos pela Oracle, de acordo com as instruções do manual de serviço do produto. Não desmonte os módulos ou tente recarregá- los fora do sistema. Não descarte os módulos; devolva-os para a Oracle de acordo com os procedimentos do produto. Gabinete da unidade do sistema Você deve remover o gabinete da unidade do sistema de computação para inserir placas, memória ou dispositivos internos de armazenamento. Recoloque o gabinete antes de ligar o sistema de computação. Atenção – Não opere os produtos Sun sem o gabinete colocado. A não observância desse procedimento pode resultar em lesões físicas e danos ao sistema. Instruções do sistema de gabinete Estas instruções de montagem de gabinete ou outras similares estão incluídas nas instruções de instalação:28 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 ¦ Temperatura ambiente operacional elevada – Se o equipamento for instalado em gabinete fechado ou gabinete com várias unidades, a temperatura do ambiente operacional pode ficar acima do ambiente da sala. Portanto, deve-se considerar a instalação do equipamento em ambiente compatível com a temperatura ambiente máxima especificada pelo fabricante. ¦ Fluxo de ar reduzido – O equipamento deve ser instalado no gabinete de forma a não comprometer o fluxo de ar necessário para uma operação segura. ¦ Carga mecânica – O equipamento deve ser montado no gabinete de forma a evitar condições de risco decorrentes de carga mecânica irregular. ¦ Circuito sobrecarregado – Deve-se atentar para a conexão do equipamento com o circuito de energia e os possíveis efeitos da sobrecarga na proteção contra corrente excessiva e na fiação de força. Consultar a classificação correta da placa de identificação do equipamento ao tratar dessa questão. ¦ Aterramento confiável – Deve-se manter um aterramento confiável para o equipamento montado em gabinete. Deve-se atentar especificamente para as conexões de energia além das conexões diretas com o circuito de ramal (por exemplo, uso de tiras de força). Atenção – Os equipamentos montados sobre corrediças/trilhos não devem ser utilizados como prateleira ou área de trabalho. Alerta sobre o sistema de gabinete Estes alertas se aplicam aos gabinetes e sistemas montados em gabinetes. Atenção – Por questão de segurança, o equipamento sempre deve ser carregado de baixo para cima. Ou seja, instalar primeiro o equipamento que será montado na parte inferior do gabinete, em seguida, os sistemas das partes superiores e assim por diante. Atenção – Para evitar a inclinação do gabinete durante a instalação do equipamento, usar a barra anti-inclinação. Atenção – Para evitar temperatura operacional excessiva dentro do gabinete, certifique-se de que a temperatura máxima não ultrapasse as temperaturas ambientais estabelecidas para o produto. Atenção – Para evitar temperatura operacional excessiva em virtude do fluxo reduzido de ar, deve-se verificar o fluxo de ar exigido para a operação segura do equipamento.Safety Agency Compliance Statements 29 Atenção – Tome medidas adequadas ao mover um rack ou biblioteca com equipamento instalado em rack. O peso de alguns equipamentos em rack pode alterar o centro de gravidade do rack ou da biblioteca e levar a uma condição de desequilíbrio durante uma movimentação. Atenção – Em bibliotecas de fitas, confirme se o equipamento a ser instalado no rack está na Listagem UL ou tem certificação CSA ou C-UL e se tem a marcação CE. Nota de conformidade para a tecnologia laser Seu produto Oracle ou Sun pode conter Transceivers a Laser Class 1M. Atenção – Há incidência de radiação laser de classe 1M quando aberto. Não olhar diretamente com instrumentos óticos. Dispositivos de CD e DVD Os cuidados a seguir se aplicam a dispositivos de CD, DVD e outros dispositivos óticos. Atenção – O uso de controles, a realização de ajustes ou a adoção de procedimentos não especificados neste documento podem provocar exposição perigosa à radiação.30 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Normativas de seguridad Lea esta sección antes de realizar cualquier operación. En ella se explican las medidas de seguridad que debe tomar al instalar un producto de Sun. Medidas de seguridad Para su protección, tome las medidas de seguridad siguientes durante la instalación del equipo: ¦ Siga todos los avisos e instrucciones indicados en el equipo. ¦ Asegúrese de que el voltaje y frecuencia de la fuente de alimentación coincidan con el voltaje y frecuencia indicados en la etiqueta de clasificación eléctrica del equipo. ¦ No introduzca objetos de ningún tipo por las rejillas del equipo, ya que puede quedar expuesto a voltajes peligrosos. Los objetos conductores extraños pueden producir cortocircuitos y, en consecuencia, incendios, descargas eléctricas o daños en el equipo. ¦ Este producto se ha concebido para un acceso restringido y, por tanto, éste se controla mediante mecanismos de seguridad (p. ej., acceso con clave, bloqueo, herramienta y tarjeta de identificación). Las personas con acceso autorizado están al corriente de los motivos de esta restricción y de las precauciones que se deben tomar. ¦ Do not directly connect this product to outdoor metallic communications cables. Always connect the product to outdoor metallic communications cables using a protection device that is designed for direct connectionto outdoor metallic communications cables (such as a switch or router), or use optical non-metallic communications cables upon leaving the building. ¦ Do not directly connect this product to outdoor power cables. ¦ For AC Power, connect the product only to an indoor power distribution system that uses currentlimiting circuit breakers for AC power. ¦ For DC Power, connect the product only to earthed power systems that are completely contained within one building. Símbolos En este documento aparecen los siguientes símbolos: Precaución – Existe el riesgo de que se produzcan lesiones personales y daños en el equipo. Siga las instrucciones. Precaución – Superficie caliente. Evite todo contacto. Las superficies están calientes y pueden causar lesiones personales si se tocan. Precaución – Voltaje peligroso. Para reducir el riesgo de descargas eléctricas y lesiones personales, siga las instrucciones. En función del tipo de interruptor de alimentación del que disponga el dispositivo, se utilizará uno de los símbolos siguientes: Encendido – Suministra alimentación de CA al sistema.Safety Agency Compliance Statements 31 Apagado – Corta la alimentación de CA del sistema. Espera – El interruptor de encendido/espera está en la posición de espera. Modificaciones en el equipo No realice modificaciones de tipo mecánico ni eléctrico en el equipo. Oracle no se hace responsable del cumplimiento de normativas en caso de que un producto Sun se haya modificado. Colocación de un producto Sun Precaución – No obstruya ni tape las rejillas del producto Sun. Nunca coloque un producto Sun cerca de radiadores ni fuentes de calor. Si no sigue estas indicaciones, el producto Sun podría sobrecalentarse y la fiabilidad de su funcionamiento se vería afectada. Nivel de ruido Producto: SPARC T4-1B server module En conformidad con la norma ISO 7779, el nivel de emisión de ruido de este producto en el puesto de trabajo es inferior a los 70 db(A). Cumplimiento de la normativa para instalaciones SELV Las condiciones de seguridad de las conexiones de entrada y salida cumplen los requisitos para instalaciones SELV (del inglés Safe Extra Low Voltage, voltaje bajo y seguro). Conexión del cable de alimentación Precaución – Los productos Sun se han diseñado para funcionar con sistemas de alimentación que cuenten con un conductor neutro a tierra (con conexión a tierra de regreso para los productos con alimentación de CC). Para reducir el riesgo de descargas eléctricas, no conecte ningún producto Sun a otro tipo de sistema de alimentación. Póngase en contacto con el encargado de las instalaciones de su empresa o con un electricista cualificado en caso de que no esté seguro del tipo de alimentación del que se dispone en el edificio. Precaución – No todos los cables de alimentación tienen la misma clasificación eléctrica. Los alargadores de uso doméstico no cuentan con protección frente a sobrecargas y no están diseñados para su utilización con sistemas informáticos. No utilice alargadores de uso doméstico con el producto Sun. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de un interruptor de alimentación de espera:32 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Precaución – El interruptor de alimentación de este producto funciona solamente como un dispositivo de espera. El cable de alimentación hace las veces de dispositivo de desconexión principal del sistema. Asegúrese de que conecta el cable de alimentación a una toma de tierra situada cerca del sistema y de fácil acceso. No conecte el cable de alimentación si la unidad de alimentación no se encuentra en el bastidor del sistema. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de varios cables de alimentación: Precaución – En los productos que cuentan con varios cables de alimentación, debe desconectar todos los cables de alimentación para cortar por completo la alimentación eléctrica del sistema. Advertencia sobre las baterías Precaución – Si las baterías no se manipulan o reemplazan correctamente, se corre el riesgo de que estallen. En los sistemas que cuentan con baterías reemplazables, reemplácelas sólo con baterías del mismo fabricante y el mismo tipo, o un tipo equivalente recomendado por el fabricante, de acuerdo con las instrucciones descritas en el manual de servicio del producto. No desmonte las baterías ni intente recargarlas fuera del sistema. No intente deshacerse de las baterías echándolas al fuego. Deshágase de las baterías correctamente de acuerdo con las instrucciones del fabricante y las normas locales. Tenga en cuenta que en las placas CPU de Sun, hay una batería de litio incorporada en el reloj en tiempo real. Los usuarios no deben reemplazar este tipo de baterías. Advertencia relativa al módulo de almacenamiento de energía Precaución – Existe un peligro de electrocuciones o daños en el equipo si se manipulan o sustituyen incorrectamente los módulos de almacenamiento de energía. Cuando cambie los módulos de almacenamiento de energía, utilice exclusivamente módulos de sustitución que hayan sido suministrados por Oracle, de conformidad con las instrucciones indicadas en el manual de servicio del producto. No desmonte módulos ni intente recargarlos fuera del sistema. No elimine los módulos. En su lugar, devuélvalos a Oracle de conformidad con los procedimientos de Oracle para el producto. Cubierta de la unidad del sistema Debe extraer la cubierta de la unidad del sistema informático Sun para instalar tarjetas, memoria o dispositivos de almacenamiento internos. Vuelva a colocar la cubierta antes de encender el sistema informático. Precaución – No ponga en funcionamiento los productos Sun que no tengan colocada la cubierta. De lo contrario, puede sufrir lesiones personales y ocasionar daños en el sistema.Safety Agency Compliance Statements 33 Instrucciones para el montaje en armario Las siguientes instrucciones de montaje en armario u otras similares se incluyen en las instrucciones de instalación: ¦ Temperatura de funcionamiento elevada - si se instala en un armario cerrado o con más unidades, la temperatura ambiente de funcionamiento del entorno del armario puede ser superior a la de la habitación. Por tanto, el equipo debería instalarse en un entorno compatible con la temperatura ambiente máxima (Tma) especificada por el fabricante. ¦ Flujo de aire reducido - para instalar el equipo en un armario hay que asegurarse de que se mantendrá el flujo de aire necesario para el correcto funcionamiento del equipo. ¦ Carga mecánica - el montaje del equipo en el armario debería realizarse de modo que no se dé una situación de peligro debido a una carga mecánica irregular. ¦ Sobrecarga del circuito - debe prestarse atención a la conexión del equipo al circuito de alimentación y a las consecuencias que puede tener la sobrecarga de los circuitos en la protección de sobrecorriente y el cableado de alimentación. En caso de sobrecarga, es recomendable tener en cuenta la potencia del equipo que aparece en la placa de identificación. ¦ Puesta a tierra fiable - debería mantenerse una puesta a tierra fiable del equipo montado en un armario. Debería prestarse especial atención a las conexiones de suministro que no sean las directas al circuito derivado (p. ej., las regletas de distribución). Precaución – Los equipos instalados por deslizamiento o sobre raíles no deben utilizarse como estantería o espacio de trabajo. Advertencia sobre el sistema en bastidor Las advertencias siguientes se aplican a los sistemas montados en bastidor y a los propios bastidores. Precaución – Por seguridad, siempre deben montarse los equipos de abajo arriba. A saber, primero debe instalarse el equipo que se situará en el bastidor inferior; a continuación, el que se situará en el siguiente nivel, etc. Precaución – Para evitar que el bastidor se vuelque durante la instalación del equipo, debe extenderse la barra antivolcado del bastidor. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema en el bastidor, asegúrese de que la temperatura máxima no sea superior a la temperatura ambiente establecida como adecuada para el producto.34 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema debido a una circulación de aire reducida, debe considerarse la magnitud de la circulación de aire requerida para que el equipo funcione de forma segura. Precaución – Al mover un bastidor o una librería que contiene un equipo instalado en bastidor, tome las precauciones necesarias. El peso de algunos equipos instalados en bastidor puede haber alterado el centro de gravedad de la librería o del bastidor y podría ocasionar pérdida de equilibrio o volcarse durante su traslado. Precaución – Para librerías de cintas, compruebe que el equipo que vaya a instalarse en el bastidor tenga la certificación UL Listing, CSA o C-UL, y la marca CE. Aviso de cumplimiento de la normativa para la utilización de láser Your Oracle or Sun product may contain Class 1M Laser Transceivers. Precaución – Radiación láser Clase 1M si se abre. No mirar directamente con instrumentos ópticos. Dispositivos de CD y DVD La siguiente medida se aplica a los dispositivos de CD y DVD, así como a otros dispositivos ópticos: Precaución – La utilización de controles, ajustes o procedimientos distintos a los aquí especificados puede dar lugar a niveles de radiación peligrosos.Safety Agency Compliance Statements 3536 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 3738 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 3940 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4142 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4344 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4546 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4748 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 4950 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5152 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5354 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 Nordic Lithium Battery Cautions Norge Advarsel – Litiumbatteri — Eksplosjonsfare. Ved utskifting benyttes kun batteri som anbefalt av apparatfabrikanten. Brukt batteri returneres apparatleverandøren. Sverige Varning – Explosionsfara vid felaktigt batteribyte. Använd samma batterityp eller en ekvivalent typ som rekommenderas av apparattillverkaren. Kassera använt batteri enligt fabrikantens instruktion. Danmark Advarsel! – Litiumbatteri — Eksplosionsfare ved fejlagtig håndtering. Udskiftning må kun ske med batteri af samme fabrikat og type. Levér det brugte batteri tilbage til leverandøren. Suomi Varoitus – Paristo voi räjähtää, jos se on virheellisesti asennettu. Vaihda paristo ainoastaan laitevalmistajan suosittelemaan tyyppiin. Hävitä käytetty paristo valmistajan ohjeiden mukaisesti. Nordic Grounded Socket Cautions English Caution – The appliance must be connected to a grounded socket. Norge Advarsel – Apparatet må tilkoples jordet stikkontakt. Sverige Varning – Apparaten skall anslutas till jordat uttag.Safety Agency Compliance Statements 55 Suomi Varoitus – Laite on liitettävä suojamaadoituskoskettimilla varustettuun pistorasiaan.56 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011Safety Agency Compliance Statements 5758 SPARC T4-1B Server Module Safety and Compliance Guide • October 2011 SPARC and Netra SPARC T4 Series Servers Security Guide Part No. E24876-02 December 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents SPARC and Netra SPARC T4 Series Servers Security 1 Understanding Security Principles 1 Planning a Secure Environment 2 Hardware Security 2 Software Security 3 Firmware Security 4 Oracle ILOM Firmware 4 Maintaining a Secure Environment 4 Hardware Controls 4 Asset Tracking 5 Software and Firmware 5 Local and Remote Access 5 Data Security 6 Network Security 6iv SPARC and Netra SPARC T4 Series Servers Security Guide • December 20111 SPARC and Netra SPARC T4 Series Servers Security This document provides general security guidelines for the T4-1, T4-1B, T4-2, and T4-4 servers. This guide is intended to help you ensure security when using these servers with other Oracle hardware products such as network switches and network interface cards. The following sections are in this chapter: ¦ “Understanding Security Principles” on page 1 ¦ “Planning a Secure Environment” on page 2 ¦ “Maintaining a Secure Environment” on page 4 Understanding Security Principles There are four basic security principles: access, authentication, authorization, and accounting. ¦ Access Physical and software controls are necessary to protect your hardware or data from intrusion. ¦ For hardware, access limits usually mean physical access limits. ¦ For software, access is limited through both physical and virtual means. ¦ Firmware cannot be changed except through the Oracle update process. ¦ Authentication All platform operating systems provide authentication features that can be set up to ensure that users are who they say they are. Authentication provides varying degrees of security through measures such as badges and passwords. ¦ Authorization2 SPARC and Netra SPARC T4 Series Servers Security Guide • December 2011 Authorization allows company personnel to work only with hardware and software that they are trained and qualified to use. To this end, system administrators create systems of Read/Write/Execute permissions to control user access to commands, disk space, devices, and applications. ¦ Accounting Oracle software and hardware features allow customer IT to monitor login activity and maintain hardware inventories. ¦ User logins can be monitored through system logs. System Administrator and Service accounts in particular have access to powerful commands and should be carefully monitored through system logs. Logs are typically maintained for a long period, so it is essential to periodically retire log files when they exceed a reasonable size, in accordance with the customer company policy. ¦ Customer IT assets are usually tracked through serial numbers. Oracle part numbers are electronically recorded on all cards, modules, and mother boards, and can be used for inventory purposes. Planning a Secure Environment Use the following notes before and during the installation and configuration of a server and related equipment. Hardware Security Physical hardware can be secured fairly simply: limit access to the hardware and record serial numbers. ¦ Restrict access ¦ Install servers and related equipment in a locked, restricted access room. ¦ If equipment is installed in a rack with a locking door, always lock the rack door until you have to service the components within the rack. ¦ Hot-plug or hot-swap devices are removed easily and especially require restricted accessibility. ¦ Store spare field-replaceable units (FRUs) or customer-replaceable units (CRUs) in a locked cabinet. Restrict access to the locked cabinet to authorized personnel. ¦ Record serial numbers ¦ Security-mark all significant items of computer hardware such as FRUs. Use special ultraviolet pens or embossed labels.SPARC and Netra SPARC T4 Series Servers Security 3 ¦ Keep a record of the serial numbers of all your hardware. ¦ Keep hardware activation keys and licenses in a secure location that is easily accessible to the system manager in system emergencies. The printed documents might be your only proof of ownership. Software Security Most hardware security is implemented through software measures. ¦ When a new system is installed, change all default passwords. Most types of equipment use default passwords, such as changeme, that are widely known and would allow unauthorized access to the equipment. Also, devices such as network switches can have multiple user accounts by default. Be sure to change all account passwords. ¦ Limit use of the root superuser account. Oracle Integrated Lights Out Manager (Oracle ILOM) accounts such as ilom-operator and ilom-admin should be used instead whenever possible. ¦ Use a dedicated network for service processors to separate them from the general network. ¦ Protect access to USB consoles. Devices such as system controllers, power distribution units (PDUs), and network switches can have USB connections, which can provide more powerful access than SSH connections. ¦ Refer to the documentation that came with your software to enable any security features available for the software. ¦ A server can boot securely with WAN Boot or iSCSI Boot. ¦ For an Oracle Solaris 10 release, refer to the Oracle Solaris Installation Guide: Network-Based Installations book ¦ For an Oracle Solaris 11 release, refer to the Installing Oracle Solaris 11 Systems book for WAN Boot information and the System Administration Guide: Basic Administration book for iSCSI boot information. The Oracle Solaris Security Guidelines document provides information on: ¦ How to harden Oracle Solaris ¦ How to use Oracle Solaris security features when configuring your systems ¦ How to operate securely when you add applications and users to a system ¦ How to protect network-based applications Oracle Solaris Security Guidelines documents can be found at: ¦ http://www.oracle.com/technetwork/indexes/documentation/index.h tml#sys_sw4 SPARC and Netra SPARC T4 Series Servers Security Guide • December 2011 Firmware Security Ordinary user accounts cannot edit the OpenBoot PROM (OBP) or other Oracle firmware. The Oracle Solaris Operating System uses a controlled firmware update process to prevent unauthorized firmware modifications. Only the superuser can use the update process. For information for setting OBP security variables, refer to the OpenBoot 4.x Command Reference Manual at: ¦ http://download.oracle.com/docs/cd/E19455-01/816-1177-10/cfg-va r.html#pgfId-17069 Oracle ILOM Firmware Oracle Integrated Lights Out Manager (Oracle ILOM) is system management firmware that is preinstalled on some SPARC and Netra SPARC servers. Oracle ILOM enables you to actively manage and monitor components installed in your system. The way you use Oracle ILOM affects the security of your system. To understand more about using this firmware when setting up passwords, managing users, and applying security-related features, including Secure Shell (SSH), Secure Socket Layer (SSL), and RADIUS authentication, refer to Oracle ILOM documentation: ¦ http://www.oracle.com/pls/topic/lookup?ctx=E19860-01 Maintaining a Secure Environment Oracle hardware and software provide a number of security features controlling hardware and tracking assets. Hardware Controls Some Oracle systems can be set up to be turned on and off by software commands. In addition, the power distribution units (PDUs) for some system cabinets can be enabled and disabled remotely by software commands. Authorization for these commands is typically set up during system configuration and is usually limited to system administrators and service personnel. Refer to your system or cabinet documentation for further information.SPARC and Netra SPARC T4 Series Servers Security 5 Asset Tracking Oracle serial numbers are embedded in firmware located on option cards and system mother boards. These serial numbers can be read through local area network connections for inventory tracking. Wireless radio frequency identification (RFID) readers can further simplify asset tracking. An Oracle white paper, How to Track Your Oracle Sun System Assets by Using RFID is available at: ¦ http://www.oracle.com/technetwork/articles/systems-hardware-arc hitecture/o11-001-rfid-oracle-214567.pdf Software and Firmware ¦ Always install the latest released version of the software or firmware on your equipment. Devices such as network switches contain firmware and might require patches and firmware updates. ¦ Install any necessary security patches for your software. Local and Remote Access Follow these guidelines to ensure the security of local and remote access to your systems: ¦ Create a banner to state that unauthorized access is prohibited. ¦ Use access control lists where appropriate. ¦ Set time-outs for extended sessions and set privilege levels. ¦ Use authentication, authorization, and accounting (AAA) features for local and remote access to a switch. ¦ If possible, use the RADIUS and TACACS+ security protocols: – RADIUS (Remote Authentication Dial In User Service) is a client/server protocol that secures networks against unauthorized access. – TACACS+ (Terminal Access Controller Access-Control System) is a protocol that permits a remote access server to communicate with an authentication server to determine if a user has access to the network. ¦ Use the port mirroring capability of the switch for intrusion detection system (IDS) access. ¦ Implement port security to limit access based upon a MAC address. Disable auto-trunking on all ports.6 SPARC and Netra SPARC T4 Series Servers Security Guide • December 2011 ¦ Limit remote configuration to specific IP addresses using SSH instead of Telnet. Telnet passes user names and passwords in clear text, potentially allowing everyone on the LAN segment to see login credentials. Set a strong password for SSH. ¦ Early versions of SNMP are not secure and transmit authentication data in unencripted text. Only version 3 of SNMP can provide secure transmissions. ¦ Some products come out of the box with PUBLIC set as the default SNMP community string. Attackers can query a community to draw a very complete network map and possibly modify management information base (MIB) values. If SNMP is necessary, change the default SNMP community string to a strong community string. ¦ Enable logging and send logs to a dedicated secure log host. ¦ Configure logging to include accurate time information, using NTP and timestamps. ¦ Review logs for possible incidents and archive them in accordance with the security policy. ¦ If your system controller uses a browser interface, be sure to log out after using it. Data Security Follow these guidelines to maximize data security: ¦ Back up important data using devices such as external hard drives, pen drives, or memory sticks. Store the backed up data in a second, off-site, secure location. ¦ Use data encryption software to keep confidential information on hard drives secure. ¦ When disposing of an old hard drive, physically destroy the drive or completely erase all the data on the drive. Deleting all the files or reformatting the drive will remove only the address tables on the drive - information can still be recovered from a drive after deleting files or reformatting the drive. (Use disk wiping software to completely erase all data on a drive.) Network Security Follow these guidelines to maximize your network security: ¦ Most switches allow you to define virtual local area networks (VLANs). If you use your switch to define VLANs, separate sensitive clusters of systems from the rest of the network. This decreases the likelihood that users will gain access to information on these clients and servers.SPARC and Netra SPARC T4 Series Servers Security 7 ¦ Manage switches out-of-band (separated from data traffic). If out-of-band management is not feasible, then dedicate a separate VLAN number for in-band management. ¦ Keep Infiniband hosts secure. An Infiniband fabric is only as secure as its least secure Infiniband host. ¦ Note that partitioning does not protect an Infiniband fabric. Partitioning only offers Infiniband traffic isolation between virtual machines on a host. ¦ Maintain a switch configuration file off-line and limit access only to authorized administrators. The configuration file should contain descriptive comments for each setting. ¦ Use static VLAN configuration, when possible. ¦ Disable unused switch ports and assign them an unused VLAN number. ¦ Assign a unique native VLAN number to trunk ports. ¦ Limit the VLANs that can be transported over a trunk to only those that are strictly required. ¦ Disable VLAN Trunking Protocol (VTP), if possible. Otherwise, set the following for VTP: management domain, password and pruning. Then set VTP into transparent mode. ¦ Disable unnecessary network services, such as TCP small servers or HTTP. Enable necessary network services and configure these services securely. ¦ Different switches will offer different levels of port security features. Use these port security features if they are available on your switch: ¦ MAC Locking: This involves tying a Media Access Control (MAC) address of one or more connected devices to a physical port on a switch. If you lock a switch port to a particular MAC address, superusers cannot create backdoors into your network with rogue access points. ¦ MAC Lockout: This disables a specified MAC address from connecting to a switch. ¦ MAC Learning: Use the knowledge about each switch port’s direct connections so the switch can set security based on current connections.8 SPARC and Netra SPARC T4 Series Servers Security Guide • December 2011 1 This guide describes the minimum steps required to install and power on Oracle’s SPARC T4-1B server module for the first time. Before performing the procedures in this guide, review the following documents: ¦ Sun Blade 6000 Modular System Installation Guide – Install the Sun Blade 6000 modular system chassis before you install the server module. ¦ Online SPARC T4-1B Server Module Product Notes – Find out if any late-breaking issues impact installation requirements. ¦ Online SPARC T4-1B Server Module Installation Guide – Use this guide if you want more detailed installation information. ¦ Important Safety Information for Sun Hardware Systems (in the shipping kit) and the online SPARC T4-1B Server Module Safety and Compliance Manual – To learn about safety information. For information about obtaining these documents, see “Related Documentation” on page 6. Shipment Inventory 1 Printed documents 2 Server module 3 Customer information sheet in sleeve on shipping carton (save this for MAC addresses and other information) SPARC T4-1B Server Module Getting Started Guide2 ?Install Optional Components ? Before installing the server module into the modular system chassis, install any optional components that you ordered for the server module. Optional components might already be installed in the server module you received. Refer to the customer information sheet for details. For instructions on installing optional components, refer to the documentation for each component and to the SPARC T4-1B Server Module Service Manual. ?Install the Server Module Into the Chassis The server module is hot-pluggable in the chassis. The instructions in this guide assume that the Sun Blade 6000 modular system is installed, and is up and running. Caution – Due to cooling restrictions, you must install the server module into the chassis within 60 seconds of removing the filler panel. 1. Unpack the server module. 2. Remove the protective connector cover from the rear of the server module. 3. Remove the filler panel from the desired server module slot in the chassis. 4. With the ejector levers on the right, insert the server module into the chassis (panel 1) until it is about 1.5 cm (.5 in.) from the front of the chassis. 5. Pinch the ejector levers to open them (panel 2). 6. Push the server module into the chassis and close the ejector levers (panel 3). 7. Verify the server module insertion (panel 4) by checking the green OK LED on the server module. When the server module is plugged in, standby power is supplied to the service processor (SP). The front panel LEDs blink several times, then the green OK LED on the front panel blinks for a few minutes. The server module SP generates messages as soon as the server module is connected to a powered modular system.3 ?Determine Your Connection Method Use the Oracle Integrated Lights Out Manager (Oracle ILOM) software that runs on the server module SP to start, boot, and manage the server module. You can access the SP in several ways as shown in the following illustration. ? Connect to the server module using one of the methods shown in the following figure and table. This guide describes methods 1 and 3, but you can use other methods as described in the SPARC T4-1B Server Module Installation Guide. Method Connection Description 1 Ethernet From: CMM NET MGT port To: Your network Ensure that the CMM NET MGT port is connected to your network. From your network, log into Oracle ILOM on the CMM using the IP address of the CMM. Use the Oracle ILOM proxy to navigate to the server module SP. You can use the CMM Oracle ILOM CLI or use the CMM Oracle ILOM web interface. See “Method 1 – Power On the Host Through the CMM (Web Interface)” on page 4. 2 Serial From: CMM SER MGT port To: Terminal device Connect a terminal device to the CMM SER MGT RJ-45 port and use CMM Oracle ILOM CLI to navigate to the server module SP. This method only supports the Oracle ILOM CLI. Refer to the SPARC T4-1B Server Module Installation Guide for instructions. 3 Serial From: Server module SP UCP port (dongle required) To: Terminal device Connect a dongle cable to the server module. Connect a terminal device to the serial connector on the dongle cable (UCP-3 dongles use the RJ-45 connector, UCP-4 dongles use DB-9 connector). Communicate directly with Oracle ILOM on the server module SP using the CLI. See “Method 3 – Power On the Host Through the Front Panel (SP CLI)” on page 5.4 ?Method 1 – Power On the Host Through the CMM (Web Interface) In this procedure, you use the CMM Oracle ILOM web interface to access the server module SP. You must know the CMM IP address to perform this procedure. 1. Ensure that the CMM NET MGT port is connected and configured to communicate on your network. Refer to the modular system documentation for details. 2. Access the Oracle ILOM Web Interface on the CMM. In a browser on the same network as the modular system, type http://cmm_ip_address. Replace cmm_ip_address with your CMM IP address. The Oracle ILOM login page is displayed. 3. Log in to Oracle ILOM on the CMM by typing your user name and password. The factory default Oracle ILOM root password is changeme, but might have been changed in your environment. 4. If the Chassis view (image of the modular system) is not displayed in the web interface, select the Chassis entry in the left navigation panel. 5. Use one of the following methods to navigate to the server module SP: ¦ Select the newly installed server module in the Chassis view (image) of the modular system. ¦ In the left Chassis navigation panel, select the newly installed server module (listed as Blade 0 - 9). 6. If prompted to log in, enter the following factory default user name and password: ¦ User name: root ¦ Password: changeme You are now connected to the server module SP. 7. Open a Remote Console: a. Select the Remote Control tab on the top menu. b. Click Use serial redirection. c. Click Launch Remote Console. This remote console will display host messages and prompts for installing the Oracle Solaris OS when you power on the server module. 8. Power on the server module: a. Select the Remote Power Control tab. b. Click the menu and select Power On. c. Select Save. d. Select OK when you see this prompt: Are you sure you want to perform a Power On of the server?. You are now connected to the server module host. Go to “Set Up the Operating System” on page 5. By default, the SP is configured to use DHCP to obtain an IP address. If instead you plan to assign a static IP address to the SP, refer to the online installation guide for instructions.5 ?Method 3 – Power On the Host Through the Front Panel (SP CLI) In this procedure, you use a UCP-3 dongle cable to connect directly to the front of the server module. Commands are performed using the Oracle ILOM CLI. 1. Connect the dongle cable to the UCP port on the server module front panel. A UCP-3 dongle cable is provided with each modular system (chassis). The dongle cable is intended for temporary installation and configuration. Disconnect the dongle cable once the server module is accessible through your network. 2. Configure and connect a terminal device to the RJ-45 connector on the UCP-3 dongle cable. Set up the terminal device for 8 bits, no parity, 1 stop bit, 9600 baud, no flow control. The Oracle ILOM login prompt is displayed on the terminal. 3. Enter the following factory default user name and password: ¦ User name: root ¦ Password: changeme You are now connected to the server module SP. 4. Power on the server module host. The server module initializes. 5. Switch communication to the server module host. You are now connected to the server module host. Go to “Set Up the Operating System” . By default the SP is configured to use DHCP to obtain an IP address. If instead you plan to assign a static IP address to the SP, refer to the online installation guide for instructions. ?Set Up the Operating System If a local boot device is accessible and if the Oracle Solaris OS is preinstalled, you are prompted for OS configuration information in the host console. Otherwise, the system uses the boot net command to seek a boot device on the network. ? Configure the preinstalled OS or reinstall a supported OS to suit your needs. For details on the Oracle Solaris OS configuration process, refer to the SPARC T4-1B Server Module Installation Guide and the installation guides for your version of the Oracle Solaris OS. Before you reinstall the OS, consider using Oracle VM Server. Oracle VM Server is a preinstalled system virtualization feature that provides a discrete logical grouping with its own operating system, resources, and identity within a single computer system. You can run a variety of applications in different logical domains and keep them independent for performance and security purposes. -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.6 ?Check for the Latest OS, Patches, and Firmware Later versions of OS, patches, and firmware might be available for your server module. Some features can only be enabled when certain patches or firmware are installed. Install the latest available versions for the best performance, security, and stability. ? Review the SPARC T4-1B Server Module Product Notes for this Oracle product. See “Related Documentation” . This document describes important product dependencies and late-breaking information. Related Documentation Feedback Provide feedback on this document at: http://www.oracle.com/goto/docfeedback Support and Accessibility Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1B server module http://download.oracle.com/docs/cd/E22735_01 Sun Blade 6000 modular system http://download.oracle.com/docs/cd/E19938-01 Oracle ILOM 3.0 http://download.oracle.com/docs/cd/E19860-01 Oracle Solaris and other system software http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Description Links Access electronic support through My Oracle Support. https://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support Learn about Oracle’s commitment to accessibility. http://www.oracle.com/us/corporate/accessibility Copyright © 2011, Oracle and/or its affiliates. All rights reserved. Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Part Number: E22741-01 Mfg. Number: 7017848 October 2011 SPARC T4-1B Server Module Installation Guide Part No. E22738-02 December 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation v Understanding the Server Module 1 Installation Task Overview 1 Server Module Overview 3 Front and Rear Panel Components 5 Confirming Server Module and Site Specifications 7 Physical Specifications 7 Environmental Specifications 8 Electrical Specifications 8 Preparing for Installation 11 Inventory 12 Handling Precautions 13 ESD Precautions 13 Tools Needed for Installation 14 ? Plan Communication With the Server Module During Installation 15 Dongle Cables 17 Installing the Server Module 21 ? Prepare the Modular System and Server Module 21 ? Install Optional Components 23 ? Insert the Server Module Into the Chassis 23iv SPARC T4-1B Server Module Installation Guide • December 2011 Powering On the Server Module for the First Time 27 ? Method 1a – Power On the Host Through the CMM (Web Interface) 28 ? Method 1b – Power On the Host Through the CMM (CLI) 29 ? Method 2 – Power On the Host Through the CMM SER MGT Port (CLI) 31 ? Method 3 – Power On the Host Through the Front Panel (SP CLI) 34 Configuring the Oracle Solaris OS 37 ? Configure the OS 37 ? Install Oracle Solaris Software From the Network 38 Oracle Solaris Configuration Parameters 38 ? Assign a Static IP Address to the SP 40 Glossary 43 Index 49v Using This Documentation This document provides instructions and reference material to help you install Oracle’s SPARC T4-1B server module in Oracle’s Sun Blade 6000 modular system. ¦ “Related Documentation” on page v ¦ “Feedback” on page vi ¦ “Support and Accessibility” on page vi Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1B server module http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1B Sun Blade 6000 modular system http://www.oracle.com/pls/topic/lookup?ctx=E19938-01 Oracle Integrated Lights Out Manager (Oracle ILOM) http://www.oracle.com/technetwork/documentation/sys-mgmt-networ king-190072.html Oracle Solaris OS and other system software http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Oracle VTS software http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 SAS-1/SAS-2 Compatibility http://www.oracle.com/pls/topic/lookup?ctx=E22513_01vi SPARC T4-1B Server Module Installation Guide • December 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 Understanding the Server Module The following topics describe the server module and installation tasks. ¦ “Installation Task Overview” on page 1 ¦ “Server Module Overview” on page 3 ¦ “Front and Rear Panel Components” on page 5 Related Information ¦ “Confirming Server Module and Site Specifications” on page 7 Installation Task Overview Perform the following tasks to install the server module. Step Description Links 1. Review the product notes for any late-breaking news. SPARC T4-1B Server Module Product Notes 2. Review the server module features and components. “Server Module Overview” on page 3 “Front and Rear Panel Components” on page 5 3. Review the server module requirements. “Confirming Server Module and Site Specifications” on page 7 4. Confirm that you received all the items you ordered. “Inventory” on page 12 5. Review safety and ESD precautions. “Handling Precautions” on page 13 “ESD Precautions” on page 13 6. Gather the required tools. “Tools Needed for Installation” on page 142 SPARC T4-1B Server Module Installation Guide • December 2011 Related Information ¦ “Server Module Overview” on page 3 ¦ “Front and Rear Panel Components” on page 5 Server Module Overview 7. Choose a method by which to connect to the server module during installation. “Plan Communication With the Server Module During Installation” on page 15 “Dongle Cables” on page 17 8. Install optional components in the server module and install the server module in the chassis. “Installing the Server Module” on page 21 9. Power on the server module for the first time. “Powering On the Server Module for the First Time” on page 27 10. Configure the OS on the host. “Configuring the Oracle Solaris OS” on page 37 Step Description LinksUnderstanding the Server Module 3 Related Information ¦ “Front and Rear Panel Components” on page 5 ¦ “Installation Task Overview” on page 1 ¦ “Confirming Server Module and Site Specifications” on page 7 Feature Description Processor One SPARC T4 multicore processor. Memory 16 slots for DDR3 DIMMs. Internal hard drives Up to two hot-pluggable 2.5-inch SAS-2 hard drives. REM RAID expansion module (hard drive management) with RAID controller. Refer to the SPARC T4-1B Server Module Product Notes for details about supported REMs. UCP One UCP in the front panel. Use a UCP-3 or UCP-4 dongle cable to access the following server module connectors: • USB 2.0 (two connections) • Serial • VGA video • Local KVMS support Architecture SPARC V9 architecture, ECC protected. Platform group: sun4v. Platform name: ORCL,SPARC-T4-1B. Ethernet ports Two 10/100/1000 Mb Intel 82576EB ports. PCI I/O Two Gen2-capable PCI EM slots. FEM Refer to the SPARC T4-1B Server Module Product Notes for details about supported FEMs. System firmware Preinstalled on the SP. Note - Refer to the Server Module Product Notes for details on the latest firmware. Operating system Oracle Solaris OS Note - Refer to the Server Module Product Notes for details on software that is preinstalled and for information about required patches for supported Oracle Solaris OS releases. Remote management SP running the Oracle ILOM. Power The modular system chassis provides power. Cooling The modular system chassis provides environmental controls.4 SPARC T4-1B Server Module Installation Guide • December 2011 Front and Rear Panel Components No. Description 1 RFID tag (provides the serial number of the server module) 2 Universal connector port (UCP) 3 Drive slots 4 White LED: Locator (functions as the physical presence switch) 5 Blue LED: Ready to Remove 6 Amber LED: Fault (Service Action Required) 7 Green LED: OK 8 Power button 9 Reset button: NMI (for service use only) 10 Green LED: Drive OK 11 Amber LED: Drive Fault (Service Action Required) 12 Blue LED: Drive Ready to RemoveUnderstanding the Server Module 5 Related Information ¦ “Server Module Overview” on page 3 ¦ “Installation Task Overview” on page 1 13 Rear chassis power connector 14 Rear chassis data connection No. Description6 SPARC T4-1B Server Module Installation Guide • December 20117 Confirming Server Module and Site Specifications Site-planning information is included in the documentation for the Sun Blade 6000 modular system. Refer to the Site Planning Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems. These topics help you plan installation of the server module. ¦ “Physical Specifications” on page 7 ¦ “Environmental Specifications” on page 8 ¦ “Electrical Specifications” on page 8 Related Information ¦ “Installing the Server Module” on page 21 ¦ “Installation Task Overview” on page 1 ¦ “Server Module Overview” on page 3 Physical Specifications Measure U.S. Metric Width 1.8 in. 44.5 mm Depth 20.1 in. 511.7 mm Height 12.9 in. 327.2 mm Weight * * Weight specifications vary based on the model and internal options. 16.4 lbs 7.4 kg8 SPARC T4-1B Server Module Installation Guide • December 2011 Related Information ¦ “Environmental Specifications” on page 8 ¦ “Electrical Specifications” on page 8 Environmental Specifications Related Information ¦ “Physical Specifications” on page 7 ¦ “Electrical Specifications” on page 8 Electrical Specifications Related Information ¦ “Physical Specifications” on page 7 Condition Requirement Operating temperature 5°C (41°F) to 35°C (95°F) noncondensing Nonoperating temperature -40°C (-40°F) to 65°C (149°F) Operating humidity 10% to 90% noncondensing, 27°C (80°F) max. wet bulb Nonoperating humidity 93% noncondensing, 38°C (100°F) max. wet bulb Operating altitude 3048 meters (10,000 feet) at 35°C (95°F) Nonoperating altitude 12,000 meters (40,000 feet) Measure Value Voltage (nominal) 12V main from chassis backplane 3.3V AUX from chassis backplane Power (maximum) 540W (estimated)Confirming Server Module and Site Specifications 9 ¦ “Environmental Specifications” on page 810 SPARC T4-1B Server Module Installation Guide • December 201111 Preparing for Installation These topics help you prepare to install the server module. ¦ “Inventory” on page 12 ¦ “Handling Precautions” on page 13 ¦ “ESD Precautions” on page 13 ¦ “Tools Needed for Installation” on page 14 ¦ “Plan Communication With the Server Module During Installation” on page 15 ¦ “Dongle Cables” on page 17 Related Information ¦ “Installing the Server Module” on page 21 ¦ “Installation Task Overview” on page 112 SPARC T4-1B Server Module Installation Guide • December 2011 Inventory Related Information ¦ “Handling Precautions” on page 13 ¦ “ESD Precautions” on page 13 No. Description 1 Printed documentation, including Getting Started Guide. 2 Server module. 3 Customer information sheet (on outside of shipping carton). Save this sheet as a record of the MAC address and other information about installed hardware and software.Preparing for Installation 13 ¦ “Tools Needed for Installation” on page 14 ¦ “Plan Communication With the Server Module During Installation” on page 15 ¦ “Dongle Cables” on page 17 Handling Precautions ¦ Use both hands to carry the server module. ¦ Extend the ejector arms on the front panel only while they need to be in that position to perform a step in a task. Related Information ¦ “Physical Specifications” on page 7 ¦ “Inventory” on page 12 ¦ “ESD Precautions” on page 13 ¦ “Tools Needed for Installation” on page 14 ¦ “Plan Communication With the Server Module During Installation” on page 15 ¦ “Dongle Cables” on page 17 ESD Precautions Electronic equipment is susceptible to damage by static electricity. Use a grounded antistatic wrist strap, foot strap, or equivalent safety equipment to prevent ESD when you install the server module. Caution – To protect electronic components from ESD, which can permanently disable the system, place components on an antistatic surface, such as an antistatic discharge mat, an antistatic bag, or a disposable antistatic mat. Wear an antistatic grounding strap connected to a metal surface on the chassis when you work on system components. The following figure shows the modular system chassis ground connector for which you can connect antistatic equipment.14 SPARC T4-1B Server Module Installation Guide • December 2011 Related Information ¦ “Inventory” on page 12 ¦ “Handling Precautions” on page 13 ¦ “Tools Needed for Installation” on page 14 ¦ “Plan Communication With the Server Module During Installation” on page 15 ¦ “Dongle Cables” on page 17 Tools Needed for Installation The following tools are sufficient for installing the server module, whether or not you need to install components inside the server module: ¦ Antistatic mat ¦ Antistatic wrist strap ¦ UCP-3 or UCP-4 dongle cable ¦ Terminal or terminal emulator ¦ Stylus (to press power button) Related Information ¦ “Dongle Cables” on page 17 ¦ “Handling Precautions” on page 13Preparing for Installation 15 ¦ “ESD Precautions” on page 13 ¦ “Plan Communication With the Server Module During Installation” on page 15 ¦ “Inventory” on page 12 ? Plan Communication With the Server Module During Installation There are several methods to communicate with the server module during the initial installation. Plan which method you will use. Before you perform the installation, arrange to have the equipment, information, and permissions required by that method. Note – For information about identifying and configuring IP and MAC addresses, refer to the configuring network addresses information in the Server Module Administration Guide. ? Choose one of the connection methods to communicate with the server module SP. The connection methods are shown in the figure and described in the table. Obtain the cables, monitoring devices, addresses, and passwords required for the method you choose.16 SPARC T4-1B Server Module Installation Guide • December 2011 Method Connection Description Connection Requirements Supported Interfaces 1 Ethernet From: CMM NET MGT port To : Your network The CMM NET MGT port must be connected to your network. You must know the IP addresses of the CMM. From your network, you must be able to log in to Oracle ILOM on the CMM using the IP address of the CMM. Then you can use the Oracle ILOM proxy to navigate to the server module SP Oracle ILOM interface. See “Method 1a – Power On the Host Through the CMM (Web Interface)” on page 28 and “Method 1b – Power On the Host Through the CMM (CLI)” on page 29. a) CMM Oracle ILOM web interface b) CLI 2 Serial From: CMM SER MGT port To : Terminal device A terminal device connected to the CMM SER MGT RJ-45 port. From this connection, you can use Oracle ILOM to navigate to the server module SP Oracle ILOM CLI interface. See “Method 2 – Power On the Host Through the CMM SER MGT Port (CLI)” on page 31. CMM Oracle ILOM CLI 3 Serial From: Server module SP UCP port (dongle required) To : Terminal device A UCP-3 dongle cable that connects directly to the server module and a terminal device connected to the RJ-45 connector on the dongle cable. See “Method 3 – Power On the Host Through the Front Panel (SP CLI)” on page 34. SP Oracle ILOM CLIPreparing for Installation 17 Related Information ¦ “Dongle Cables” on page 17 ¦ “Inventory” on page 12 ¦ “Handling Precautions” on page 13 ¦ “ESD Precautions” on page 13 ¦ “Tools Needed for Installation” on page 14 Dongle Cables For setup, testing, or service purposes, you can connect cables directly to the server module SP by first attaching a dongle cable to the UCP on the front panel of the server module. Caution – Dongle cables should be removed when not in use. These cables have not been evaluated for electromagnetic compatibility compliance and are not to be used during normal system operation. There are two types of dongle cables you can use: ¦ UCP-3 – Three-connector dongle cable (preferred) ships with the server module. Use the RJ-45 connector to connect to the server module SP. ¦ UCP-4 – Four-connector dongle cable (previous version). You must use the DB-9 connector to connect to the server module SP. The RJ-45 connector is not supported. If you need an RJ-45 connection, attach an optional DB-9-to-RJ-45 adapter to the DB-9 connector.18 SPARC T4-1B Server Module Installation Guide • December 2011 FIGURE: UCP-3 Three-Connector Dongle Cable Figure Legend 1 Dongle connector attaching to the server module UCP 2 RJ-45 serial connector 3 USB 2.0 (two connectors) 4 VGA 15-pin female connector 5 Insertion and release buttonsPreparing for Installation 19 FIGURE: UCP-4 Four-Connector Dongle Cable Related Information ¦ “Inventory” on page 12 ¦ “Handling Precautions” on page 13 ¦ “ESD Precautions” on page 13 ¦ “Tools Needed for Installation” on page 14 ¦ “Plan Communication With the Server Module During Installation” on page 15 Figure Legend 1 Dongle connector attaching to the server module UCP 2 RJ-45 serial connector (Do not use this connector on the UCP-4) 3 DB-9 serial male connector (TTYA) 4 USB 2.0 (two connectors) 5 VGA 15-pin female connector 6 Insertion and release buttons20 SPARC T4-1B Server Module Installation Guide • December 201121 Installing the Server Module The following topics describe how to physically install the server module into the modular system. Related Information ¦ “Powering On the Server Module for the First Time” on page 27 ¦ “Installation Task Overview” on page 1 ? Prepare the Modular System and Server Module You must install and configure the Sun Blade 6000 modular system (chassis) before installing the server module. 1. Ensure that the modular system is installed and functional. Satisfying the following conditions ensures a straightforward installation of the server module: a. Install the modular system into its intended rack before installing server modules. Step Description Links 1. Prepare the modular system chassis and server module for installation. “Prepare the Modular System and Server Module” on page 21 2. Install any optional components. “Install Optional Components” on page 23 3. Insert the server module into the chassis. “Insert the Server Module Into the Chassis” on page 2322 SPARC T4-1B Server Module Installation Guide • December 2011 b. If you plan to manage the server modules through the modular system CMM, configure the CMM to run in your network. c. Ensure that the modular system chassis is powered on and running. d. Ensure that the modular system is running the latest version of Oracle’s CMM ILOM firmware. Note – For more information about preparing the modular system and the CMM ILOM, refer to the Sun Blade 6000 Modular System Installation Guide. 2. (If necessary) Upgrade all SAS-1 components. This server module is a SAS-2 component. You must upgrade the firmware of all SAS-1 components (such as SAS-1 NEMs and disk modules) to a firmware version that supports SAS-1/SAS-2 coexistence. You must complete this firmware upgrade before you insert this server module or any other SAS-2 component into the modular system chassis. Refer to the SAS-1/SAS-2 Compatibility Upgrade Guide for more information. See “Related Documentation” on page v. 3. Unpackage the server module. Be ready to insert the server module within 60 seconds of removing the filler panel. 4. Install any optional components. See “Install Optional Components” on page 23. 5. Be prepared to communicate with the server module as quickly as possible after completing the physical installation. As soon as you insert the server module in a powered modular system, power is supplied to the server module and the SP generates messages. If you want to see these messages, be ready to connect using one of the methods in “Plan Communication With the Server Module During Installation” on page 15. Related Information ¦ “Install Optional Components” on page 23 ¦ “Insert the Server Module Into the Chassis” on page 23Installing the Server Module 23 ? Install Optional Components Optional components that you order as part of the server module’s initial configuration are installed in the server module before it is shipped. These optional components are identified on the customer information sheet included with the server module’s packaging. However, if you ordered optional components separately, you must install them in the server module before you install the server module in the modular system chassis. 1. Install any optional components in the server module. To install any optional components, refer to the SPARC T4-1B Server Module Service Manual and to the documentation for the optional component. 2. Close the server module. 3. Insert the server module into the chassis. See “Insert the Server Module Into the Chassis” on page 23. Related Information ¦ “Prepare the Modular System and Server Module” on page 21 ¦ “Install Optional Components” on page 23 ? Insert the Server Module Into the Chassis 1. (If necessary) Prepare the modular system and server module. See “Prepare the Modular System and Server Module” on page 21. 2. (If necessary) Install any optional components. See “Install Optional Components” on page 23. 3. Remove the protective cover from the rear connector of the server module.24 SPARC T4-1B Server Module Installation Guide • December 2011 4. Locate the slot in the chassis where you plan to install the server module. A filler panel should remain in this slot until just before you are ready to insert the server module. All slots should remain filled with server modules or filler panels to ensure correct air flow, heat, and electromagnetic interference conditions in the modular system. 5. Remove the filler panel from the selected chassis slot. Pull down the ejector arm of the filler panel, then pull the panel straight out of the chassis. Caution – Be ready to insert the server module within 60 seconds of removing the filler panel. 6. Use both hands to position the server module vertically with the ejector arms on the right (panel 1). 7. Push the server module into the empty slot until the module extends about 1.5 cm (0.5 inch) from the chassis front (panel 2). 8. Pinch the ejector levers to open them (panel 2). 9. Push the server module into the chassis and close the ejector levers (panel 2 and 3).Installing the Server Module 25 10. Monitor status messages when power is applied to the server module (panel 4). As soon as you insert the server module into a chassis that is connected to power, the server module goes into standby mode and its SP initializes. The front panel LEDs blink three times, then the green OK LED on the front panel blinks for a few minutes. See “Front and Rear Panel Components” on page 5. Related Information ¦ “Prepare the Modular System and Server Module” on page 21 ¦ “Install Optional Components” on page 23 ¦ “Front and Rear Panel Components” on page 526 SPARC T4-1B Server Module Installation Guide • December 201127 Powering On the Server Module for the First Time After you install the server module in the modular system, you power on the server module host for the first time. Based on the connection method you selected from “Plan Communication With the Server Module During Installation” on page 15, perform one of the tasks in this table to power on the server module: Related Information ¦ “Configuring the Oracle Solaris OS” on page 37 ¦ “Installation Task Overview” on page 1 ¦ Server Module Administration Guide Description Links Through a browser that is on the same network as the CMM, use the CMM ILOM web interface. “Method 1a – Power On the Host Through the CMM (Web Interface)” on page 28 Through a terminal window on a system that is on the same network as the CMM, use the CMM ILOM CLI. “Method 1b – Power On the Host Through the CMM (CLI)” on page 29 Through a terminal device connected to the CMM SER MGT port, use the CMM ILOM CLI. “Method 2 – Power On the Host Through the CMM SER MGT Port (CLI)” on page 31 Through a terminal device connected to the front panel of the server module (using the dongle cable), use the server module SP ILOM CLI. “Method 3 – Power On the Host Through the Front Panel (SP CLI)” on page 3428 SPARC T4-1B Server Module Installation Guide • December 2011 ? Method 1a – Power On the Host Through the CMM (Web Interface) You connect to the CMM through the RJ-45 NET MGT 0 Ethernet port. While this Ethernet connection supports both the CLI and the web interface to the CMM, this procedure uses the web interface. By default, the server module is configured to use DHCP to obtain the IP address for the SP. 1. Ascertain the IP addresses for the CMM. 2. Ensure that the CMM is connected to the network you are on. The network connection is through the RJ-45 connector labeled NET MGT 0 on the CMM. 3. In a browser on the same network as the modular system, enter the IP address of the CMM. For example, if your CMM has the IP address 129.99.99.99, enter http://129.99.99.99 into your browser. A login window for ILOM appears. 4. Log into ILOM on the CMM by typing your user name and password. The factory default ILOM root password is changeme, but might have been changed in your environment. You are logged in to the CMM ILOM web interface. 5. If the Chassis View (image of the modular system) is not displayed in the web interface, select the Chassis entry in the left navigation panel. 6. Use one of the following methods to navigate to the server module SP. ¦ Select the newly installed server module in the Chassis View (image) of the modular system. ¦ In the left Chassis navigation panel, select the newly installed server module (listed as Blade 0 - 9). 7. If prompted to log in, enter the following factory default user name and password: ¦ User name: root ¦ Password: changeme You are now connected to the server module SP. 8. Open a Remote Console.Powering On the Server Module for the First Time 29 a. Select the Remote Control tab on the top menu. b. Click on Use serial redirection. c. Click on Launch Remote Console. This remote console will display host messages and prompts for installing the Oracle Solaris OS when you power on the server module. 9. Power on the server module. a. Select the Remote Power Control tab. b. Click on the menu and select Power On. c. Select Save. d. Select OK when you see this prompt: Are you sure you want to perform a Power On of the server. The server module host is powered on for the first time. 10. You can now configure the Oracle Solaris OS to meet your needs. See “Configuring the Oracle Solaris OS” on page 37. Related Information ¦ “Plan Communication With the Server Module During Installation” on page 15 ? Method 1b – Power On the Host Through the CMM (CLI) You connect to the CMM through the RJ-45 NET MGT 0 Ethernet port. While this Ethernet connection supports both the CLI and the web interface to the CMM SP, this procedure uses the CMM CLI. 1. Ascertain the IP addresses for the CMM. 2. Ensure that the CMM is connected to the network you are on. The network connection is through the RJ-45 connector labeled NET MGT 0 on the CMM.30 SPARC T4-1B Server Module Installation Guide • December 2011 3. Log in to the CMM with the SSH client. Replace cmm_ip_address with the IP address of the CMM. 4. Type your password for the CMM ILOM root account when prompted. The factory default ILOM root password is changeme, but might have been changed in your environment. You are now logged in to the CMM ILOM CLI. Note – When you are ready to log out of the CMM ILOM, type exit. 5. Navigate to the server module SP. Replace n with a number that identifies the chassis slot in the modular system where the target server module is installed. 6. Access the server module SP. If you are prompted for a password for the root user on the server module SP, type changeme (the factory default password). You are now logged into ILOM on the server module SP. $ ssh root@cmm_ip_address Password: CMM_ILOM_password Oracle(TM) Integrated Lights Out Manager Version 3.x.x ... Warning: password is set to factory default. -> -> cd /CH/BLn/SP/cli -> start Are you sure you want to start /CH/BLn/SP/cli (y/n)? y start: Connecting to /CH/BLn/SP/cli as user rootPowering On the Server Module for the First Time 31 7. At the server module ILOM prompt, type: The server module initializes. 8. Switch communication to the server module host. When the ILOM prompt appears, type: The server module might take several minutes to complete POST. If a boot device installed with Oracle Solaris OS is accessible locally, the server module boots. Otherwise, the server module uses the boot net command to seek a boot device on the network. You are now connected to the server module host. 9. The server module hardware installation is now complete. You can now configure the Oracle Solaris OS to meet your needs. See “Configuring the Oracle Solaris OS” on page 37. Related Information ¦ “Plan Communication With the Server Module During Installation” on page 15 ? Method 2 – Power On the Host Through the CMM SER MGT Port (CLI) You can access the server module SP by first accessing the chassis CMM ILOM through a terminal or terminal emulator connected to the RJ-45 serial port on the chassis. Then you can connect to the server module SP through the CLI of the CMM ILOM software. -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS. . . -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #. ...32 SPARC T4-1B Server Module Installation Guide • December 2011 1. Verify that the terminal, laptop, or terminal server that will connect to the chassis is operational. 2. Configure the terminal device or terminal emulation software with these settings: ¦ 8N1 (eight data bits, no parity, one stop bit) ¦ 9600 baud (the default, but can be set to any standard rate up to 57600) ¦ Disable hardware flow control (CTS/RTS) 3. Connect a serial cable from the chassis serial port to the terminal device. Refer to the modular system chassis documentation for the location of the serial port. The serial port requires a cable with these pin assignments. 4. Press Enter on the terminal device. The connection between the terminal device and the CMM is established. If you connected to the serial port before the powering on the modular system, you will see boot messages. The CMM ILOM software displays its login prompt: The first string in the prompt is the default host name, which consists of the prefix ORACLECMM followed by the CMM ILOM MAC address. The MAC address for each CMM and SP is unique. Pin Signal Description 1 Request To Send (RTS) 2 Data Terminal Ready (DTR) 3 Transmit Data (TXD) 4 Ground 5 Ground 6 Receive Data (RXD) 7 Data Carrier Detect (DCD) 8 Clear To Send (CTS) ORACLECMMnnnnnnnnnn login:Powering On the Server Module for the First Time 33 5. Log into ILOM on the CMM by typing your user name and password. The factory default ILOM root password is changeme, but might have been changed in your environment. You are now logged in to the CMM ILOM web interface. After you have successfully logged in, the CMM ILOM displays its default command prompt: 6. Navigate to the server module: Replace n with an integer that identifies the target server module (the slot for which the server module is installed). 7. Start the server module’s Oracle ILOM CLI: Note – The CMM ILOM logs into the server module ILOM using the user name in the user target under /CH/BLn/SP/cli (where n is the slot where the server module is installed). 8. If prompted for a password, enter the default password changeme. 9. At the Oracle ILOM prompt, type: The server module initializes. -> -> cd /CH/BLn/SP/cli -> start Are you sure you want to start /CH/BL0/SP/cli (y/n)? y start: Connecting to /CH/BL0/SP/cli using Single Sign On -> start /SYS Are you sure you want to start /SYS (y/n)? y34 SPARC T4-1B Server Module Installation Guide • December 2011 10. Switch communication to the server module host. When the ILOM prompt appears, type: The server module might take several minutes to complete POST. If a boot device installed with Oracle Solaris OS is accessible locally, the server module boots. Otherwise, the server module uses the boot net command to seek a boot device on the network. You are now connected to the server module host. 11. The server module hardware installation is now complete. You can now configure the Oracle Solaris OS to meet your needs. See “Configuring the Oracle Solaris OS” on page 37. Related Information ¦ “Plan Communication With the Server Module During Installation” on page 15 ? Method 3 – Power On the Host Through the Front Panel (SP CLI) You can access the server module SP directly by connecting a dongle cable to the UCP on the front of the server module. Caution – Dongle cables are intended for setup, testing, or service purposes and should be removed when not in use. These cables have not been evaluated for electromagnetic compatibility compliance and are not to be used during normal operation. See “Dongle Cables” on page 17. 1. Configure the terminal device or terminal emulation software with these settings: ¦ 8N1 (eight data bits, no parity, one stop bit) ¦ 9600 baud (the default, but can be set to any standard rate up to 57600) ¦ Disable hardware flow control (CTS/RTS) -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.Powering On the Server Module for the First Time 35 2. Connect the dongle cable to the UCP connector on the front panel of the server module. If possible, use a three-connector UCP-3 dongle cable rather than a four-connector UCP-4. See “Dongle Cables” on page 17 for details. 3. Connect a terminal or terminal emulator to a dongle cable. ¦ For a UCP-3 dongle cable, use the RJ-45 connector. ¦ For a UCP-4 dongle cable, use the DB-9 serial connector (TTYA). If you need to make an RJ-45 connection to a UCP-4, do so through a DB-9-to-RJ-45 adapter attached to the DB-9 connector. The Oracle ILOM login prompt is displayed on the terminal or terminal emulator. 4. Type the user name and password when prompted. The default user is root. The default password is changeme. You are now logged into Oracle ILOM on the server module SP. 5. At the server module ILOM prompt, type: The server module initializes. 6. Switch communication to the server module host. When the Oracle ILOM prompt appears, type: The server module might take several minutes to complete POST. If a boot device installed with Oracle Solaris OS is accessible locally, the server module boots. Otherwise, the server module uses the boot net command to seek a boot device on the network. You are now connected to the server module host. 7. The server module hardware installation is now complete. You can now configure the Oracle Solaris OS to meet your needs. See “Configuring the Oracle Solaris OS” on page 37. Related Information ¦ “Plan Communication With the Server Module During Installation” on page 15 -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS. . . -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.36 SPARC T4-1B Server Module Installation Guide • December 2011 ¦ “Dongle Cables” on page 1737 Configuring the Oracle Solaris OS After you install the server module in the modular system, you can power on the server for the first time and begin configuration. Related Information ¦ “Installation Task Overview” on page 1 ? Configure the OS This procedure assumes that you are using the Oracle Solaris OS software that was preinstalled on the drive in slot 0 of the server module. If you are installing the Oracle Solaris OS another way, complete the Oracle Solaris OS installation then resume this procedure. ? Respond to configuration questions in the Oracle Solaris installation process. See the configuration choices you planned, based on “Oracle Solaris Configuration Parameters” on page 38. Description Links Configure the preinstalled Oracle Solaris OS. “Configure the OS” on page 37 “Oracle Solaris Configuration Parameters” on page 38 “Assign a Static IP Address to the SP” on page 40 Install your own version of the Oracle Solaris OS. “Install Oracle Solaris Software From the Network” on page 38 “Oracle Solaris Configuration Parameters” on page 38 “Assign a Static IP Address to the SP” on page 4038 SPARC T4-1B Server Module Installation Guide • December 2011 Related Information ¦ “Install Oracle Solaris Software From the Network” on page 38 ¦ “Oracle Solaris Configuration Parameters” on page 38 ¦ “Assign a Static IP Address to the SP” on page 40 ? Install Oracle Solaris Software From the Network If you choose to use Oracle Solaris OS software other than the preinstalled Oracle Solaris OS, you can install the operating system from the network. ? Refer to the Solaris Installation Guide: Network-Based Installations for the version of Oracle Solaris OS that you plan to use. You can obtain this guide in the Oracle Solaris OS documentation collections that are under the Systems Software category at: http://http:www.oracle.com/technetwork/indexes/documentation/# sys_sw This guide includes information about using a JumpStart server. Related Information ¦ “Configure the OS” on page 37 ¦ “Oracle Solaris Configuration Parameters” on page 38 ¦ “Assign a Static IP Address to the SP” on page 40 Oracle Solaris Configuration Parameters You are prompted to provide these parameters when configuring the Oracle Solaris OS on the server module. Parameter Description Language Select a number from the displayed language list. Locale Select a number from the displayed locale list.Configuring the Oracle Solaris OS 39 Related Information ¦ “Configure the OS” on page 37 ¦ “Install Oracle Solaris Software From the Network” on page 38 ¦ “Assign a Static IP Address to the SP” on page 40 Terminal Type Select a terminal type that corresponds with your terminal device. Network? Select Yes. Multiple Network Interfaces Select the network interfaces that you plan to configure. If you are not sure, select the first interface in the list. DHCP? Select Yes or No according to your network environment. Host Name Enter the host name for the server. IP Address Enter the IP address for this Ethernet interface. Subnet? Select Yes or No according to your network environment. Subnet Netmask (If subnet was Yes) Enter the netmask for the subnet for your network environment. IPv6? Specify whether or not to use IPv6. If you are not sure, select No to configure the Ethernet interface for IPv4. Security Policy Select either standard UNIX security (No) or Kerberos Security (Yes). If you are not sure, select No. Confirm Review the onscreen information and change it if needed. Otherwise, continue. Name Service Select the name service according to your network environment. Note – If you select a name service other than None, you will be prompted for additional name service configuration information. NFSv4 Domain Name Select the type of domain name configuration according to your environment. If you are not sure, select Use the NFSv4 domain. Time Zone (Continent) Select your continent. Time Zone (Country or Region) Select your country or region. Time Zone Select the time zone. Date and Time Accept the default date and time or change the values. root Password Enter the root password twice. This password is for the superuser account for the Oracle Solaris OS on this server. This password is not the SP password.40 SPARC T4-1B Server Module Installation Guide • December 2011 ? Assign a Static IP Address to the SP By default, the server module is configured to obtain an IP address from DHCP services in your network. If the network your server module is connected to does not support DHCP for IP addressing, perform this procedure. To configure the server module to support DHCP, refer to the Oracle ILOM documentation. 1. Set the SP to accept a static IP address. 2. Set the IP address for the SP. 3. Set the IP address for the SP gateway. 4. Set the netmask for the SP. This example uses 255.255.255.0 to set the netmask. Your network environment subnet might require a different netmask. Use a netmask number most appropriate to your environment. 5. Verify that the pending parameters are set correctly. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0' -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxxConfiguring the Oracle Solaris OS 41 6. Commit the changes to the SP network parameters. Note – You can type the show /SP/network command again to verify that the parameters have been updated. 7. Set the static IP address when you configure the Oracle Solaris OS. See “Configure the OS” on page 37. Related Information ¦ “Configure the OS” on page 37 ¦ “Install Oracle Solaris Software From the Network” on page 38 ¦ “Oracle Solaris Configuration Parameters” on page 38 ipnetmask = 255.255.255.0 macaddress = 00:21:28:C1:6E:C5 managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:C1:6E:C5 pendingipaddress = service-processor-IPaddr pendingipdiscovery = static pendingipgateway = gateway-IPaddr pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:21:28:C1:6E:C4 state = enabled -> set /SP/network commitpending=true Set 'commitpending' to 'true'42 SPARC T4-1B Server Module Installation Guide • December 201143 Glossary A ANSI SIS American National Standards Institute Status Indicator Standard. ASF Alert standard format (Netra products only). ASR Automatic system recovery. AWG American wire gauge. B blade Generic term for server modules and storage modules. See server module and storage module. blade server Server module. See server module. BMC Baseboard management controller. BOB Memory buffer on board. C chassis For servers, refers to the server enclosure. For server modules, refers to the modular system enclosure. CMA Cable management arm.44 SPARC T4-1B Server Module Installation Guide • December 2011 CMM Chassis monitoring module. The CMM is the service processor in the modular system. Oracle ILOM runs on the CMM, providing lights out management of the components in the modular system chassis. See Modular system and Oracle ILOM. CMM Oracle ILOM Oracle ILOM that runs on the CMM. See Oracle ILOM. D DHCP Dynamic Host Configuration Protocol. disk module or disk blade Interchangeable terms for storage module. See storage module. DTE Data terminal equipment. E EIA Electronics Industries Alliance. ESD Electrostatic discharge. F FEM Fabric expansion module. FEMs enable server modules to use the 10GbE connections provided by certain NEMs. See NEM. FRU Field-replaceable unit. H HBA Host bus adapter. host The part of the server or server module with the CPU and other hardware that runs the Oracle Solaris OS and other applications. The term host is used to distinguish the primary computer from the SP. See SP.Glossary 45 I ID PROM Chip that contains system information for the server or server module. IP Internet Protocol. K KVM Keyboard, video, mouse. Refers to using a switch to enable sharing of one keyboard, one display, and one mouse with more than one computer. L LwA Sound power level. M MAC Machine access code. MAC address Media access controller address. Modular system The rackmountable chassis that holds server modules, storage modules, NEMs, and PCI EMs. The modular system provides Oracle ILOM through its CMM. MSGID Message identifier. N name space Top-level Oracle ILOM CMM target. NEBS Network Equipment-Building System (Netra products only).46 SPARC T4-1B Server Module Installation Guide • December 2011 NEM Network express module. NEMs provide 10/100/1000 Mbps Ethernet, 10GbE Ethernet ports, and SAS connectivity to storage modules. NET MGT Network management port. An Ethernet port on the server SP, the server module SP, and the CMM. NIC Network interface card or controller. NMI Nonmaskable interrupt. O OBP OpenBoot PROM. Oracle ILOM Oracle Integrated Lights Out Manager. Oracle ILOM firmware is preinstalled on a variety of Oracle systems. Oracle ILOM enables you to remotely manage your Oracle servers regardless of the state of the host system. Oracle Solaris OS Oracle Solaris operating system. P PCI Peripheral component interconnect. PCI EM PCIe ExpressModule. Modular components that are based on the PCI Express industry-standard form factor and offer I/O features such as Gigabit Ethernet and Fibre Channel. POST Power-on self-test. PROM Programmable read-only memory. PSH Predictive self healing. Q QSFP Quad small form-factor pluggable.Glossary 47 R REM RAID expansion module. Sometimes referred to as an HBA See HBA. Supports the creation of RAID volumes on drives. S SAS Serial attached SCSI. SCC System configuration chip. SER MGT Serial management port. A serial port on the server SP, the server module SP, and the CMM. server module Modular component that provides the main compute resources (CPU and memory) in a modular system. Server modules might also have onboard storage and connectors that hold REMs and FEMs. SP Service processor. In the server or server module, the SP is a card with its own OS. The SP processes Oracle ILOM commands providing lights out management control of the host. See host. SSD Solid-state drive. SSH Secure shell. storage module Modular component that provides computing storage to the server modules. T TIA Telecommunications Industry Association (Netra products only). Tma Maximum ambient temperature. U UCP Universal connector port.48 SPARC T4-1B Server Module Installation Guide • December 2011 UI User interface. UL Underwriters Laboratory Inc. US. NEC United States National Electrical Code. UTC Coordinated Universal Time. UUID Universal unique identifier. W WWN World wide name. A unique number that identifies a SAS target.49 Index A altitude speci?cations, 8 antistatic mat and wrist strap (Installation), 14 architecture, processor, 3 C cable, dongle, 17 chassis inserting the server module, 23 preparation, 21 CLI for installation, 29 CMM NET MGT port, 15 CMM SER MGT port, 15 using for installation, 31 communicating with the server module, 15 components, optional, 23 con?guration settings for Oracle Solaris OS, 38 con?guring the IP address, 40 con?guring the Oracle Solaris OS, 37 connecting to the server CMM NET MGT port (CLI), 29 CMM NET MGT port (Web Interface), 28 CMM SER MGT port (CLI), 31 UCP connector, 34 connection methods, 15 connector covers, 23 cooling, 3 customer information sheet, 12 D data connector, 5 depth, 7 DHCP used to obtain IP address, 40 dimensions, 7 DIMM types, 3 documentation, related, v dongle cable, 15, 34 dongle cables, 15, 17, 34 E ejector arms, 23 electrical speci?cations, 8 environmental speci?cations, 8 ESD precautions, 13 Ethernet ports, 3 F features, server module, 3 FEMs, 3 ?ller panels, 23 front panel components, 5 G graphics, onboard, 3 H handling precautions, 13 height, 7 humidity speci?cations, 8 I ILOM root password, default, 28, 29, 31, 34 installation chassis preparation, 21 planning, 7, 11 task overview, 1 tools required, 14 installing the server module, 21 inventory of shipping kit, 12 IP address of CMM, 2850 SPARC T4-1B Server Module Installation Guide • December 2011 IP address, con?guring, 40 K KVMS, 3 L LEDs front panel, 5 upon installation, 23 M MAC address, 12 memory, 3 modular system chassis preparation, 21 O optional components, 23 Oracle Solaris con?guration settings, 38 con?guring, 37 Oracle Solaris OS con?guration settings, 38 OS installing from the network, 38 Oracle Solaris con?guration settings, 38 overview, installation task, 1 P PCIe EMs, 3 physical speci?cations, 7 planning the installation, 7, 11 power button, 5 power connector, 5 power speci?cations, 8 powering on the server module, 27 precautions ESD, 13 handling, 13 processor architecture, 3 R rear panel components, 5 related documentation, v remote console, 28 REMs, 3 reset button, 5 root password, default, 28 S serial cable pin assignments, 31 serial port connection, 15, 17 serial redirection, 28 server module con?guring the OS, 37 features, 3 inserting into chassis, 23 installing, 21 installing the OS from the network, 38 powering on, 27 starting, 31 understanding, 1 set command, 40 shipping kit inventory, 12 show command, 40 speci?cations electrical, 8 environmental, 8 physical, 7 ssh command, 29 start command, 29, 31 starting the server module, 31 static IP address, 40 system ?rmware, 3 T task overview, installation, 1 temperature speci?cations, 8 tools required for installation, 14 U UCP cables, 17 UCP connector, 3, 5, 34 understanding the server module, 1 USB connection, 17 V VGA connection, 17 voltage speci?cations, 8 W web interface, 28Index 51 weight, 7 width, 752 SPARC T4-1B Server Module Installation Guide • December 2011 SPARC and Netra SPARC T4 Series Servers Administration Guide Part No.: E22989-04 December 2011Please Recycle Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation ix Understanding System Administration Resources 1 Oracle ILOM Overview 1 Platform-Specific Oracle ILOM Features 2 Oracle Solaris OS Overview 3 OpenBoot Overview 4 Oracle VM Server for SPARC Overview 4 Multipathing Software 5 Hardware Management Pack Overview 6 Source for Downloading Hardware Management Pack Software 7 Hardware Management Pack Documentation 7 Accessing the Server 9 ? Log In to Oracle ILOM 9 ? Log In to the System Console 10 ? Display the ok Prompt 11 ? Display the Oracle ILOM -> Prompt 12 ? Use a Local Graphics Monitor 13 Oracle ILOM Remote Console 14 Controlling the Server 15 ? Power On the Server (Oracle ILOM) 15iv SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Power Off the Server (Oracle ILOM) 16 ? Reset the Server (Oracle Solaris OS) 17 ? Reset the Server (Oracle ILOM) 17 ? Reset the SP to Default Values 18 Configuring Hardware RAID 19 Hardware RAID Support 19 Important Hardware RAID Guidelines 21 ? Prepare to Use the FCode Utility 21 FCode Utility Commands 22 ? Create a Hardware RAID Volume 23 Hot Spare Drives in RAID Volumes (LSI) 24 Determining If a Drive Has Failed 25 Service Required Drive LEDs 25 Error Messages (System Console and Log Files) 25 ? Display Status (show-volumes Command, OBP) 26 ? Display Status (sas2ircu Utility, LSI) 27 RAID Drive Replacement Strategies 27 ? Locate Device Paths 28 Changing Server Identification Information 31 ? Change Customer Data on FRU PROMs 31 ? Change System Identifier Information 32 Configuring Policy Settings 33 ? Specify Cooldown Mode 33 ? Restore the Host Power State at Restart 34 ? Specify the Host Power State at Restart 34 ? Disable or Re-Enable the Host Power-On Delay 35 ? Specify Parallel Boot of the SP and Host 36Contents v ? Configure Host Behavior (Keyswitch State) 36 Configuring Network Addresses 39 SP Network Address Options 39 ? Disable or Re-Enable Network Access to the SP 40 ? Display the DHCP Server IP Address 40 ? Display the IP Address of the SP 41 ? Display the Host MAC Address 42 Using an In-band Connection to the SP 43 Oracle ILOM In-band (Sideband) Management 43 ? Configure SP In-band (Sideband) Access 44 Configuring Boot Mode 47 Boot Mode Overview 47 ? Configure the Host Boot Mode (Oracle VM Server for SPARC) 48 ? Change the Host Boot Mode Behavior at Reset 49 ? Manage the Host Boot Mode Script 50 ? Display Host Boot Mode Expiration Date 51 ? Override OBP Settings to Reset the Server 51 Configuring Server Behavior at Restart 53 ? Specify Behavior When the Host Resets 53 ? Specify Behavior When the Host Stops Running 54 ? Set the Boot Timeout Interval 54 ? Specify Behavior at Boot Timeout 55 ? Specify Behavior if Restart Fails 55 ? Specify Maximum Restart Attempts 56 Configuring Devices 57 ? Unconfigure a Device Manually 57vi SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Reconfigure a Device Manually 57 Monitoring the Server 59 Monitoring Faults 59 Diagnostics Overview 59 ? Discover Faults (Oracle ILOM) 61 ? Discover Faults (Oracle ILOM Fault Management Shell) 61 ? Discover Faults Using POST 63 ? Display Console History 63 ? Repair a Fault (Oracle ILOM Fault Management Shell) 65 ? Clear a Fault 66 Enabling Automatic System Recovery 67 Automatic System Recovery Overview 67 ? Enable ASR 68 ? Disable ASR 68 ? View Information on Components Affected by ASR 69 ? Display Server Components 69 ? Locate the Server 70 Updating the Firmware 73 ? Display the Firmware Version 73 ? Update the Firmware 73 ? Display OpenBoot Version 76 ? Display POST Version 76 Identifying WWN-Designated SAS2 Devices 79 World Wide Name Syntax 79 Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command) 80 probe-scsi-all WWN Mapping Overview 81Contents vii probe-scsi-all WWN Mapping Example (SPARC T4-1) 82 probe-scsi-all WWN Mapping Example (Netra SPARC T4-1) 85 probe-scsi-all WWN Mapping Example (SPARC T4-2) 88 probe-scsi-all WWN Mapping Example (Netra SPARC T4-2) 91 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs) 93 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs) 96 probe-scsi-all WWN Mapping Example (SPARC T4-1B and Netra SPARC T4-1B) 99 ? Identify a Disk Slot Using prtconf (Oracle Solaris OS) 102 WWN Syntax in an OS Installation on an Individual Drive 105 WWN Syntax in an OS Installation on a RAID Volume 106 Glossary 109 Index 115viii SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011ix Using This Documentation This administration guide is for system administrators of servers in the Oracle SPARC T4 server series. The guide includes general descriptive information about the server, and detailed instructions for configuring and administering the server. To use the information in this document, you must have working knowledge of computer network concepts and terms, and advanced familiarity with the Oracle Solaris Operating System (Oracle Solaris OS). Note – The SPARC T4 Series Servers Administration Guide applies to several server and server module products. Specific examples used in this document are based on one of these servers. Your output may vary from the examples based on your product. ¦ “Related Documentation” on page ix ¦ “Feedback” on page x ¦ “Support and Accessibility” on page x Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T4-1 Server http://www.oracle.com/pls/topic/lookup?ctx=E19836-01&id= homepagehttp://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1x SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Oracle ILOM 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle Solaris OS and other systems software http://www.oracle.com/technetwork/indexes/documentation/index.ht ml#sys_sw Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0 Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html Documentation Links1 Understanding System Administration Resources These topics provide a summary of common tools used to administer the server. ¦ “Oracle ILOM Overview” on page 1 ¦ “Platform-Specific Oracle ILOM Features” on page 2 ¦ “Oracle Solaris OS Overview” on page 3 ¦ “OpenBoot Overview” on page 4 ¦ “Oracle VM Server for SPARC Overview” on page 4 ¦ “Multipathing Software” on page 5 ¦ “Hardware Management Pack Overview” on page 6 Oracle ILOM Overview Oracle Integrated Lights Out Manager (Oracle ILOM) is system management firmware that is preinstalled on some SPARC servers. Oracle ILOM enables you to actively manage and monitor components installed in your server. Oracle ILOM provides a browser-based interface and a command-line interface, as well as SNMP and IPMI interfaces. The ILOM service processor runs independently of the server and regardless of the server power state as long as AC power is connected to the server (or to the modular system that contains the server module). When you connect your server to AC power, the ILOM service processor immediately starts up and begins monitoring the server. All environmental monitoring and control are handled by Oracle ILOM. The -> prompt indicates that you are interacting with the Oracle ILOM SP directly. This prompt is the first prompt you see when you log in to the server through the SER MGT port or NET MGT port, regardless of the host’s power state. On a modular system, that prompt is also present when you log in to a server module either directly or through Oracle ILOM on the CMM of the modular system.2 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 You can also access the ILOM service processor prompt (->) from the OpenBoot ok prompt, or from the Oracle Solaris # or % prompt, provided the system console is configured to be accessible through the SER MGT and NET MGT ports. The ILOM service processor supports a total of ten concurrent sessions per server: nine SSH or web connections are available through the NET MGT port and one connection is available through the SER MGT port. For more information about how to work with Oracle ILOM features that are common to all platforms managed by Oracle ILOM, see the Oracle ILOM documentation at: http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Related Information ¦ “Platform-Specific Oracle ILOM Features” on page 2 ¦ “Log In to Oracle ILOM” on page 9 Platform-Specific Oracle ILOM Features Oracle ILOM operates on many platforms, supporting features that are common to all platforms. Some Oracle ILOM features belong to only a subset of platforms. This topic describes the difference between Oracle ILOM features supported on the SPARC T4 series servers and the common set of features described in the Oracle ILOM 3.0 base documentation. Note – To perform some procedures documented in Oracle’s ILOM 3.0 base documentation, you must create a serial connection to the server and activate the Physical Presence switch on the server. For information about creating a serial connection, see the installation guide for your server. Among the Oracle ILOM features supported on other platforms, Oracle ILOM does not support the following features on the SPARC T4 rack-mount servers: ¦ Chassis monitoring module (CMM) features, such as single signon. Note - T4 blade servers in a modular system do support the CMM features. Note – The T4-1B blade servers in a modular system do support the CMM features. ¦ The POST diagnostics user-reset trigger is not available.Understanding System Administration Resources 3 Oracle ILOM supports the following feature on this server, which may not be available on other platforms: ¦ POST diagnostics hw-change trigger. This new trigger (hw-change error-reset) is the default setting for the server, and causes POST to run each time the server is AC power-cycled, or the top cover is removed (if applicable). For more information on POST, see the service manual for your server. Related Information ¦ “Oracle ILOM Overview” on page 1 Oracle Solaris OS Overview The Oracle Solaris OS includes commands and other software resources to use for server administration. For an introduction to management tools in your Oracle Solaris release, see System Administration Guide: Basic Administration in the Oracle Solaris documentation collection. Oracle Solaris software includes SunVTS software. SunVTS tests and validates Oracle hardware by verifying the connectivity and functionality of hardware devices, controllers and peripherals. In addition to the SunVTS information in the Oracle Solaris documentation, SunVTS documentation collections are available at: http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id= homepagehttp://www.oracle.com/pls/topic/lookup?ctx=E19719-01 Related Information ¦ “OpenBoot Overview” on page 4 OpenBoot Overview The OpenBoot firmware starts the OS, validates installed hardware, and can be used for other server administration tasks below the OS level. For more information about OpenBoot commands, see the OpenBoot 4.x Command Reference Manual in the Oracle Solaris documentation collection.4 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “Oracle Solaris OS Overview” on page 3 Oracle VM Server for SPARC Overview A logical domain is a discrete logical grouping with its own operating systems, resources, and identity within a single computer system. Application software can run in logical domains. Each logical domain can be created, destroyed, reconfigured, and rebooted independently. Oracle VM Server for SPARC software enables you to create and manage as many as 32 logical domains, depending on the hardware configuration of the server on which the Oracle VM Server for SPARC Manager has been installed. You can virtualize resources and define network, storage, and other I/O devices as services that can be shared between domains. The Oracle VM Server for SPARC configurations are stored on the SP. Using Oracle VM Server for SPARC CLI commands, you can add a configuration, specify a configuration to be used, and list the configurations on the SP. You can also use the Oracle ILOM set /HOST/bootmode config=configfile command to specify an Oracle VM Server boot configuration. Related Information ¦ “Configuring Boot Mode” on page 47 ¦ Oracle VM Server for SPARC documentation http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html Multipathing Software Multipathing software enables you to define and control redundant physical paths to I/O devices such as storage devices and network interfaces. If the active path to a device becomes unavailable, the software can automatically switch to an alternate path to maintain availability. This capability is known as automatic failover. To take advantage of multipathing capabilities, you must configure the server with redundant hardware, such as redundant network interfaces or two host bus adapters connected to the same dual-ported storage array.Understanding System Administration Resources 5 For the SPARC T4 series servers, three different types of multipathing software are available: ¦ Oracle Solaris IP Network Multipathing software provides multipathing and load-balancing capabilities for IP network interfaces. For instructions on how to configure and administer Oracle Solaris IP Network Multipathing, consult the IP Network Multipathing Administration Guide provided with your specific Oracle Solaris release. ¦ VVM software includes a feature called DMP, which provides disk multipathing as well as disk load balancing to optimize I/O throughput. For information about VVM and its DMP feature, refer to the documentation provided with the VERITAS Volume Manager software. ¦ StorageTek Traffic Manager is an architecture fully integrated within the Oracle Solaris OS (beginning with the Oracle Solaris 8 release) that enables I/O devices to be accessed through multiple host controller interfaces from a single instance of the I/O device. For information about StorageTek Traffic Manager, refer to your Oracle Solaris OS documentation. Related Information ¦ “Oracle Solaris OS Overview” on page 3 ¦ “Oracle VM Server for SPARC Overview” on page 4 Hardware Management Pack Overview The Hardware Management Pack (HMP) from Oracle provides tools you can use to manage and configure Oracle servers from the host operating system. To use these tools, you must install the HMP software on your server. After installing the software, you will be able to perform the following server management tasks described in the following table.6 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 TABLE: Hardware Management Pack -- Server Managment Tasks Server Management Task From Host OS* * Supported host operating systems include: Oracle Solaris, Linux, Windows, and VMware Hardware Management Pack Implementation Tool Monitor Oracle hardware with host IP address Use the Hardware Management Agent and the associated Simple Network Management Protocol (SNMP) plug-ins at the operating-system level to enable in-band monitoring of your Oracle hardware. This in-band monitoring functionality enables you to use your host operating system IP address to monitor your Oracle servers without the need of connecting the Oracle ILOM management port to your network. Host OS-level management tool Monitor storage devices, including RAID arrays Use the Server Storage Management Agent at the operating-system level to enable in-band monitoring of the storage devices configured on your Oracle servers. The Server Storage Management Agent provides an operating-system daemon that gathers information about your server’s storage devices, such as hard disk drives (HDDs) and RAID arrays, and sends this information to the Oracle ILOM SP. The Storage Monitoring features in Oracle ILOM enable you to view and monitor the information provided by the Server Storage Management Agent. You can access the Storage Monitoring features in Oracle ILOM from the command-line interface (CLI). Oracle ILOM 3.0 CLI Storage Monitoring features Query, update, and validate firmware versions on supported SAS storage devices Use the fwupdate CLI tool from the host operating system to query, update, and validate firmware versions on supported storage devices such as SAS host bus adapters (HBAs), embedded SAS storage controllers, LSI SAS storage expanders, and disk drives. Host OS-level fwupdate CLI Restore, set, and view Oracle Oracle ILOM configuration settings Use the ilomconfig CLI tool from the host operating system to restore Oracle ILOM configuration settings,as well as to view and set Oracle ILOM properties associated with network management, clock configuration, and user management. Host OS-level ilomconfig CLI View or create RAID volumes on storage drives Use the raidconfig CLI tool from the host operating system to view and create RAID volumes on storage drives that are attached to RAID controllers, including storage arrays. Host OS-level raidconfig CLI Use IPMItool to access and manage Oracle servers Use the open source command-line IPMItool from the host operating system to access and manage your Oracle servers via the IPMI protocol. Host OS-level command-line IMPItoolUnderstanding System Administration Resources 7 Source for Downloading Hardware Management Pack Software You can download the Hardware Management Pack software from the following location: http://support.oracle.com Hardware Management Pack Documentation You can download Hardware Management Pack documentaton from the following location: http://www.oracle.com/pls/topic/lookup?ctx=ohmp For additional details about how to use the Storage Monitoring features in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide and the Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management CLI Procedures Guide. For additional details about accessing and managing your server via SNMP or IPMI, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 SNMP, IPMI, CIM, WSMAN, Protocol Management Reference. Links to these Oracle ILOM manuals are provided on the web site shown above. You can find the complete set of Oracle ILOM documentation at this location: http://www.oracle.com/pls/topic/lookup?ctx=ilom308 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 20119 Accessing the Server These topics include information on establishing low-level communication with the server using the Oracle ILOM tool and the system console. ¦ “Log In to Oracle ILOM” on page 9 ¦ “Log In to the System Console” on page 10 ¦ “Display the ok Prompt” on page 11 ¦ “Display the Oracle ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “Oracle ILOM Remote Console” on page 14 ? Log In to Oracle ILOM This procedure assumes the default configuration of the SP as described in your server’s installation guide. Note – For a SPARC T4 server module, you can either log in directly to the modular server’s SP or you can start Oracle ILOM through the chassis’ CMM. Refer to the modular server’s installation guide for instructions on both approaches.10 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Open an SSH session and connect to the SP by specifying its IP address. The Oracle ILOM default username is root and the default password is changeme. You are now logged in to Oracle ILOM. Perform tasks as needed. Note – To provide optimum server security, change the default server password. Related Information ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to the System Console” on page 10 ? Log In to the System Console ? At the Oracle ILOM -> prompt, type: where option can be: ¦ -f|force – Enables a user with a Console (c) role to take the console from any current user and force that user into view mode. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.16.3 r66969 Copyright 2011 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accessing the Server 11 ¦ -script – Bypasses prompt for a yes or no confirmation. Note – If the Oracle Solaris OS is not running, the server displays the ok prompt. Related Information ¦ “Display the Oracle ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “Log In to Oracle ILOM” on page 9 ? Display the ok Prompt This procedure assumes the default system console configuration. ? Choose the appropriate shutdown method from the following table to reach the ok prompt. Note – To ensure getting to the ok prompt, set the following Oracle ILOM property before performing the procedures below: -> set /HOST/bootmode script=”setenv auto-boot? false” Caution – When possible, reach the ok prompt by performing a graceful shutdown of the OS. Any other method used might result in the loss of server state data.12 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “Monitoring Faults” on page 59 ? Display the Oracle ILOM -> Prompt ? Use one of the following ways to display the Oracle ILOM -> prompt: ¦ From the system console, type the Oracle ILOM escape sequence (#.). ¦ Log in to Oracle ILOM directly from a device connected to the SER MGT port or NET MGT port. ¦ Log in to Oracle ILOM through an SSH connection. See “Log In to Oracle ILOM” on page 9. Server State What To Do OS running and responsive Shut down the server beginning at the host prompt: From a shell or command tool window, type an appropriate command (for example, the shutdown or init 0 command) as described in the Oracle Solaris system administration documentation. Then take one of the following steps: • At the Oracle ILOM prompt, type: -> stop /SYS • Use the server Power button. OS unresponsive Disable autoboot and thereset the host. (Provided the operating system software is not running and the server is already under OpenBoot firmware control.) At the Oracle ILOM prompt, type: -> set /HOST send_break_action=break Press Enter. Then type: -> start /HOST/console OS unresponsive and need to prevent auto-boot Shut down the server from Oracle ILOM and disable autoboot. At the Oracle ILOM prompt, type: -> set /HOST/bootmode script=”setenv auto-boot? false” Press Enter. Then type: -> reset /SYS -> start /HOST/consoleAccessing the Server 13 Related Information ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to Oracle ILOM” on page 9 ? Use a Local Graphics Monitor You can redirect the system console to a local graphic monitor. You cannot use a local graphics monitor to perform the initial server installation, nor can you use a local graphics monitor to view POST messages. To use a local graphics monitor: 1. Connect the monitor video cable to a video port on the server. Tighten the thumbscrews to secure the connection. Refer to your system’s documentation for any special connection instructions that might apply to your server. 2. Connect the monitor power cord to an AC outlet. 3. Connect the USB keyboard cable to one USB port. 4. Connect the USB mouse cable to another USB port on the server. 5. Display the ok prompt. See “Display the ok Prompt” on page 11. 6. At the ok prompt, set the following OBP configuration variables: 7. Make the changes take effect: The server stores the parameter changes and boots automatically. Note – Instead of using the reset-all command to store the parameter changes, you can also power cycle the server using the Power button. You can now type system commands and view system messages using your local graphics monitor. To activate the GUI interface, continue to the next step. ok setenv input-device keyboard ok setenv output-device screen ok reset-all14 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 8. Activate the Oracle Solaris OS GUI interface. Once the Oracle Solaris OS is installed and booted, type the following commands to display the GUI login screen. Related Information ¦ “Display the ok Prompt” on page 11. ¦ “Oracle ILOM Remote Console” on page 14 Oracle ILOM Remote Console Oracle ILOM Remote Console is a Java application that enables you to remotely redirect and control the following devices on the host server. This group of devices is commonly abbreviated as KVMS. ¦ Keyboard ¦ Video console display ¦ Mouse ¦ Serial console display ¦ Storage devices or images (CD/DVD) Oracle ILOM Remote Console is documented in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management Web Interface Procedures Guide (”Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console”). Related Information ¦ “Oracle ILOM In-band (Sideband) Management” on page 43 # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # reboot15 Controlling the Server These topics include procedures for contolling basic server operations. ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Reset the SP to Default Values” on page 18 ? Power On the Server (Oracle ILOM) 1. Log in to Oracle ILOM. “Log In to Oracle ILOM” on page 9. Note – If you have a modular system, make sure you are logged in to the desired server module. 2. At the Oracle ILOM -> prompt, type: Note – To skip being prompted for confirmation, use the start -script /SYS command. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->16 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Power Off the Server (Oracle ILOM) 1. Shut down the Oracle Solaris OS. At the Oracle Solaris prompt, type: 2. Switch from the system console prompt to the SP console prompt. 3. From the Oracle ILOM -> prompt, type: Note – To perform an immediate shutdown, use the stop -force -script /SYS command. Ensure that all data is saved before typing this command. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 106 system services are now being stopped. Sep 12 17:52:11 bur381-14 syslogd: going down on signal 15 svc.startd: The system is down. syncing file systems...done Program terminated SPARC T4-1, No Keyboard Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved. OpenBoot 4.33.1, 32256 MB memory available, Serial #95593628. Ethernet address 0:21:28:b2:a4:9c, Host ID: 85b2a49c. {0} ok {0} ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Controlling the Server 17 Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Reset the Server (Oracle Solaris OS) It is not necessary to power the server off and on to perform a reset. ? To reset the server from the Oracle Solaris prompt, type one of the following commands: or Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle ILOM)” on page 17 ? Reset the Server (Oracle ILOM) The Oracle ILOM reset command generates a graceful or forced hardware reset of the server. By default, the reset command gracefully resets the server. ? Type one of the following commands to reset the server. ¦ Perform a graceful reset from Oracle ILOM: # shutdown -g0 -i6 -y # reboot -> reset /SYS18 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ If a graceful reset is not possible, perform a forced hardware reset from Oracle ILOM: Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Override OBP Settings to Reset the Server” on page 51 ? Reset the SP to Default Values If your SP becomes corrupt, or you want to reset the SP to the factory default values, change the /SP reset_to_defaults setting then power off the host to implement the changes. This is new behavior. Previously you did not have to power off the host to reset default values to the SP. You need administrator permissions to perform this task. 1. To reset the SP to the default values, type: where value can be: ¦ all – Removes all of the SP configuration data. ¦ factory – Removes all SP configuration data as well as all log files. 2. Power off and restart the host to complete the setting change. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> reset -force /SYS -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP19 Configuring Hardware RAID These topics describe how to configure and manage RAID disk volumes using the server’s onboard SAS-2 disk controller. ¦ “Hardware RAID Support” on page 19 ¦ “Prepare to Use the FCode Utility” on page 21 ¦ “Create a Hardware RAID Volume” on page 23 ¦ “Hot Spare Drives in RAID Volumes (LSI)” on page 24 ¦ “Determining If a Drive Has Failed” on page 25 ¦ “RAID Drive Replacement Strategies” on page 27 ¦ “Locate Device Paths” on page 28 Hardware RAID Support SPARC T4 series servers contain onboard SAS2 RAID controllers, which enable the formation of logical disk volumes consisting of two or more redundant disk drives. These controllers support the following RAID levels: ¦ RAID 0 -- Data striping ¦ RAID 1 -- Data mirroring (using two disks) ¦ RAID 1e -- Enhanced mirroring (using three to eight disks) Data striping refers to the technique of distributing data files across multiple disks so that storage and retrieval can be done in parallel over multiple data channels. Striping data can significantly enhance data storage operations. Data mirroring refers to the technique of storing identical copies of data on separate disks. Mirroring critical data reduces the risk of data loss by maintaining duplicate instances of the data.20 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Note – The SPARC T4-1 server has two onboard RAID controllers. SPARC T4-2 has a single onboard RAID controller. The SPARC T4-1B modular server has a single pluggable RAID Expansion Module (REM). The SPARC T4-4 server has two pluggable RAID Expansion Modules (REMs). Up to two logical volumes can be configured on each onboard RAID controller. This means up to four volumes can be created on a SPARC T4-1 server. You can choose from among three environments for creating and managing the RAID resources in your server. ¦ Fcode utility -- This utility consists of a set of special commands to display targets and manage logical volumes on your server. You access these commands through the OBP environment. The examples shown in this manual rely on Fcode commands. ¦ LSI SAS2 2008 RAID Management Utility for SPARC T4 servers -- You can use the sas2ircu commands contained in the LSI SAS2 Integrated Configuration Utility to configure and manage RAID volumes on your server. To use the sas2ircu command set, download and install the SAS2IRCU software from the following location: http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Oracle Hardware Management Pack 2.2 -- You can use the raidconfig commands contained in this software’s Oracle Server CLI Tools component to create and manage RAID volumes on your server. To use these commands, download and install the latest version of the Oracle Hardware Management Pack. Refer to the Oracle Hardware Management Pack 2.2 Installation Guide for instructions. You can find documentation for the Oracle Hardware Management Pack 2.2 software at this location: http://www.oracle.com/pls/topic/lookup?ctx=mgtpk22 Tip – Some Hardware Management Pack 2.2 commands may have long startup or execution latencies on SPARC T4-2 and T4-4 servers. In such cases, you may prefer to use the Fcode or LSI sas2ircu commands. Related Information ¦ “Create a Hardware RAID Volume” on page 23 ¦ “Prepare to Use the FCode Utility” on page 21Configuring Hardware RAID 21 Important Hardware RAID Guidelines The following points are important to understand when configuring RAID volumes on a SPARC T4-1 server: ¦ Before configuring and using RAID disk volumes on a SPARC T4-1 server, ensure that you have installed the latest patches for your operating system from here: https://pkg.oracle.com/solaris/support ¦ Volume migration (relocating all RAID volume disk members from one T4-1 server to another) is not supported. If you must perform this operation, contact your authorized Oracle service provider. Caution – When you create a RAID volume using the on-board disk controllers, all data currently on the disksyou include in the volume will be lost. ? Prepare to Use the FCode Utility Perform the following procedure from an xterm or an equivalent terminal window that supports scrolling. Note – FCode commands produce large amounts of detailed output. An xterm and gnome terminal windows provide scroll bar functionality, which helps view such output. 1. Either apply power to the system or reset the system if power is already present and disable auto-boot in OBP. See “Display the ok Prompt” on page 11. 2. Enter the OBP environment. 3. Use the show-devs command to list the device paths on the server. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ...22 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Note – For a server module, the device path might be /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. Use the select command to choose the controller where you want to create a hardware RAID volume. Instead of using the entire device path for the controller, you can use a preconfigured alias for a controller. For example: To view the preconfigured aliases on your server, use the devalias command. See “Locate Device Paths” on page 28. Display the SAS addresses of any connected drives using the show-children command. Related Information ¦ “FCode Utility Commands” on page 22 ¦ “Display the ok Prompt” on page 11 FCode Utility Commands {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi0 FCode Command Description show-children Lists all connected physical drives and logical volumes. show-volumes Lists all connected logical volumes in detail. create-raid0-volume Creates a RAID 0 volume (minimum two targets). create-raid1-volume Creates a RAID 1 volume (exactly two targets). create-raid1e-volume Creates a RAID 1e volume (minimum three targets). delete-volume Deletes a RAID volume. activate-volume Re-activate a RAID volume after disks have been replaced.Configuring Hardware RAID 23 Related Information ¦ “Create a Hardware RAID Volume” on page 23 ¦ “Prepare to Use the FCode Utility” on page 21 ? Create a Hardware RAID Volume 1. Prepare to create a RAID volume. See “Prepare to Use the FCode Utility” on page 21. 2. Use the show-children command to list the physical drives on the selected controller. {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok24 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 3. Use the create-raid0-volume, create-raid1-volume, or create-raid1e-volume command to create a logical drive from the physical disks. For example, to create a RAID 0 volume with targets 9 and a, type the targets first then type the create command: For example, to create a RAID 1e volume with targets a, b, and c, type: 4. To verify creation of the volume, type: 5. Type unselect-dev to deselect the controller. Related Information ¦ “FCode Utility Commands” on page 22 ¦ “Display the ok Prompt” on page 11 Hot Spare Drives in RAID Volumes (LSI) You can configure two global hot spare drives to protect data on mirrored RAID volumes. If one of the drives in a RAID 1 or RAID 1E mirrored volume fails, the onboard RAID controller will replace the failed drive automatically with a hot spare drive and then resynchronize the mirrored data. Use the sas2ircu LSI utility to add global hot spare drives or HMP. Refer to the SAS2 Integrated RAID Solution User Guide for more information about adding hot spare drives. {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volume {0} ok show-volumes {0} ok unselect-devConfiguring Hardware RAID 25 Determining If a Drive Has Failed These topics explain various ways to determine if a drive contained in a RAID volume has failed: ¦ “Service Required Drive LEDs” on page 25 ¦ “Error Messages (System Console and Log Files)” on page 25 ¦ “Display Status (show-volumes Command, OBP)” on page 26 ¦ “Display Status (sas2ircu Utility, LSI)” on page 27 Service Required Drive LEDs When a fault occurs on a drive in a SPARC T4 system, the amber Service Required LED will light on the front of the drive. This amber LED will allow you to locate the faulted drive in the system. Additionally, the front and rear panel Service Action Required LEDs also light when the system detects a hard drive fault. Refer to your service manual for the location and description of these LEDs. Error Messages (System Console and Log Files) When a fault occurs on a drive, error messages will be displayed on the system console. This is an example of a system console display indicating that volume 905 has been degraded with the loss of PhysDiskNum 1: Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degraded Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded26 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 You can also view these messages by reviewing the /var/adm/messages files: Refer to the View the System Message Log Files topic in your service manual for more information about examining these messages. ? Display Status (show-volumes Command, OBP) You can halt the system and use the show-volumes OBP command to determine if a drive has failed. 1. Halt the system and display the OBP ok prompt. See “Display the ok Prompt” on page 11. 2. Select the SAS controller device. See “Prepare to Use the FCode Utility” on page 21 for more information. # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded ok select /pci@400/pci@2/pci@0/pci@e/scsi@0Configuring Hardware RAID 27 3. Type the show-volumes command to display the RAID volumes and their associated disks. In the following example, the secondary disk in a RAID 1 volume is offline. 4. Type the unselect-dev command to deselect the SAS controller device. ? Display Status (sas2ircu Utility, LSI) ? Use the LSI sas2ircu utility to display the status of the RAID volume and its associated drives. Refer to the SAS2 Integrated RAID Solution User Guide for more information about displaying and interpreting device status using the sas2ircu utility. RAID Drive Replacement Strategies Follow the strategies described below when replacing a failed drive in a RAID volume. ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-dev RAID Volume Level Strategy RAID 0 If a drive fails in a RAID 0 volume, you will lose all data on that volume. Replace the failed drive with a new drive of the same capacity, recreate the RAID 0 volume, and restore the data from a backup.28 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Note – The cfgadm instructions in the service manual are for individual drives that are not part of RAID volumes. When a drive is part of a RAID volume, you do not need to unconfigure it before hot swapping it with a new drive. ? Locate Device Paths Use this procedure to locate device paths specific to your server. 1. Display the ok prompt. See “Display the ok Prompt” on page 11. 2. From the ok prompt, type: Note – This example represents devalias output for a sample T4-x server. The specific devices displayed will differ for different products. RAID 1 Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume. RAID 1E Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume. {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 RAID Volume Level StrategyConfiguring Hardware RAID 29 Related Information ¦ “Display the ok Prompt” on page 11 ¦ “Prepare to Use the FCode Utility” on page 21 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok30 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 201131 Changing Server Identification Information These topics describe how to store information (for purposes such as inventory control or site resource management) on the SP and FRU PROMs using the Oracle ILOM CLI interface. ¦ “Change Customer Data on FRU PROMs” on page 31 ¦ “Change System Identifier Information” on page 32 ? Change Customer Data on FRU PROMs Use the /SP customer_frudata property to store information in all FRU PROMs. This field can be used to identify a particular system to a third-party application, or for any other identifcation needs in your environment. ? At the Oracle ILOM -> prompt, type: Note – You must enclose the data string (data) in quote marks. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Change System Identifier Information” on page 32 -> set /SP customer_frudata=”data”32 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Change System Identifier Information Use the /SP system_identifier property to store customer identification information. This string is encoded in all trap messages generated by SNMP. Assigning a unique system identifier can be useful in distinguishing which system generates which SNMP message. ? At the Oracle ILOM -> prompt, type: Note – The data string (data) must be enclosed in quote marks. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Change Customer Data on FRU PROMs” on page 31 -> set /SP system_identifier=”data”33 Configuring Policy Settings These topics describe managing configuration policies using Oracle ILOM. ¦ “Specify Cooldown Mode” on page 33 ¦ “Restore the Host Power State at Restart” on page 34 ¦ “Specify the Host Power State at Restart” on page 34 ¦ “Disable or Re-Enable the Host Power-On Delay” on page 35 ¦ “Specify Parallel Boot of the SP and Host” on page 36 ¦ “Configure Host Behavior (Keyswitch State)” on page 36 ? Specify Cooldown Mode Some SPARC T4 systems support the host cooldown mode, but not all. Setting the HOST_COOLDOWN property to enabled causes the server to enter cooldown mode while the host is powering off. The cooldown mode directs Oracle ILOM to monitor certain components to ensure that they are below a minimum temperature so as not to cause harm to the user if internal components are accessed. Once the components are below the threshold temperature, power is removed from the server, which allows the cover interlock switch to release. If the monitored temperatures take longer than 4 minutes to reach the threshold, the host tuns off. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – Server cools certain components before powering off. ¦ disabled – Component temperatures are not monitored during power off. Related Information ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> set /SP/policy HOST_COOLDOWN=value34 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Restore the Host Power State at Restart Use the /SP/policy HOST_LAST_POWER_STATE property to control the behavior of the server after an unexpected power outage. When external power is restored, the Oracle ILOM SP starts to run automatically. Normally, the host power is not turned on until you use Oracle ILOM to turn it on. Oracle ILOM records the current power state of the server in nonvolatile storage. If the HOST_LAST_POWER_STATE policy is enabled, Oracle ILOM can restore the host to the previous power state. This policy is useful in the event of a power failure, or if you physically move the server to a different location. For example, if the host server is running when power is lost and the /SP/policy HOST_LAST_POWER_STATE property is set to disabled, the host server remains off when power is restored. If the /SP/policy HOST_LAST_POWER_STATE property is set to enabled, the host server restarts when the power is restored. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – When power is restored, returns the server to the state it was in before the power was removed. ¦ disabled – Keeps the server off when power is applied (the default). If you enable HOST_LAST_POWER_STATE, you should also configure /SP/policy HOST_POWER_ON_DELAY. For further information, see “Disable or Re-Enable the Host Power-On Delay” on page 35. Related Information ¦ “Disable or Re-Enable the Host Power-On Delay” on page 35 ¦ “Specify the Host Power State at Restart” on page 34 ? Specify the Host Power State at Restart Use /SP/policy HOST_AUTO_POWER_ON to power on the host when external power is applied to the server. If this policy is set to enabled, the SP sets HOST_LAST_POWER_STATE to disabled. -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguring Policy Settings 35 ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – When power is applied, automatically powers on the host when the SP has been booted. ¦ disabled – Keeps the host power off when power is applied (the default). Related Information ¦ “Restore the Host Power State at Restart” on page 34 ¦ “Disable or Re-Enable the Host Power-On Delay” on page 35 ? Disable or Re-Enable the Host Power-On Delay Use the /SP/policy HOST_POWER_ON_DELAY property to cause the server to wait for a short time before powering on automatically. The delay is a random interval of one to five seconds. Delaying the server power on helps minimize current surges on the main power source. This power-on delay is important when multiple servers in racks power on after a power outage. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – Causes the server to wait for a short time before powering on automatically. ¦ disabled – Server powers on automatically without a delay (the default). Related Information ¦ “Specify the Host Power State at Restart” on page 34 -> set /SP/policy HOST_AUTO_POWER_ON=value -> set /SP/policy HOST_POWER_ON_DELAY=value36 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Specify Parallel Boot of the SP and Host The /SP/policy PARALLEL_BOOT property, when enabled, allows the host to boot and power on in parallel with the SP if an auto-power policy (HOST_AUTO_POWER_ON or HOST_LAST_POWER_STATE) was on or a user presses the power button while the SP is in the process of booting. Oracle ILOM has to be running in order to allow the host to power on when the power button is pressed or the the auto-power policies are set. When this property is set to disabled, the SP boots first, then the host boots. Note – Parallel boot is not supported on server modules. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled – SP and host boot concurrently. ¦ disabled – SP and host boot serially. Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 ? Configure Host Behavior (Keyswitch State) Use the /SYS keyswitch_state property to control the position of the virtual keyswitch. -> set /SP/policy PARALLEL_BOOT=valueConfiguring Policy Settings 37 ? At the Oracle ILOM -> prompt, type: where value can be: ¦ normal – The server can power itself on and start the boot process (the default). ¦ standby – Powers off host, disables power on. ¦ diag – Host power on is allowed, it overrides the settings of /HOST/diag target, resulting in Max POST being executed. ¦ locked – Host power on is allowed, however, you are prohibited from updating flash devices or setting /HOST send_break_action=break. Related Information ¦ “Power On the Server (Oracle ILOM)” on page 15 ¦ “Power Off the Server (Oracle ILOM)” on page 16 -> set /SYS keyswitch_state=value38 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 201139 Configuring Network Addresses These topics describe managing network addresses with Oracle ILOM. ¦ “SP Network Address Options” on page 39 ¦ “Disable or Re-Enable Network Access to the SP” on page 40 ¦ “Display the DHCP Server IP Address” on page 40 ¦ “Display the IP Address of the SP” on page 41 ¦ “Display the Host MAC Address” on page 42 ¦ “Using an In-band Connection to the SP” on page 43 SP Network Address Options You can access the SP on your system in multiple ways. Consider the following options and choose the access method that is best for your environment. You can physically connect to the SP using a serial connection or a network connection. The network connection can be configured to use a static IP address or DHCP (the default). Optionally, the T4 Series servers can use an in-band network connection to the SP, rather than the default out-of-band NET MGT port. For more information on each option, see the following documentation: ¦ To use a serial connection to the SP, see: Connect a Terminal or Emulator to the SER MGT Port, in the installation guide for your server or Communicating With the Server Module During Startup in the installation guide for your server module. ¦ To assign a static IP address to the SP, see: Assign a Static IP Address to the SP, in the installation guide for your server. ¦ To use an in-band connection to the SP, see: “Oracle ILOM In-band (Sideband) Management” on page 4340 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation ¦ “Oracle ILOM Overview” on page 1 ¦ “Log In to Oracle ILOM” on page 9 ? Disable or Re-Enable Network Access to the SP Use the /SP/network state property to enable or disable the SP’s network interface. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ enabled (the default) ¦ disabled Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “SP Network Address Options” on page 39 ? Display the DHCP Server IP Address To display the IP address of the DHCP server that provided the dynamic IP address requested by the SP, view the dhcp_server_ip property. ? At the Oracle ILOM -> prompt, type: -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguring Network Addresses 41 Note – The list of properties might vary based on your server. Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Display the Host MAC Address” on page 42 ? Display the IP Address of the SP To display the IP address of the SP, view the ipaddress property. ? At the Oracle ILOM -> prompt, type: ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 <--- DHCP server ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show -> show /SP/network /SP/network Targets:42 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Display the Host MAC Address The /HOST macaddress property is automatically configured by the server software, so you cannot set or change the property. The value is read and determined from the server’s removable system configuration card (SCC PROM) or from the server module’s ID PROM and then stored as a property in Oracle ILOM. /HOST macaddress is the MAC address for the net0 port. The MAC addresses for each additional port increments from the /HOST macaddress. For example, net1 is equal to the value of /HOST macaddress plus one (1). ? At the Oracle ILOM -> prompt, type: interconnect ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 <--- IP address of SP ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show -> show /HOST macaddressConfiguring Network Addresses 43 Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Display the DHCP Server IP Address” on page 40 Using an In-band Connection to the SP These topics describe how to use an in-band, or sideband connection, to the SP. ¦ “Oracle ILOM In-band (Sideband) Management” on page 43 ¦ “Configure SP In-band (Sideband) Access” on page 44 Oracle ILOM In-band (Sideband) Management By default, you connect to the server’s SP using the out-of-band NET MGT port. The Oracle ILOM sideband management feature enables you to select either the NET MGT port or one of the server’s Gigabit Ethernet ports (NETn), which are in-band ports, to send and receive Oracle ILOM commands to and from the server SP. In-band ports are also called sideband ports. The advantage of using a sideband management port to manage the server’s SP is that one fewer cable connection and one fewer network switch port are needed. In configurations where numerous servers are being managed, such as data centers, sideband management can represent a significant savings in hardware and network utilization. Note – In-band connection is not recommended for server modules. When sideband management is enabled in Oracle ILOM, the following conditions might occur: ¦ Connectivity to the server SP might be lost when the SP management port configuration is changed while you are connected to the SP using a network connection, such as SSH, web, or Oracle ILOM Remote Console. ¦ In-chip connectivity between the SP and the host operating system might not be supported by the on-board host Gigabit Ethernet controller. If this condition occurs, use a different port or route to transmit traffic between the source and destination targets instead of using L2 bridging/switching.44 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ Server host power cycles might cause a brief interruption of network connectivity for server Gigabit Ethernet ports (NETn) that are configured for sideband management. If this condition occurs, configure the adjacent switch/bridge ports as host ports. Related Information ¦ “Configure SP In-band (Sideband) Access” on page 44 ¦ “SP Network Address Options” on page 39 ? Configure SP In-band (Sideband) Access This procedure describes how to access the SP from an in-band (or sideband) management using a host network port. If you perform this procedure using a network connection, you might lose connectivity to the server. Using a serial connection for this procedure eliminates the possibility of losing connectivity during sideband management configuration changes. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. If you logged in using the serial port, you can assign a static IP address. For instructions, see the information about assigning an IP address in the installation guide for your server. 3. View the current network settings. -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7Configuring Network Addresses 45 4. Set the SP management port to a sideband port. (where n is 0-3). For SPARC T4-1B systems, n is 0-1. For all other systems, n is 0-3. 5. Verify the change. managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set /SP/network commitpending=true -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.046 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “Oracle ILOM In-band (Sideband) Management” on page 43 ¦ “SP Network Address Options” on page 39 pendingmanagementport = /SYS/MB/NET0 sidebandmacaddress = 00:11:3T:80:44:B7 state = enabled Commands: cd set show47 Configuring Boot Mode Use the Oracle ILOM boot mode properties to specify how the host boots when correcting a problem with OpenBoot or Oracle VM Server for SPARC settings. ¦ “Boot Mode Overview” on page 47 ¦ “Configure the Host Boot Mode (Oracle VM Server for SPARC)” on page 48 ¦ “Change the Host Boot Mode Behavior at Reset” on page 49 ¦ “Manage the Host Boot Mode Script” on page 50 ¦ “Display Host Boot Mode Expiration Date” on page 51 ¦ “Override OBP Settings to Reset the Server” on page 51 Boot Mode Overview Boot mode (bootmode) properties enable you to override the default method the server uses when it boots. This ability is useful to override particular OpenBoot or Oracle VM Server settings that might be incorrect, to set up OpenBoot variables using a script, or to perform similar tasks. For example, if the OpenBoot settings have become corrupt, you can set the bootmode state property to reset_nvram then reset the server to its factory default OpenBoot settings. Service personnel might instruct you to use the bootmode script property for problem resolution. The full extent of script capabilities are not documented and exist primarily for debugging. Because bootmode is intended to be used to correct a problem with the OpenBoot or Oracle VM Server settings, the bootmode takes effect for a single boot only. Additionally, to prevent an administrator from setting a bootmode state property and forgetting about it, a bootmode state property expires if the host is not reset within 10 minutes of the bootmode state property being set.48 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “Reset the Server (Oracle Solaris OS)” on page 17 ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “OpenBoot Overview” on page 4 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Configure the Host Boot Mode (Oracle VM Server for SPARC) Note – You must use a valid Oracle VM Server configuration name for this task. 1. Determine the valid Oracle VM Server configurations on your SP, at the Oracle ILOM -> prompt, type: 2. Set the boot mode configuration, at the Oracle ILOM -> prompt, type: where the config property takes a configname value that is a valid named logical domain configuration. For example, if you created a Oracle VM Server configuration called ldm-set1: To return the boot mode config to the factory default configuration, specify factory-default. For example: Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 -> show /HOST/domain/configs -> set /HOST/bootmode config=configname -> set /HOST/bootmode config=ldm-set1 -> set /HOST/bootmode config=factory-defaultConfiguring Boot Mode 49 ¦ “Boot Mode Overview” on page 47 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Change the Host Boot Mode Behavior at Reset The /HOST/bootmode state property controls how OpenBoot NVRAM variables are used. Normally the current settings of these variables are retained. Setting /HOST/bootmode state=reset_nvram changes the OpenBoot NVRAM variables to their default settings at the next reset. ? At the Oracle ILOM -> prompt, type: where value is one of the following: ¦ normal – At next reset, retains current NVRAM variable settings. ¦ reset_nvram – At next reset, returns OpenBoot variables to default settings. Note – state=reset_nvram will return to normal after the next server reset or 10 minutes (see expires property in “Display Host Boot Mode Expiration Date” on page 51). config and script properties do not expire and will be cleared upon the next server reset or manually by setting value to "". Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 47 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode state=value50 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Manage the Host Boot Mode Script ? At the Oracle ILOM -> prompt, type: where script controls the host server OBP firmware method of booting. script does not affect the current /HOST/bootmode setting. value can be up to 64 bytes in length. You can specify a /HOST/bootmode setting and set the script within the same command. For example: After the server resets and OBP reads the values stored in the script, the OBP sets the OBP variable diag-switch? to the user-requested value of true. Note – If you set /HOST/bootmode script="", Oracle ILOM sets the script to empty. Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 47 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"Configuring Boot Mode 51 ? Display Host Boot Mode Expiration Date ? At the Oracle ILOM -> prompt, type: where expires is the date and time when the current boot mode will expire. Related Information ¦ “Reset the Server (Oracle ILOM)” on page 17 ¦ “Boot Mode Overview” on page 47 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Override OBP Settings to Reset the Server Use this procedure to override the OBP settings and initiate reboot of the control domain, which results in the host booting to the ok prompt. ? At the Oracle ILOM -> prompt, type: The host reboots and stops at the ok prompt. Related Information ¦ “Change the Host Boot Mode Behavior at Reset” on page 49 ¦ “Configuring Boot Mode” on page 47 ¦ “Boot Mode Overview” on page 47 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled -> reset /HOST/domain/control [-force] [-script]52 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 201153 Configuring Server Behavior at Restart Use the following procedures to configure how Oracle ILOM should behave during the following restart scenarios. ¦ “Specify Behavior When the Host Resets” on page 53 ¦ “Specify Behavior When the Host Stops Running” on page 54 ¦ “Set the Boot Timeout Interval” on page 54 ¦ “Specify Behavior at Boot Timeout” on page 55 ¦ “Specify Behavior if Restart Fails” on page 55 ¦ “Specify Maximum Restart Attempts” on page 56 ? Specify Behavior When the Host Resets Specify if the host should continue to boot if an error is encountered. ? Set this property: where value can be: ¦ false – The host continues to boot if an error is encountered. ¦ true – The host does not continue to boot if an error is encountered. Related Information ¦ “Configuring Policy Settings” on page 33 -> set /HOST autorunonerror=value54 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Specify Behavior When the Host Stops Running Specify what Oracle ILOM should do when the host leaves the RUNNING state (when the watchdog timer expires). ? Set this property: where value can be: ¦ none – Oracle ILOM takes no action other than to issue a warning. ¦ reset – Oracle ILOM attempts to reset the server when the Oracle Solaris watchdog timer expires (the default). ¦ dumpcore – Oracle ILOM attempts to force a core dump of the OS when the watchdog timer expires. Related Information ¦ “Display Console History” on page 63 ? Set the Boot Timeout Interval ? Set the time delay between a request to boot the host and booting the host: The default value of boottimeout is 0 (zero seconds) or no timeout. Possible values are in the range from 0 to 36000 seconds. Related Information ¦ “Specify Behavior at Boot Timeout” on page 55 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguring Server Behavior at Restart 55 ? Specify Behavior at Boot Timeout Specify what Oracle ILOM should do if the host fails to boot before the boot timeout interval. ? Specify behavior at the completion of boottimeout: where value can be: ¦ none (the default) ¦ reset Related Information ¦ “Set the Boot Timeout Interval” on page 54 ? Specify Behavior if Restart Fails Specify what Oracle ILOM should do if the host fails to reach the Oracle Solaris running state. ? At the Oracle ILOM -> prompt, type: where value can be: ¦ powercycle ¦ poweroff (the default) Related Information ¦ “Specify Maximum Restart Attempts” on page 56 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value56 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? Specify Maximum Restart Attempts Specify how many times Oracle ILOM should attempt to restart the host. ? At the Oracle ILOM -> prompt, type: The default value of maxbootfail is 3 (three attempts). If the host does not boot successfully within the number of tries indicated by maxbootfail, the host is powered off or powercycled (depending upon the setting of bootfailrecovery). In either case, boottimeout is set to 0 (zero seconds), disabling further attempts to restart the host. Related Information ¦ “Specify Behavior if Restart Fails” on page 55 -> set /HOST maxbootfail=attempts57 Configuring Devices These topics contain information about configuring devices in the server. ¦ “Unconfigure a Device Manually” on page 57 ¦ “Reconfigure a Device Manually” on page 57 ? Unconfigure a Device Manually The Oracle ILOM firmware provides a component_state=disabled command, which enables you to unconfigure server devices manually. This command marks the specified device as disabled. Any device marked disabled, whether manually or by the system firmware, is removed from the server’s machine description prior to transfer of control to other layers of system firmware, such as OBP. ? At the Oracle ILOM -> prompt, type: Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Reconfigure a Device Manually” on page 57 ¦ “Display Server Components” on page 69 ¦ “Locate Device Paths” on page 28 ? Reconfigure a Device Manually The Oracle ILOM firmware provides a component_state=enabled command, which enables you to reconfigure server devices manually. Use this command to mark the specified device as enabled. -> set component-name component_state=disabled58 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? At the Oracle ILOM -> prompt, type: Related Information ¦ “Log In to Oracle ILOM” on page 9 ¦ “Unconfigure a Device Manually” on page 57 ¦ “Display Server Components” on page 69 ¦ “Locate Device Paths” on page 28 -> set component-name component_state=enabled59 Monitoring the Server The SPARC T4 series servers provide many ways to indicate faulty behavior, including LEDs, Oracle ILOM, and POST. For specific information about LEDs, and for complete troubleshooting information, refer to the service manual for your server. ¦ “Monitoring Faults” on page 59 ¦ “Enabling Automatic System Recovery” on page 67 ¦ “Display Server Components” on page 69 ¦ “Locate the Server” on page 70 Monitoring Faults These topics contain a summary of diagnostic tools and basic information about finding server faults using pre-OS tools, including Oracle ILOM and POST. For complete troubleshooting information, see the service manual for your server. ¦ “Diagnostics Overview” on page 59 ¦ “Discover Faults (Oracle ILOM)” on page 61 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 61 ¦ “Discover Faults Using POST” on page 63 ¦ “Display Console History” on page 63 ¦ “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 65 ¦ “Clear a Fault” on page 66 Diagnostics Overview You can use a variety of diagnostic tools, commands, and indicators to monitor and troubleshoot a server. See the service manual for your server for complete information about these diagnostic tools:60 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ LEDs – Provide a quick visual notification of the status of the server and of some of the FRUs. ¦ Oracle ILOM – This firmware runs on the SP. In addition to providing the interface between the hardware and OS, Oracle ILOM also tracks and reports the health of key server components. Oracle ILOM works closely with POST and Oracle Solaris Predictive Self-Healing technology to keep the server running even when there is a faulty component. ¦ Power-on self-test – POST performs diagnostics on server components upon server reset to ensure the integrity of those components. POST is configureable and works with Oracle ILOM to take faulty components offline if needed. ¦ Oracle Solaris OS Predictive Self-Healing – This technology continuously monitors the health of the CPU, memory, and other components, and works with Oracle ILOM to take a faulty component offline if needed. The PSH technology enables servers to accurately predict component failures and mitigate many serious problems before they occur. ¦ Log files and command interface – Provide the standard Oracle Solaris OS log files and investigative commands that can be accessed and displayed on the device of your choice. ¦ SunVTS – An application that exercises the server, provides hardware validation, and discloses possible faulty components with recommendations for repair. The LEDs, Oracle ILOM, PSH, and many of the log files and console messages are integrated. For example, when the Oracle Solaris software detects a fault, it displays the fault, and logs it, and passes information to Oracle ILOM, where it is logged. Related Information ¦ “Discover Faults (Oracle ILOM)” on page 61 ¦ “Discover Faults Using POST” on page 63 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 61 ¦ See the server service manual section detecting and managing faultsMonitoring the Server 61 ? Discover Faults (Oracle ILOM) ? At the Oracle ILOM -> prompt, type: This command displays the target, the property, and the value of the fault. For example: Related Information ¦ “Discover Faults Using POST” on page 63 ¦ “Log In to Oracle ILOM” on page 9 ¦ “Locate the Server” on page 70 ¦ “Clear a Fault” on page 66 ¦ “Enabling Automatic System Recovery” on page 67 ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 61 ? Discover Faults (Oracle ILOM Fault Management Shell) The Oracle ILOM Fault Management shell provides a way to use the Oracle Solaris Fault Manager commands (fmadm, fmstat) from within Oracle ILOM, and to view both host and Oracle ILOM faults. 1. To start the captive shell, at the Oracle ILOM -> prompt, type: -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgt/shell (y/n)? y faultmgmtsp>62 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 2. For a list of current server faults, type: Note – If the server detects the replacement of the faulty FRU, the repair does not require a user command, and the fault will be cleared automatically. 3. Discover more information about a specific fault. Find the fault MSG-ID (SPT-8000-DH in the preceeding example), and type it in the Search Knowledge Base search window at http://support.oracle.com. 4. For information on how to repair the fault, see: “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 65. 5. To leave the Fault Management shell and return to Oracle ILOM, type: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Monitoring the Server 63 Related Information ¦ “Oracle Solaris 10 OS Feature Spotlight: Predictive Self Healing” at www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ “Log In to Oracle ILOM” on page 9 ¦ “Discover Faults (Oracle ILOM)” on page 61 ¦ “Repair a Fault (Oracle ILOM Fault Management Shell)” on page 65 ? Discover Faults Using POST The virtual keyswitch can be used to run full POST diagnostics without having to modify the diagnostic property settings. Note that POST diagnostics can take a significant amount of time to run at server reset. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. At the Oracle ILOM -> prompt, type: The server is set to run full POST diagnostics on server reset. 3. To return to your normal diagnostic settings after running POST, at the Oracle ILOM -> prompt, type: Related Information ¦ “Discover Faults (Oracle ILOM)” on page 61 ¦ “Locate the Server” on page 70 ¦ “Clear a Fault” on page 66 ? Display Console History This topic describes displaying the host server console output buffers. -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal64 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 There are two console history buffers that can contain up to 1 Mbyte of information. The /HOST/console/history target writes all types of log information. The /HOST/console/bootlog target writes boot information and initialization data into the console buffer until Oracle ILOM is notified by the server that the Oracle Solaris OS is up and running. This buffer is kept until the host is booted again. Note – You must have Oracle ILOM Administrator level user permission to use this command. 1. To manage the /HOST/console/history log, at the Oracle ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 1 to 2048 lines. Specify "" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of 1 to any valid integer or "" for infinite number of lines. The default is not to pause. ¦ start_from – The options are: ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. If you type the show /HOST/console/history command without first setting any arguments with the set command, Oracle ILOM displays all lines of the console log, starting from the end. Note – Timestamps recorded in the console log reflect server time. These timestamps reflect local time, and the Oracle ILOM console log uses UTC (Coordinated Universal Time). The Oracle Solaris OS system time is independent of the Oracle ILOM time. 2. To view the /HOST/console/bootlog, at the Oracle ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is not to pause. -> set /HOST/console/history property=option [...] -> show /HOST/console/history -> show /HOST/console/bootlog propertyMonitoring the Server 65 ¦ start_from – The options are: ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. Note – Timestamps in the console log reflect server time. By default, the Oracle ILOM console log uses Greenwich Mean Time (GMT), but you can use the /SP/clock timezone command to the set the SP clock to use other timezones. The Oracle Solaris OS system time is independent of the Oracle ILOM time. Related Information ¦ “Specify the Host Power State at Restart” on page 34 ? Repair a Fault (Oracle ILOM Fault Management Shell) You can use the fmadm repair command to fix faults diagnosed by Oracle ILOM. (Faults diagnosed by Oracle ILOM, rather than the host, have message IDs starting with “SPT.”) The only time you should use the fmadm repair command in the Oracle ILOM Fault Management shell for a host-diagnosed fault is when the fault is repaired and Oracle ILOM is unaware of the repair. For example, Oracle ILOM might be down when the fault is repaired. In that case, the host would no longer display the fault, yet the fault is still displayed in Oracle ILOM. Use the the fmadm repair command to clear the fault. 1. Locate the fault: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range.66 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 2. To repair an Oracle ILOM-detected fault, use the fmadm repair command: Note – You can use either the NAC name (for instance, /SYS/MB) or the UUID (for instance, fa4a2f86-5156-4243-8e88-d6516db12970) of the fault with the fmadm repair command. 3. To leave the Fault Management shell and return to Oracle ILOM, type: Related Information ¦ “Discover Faults (Oracle ILOM Fault Management Shell)” on page 61 ? Clear a Fault ? At the Oracle ILOM -> prompt, type: Setting clear_fault_action to true clears the fault at the component and all levels below it in the /SYS tree. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit -> -> set /SYS/component clear_fault_action=trueMonitoring the Server 67 Related Information ¦ “Discover Faults (Oracle ILOM)” on page 61 ¦ “Discover Faults Using POST” on page 63 ¦ “Display Server Components” on page 69 Enabling Automatic System Recovery These topics include information about configuring your server to automatically recover from minor faults. Note – This section refers to the automatic system recovery feature, not the similarly named auto service request feature. ¦ “Automatic System Recovery Overview” on page 67 ¦ “Enable ASR” on page 68 ¦ “Disable ASR” on page 68 ¦ “View Information on Components Affected by ASR” on page 69 Automatic System Recovery Overview The server provides for ASR from failures in memory modules or PCI cards. ASR functionality enables the server to resume operation after experiencing certain nonfatal hardware faults or failures. When ASR is enabled, the system’s firmware diagnostics automatically detect failed hardware components. An autoconfiguring capability designed into the system firmware enables the system to unconfigure failed components and to restore server operation. As long as the server is capable of operating without the failed component, the ASR features enable the server to reboot automatically, without operator intervention. Note – ASR is not activated until you enable it. See “Enable ASR” on page 68. For more information about ASR, refer to the service manual for your server. Related Information ¦ “Enable ASR” on page 6868 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ “Disable ASR” on page 68 ¦ “View Information on Components Affected by ASR” on page 69 ? Enable ASR 1. At the Oracle ILOM -> prompt, type: 2. At the ok prompt, type: Note – For more information about OpenBoot configuration variables, refer to the service manual for your server. 3. To cause the parameter changes to take effect, type: The server permanently stores the parameter changes and boots automatically when the OpenBoot configuration variable auto-boot? is set to true (its default value). Related Information ¦ “Automatic System Recovery Overview” on page 67 ¦ “Disable ASR” on page 68 ¦ “View Information on Components Affected by ASR” on page 69 ? Disable ASR 1. At the ok prompt, type: -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? true ok reset-all ok setenv auto-boot-on-error? falseMonitoring the Server 69 2. To cause the parameter changes to take effect, type: The server permanently stores the parameter change. After you disable the ASR feature, it is not activated again until you re-enable it. Related Information ¦ “Enable ASR” on page 68 ¦ “View Information on Components Affected by ASR” on page 69 ¦ “Automatic System Recovery Overview” on page 67 ? View Information on Components Affected by ASR ? At the Oracle ILOM -> prompt, type: In the show /SYS/component component_state command output, any devices marked disabled have been manually unconfigured using the system firmware. The command output also shows devices that have failed firmware diagnostics and have been automatically unconfigured by the system firmware. Related Information ¦ “Automatic System Recovery Overview” on page 67 ¦ “Enable ASR” on page 68 ¦ “Disable ASR” on page 68 ¦ “Unconfigure a Device Manually” on page 57 ¦ “Reconfigure a Device Manually” on page 57 ? Display Server Components View real-time information about the components installed in your server using the Oracle ILOM show components command. ok reset-all -> show /SYS/component component_state70 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ? At the Oracle ILOM prompt, type: Note – This is a sample of show components output. Specific components will vary based on your server. Related Information ¦ “Locate Device Paths” on page 28 ? Locate the Server In case you need to service a component, lighting the system locator LED assists in easily identifying the correct server. You do not need administrator permissions to use the set /SYS/LOCATE and show /SYS/LOCATE commands. 1. Log in to Oracle ILOM. See “Log In to Oracle ILOM” on page 9. 2. Manage the Locator LED with the following commands. ¦ To turn on the Locator LED, from the ILOM service processor command prompt, type: -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | Enabled /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_BlinkMonitoring the Server 71 ¦ To turn off the Locator LED, from the ILOM service processor command prompt, type: ¦ To display the state of the Locator LED, from the ILOM service processor command prompt, type: Related Information ¦ “Monitoring Faults” on page 59 ¦ “Configuring Devices” on page 57 -> set /SYS/LOCATE value=off -> show /SYS/LOCATE72 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 201173 Updating the Firmware These topics describe how to update the system firmware and view current versions of firmware for Oracle’s SPARC T4 series servers. ¦ “Display the Firmware Version” on page 73 ¦ “Update the Firmware” on page 73 ¦ “Display OpenBoot Version” on page 76 ¦ “Display POST Version” on page 76 ? Display the Firmware Version The /HOST sysfw_version property displays information about the system firmware version on the host. ? View the current setting for this property. At the Oracle ILOM -> prompt, type: Related Information ¦ “Update the Firmware” on page 73 ? Update the Firmware 1. Ensure that the Oracle ILOM SP network management port is configured. See the installation guide for your server for instructions. -> show /HOST sysfw_version74 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 2. Open an SSH session to connect to the SP: 3. Power off the host: 4. Set the keyswitch_state parameter to normal: 5. Type the load command with the path to the new flash image. The load command updates the SP flash image and the host firmware. The load command requires the following information: ¦ IP address of a TFTP server on the network that can access the flash image. ¦ Full path name to the flash image that the IP address can access. The command usage is as follows: load [-script] -source tftp://xxx.xxx.xx.xxx/pathname where: ¦ -script - Does not prompt for confirmation and acts as if yes was specified. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalUpdating the Firmware 75 ¦ -source - Specifies the IP address and full path name (URL) to the flash image. After the flash image has been updated, the server automatically resets, runs diagnostics, and returns to the login prompt on the serial console. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open76 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “Display the Firmware Version” on page 73 ? Display OpenBoot Version The /HOST obp_version property displays information about the version of OpenBoot on the host. ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 73 ¦ “OpenBoot Overview” on page 4 ? Display POST Version The /HOST post_version property displays information about the version of POST on the host. Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionUpdating the Firmware 77 ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 73 -> show /HOST post_version78 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 201179 Identifying WWN-Designated SAS2 Devices These topics explain how to identify SAS2 devices based on their WWN values. ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 80 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 World Wide Name Syntax The Oracle Solaris OS uses the World Wide Name (WWN) syntax in place of the locally unique tn (target ID) field in logical device names. This change affects how device names can be mapped to specific SCSI devices. The following points are key to understanding the impact of this change: ¦ Before the change to WWN nomenclature, the Oracle Solaris OS would ordinarily identify the default boot device as c0t0d0. ¦ With the change, the device identifier for the default boot device is now referred to as c0tWWNd0, where WWN is a hexadecimal value that is unique to this device throughout the world. ¦ This WWN value is assigned by the manufacturer of the device and, therefore, has a random relationship to the server’s device tree structure. Because WWN values do not conform to the traditional logical device name structure, you cannot directly identify a target device from its c#tWWNd# value. Instead, you can use one of the following alternative methods to map WWN-based device names to physical devices.80 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ One method consists of analyzing the output of the OBP command probe-scsi-all. You use this method when the OS is not running. See “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 80 for more information. Note – For example, you would analyze probe-scsi-all output when you want to identify a boot device. ¦ When the OS is running, you can analyze the output of the command prtconf -v. See “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 for more information. Related Information ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 80 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command) These topics explain how to map WWN values to specific SAS2 drives using the OBP command probe-scsi-all. Separate explanations are provided for each SPARC T4-x server model. ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-1)” on page 82 ¦ “probe-scsi-all WWN Mapping Example (Netra SPARC T4-1)” on page 85 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-2)” on page 88 ¦ “probe-scsi-all WWN Mapping Example (Netra SPARC T4-2)” on page 91 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs)” on page 93 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs)” on page 96 ¦ “probe-scsi-all WWN Mapping Example (SPARC T4-1B and Netra SPARC T4-1B)” on page 99Identifying WWN-Designated SAS2 Devices 81 probe-scsi-all WWN Mapping Overview The output displayed by probe-scsi-all lists all SCSI devices in the server and provides a basic set of information about each device. When analyzing the probe-scsi-all output, look for the following data fields: At a high level, the WWN mapping process consists of the following stages: ¦ Identify the physical location of the hard drive that is to be the target of the operation. ¦ Then identify the controller port that is attached to that physical location. ¦ Finally, find the WWN-based device name of the drive attached to that controller port. Examples of this process are provided for each of the SPARC T4 server models: ¦ SPARC T4-1 -- “probe-scsi-all WWN Mapping Example (SPARC T4-1)” on page 82 ¦ Netra SPARC T4-1 -- “probe-scsi-all WWN Mapping Example (Netra SPARC T4-1)” on page 85 ¦ SPARC T4-2 -- “probe-scsi-all WWN Mapping Example (SPARC T4-2)” on page 88 Entity Name Definition Target Each SAS drive is assigned a unique Target ID. SASDeviceName This is the WWN value assigned to the SAS drive by the manufacturer. The Oracle Solaris OS recognizes this name. SASAddress This is the WWN value assigned to a SCSI device that is recognized by the OBP firmware. PhyNum This is a hexidecimal ID of the controller port that is attached to the target drive. VolumeDeviceName (when a RAID volume is configured) This is the WWN value assigned to a RAID volume that is recognized by Oracle Solaris OS. VolumeDeviceName replaces the SASDeviceName of every SCSI device contained in the RAID volume. VolumeWWID (when a RAID volume is configured) This is the WWN-based value assigned to a RAID volume that is recognized by the OBP firmware. VolumeWWID replaces the SASAddress of every SCSI device contained in the RAID volume.82 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ Netra SPARC T4-2 -- “probe-scsi-all WWN Mapping Example (Netra SPARC T4-2)” on page 91 ¦ SPARC T4-4 with four CPUs -- “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs)” on page 93 ¦ SPARC T4-4 with two CPUs -- “probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs)” on page 96 ¦ SPARC and Netra SPARC T4-1B -- “probe-scsi-all WWN Mapping Example (SPARC T4-1B and Netra SPARC T4-1B)” on page 99 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (SPARC T4-1) The SPARC T4-1 server has two SAS2 RAID controllers on the motherboard. Each controller is connected to four slots on the disk backplane. The following table shows the PhyNum-to-disk slot mapping for the eight-slot SPARC T4-1 backplane. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-1 disk backplane. TABLE: SAS2 Controller Port Mapping for the SPARC T4-1 Disk Backplane SAS2 Controller Controller Port (PhyNum) Disk Slot SAS2 Controller Controller Port (PhyNum) Disk Slot 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Identifying WWN-Designated SAS2 Devices 83 The following example is based on a SPARC T4-1 server with eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive. The virtual drive consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: ¦ Controller 0 is attached to Targets 9 and b (two individual storage devices). ¦ Controller 0 is also attached to Target 523 (a RAID volume). ¦ Controller 1 is attached to Targets 9, b, c, and d (four individual storage devices). ¦ Controller 1 is also attached to Target a (a DVD unit). Note – For SPARC T4-1 servers, the second field of the device path specifies the controllers: /pci@400/pci@1 = controller 0 and /pci@400/pci@2 = controller 1. TABLE: Physical Drive Locations in the SPARC T4-1 Disk Backplane Disk Slot 1 Disk Slot 3 Disk Slot 5 DVD Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 4 Disk Slot 6 Disk Slot 7 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 2 Target d Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca01201e544 SASAddress 5000cca01201e545 PhyNum 384 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 In this example, the controller ports are attached to the hard drives and the DVD in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00a75dcac ¦ SASAddress = 5000cca00a75dcad /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 1 Target 523 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 0 0 * * Default boot drive 9 1 0 4 9 1 1 a 1 5 b 2 2 RAID Target 523 2 6 c 3 3 RAID Target 523 3 7 d 6 DVD aIdentifying WWN-Designated SAS2 Devices 85 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 5, it has the following values: ¦ Controller = 1 ¦ Target = b ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00a76e380 ¦ SASAddress = 5000cca00a76e381 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (Netra SPARC T4-1) The Netra SPARC T4-1 server uses only one of the two SAS2 RAID controllers on the motherboard. The controller connects to one slot on the disk backplane. The following table shows the PhyNum-to-disk slot mapping. The following table shows the locations of the drive slots in the Netra SPARC T4-1 disk backplane. TABLE: SAS2 Controller Port Mapping for the Netra SPARC T4-1 Disk Backplane SAS2 Controller Controller Port (PhyNum) Disk Slot SAS2 Controller Controller Port (PhyNum) Disk Slot 0 Not Used 1 0 * * Default boot drive 0 1 1 2 2 3 386 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 The following example is based on a Netra SPARC T4-1 server with four hard drives. These hard drives are deployed as four individual storage devices. Controller 1 is attached to these storage devices in the following manner: ¦ Controller 1 is attached to Targets 9, b, c, and d (four individual storage devices). ¦ Target a (is a DVD drive). Note – For Netra SPARC T4-1 servers, the second field of the device path specifies the controllers: /pci@400/pci@2 = controller 1 and /pci@400/pci@1 = controller 0. TABLE: Physical Drive Locations in the Netra SPARC T4-1 Disk Backplane Disk Slot 1 DVD Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 3 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H106030SDSUN300G A2B0 585937500 Blocks, 300 GB SASDeviceName 5000cca012b76b40 SASAddress 5000cca012b76b41 PhyNum 0<-HD slot 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-V 1.0B SATA device PhyNum 6 <- DVD Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4d2ff0 SASAddress 5000cca00a4d2ff1 PhyNum 2<-HD slot 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017871633 SASAddress 5000c50017871631 PhyNum 1 <- HD slot 1 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb42adf SASAddress 5000c5001cb42add PhyNum 3 <- HD slot 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 (Not Used) FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00Identifying WWN-Designated SAS2 Devices 87 In this example, the controller ports are attached to the hard drives and the DVD in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 1 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca012b76b40 ¦ SASAddress = 5000cca012b76b41 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 2, it has the following values: ¦ Controller = 1 ¦ Target = b ¦ PhyNum = 2 ¦ SASDeviceName = 5000cca00a4d2ff0 ¦ SASAddress = 5000cca00a4d2ff1 Related Information ¦ “World Wide Name Syntax” on page 79 ok SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 Not Used 1 0 * * Default boot drive 0 9 1 1 b 2 2 c 3 3 d 6 DVD a88 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (SPARC T4-2) The SPARC T4-2 server has one SAS2 RAID controller on the motherboard. This controller is connected to six slots on the disk backplane. The following table shows the PhyNum-to-disk slot mapping for the six-slot SPARC T4-2 backplane. The following example is based on a SPARC T4-2 server with six hard drives. These hard drives are deployed as four individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. The controller is attached to these devices in the following manner: ¦ Targets 9, d, e, and f (four individual storage devices). ¦ Target 389 (a RAID volume). TABLE: SAS2 Controller Port Mapping for the SPARC T4-2 Disk Backplane SAS2 Controller Controller Port (PhyNum) Disk Slots and DVD 0 0 0 * * Default boot drive 1 1 2 2 3 3 4 4 5 5 6 Not connected 7 DVDIdentifying WWN-Designated SAS2 Devices 89 ¦ Target a (a DVD unit). In this example, the controller ports are attached to the hard drives and the DVD in the following manner: ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 0 0 * 9 1 1 d 2 2 e 3 3 f 4 4 RAID Target 389 5 5 RAID Target 38990 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c5001cb4a637 ¦ SASAddress = 5000c5001cb4a635 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 3, it has the following values: ¦ Controller = 0 ¦ Target = f ¦ PhyNum = 3 ¦ SASDeviceName = 5000c5001cb47f7f ¦ SASAddress = 5000c5001cb47f7d Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 6 Not connected -- 7 DVD a * Default boot drive SAS2 Controller Controller Port (PhyNum) Disk Slot ID TargetIdentifying WWN-Designated SAS2 Devices 91 probe-scsi-all WWN Mapping Example (Netra SPARC T4-2) The Netra SPARC T4-2 server has one SAS2 RAID controller on the motherboard. This controller is connected to eight hard drive slots on the disk backplane and one DVD slot. The following table shows the PhyNum-to-disk slot mapping for the Netra SPARC T4-2 backplane. The following example is based on a Netra SPARC T4-2 server with eight hard drives. SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target SAS2 Controller Controller Port (PhyNum) Disk Slot ID Target 0 0 * * Default boot drive 0 9 1 0 4 9 1 1 a 1 5 b 2 2 b 2 6 c 3 3 c 3 7 d 6 DVD a ok probe-scsi-all /pci@500/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca012640718 SASAddress 5000cca012640719 PhyNum 0<-HD slot 4 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-V 1.0B SATA device PhyNum 6 <-DVD Target b Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 G SASDeviceName 5000cca01263ce30 SASAddress 5000cca01263ce31 PhyNum 1<-HD slot 5 Target c Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca01261b2fc SASAddress 5000cca01261b2fd PhyNum 2<-HD slot 6 Target d Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca012633e3c SASAddress 5000cca012633e3d PhyNum 3<-HD slot 792 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca0120f9dbc ¦ SASAddress = 5000cca0120f9dbd If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 3, it has the following values: ¦ Controller = 0 ¦ Target = c ¦ PhyNum = 3 ¦ SASDeviceName = 5000cca01260f594 ¦ SASAddress = 5000cca01260f595 /pci@400/pci@2/pci@0/pci@e/scsi@0 <---- SAS controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca0120f9dbc SASAddress 5000cca0120f9dbd PhyNum 0<-HD slot 0 Target a Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca012633c18 SASAddress 5000cca012633c19 PhyNum 1<-HD slot 1 Target b Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca0126406ec SASAddress 5000cca0126406ed PhyNum 2<-HD slot 2 Target c Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca01260f594 SASAddress 5000cca01260f595 PhyNum 3<-HD slot 3 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 okIdentifying WWN-Designated SAS2 Devices 93 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Four CPUs) The SPARC T4-4 server has two REM cards plugged into the motherboard. These modules are referred to as controllers 0 and 1. Each SAS controller is connected to a separate four-slot disk backplane. The following table shows the PhyNum-to-disk slot mapping for the two four-slot SPARC T4-4 backplanes. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-4 disk backplane. TABLE: SAS2 Controller Port Mapping for the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLE: Physical Drive Locations in the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 Disk Slot 1 Disk Slot 3 Disk Slot 5 Disk Slot 7 Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 4 Disk Slot 694 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 The following example is based on a SPARC T4-4 server with four CPUs and eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: ¦ Controller 0 is attached to Targets 9 and a (two individual storage devices). ¦ Controller 0 is also attached to Target 688 (a RAID volume). ¦ Controller 1 is attached to Targets 9, a, b, and c (four individual storage devices). Note – OBP uses a different device path for SAS controller 1 in SPARC T4-4 servers, depending on whether the server has four processors or two processors.The path for SAS controller 0 is the same for both processor configurations. ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 688 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 okIdentifying WWN-Designated SAS2 Devices 95 In this example, the controller ports are attached to the hard drives in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 1, it has the following values: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 Disk Backplane 0 Disk Backplane 1 Controller Port (PhyNum) Disk Slot ID Target Controller Port (PhyNum) Disk Slot ID Target 0 0 * * Default boot drive 9 0 4 9 1 1 a 1 5 a 2 2 RAID Target 688 2 6 b 3 3 RAID Target 688 3 7 c96 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (SPARC T4-4 With Two CPUs) The SPARC T4-4 server has two REM cards plugged into the motherboard. These modules are referred to as controllers 0 and 1. Each SAS controller is connected to a separate four-slot disk backplane. The following table shows the PhyNum-to-disk slot mapping for the two four-slot SPARC T4-4 backplanes. This table shows that ports 0-3 of controller 0 are connected to backplane slots 0-3 and ports 0-3 of controller 1 are connected to slots 4-7. The following table shows the locations of the drive slots in the SPARC T4-4 disk backplane. TABLE: SAS2 Controller Port Mapping for the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID SAS2 Controller Controller Port ID (PhyNum) Disk Slot ID 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLE: Physical Drive Locations in the SPARC T4-4 Disk Backplane Disk Backplane 0 Disk Backplane 1 Disk Slot 1 Disk Slot 3 Disk Slot 5 Disk Slot 7 Disk Slot 0 * * Default boot drive Disk Slot 2 Disk Slot 4 Disk Slot 6Identifying WWN-Designated SAS2 Devices 97 The following example is based on a SPARC T4-4 server with two CPUs and eight hard drives. These hard drives are deployed as six individual storage devices and a virtual drive that consists of two hard drives configured as a RAID volume. Controllers 0 and 1 are attached to these storage devices in the following manner: ¦ Controller 0 is attached to Targets 9 and a (two individual storage devices). ¦ Controller 0 is also attached to Target 457 (a RAID volume). ¦ Controller 1 is attached to Targets 9, a, b, and c (four individual storage devices). Note – OBP uses a different device path for SAS controller 1 in SPARC T4-4 servers, depending on whether the server has four processors or two processors.The path for SAS controller 0 is the same for both processor configurations. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 457 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB98 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 In this example, the controller ports are attached to the hard drives in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 If you want to specify another drive to be the boot device, find its PhyNum value in the output and use the SASDeviceName assigned to that device. For example, if you want to use the hard drive in disk slot 1, it has the following values: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok Disk Backplane 0 Disk Backplane 1 Controller Port (PhyNum) Disk Slot ID Target Controller Port (PhyNum) Disk Slot ID Target 0 0 * * Default boot drive 9 0 4 9 1 1 a 1 5 a 2 2 RAID Target 457 2 6 b 3 3 RAID Target 457 3 7 cIdentifying WWN-Designated SAS2 Devices 99 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 probe-scsi-all WWN Mapping Example (SPARC T4-1B and Netra SPARC T4-1B) The SPARC and Netra SPARC T4-1B blades have two SCSI disk slots in the disk backplane. A Sun Blade 6000 RAID 0/1 SAS2 HBA REM, which is plugged into the motherboard, manages storage devices installed in these backplane slots. The following table shows the PhyNum-to-disk slot mapping for the two-slot SPARC T4-1B backplane. The following example is based on a SPARC T4-1B blade with both hard drives attached to the controller as individual storage devices. TABLE: SAS2 Controller Port Mapping for the SPARC T4-1B Disk Backplane Controller Port (PhyNum) 0 Controller Port (PhyNum) 1 Disk Slot ID 0 * * Default boot drive Disk Slot ID 1 ok probe-scsi-all /pci@400/pci@1/pci@0/pci@c/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c500231694cf SASAddress 5000c500231694cd PhyNum 0 Target a Unit 0 Disk SEAGATE ST973402SSUN72G 0603 143374738 Blocks, 73 GB SASDeviceName 5000c50003d37fcb SASAddress 5000c50003d37fc9 PhyNum 1 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2100 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 In this example, the controller ports are attached to the hard drives in the following manner: Note – Target values are not static. The same storage device can appear in two consecutive probe-scsi-all listings with different Target values. The default boot device has the following values: ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c500231694cf ¦ SASAddress = 5000c500231694cd If you want to specify the hard drive in disk slot 1 to be the boot device, it would have the following values in this example: ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000c50003d37fcb ¦ SASAddress = 5000c50003d37fc9 The following example is based on a SPARC T4-1B blade with both hard drives attached to the controller as a RAID volume. Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok Controller Port (PhyNum) 0 Controller Port (PhyNum) 1 Target 9 (Disk Slot ID 0) Target a (Disk Slot ID 1) ok probe-scsi-all /pci@400/pci@1/pci@0/pci@2/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 377 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GBIdentifying WWN-Designated SAS2 Devices 101 In this example, the controller ports are attached to a RAID volume containing the hard drives installed in disk slots 0 and 1. Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 ? Identify a Disk Slot Using prtconf (Oracle Solaris OS) The procedure described below applies to SPARC T4-1 and SPARC T4-4 servers, which have eight-disk backplane configurations. The same methodology can be used for the SPARC T4-2 server and SPARC T4-1B blade systems. 1. Run the format command. The remaining steps in this example will identify the physical slot that corresponds to the device name c0t5000CCA00ABBAEB8d0. VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]102 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 2. Run prtconf -v and search for the device link containing the device name c0t5000CCA00ABBAEB8d0. 3. Search the prtconf output for the name=’wwn’ entry that shows the WWN value 5000cca00abbaeb8. Note the obp-path value listed under WWN 5000cca00abbaeb8. Refer to the following table to find the controller. For SPARC T4-1 servers, the controller is identified in the second field: pci@1 = controller 0 and pci@2 = controller 1. For SPARC T4-4 servers, the controller is identified in the first field. For systems with a four-processor configuration, pci@400 = controller 0 and pci@700 = controller 1. For systems with a two-processor configuration, pci@400 = controller 0 and pci@500 = controller 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/rsd3a SPARC T4-1 Controller 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (4 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (2 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Identifying WWN-Designated SAS2 Devices 103 Note – Because SPARC T4-2 and SPARC T4-1B systems contain only one SAS controller, only controller 0 will be listed. The following output example shows the obp-path for a SPARC T4-1 server. In this SPARC T4-1 example, the obp-path is: Based on the previous table, this disk is on controller 0. The following output example shows the obp-path for a SPARC T4-4 server. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’104 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 In this SPARC T4-4 example, the obp-path is: Based on the previous table, this disk is on controller 0. 4. This phy-num value corresponds to physical disk slot 0, as shown in the following port mapping table. Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 WWN Syntax in an OS Installation on an Individual Drive The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the operating system on a specific disk drive. In this example, the device name contains the WWN value 5000CCA00A75DCAC. Note – All alpha characters in the WWN value must be capitalized. /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SAS Controller PhyNum Disk Slot SAS Controller PhyNum Disk Slot 0 0 0 * * Default boot drive 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserveIdentifying WWN-Designated SAS2 Devices 105 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 80 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 106 WWN Syntax in an OS Installation on a RAID Volume The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the OS on a RAID volume. When installing software on a RAID volume, use the virtual device’s VolumeDeviceName instead of an individual device name. In this example, the RAID volume name is 3ce534e42c02a3c0. archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap106 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 Related Information ¦ “World Wide Name Syntax” on page 79 ¦ “probe-scsi-all WWN Mapping Overview” on page 81 ¦ “Mapping WWN Values to Hard Drives (OBP probe-scsi-all Command)” on page 80 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris OS)” on page 102 ¦ “WWN Syntax in an OS Installation on an Individual Drive” on page 105Identifying WWN-Designated SAS2 Devices 107108 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011109 Glossary A ANSI SIS American National Standards Institute Status Indicator Standard. ASF Alert standard format (Netra products only). ASR Automatic system recovery. AWG American wire gauge. B blade Generic term for server modules and storage modules. See server module and storage module. blade server Server module. See server module. BMC Baseboard management controller. BOB Memory buffer on board. C chassis For servers, refers to the server enclosure. For server modules, refers to the modular system enclosure. CMA Cable management arm.110 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 CMM Chassis monitoring module. The CMM is the service processor in the modular system. Oracle ILOM runs on the CMM, providing lights out management of the components in the modular system chassis. See Modular system and Oracle ILOM. CMM Oracle ILOM Oracle ILOM that runs on the CMM. See Oracle ILOM. D DHCP Dynamic Host Configuration Protocol. disk module or disk blade Interchangeable terms for storage module. See storage module. DTE Data terminal equipment. E EIA Electronics Industries Alliance. ESD Electrostatic discharge. F FEM Fabric expansion module. FEMs enable server modules to use the 10GbE connections provided by certain NEMs. See NEM. FRU Field-replaceable unit. H HBA Host bus adapter. host The part of the server or server module with the CPU and other hardware that runs the Oracle Solaris OS and other applications. The term host is used to distinguish the primary computer from the SP. See SP.Glossary 111 I ID PROM Chip that contains system information for the server or server module. IP Internet Protocol. K KVM Keyboard, video, mouse. Refers to using a switch to enable sharing of one keyboard, one display, and one mouse with more than one computer. L LwA Sound power level. M MAC Machine access code. MAC address Media access controller address. Modular system The rackmountable chassis that holds server modules, storage modules, NEMs, and PCI EMs. The modular system provides Oracle ILOM through its CMM. MSGID Message identifier. N name space Top-level Oracle ILOM CMM target. NEBS Network Equipment-Building System (Netra products only).112 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 NEM Network express module. NEMs provide 10/100/1000 Mbps Ethernet, 10GbE Ethernet ports, and SAS connectivity to storage modules. NET MGT Network management port. An Ethernet port on the server SP, the server module SP, and the CMM. NIC Network interface card or controller. NMI Nonmaskable interrupt. O OBP OpenBoot PROM. Oracle ILOM Oracle Integrated Lights Out Manager. Oracle ILOM firmware is preinstalled on a variety of Oracle systems. Oracle ILOM enables you to remotely manage your Oracle servers regardless of the state of the host system. Oracle Solaris OS Oracle Solaris operating system. P PCI Peripheral component interconnect. PCI EM PCIe ExpressModule. Modular components that are based on the PCI Express industry-standard form factor and offer I/O features such as Gigabit Ethernet and Fibre Channel. POST Power-on self-test. PROM Programmable read-only memory. PSH Predictive self healing. Q QSFP Quad small form-factor pluggable.Glossary 113 R REM RAID expansion module. Sometimes referred to as an HBA See HBA. Supports the creation of RAID volumes on drives. S SAS Serial attached SCSI. SCC System configuration chip. SER MGT Serial management port. A serial port on the server SP, the server module SP, and the CMM. server module Modular component that provides the main compute resources (CPU and memory) in a modular system. Server modules might also have onboard storage and connectors that hold REMs and FEMs. SP Service processor. In the server or server module, the SP is a card with its own OS. The SP processes Oracle ILOM commands providing lights out management control of the host. See host. SSD Solid-state drive. SSH Secure shell. storage module Modular component that provides computing storage to the server modules. T TIA Telecommunications Industry Association (Netra products only). Tma Maximum ambient temperature. U UCP Universal connector port.114 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 UI User interface. UL Underwriters Laboratory Inc. US. NEC United States National Electrical Code. UTC Coordinated Universal Time. UUID Universal unique identifier. W WWN World wide name. A unique number that identifies a SAS target.115 Index Symbols -> prompt about, 1 ways to access, 12 A Automatic System Recovery (ASR) disabling, 68 enabling, 68 viewing affected components, 69 B boot mode expiration date, 51 managing at reset, 49 managing con?guration, 48 managing script, 50 managing system, 47 Oracle VM Server (LDoms), 48 overview, 47 C cables, keyboard and mouse, 13 console history, displaying, 63 D device paths, 28 devices con?guring, 58 managing, 57 uncon?guring, 57 DHCP server, displaying IP Address, 40 diagnostics, 59 F faults bypassing, 67 clearing, 66 discovering with ILOM, 61 discovering with POST, 63 handling, 59 FCode utility commands, 22 RAID, 21 ?rmware, updating, 73 FRU data, changing, 31 H host power state managing power-on delay, 35 restoring at restart, 34 speci?ng at restart, 34 I ILOM accessing the system console, 10 default username and password, 10 logging in, 9 overview, 1 parallel boot policy, 36 platform-speci?c features, 2 prompt, 10, 12 speci?ng host power state property, 34 K keyboard, attaching, 13 keyswitch, specifying host behavior, 36 L local graphics monitor, 13 locating the server, 70116 SPARC and Netra SPARC T4 Series Servers Administration Guide • December 2011 M MAC address, displaying host, 42 multipathing software, 5 N network access, enabling or disabling, 40 network address options, 39 O ok prompt, displaying, 11 OpenBoot displaying version, 76 setting con?guration variables, 13 Oracle VM Server for SPARC overview, 4 P POST displaying version, 73, 76 running diagnostics, 63 power off, 16 power on, 15 R RAID con?guring, 19 creating volumes, 23 FCode utility, 21 support, 19 restart behavior setting the boot timeout interval, 54 specifying behavior at boot timeout, 55 specifying behavior if restart fails, 55 specifying behavior when host stops running, 54 specifying max restart attempts, 56 specifying on host reset, 53 S server controlling, 15 resetting from ILOM, 17 resetting from the OS, 17 SP, resetting, 18 SunVTS, 60 system administration overview, 1 system communication, 9 system console, logging in, 10 system identi?cation, changing, 32 Serveur SPARC T4-1 Notes de produit N° de référence : E26634-01 Novembre 2011, révision AProduit recyclable Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée de The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation vii 1. Informations de dernière heure 1 Logiciels préinstallés 1 Informations relatives au SE Oracle Solaris, au microprogramme et aux logiciels 2 Informations sur les patchs 3 2. Problèmes connus concernant le produit 5 Problèmes liés au matériel 5 Claviers Sun de type 6 non pris en charge par les serveurs de la série SPARC T4 5 Précautions à prendre lors de la déconnexion d’un câble de données SATA d’un connecteur de backplane 6 Précautions à prendre lors de la manipulation des cartes de connecteur 6 Dégradation des performances avec les cartes Sun Dual 10 GbE SFP+ PCIe TCP RX à 4 ports (cartes 8 voies en cuivre GigE à quatre ports PCI-E) sur les serveurs SPARC T4-1 (CR 6943558) 7 Activation du contrôle de flux (avec redémarrage du système) 7 Activation du contrôle de flux (sans redémarrage du système) 8 Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) 8iv Notes de produit du serveur SPARC T4-1 • Novembre 2011 PSH n'efface parfois pas une ligne de cache obsolète sur une carte mère remplacée (CR 7031216) 8 Des erreurs pouvant être corrigées par PCIe sont parfois signalées (CR 7051331) 9 Les erreurs de mémoire cache L2 non corrigibles peuvent conduire à la défaillance d'un processeur entier (CR 7065563) 10 Lors d'une réinitialisation suivant une erreur matérielle irrécupérable, les CPU risquent de ne pas démarrer (CR 7075336) 13 Les opérations reset /SYS peuvent entraîner la disparition du contrôleur SAS (CR 7082665) 13 La commande SAS risque d'échouer si certains périphériques SAS subissent une charge importante (CR 7088469) 15 La réinitialisation d'un domaine invité SDIO-SAS HBA peut générer une erreur ereport.io.pciex.pl.re (CR 7048307) 16 Problèmes liés au système d’exploitation Oracle Solaris 16 Impossible de démarrer le SE Oracle Solaris 10 10/09 (U8) à partir du DVD interne 16 Message d’interruption parasite affiché sur la console système (CR 6963563) 17 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) 17 Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) 18 Problèmes d’allocation de mémoire avec les HBA Emulex 8 Gbits installés dans un boîtier d’expansion d’E/S Magma (CR 6982072) 19 La gestion des pannes envoie parfois des cas résolus au SP (CR 6983432) 20 Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du SE Oracle Solaris 10 10/09 et d'un ensemble de patchs Solaris 10 9/10 ou Solaris 10 8/11 (CR 6995458) 21 La commande cfgadm échoue pour certains HBA (CR 7044759) 22 De lourdes charges de travail et des configurations de mémoire maximale peuvent provoquer des délais d'attente du chien de garde (CR 7083001) 23Sommaire v Message d’erreur mineur : mptsas request inquiry page 0x83 for target:a, lun:0 failed! (CR 7092982) 24 Oracle VTS dtlbtest se bloque lorsque le mode CPU Threading est défini sur max-ipc (CR 7094158) 24 Problèmes liés au microprogramme 25 L'horodatage d'un événement critique/d'une erreur dans Oracle ILOM est parfois décalé d'une heure (CR 6943957) 25 e1000g : Pilote générant des rapports en ligne parasites Lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (CR 6958011) 25 Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (CR 6968801) 26 Clarification du message sas2ircu indiquant que les tailles de volume RAID autres que MAX ne sont pas prises en charge (CR 6983210) 26 Les unités utilisées pour définir la durée maximale de gestion de l'alimentation de la MIB (base d'informations de gestion) sont les secondes (CR 6993008) 27 Un message de cpustat fait référence à la documentation du processeur de manière incorrecte (CR 7046898) 27 La commande reboot disk échoue parfois lorsque l'argument disk détecte des caractères supplémentaires (CR 7050975) 28 La DEL bleue ne s'allume pas sur le disque lorsque celui-ci est prêt à être retiré (CR 7082700) 28vi Notes de produit du serveur SPARC T4-1 • Novembre 2011vii Utilisation de cette documentation Ce document contient les informations de dernière minute et les problèmes connus concernant le serveur SPARC T4-1 d'Oracle. ¦ « Documentation connexe », page vii ¦ « Commentaires », page viii ¦ « Support technique et accessibilité », page viii Documentation connexe Tableau de la documentation connexe. Documentation Liens Tous les produits Oracle http://www.oracle.com/documentation Serveur SPARC T4-1 http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1 SE Oracle Solaris et autres logiciels système http://www.oracle.com/technetwork/indexes/documentation/index.ht ml#sys_sw Oracle Integrated Lights Out Manager (ILOM) 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0viii Notes de produit du serveur SPARC T4-1 • Novembre 2011 Commentaires Vous pouvez laisser vos commentaires relatifs à cette documentation sur le site : http://www.oracle.com/goto/docfeedback Support technique et accessibilité Tableau des liens des ressources de support et d'accessibilité. Description Liens Accédez au support électronique via My Oracle Support http://support.oracle.com Pour malentendants : http://www.oracle.com/accessibility/support.html Pour plus d’informations sur l’engagement d’Oracle en matière d’accessibilité http://www.oracle.com/us/corporate/accessibility/index.html1 C H A P I T R E 1 Informations de dernière heure Ces notes de produit contiennent des informations importantes de dernière minute concernant le serveur SPARC T4-1 d’Oracle. ¦ « Logiciels préinstallés », page 1 ¦ « Informations relatives au SE Oracle Solaris, au microprogramme et aux logiciels », page 2 ¦ « Informations sur les patchs », page 3 Logiciels préinstallés Le système d'exploitation Oracle Solaris préinstallé est installé sur un système de fichiers ZFS comme décrit dans le tableau ci-dessous. Ce tableau répertorie les composants logiciels préinstallés sur le serveur. Logiciel Emplacement Fonction Oracle Solaris 10 8/11 Tranche 0 du disque root (et tranche 3 pour un ABE). Système d’exploitation Oracle VM Server pour SPARC 2.1 /opt/SUNWldm Gestion des domaines logiques Electronic Prognostics 1.2 /opt/ep Génération d’avertissements précoces concernant des pannes de FRU potentielles2 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Informations relatives au SE Oracle Solaris, au microprogramme et aux logiciels Le tableau suivant répertorie les versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge. Remarque – Le bundle Solaris 10 8/11 SPARC à télécharger est identifié par le numéro 13058415 à l'adresse http://support.oracle.com. TABLEAU 1-1 Versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge Logiciel Versions prises en charge Système d'exploitation hôte (préinstallé ou installé par le client) Oracle Solaris 8 10/11. Vous devez installer les patchs répertoriés dans le TABLEAU 1-2. * * Reportez-vous au fichier README fourni avec les patchs pour obtenir des informations supplémentaires, y compris des instructions sur l'installation des patchs. Système d'exploitation hôte (versions antérieures) • SE Solaris 10 9/10 avec le bundle Solaris 10 8/11 SPARC, suivi par les patchs indiqués dans le TABLEAU 1-2. • SE Solaris 10 10/09 avec le bundle Solaris 10 8/11 SPARC, suivi par les patchs indiqués dans le TABLEAU 1-2. Microprogramme système 8.1.1.c (comprend Oracle Integrated Lights Out Manager 3.0) Oracle VM Server pour SPARC (LDoms) 2.1 Système de fichiers ZFS Electronic Prognostics sur l’hôte du serveur 1.2Chapitre 1 Informations de dernière heure 3 Informations sur les patchs Vous devez installer les patchs répertoriés dans le TABLEAU 1-2 avant d'utiliser le serveur avec le logiciel préinstallé ou si vous avez installé le SE Oracle Solaris 10 8/11 vous-même. Ce tableau répertorie les patchs requis par le SE Oracle Solaris 10 8/11. Outre l'installation des patchs requis répertoriés dans le TABLEAU 1-1, vous devez télécharger et installer l'ensemble de patchs "Recommended OS Patchset Solaris 10 SPARC". Il contient les patchs du SE Oracle Solaris 10 qui traitent les alertes Sun actuelles. Si vous souhaitez utiliser une version antérieure du SE Oracle Solaris, vous devez installer le bundle Solaris 10 8/11 SPARC. Une fois le bundle Solaris 10 8/11 SPARC installé, vous devez installer les patchs requis répertoriés dans le TABLEAU 1-2. TABLEAU 1-2 Ensemble de patchs obligatoire pour Oracle Solaris 10 8/11 147440-04 147149-01 147153-01 147707-01 147159-034 Notes de produit du serveur SPARC T4-1 • Novembre 20115 C H A P I T R E 2 Problèmes connus concernant le produit Cette section décrit les problèmes connus ayant un impact sur les serveurs SPARC T4-1 d’Oracle au moment de la parution de cette version. Les problèmes sont décrits de la manière suivante. ¦ « Problèmes liés au matériel », page 5 ¦ « Problèmes liés au système d’exploitation Oracle Solaris », page 16 ¦ « Problèmes liés au microprogramme », page 25 Problèmes liés au matériel Cette section décrit les problèmes liés aux composants du serveur SPARC T4-1. Claviers Sun de type 6 non pris en charge par les serveurs de la série SPARC T4 Les claviers Sun de type 6 ne peuvent pas être utilisés avec les serveurs SPARC de la série T4.6 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Précautions à prendre lors de la déconnexion d’un câble de données SATA d’un connecteur de backplane Lorsque vous déconnectez un câble de données SATA du backplane de disque, tirez sur le câble dans une direction perpendiculaire par rapport au backplane. Attention – Ne secouez ou ne tordez pas le câble dans une autre direction. Vous risqueriez d’endommager l’intégrité de la connexion du câble de données. Précautions à prendre lors de la manipulation des cartes de connecteur Manipulez les cartes de connecteur avec précaution afin d’éviter d’exercer avec la main une pression sur l’extrémité pointue de la tige de guidage située sous le support de montage. La tige de guidage est indiquée par une flèche dans l’illustration suivante.Chapitre 2 Problèmes connus concernant le produit 7 Dégradation des performances avec les cartes Sun Dual 10 GbE SFP+ PCIe TCP RX à 4 ports (cartes 8 voies en cuivre GigE à quatre ports PCI-E) sur les serveurs SPARC T4-1 (CR 6943558) Une perte de paquets excessive peut se produire lorsque trois ports ou plus sont utilisés par plusieurs cartes Sun Dual 10GbE SFP+ PCIe installées sur un serveur SPARC T4-1. Les performances d’émission et de réception risquent d’être considérablement diminuées. Lorsque deux ports seulement sont utilisés, la perte de paquets est minime et les performances d’émission et de réception sont conformes aux attentes. Conseil – Si les performances ne sont pas satisfaisantes, pensez à appliquer la solution. Solution : utilisez l’une des procédures suivantes pour activer le contrôle de flux sur les interfaces. Vous pourrez ainsi considérablement réduire la perte de paquets observée et augmenter les performances. Activation du contrôle de flux (avec redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf : 2. Redémarrez le système afin d’appliquer ces modifications. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;8 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Activation du contrôle de flux (sans redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf : 2. Déplombez toutes les interfaces ixgbe. 3. Emettez la commande update_drv ixgbe. 4. Plombez à nouveau toutes les interfaces ixgbe. Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) Lorsque vous tentez de démarrer à partir d’une clé USB insérée dans l’un des ports USB avant (USB2 ou USB3), le serveur peut générer une erreur grave. Solution : utilisez les ports USB arrière du serveur (USB0 ou USB1) pour démarrer depuis un périphérique USB externe. PSH n'efface parfois pas une ligne de cache obsolète sur une carte mère remplacée (CR 7031216) Lorsque le boîtier est remplacé afin de réparer une mémoire cache défectueuse sur la carte mère, PSH n'efface parfois pas le cache sur le boîtier remplacé. La ligne de cache reste désactivée. Solution : effacez manuellement la ligne de cache désactivée en exécutant l'une des commandes suivantes : fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; # fmadm repaired fmri | label # fmadm replaced fmri | labelChapitre 2 Problèmes connus concernant le produit 9 Des erreurs pouvant être corrigées par PCIe sont parfois signalées (CR 7051331) Dans de rares situations, les périphériques PCI Express Gen2 figurant dans le module serveur signalent des erreurs d'E/S identifiées et signalées par l'autorétablissement prédictif (PSH). Exemple : --------------- ------------------------------------ -------------- --------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ -------------- --------- Aug 10 13:03:23 a7d43aeb-61ca-626a-f47b-c05635f2cf5a PCIEX-8000-KP Major Host : dt214-154 Platform : ORCL,SPARC-T3-1B Chassis_id : Product_sn : Fault class : fault.io.pciex.device-interr-corr 67% fault.io.pciex.bus-linkerr-corr 33% Affects : dev:////pci@400/pci@1/pci@0/pci@c dev:////pci@400/pci@1/pci@0/pci@c/pci@0 faulted but still in service FRU : "/SYS/MB" (hc://:product-id=ORCL,SPARC-T3-1B:productsn=1052NND107:server-id=dt214-154:chassis-id=0000000- 0000000000:serial=1005LCB-1052D9008K:part=541- 424304:revision=50/chassis=0/motherboard=0) 67% "FEM0" (hc://:product-id=ORCL,SPARC-T3-1B:productsn=1052NND107:server-id=dt214-154:chassis-id=0000000- 0000000000/chassis=0/motherboard=0/hostbridge=0/pciexrc=0/pciexbus=1/pciexdev= 0/pciexfn=0/pciexbus=2/pciexdev=12/pciexfn=0/pciexbus=62/pciexdev=0) 33% faulty Description : Too many recovered bus errors have been detected, which indicates a problem with the specified bus or with the specified transmitting device. This may degrade into an unrecoverable fault. Refer to http://sun.com/msg/PCIEX-8000-KP for more information. Response : One or more device instances may be disabled Impact : Loss of services provided by the device instances associated with this fault Action : If a plug-in card is involved check for badly-seated cards or bent pins. Otherwise schedule a repair procedure to replace the affected device. Use fmadm faulty to identify the device or contact Sun for support.10 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Ces erreurs peuvent indiquer la présence d'un EM PCI défectueux ou mal inséré. Ces erreurs peuvent également être erronées. Solution : assurez-vous que le périphérique est correctement inséré et qu'il fonctionne normalement. Si l'erreur persiste, appliquez le patch 147705-01 ou version supérieure. Les erreurs de mémoire cache L2 non corrigibles peuvent conduire à la défaillance d'un processeur entier (CR 7065563) Une erreur de mémoire cache L2 non corrigible peut conduire à la panne d'un processeur entier et non seulement de brins spécifiques. Solution : désactivez le noyau défectueux à l'aide de la procédure suivante. 1. Identifiez le noyau défectueux. Saisissez ce qui suit : # fmdump -eV -c ereport.cpu.generic-sparc.l2tagctl-ucChapitre 2 Problèmes connus concernant le produit 11 La partie detector s'affiche comme suit : Dans cet exemple, la puce défectueuse est indiquée sous la forme cpuboard=1/chip=2/core=19. Vous trouverez d'autres exemples ci-dessous. Le tableau présente des exemples de sortie de fmdump et les noms NAC correspondants pour les noyaux CMP. 2. Arrêtez le système d'exploitation Oracle Solaris et mettez le serveur hors tension. detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = hc hc-root = hc-list-sz = 4 hc-list = (array of embedded nvlists) (start hc-list[0]) nvlist version: 0 hc-name = chassis hc-id = 0 (end hc-list[0]) (start hc-list[1]) nvlist version: 0 hc-name = cpuboard hc-id = 1 (end hc-list[1]) (start hc-list[2]) nvlist version: 0 hc-name = chip hc-id = 2 (end hc-list[2]) (start hc-list[3]) nvlist version: 0 hc-name = core hc-id = 19 (end hc-list[3]) (end detector) Exemple de sortie de fmdump Nom NAC correspondant cpuboard=0/chip=0/core=0 /SYS/PM0/CMP0/CORE0 cpuboard=1/chip=2/core=16 /SYS/PM1/CMP0/CORE0 cpuboard=1/chip=2/core=19 /SYS/PM1/CMP0/CORE312 Notes de produit du serveur SPARC T4-1 • Novembre 2011 3. Désactivez le noyau défectueux. A partir de la ligne de commande d'Oracle ILOM : 4. Mettez le serveur sous tension, puis redémarrez le SE Oracle Solaris. 5. Remplacez le diagnostic FMA manuellement : -> cd /SYS/PM1/CMP0/CORE0 /SYS/PM1/CMP0/CORE0 -> show /SYS/PM1/CMP0/CORE01331 Targets: P0 P1 P2 P3 P4 P5 P6 P7 L2CACHE L1CACHE Properties: type = CPU Core component_state = Enabled Commands: cd set show -> set component_state = disabled # fmadm repair uuid-of-faultChapitre 2 Problèmes connus concernant le produit 13 Lors d'une réinitialisation suivant une erreur matérielle irrécupérable, les CPU risquent de ne pas démarrer (CR 7075336) Dans de rares cas, si le serveur ou module de serveur rencontre un problème sérieux qui génère une erreur grave, lorsque le serveur est redémarré, un certain nombre de CPU peuvent ne pas démarrer même si elles ne sont pas défectueuses. Exemple de type d'erreur affichée : Solution : connectez-vous à Oracle ILOM sur le SP et effectuez une mise sous tension progressive en tapant ce qui suit : Les opérations reset /SYS peuvent entraîner la disparition du contrôleur SAS (CR 7082665) Au cours de l'exécution de la commande reset /SYS Oracle ILOM, un contrôleur SAS peut ne pas s'initialiser correctement. Dans ce cas, il peut perdre le contact avec les périphériques de disque cible. Voici un exemple de message d'erreur qui peut s'afficher : rebooting... Resetting... ERROR: 63 CPUs in MD did not start -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS {0} ok boot disk Boot device: /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 File and args: ERROR: boot-read fail Can’t locate boot device {0} ok14 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Si un disque de données n'est pas disponible après l'exécution d'une commande reset /SYS, vous pouvez utiliser la commande OBP probe-scsi-all pour vérifier si les contrôleurs SAS sont présents. L'exemple suivant illustre la sortie que vous devez obtenir avec probe-scsi-all : {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50005ba000f SASAddress 5000c50005ba000d PhyNum 0 Target a Unit 0 Removable Read Only device TSSTcorp CDDVDW TS-T633A SR00 SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f76db7 SASAddress 5000c50016f76db5 PhyNum 1 Target c Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f765ef SASAddress 5000c50016f765ed PhyNum 2 Target d Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7833b SASAddress 5000c50016f78339 PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST914603SSUN146G 0868 286739329 Blocks, 146 GB SASDeviceName 5000c50016f777df SASAddress 5000c50016f777dd PhyNum 0 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7818b SASAddress 5000c50016f78189 PhyNum 2 Target b Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f758ff SASAddress 5000c50016f758fd PhyNum 3 Target c Unit 0 Disk SEAGATE ST914603SSUN146G 0B70 286739329 Blocks, 146 GB SASDeviceName 5000c50016f7703f SASAddress 5000c50016f7703d PhyNum 1 {0} okChapitre 2 Problèmes connus concernant le produit 15 Si vous n'obtenez pas l'une des lignes suivantes, cela peut être dû à l'erreur suivante (CR 7082665) : ¦ /pci@400/pci@2/pci@0/pci@4/scsi@0 ¦ /pci@400/pci@1/pci@0/pci@4/scsi@0 Pour effectuer un autre test relatif à cette condition d'erreur, vous pouvez utiliser la commande format(1) dans Oracle Solaris afin d'obtenir la liste de tous les disques disponibles pour le système d'exploitation. Si l'un des disques de données n'est pas présent après l'exécution d'une commande reset /SYS et l'initialisation du système d'exploitation, cela peut être dû à cette erreur (CR 7082665). Solution : à l'invite d'Oracle ILOM, entrez d'abord la commande stop /SYS, puis la commande start /SYS. Si le problème persiste après plusieurs mises sous tension progressives, contactez votre fournisseur de services Oracle autorisé. La commande SAS risque d'échouer si certains périphériques SAS subissent une charge importante (CR 7088469) Lorsque certains périphériques SAS subissent une charge importante, une réinitialisation du bus SCSI est susceptible de se produire. La réinitialisation du bus SCSI se traduira par un ou plusieurs messages d'avertissement écrits dans le fichier journal du système, /var/adm/messages. Exemple de message d'avertissement : Solution : aucune solution nécessaire. Le système va réessayer automatiquement la commande ayant échoué. Contactez votre fournisseur de services Oracle autorisé si le message suivant s'affiche : scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_handle_event_sync: IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_handle_event: IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /pci@400/pci@2/pci@0/pci@4/scsi@0 (mpt_sas1): mptsas_check_scsi_io: IOCStatus=0x4b IOCLogInfo=0x31120303 scsi: [ID 243001 kern.info] /scsi_vhci (scsi_vhci0): /scsi_vhci/disk@g5000c5003bee5ae3 (sd6): Command failed to complete (4) on path mpt_sas3/disk@w5000c5003bee5ae1,0 scsi: [ID 107833 kern.warning] WARNING: /scsi_vhci/disk@g5000c5003bee5ae3 (sd6): SCSI transport failed: reason ’reset’: retrying command SCSI transport failed: reason ’reset’: giving up16 Notes de produit du serveur SPARC T4-1 • Novembre 2011 La réinitialisation d'un domaine invité SDIO-SAS HBA peut générer une erreur ereport.io.pciex.pl.re (CR 7048307) La réinitialisation d'un domaine invité sur un système équipé d'un domaine invité SDIO-SAS peut générer un message d'erreur similaire à l'exemple suivant : Solution : effacez manuellement la ligne d'erreur MB en exécutant la commande suivante : Si le problème persiste ou se produit dans une situation autre que la réinitialisation du domaine invité SDIO-SAS HBA, contactez votre fournisseur de services Oracle autorisé pour obtenir de l'aide supplémentaire. Problèmes liés au système d’exploitation Oracle Solaris Cette section décrit les problèmes liés au SE Oracle Solaris observés dans cette version. Impossible de démarrer le SE Oracle Solaris 10 10/09 (U8) à partir du DVD interne Vous ne pouvez pas démarrer le système d’exploitation Oracle Solaris U8 partir du DVD interne. May 24 11:34:55 ctech19b SC Alert: [ID 234807 daemon.alert] Fault | critical: Fault detected at time = Tue May 24 18:34:55 2011. The suspect component: /SYS/MB has fault.io.pciex.device-interr-corr with probability=67. [...] # fmdump -eV -u cc3ba095-e3dd-6570-f457-f48b29250c82 TIME CLASS May 24 2011 11:30:56.971332756 ereport.io.pciex.pl.re [...] # fmadm faultyChapitre 2 Problèmes connus concernant le produit 17 Remarque – Cette limitation ne s’applique pas aux mises à jour ultérieures d’Oracle Solaris 10. Solution : vous pouvez utiliser un CD-Rom/DVD distant (espace de stockage de rKVMS) pour initialiser le média DVD ou l’image ISO. Une unité DVD USB externe permet également d’initialiser le média. Message d’interruption parasite affiché sur la console système (CR 6963563) Au cours du fonctionnement normal du serveur et lors de l’exécution du programme de test système Oracle VTS, la console système peut afficher le message suivant : Solution : Vous pouvez ignorer ce message en toute sécurité. Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) Le système miniroot est un système de fichiers root initialisable comprenant la version minimale du SE Oracle Solaris requise pour démarrer le serveur et configurer le système d’exploitation. Le système miniroot s’exécute uniquement lors du processus d’installation. Lorsque le serveur démarre le système miniroot pour la configuration initiale, les messages suivants peuvent s’afficher sur la console système : date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info] Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error.18 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Le messages indique que le serveur Xsun sous le système miniroot Oracle Solaris ne parvient pas à détecter un pilote pris en charge par le périphérique graphique AST dans le processeur de service. Ces messages sont légitimes, car le système miniroot contient uniquement l’environnement Xsun alors que le tampon de mémoire AST (astfb) est uniquement pris en charge par l’environnement Xorg. L’environnement Xorg est inclus dans le système installé. Par conséquent, le périphérique graphique peut être utilisé lors de l’exécution du SE Oracle Solaris installé. Solution : Vous pouvez ignorer ce message en toute sécurité. Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) Dans le cadre de l’installation du SE Oracle Solaris sur un périphérique, si le paramètre OBP diag-switch? est défini sur true, le programme d’installation d’Oracle Solaris ne parvient pas à mettre à jour le paramètre bootdevice pour refléter le nouveau chemin d’accès au périphérique sur lequel le SE a été installé. Par conséquent, ce chemin ne pourra pas être utilisé lors des redémarrages système automatiques suivants. Dans ces conditions, vous ne pouvez plus redémarrer à partir du périphérique et le serveur affiche le message d’erreur suivant : Sur les systèmes précédents, le paramètre OBP diag-device définissait le nouveau chemin d’accès au périphérique d’initialisation lorsque le paramètre diag-switch? était défini sur true. Sur les systèmes SPARC T4, le paramètre diag-device n’est plus pris en charge et le programme d’installation du SE Oracle Solaris génère un avertissement concernant le paramètre OBP boot-device. Solution : à partir de l’invite d’Oracle ILOM, définissez le paramètre OBP diagswitch? sur false : Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebooting -> set /HOST/bootmode script="setenv diag-switch? false"Chapitre 2 Problèmes connus concernant le produit 19 Remarque – La modification apportée au script /HOST/bootmode prendra effet à la prochaine mise sous tension du système. Autre solution : définissez ce paramètre à partir de l’invite ok d’OBP : Problèmes d’allocation de mémoire avec les HBA Emulex 8 Gbits installés dans un boîtier d’expansion d’E/S Magma (CR 6982072) Des erreurs d’allocation de mémoire peuvent se produire lorsque quatre cartes HBA Emulex PCI-Express FC 8 Gbits ou plus sont utilisées dans un boîtier d’expansion d’E/S Magma connecté à un serveur Oracle SPARC T4. L’exemple ci-dessous illustre l’un des types de messages pouvant être consignés dans le répertoire /var/adm/messages avec la configuration suivante : ok setenv diag-switch? false date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs22: ERROR: 301: Memory alloc failed. (BPL Pool buffer[1760]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs20: ERROR: 301: Memory alloc failed. (BPL Pool buffer[2765]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs24: ERROR: 301: Memory alloc failed. (BPL Pool buffer[3437]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs22: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs22: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs22: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs20: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs20: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs24: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs24: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.)20 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Solution : limitez à trois au maximum le nombre de cartes HBA Emulex PCI-Express FC 8 Gbits dans un boîtier d’expansion d’E/S Magma. La gestion des pannes envoie parfois des cas résolus au SP (CR 6983432) En raison de ce défaut, certaines erreurs PSH de l'hôte précédemment diagnostiquées et réparées réapparaissent dans Oracle ILOM lorsque l'hôte se réinitialise. Il s'affiche sous la forme d'un rapport incorrect d'une erreur diagnostiquée par PSH dans l'interface de ligne de commande et l'interface utilisateur du navigateur d'Oracle ILOM, et la DEL de panne s'allume. Vous pouvez identifier ce défaut en vérifiant si la même erreur PSH a également été signalée à partir de l'hôte. Si l'erreur a été signalée uniquement par Oracle ILOM et non par l'hôte, il s'agit probablement d'un exemple de ce défaut. Solution : Utilisez les outils de diagnostic et de réparation Oracle ILOM pour identifier une condition d'erreur, puis la corriger. L'exemple illustre la manière de diagnostiquer et de corriger une erreur PSH détectée par l'hôte. Cet exemple repose sur le shell de gestion des pannes d'Oracle ILOM. Vous pourriez à la place utiliser la CLI ou l'interface utilisateur du navigateur d'Oracle ILOM pour obtenir les mêmes résultats. 1. Affichez les informations sur l'erreur faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2011-09-16/15:38:19 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Major Fault class : fault.cpu.generic-sparc.strand FRU : /SYS/MB (Part Number: 7015272) (Serial Number: 465769T+1130Y6004M) Description : A fault has been diagnosed by the Host Operating System. Response : The service required LED on the chassis and on the affected FRU may be illuminated. Impact : No SP impact. Check the Host OS for more information.Chapitre 2 Problèmes connus concernant le produit 21 2. Recherchez les erreurs éventuelles sur l'hôte. 3. Vérifiez que l'erreur affichée par Oracle ILOM a été réparée sur l'hôte. 4. Eliminez le composant précédemment défectueux du cache des ressources de l'hôte. 5. Corrigez l'erreur dans Oracle ILOM. Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du SE Oracle Solaris 10 10/09 et d'un ensemble de patchs Solaris 10 9/10 ou Solaris 10 8/11 (CR 6995458) Le processus d’installation du package Oracle Solaris 10 10/09 présente un problème qui empêche l’insertion de la définition d’alias nxge conçue pour les serveurs SPARC T 4 dans /etc/driver_aliases. Si cet alias n’est pas correctement défini, il est impossible de connecter nxge. Action : The administrator should review the fault on the Host OS. Please refer to the Details section of the Knowledge Article for additional information. # fmadm faulty # <-- Host displays no faults # fmdump TIME UUID SUNW-MSG-ID Sep 16 08:38:19.5582 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Sep 16 08:40:47.8191 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-4M Repaired Sep 16 08:40:47.8446 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-6U Resolved # # fmadm flush /SYS/MB fmadm: flushed resource history for /SYS/MB # faultmgmtsp> fmadm repair /SYS/MB faultmgmtsp> fmadm faulty No faults found faultmgmtsp>22 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Action de récupération : pour remédier à ce problème, suivez les étapes décrites cidessous. Remarque – Connectez-vous en tant qu’utilisateurroot afin de pouvoir modifier le fichier driver_aliases. 1. Ajoutez l’entrée suivante à /etc/driver_aliases : 2. Redémarrez le système. 3. Configurez les interfaces réseau. La commande cfgadm échoue pour certains HBA (CR 7044759) La commande cfgadm échoue pour certains périphériques HBA (tels que SGX-SAS6- EXT-Z, SGX-SAS6-INT-Z, SG-SAS6-REM-Z). Exemple : Solution : désactivez le démon de gestion des pannes avant d'exécuter la commande cfgadm unconfigure. Une fois la tâche cfadm terminée, réactivez le démon de gestion des pannes : nxge "SUNW,niusl-kt" # cfgadm -c unconfigure Slot1 cfgadm: Component system is busy, try again: unconfigure failed WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 # svcadm disable fmd # ps -ef |grep fmd ... # cfgadm -c unconfigure PCI-EM0 # svcadm enable fmd Chapitre 2 Problèmes connus concernant le produit 23 De lourdes charges de travail et des configurations de mémoire maximale peuvent provoquer des délais d'attente du chien de garde (CR 7083001) Avec certaines lourdes charges de travail inhabituelles, notamment lorsqu'une charge de travail requérant une utilisation intensive du processeur est liée à cpu 0, l'hôte semble se réinitialiser soudainement sur OBP sans arrêt brutal ni erreur grave, et le journal des événements d'Oracle ILOM contient une entrée de type "Host watchdog expired" (Chien de garde de l'hôte arrivé à expiration). Le problème se produit plus souvent sur des systèmes dont la configuration de mémoire est saturée. Lorsque vous êtes confronté à ce type de réinitialisation soudaine, affichez le journal d'événements du SP à l'aide de cette commande depuis la CLI d'Oracle ILOM : Si l'erreur 7083001 se produit, vous voyez une entrée de type "Host watchdog expired". Solution : si l'erreur 7083001 se produit, contactez votre fournisseur de services autorisé pour savoir si une solution est disponible. Vous pouvez également résoudre ce problème en étendant le délai d'expiration du chien de garde en ajoutant l'entrée suivante au fichier /etc/system d'Oracle Solaris : Le délai d’expiration du chien de garde est ainsi étendu à 1 minute (60 000 millisecondes). En situations extrêmes, vous pouvez également entièrement désactiver le délai d'expiration du chien de garde en ajoutant l'entrée suivante au fichier /etc/system : Vous devez réinitialiser le système afin que toutes les modifications apportées au fichier /etc/system prennent effet. -> show /SP/logs/event/list set watchdog_timeout = 60000 set watchdog_enabled = 024 Notes de produit du serveur SPARC T4-1 • Novembre 2011 S'il n'est pas souhaitable de réinitialiser le système immédiatement après la modification du fichier /etc/system, vous pouvez appliquer une solution supplémentaire temporaire à effet immédiat. Pour appliquer cette solution temporaire, exécutez la commande suivante en tant que root : Cette commande crée un ensemble de processeurs temporaire contenant uniquement cpu 0, empêchant les charges de travail de l'application d'utiliser ce processeur et ce problème de se produire. Remarque – Si certains threads sont liés à cpu 0, le lien est alors supprimé. Cet ensemble de processeurs temporaire est supprimé lors de la réinitialisation suivante du système d'exploitation, moment auquel la solution du fichier /etc/system décrite ci-dessus est appliquée. Message d’erreur mineur : mptsas request inquiry page 0x83 for target:a, lun:0 failed! (CR 7092982) Vous pouvez voir le message d’erreur suivant dans /var/adm/messages lorsque le système est réinitialisé : Solution : Vous pouvez ignorer ce message en toute sécurité. Oracle VTS dtlbtest se bloque lorsque le mode CPU Threading est défini sur max-ipc (CR 7094158) Le test dtlbtest en mode stress du composant Oracle VTS se bloque lorsque le mode threading max-ipc est activé. Ce problème n'est pas spécifique à un type de processeur particulier et peut se produire lorsque les deux situations suivantes se présentent : ¦ Une seule CPU ou un seul brin par noyau est activé ou en ligne. ¦ Le nombre total de CPU/brins en ligne est inférieur ou égal à 128. Solution : n'exécutez pas le test des processeurs Oracle VTS en mode stress élevé lorsqu'Oracle VM pour SPARC est en mode max-ipc. # psrset -c -F 0 mptsas request inquiry page 0x83 for target:a, lun:0 failed!Chapitre 2 Problèmes connus concernant le produit 25 Problèmes liés au microprogramme Cette section décrit des problèmes relatifs au microprogramme système. L'horodatage d'un événement critique/d'une erreur dans Oracle ILOM est parfois décalé d'une heure (CR 6943957) L'horodatage signalé dans un e-mail généré lors d'un événement critique/d'une erreur Oracle ILOM indique parfois une heure de plus que l'horodatage enregistré dans le journal d'événements. Le problème est probablement causé par la méthode utilisée pour calculer le passage à l'heure d'été. Action de récupération : vérifiez l'horodatage enregistré dans le journal d'événements. Si cet horodatage ne correspond pas à l'horodatage signalé dans l'e-mail, utilisez l'heure du journal d'événements. e1000g : Pilote générant des rapports en ligne parasites Lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (CR 6958011) Lors de l’installation du SE Oracle Solaris sur des domaines contrôlés au moyen d’adaptateurs Sun PCIe Dual Gigabit Ethernet (UTP ou MMF), le pilote Gigabit Ethernet e1000g peut générer des rapports de fausses erreurs sur les domaines SDIO (Static Direct Input/Output) et principaux. L’exemple suivant illustre ce type de rapport parasite : date time ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 ena = 0x298a9f62243802 detector = (embedded nvlist) nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca26 Notes de produit du serveur SPARC T4-1 • Novembre 2011 Solution : vous pouvez ignorer ces rapports en ligne en toute sécurité. Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (CR 6968801) Lors de l’exécution d'Oracle VTS sur les plates-formes de la série T4, il est possible (bien que rare) qu’un test d’Oracle VTS se bloque. Si cela se produit, d’autres processus et commandes peuvent également se bloquer, notamment fmadm et prtconf. Il est impossible de terminer les processus bloqués. Solution : redémarrez le système. Si le problème se répète, contactez votre fournisseur de services agréé. Evitez d’exécuter Oracle VTS dans des environnements de production. Clarification du message sas2ircu indiquant que les tailles de volume RAID autres que MAX ne sont pas prises en charge (CR 6983210) Si vous tentez de créer un volume RAID d’une taille inférieure à la taille MAX, la série de messages suivante s’affiche : dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600 source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a0 You are about to create an IR volume. WARNING: Proceeding with this operation may cause data loss or data corruption. Are you sure you want to proceed (YES/NO)? yes WARNING: Volume created with size other than ’MAX’ is not supported.Chapitre 2 Problèmes connus concernant le produit 27 Il est vrai que les volumes RAID dont la taille est inférieure à la taille MAX ne sont pas pris en charge. Toutefois, si vous souhaitez créer un volume d’une taille inférieure à la taille MAX pour une utilisation autre qu’en production, le logiciel vous permet de le faire. Le message n’est pas clair sur ce point. Solution : ignorez les messages et répondez Oui à la question demandant si vous souhaitez continuer la création du volume. Les unités utilisées pour définir la durée maximale de gestion de l'alimentation de la MIB (base d'informations de gestion) sont les secondes (CR 6993008) La MIB est censée signaler le paramètre sunHwCtrlPowerMgmtBudgetTimelimit en millisecondes, toutefois la valeur s'affiche en secondes. Solution : Se rendre compte que la valeur signalée pour sunHwCtrlPowerMgmtBudgetTimelimit est en secondes. Un message de cpustat fait référence à la documentation du processeur de manière incorrecte (CR 7046898) Un message affiché par la commande cpustat stipule ce qui suit : Le document et le site Web répertoriés dans ce message ne sont pas disponibles. Do you want to continue with volume creation (YES/NO)? n SAS2IRCU: you must answer "YES" or "yes" to proceed; operation aborted! SAS2IRCU: Error executing command CREATE. SPARC T4 Supplement to Oracle SPARC Architecture 2011 User’s Manual" for descriptions of these events. Documentation for Sun processors can be found at: http://www.sun.com/processors/manuals28 Notes de produit du serveur SPARC T4-1 • Novembre 2011 La commande reboot disk échoue parfois lorsque l'argument disk détecte des caractères supplémentaires (CR 7050975) Lorsque vous exécutez la commande reboot disk, des caractères superflus sont parfois ajoutés à l'argument disk avant qu'il n'atteigne l'OBP (OpenBoot PROM). Cela entraîne l'échec de l'initialisation. Solution : Relancez la requête d'initialisation. La DEL bleue ne s'allume pas sur le disque lorsque celui-ci est prêt à être retiré (CR 7082700) Lorsque vous tentez d'annuler la configuration d'un disque afin de le retirer, la DEL bleue du disque indiquant que ce dernier peut être retiré ne s'allume parfois pas. Ce problème se produit après avoir remplacé un disque à un emplacement par un disque dont le WWID est différent. Solution : si vous avez inséré un disque après l'initialisation du serveur, notez que la DEL bleue n'exécutera pas cette fonction tant que le serveur n'aura pas démarré une nouvelle fois. Module serveur SPARC T4-1B Notes de produit Réf.: E26255-01 Novembre 2011Veuillez recycler Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. En tant que tels, leurs utilisation, duplication, divulgation, modification et adaptation doivent être soumises aux restrictions et conditions de licence énoncées dans le contrat du Gouvernement applicable et, dans la mesure autorisée par ce contrat du Gouvernement, aux droits supplémentaires énoncés dans le FAR 52.227-19, Commercial Computer Software License (décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion d'informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée de The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation vii 1. Informations de dernière minute 1 Châssis pris en charge 2 ? Identification de la version de votre châssis 2 Composants matériels pris en charge 3 Logiciels préinstallés 4 Versions du SE, du microprogramme et des logiciels prises en charge 5 Informations sur les patchs 6 ? Se procurer les patchs 7 Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 8 Identification des noms de disque logique et des emplacements physiques 8 ? Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande diskinfo) 10 ? Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande probe-scsi-all) 11 Syntaxe WWN d'Oracle Solaris JumpStart 12 Exemple d’installation interactive 13iv Notes de produit du module serveur SPARC T4-1B • Novembre 2011 2. Problèmes connus concernant le produit 15 Problèmes liés au matériel 15 Les claviers Sun de type 6 ne sont pas pris en charge par les serveurs SPARC de la série T4 15 PSH peut ne pas effacer une ligne de cache obsolète sur une carte mère remplacée (CR 7031216) 16 Longueur limite de câble USB de 2 mètres (7048419) 16 Lors d'une réinitialisation suivant une erreur matérielle irrécupérable, les CPU risquent de ne pas démarrer (CR 7075336) 16 La DEL bleue ne s'allume pas sur le disque lorsque celui-ci est prêt à être retiré (CR 7082700) 17 Problèmes de microprogramme, de SE et autres 17 Erreur fault.memory.memlink-uc n'engendre pas de panique contrairement au texte du message système (CR 6940599) 17 L'horodatage d'un événement critique/d'une erreur dans Oracle ILOM est parfois décalé d'une heure (CR 6943957) 18 e1000g : Pilote générant des rapports en ligne parasites lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (CR 6958011) 18 cfgadm affiche disconnected au lieu de empty lorsque certains EM PCI sont supprimés (CR 6980416) 19 Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) 20 sas2ircu : message indiquant que les tailles de volume RAID autres que la taille maximale ne sont pas prises en charge (CR 6983210) 21 La gestion des pannes envoie parfois des cas résolus au SP (CR 6983432) 21 Les unités utilisées pour définir la durée maximale de gestion de l'alimentation de la MIB (base d'informations de gestion) sont les secondes (CR 6993008) 23 Un message d'interruption parasite s'affiche sur la console système lors de l'utilisation d'Oracle VTS (CR 7038266) 23 Un délai d'expiration intermittent de formation de lien s'affiche au cours des mises sous tension progressives (CR 7043201) 24Sommaire v La commande cfgadm échoue parfois sur les HBA SG-SAS6-REM-Z ou SGXSAS6-REM-Z (CR 7044759) 24 Un message de cpustat réfère à la documentation du processeur de manière incorrecte (CR 7046898) 25 La command reboot disk échoue parfois elorsque l'argument disk détecte des caractères supplémentaires (CR 7050975) 25 Des erreurs pouvant être corrigées par PCIe sont parfois signalées (CR 7051331) 25 De lourdes charges de travail et des configurations de mémoire maximale peuvent provoquer des délais d'attente du chien de garde (CR 7083001) 26 ereport.fm.fmd.module : généré lors de la réinitialisation d'un domaine SDIO (CR 7085231) 28 Oracle VTS dtlbtest se bloque lorsque le mode CPU Threading est défini sur max-ipc (CR 7094158) 29vi Notes de produit du module serveur SPARC T4-1B • Novembre 2011vii Utilisation de cette documentation Ce document fournit des informations importantes, ainsi que les toutes dernières informations concernant le module serveur SPARC T4-1B d'Oracle. ¦ « Documentation connexe », page vii ¦ « Commentaires », page viii ¦ « Support et accessibilité », page viii Documentation connexe Tableau répertoriant les URL de la documentation connexe Documentation Liens Tous les produits Oracle http://www.oracle.com/documentation Module serveur SPARC T4-1B http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1B Système modulaire Sun Blade 6000 http://www.oracle.com/pls/topic/lookup?ctx=E19938-01 Oracle Integrated Lights Out Manager (Oracle ILOM) 3.0 http://www.oracle.com/technetwork/documentation/sys-mgmtnetworking-190072.html SE Oracle Solaris et autres logiciels système http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Logiciel Oracle VTS http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 Compatibilité SAS- 1/SAS-2 http://www.oracle.com/pls/topic/lookup?ctx=E22513_01viii Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Commentaires Vous pouvez laisser vos commentaires relatifs à cette documentation sur le site : http://www.oracle.com/goto/docfeedback Support et accessibilité Place alternate text for the preceding table here. Description Liens Accédez à l'assistance électronique via My Oracle Support http://support.oracle.com Pour les malentendants : http://www.oracle.com/accessibility/support.html Découvrez l'engagement d'Oracle vis à vis de l'accessibilité http://www.oracle.com/us/corporate/accessibility/index.html1 C H A P I T R E 1 Informations de dernière minute Les sections suivantes fournissent des informations importantes, ainsi que les toutes dernières informations concernant le module serveur : ¦ « Châssis pris en charge », page 2 ¦ « Composants matériels pris en charge », page 3 ¦ « Logiciels préinstallés », page 4 ¦ « Versions du SE, du microprogramme et des logiciels prises en charge », page 5 ¦ « Informations sur les patchs », page 6 ¦ « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 8 ¦ « Identification des noms de disque logique et des emplacements physiques », page 82 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Châssis pris en charge Plusieurs versions du système modulaire Sun Blade 6000 existent. Les deux dernières prennent en charge les composants modulaires SAS-1 et SAS-2. Les EM et NEM PCIe compatibles Gen2 connectés à ce module serveur via le châssis s'exécutent à des vitesses Gen2. Les périphériques compatibles Gen1 s'exécutent à des vitesses Gen1. Ce module serveur est pris en charge dans les modèles de châssis suivants : ¦ Le dernier modèle (A90-D) du système modulaire Sun Blade 6000 requiert au moins la version 4.0 du logiciel CMM. ¦ Modèle précédent (A90-B) du système modulaire Sun Blade 6000 : Requiert le logiciel CMM version 3.3 ou plus récente. Pour déterminer la version de votre châssis, voir « Identification de la version de votre châssis », page 2. ? Identification de la version de votre châssis ? Examinez le CMM à l'arrière du système modulaire (châssis). Figure illustrant la disposition des DEL du CMM à l'arrière du châssis. ¦ Gauche : CMM du modèle précédent (A90-B) du châssis ¦ Droite : CMM du tout dernier modèle (A90-D) du châssis Pour plus d'informations sur le châssis, reportez-vous à la documentation du système modulaire Sun Blade 6000.Chapitre 1 Informations de dernière minute 3 Composants matériels pris en charge Tableau répertoriant tous les NEM, REM et FEM pris en charge. Composants matériels Description NEM NEM 7100091 ou 7011713 : NEM (Network Express Module) de 40 GbE virtualisé Sun Blade 6000 Requiert : • Pour bénéficier d'une connectivité de 1 GbE : aucun FEM n'est requis. • Pour bénéficier d'une connectivité de 10 GbE : FEM 7100283 ou 7100633. • Pour bénéficier d'une connectivité de stockage SAS2 : REM SG- ou SGX- SAS6-REM-Z NEM 2073A : NEM (Network Express Module) Sun Blade 6000 Ethernet Switched 24p 10 GbE Requiert : • Pour bénéficier d’une connectivité réseau 10 GbE : FEM 4871A-Z. • Pour bénéficier d’une connectivité de stockage : REM SG-SAS6-REM-Z. Remarque - Pour plus d'informations sur la configuration requise par ce NEM, reportez-vous aux Notes de produit du NEM Sun Blade 6000 Ethernet Switched 24p 10 GbE. NEM 4338A – NEM virtualisé Sun Blade 6000 à 10 ports 1 GbE + SAS à 4 ports + à 2 ports 10 GbE (SFP) Requiert : • Pour bénéficier d'une connectivité de 1 GbE : aucun FEM n'est requis. • Pour bénéficier d'une connectivité de 10 GbE : FEM 7100283 ou 7100633. • Pour bénéficier d'une connectivité de stockage SAS2 : REM SG- ou SGX- SAS6-REM-Z NEM 4250A – Intercommunication par NEM (Network Express Module) Sun Blade 6000 à 10 ports 1 GbE Permet de bénéficier d'une connectivité GbE : aucun FEM n'est requis. Modules REM REM SG(X)-SAS6-REM-Z : HBA Sun StorageTek 6 Gbps SAS REM Avant de procéder à l’installation, mettez à jour le microprogramme sur les composants SAS-1. Reportez-vous à la section « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 8. FEM FEM 7100283 ou FEM d'intercommunication PCI-E 7100633 Pris en charge. FEM X4871A-Z : FEM Sun PCIe 2.0 10 GbE à double accès Pris en charge.4 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Logiciels préinstallés Le SE Oracle Solaris préinstallé est stocké sur un système de fichiers ZFS. Tableau répertoriant la version des logiciels préinstallés. Une copie du SE Oracle Solaris est préinstallée sur le premier disque du module serveur. Le SE est prêt à être configuré au moment opportun lors de la mise sous tension initiale du serveur. Vous devez cependant installer les patchs obligatoires avant de mettre le module serveur en service. Reportez-vous à la section « Informations sur les patchs », page 6. Vous pouvez réinstaller le SE et installer les patchs au lieu d'utiliser le SE préinstallé. Reportez-vous à la section « Versions du SE, du microprogramme et des logiciels prises en charge », page 5. Vous trouverez des instructions d’installation et de configuration d’Oracle Solaris, dans la documentation livrée avec le système d’exploitation. Logiciel Emplacement Fonction SE Oracle Solaris 10 8/11 Partition racine (/) sur disque 0, tranche 0 Remarque - Les patchs obligatoires ne sont pas installés. Vous devez vous les procurer et les installer avant de mettre le module serveur en service. Reportez-vous à la section « Informations sur les patchs », page 6. SE. Oracle VM Server pour SPARC 2.1 /opt/SUNWldm Gestion des domaines logiques. Electronic Prognostics (EP) 1.2 /opt/ep Génération d’avertissements précoces concernant des pannes de FRU potentielles.Chapitre 1 Informations de dernière minute 5 Versions du SE, du microprogramme et des logiciels prises en charge Tableau répertoriant les versions prises en charge du SE, du microprogramme et des logiciels. Logiciel Versions prises en charge SE hôte Vous pouvez utiliser la version suivante du SE (préinstallée ou réinstallée) : • SE Oracle Solaris 10 8/11 (patchs obligatoires). Les patchs obligatoires ne sont pas installés. Vous devez vous les procurer et les installer avant de mettre le module serveur en service. Vous pouvez également réinstaller le module serveur avec les versions suivantes du SE : • SE Oracle Solaris 10 9/10 (patchs obligatoires) • SE Oracle Solaris 10 10/09 (patchs obligatoires) Pour plus d'informations sur les patchs du SE, reportez-vous à « Informations sur les patchs », page 6. Microprogramme système 8.1.2.b (inclut Oracle ILOM 3.0). Oracle VM Server pour SPARC (LDoms) 2.1 et patchs associés. Les patchs sont inclus et préinstallés sur le SE préinstallé. Oracle Electronic Prognostics (EP) 1.2 Ce logiciel génère des avertissements précoces concernant des pannes de FRU potentielles.6 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Informations sur les patchs Lorsque vous utilisez le SE préinstallé ou réinstallez le SE sur le module serveur, vous devez au préalable installer certains patchs avant de pouvoir mettre le module serveur en service. Installez les patchs appropriés conformément aux tableaux suivants. Tableau répertoriant les patchs du SE. Tableau répertoriant les patchs du SE. TABLEAU 1-1 Patch du SE Oracle Solaris 10 8/11 Ordre d’installation SE ou patch 1 Utilisez le SE préinstallé ou réinstallez le SE Oracle Solaris 10 8/11 2 Les patchs obligatoires suivants : • 147440-04 (ou version plus récente) • 147149-01 (ou version plus récente) • 147153-01 (ou version plus récente) • 147707-01 (ou version plus récente) • 147159-03 (ou version plus récente) 3 Ensemble de patchs recommandé pour SPARC Solaris 10 TABLEAU 1-2 Patchs des SE Oracle Solaris 10 9/10 OS et Oracle Solaris 10 10/09 Ordre d’installation SE ou patch 1 SE Oracle Solaris 10 9/10 ou Oracle Solaris 10 10/09 2 Bundle de patchs Solaris 10 8/11 (13058415) 3 Patchs obligatoires suivants : • 147440-04 (ou version plus récente) • 147149-01 (ou version plus récente) • 147153-01 (ou version plus récente) • 147707-01 (ou version plus récente) • 147159-03 (ou version plus récente) 4 Ensemble de patchs recommandé pour SPARC Solaris 10 Chapitre 1 Informations de dernière minute 7 Remarque – Vous trouverez des informations actualisées sur les patchs obligatoires et les mises à jour des composants matériels et logiciels optionnels dans la documentation des produits concernés. ? Se procurer les patchs 1. Me connecter à My Oracle Support : http://support.oracle.com 2. Cliquez sur l'onglet Patches & Updates (Patchs et mises à jour). 3. Recherchez des patchs dans le panneau Patch Search (Recherche de patchs). Pour rechercher un patch à l'aide du champ Patch Name (Nom du patch) ou Number (Numéro), spécifiez le nom ou numéro complet du patch. Par exemple : ¦ Bundle de patchs pour Solaris 10 8/11 ¦ 13058415 ¦ 147159-03 Pour rechercher un numéro de patch sans son numéro de révision (deux derniers chiffres), utilisez % à la place du numéro de révision. Par exemple : 14159-% 4. Une fois le patch trouvé, vous pouvez consulter le fichier LISEZ-MOI et télécharger le patch à partir du site. Le fichier LISEZ-MOI du patch contient la procédure d'installation.8 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 Vous devez mettre à niveau le microprogramme de tous les composants SAS-1 (modules NEM SAS-1 et modules de stockage) vers une version prenant en charge la coexistence de modules SAS-1 et SAS-2. Cette mise à niveau doit être effectuée avant l'insertion d'un composant SAS-2 dans le châssis. Tous les expandeurs SAS des NEM SAS-1 et modules de stockage Sun Blade 6000 doivent être mis à niveau vers la version 5.04.03 du microprogramme (ou une version plus récente). Cette révision du microprogramme permet de faire coexister les périphériques SAS-1/SAS-2 dans le châssis du système modulaire Sun Blade 6000. Si vous utilisez des versions antérieures du microprogramme, vous risquez d’entraîner le blocage des périphériques SAS-2. Pour plus d'informations, reportez-vous au SAS-1/SAS-2 Compatibility Upgrade Guide (Guide de mise à niveau pour la compatibilité de SAS-1/SAS-2). Ce document est disponible sur le site suivant : http://www.oracle.com/pls/topic/lookup?ctx=E22513_01 Identification des noms de disque logique et des emplacements physiques Le SE Oracle Solaris utilise dorénavant le numéro universel (WWN, Worldwide Number) au lieu du champ tn (ID cible) comme nom de disque logique des contrôleurs de stockage SAS-2. Ce changement modifie la manière dont vous faites correspondre le nom logique d'un disque avec son emplacement physique. Les points suivants sont essentiels pour comprendre l’impact de ce changement : ¦ Avant l'utilisation des noms universels, le SE identifiait les disques par un nom logique du type c0t0d0.. Ce nom logique était mappé vers l'emplacement physique du disque.Chapitre 1 Informations de dernière minute 9 Depuis ce changement, l'identificateur des disques est dorénavant cntWWNdn, où WWN correspond à une valeur hexadécimale unique. Exemple de nom de périphérique logique : c0t5000C50033438DBBd0 Cette valeur WWN n'est pas mappée de manière prévisible vers l'emplacement physique du disque. ¦ L'OBP et le SE utilisent des numéros WWN différents pour identifier un disque. Pour plus d'informations, reportez-vous à Etape 3 de la rubrique « Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande diskinfo) », page 10. ¦ Diverses situations nécessitent la mise en correspondance d'un nom de périphérique logique avec l'emplacement physique d'un disque. Par exemple : ¦ Lors du téléchargement du SE sur un réseau, vous devez spécifier le nom de périphérique logique du disque se trouvant à l'emplacement 0 (périphérique d'initialisation par défaut). En outre, si vous utilisez Oracle Solaris JumpStart, vous devez utiliser une syntaxe WWN particulière. Reportez-vous à la section « Syntaxe WWN d'Oracle Solaris JumpStart », page 12. ¦ Lorsque vous prévoyez d'exécuter la commande format, vous devez sélectionner l'un des noms de périphérique logique présentés. Pour vous assurer de sélectionner le disque approprié, vous devez faire correspondre un nom de périphérique logique à un disque physique. ¦ Si un message système répertoriant le nom de périphérique logique du disque s'affiche, vous devez parfois identifier l'emplacement auquel le disque est installé. Il existe plusieurs manières de faire correspondre des noms de périphérique logique de disque à des emplacements physiques, et vice-versa. ¦ A partir du SE Oracle Solaris 10 8/10, utilisez la commande diskinfo. Reportezvous à la section « Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande diskinfo) », page 10. ¦ A l'invite OBP ok, saisissez la commande probe-scsi-all. Reportez-vous à la section « Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande probe-scsi-all) », page 11.10 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 ? Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande diskinfo) La commande diskinfo est un utilitaire permettant d'identifier les nouveaux disques et emplacements. Cette commande a été introduite dans le SE Oracle Solaris 10 8/10 et dans le patch du noyau 144500-19 (ou plus récent). Si vous n'avez pas accès au SE, lorsque le module serveur n'est par exemple pas initialisé, reportez-vous plutôt à la rubrique « Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande probe-scsiall) », page 11. Si votre SE ne dispose pas de la commande diskinfo, reportez-vous au SPARC T4 Series Servers Administration Guide (Guide d'administration des serveurs SPARC de la série T4) pour voir les autres méthodes disponibles. 1. Connectez-vous au SE. 2. Tapez : 3. Utilisez la sortie figurant dans les colonnes Label (Etiquette) et Disk Name (Nom du disque) pour faire correspondre l'emplacement physique d'un disque à son nom de périphérique logique. Pour ce module serveur : ¦ /SYS/HDD0 représente un disque à l'emplacement 0. ¦ /SYS/HDD1 représente un disque à l'emplacement 1. Dans cet exemple, le disque installé à l'emplacement 0 porte le nom de périphérique logique c0t5000C50033438DBBd0. # diskinfo -a Enclosure path: 1114BD0ACC-physical-hba-0 Chassis Serial Number: 1114BD0ACC-physical-hba-0 Chassis Model: ORCL,SPARC-T4-1B Label Disk name Vendor Product Vers ---------- ---------------------- -------- ---------------- ---- /SYS/HDD0 c0t5000C50033438DBBd0 SEAGATE ST930003SSUN300G 0B70 /SYS/HDD1 c0t5000C50005C15803d0 SEAGATE ST930003SSUN300G 0468Chapitre 1 Informations de dernière minute 11 Remarque – La commande diskinfo fournit diverses informations sur les disques, liées aux options de commande spécifiées. Pour plus d'informations, saisissez diskinfo -h, puis reportez-vous à la page de manuel diskinfo(1M). ? Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande probe-scsi-all) Si vous avez accès au SE, vous pouvez peut-être utiliser la commande diskinfo à la place. Reportez-vous à la section « Correspondance entre les noms de périphérique WWN et les emplacements physiques (commande diskinfo) », page 10. 1. A l’invite ok, saisissez : {0} ok probe-scsi-all /pci@400/pci@1/pci@0/pci@c/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c50033438dbb SASAddress 5000c50033438db9 PhyNum 0 <=HD,slot 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0468 585937500 Blocks, 300 GB SASDeviceName 5000c50005c15803 SASAddress 5000c50005c15801 PhyNum 1 <=HD,slot 1 Target c Unit 0 Encl Serv device SUN NEM Hydra II SOL 0308 SASAddress 5080020000bb193d PhyNum 24 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.0012 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 2. Dans la sortie, recherchez les identificateurs de disque suivants : ¦ LSI,sas@0 : Contrôleur (REM) sur le module serveur. ¦ SASDeviceName : WWN reconnu par le SE Oracle Solaris. ¦ SASAddress : WWN auquel réfère l'OBP. ¦ PhyNum : Emplacement physique occupé par le disque. 3. Utilisez les valeurs figurant dans la sortie pour créer le nom de périphérique logique Oracle Solaris résultant, tel qu'indiqué par cntndn. Cet exemple repose sur la sortie précédente : ¦ cn = c0 n correspond au numéro du contrôleur SAS, 0 dans cet exemple. ¦ tn = t5000c50033438dbb n correspond à la valeur SASDeviceName. ¦ dn = d0 n est 0 pour l'ensemble des périphériques SCSI intégrés. Le nom de périphérique logique résultant est c0t5000c50033438dbbd0. Syntaxe WWN d'Oracle Solaris JumpStart La syntaxe d’Oracle Solaris requiert la mise en majuscules de tous les caractères alphabétiques WWN. Remarque – Seule la portion WWN du nom de périphérique logique requiert la mise en majuscules de tous les caractères alphabétiques. Les portions c0 et d0 ne sont pas mises en majuscules. Cet exemple de profil JumpStart illustre l'utilisation de la syntaxe WWN lors de l'installation du SE sur un disque spécifique. # install_type flash_install boot_device c0t5000C50033438DBBd0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/la test.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapChapitre 1 Informations de dernière minute 13 Exemple d’installation interactive Lors d'une installation interactive, un message vous invite à spécifier un ou plusieurs disques comme cibles d’installation du SE. Cette étape a pour objectif de s’assurer que l’installation dispose de suffisamment d’espace de stockage. Dans le cadre de cette étape, spécifiez le disque dont la valeur WWN correspond au disque sur lequel vous souhaitez installer le logiciel. Ces valeurs WWN sont illustrées dans l’exemple interactif suivant. Le disque sélectionné comme cible d’installation se trouve à l’emplacement de disque 0, l’emplacement d'initialisation par défaut. Remarque – Si vous préférez un autre disque, vous pouvez le définir à la place de l’emplacement de disque dur 0. Remarque – Les nouveaux disques et les disques de remplacement doivent parfois être libellés à l'aide de l'utilitaire format avant de pouvoir installer le SE. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000C50005C15803d0 286090 MB [X] c0t5000C50033438DBBd0 286090 MB (F4 to edit) Total Selected: 286090 MB Suggested Minimum: 5032 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_Help14 Notes de produit du module serveur SPARC T4-1B • Novembre 201115 C H A P I T R E 2 Problèmes connus concernant le produit Les sections suivantes décrivent les problèmes connus de ce module serveur : ¦ « Problèmes liés au matériel », page 15 ¦ « Problèmes de microprogramme, de SE et autres », page 17 Problèmes liés au matériel Ces notes répertorient les problèmes matériels connus et leur solution. Les claviers Sun de type 6 ne sont pas pris en charge par les serveurs SPARC de la série T4 Les claviers Sun de type 6 ne peuvent pas être utilisés avec les serveurs SPARC de la série T4.16 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 PSH peut ne pas effacer une ligne de cache obsolète sur une carte mère remplacée (CR 7031216) Lorsque le boîtier est remplacé pour réparer une mémoire cache défectueuse sur la carte mère, PSH peut ne pas effacer le cache sur le boîtier remplacé. La ligne de cache reste désactivée. Solution : Utilisez les commandes suivantes pour l'effacer manuellement : Longueur limite de câble USB de 2 mètres (7048419) Le module serveur dispose de trois ports USB : ¦ Les ports 1 et 2 sont accessibles via un dongle connecté au connecteur UCP avant. ¦ Le port 3 est situé à l'arrière de la carte mère (conçu pour un disque à mémoire flash). Solution : Si vous connectez des périphériques USB aux ports 1 ou 2, assurez-vous que le câble ne mesure pas plus de 2 mètres. Lors d'une réinitialisation suivant une erreur matérielle irrécupérable, les CPU risquent de ne pas démarrer (CR 7075336) Dans de rares situations, un probléme serieux de serveur ou de module serveur entraîner une panique du système. Lorsque le serveur ou module serveur est réinitialisé, une ou plusieurs CPU risquent de ne pas démarrer alors qu'elles fonctionnent correctement. Exemple de type d'erreur affichée : # fmadm repaired fmri | label # fmadm replaced fmri | label rebooting... Resetting... ERROR: 63 CPUs in MD did not startChapitre 2 Problèmes connus concernant le produit 17 Solution : Connectez-vous à Oracle ILOM sur le SP, puis mettez l'hôte progressivement sous tension : La DEL bleue ne s'allume pas sur le disque lorsque celui-ci est prêt à être retiré (CR 7082700) Parfois, lorsque vous essayez d'annuler la configuration d'un disque pour le retirer, sa DEL bleue, indiquant qu'il peut être retiré, peut ne pas s'allumer. Ce problème se produit après avoir remplacé un disque à un emplacement par un disque dont le WWID diffère. Solution : Si vous avez inséré un disque après avoir initialisé le serveur, réinitialisez le serveur pour que la DEL bleue fonctionne correctement. Problèmes de microprogramme, de SE et autres Les notes suivantes décrivent les problèmes connus relatifs au microprogramme, au SE et aux autres logiciels. Erreur fault.memory.memlink-uc n'engendre pas de panique contrairement au texte du message système (CR 6940599) Lorsqu’une erreur d’interconnexion de type fault.memory.memlink-uc est détectée, le serveur devrait s’arrêter pour protéger l’intégrité de la mémoire. Cette panne a été signalée de manière intermittente lors d’opérations d’initialisation sans arrêt du serveur. -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS18 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Bien que ce comportement occasionnel puisse indiquer que le système a été en mesure de reprendre les opérations suite à l'erreur de liaison de mémoire et de rétablir un état d'initialisation fonctionnel, il est recommandé de mettre le serveur progressivement hors tension. Solution : Connectez-vous à Oracle ILOM sur le SP, puis mettez progressivement l'hôte sous tension : L'horodatage d'un événement critique/d'une erreur dans Oracle ILOM est parfois décalé d'une heure (CR 6943957) L'horodatage signalé dans un e-mail généré lors d'un événement critique/d'une erreur Oracle ILOM indique parfois une heure de plus que l'horodatage enregistré dans le journal d'événements. Solution : Vérifiez l'horodatage enregistré dans le journal d'événements. Si cet horodatage ne correspond pas à l'horodatage signalé dans l'e-mail, utilisez l'heure du journal d'événements. e1000g : Pilote générant des rapports en ligne parasites lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (CR 6958011) Lors de l’installation du SE Oracle Solaris sur des domaines contrôlés au moyen d’adaptateurs Sun PCIe Dual Gigabit Ethernet (UTP ou MMF), le pilote e1000g peut générer des rapports de fausses erreurs sur les domaines SDIO (Static Direct Input/Output) et principaux. Par exemple : -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS date time ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 ena = 0x298a9f62243802 detector = (embedded nvlist)Chapitre 2 Problèmes connus concernant le produit 19 Solution : Vous pouvez ignorer ces rapports en ligne en toute sécurité. cfgadm affiche disconnected au lieu de empty lorsque certains EM PCI sont supprimés (CR 6980416) Après avoir préparé un EM PCI pour le retirer avec le bouton ATTN, la commande cfgadm signale bien que le réceptacle de l'EM PCI est déconnecté, ce qui indique que la carte peut être retirée. Une fois la carte retirée, la commande cfgadm devrait signaler que le réceptacle de l'EM PCI est vide ; toutefois, pour certains EM PCI, la commande cfgadm signale que le réceptacle est déconnecté. Solution : N'utilisez pas la commande cfgadm pour identifier les réceptacles d'EM PCI vides. nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600 source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a020 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) Dans le cadre de l’installation du SE Oracle Solaris, si le paramètre OBP diagswitch? est défini sur true, le programme d’installation du SE ne parvient pas à mettre à jour le paramètre bootdevice pour refléter le nouveau chemin d’accès au périphérique sur lequel le SE a été installé. Par conséquent, ce chemin ne pourra pas être utilisé lors des redémarrages système automatiques suivants. Dans ces conditions, le serveur affiche ces messages d'erreur et vous empêche d'effectuer une réinitialisation à partir du périphérique : Sur les serveurs et modules serveur précédents, le paramètre OBP diag-device définissait le nouveau chemin d’accès au périphérique d’initialisation lorsque le paramètre diag-switch? était défini sur true. Sur les serveurs et modules serveur SPARC T4, le paramètre diag-device n’est plus pris en charge et le programme d’installation du SE Oracle Solaris génère un avertissement concernant le paramètre OBP boot-device. Solution : A partir de l’invite d’Oracle ILOM, définissez le paramètre OBP diagswitch? sur false : Une autre solution consiste à définir ce paramètre à partir de l’invite ok d’OBP : Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebooting -> set /HOST/bootmode script="setenv diag-switch? false" ok setenv diag-switch? falseChapitre 2 Problèmes connus concernant le produit 21 sas2ircu : message indiquant que les tailles de volume RAID autres que la taille maximale ne sont pas prises en charge (CR 6983210) Lorsque vous tentez de créer un volume RAID plus petit que la taille maximale, la série de messages suivante est renvoyée : Les volumes RAID d'une taille inférieure à la taille maximale ne sont pas pris en charge. Toutefois, si vous souhaitez créer un volume inférieur à la taille maximale à des fins autres que la production, le logiciel vous permet de le faire. Le message n'explique pas cette situation clairement. Solution : Ignorez les messages et répondez yes (oui) à la question « Do you want to continue with volume creation (YES/NO)? » (Voulez-vous poursuivre la création du volume (OUI/NON)). La gestion des pannes envoie parfois des cas résolus au SP (CR 6983432) Certaines erreurs PSH de l'hôte précédemment diagnostiquées et réparées réapparaissent dans Oracle ILOM lorsque l'hôte se réinitialise. Un rapport incorrect d'erreur diagnostiquée par PSH-s'affiche dans la CLI et l'interface Web d'Oracle ILOM, et la DEL de panne s'allume. Vous pouvez identifier ce problème en vérifiant si la même erreur PSH a également été signalée à partir de l'hôte. Si l'erreur a été signalée uniquement par Oracle ILOM et non pas par l'hôte, il s'agit probablement d'un exemple de ce problème. Solution : Utilisez les outils de diagnostic et de réparation Oracle ILOM pour identifier une condition d'erreur, puis la corriger. Cet exemple illustre la manière de diagnostiquer et de corriger une erreur PSH détectée par l'hôte. Cet exemple repose sur le shell de gestion des pannes d'Oracle ILOM. Vous pourriez à la place utiliser la CLI ou l'interface Web d'Oracle ILOM pour obtenir les mêmes résultats. You are about to create an IR volume. WARNING: Proceeding with this operation may cause data loss or data corruption. Are you sure you want to proceed (YES/NO)? yes WARNING: Volume created with size other than ’MAX’ is not supported. Do you want to continue with volume creation (YES/NO)? n SAS2IRCU: you must answer "YES" or "yes" to proceed; operation aborted! SAS2IRCU: Error executing command CREATE.22 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 1. Affichez les informations des erreurs. 2. Recherchez les erreurs éventuelles sur l'hôte. 3. Vérifiez que l'erreur affichée par Oracle ILOM a été réparée sur l'hôte. 4. Eliminez le composant précédemment défectueux du cache des ressources de l'hôte. faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2011-09-16/15:38:19 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Major Fault class : fault.cpu.generic-sparc.strand FRU : /SYS/MB (Part Number: 7015272) (Serial Number: 465769T+1130Y6004M) Description : A fault has been diagnosed by the Host Operating System. Response : The service required LED on the chassis and on the affected FRU may be illuminated. Impact : No SP impact. Check the Host OS for more information. Action : The administrator should review the fault on the Host OS. Please refer to the Details section of the Knowledge Article for additional information. # fmadm fault # <-- Host displays no faults # fmdump TIME UUID SUNW-MSG-ID Sep 16 08:38:19.5582 af875d87-433e-6bf7-cb53-c3d665e8cd09 SUN4V-8002-6E Sep 16 08:40:47.8191 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-4M Repaired Sep 16 08:40:47.8446 af875d87-433e-6bf7-cb53-c3d665e8cd09 FMD-8000-6U Resolved # # fmadm flush /SYS/MB fmadm: flushed resource history for /SYS/MB #Chapitre 2 Problèmes connus concernant le produit 23 5. Corrigez l'erreur dans Oracle ILOM. Les unités utilisées pour définir la durée maximale de gestion de l'alimentation de la MIB (base d'informations de gestion) sont les secondes (CR 6993008) La MIB est censée signaler le paramètre sunHwCtrlPowerMgmtBudgetTimelimit en millisecondes, toutefois la valeur s'affiche en secondes. Solution : La valeur signalée pour sunHwCtrlPowerMgmtBudgetTimelimit est en secondes. Un message d'interruption parasite s'affiche sur la console système lors de l'utilisation d'Oracle VTS (CR 7038266) Dans le cadre d’un fonctionnement normal ou de l’exécution du testeur de système Oracle VTS, le message suivant s'affiche parfois sur la console système : Solution : Vous pouvez ignorer ce message en toute sécurité. faultmgmtsp> fmadm repair /SYS/MB faultmgmtsp> fmadm faulty No faults found faultmgmtsp> date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x3,0x02,or 0x0424 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Un délai d'expiration intermittent de formation de lien s'affiche au cours des mises sous tension progressives (CR 7043201) Il arrive parfois que lors d'une mise sous tension progressive, le module serveur affiche le message d'avertissement suivant : [CPU 0:0:0] NOTICE: MCU0: Link init failed: TS0 Timeout Le module serveur retente automatiquement l'opération de séquence de formation sans erreur. Solution : Vous pouvez ignorer ce message en toute sécurité. La commande cfgadm échoue parfois sur les HBA SG-SAS6-REM-Z ou SGX-SAS6-REM-Z (CR 7044759) La commande cfgadm échoue parfois sur les périphériques HBA SG-SAS6-REM-Z ou SGX-SAS6-REM-Z . Solution : Désactivez le démon de gestion des pannes avant d'exécuter la commande cfgadm unconfigure. Une fois la tâche cfadm terminée, réactivez le démon de gestion des pannes : # cfgadm -c unconfigure Slot1 cfgadm: Component system is busy, try again: unconfigure failed WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 WARNING: (pcieb2): failed to detach driver for the device (mpt_sas9) in the Connection Slot1 # svcadm disable fmd # ps -ef |grep fmd ... # cfgadm -c unconfigure PCI-EM0 # svcadm enable fmd Chapitre 2 Problèmes connus concernant le produit 25 Un message de cpustat réfère à la documentation du processeur de manière incorrecte (CR 7046898) Un message affiché par la commande cpustat stipule ce qui suit : Le document et le site Web répertoriés dans ce message ne sont pas disponibles. La command reboot disk échoue parfois elorsque l'argument disk détecte des caractères supplémentaires (CR 7050975) Lorsque vous exécutez la commande reboot disk, des caractères superflus sont parfois ajoutés à l'argument disk avant qu'il n'atteigne l'OBP. Cette situation se traduit par l'échec de l'initialisation. Solution : Relancez la requête d'initialisation. Des erreurs pouvant être corrigées par PCIe sont parfois signalées (CR 7051331) Dans de rares situations, les périphériques PCIe Gen2 figurant dans le module serveur signalent des erreurs d'E/S identifiées et signalées par l'autorétablissement prédictif (PSH). Par exemple : See the “SPARC T4 User’s Manual” for descriptions of these events. Documentation for Sun processors can be found at: http://www.sun.com/processors/manuals --------------- ------------------------------------ -------------- --------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ -------------- --------- Aug 10 13:03:23 a7d43aeb-61ca-626a-f47b-c05635f2cf5a PCIEX-8000-KP Major Host : dt214-154 Platform : ORCL,SPARC-T3-1B Chassis_id : Product_sn : Fault class : fault.io.pciex.device-interr-corr 67% fault.io.pciex.bus-linkerr-corr 33%26 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Ces erreurs peuvent indiquer la présence d'un EM PCI défectueux ou mal inséré. Ces erreurs peuvent également être erronées. Solution : Assurez-vous que l'EM PCI est correctement inséré et qu'il fonctionne normalement. Si les erreurs persistent, appliquez le patch 147705-01 du SE Oracle Solaris 10 8/11 (ou version plus récente). De lourdes charges de travail et des configurations de mémoire maximale peuvent provoquer des délais d'attente du chien de garde (CR 7083001) Avec certaines lourdes charges de travail inhabituelles, notamment lorsqu'une charge de travail requérant une utilisation intensive du processeur est liée à cpu 0, l'hôte semble se réinitialiser soudainement sur OBP sans arrêt brutal ni panique Affects : dev:////pci@400/pci@1/pci@0/pci@c dev:////pci@400/pci@1/pci@0/pci@c/pci@0 faulted but still in service FRU : "/SYS/MB" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000:serial=1005LCB- 1052D9008K:part=541-424304:revision=50/chassis=0/motherboard=0) 67% "FEM0" (hc://:product-id=ORCL,SPARC-T3-1B:product-sn= 1052NND107:server-id=dt214-154:chassis-id=0000000-0000000000/chassis= 0/motherboard=0/hostbridge=0/pciexrc=0/pciexbus=1/pciexdev=0/pciexfn= 0/pciexbus=2/pciexdev=12/pciexfn=0/pciexbus=62/pciexdev=0) 33% faulty Description : Too many recovered bus errors have been detected, which indicates a problem with the specified bus or with the specified transmitting device. This may degrade into an unrecoverable fault. Refer to http://sun.com/msg/PCIEX-8000-KP for more information. Response : One or more device instances may be disabled Impact : Loss of services provided by the device instances associated with this fault Action : If a plug-in card is involved check for badly-seated cards or bent pins. Otherwise schedule a repair procedure to replace the affected device. Use fmadm faulty to identify the device or contact Sun for support.Chapitre 2 Problèmes connus concernant le produit 27 apparente. Le journal d’événements d’Oracle ILOM contient une entrée de chien de garde de l’hôte arrivée à expiration. Le problème se produit plus souvent sur des systèmes dont la configuration de mémoire est saturée. Lorsque vous êtes confronté à ce type de réinitialisation soudaine, affichez le journal d'événements du SP à l'aide de cette commande depuis la CLI d'Oracle ILOM : Si vous voyez une entrée libellée Host watchdog expired (Chien de garde arrivé à expiration), il s'agit de ce problème. Solution : Contactez votre fournisseur de services autorisé pour savoir si une solution est disponible. Il existe deux solutions à ce problème : ¦ Vous pouvez étendre la période du chien de garde en ajoutant l'entrée suivante au fichier /etc/system d'Oracle Solaris : Le délai d’attente du chien de garde est ainsi étendu à 1 minute (60000 millisecondes). ¦ En situations extrêmes, vous pouvez entièrement désactiver le délai d'attente du chien de garde en ajoutant l'entrée suivante au fichier /etc/system : Chaque fois que vous modifiez le fichier /etc/system, vous devez réinitialiser le système pour appliquer les modifications. Si vous ne voulez pas réinitialiser le système immédiatement après la modification du fichier /etc/system, vous pouvez appliquer une solution supplémentaire temporaire à effet immédiat. Pour appliquer cette solution temporaire, en tant qu'utilisateur root, saisissez : Cette commande crée un ensemble de processeurs temporaire contenant uniquement CPU 0, empêchant les charges de travail de l'application d'utiliser ce processeur et ce problème de se produire. Remarque – Si certains threads sont liés au CPU 0, le lien est alors supprimé. -> show /SP/logs/event/list set watchdog_timeout = 60000 set watchdog_enabled = 0 # psrset -c -F 028 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 Cet ensemble de processeurs temporaire est supprimé lors de la réinitialisation suivante du système d'exploitation, moment auquel la solution du fichier /etc/system est appliquée. ereport.fm.fmd.module : généré lors de la réinitialisation d'un domaine SDIO (CR 7085231) Le module serveur génère parfois un message ereport.fm.fmd.module lors de la réinitialisation d'un domaine SDIO. Ce rapport en ligne indique qu'une erreur s'est produite sur l'un des modules fmd mais la commande fmdump n'affiche pas un message valable (msg). Par exemple : Solution : Vous pouvez ignorer les rapports en ligne ereport.fm.fmd.module en toute sécurité. # fmdump -eV -c ereport.fm.fmd.module TIME CLASS Sep 27 2011 06:27:19.954801492 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = ORCL,SPARC-T4-1B server-id = c193-133 (end authority) mod-name = etm mod-version = 1.2 (end detector) ena = 0x425fc9b065404001 msg = cannot open write-only transport <=== __ttl = 0x1 __tod = 0x4e81cf37 0x38e91d54Chapitre 2 Problèmes connus concernant le produit 29 Oracle VTS dtlbtest se bloque lorsque le mode CPU Threading est défini sur max-ipc (CR 7094158) Le test des processeurs Oracle VTS appelé dtlbtest se bloque lorsque le mode threading max-ipc d'Oracle VM pour SPARC est défini. Ce problème n'est pas spécifique à un type de processeur particulier et se produit lorsque les deux situations suivantes se présentent : ¦ Une seule CPU ou un seul brin élémentaire par noyau est activé ou en ligne. ¦ Le nombre total de CPU en ligne par brin élémentaire est inférieur ou égal à 128. Solution : N'exécutez pas dtlbtest d'Oracle VTS avec le mode threading d'Oracle VM pour SPARC défini sur max-ipc.30 Notes de produit du module serveur SPARC T4-1B • Novembre 2011 1 Ce guide décrit la procédure minimale requise pour installer et mettre sous tension pour la première fois le module serveur SPARC T4-1B d’Oracle. Avant de mettre en œuvre les procédures données dans ce guide, consultez les documents suivants : ? Sun Blade 6000 Modular System Installation Guide (Guide d'installation du système modulaire Sun Blade 6000) : Installez le châssis du système modulaire Sun Blade 6000 avant d'installer le module serveur. ? SPARC T4-1B Server Module Product Notes (Notes de produit du module serveur SPARC T4-1B) en ligne : Prenez connaissance des tous derniers problèmes pour connaître leur impact éventuel sur la configuration de l'installation. ? SPARC T4-1B Server Module Installation Guide (Guide d'installation du module serveur SPARC T4-1B) en ligne : Consultez ce guide pour plus d'informations sur l'installation. ? Importantes informations de sécurité concernant les systèmes matériels Sun (dans le kit fourni) et SPARC T4-1B Server Module Safety and Compliance Manual (Manuel de conformité et de sécurité du module serveur SPARC T4-1B) : Pour plus d'informations sur la sécurité. Pour plus d'informations sur la manière de se procurer ces documents, reportez-vous à la rubrique « Documentation connexe » , page 6. Inventaire du carton 1 Documents imprimés 2 Module serveur 3 Fiche d'informations client insérée dans une pochette collée sur le carton (à conserver pour les adresses MAC et autres informations) Module serveur SPARC T4-1B Guide de démarrage2 ? Installation de composants optionnels ? Avant d’installer le module serveur dans le châssis du système modulaire, installez (le cas échéant) les composants optionnels que vous avez commandés à des fins d’utilisation avec le module serveur. Il se peut que les composants optionnels soient déjà installés dans le module serveur que vous avez reçu. Pour plus de détails, consultez la fiche d’informations client. Pour obtenir des instructions sur l’installation des composants optionnels, reportez-vous à la documentation relative à chaque composant ainsi qu’au SPARC T4-1B Server Module Service Manual (Manuel d'entretien du module serveur SPARC T4-1B). ? Installation du module serveur dans le châssis Le module serveur est enfichable à chaud dans le châssis. Dans le présent document, il est supposé que le système modulaire Sun Blade 6000 est installé et en cours d’exécution. Attention – Conformément aux restrictions de refroidissement, vous devez installer le module serveur dans le châssis dans les 60 secondes suivant le retrait du panneau de remplissage. 1. Déballez le module serveur. 2. Retirez le cache de protection du connecteur situé à l'arrière du module serveur. 3. Retirez le panneau de remplissage de l’emplacement de châssis voulu sur le module serveur. 4. Les leviers d'éjection à votre droite, enfoncez le module serveur dans le châssis (encadré 1) d'environ 1,5 cm. par l’avant. 5. Appuyez sur les leviers d'éjection pour les ouvrir (encadré 2). 6. Insérez le module serveur dans le châssis et fermez les leviers d'éjection (encadré 3). 7. Assurez-vous que le module serveur est bien installé (encadré 4) en vérifiant que la DEL OK verte est allumée. Lorsque le module serveur est branché, le processeur de service (SP) est alimenté en courant de secours. Les DEL avant clignotent plusieurs fois, puis la DEL OK verte du panneau avant clignote pendant plusieurs minutes. Le SP du module serveur génère des messages dès que le module serveur est connecté à un système modulaire sous tension.3 ? Choix d’une méthode de connexion Utilisez le logiciel Oracle Integrated Lights Out Manager (Oracle ILOM) exécuté sur le SP du module serveur pour démarrer, initialiser et gérer le module serveur. Vous pouvez accéder au SP de diverses manières comme illustré sur la figure suivante. ? Connectez-vous au module serveur en utilisant l’une des méthodes indiquées dans l’illustration et le tableau suivants. Ce guide décrit les méthodes 1 et 3 mais vous pouvez très bien opter pour l’une des autres méthodes décrites dans le SPARC T4-1B Server Module Installation Guide (Guide d'installation du module serveur SPARC T4-1B). Méthode Connection (Connexion) Description 1 Vitesse Du port NET MGT du module CMM Au réseau Assurez-vous que le port NET MGT du module CMM est connecté à votre réseau. A partir du réseau, connectez-vous au logiciel Oracle ILOM installé sur le module CMM à l’aide de l’adresse IP du CMM. Utilisez le proxy Oracle ILOM pour accéder au SP du module serveur. Vous pouvez utiliser la CLI ou l'interface Web Oracle ILOM du CMM. Reportez-vous à la section « Méthode 1 : Mettez l'hôte sous tension via le CMM (interface Web) » , page 4. 2 Port série Du port SER MGT du module CMM Au périphérique terminal Connectez un périphérique terminal au port RJ-45 SER MGT du CMM et servez-vous d’Oracle ILOM du CMM pour accéder au SP du module serveur. Cette méthode prend uniquement en charge la CLI d’Oracle ILOM. Pour plus d'informations, reportez-vous au SPARC T4-1B Server Module Installation Guide (Guide d'installation du module serveur SPARC T4-1B). 3 Port série Du port UCP du SP du module serveur (dongle requis) Au périphérique terminal Connectez un câble de dongle au module serveur. Connectez un périphérique terminal au connecteur série sur le câble de dongle (les dongles UCP-3 utilisent le connecteur RJ-45, les dongles UCP-4 utilisent eux le connecteur DB-9). Communiquez directement avec Oracle ILOM installé sur le SP du module serveur à l’aide de la CLI. Reportez-vous à la section « Méthode 3 : Mettez l'hôte sous-tension via le panneau avant (CLI du SP) » , page 5.4 ? Méthode 1 : Mettez l'hôte sous tension via le CMM (interface Web) Dans cette procédure, vous utilisez l'interface Web d'Oracle ILOM du CMM pour accéder au SP du module serveur. Pour effectuer cette procédure, vous devez connaître l’adresse IP du CMM. 1. Assurez-vous que le port NET MGT du CMM est connecté et configuré pour communiquer sur votre réseau. Pour plus d’informations à ce sujet, reportez-vous à la documentation du système modulaire. 2. Accédez à l'interface Web d'Oracle ILOM sur le CMM. Dans un navigateur figurant sur le même réseau que le système modulaire, saisissez http://adresse_ip_du_cmm. Remplacez adresse_ip_du_cmm par l'adresse IP de votre CMM. La page de connexion d'Oracle ILOM s'affiche. 3. Connectez-vous à Oracle ILOM sur le CMM en saisissant votre nom d’utilisateur et votre mot de passe. Le mot de passe root d'Oracle ILOM défini en usine est changeme ; toutefois, il peut avoir été modifié dans votre environnement. 4. Si la vue Chassis (Châssis), une image du système modulaire, ne s'affiche pas dans l'interface Web, sélectionnez l'entrée Chassis (Châssis) dans le volet gauche de navigation. 5. Utilisez l'une des méthodes suivantes pour naviguer jusqu'au SP du module serveur : ? Dans la vue Chassis (Châssis) du système modulaire, sélectionnez le module serveur qui vient d'être installé. ? Dans le volet gauche de navigation Chassis (Châssis), sélectionnez le module serveur qui vient d'être installé (répertorié comme Blade 0 à 9). 6. Si vous êtes invité à vous connecter, entrez les nom d'utilisateur et mot de passe définis en usine suivants : ? Nom d'utilisateur : root ? Mot de passe : changeme Vous êtes maintenant connecté au SP du module serveur. 7. Ouvrez une console distante : a. Sélectionnez l'onglet Remote Control (Contrôle à distance) dans le menu figurant en haut de la fenêtre. b. Cliquez sur Use serial redirection (Utiliser la redirection série). c. Cliquez sur Launch Remote Console (Lancer la console distante). Cette console distante affiche les messages de l'hôte et vous invite à installer le SE Oracle Solaris lors de la mise sous tension du module serveur. 8. Mettez le module serveur sous tension : a. Cliquez sur l’onglet Remote Power Control (Contrôle à distance de l’alimentation). b. Cliquez sur le menu et sélectionnez Power On (Mettre sous tension). c. Sélectionnez Save (Enregistrer). d. Cliquez sur OK lorsque l’invite : « Are you sure you want to perform a Power On of the server ? » (Voulez-vous vraiment mettre le serveur sous tension ?) s’affiche. Vous êtes maintenant connecté à l'hôte du module de serveur. Reportez-vous à la section « Configuration du système d'exploitation » , page 5. Par défaut, le SP est configuré afin d'utiliser DHCP pour obtenir une adresse IP. Si vous prévoyez à la place d'attribuer une adresse IP statique au SP, reportez-vous au guide d'installation en ligne pour des instructions.5 ? Méthode 3 : Mettez l'hôte sous-tension via le panneau avant (CLI du SP) Dans cette procédure, utilisez un câble de dongle UCP-3 pour effectuer directement la connexion à l'avant du module serveur. Les commandes sont utilisées via la CLI d'Oracle ILOM. 1. Connectez le câble du dongle au port UCP situé sur le panneau avant du module serveur. Un câble de dongle UCP-3 est fourni avec chaque système modulaire (châssis). Le câble de dongle sert à une installation et une configuration temporaires. Déconnectez le câble de dongle une fois que le module serveur est accessible sur le réseau. 2. Configurez et connectez un périphérique terminal au connecteur RJ-45 du câble de dongle UCP-3. Paramétrez le périphérique terminal sur 8 bits, sans parité, 1 bit d'arrêt, 9600 bauds et aucun contrôle de flux. L'invite de connexion d'Oracle ILOM s'affiche sur le terminal. 3. Entrez les nom d'utilisateur et mot de passe définis en usine suivants : ? Nom d'utilisateur : root ? Mot de passe : changeme Vous êtes maintenant connecté au SP du module serveur. 4. Mettez l’hôte du module serveur sous tension. Le module serveur s’initialise. 5. Permutez la communication sur l’hôte du module serveur. Vous êtes maintenant connecté à l'hôte du module de serveur. Reportez-vous à la section “Configuration du système d'exploitation” . Par défaut, le SP est configuré afin d'utiliser DHCP pour obtenir une adresse IP. Si vous prévoyez à la place d'attribuer une adresse IP statique au SP, reportez-vous au guide d'installation en ligne pour des instructions. ? Configuration du système d'exploitation Si un périphérique d'initialisation local est accessible et si le SE Oracle Solaris est préinstallé, vous êtes invité à indiquer les informations de configuration du SE dans la console de l'hôte. Sinon, le système recherche un périphérique d’initialisation sur le réseau à l’aide de la commande boot net. ? Configurez le SE préinstallé ou réinstallez un SE pris en charge répondant à vos besoins. Pour plus d’informations sur le processus de configuration du SE Oracle Solaris, reportez-vous au SPARC T4-1B Server Module Installation Guide (Guide d'installation du module serveur SPARC T4-1B) ainsi qu’aux guides d’installation de votre version du SE Oracle Solaris. Avant de réinstaller le SE, considérez l'utilisation du serveur Oracle VM. Le serveur Oracle VM est une fonction de virtualisation système préinstallée qui fournit un groupement logique discret avec son propre système d'exploitation, ses propres ressources et sa propre identité au sein d'un même système informatique. Vous pouvez exécuter toute une série d’applications dans différents domaines logiques en maintenant leur indépendance à des fins de performance et de sécurité. -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.6 ? Vérification des dernières versions du SE, des patchs et du microprogramme Des versions plus récentes du système d’exploitation, des patchs et du microprogramme peuvent être disponibles pour votre module serveur. Certaines fonctions sont activables uniquement lorsque des patchs ou des microprogrammes précis sont installés. En installant les dernières versions disponibles de ces produits, vous bénéficierez de performances, d’une sécurité et d’une stabilité optimales. ? Consultez les Notes de produit du module serveur SPARC T4-1B de ce produit Oracle. Reportez-vous à la section “Documentation connexe” . Ce document décrit les interdépendances produits importantes et présente des informations de dernière minute. Documentation connexe Commentaires Vous pouvez laisser vos commentaires relatifs à ce document sur le site : http://www.oracle.com/goto/ docfeedback Support et accessibilité Documentation Liens Tous les produits Oracle http://www.oracle.com/documentation Module serveur SPARC T4-1B http://download.oracle.com/docs/cd/E22735_01 Système modulaire Sun Blade 6000 http://download.oracle.com/docs/cd/E19938-01 Oracle ILOM 3.0 http://download.oracle.com/docs/cd/E19860-01 Oracle Solaris et autres logiciels système http://www.oracle.com/technetwork/indexes/documentation/#sys_sw Description Liens Accédez à l'assistance électronique via My Oracle Support. https://support.oracle.com Pour les malentendants : http://www.oracle.com/accessibility/support Découvrez l'engagement d'Oracle vis à vis de l'accessibilité. http://www.oracle.com/us/corporate/accessibility Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Numéro de référence : E26271-01 Novembre 2011 Serveurs de la série SPARC T4 Guide d’administration N° de référence : E26644-01 Novembre 2011Produit recyclable Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée de The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation ix Présentation des ressources de l’administration système 1 Présentation d'Oracle ILOM 1 Fonctions d’Oracle ILOM spécifiques à la plate-forme 2 Présentation du SE Oracle Solaris 3 Présentation d’OpenBoot 4 Présentation d’Oracle VM Server pour SPARC 4 Logiciel de multiacheminement 5 Présentation du pack de gestion du matériel 6 Source du téléchargement du logiciel HMP (pack de gestion du matériel) 7 Documentation du pack de gestion du matériel 8 Accès au serveur 9 ? Connexion à Oracle ILOM 9 ? Pour se connecter à la console système 10 ? Pour afficher l’invite ok 11 ? Pour afficher l’invite -> d'Oracle ILOM 13 ? Pour utiliser un moniteur graphique local 13 Oracle ILOM Remote Console 15iv Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Contrôle du serveur 17 ? Pour mettre le serveur sous tension (Oracle ILOM) 17 ? Pour mettre le serveur hors tension (Oracle ILOM) 18 ? Pour réinitialiser le serveur (SE Oracle Solaris) 19 ? Pour réinitialiser le serveur (Oracle ILOM) 20 ? Pour rétablir les valeurs par défaut du SP 20 Configuration de volumes RAID matériels 23 Prise en charge des volumes RAID matériels 23 ? Pour préparer l’utilisation de l’utilitaire FCode 25 Commandes de l’utilitaire FCode 26 ? Pour créer un volume RAID matériel 27 Disques hot spare de volumes RAID (LSI) 28 Diagnostic de l'état de fonctionnement d'un disque 28 DEL de service requis du disque 29 Messages d'erreur (console système et fichiers journaux) 29 ? Affichage de l'état (commande show-volumes, OBP) 30 ? Affichage de l'état (utilitaire sas2ircu, LSI) 31 Stratégies de remplacement d'un disque RAID 31 ? Pour identifier les chemins d’accès aux périphériques 32 Modification des informations d’identification du serveur 35 ? Pour modifier les données client des PROM des FRU 35 ? Pour modifier les informations d’identification du système 36 Configuration des paramètres de stratégie 37 ? Pour définir le mode de refroidissement 37 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage 38 ? Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage 39 ? Pour désactiver ou réactiver le délai de mise sous tension de l'hôte 40Sommaire v ? Pour définir l’initialisation parallèle du SP et de l’hôte 40 ? Pour configurer le comportement de l'hôte (état de l'interrupteur à clé) 41 Configuration des adresses réseau 43 Options d’adresse réseau du SP 43 ? Pour désactiver ou réactiver l’accès réseau au SP 44 ? Pour afficher l’adresse IP du serveur DHCP 45 ? Pour afficher l'adresse IP du processeur de service 46 ? Pour afficher l’adresse MAC de l’hôte 47 Utilisation d’une connexion in-band au SP 47 Gestion in-band (sideband) d’Oracle ILOM 48 ? Pour configurer l’accès in-band (sideband) au SP 49 Configuration du mode d’initialisation 51 Présentation du mode d’initialisation 51 ? Pour configurer le mode d’initialisation de l’hôte (Oracle VM Server pour SPARC) 52 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations 53 ? Pour gérer le script du mode d’initialisation de l’hôte 55 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte 56 ? Pour remplacer les paramètres de l’OBP afin de réinitialiser le serveur 56 Configuration du comportement du serveur au redémarrage 57 ? Pour définir le comportement de l’hôte à sa réinitialisation 57 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête 58 ? Pour définir l’intervalle du délai d’attente d’initialisation 58 ? Pour définir le comportement à l’expiration du délai d’initialisation 59 ? Pour définir le comportement en cas d’échec du redémarrage 59 ? Pour définir le nombre maximum de tentatives de redémarrage 60vi Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Configuration des périphériques 61 ? Pour déconfigurer manuellement un périphérique 61 ? Pour reconfigurer manuellement un périphérique 62 Contrôle du serveur 63 Contrôle des pannes 63 Présentation des diagnostics 64 ? Pour détecter les pannes (Oracle ILOM) 65 ? Détection des pannes (shell de gestion des pannes d’Oracle ILOM) 65 ? Pour détecter les pannes à l’aide du POST 67 ? Pour afficher l’historique de la console 68 ? Pour corriger une panne (shell de gestion des pannes d’Oracle ILOM) 69 ? Pour effacer une panne 71 Activation de la récupération automatique du système 71 Présentation de la récupération automatique de système 72 ? Pour activer la fonction ASR 72 ? Pour désactiver la fonction ASR 73 ? Pour afficher des informations sur les composants concernés par l’ASR 74 ? Pour afficher les composants du serveur 74 ? Pour localiser le serveur 75 Mise à jour du microprogramme 77 ? Pour afficher la version du microprogramme 77 ? Pour mettre à jour le microprogramme 78 ? Pour afficher la version d’OpenBoot 80 ? Pour afficher la version de POST 81Sommaire vii Identification des périphériques DIS2 compatibles WWN 83 Syntaxe de nom universel 83 Mappage des valeurs WWN à des disques durs (commande OBP probescsi-all) 85 Présentation du mappage WWN Probe-scsi-all 85 Exemple de mappage WWN probe-scsi-all (SPARC T4-1) 87 Exemple de mappage WWN probe-scsi-all (SPARC T4-2) 90 Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec quatre CPU) 93 Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec deux CPU) 96 Exemple de mappage WWN probe-scsi-all (SPARC T4-1B) 100 ? Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) 103 Syntaxe WWN d'une installation de système d'exploitation sur un disque 107 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID 108 Glossaire 109 Index 115viii Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011ix Utilisation de cette documentation Ce guide d'administration s'adresse aux administrateurs système de serveurs de la série Oracle SPARC T4. Ce guide contient des informations descriptives d’ordre général sur le serveur ainsi que des instructions détaillées sur sa configuration et son administration. Pour utiliser les informations de ce document, vous devez maîtriser les concepts et la terminologie des réseaux informatiques ainsi que posséder une connaissance poussée du système d’exploitation Oracle Solaris (SE Oracle Solaris). Remarque – Le Guide d’administration des serveurs de la série SPARC T4 s’applique à plusieurs serveurs et modules serveur. Les exemples précis utilisés dans ce document sont basées sur l’un de ces modèles de serveurs. C’est pourquoi votre sortie peut différer des exemples présentés selon le produit que vous utilisez. ¦ « Documentation connexe », page ix ¦ « Commentaires », page x ¦ « Support technique et accessibilité », page x Documentation connexe Documentation Liens Tous les produits Oracle http://www.oracle.com/documentation Serveur SPARC T4-1 http://www.oracle.com/pls/topic/lookup?ctx=SPARCT4-1x Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Ce tableau répertorie les liens URL de la documentation de tous les produits Oracle, du serveur SPARC T4-1, du microprogramme Oracle ILOM 3.0, du SE Oracle Solaris et d'autres logiciels système, et des utilitaires Oracle VTS 7.0. Commentaires Vous pouvez laisser vos commentaires relatifs à cette documentation sur le site : http://www.oracle.com/goto/docfeedback Support technique et accessibilité Ce tableau répertorie les liens URL vers le site d'assistance général d'Oracle , un site d'assistance pour les malentendants, et un site qui décrit les politiques d'accessibilité d'Oracle. Oracle ILOM 3.0 http://www.oracle.com/pls/topic/lookup?ctx=ilom30 SE Oracle Solaris et autres logiciels système http://www.oracle.com/technetwork/indexes/documentation/index.ht ml#sys_sw Oracle VTS 7.0 http://www.oracle.com/pls/topic/lookup?ctx=OracleVTS7.0 Description Liens Accédez au support électronique via My Oracle Support http://support.oracle.com Pour malentendants : http://www.oracle.com/accessibility/support.html Pour plus d’informations sur l’engagement d’Oracle en matière d’accessibilité http://www.oracle.com/us/corporate/accessibility/index.html Documentation Liens1 Présentation des ressources de l’administration système Les sections suivantes présentent un récapitulatif des outils courants servant à administrer le serveur. ¦ « Présentation d'Oracle ILOM », page 1 ¦ « Fonctions d’Oracle ILOM spécifiques à la plate-forme », page 2 ¦ « Présentation du SE Oracle Solaris », page 3 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 ¦ « Logiciel de multiacheminement », page 5 ¦ « Présentation du pack de gestion du matériel », page 6 Présentation d'Oracle ILOM Oracle Integrated Lights Out Manager (Oracle ILOM) est un microprogramme de gestion système préinstallé sur certains serveurs SPARC. Il vous permet de gérer et de contrôler de manière active les composants installés sur le serveur. Oracle ILOM fournit une interface Web et une interface de ligne de commande, ainsi que les interfaces SNMP et IPMI. Le processeur de service ILOM fonctionne indépendamment du serveur et quel que soit l’état de marche du serveur, du moment que ce dernier (ou le système modulaire contenant le module serveur) est alimenté en courant CA. Lorsque vous connectez un serveur à une alimentation CA, le processeur de service ILOM démarre immédiatement et commence à contrôler le serveur. Oracle ILOM gère l’ensemble des tâches de surveillance et de contrôle environnementaux. L’invite -> indique que vous interagissez directement avec le processeur de service Oracle ILOM. Il s’agit de la première invite qui s’affiche lorsque vous vous connectez au serveur via le port SER MGT ou le port NET MGT, quel que soit l’état 2 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 d’alimentation de l’hôte. Sur un système modulaire, cette invite est également présente lorsque vous vous connectez à un module serveur soit directement soit via Oracle ILOM sur le module CMM du système modulaire. Vous pouvez également accéder à l’invite du processeur de service ILOM (->) à partir de l’invite ok de l’OpenBoot ou de l’invite # ou % d’Oracle Solaris, du moment que la console système est configurée pour être accessible via les ports SER MGT et NET MGT. Le processeur de service ILOM prend en charge un total de dix sessions simultanées par serveur : neuf connexions SSH ou Web via le port NET MGT et une via le port SER MGT. Pour plus d’informations sur l’utilisation des fonctions Oracle ILOM communes à toutes les plates-formes gérées par Oracle ILOM, consultez la documentation Oracle ILOM suivante à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=ilom30 Informations connexes ¦ « Fonctions d’Oracle ILOM spécifiques à la plate-forme », page 2 ¦ « Connexion à Oracle ILOM », page 9 Fonctions d’Oracle ILOM spécifiques à la plate-forme Oracle ILOM peut être exécuté sur de nombreuses plates-formes, prenant en charge les fonctions que celles-ci ont en commun. Certaines des fonctions d’Oracle ILOM sont limitées à un sous-ensemble de plates-formes. Cette section décrit la différence entre les fonctions d’Oracle ILOM prises en charge par les serveurs de la série SPARC T4 et le jeu de fonctions communes décrit dans la documentation de base d’Oracle ILOM 3.0. Remarque – Pour effectuer certaines procédures décrites dans la documentation de base d’Oracle ILOM 3.0, vous devez établir une connexion série avec le serveur et activer le commutateur de présence physique sur ce dernier. Pour plus d’informations sur l’établissement d’une connexion série, reportez-vous au guide d’installation de votre serveur.Présentation des ressources de l’administration système 3 Parmi les fonctions d’Oracle ILOM prises en charge sur d’autres plates-formes, les suivantes ne sont pas compatibles avec les serveurs montés en rack Sun SPARC T4 : ¦ Fonctions du module de contrôle de châssis (CMM, Chassis Monitoring Module) telles que la connexion unique SSO (Single Sign On). Remarque : les serveurs lames T4 installés dans un système modulaire prennent en charge les fonctions du module CMM. Remarque – Les serveurs lames T4-1B installés dans un système modulaire prennent en charge les fonctions du module CMM. ¦ Le déclencheur user-reset de diagnostics du POST n'est pas disponible Oracle ILOM prend en charge la fonction suivante sur ce serveur, mais cette dernière peut très bien ne pas être disponible sur d’autres plates-formes : ¦ Déclencheur hw-change de diagnostics du POST. Ce nouveau déclencheur (hw-change error-reset) constitue le paramètre par défaut du serveur. Il déclenche l’exécution du test POST chaque fois que le serveur est mis sous tension progressive CA ou que le capot du haut est retiré (le cas échéant). Pour plus d’informations sur le POST, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Présentation d'Oracle ILOM », page 1 Présentation du SE Oracle Solaris Le SE Oracle Solaris comprend des commandes et d’autres ressources logicielles utilisées dans le cadre de l’administration du serveur. Pour une introduction aux outils de gestion de votre version d’Oracle Solaris, reportez-vous au manuel System Administration Guide: Basic Administration dans la collection de documents Oracle Solaris. Le logiciel SunVTS est inclus dans Oracle Solaris. Il permet de tester et de valider le matériel Oracle en contrôlant la connectivité et la fonctionnalité des périphériques, contrôleurs et dispositifs matériels. Outre les informations relatives à SunVTS contenues dans la documentation d’Oracle Solaris, les collections de documentation propres à SunVTS sont disponibles à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01 Informations connexes ¦ « Présentation d’OpenBoot », page 44 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Présentation d’OpenBoot Le microprogramme OpenBoot démarre le système d’exploitation, valide le matériel installé et permet d’effectuer d’autres tâches d’administration serveur situées en dessous du niveau du SE. Pour plus d’informations sur les commandes d’OpenBoot, reportez-vous au manuel OpenBoot 4.x Command Reference Manual inclus dans la collection de documents Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 3 Présentation d’Oracle VM Server pour SPARC Un domaine logique regroupe de manière logique et discrète ses propres ressources, systèmes d’exploitation et identité au sein d’un seul système informatique. Les applications logicielles peuvent être exécutées dans les domaines logiques. Il est possible de créer, de détruire, de reconfigurer et de réinitialiser chaque domaine logique indépendamment des autres. Le logiciel Oracle VM Server pour SPARC vous permet de créer et de gérer jusqu’à 32 domaines logiques en fonction de la configuration matérielle du serveur sur lequel Oracle VM Server pour SPARC Manager est installé. Vous avez la possibilité de virtualiser les ressources et de définir des périphériques réseau, de stockage et d’E/S en tant que services pouvant être partagés entre les différents domaines. Les configurations Oracle VM Server pour SPARC sont stockées sur le SP. A l’aide des commandes de la CLI d’Oracle VM Server pour SPARC, vous pouvez ajouter une configuration, spécifier la configuration à utiliser et répertorier les configurations figurant sur le processeur de service. Vous avez également la possibilité d’utiliser la commande set /HOST/bootmode config=configfile d’Oracle ILOM pour indiquer la configuration d’initialisation d’Oracle VM Server. Informations connexes ¦ « Configuration du mode d’initialisation », page 51 ¦ Documentation d'Oracle VM Server pour SPARC http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.htmlPrésentation des ressources de l’administration système 5 Logiciel de multiacheminement Le logiciel de multiacheminement vous permet de définir et de contrôler les chemins physiques redondants des périphériques d’E/S, tels que les périphériques de stockage et les interfaces réseau. Si le chemin d’accès actif à un périphérique devient indisponible, le logiciel peut automatiquement basculer sur un chemin secondaire pour maintenir la disponibilité. Cette fonction est connue sous l’appellation de basculement automatique. Pour tirer parti des fonctions de multiacheminement, vous devez configurer le serveur avec du matériel redondant, par exemple des interfaces réseau redondantes ou deux adaptateurs de bus hôte connectés à la même baie de stockage à double accès. Pour les serveurs de la série SPARC T4, trois types différents de logiciel de multiacheminement sont disponibles : ¦ Le logiciel Oracle Solaris IP Network Multipathing assure le multiacheminement et l’équilibrage de charge pour les interfaces réseau IP. Pour des instructions de configuration et d’administration du logiciel Oracle Solaris IP Network Multipathing, consultez le manuel IP Network Multipathing Administration Guide fourni avec votre version d’Oracle Solaris. ¦ Le logiciel VVM inclut une fonction appelée DMP, qui assure le multiacheminement pour les disques ainsi que l’équilibrage de charge des disques en vue d’optimiser le débit d’E/S. Pour des informations sur VVM et sa fonction DMP, reportez-vous à la documentation qui accompagne le logiciel VERITAS Vo lume Ma na g er. ¦ StorageTek Traffic Manager est une architecture entièrement intégrée au sein du SE Oracle Solaris (à partir de la version Oracle Solaris 8) qui permet d’accéder aux périphériques d’E/S par le biais de plusieurs interfaces de contrôleur hôte depuis une unique instance du périphérique d’E/S. Pour plus d’informations sur StorageTek Traffic Manager, reportez-vous à la documentation de votre SE Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 3 ¦ « Présentation d’Oracle VM Server pour SPARC », page 46 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Présentation du pack de gestion du matériel Le pack de gestion du matériel (HMP) d'Oracle fournit des outils qui permettent de gérer et de configurer les serveurs Oracle à partir du système d'exploitation de l'hôte. Pour utiliser ces outils, vous devez installer le logiciel HMP sur votre serveur. Une fois le logiciel installé, vous pouvez effectuer les tâches de gestion de serveur décrites dans le tableau ci-après. TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil Surveillance du matériel Oracle avec l'adresse IP de l'hôte Utilisez l'agent de gestion du matériel et les plug-ins du protocole SNMP (Simple Network Management Protocol) au niveau du système d'exploitation pour activer la surveillance in-band de votre matériel Oracle. Cette fonctionnalité de surveillance in-band vous permet d'utiliser l'adresse IP du système d'exploitation hôte pour surveiller vos serveurs Oracle sans connecter le port de gestion Oracle ILOM à votre réseau. Outil de gestion au niveau du système d'exploitation hôte Surveillance des périphériques de stockage, notamment des baies de disque RAID Utilisez l'agent de gestion du stockage du serveur au niveau du système d'exploitation pour activer la surveillance in-band des périphériques de stockage configurés sur vos serveurs Oracle. L'agent de gestion du stockage du serveur fournit un démon de système d'exploitation qui collecte des informations sur les périphériques de stockage du serveur, notamment les disques durs et les baies RAID, puis les envoie au processeur de service Oracle ILOM. Les fonctions de surveillance du stockage dans Oracle ILOM vous permettent de consulter et de surveiller les informations fournies par l'agent de gestion du stockage du serveur. Vous pouvez accéder aux fonctions de surveillance du stockage dans Oracle ILOM à partir de l'interface de ligne de commande (CLI). Fonctions de surveillance du stockage de la CLI Oracle ILOM 3.0Présentation des ressources de l’administration système 7 Ce tableau répertorie les outils du pack de gestion du matériel et identifie les tâches de gestion de serveur que chacun effectue. Source du téléchargement du logiciel HMP (pack de gestion du matériel) Vous pouvez télécharger le logiciel HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://support.oracle.com Interrogation, mise à jour et validation des versions de microprogramme sur les périphériques de stockage SAS pris en charge Utilisez l'outil CLI fwupdate à partir du système d'exploitation hôte pour interroger, mettre à jour et valider les versions de microprogramme sur les périphériques de stockage pris en charge, tels que les adaptateurs de bus hôte SAS (HBA), les contrôleurs de stockage SAS intégrés, les expandeurs de stockage SAS LSI et les disques durs. CLI fwupdate au niveau du SE hôte Pour restaurer, définir et consulter les paramètres de configuration d'Oracle ILOM Utilisez l'outil CLI ilomconfig à partir du système d'exploitation hôte pour restaurer les paramètres de configuration d'Oracle ILOM, ainsi que pour consulter et définir les propriétés d'Oracle ILOM associées à la gestion du réseau, la configuration de l'horloge et la gestion des utilisateurs. CLI ilomconfig au niveau du SE hôte Affichage ou création de volumes RAID sur des unités de stockage Utilisez l'outil CLI raidconfig à partir du système d'exploitation hôte pour consulter et créer des volumes RAID sur les unités de stockage connectées aux contrôleurs RAID, notamment les baies de stockage. CLI raidconfig au niveau du SE hôte Utilisation de l'outil IPMItool pour accéder aux serveurs Oracle et les gérer Utilisez la ligne de commande « open source » IPMItool à partir du système d'exploitation hôte pour accéder aux serveurs Oracle et les gérer à l'aide du protocole IPMI. Ligne de commande IMPItool au niveau du SE hôte * Les systèmes d'exploitation pris en charge sont les suivants : Oracle Solaris, Linux, Windows et VMware TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur (suite) Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil8 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Documentation du pack de gestion du matériel Vous pouvez télécharger la documentation HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=ohmp Pour plus d'informations sur l'utilisation des fonctions de contrôle de stockage dans Oracle ILOM, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (Guide des notions fondamentales d'Oracle Integrated Lights Out Manager (ILOM) 3.0) et au Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management CLI Procedures Guide (Guide des procédures de gestion quotidienne relatives à la CLI d'Oracle Integrated Lights Out Manager (ILOM) 3.0). Pour plus d'informations sur l'accès et la gestion d'un serveur via SNMP ou IPMI, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 SNMP, IPMI, CIM, WSMAN, Protocol Management Reference (Guide des références des protocoles de gestion Oracle Integrated Lights Out Manager (ILOM) 3.0 SNMP, IPMI, CIM, WSMAN). Les liens vers ces manuels Oracle ILOM sont fournis sur le site Web indiqué ci-dessus. Vous trouverez l'intégralité de la documentation Oracle ILOM à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=ilom309 Accès au serveur Les sections suivantes présentent des informations relatives à l’établissement de communications de bas niveau avec le serveur à l’aide de l’outil Oracle ILOM et de la console système. ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour se connecter à la console système », page 10 ¦ « Pour afficher l’invite ok », page 11 ¦ « Pour afficher l’invite -> d'Oracle ILOM », page 13 ¦ « Pour utiliser un moniteur graphique local », page 13 ¦ « Oracle ILOM Remote Console », page 15 ? Connexion à Oracle ILOM Dans cette procédure, il est supposé que vous utilisez la configuration par défaut du processeur de service comme décrite dans le guide d’installation du serveur. Remarque – Pour un module de serveur SPARC T4, vous pouvez vous connecter directement au processeur de service du serveur modulaire ou démarrer Oracle ILOM via le module CMM du châssis. Reportez-vous au guide d'installation du serveur modulaire pour obtenir des instructions sur les deux approches.10 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Ouvrez une session SSH et connectez-vous au SP en spécifiant son adresse IP. Le nom d’utilisateur Oracle ILOM par défaut est root et le mot de passe par défaut est changeme. Vous êtes à présent connecté à Oracle ILOM. Exécutez les tâches nécessaires. Remarque – Pour bénéficier d’une sécurité optimale sur le serveur, changez le mot de passe par défaut de ce dernier. Informations connexes ¦ « Présentation d'Oracle ILOM », page 1 ¦ « Pour se connecter à la console système », page 10 ? Pour se connecter à la console système ? A l'invite -> d'Oracle ILOM, tapez : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.16.3 r66969 Copyright 2011 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accès au serveur 11 où option correspond à l’une des valeurs suivantes : ¦ -f|force : permet à un utilisateur doté du rôle Console (c) de prendre la console à l’utilisateur qui y est connecté et d’obliger ce dernier à utiliser le mode de visualisation. ¦ -script : contourne l’invite de confirmation (yes ou no). Remarque – Si le SE Oracle Solaris n’est pas en cours d’exécution, le serveur affiche l’invite ok. Informations connexes ¦ « Pour afficher l’invite -> d'Oracle ILOM », page 13 ¦ « Pour utiliser un moniteur graphique local », page 13 ¦ « Connexion à Oracle ILOM », page 9 ? Pour afficher l’invite ok Dans cette procédure, il est supposé que vous utilisez la configuration par défaut de la console système. ? Dans le tableau suivant, choisissez la méthode d’arrêt appropriée pour accéder à l’invite ok. Remarque – Afin de vous assurer d’accéder à l’invite ok, définissez la propriété Oracle ILOM suivante avant d’exécuter les procédures ci-dessous : -> set /HOST/bootmode script=”setenv auto-boot? false” Attention – Dans la mesure du possible, affichez l’invite ok en effectuant un arrêt progressif du SE. Toute autre méthode pourrait entraîner la perte de données d’état du serveur.12 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Le tableau ci-dessous décrit les méthodes d'arrêt du serveur sous trois conditions différentes : lorsque le système d'exploitation est en cours d'exécution et réactif, lorsque le système d'exploitation n'est pas réactif, et lorsque le système d'exploitation n'est pas réactif et que la réinitialisation n'est pas nécessaire. Informations connexes ¦ « Contrôle des pannes », page 63 Etat du serveur Procédure à suivre SE en cours d’exécution et réactif Arrêtez le serveur en commençant à l'invite de l'hôte : Dans une fenêtre d’utilitaire de shell ou de commande, tapez une commande appropriée (par exemple, la commande shutdown ou init 0), comme décrit dans la documentation relative à l’administration système d’Oracle Solaris. Ensuite, effectuez l'une des étapes suivantes : • A l'invite d'Oracle ILOM, tapez : -> stop /SYS • Appuyez sur le bouton de marche/arrêt du serveur. SE non réactif Désactivez la fonction d'initialisation automatique, puis réinitialisez l'hôte. (à condition que le logiciel de système d’exploitation ne soit pas en cours d’exécution et que le serveur soit déjà sous le contrôle du microprogramme OpenBoot) A l'invite d'Oracle ILOM, tapez : -> set /HOST send_break_action=break Appuyez sur Entrée. Tapez ensuite : -> start /HOST/console SE non réactif et initialisation automatique devant être empêchée Arrêtez le serveur à partir d'Oracle ILOM et désactivez la fonction d'initialisation automatique. A l'invite d'Oracle ILOM, tapez : -> set /HOST/bootmode script=”setenv auto-boot? false” Appuyez sur Entrée. Tapez ensuite : -> reset /SYS -> start /HOST/consoleAccès au serveur 13 ? Pour afficher l’invite -> d'Oracle ILOM ? Utilisez l’une des méthodes suivantes pour afficher l’invite -> d’Oracle ILOM : ¦ A partir de la console système, tapez la séquence d’échappement (#.) d’Oracle ILOM. ¦ Connectez-vous à Oracle ILOM directement à partir d'un périphérique connecté au port SER MGT ou NET MGT. ¦ Connectez-vous à Oracle ILOM via une connexion SSH. Reportez-vous à la section « Connexion à Oracle ILOM », page 9. Informations connexes ¦ « Présentation d'Oracle ILOM », page 1 ¦ « Connexion à Oracle ILOM », page 9 ? Pour utiliser un moniteur graphique local Vous pouvez rediriger la console système vers un moniteur graphique local. Vous ne pouvez pas utiliser un moniteur graphique local pour effectuer l’installation initiale du serveur, ni pour afficher les messages de l’autotest de l’allumage (POST). Pour utiliser un moniteur graphique local : 1. Connectez le câble vidéo du moniteur à un port vidéo du serveur. Fixez les vis à serrage à main pour maintenir la connexion. Reportez-vous à la documentation de votre système pour connaître les instructions de connexion qui peuvent s’appliquer à votre serveur. 2. Branchez le cordon d’alimentation du moniteur sur une prise CA. 3. Connectez le câble de clavier USB à un port USB. 4. Connectez le câble de souris USB à un autre port USB sur le serveur. 5. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 11.14 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 6. A l’invite ok, définissez les variables de configuration OBP suivantes : 7. Pour appliquer vos modifications, tapez : Le serveur enregistre les modifications de paramètres et s’initialise automatiquement. Remarque – Au lieu d’utiliser la commande reset-all pour stocker les modifications de paramètres, vous pouvez également mettre le serveur progressivement sous tension à l’aide du bouton de marche/arrêt. Vous pouvez à présent exécuter des commandes système et afficher les messages du système en utilisant le moniteur graphique local. Pour activer l’interface graphique, passez à l’étape suivante. 8. Activez l’interface graphique du SE Oracle Solaris. Une fois que le SE Oracle Solaris est installé et initialisé, tapez les commandes suivantes afin d’afficher l’écran de connexion de l’IG. Informations connexes ¦ « Pour afficher l’invite ok », page 11. ¦ « Oracle ILOM Remote Console », page 15 ok setenv input-device keyboard ok setenv output-device screen ok reset-all # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # rebootAccès au serveur 15 Oracle ILOM Remote Console Oracle ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques suivants sur un serveur hôte. Ce groupe de périphériques est couramment désigné par l’abréviation KVMS (Keyboard, Video, Mouse, Storage, c’est-à-dire clavier, vidéo, souris et stockage). ¦ Clavier ¦ Affichage vidéo de la console ¦ Souris ¦ Affichage série de la console ¦ Périphériques de stockage ou images (CD/DVD) Oracle ILOM Remote Console est documentée dans le manuel Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (à la section « Managing Remote Hosts Redirection and Securing the ILOM Remote Console »). Informations connexes ¦ « Gestion in-band (sideband) d’Oracle ILOM », page 4816 Guide d’administration des serveurs de la série SPARC T4 • Novembre 201117 Contrôle du serveur Les sections suivantes présentent les procédures de commande des opérations de base relatives au serveur. ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ¦ « Pour réinitialiser le serveur (SE Oracle Solaris) », page 19 ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Pour rétablir les valeurs par défaut du SP », page 20 ? Pour mettre le serveur sous tension (Oracle ILOM) 1. Connectez-vous à Oracle ILOM. « Connexion à Oracle ILOM », page 9. Remarque – Si vous disposez d’un système modulaire, assurez-vous que vous n’êtes pas connecté au module serveur souhaité. 2. A l'invite -> d'Oracle ILOM, tapez : Remarque – Pour éviter d’avoir à confirmer, utilisez la commande start -script /SYS. -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->18 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Informations connexes ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ¦ « Pour réinitialiser le serveur (SE Oracle Solaris) », page 19 ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ? Pour mettre le serveur hors tension (Oracle ILOM) 1. Arrêtez le SE Oracle Solaris. A l’invite Oracle Solaris, tapez : 2. Passez de l’invite de la console système à celle de la console du processeur de service. 3. A l'invite -> d'Oracle ILOM, tapez : # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 106 system services are now being stopped. Sep 12 17:52:11 bur381-14 syslogd: going down on signal 15 svc.startd: The system is down. syncing file systems...done Program terminated SPARC T4-1, No Keyboard Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved. OpenBoot 4.33.1, 32256 MB memory available, Serial #95593628. Ethernet address 0:21:28:b2:a4:9c, Host ID: 85b2a49c. {0} ok {0} ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Contrôle du serveur 19 Remarque – Pour exécuter un arrêt immédiat, utilisez la commande stop -force -script /SYS. Vérifiez que toutes les données sont enregistrées avant de taper cette commande. Informations connexes ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour réinitialiser le serveur (SE Oracle Solaris) », page 19 ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ? Pour réinitialiser le serveur (SE Oracle Solaris) Il est inutile de mettre le serveur hors puis sous tension pour effectuer une réinitialisation. ? Pour réinitialiser le serveur à partir de l’invite d’Oracle Solaris, tapez l’une des commandes suivantes : ou Informations connexes ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 # shutdown -g0 -i6 -y # reboot20 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour réinitialiser le serveur (Oracle ILOM) La commande reset d’Oracle ILOM entraîne une réinitialisation matérielle progressive ou forcée du serveur. Par défaut, la commande reset effectue une réinitialisation progressive du serveur. ? Tapez l’une des commandes suivantes pour réinitialiser le serveur. ¦ Procédez à une réinitialisation progressive à partir d’Oracle ILOM : ¦ Si cette opération est impossible, effectuez une réinitialisation matérielle forcée à partir d’Oracle ILOM : Informations connexes ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour réinitialiser le serveur (SE Oracle Solaris) », page 19 ¦ « Pour remplacer les paramètres de l’OBP afin de réinitialiser le serveur », page 56 ? Pour rétablir les valeurs par défaut du SP Si le processeur de service (SP) est endommagé ou que vous souhaitez rétablir ses valeurs par défaut définies en usine, modifiez le paramètre /SP reset_to_defaults, puis mettez l’hôte hors tension afin d’appliquer les modifications. Il s’agit d’un nouveau comportement. Dans les versions précédentes, il était inutile de mettre l’hôte hors tension pour rétablir les valeurs par défaut du SP. Vous devez disposer des autorisations d’administrateur pour effectuer cette tâche. -> reset /SYS -> reset -force /SYSContrôle du serveur 21 1. Pour rétablir les valeurs par défaut du SP, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ all : supprime l’ensemble des données de configuration du SP. ¦ factory : supprime l’ensemble des données de configuration du SP de même que tous les fichiers journaux. 2. La mise hors tension suivie du redémarrage de l’hôte permet d’achever les changements de paramètres. Informations connexes ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP22 Guide d’administration des serveurs de la série SPARC T4 • Novembre 201123 Configuration de volumes RAID matériels Les sections suivantes décrivent les procédures de configuration et de gestion des volumes de disques RAID à l’aide du contrôleur de disque SAS-2 intégré du serveur. ¦ « Prise en charge des volumes RAID matériels », page 23 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 25 ¦ « Pour créer un volume RAID matériel », page 27 ¦ « Disques hot spare de volumes RAID (LSI) », page 28 ¦ « Diagnostic de l'état de fonctionnement d'un disque », page 28 ¦ « Stratégies de remplacement d'un disque RAID », page 31 ¦ « Pour identifier les chemins d’accès aux périphériques », page 32 Prise en charge des volumes RAID matériels Les serveurs de la série SPARC T4 contiennent des contrôleurs RAID SAS-2 intégrés qui permettent la formation de volumes de disques logiques composés d'un ou de plusieurs disques durs redondants. Ces contrôleurs prennent en charge les niveaux RAID suivants : ¦ RAID 0 : répartition des données ¦ RAID 1 : mise en miroir des données (à l'aide de deux disques) ¦ RAID 1e : mise en miroir améliorée (à l'aide de trois à huit disques) La répartition des données fait référence à la technique de distribution des fichiers de données sur plusieurs disques, de sorte que le stockage et la récupération puissent être effectués en parallèle sur plusieurs canaux de données. La répartition des données peut considérablement améliorer les opérations de stockage de données. 24 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 La mise en miroir des données fait référence à la technique de stockage de copies identiques de données sur des disques séparés. La mise en miroir des données critiques permet de réduire les risques de perte de données grâce à la création d'instances dupliquées des données. Remarque – Le serveur SPARC T4-1 est doté de deux contrôleurs RAID intégrés. SPARC T4-2 est doté d'un seul contrôleur RAID intégré. Le serveur modulaire SPARC T4-1B est doté d'un seul module d'extension RAID (REM) enfichable. Le serveur SPARC T4-4 est doté de deux modules d'extension RAID (REM) enfichables. Jusqu'à deux volumes logiques peuvent être configurés sur chaque contrôleur RAID intégré. Cela signifie que quatre volumes peuvent être créés sur un serveur SPARC T4-1 au maximum. Vous avez le choix entre trois environnements pour créer et gérer les ressources RAID sur votre serveur. ¦ Utilitaire Fcode : Cet utilitaire se compose d’un ensemble de commandes permettant d’afficher les cibles et de gérer les volumes logiques de votre serveur. Vous accédez à ces commandes via l'environnement OBP. Les exemples figurant dans ce manuel s'appuient sur les commandes Fcode. ¦ Utilitaire de gestion LSI SAS2 2008 RAID pour serveurs SPARC T4 : vous pouvez utiliser les commandes sas2ircu contenues dans l'utilitaire de configuration intégré LSI SAS2 pour configurer et gérer les volumes RAID sur votre serveur. Pour utiliser le jeu de commandes sas2ircu, téléchargez et installez le logiciel SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/channel/support/pages/downloads.aspx?k=* ¦ Pack de gestion du matériel Oracle 2.2 : vous pouvez utiliser les commandes raidconfig figurant dans le composant Outils de l'interface CLI des serveurs Oracle de ce logiciel pour créer et gérer des volumes RAID sur votre serveur. Pour utiliser ces commandes, téléchargez et installez la toute dernière version du pack de gestion du matériel à partir du site suivant : http://www.oracle.com/us/support/044752.html Vous trouverez une documentation complète sur l'utilisation du pack de gestion du matériel à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21 Conseil – Certaines commandes du pack de gestion du matériel 2.2 présentent parfois de longs délais de démarrage ou d'exécution sur les serveurs SPARC T4-2 et T4-4. Dans de tels cas, vous pouvez, si vous le préférez, utiliser les commandes Fcode ou LSI sas2ircu.Configuration de volumes RAID matériels 25 Informations connexes ¦ « Pour créer un volume RAID matériel », page 27 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 25 ? Pour préparer l’utilisation de l’utilitaire FCode Effectuez la procédure suivante dans une fenêtre de terminal xterm ou une fenêtre de terminal équivalente qui prend en charge le défilement. Remarque – Les commandes FCode génèrent une sortie détaillée volumineuse. Les fenêtres de terminal xterm et gnome offrent une fonctionnalité de barre de défilement, destinée à faciliter la visualisation de la sortie. 1. Mettez le système sous tension ou réinitialisez-le s'il est déjà sous tension et désactivez la fonction d'initialisation automatique dans l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 11. 2. Accédez à l'environnement OBP. 3. La commande show-devs dresse la liste des chemins de périphériques connectés au serveur. Remarque – Dans le cas d’un module serveur, le chemin d’accès au périphérique peut correspondre à /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. La commande select vous permet de choisir le contrôleur sur lequel vous souhaitez créer un volume RAID matériel. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@026 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Au lieu d’utiliser l’intégralité du chemin d’accès au périphérique pour le contrôleur, vous pouvez définir un alias préconfiguré à associer à ce dernier. Par exemple : Pour afficher les alias préconfigurés sur le serveur, exécutez la commande devalias. Reportez-vous à la section « Pour identifier les chemins d’accès aux périphériques », page 32. Affichez les adresses SAS des unités connectées à l’aide de la commande show-children. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 26 ¦ « Pour afficher l’invite ok », page 11 Commandes de l’utilitaire FCode Ce tableau répertorie les commandes de l'utilitaire de FCode. Informations connexes ¦ « Pour créer un volume RAID matériel », page 27 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 25 {0} ok select scsi0 Commande FCode Description show-children Dresse la liste complète des unités physiques et des volumes logiques connectés. show-volumes Dresse une liste détaillée des volumes logiques connectés. create-raid0-volume Crée un volume RAID 0 (au minimum deux cibles). create-raid1-volume Crée un volume RAID 1 (exactement deux cibles). create-raid1e-volume Crée un volume RAID 1e (au minimum trois cibles). delete-volume Supprime un volume RAID. activate-volume Réactive un volume RAID après le remplacement de disques.Configuration de volumes RAID matériels 27 ? Pour créer un volume RAID matériel 1. Préparez la création du volume RAID. Reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 25. 2. La commande show-children permet de répertorier les unités physiques situées sur le contrôleur sélectionné. 3. Exécutez la commande create-raid0-volume, create-raid1-volume ou create-raid1e-volume pour créer une unité logique à partir des disques physiques. Par exemple, pour créer un volume RAID 0 avec les cibles 9 et a, commencez par spécifier les cibles, puis tapez la commande create : Par exemple, pour créer un volume RAID 1e avec les cibles a, b et c, tapez : {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volume28 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 4. Pour vérifier la création du volume, tapez : 5. Saisissez unselect-dev pour désélectionner le contrôleur. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 26 ¦ « Pour afficher l’invite ok », page 11 Disques hot spare de volumes RAID (LSI) Vous pouvez configurer deux disques hot spare globaux pour protéger les données figurant sur des volumes RAID mis en miroir. Si l'un des disques d'un volume RAID 1 ou RAID 1E mis en miroir échoue, le contrôleur RAID intégré remplace automatiquement le disque défaillant par un disque hot spare, puis resynchronise les données mises en miroir. Utilisez l'utilitaire LSI sas2ircu pour ajouter des disques hot spare globaux ou HMP. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'ajout de disques hot spare. Diagnostic de l'état de fonctionnement d'un disque Les rubriques suivantes traitent des diverses façons de déterminer si un disque figurant dans un volume RAID a échoué ou non : ¦ « DEL de service requis du disque », page 29 ¦ « Messages d'erreur (console système et fichiers journaux) », page 29 ¦ « Affichage de l'état (commande show-volumes, OBP) », page 30 ¦ « Affichage de l'état (utilitaire sas2ircu, LSI) », page 31 {0} ok show-volumes {0} ok unselect-devConfiguration de volumes RAID matériels 29 DEL de service requis du disque Lorsqu'une erreur se produit sur un disque d'un système SPARC T4, la DEL jaune de service requis s'allume à l'avant du disque. Cette DEL jaune vous permet de localiser le disque défaillant dans le système. Par ailleurs, les DEL d’opération de maintenance requise des panneaux avant et arrière s’allument également lorsque le système détecte une panne au niveau du disque dur. Reportez-vous à votre manuel d'entretien pour connaître l'emplacement et la description de ces DEL. Messages d'erreur (console système et fichiers journaux) Lorsqu'une erreur se produit sur un disque, des messages d'erreur s'affichent sur la console système. Il s'agit d'un exemple d'affichage de console système indiquant que le volume 905 a été endommagé par la perte de PhysDiskNum 1 : Vous pouvez également afficher ces messages en consultant les fichiers /var/adm/messages : Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degraded Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0):30 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Reportez-vous à la rubrique View the System Message Log Files (Affichage des fichiers journaux de messages système) du manuel d'entretien pour plus d'informations sur la consultation de ces messages. ? Affichage de l'état (commande show-volumes, OBP) Vous pouvez arrêter le système et utilisez la commande show-volumes de l'OBP pour savoir si un disque est en panne. 1. Arrêtez le système et affichez l'invite ok de l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 11. 2. Sélectionnez le contrôleur SAS. Pour plus d’informations, reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 25. 3. Saisissez la commande show-volumes pour afficher les volumes RAID et les disques qui leur sont associés. Dans l'exemple suivant, le disque secondaire d'un volume RAID 1 est hors ligne. Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary OptimalConfiguration de volumes RAID matériels 31 4. Saisissez la commande unselect-dev pour désélectionner le contrôleur SAS. ? Affichage de l'état (utilitaire sas2ircu, LSI) ? Utilisez l'utilitaire sas2ircu LSI pour afficher l'état du volume RAID et des périphériques qui lui sont associés. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'affichage et l'interprétation de l'état du périphérique à l'aide de l'utilitaire sas2ircu. Stratégies de remplacement d'un disque RAID Suivez les stratégies décrites ci-dessous lors du remplacement d'un disque défectueux dans un volume RAID. Le tableau ci-dessous décrit les trois niveaux RAID pris en charge : 0, 1 et 1E. Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-dev Niveau de volume RAID Stratégie RAID 0 Lorsqu'un disque d'un volume RAID 0 tombe en panne, toutes les données figurant sur ce volume sont perdues. Remplacez le disque défectueux par un disque de même capacité, recréez le volume RAID 0, puis restaurez les données à partir d'une sauvegarde. RAID 1 Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID. RAID 1E Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID.32 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Remarque – Les instructions cfgadm figurant dans le manuel d'entretien s'appliquent à des disques individuels ne faisant pas partie de volumes RAID. Lorsqu'un disque fait partie d'un volume RAID, il n'est pas nécessaire d'annuler la configuration avant de le remplacer à chaud par un nouveau disque. ? Pour identifier les chemins d’accès aux périphériques La procédure suivante permet de localiser les chemins d’accès aux périphériques propres à votre serveur. 1. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 11. 2. A partir de l’invite ok, tapez : Remarque – Cet exemple illustre la sortie de devalias pour un exemple de serveur T4-x. Les périphériques spécifiques affichés diffèrent en fonction des produits. {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6Configuration de volumes RAID matériels 33 Informations connexes ¦ « Pour afficher l’invite ok », page 11 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 25 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok34 Guide d’administration des serveurs de la série SPARC T4 • Novembre 201135 Modification des informations d’identification du serveur Les sections suivantes décrivent la procédure de stockage des informations (à des fins de contrôle d’inventaire ou de gestion des ressources du site, par exemple) sur le processeur de service et les PROM des FRU à l’aide de l’interface CLI d’Oracle ILOM. ¦ « Pour modifier les données client des PROM des FRU », page 35 ¦ « Pour modifier les informations d’identification du système », page 36 ? Pour modifier les données client des PROM des FRU La propriété /SP customer_frudata permet de stocker des informations dans toutes les PROM de FRU. Ce champ peut servir à identifier un système particulier pour une application tierce ou pour tout autre besoin d’identification au sein de votre environnement. ? A l'invite -> d'Oracle ILOM, tapez : Remarque – Vous devez placer la chaîne de données (données) entre guillemets anglo-saxons. Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour modifier les informations d’identification du système », page 36 -> set /SP customer_frudata=”data”36 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour modifier les informations d’identification du système La propriété /SP system_identifier permet de stocker les informations d’identification client. Cette chaîne de caractères est codée dans tous les messages d’interruption générés par SNMP. L’affectation d’un identificateur de système unique peut se révéler utile pour déterminer le système qui génère le message SNMP. ? A l'invite -> d'Oracle ILOM, tapez : Remarque – La chaîne des données (données) doit être placée entre guillemets anglo-saxons doubles. Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour modifier les données client des PROM des FRU », page 35 -> set /SP system_identifier=”data”37 Configuration des paramètres de stratégie Les sections suivantes décrivent la gestion des stratégies de configuration à l’aide d’Oracle ILOM. ¦ « Pour définir le mode de refroidissement », page 37 ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 38 ¦ « Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage », page 39 ¦ « Pour désactiver ou réactiver le délai de mise sous tension de l'hôte », page 40 ¦ « Pour définir l’initialisation parallèle du SP et de l’hôte », page 40 ¦ « Pour configurer le comportement de l'hôte (état de l'interrupteur à clé) », page 41 ? Pour définir le mode de refroidissement Certains systèmes SPARC T4 prennent en charge le mode de refroidissement de l'hôte. L'activation de la propriété HOST_COOLDOWN oblige le serveur à entrer en mode de refroidissement (cooldown) à la mise hors tension de l’hôte. Le mode de refroidissement redirige Oracle ILOM de manière à contrôler certains composants et à garantir qu’ils restent en dessous d’une température minimale et ne présentent aucun danger pour l’utilisateur qui y accède. Une fois que les composants se situent au-dessous du seuil de température, le serveur n’est plus alimenté en courant, ce qui permet l'ouverture de l'interrupteur de verrouillage du capot. Si la température surveillée nécessite plus de quatre minutes pour atteindre le seuil, l'hôte s'éteint. 38 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le serveur refroidit certains composants avant d’être mis hors tension. ¦ disabled : la température des composants n’est pas contrôlée lors de la mise hors tension. Informations connexes ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_LAST_POWER_STATE permet de contrôler le comportement du serveur après une panne de courant inattendue. Une fois le courant externe rétabli, le processeur de service d’Oracle ILOM est exécuté automatiquement. En général, l’hôte n’est pas remis sous tension tant que vous n’utilisez pas Oracle ILOM pour cette opération. Oracle ILOM enregistre l’état de l’alimentation actuelle du serveur dans l’espace de stockage non volatile. Si la stratégie HOST_LAST_POWER_STATE est activée, Oracle ILOM peut rétablir l’état d’alimentation précédent de l’hôte. Cette stratégie s’avère pratique en cas de panne d’alimentation ou si vous changez le serveur d’emplacement physique. Par exemple, si le serveur hôte est en cours d’exécution lors d’une panne d’alimentation et que la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur disabled, le serveur hôte demeure hors tension lorsque l’alimentation est rétablie. Si la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur enabled, le serveur hôte redémarre lorsque l’alimentation est rétablie. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : -> set /SP/policy HOST_COOLDOWN=value -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguration des paramètres de stratégie 39 ¦ enabled : lorsque l’alimentation est rétablie, le serveur revient à l’état où il se trouvait au moment de la mise hors tension. ¦ disabled : maintient le serveur hors tension au retour du courant (valeur par défaut). Si vous activez HOST_LAST_POWER_STATE, vous devriez également configurer /SP/policy HOST_POWER_ON_DELAY. Pour plus d’informations, reportez-vous à la section « Pour désactiver ou réactiver le délai de mise sous tension de l'hôte », page 40. Informations connexes ¦ « Pour désactiver ou réactiver le délai de mise sous tension de l'hôte », page 40 ¦ « Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage », page 39 ? Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage La propriété /SP/policy HOST_AUTO_POWER_ON permet de mettre l’hôte sous tension lorsque le serveur est alimenté par du courant externe. Si cette stratégie est définie sur enabled (activé), le processeur de service définit HOST_LAST_POWER_STATE sur disabled (désactivé). ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : une fois le courant rétabli, l’hôte est automatiquement mis sous tension après l’initialisation du SP. ¦ disabled : maintient l’hôte hors tension au retour du courant (valeur par défaut). Informations connexes ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 38 ¦ « Pour désactiver ou réactiver le délai de mise sous tension de l'hôte », page 40 -> set /SP/policy HOST_AUTO_POWER_ON=value40 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour désactiver ou réactiver le délai de mise sous tension de l'hôte La propriété /SP/policy HOST_POWER_ON_DELAY permet de définir un délai d’attente avant la remise automatique sous tension du serveur. Ce délai est un intervalle aléatoire compris entre une et cinq secondes. Retarder la mise sous tension du serveur permet de minimiser les surintensités au niveau de la source d’alimentation principale. Cela est important lorsque plusieurs serveurs montés en rack se mettent sous tension après une coupure de courant. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : oblige le serveur à attendre un court moment avant de se mettre sous tension automatiquement. ¦ disabled : le serveur se met automatiquement et sans délai sous tension (valeur par défaut). Informations connexes ¦ « Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage », page 39 ? Pour définir l’initialisation parallèle du SP et de l’hôte La propriété /SP/policy PARALLEL_BOOT, lorsqu’elle est activée, permet à l’hôte de s’initialiser/se mettre sous tension parallèlement au SP quand une stratégie de mise sous tension automatique (HOST_AUTO_POWER_ON ou HOST_LAST_POWER_STATE) est activée ou que l’utilisateur appuie sur le bouton de marche/arrêt pendant que le SP est en cours d’initialisation. Oracle ILOM doit être en cours d’exécution pour permettre la mise sous tension de l’hôte lorsque l’utilisateur appuie sur le bouton de marche/arrêt ou que les stratégies de mise sous tension automatique sont configurées. Lorsque cette propriété est désactivée, le SP s’initialise avant l’hôte. -> set /SP/policy HOST_POWER_ON_DELAY=valueConfiguration des paramètres de stratégie 41 Remarque – L’initialisation parallèle n’est pas prise en charge par les modules serveur. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le SP et l’hôte s’initialisent en même temps. ¦ disabled : le SP et l’hôte s’initialisent de manière consécutive (en série). Informations connexes ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 18 ? Pour configurer le comportement de l'hôte (état de l'interrupteur à clé) La propriété /SYS setkeyswitch_state permet de contrôler la position de l’interrupteur à clé virtuel. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ normal : le serveur peut se mettre automatiquement sous tension et lancer le processus d’initialisation (valeur par défaut). ¦ standby : met l’hôte hors tension et désactive la mise sous tension. ¦ diag : la mise sous tension de l’hôte est autorisée ; ce paramètre remplace ceux de /HOST/diag cible, ce qui se traduit par l’exécution d’un nombre maximum de POST. ¦ locked : la mise sous tension de l’hôte est autorisée. Toutefois, vous ne pouvez pas mettre à jour les périphériques flash ni définir la propriété /HOST send_break_action=break. -> set /SP/policy PARALLEL_BOOT=value -> set /SYS keyswitch_state=value42 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Informations connexes ¦ « Pour mettre le serveur sous tension (Oracle ILOM) », page 17 ¦ « Pour mettre le serveur hors tension (Oracle ILOM) », page 1843 Configuration des adresses réseau Les sections suivantes décrivent la gestion des adresses réseau à l’aide d’Oracle ILOM. ¦ « Options d’adresse réseau du SP », page 43 ¦ « Pour désactiver ou réactiver l’accès réseau au SP », page 44 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 45 ¦ « Pour afficher l'adresse IP du processeur de service », page 46 ¦ « Pour afficher l’adresse MAC de l’hôte », page 47 ¦ « Utilisation d’une connexion in-band au SP », page 47 Options d’adresse réseau du SP Vous pouvez accéder au SP de votre système de plusieurs façons. Tenez compte des options disponibles et choisissez la méthode d’accès la plus adaptée à votre environnement. Vous pouvez établir des connexions physiques avec le SP au moyen d’une connexion série ou réseau. La connexion réseau peut être configurée de manière à utiliser une adresse IP statique ou le protocole DHCP (valeur par défaut). Le cas échéant, les serveurs de la série T4 peuvent se connecter au SP via une connexion réseau in-band au lieu d’utiliser le port NET MGT out-of-band défini par défaut. Pour plus d’informations sur chaque option, reportez-vous à la documentation suivante : ¦ Pour utiliser une connexion série au SP, consultez la section suivante : Pour connecter un terminal ou un émulateur au port SER MGT, dans le guide d’installation de votre serveur ou Communication avec le module serveur au démarrage, dans le guide d’installation de votre module serveur. ¦ Pour assigner une adresse IP statique au SP, consultez la section suivante : Pour assigner une adresse IP statique au SP, dans le guide d’installation du serveur44 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ¦ Pour utiliser une connexion in-band au SP, reportez-vous à la section suivante : « Gestion in-band (sideband) d’Oracle ILOM », page 48 Informations connexes ¦ Documentation d’Oracle Integrated Lights Out Manager (ILOM) 3.0 ¦ « Présentation d'Oracle ILOM », page 1 ¦ « Connexion à Oracle ILOM », page 9 ? Pour désactiver ou réactiver l’accès réseau au SP La propriété /SP/network state permet d’activer ou de désactiver l’interface réseau du processeur de service. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled (valeur par défaut) ¦ disabled Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Options d’adresse réseau du SP », page 43 -> set /SP/network state=valueConfiguration des adresses réseau 45 ? Pour afficher l’adresse IP du serveur DHCP Pour afficher l’adresse IP du serveur DHCP qui a fourni l’adresse IP dynamique demandée par le processeur de service, affichez la propriété dhcp_server_ip. ? A l'invite -> d'Oracle ILOM, tapez : Remarque – La liste des propriétés peut varier en fonction de votre serveur. Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour afficher l’adresse MAC de l’hôte », page 47 -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 <--- DHCP server ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show46 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour afficher l'adresse IP du processeur de service Pour afficher l'adresse IP du processeur de service, reportez-vous à la propriété ipaddress. ? A l'invite -> d'Oracle ILOM, tapez : -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 <--- IP address of SP ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set showConfiguration des adresses réseau 47 ? Pour afficher l’adresse MAC de l’hôte La propriété /HOST macaddress est automatiquement configurée par le logiciel serveur de sorte que vous ne pouvez ni la définir ni la modifier. La valeur est lue et déterminée à partir de la carte de configuration système amovible du serveur (PROM SCC) ou à partir de l’ID de PROM du module serveur, puis stockée en tant que propriété dans Oracle ILOM. /HOST macaddress désigne l’adresse MAC du port net0. Chaque adresse MAC de port supplémentaire augmente d’une unité, l’adresse de base étant /HOST macaddress. Par exemple, net1 équivaut à la valeur de /HOST macaddress plus un (1). ? A l'invite -> d'Oracle ILOM, tapez : Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 45 Utilisation d’une connexion in-band au SP Les sections suivantes décrivent l’utilisation d’une connexion in-band (ou sideband) au SP. ¦ « Gestion in-band (sideband) d’Oracle ILOM », page 48 ¦ « Pour configurer l’accès in-band (sideband) au SP », page 49 -> show /HOST macaddress48 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Gestion in-band (sideband) d’Oracle ILOM Par défaut, la connexion au processeur de service du serveur est établie par le biais du port out-of-band NET MGT. La fonction de gestion sideband Oracle ILOM vous permet de sélectionner le port NET MGT ou l’un des ports Gigabit Ethernet du serveur (NETn), en l’occurrence des ports in-band, pour envoyer ou recevoir des commandes Oracle ILOM vers et à partir du processeur de service du serveur. Les ports in-band sont également désignés en tant que ports sideband. En utilisant un port de gestion sideband pour gérer le processeur de service du serveur, une connexion par câble et un port de commutateur réseau ne sont plus nécessaires. Dans des configurations où de nombreux serveurs sont gérés, comme par exemple dans les centres de données, la gestion sideband peut ainsi permettre des économies importantes en termes d’utilisation de matériel et de réseau. Remarque – L’utilisation de connexions in-band est déconseillée avec les modules serveur. Lorsque la gestion sideband est active dans Oracle ILOM, les situations suivantes peuvent se produire : ¦ La connexion au processeur de service du serveur peut être interrompue si vous changez la configuration du port de gestion du processeur de service lorsque vous êtes connecté au processeur de service via une connexion réseau (console distante d'Oracle ILOM, SSH ou Web, par exemple). ¦ La connectivité intégrée entre le processeur de service et le système d’exploitation hôte peut ne pas être prise en charge par le contrôleur Gigabit Ethernet hôte intégré. Dans ce cas, utilisez un port différent ou routez le trafic de transmission entre la source et les cibles de destination au lieu d’utiliser la commutation/un pont L2. ¦ Les mises hors et sous tension de l’hôte du serveur peuvent interrompre la connectivité réseau des ports Gigabit Ethernet du serveur (NETn) configurés pour la gestion sideband. Dans ce cas, configurez les ports de commutation/pont contigus sous forme de ports hôtes. Informations connexes ¦ « Pour configurer l’accès in-band (sideband) au SP », page 49 ¦ « Options d’adresse réseau du SP », page 43Configuration des adresses réseau 49 ? Pour configurer l’accès in-band (sideband) au SP Cette procédure décrit la méthode d’accès au SP via une gestion in-band (ou sideband) au moyen d’un port réseau hôte. Si vous effectuez cette procédure via une connexion réseau, vous risquez de perdre la connectivité au serveur. Une connexion série pour cette procédure permet d’éviter la perte de connectivité pendant les modifications de configuration de la gestion sideband. 1. Connectez-vous à Oracle ILOM. Reportez-vous à la section « Connexion à Oracle ILOM », page 9. 2. En cas de connexion par le port série, vous pouvez assigner une adresse IP statique. Pour obtenir les instructions, consultez les informations relatives à l’assignation d’une adresse IP dans le guide d’installation de votre serveur. 3. Affichez les paramètres réseau actuels. -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show50 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 4. Définissez le port de gestion du processeur de service sur un port sideband. (où n est compris entre 0 et 3). Pour les systèmes SPARC T4-1B, n est 0 ou 1. Pour tous les autres systèmes, n est compris entre 0 et 3. 5. Vérifiez l’application de la modification. Informations connexes ¦ « Gestion in-band (sideband) d’Oracle ILOM », page 48 ¦ « Options d’adresse réseau du SP », page 43 -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set /SP/network commitpending=true -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/NET0 sidebandmacaddress = 00:11:3T:80:44:B7 state = enabled Commands: cd set show51 Configuration du mode d’initialisation Les propriétés du mode d’initialisation d’Oracle ILOM permettent de spécifier la manière dont l’hôte s’initialise dans le cadre de la résolution d’un problème lié à OpenBoot ou Oracle VM Server pour SPARC. ¦ « Présentation du mode d’initialisation », page 51 ¦ « Pour configurer le mode d’initialisation de l’hôte (Oracle VM Server pour SPARC) », page 52 ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 53 ¦ « Pour gérer le script du mode d’initialisation de l’hôte », page 55 ¦ « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 56 ¦ « Pour remplacer les paramètres de l’OBP afin de réinitialiser le serveur », page 56 Présentation du mode d’initialisation Les propriétés du mode d’initialisation (bootmode) annulent et remplacent la méthode d’initialisation par défaut du serveur. Cette possibilité s’avère pratique pour remplacer des paramètres OpenBoot ou Oracle VM Server particuliers pouvant être incorrects, pour configurer des variables OpenBoot à l’aide d’un script ou pour effectuer d’autres tâches similaires. Si, par exemple, les paramètres OpenBoot viennent à être endommagés, vous pouvez définir la propriété bootmode state sur reset_nvram, puis réinitialiser le serveur sur les paramètres OpenBoot par défaut définis en usine. Le personnel de maintenance peut également vous demander d’utiliser la propriété bootmode script afin de résoudre un problème. La portée intégrale des fonctionnalités de script n’est pas documentée et sert principalement à des fins de débogage.52 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Comme bootmode est destiné à corriger un problème lié aux paramètres OpenBoot ou Oracle VM Server, il ne s’applique qu’à une seule initialisation. De plus, pour éviter qu’un administrateur ne définisse la propriété bootmode state puis l’oublie, celle-ci expire lorsque l’hôte n’est pas réinitialisé dans les 10 minutes suivant la configuration de la propriété bootmode state. Informations connexes ¦ « Pour réinitialiser le serveur (SE Oracle Solaris) », page 19 ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 ? Pour configurer le mode d’initialisation de l’hôte (Oracle VM Server pour SPARC) Remarque – Vous devez utiliser un nom de configuration Oracle VM Server pour cette tâche. 1. Déterminez les configurations Oracle VM Server valides sur votre processeur de service en tapant ce qui suit à l’invite -> d’Oracle ILOM : -> show /HOST/domain/configsConfiguration du mode d’initialisation 53 2. Définissez la configuration du mode d’initialisation en tapant ce qui suit à l’invite -> d’Oracle ILOM : où la propriété config est dotée d’une valeur configname correspondant à une configuration de domaine logique nommée correcte. Par exemple, si vous avez créé une configuration Oracle VM Server intitulée ldm-set1 : Pour que le mode d’initialisation config revienne à la configuration par défaut d’usine, spécifiez factory-default. Par exemple : Informations connexes ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Présentation du mode d’initialisation », page 51 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations La propriété /HOST/bootmode state contrôle la manière dont les variables de la NVRAM OpenBoot sont utilisées. En général, les paramètres actifs de ces variables sont conservés. Définir /HOST/ bootmode state=reset_nvram permet de ramener les variables de la NVRAM OpenBoot à leurs valeurs par défaut à la réinitialisation suivante. -> set /HOST/bootmode config=configname -> set /HOST/bootmode config=ldm-set1 -> set /HOST/bootmode config=factory-default54 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? A l'invite -> d'Oracle ILOM, tapez : où valeur correspond à l’un des paramètres suivants : ¦ normal : conserve les paramètres actifs des variables de la NVRAM à la réinitialisation suivante. ¦ reset_nvram : redéfinit les variables OpenBoot sur les paramètres par défaut à la réinitialisation suivante. Remarque – state=reset_nvram rétablit la valeur « normal » après la prochaine réinitialisation du serveur ou après dix minutes (voir la propriété expires décrite à la section « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 56). Les propriétés config et script n’arrivent pas à échéance et sont effacées lors de la prochaine réinitialisation du serveur ou manuellement en définissant la valeur sur "". Informations connexes ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Présentation du mode d’initialisation », page 51 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 -> set /HOST/bootmode state=valueConfiguration du mode d’initialisation 55 ? Pour gérer le script du mode d’initialisation de l’hôte ? A l'invite -> d'Oracle ILOM, tapez : où script contrôle la méthode d’initialisation du microprogramme OBP du serveur hôte. Le script n’a aucune incidence sur le paramètre /HOST/bootmode actuel. valeur peut compter jusqu’à 64 octets. Vous pouvez spécifier le paramètre /HOST/bootmode et définir le script dans la même commande. Par exemple : Une fois serveur réinitialisé et que l’OBP lit les valeurs stockées dans le script, l'OBP définit la variable OBP diag-switch? sur la valeur requise par l’utilisateur : true. Remarque – Si vous indiquez /HOST/bootmode script="", Oracle ILOM définit la valeur script comme vide. Informations connexes ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Présentation du mode d’initialisation », page 51 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"56 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte ? A l'invite -> d'Oracle ILOM, tapez : où expires correspond aux date et heure d’échéance du mode d’initialisation actif. Informations connexes ¦ « Pour réinitialiser le serveur (Oracle ILOM) », page 20 ¦ « Présentation du mode d’initialisation », page 51 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 ? Pour remplacer les paramètres de l’OBP afin de réinitialiser le serveur Cette procédure vous permet de remplacer les paramètres de l’OBP et de lancer la réinitialisation du domaine de contrôle, ce qui entraîne le démarrage de l’hôte à l’invite ok. ? A l'invite -> d'Oracle ILOM, tapez : L’hôte redémarre puis s’arrête à l’invite ok. Informations connexes ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 53 ¦ « Configuration du mode d’initialisation », page 51 ¦ « Présentation du mode d’initialisation », page 51 ¦ « Présentation d’Oracle VM Server pour SPARC », page 4 -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled -> reset /HOST/domain/control [-force] [-script]57 Configuration du comportement du serveur au redémarrage Pour configurer le comportement d’Oracle ILOM dans les scénarios de redémarrage suivants, suivez les procédures indiquées ci-après. ¦ « Pour définir le comportement de l’hôte à sa réinitialisation », page 57 ¦ « Pour définir le comportement de l’hôte lorsque son exécution s’arrête », page 58 ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 58 ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 59 ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 59 ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 60 ? Pour définir le comportement de l’hôte à sa réinitialisation Spécifiez si l’hôte doit continuer à démarrer lorsqu’une erreur se produit. ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ false : l’hôte continue la procédure d’initialisation même s’il rencontre une erreur. ¦ true : l’hôte ne continue pas la procédure d’initialisation s’il rencontre une erreur. Informations connexes ¦ « Configuration des paramètres de stratégie », page 37 -> set /HOST autorunonerror=value58 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête Spécifiez le comportement d’Oracle ILOM lorsque l’hôte quitte l’état RUNNING (à l’expiration de l’horloge chien de garde). ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune) : Oracle ILOM se limite à émettre un avertissement. ¦ reset (réinitialiser) : Oracle ILOM tente de réinitialiser le serveur lorsque l’horloge chien de garde Oracle Solaris expire (option par défaut). ¦ dumpcore : Oracle ILOM tente de forcer un core dump du SE lorsque l’horloge chien de garde expire. Informations connexes ¦ « Pour afficher l’historique de la console », page 68 ? Pour définir l’intervalle du délai d’attente d’initialisation ? Définissez le délai d’attente entre une requête d’initialisation de l’hôte et l’initialisation proprement dite : La valeur par défaut de boottimeout correspond à 0 (zéro seconde) ou aucun délai d’attente. Les valeurs possibles sont comprises entre 0 et 36 000 secondes. Informations connexes ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 59 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguration du comportement du serveur au redémarrage 59 ? Pour définir le comportement à l’expiration du délai d’initialisation Spécifiez le comportement d’Oracle ILOM en cas d’échec de l’initialisation de l’hôte avant l’expiration du délai d’initialisation. ? Définissez le comportement au terme de la commande boottimeout : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune, par défaut) ¦ Réinitialisation Informations connexes ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 58 ? Pour définir le comportement en cas d’échec du redémarrage Spécifiez le comportement d’Oracle ILOM lorsque l’hôte ne parvient pas à atteindre l’état running pour Oracle Solaris. ? A l'invite -> d'Oracle ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ powercycle ¦ poweroff (valeur par défaut) Informations connexes ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 60 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value60 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour définir le nombre maximum de tentatives de redémarrage Indiquez le nombre de fois qu’Oracle ILOM doit tenter de redémarrer l’hôte. ? A l'invite -> d'Oracle ILOM, tapez : La valeur par défaut de maxbootfail est 3 (trois tentatives). Si l’initialisation de l’hôte échoue après le nombre de tentatives indiqué par maxbootfail, l’hôte est mis hors tension ou soumis à un cycle d’alimentation progressive (selon la configuration de bootfailrecovery). Dans les deux cas, la commande boottimeout est définie sur 0 (zéro seconde), empêchant d’autres tentatives de redémarrage de l’hôte. Informations connexes ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 59 -> set /HOST maxbootfail=attempts61 Configuration des périphériques Les sections suivantes présentent des informations sur la configuration des périphériques du serveur. ¦ « Pour déconfigurer manuellement un périphérique », page 61 ¦ « Pour reconfigurer manuellement un périphérique », page 62 ? Pour déconfigurer manuellement un périphérique Le microprogramme Oracle ILOM dispose d’une commande component_state= disabled permettant de déconfigurer manuellement les périphériques du serveur. Cette commande identifie le périphérique spécifié comme étant désactivé (disabled). Tout périphérique marqué disabled, que ce soit manuellement ou par le microprogramme système, est supprimé de la description de machine du serveur avant le transfert de contrôle à d’autres couches du microprogramme système, comme l’OBP. ? A l'invite -> d'Oracle ILOM, tapez : Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour reconfigurer manuellement un périphérique », page 62 ¦ « Pour afficher les composants du serveur », page 74 ¦ « Pour identifier les chemins d’accès aux périphériques », page 32 -> set component-name component_state=disabled62 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour reconfigurer manuellement un périphérique Le microprogramme Oracle ILOM dispose d’une commande component_state= enabled permettant de reconfigurer manuellement les périphériques serveur. Cette commande vous permet de marquer le périphérique spécifié comme étant activé (enabled). ? A l'invite -> d'Oracle ILOM, tapez : Informations connexes ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour déconfigurer manuellement un périphérique », page 61 ¦ « Pour afficher les composants du serveur », page 74 ¦ « Pour identifier les chemins d’accès aux périphériques », page 32 -> set component-name component_state=enabled63 Contrôle du serveur Les serveurs de la série SPARC T4 disposent de nombreuses méthodes pour signaler un comportement défectueux, y compris les DEL, Oracle ILOM et le POST. Pour en savoir plus sur les DEL et obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Contrôle des pannes », page 63 ¦ « Activation de la récupération automatique du système », page 71 ¦ « Pour afficher les composants du serveur », page 74 ¦ « Pour localiser le serveur », page 75 Contrôle des pannes Les sections suivantes présentent un récapitulatif des outils de diagnostic ainsi que des informations de base sur la détection des pannes du serveur à l’aide d’outils exécutés en amont du système d’exploitation, notamment Oracle ILOM et le POST. Pour obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Présentation des diagnostics », page 64 ¦ « Pour détecter les pannes (Oracle ILOM) », page 65 ¦ « Détection des pannes (shell de gestion des pannes d’Oracle ILOM) », page 65 ¦ « Pour détecter les pannes à l’aide du POST », page 67 ¦ « Pour afficher l’historique de la console », page 68 ¦ « Pour corriger une panne (shell de gestion des pannes d’Oracle ILOM) », page 69 ¦ « Pour effacer une panne », page 7164 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Présentation des diagnostics Vous disposez de toute une gamme d’outils de diagnostic, de commandes et d’indicateurs permettant de contrôler et de dépanner un serveur. Reportez-vous au manuel d’entretien de votre serveur pour obtenir des informations complètes sur ces outils de diagnostic : ¦ DEL : fournissent une indication visuelle rapide du statut du serveur et de certaines FRU. ¦ Oracle ILOM : microprogramme exécuté sur le processeur de service. Outre l’interface qu’il fournit entre le matériel et le SE, le microprogramme Oracle ILOM permet également de suivre et de signaler l’état général des composants clés du serveur. Oracle ILOM exploite pleinement le POST et la technologie d’autorétablissement prédictif d’Oracle Solaris pour maintenir le serveur en état de fonctionnement, même en présence d’un composant défectueux. ¦ Autotest de l’allumage (POST) : le POST effectue des tests de diagnostic sur les composants du serveur après une réinitialisation manuelle pour s’assurer de leur intégrité. Le POST peut être configuré et utilise le microprogramme Oracle ILOM pour mettre hors tension les composants défectueux, le cas échéant. ¦ Autorétablissement prédictif du SE Oracle Solaris : cette technologie contrôle en permanence l’intégrité du processeur et de la mémoire, et fonctionne avec Oracle ILOM pour placer un composant défectueux hors ligne, le cas échéant. Elle permet aux serveurs de prévoir avec précision les pannes de composants et de limiter de nombreux problèmes graves avant qu’ils ne surviennent. ¦ Fichiers journaux et interface de commandes : fournissent les fichiers journaux standard du SE Oracle Solaris, ainsi que les commandes d’investigation qui peuvent être utilisées et affichées sur le périphérique de votre choix. ¦ SunVTS : application qui permet de tester le serveur, de vérifier le fonctionnement du matériel et d’identifier les composants éventuellement défectueux en fournissant des recommandations pour leur réparation. Les DEL, le microprogramme Oracle ILOM, l’autorétablissement prédictif du SE et les nombreux fichiers journaux et messages de la console offrent une intégration mutuelle totale. Cela signifie que, par exemple, en cas de panne détectée par le logiciel Oracle Solaris, celle-ci est affichée et consignée, tandis que les informations correspondantes sont transmises à Oracle ILOM qui les consigne. Informations connexes ¦ « Pour détecter les pannes (Oracle ILOM) », page 65 ¦ « Pour détecter les pannes à l’aide du POST », page 67 ¦ « Détection des pannes (shell de gestion des pannes d’Oracle ILOM) », page 65 ¦ Consultez la section du manuel d’entretien du serveur concernant la détection et la gestion des pannes.Contrôle du serveur 65 ? Pour détecter les pannes (Oracle ILOM) ? A l'invite -> d'Oracle ILOM, tapez : Cette commande affiche la cible, la propriété et la valeur de la panne. Par exemple : Informations connexes ¦ « Pour détecter les pannes à l’aide du POST », page 67 ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour localiser le serveur », page 75 ¦ « Pour effacer une panne », page 71 ¦ « Activation de la récupération automatique du système », page 71 ¦ « Détection des pannes (shell de gestion des pannes d’Oracle ILOM) », page 65 ? Détection des pannes (shell de gestion des pannes d’Oracle ILOM) Le shell de gestion des pannes d’Oracle ILOM (Fault Management Shell) permet d’utiliser les commandes du gestionnaire des pannes d’Oracle Solaris (fmadm et fmstat) à partir d’Oracle ILOM, afin de visualiser à la fois les pannes relatives à l’hôte et à Oracle ILOM. 1. Pour lancer le shell intégré, à l’invite -> d’Oracle ILOM, tapez : -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgt/shell (y/n)? y faultmgmtsp>66 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 2. Pour obtenir la liste des pannes actuelles du serveur, tapez : Remarque – Si le serveur détecte le remplacement de la FRU défectueuse, la réparation ne nécessite pas l’exécution d’une commande par l’utilisateur, car la panne sera effacée automatiquement. 3. Détectez des informations complémentaires sur une panne donnée. Recherchez la panne MSG-ID (SPT-8000-DH dans l'exemple précédent), et saisissez-la dans la fenêtre de recherche Search Knowledge Base (Rechercher dans la base de connaissances) sur le site http://support.oracle.com. 4. Pour plus d'informations sur la réparation de la panne, reportez-vous à la section : « Pour corriger une panne (shell de gestion des pannes d’Oracle ILOM) », page 69. faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.Contrôle du serveur 67 5. Pour quitter le shell de gestion des pannes et revenir à Oracle ILOM, tapez : Informations connexes ¦ Article sur l'autorétablissement prédictif (en anglais) « Oracle Solaris 10 OS Feature Sportlight: Predictive Self Healing » disponible à l’adresse www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ « Connexion à Oracle ILOM », page 9 ¦ « Pour détecter les pannes (Oracle ILOM) », page 65 ¦ « Pour corriger une panne (shell de gestion des pannes d’Oracle ILOM) », page 69 ? Pour détecter les pannes à l’aide du POST L’interrupteur à clé virtuel permet d’exécuter des diagnostics POST complets sans avoir à modifier les paramètres des propriétés de diagnostic. Notez que l’exécution des diagnostics POST peuvent prendre temps considérable lors de la réinitialisation du serveur. 1. Connectez-vous à Oracle ILOM. Reportez-vous à la section « Connexion à Oracle ILOM », page 9. 2. A l'invite -> d'Oracle ILOM, tapez : Le serveur est configuré pour exécuter les diagnostics POST complets au moment de sa réinitialisation. 3. Pour revenir aux paramètres de diagnostic standard après l’exécution du POST, à l’invite -> d’Oracle ILOM, tapez ce qui suit : Informations connexes ¦ « Pour détecter les pannes (Oracle ILOM) », page 65 ¦ « Pour localiser le serveur », page 75 ¦ « Pour effacer une panne », page 71 faultmgmtsp> exit -> -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal68 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour afficher l’historique de la console Cette rubrique décrit la procédure d’affichage des tampons de sortie de la console du serveur hôte. Il existe deux tampons d’historique de console pouvant contenir jusqu’à 1 Mo d’informations. La cible /HOST/console/history écrit tous les types d’informations de journalisation. La cible /HOST/console/bootlog consigne les informations de démarrage et les données d’initialisation dans le tampon de la console jusqu’à ce qu’Oracle ILOM soit notifié par le serveur que le SE Oracle Solaris est exécuté et opérationnel. Ce tampon est conservé jusqu’à ce que l’hôte soit réinitialisé. Remarque – Vous devez disposer des droits d’administrateur Oracle ILOM pour utiliser cette commande. 1. Pour gérer le journal /HOST/console/history, à l’invite -> d’Oracle ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 1 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 1 et tout nombre entier ou "" pour indiquer un nombre de lignes illimité. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Si vous tapez la commande show /HOST/console/history sans définir d’arguments préalables à l’aide de la commande set, Oracle ILOM affiche toutes les lignes du journal de la console en commençant par la fin. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console Oracle ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’Oracle ILOM. -> set /HOST/console/history property=option [...] -> show /HOST/console/historyContrôle du serveur 69 2. Pour afficher le journal /HOST/console/bootlog, à l’invite -> d’Oracle ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Par défaut, le journal de la console Oracle ILOM utilise l'heure de Greenwich (GMT), mais vous pouvez utiliser la commande /SP/clock timezone afin que l'horloge du processeur de service utilise d'autres fuseaux horaires. L’heure système du SE Solaris est indépendante de celle d’Oracle ILOM. Informations connexes ¦ « Pour spécifier l’état d’alimentation actuelle de l’hôte au redémarrage », page 39 ? Pour corriger une panne (shell de gestion des pannes d’Oracle ILOM) Vous pouvez utiliser la commande fmadm repair pour corriger des pannes diagnostiquées par Oracle ILOM. Contrairement aux pannes détectées par l’hôte, les pannes et erreurs diagnostiquées par Oracle ILOM sont dotées d’un ID de message commençant par SPT. Le seul moment auquel vous devriez utiliser la commande fmadm repair dans le shell de gestion des pannes d’Oracle ILOM pour une panne détectée par l’hôte est le cas où la panne est réparée sans qu’Oracle ILOM le remarque. Il se peut, par exemple, qu’Oracle ILOM ait été hors service lorsque la panne a été réparée. Dans ce cas, l’hôte n’afficherait plus la panne, contrairement à Oracle ILOM. Utilisez la commande fmadm repair pour effacer la panne. -> show /HOST/console/bootlog property70 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 1. Localisez la panne : 2. Pour réparer une panne détectée par Oracle ILOM, exécutez la commande fmadm repair : Remarque – Vous pouvez utiliser soit le nom NAC (par exemple, /SYS/MB) soit l’UUID (par exemple, fa4a2f86-5156-4243-8e88-d6516db12970) de la panne avec la commande fmadm repair. faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp>Contrôle du serveur 71 3. Pour quitter le shell de gestion des pannes et revenir à Oracle ILOM, tapez : Informations connexes ¦ « Détection des pannes (shell de gestion des pannes d’Oracle ILOM) », page 65 ? Pour effacer une panne ? A l'invite -> d'Oracle ILOM, tapez : Définissez clear_fault_action sur true pour effacer la panne au niveau du composant et à tous les niveaux inférieurs de l’arborescence /SYS. Informations connexes ¦ « Pour détecter les pannes (Oracle ILOM) », page 65 ¦ « Pour détecter les pannes à l’aide du POST », page 67 ¦ « Pour afficher les composants du serveur », page 74 Activation de la récupération automatique du système Les sections suivantes présentent des informations relatives à la configuration du serveur en vue de récupérer automatiquement de pannes mineures. Remarque – Cette section fait référence à la fonction de récupération automatique du système et non à la fonction de dénomination voisine, l’Auto Service Request (requête automatique de service). ¦ « Présentation de la récupération automatique de système », page 72 ¦ « Pour activer la fonction ASR », page 72 ¦ « Pour désactiver la fonction ASR », page 73 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 74 faultmgmtsp> exit -> -> set /SYS/component clear_fault_action=true72 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Présentation de la récupération automatique de système Le serveur assure la récupération automatique du système (ASR) en cas de panne des modules de mémoire ou des cartes PCI. La fonction ASR permet au serveur de reprendre son fonctionnement après certaines défaillances ou pannes matérielles non fatales. Lorsque l’ASR est activée, les diagnostics du microprogramme du système détectent automatiquement les composants matériels en panne. Une fonction de configuration automatique intégrée au microprogramme du système permet au système de déconfigurer les composants en panne et de rétablir le fonctionnement du serveur. Tant que le serveur est en mesure de fonctionner sans le composant en panne, la fonction ASR lui permet de redémarrer automatiquement sans intervention de l’utilisateur. Remarque – Vous devez activer l’ASR manuellement. Reportez-vous à la section « Pour activer la fonction ASR », page 72. Pour plus d’informations sur l’ASR, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Pour activer la fonction ASR », page 72 ¦ « Pour désactiver la fonction ASR », page 73 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 74 ? Pour activer la fonction ASR 1. A l'invite -> d'Oracle ILOM, tapez : 2. A l’invite ok, tapez : -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? trueContrôle du serveur 73 Remarque – Pour plus d’informations sur les variables de configuration OpenBoot, reportez-vous au manuel d’entretien du serveur. 3. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke en permanence les modifications apportées aux paramètres et est automatiquement initialisé si la variable de configuration OpenBoot auto-boot? est définie sur true (valeur par défaut). Informations connexes ¦ « Présentation de la récupération automatique de système », page 72 ¦ « Pour désactiver la fonction ASR », page 73 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 74 ? Pour désactiver la fonction ASR 1. A l’invite ok, tapez : 2. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke définitivement le changement de paramètre. Une fois désactivée, la fonction ASR le reste tant que vous ne la réactivez pas. Informations connexes ¦ « Pour activer la fonction ASR », page 72 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 74 ¦ « Présentation de la récupération automatique de système », page 72 ok reset-all ok setenv auto-boot-on-error? false ok reset-all74 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour afficher des informations sur les composants concernés par l’ASR ? A l'invite -> d'Oracle ILOM, tapez : Dans la sortie de la commande show /SYS/composant component_state, tout périphérique indiqué comme désactivé a été déconfiguré manuellement en utilisant le microprogramme du système. La sortie de la commande indique également les périphériques qui ont échoué aux diagnostics du microprogramme et ont été automatiquement déconfigurés par le microprogramme du système. Informations connexes ¦ « Présentation de la récupération automatique de système », page 72 ¦ « Pour activer la fonction ASR », page 72 ¦ « Pour désactiver la fonction ASR », page 73 ¦ « Pour déconfigurer manuellement un périphérique », page 61 ¦ « Pour reconfigurer manuellement un périphérique », page 62 ? Pour afficher les composants du serveur Affichez des informations en temps réel sur les composants installés sur votre serveur en utilisant la commande show components d’Oracle ILOM. ? A l'invite d'Oracle ILOM, tapez : Remarque – L'exemple ci-après illustre une sortie de la commande show components. Les composants spécifiques varient en fonction du serveur. -> show /SYS/component component_state -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | DisabledContrôle du serveur 75 Informations connexes ¦ « Pour identifier les chemins d’accès aux périphériques », page 32 ? Pour localiser le serveur Si vous avez besoin d’effectuer une opération de maintenance sur un composant, vous identifierez plus facilement le serveur concerné par la DEL de localisation système qui s’allume. Vous n’avez besoin d’aucun droit administrateur pour utiliser les commandes set /SYS/LOCATE et show /SYS/LOCATE. 1. Connectez-vous à Oracle ILOM. Reportez-vous à la section « Connexion à Oracle ILOM », page 9. 2. Gérez la DEL de localisation à l’aide des commandes suivantes. ¦ Pour activer la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour désactiver la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour afficher l’état de la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : Informations connexes ¦ « Contrôle des pannes », page 63 ¦ « Configuration des périphériques », page 61 PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | Enabled /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=off -> show /SYS/LOCATE76 Guide d’administration des serveurs de la série SPARC T4 • Novembre 201177 Mise à jour du microprogramme Les sections suivantes décrivent les procédures de mise à jour du microprogramme système et d’affichage des versions actuelles des microprogrammes des serveurs de la série SPARC T4 d’Oracle. ¦ « Pour afficher la version du microprogramme », page 77 ¦ « Pour mettre à jour le microprogramme », page 78 ¦ « Pour afficher la version d’OpenBoot », page 80 ¦ « Pour afficher la version de POST », page 81 ? Pour afficher la version du microprogramme La propriété /HOST sysfw_version affiche des informations relatives à la version du microprogramme système installée sur l’hôte. ? Affichez le paramètre actuel de cette propriété. A l'invite -> d'Oracle ILOM, tapez : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 78 -> show /HOST sysfw_version78 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ? Pour mettre à jour le microprogramme 1. Assurez-vous que le processeur de service Oracle ILOM est configuré. Pour les instructions, reportez-vous au guide d’installation de votre serveur. 2. Ouvrez une session SSH pour vous connecter au processeur de service : 3. Mettez l’hôte hors tension : 4. Définissez le paramètre keyswitch_state sur normal: 5. Tapez la commande load en indiquant le chemin d’accès à la nouvelle image flash. La commande load met à jour l’image flash du processeur de service et le microprogramme de l’hôte. La commande load requiert les informations suivantes : ¦ Adresse IP d’un serveur TFTP du réseau pouvant accéder à l’image flash ¦ Chemin d’accès complet à l’image flash à laquelle l’adresse IP peut accéder Cette commande s’utilise de la manière suivante : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalMise à jour du microprogramme 79 load [-script] -source tftp://xxx.xxx.xx.xxx/chemin d’accès où : ¦ -script : ne demande aucune confirmation et agit comme si yes était spécifié. ¦ -source : indique l’adresse IP et le chemin d’accès complet (URL) de l’image flash. Une fois l’image flash mise à jour, le serveur est réinitialisé automatiquement, puis il exécute les diagnostics et revient à l’invite de connexion sur la console série. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... ***80 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Informations connexes ¦ « Pour afficher la version du microprogramme », page 77 ? Pour afficher la version d’OpenBoot La propriété /HOST obp_version affiche des informations sur la version d’OpenBoot installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 78 ¦ « Présentation d’OpenBoot », page 4 Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionMise à jour du microprogramme 81 ? Pour afficher la version de POST La propriété /HOST post_version affiche des informations sur la version de POST installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 78 -> show /HOST post_version82 Guide d’administration des serveurs de la série SPARC T4 • Novembre 201183 Identification des périphériques DIS2 compatibles WWN Les rubriques suivantes expliquent comment identifier les périphériques DIS2 en fonction de leurs valeurs WWN. ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) », page 85 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 Syntaxe de nom universel Le SE Oracle Solaris utilise la syntaxe de nom universel (WWN) au lieu du champ unique au niveau local tn (ID cible) dans les noms de périphériques logiques. Cette modification a une incidence sur la façon dont les noms de périphérique peuvent être mappés à des périphériques SCSI spécifiques. Les points suivants sont essentiels pour comprendre l’impact de ce changement : ¦ Avant le passage à la nomenclature WWN, le SE Oracle Solaris identifiait le périphérique d'initialisation par défaut comme étant c0t0d0. ¦ Depuis ce changement, l'identificateur du périphérique d'initialisation par défaut est désormais c0tWWNd0, où WWN correspond à une valeur hexadécimale unique à ce périphérique au niveau mondial. ¦ Cette valeur WWN est affectée par le fabricant du périphérique et, par conséquent, est liée à l'arborescence du périphérique par une relation aléatoire.84 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Dans la mesure où les valeurs WWN ne sont pas conformes à la structure standard de nom de périphérique logique, vous ne pouvez pas identifier directement un périphérique cible à partir de sa valeur c#tWWNd#. Au lieu de cela, vous pouvez utiliser l'une des méthodes alternatives suivantes pour mapper les noms de périphérique WWN à des périphériques physiques. ¦ L'une des méthodes consiste à analyser la sortie de la commande OBP probe-scsi-all. Vous utilisez cette méthode lorsque le système d'exploitation n'est pas en cours d'exécution. Pour plus d’informations, reportez-vous à la section « Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) », page 85. Remarque – Par exemple, vous pouvez analyser la sortie de probe-scsi-all lorsque vous voulez identifier un périphérique d'initialisation. ¦ Lorsque le système d'exploitation est en cours d'exécution, vous pouvez analyser la sortie de la commande prtconf -v. Pour plus d’informations, reportez-vous à la section « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103. Informations connexes ¦ « Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) », page 85 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108Identification des périphériques DIS2 compatibles WWN 85 Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) Ces rubriques expliquent comment mapper les valeurs WWN à des disques SAS2 spécifiques à l'aide de la commande OBP probe-scsi-all. Des explications spécifiques sont fournies pour chaque modèle de serveur SPARC T4-x. ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Exemple de mappage WWN probe-scsi-all (SPARC T4-1) », page 87 ¦ « Exemple de mappage WWN probe-scsi-all (SPARC T4-2) », page 90 ¦ « Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec quatre CPU) », page 93 ¦ « Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec deux CPU) », page 96 ¦ « Exemple de mappage WWN probe-scsi-all (SPARC T4-1B) », page 100 Présentation du mappage WWN Probe-scsi-all La sortie affichée par probe-scsi-all répertorie tous les périphériques SCSI dans le serveur et fournit un ensemble d'informations élémentaires sur chaque périphérique. Lors de l'analyse de la sortie de probe-scsi-all, recherchez les champs de données suivants : Entity Name (Nom de l'entité) Définition Cible Un ID cible unique est affecté à chaque disque SAS. SASDeviceName Il s'agit de la valeur WWN affectée au disque SAS par le fabricant. Le SE Oracle Solaris reconnaît ce nom. SASAddress Il s'agit de la valeur WWN affectée à un périphérique SCSI qui est reconnu par le microprogramme OBP. PhyNum Il s'agit de l'ID hexadécimal du port de contrôleur qui est connecté au disque cible. Vo lumeDev iceNa me (lorsqu'un volume RAID est configuré) Il s'agit de la valeur WWN affectée à un volume RAID qui est reconnu par le SE Oracle Solaris. VolumeDeviceName remplace la valeur SASDeviceName de chaque périphérique SCSI contenu dans le volume RAID.86 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Ce tableau décrit six éléments de la sortie de probe-scsi-all qui contribuent à l'identification des disques durs connectés à un contrôleur DIS2. A un niveau élevé, le processus de mappage WWN se compose des étapes suivantes : ¦ Identifiez l'emplacement physique du disque dur cible de l'opération. ¦ Identifiez le port du contrôleur connecté à cet emplacement physique. ¦ Enfin, recherchez le nom du périphérique WWN du disque connecté à ce port de contrôleur. Des exemples de ce processus sont fournis pour chacun des modèles de serveur SPARC T4 : ¦ SPARC T4-1 -- « Exemple de mappage WWN probe-scsi-all (SPARC T4-1) », page 87 ¦ SPARC T4-2 -- « Exemple de mappage WWN probe-scsi-all (SPARC T4-2) », page 90 ¦ SPARC T4-4 avec quatre CPU -- « Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec quatre CPU) », page 93 ¦ SPARC T4-4 avec deux CPU -- « Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec deux CPU) », page 96 ¦ SPARC T4-1B -- « Exemple de mappage WWN probe-scsi-all (SPARC T4-1B) », page 100 Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 VolumeWWID (lorsqu'un volume RAID est configuré) Il s'agit de la valeur WWN affectée à un volume RAID qui est reconnu par le microprogramme OBP. VolumeWWID remplace la valeur SASAddress de chaque périphérique SCSI contenu dans le volume RAID. Entity Name (Nom de l'entité) DéfinitionIdentification des périphériques DIS2 compatibles WWN 87 Exemple de mappage WWN probe-scsi-all (SPARC T4-1) La carte mère du serveur SPARC T4-1 comporte deux contrôleurs SAS2 RAID. Chaque contrôleur est connecté à quatre emplacements sur le backplane de disque. Le tableau suivant montre le mappage entre le PhyNum et les emplacements de disque pour le backplane SPARC T4-1 à huit emplacements. Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS pour les deux contrôleurs d'un serveur SPARC T4-1. Ce tableau montre que les ports 0 à 3 du contrôleur 0 sont connectés aux emplacements de backplane 0 à 3 et que les ports 0 à 3 du contrôleur 1 sont connectés aux emplacements 4 à 7. Le tableau ci-dessous illustre les emplacements de disques dans le backplane SPARC T4-1. Le tableau ci-après illustre l'organisation des huit emplacements de disques dans un serveur SPARC T4-1. TABLEAU : Mappage des ports de contrôleurs SAS2 pour le backplane de disque SPARC T4-1 Contrôleur SAS2 Port de contrôleur (PhyNum) Emplacement de disque Contrôleur SAS2 Port de contrôleur (PhyNum) Emplacement de disque 0 0 0 * * Disque d'initialisation par défaut 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLEAU : Emplacements des disques physiques dans le backplane SPARC T4-1 Emplacement de disque 1 Emplacement de disque 3 Emplacement de disque 5 DVD Emplacement de disque 0 * * Disque d'initialisation par défaut Emplacement de disque 2 Emplacement de disque 4 Emplacement de disque 6 Emplacement de disque 788 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 L'exemple suivant est basé sur un serveur SPARC T4-1 à huit disques durs. Ces disques durs sont déployés sous forme de six périphériques de stockage et d'un disque virtuel. Le disque virtuel se compose de deux disques durs configurés en tant que volume RAID. Les contrôleurs 0 et 1 sont connectés à ces périphériques de stockage de la manière suivante : ¦ Le contrôleur 0 est connecté aux cibles 9 et b (deux périphériques de stockage). ¦ Le contrôleur 0 est également connecté à la cible 523 (volume RAID). ¦ Le contrôleur 1 est connecté aux cibles 9, b, c et d (quatre périphériques de stockage). ¦ Le contrôleur 1 est également connecté à une cible (lecteur de DVD). Remarque – Pour les serveurs SPARC T4-1, le deuxième champ du chemin d'accès au périphérique spécifie les contrôleurs : /pci@400/pci@1 = contrôleur 0 et /pci@400/pci@2 = contrôleur 1. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 2 Target d Unit 0 Disk HITACHI H106060SDSUN600G A2B0 1172123568 Blocks, 600 GB SASDeviceName 5000cca01201e544 SASAddress 5000cca01201e545 PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GBIdentification des périphériques DIS2 compatibles WWN 89 Dans cet exemple, les ports de contrôleur sont connectés aux disques durs et au lecteur de DVD de la manière suivante : Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS d'un serveur SPARC T4-1 doté de deux disques durs configurés dans un volume RAID et de six disques durs disponibles en tant que périphériques de stockage. Remarque – Les valeurs cibles ne sont pas statiques. Le même périphérique de stockage peut apparaître dans deux listes probe-scsi-all consécutives avec des valeurs cible différentes. Le périphérique d'initialisation par défaut possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00a75dcac ¦ SASAddress = 5000cca00a75dcad SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 1 Target 523 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok Contrôleur SAS2 Port de contrô- leur (PhyNum) ID d'emplacement de disque Cible Contrôleur SAS2 Port de contrô- leur (PhyNum) ID d'emplacement de disque Cible 0 0 0 * * Disque d'initialisation par défaut 9 1 0 4 9 1 1 a 1 5 b 2 2 Cible RAID 523 2 6 c 3 3 Cible RAID 523 3 7 d 6 DVD a90 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Si vous voulez spécifier un autre disque en tant que périphérique d'initialisation, recherchez sa valeur PhyNum dans la sortie et utilisez la valeur SASDeviceName affectée à ce périphérique. Par exemple, si vous souhaitez utiliser le disque dur de l'emplacement de disque 5, il possède les valeurs suivantes : ¦ Controller = 1 ¦ Target = b ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00a76e380 ¦ SASAddress = 5000cca00a76e381 Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 Exemple de mappage WWN probe-scsi-all (SPARC T4-2) La carte mère du serveur SPARC T4-2 comporte un contrôleur SAS2 RAID. Ce contrôleur est connecté à six emplacements sur le backplane de disque. Le tableau suivant montre le mappage entre le PhyNum et les emplacements de disques pour le backplane SPARC T4-2 à six emplacements. TABLEAU : Mappage des ports de contrôleur SAS2 pour le backplane de disque SPARC T4-2 Contrôleur SAS2 Port de contrôleur (PhyNum) Emplacements de disques et lecteur DVD 0 0 0 * * Disque d'initialisation par défaut 1 1 2 2 3 3 4 4 5 5 6 Non connecté 7 DVDIdentification des périphériques DIS2 compatibles WWN 91 Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de contrôleur SAS d'un serveur SPARC T4-2. L'exemple suivant est basé sur un serveur SPARC T4-2 doté de six disques durs. Ces disques durs sont déployés sous forme de quatre périphériques de stockage et d'un disque virtuel qui se compose de deux disques durs configurés en tant que volume RAID. Le contrôleur est connecté à ces périphériques de la manière suivante : ¦ Cibles 9, d, e et f (quatre périphériques de stockage). ¦ Cible 389 (volume RAID). ¦ Cible a (lecteur de DVD). Dans cet exemple, les ports de contrôleur sont connectés aux disques durs et au lecteur de DVD de la manière suivante : ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.56, MPT Version 2.00, Firmware Version 9.00.00.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok92 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS d'un serveur SPARC T4-2 doté de deux disques durs configurés dans un volume RAID et de quatre disques durs disponibles en tant que périphériques de stockage. Remarque – Les valeurs cibles ne sont pas statiques. Le même périphérique de stockage peut apparaître dans deux listes probe-scsi-all consécutives avec des valeurs cible différentes. Le périphérique d'initialisation par défaut possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c5001cb4a637 ¦ SASAddress = 5000c5001cb4a635 Si vous voulez spécifier un autre disque en tant que périphérique d'initialisation, recherchez sa valeur PhyNum dans la sortie et utilisez la valeur SASDeviceName affectée à ce périphérique. Par exemple, si vous souhaitez utiliser le disque dur de l'emplacement 3, il possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = f ¦ PhyNum = 3 Contrôleur SAS2 Port de contrôleur (PhyNum) ID d'emplacement de disque Cible 0 0 0 * * Disque d'initialisation par défaut 9 1 1 d 2 2 e 3 3 f 4 4 Cible RAID 389 5 5 Cible RAID 389 6 Non connecté -- 7 DVD aIdentification des périphériques DIS2 compatibles WWN 93 ¦ SASDeviceName = 5000c5001cb47f7f ¦ SASAddress = 5000c5001cb47f7d Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec quatre CPU) Deux cartes REM sont connectées à la carte mère du serveur SPARC T4-4. Ces modules sont appelés les contrôleurs 0 et 1. Chaque contrôleur SAS est connecté à un backplane de disque distinct à quatre emplacements. Le tableau ci-après montre le mappage entre le PhyNume et les emplacements de disques pour les deux backplanes SPARC T4-4 à quatre emplacements. Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS pour les deux contrôleurs d'un serveur SPARC T4-4. Ce tableau montre que les ports 0 à 3 du contrôleur 0 sont connectés aux emplacements de backplane 0 à 3 et que les ports 0 à 3 du contrôleur 1 sont connectés aux emplacements 4 à 7. TABLEAU : Mappage des ports de contrôleur SAS2 pour le backplane de disque SPARC T4-4 Backplane de disque 0 Backplane de disque 1 Contrôleur SAS2 ID du port de contrôleur (PhyNum) ID d'emplacement de disque Contrôleur SAS2 ID du port de contrôleur (PhyNum) ID d'emplacement de disque 0 0 0 * * Disque d'initialisation par défaut 1 0 4 1 1 1 5 2 2 2 6 3 3 3 794 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Le tableau ci-dessous illustre les emplacements de disque dans le backplane SPARC T4-4. Le tableau suivant illustre l'organisation des huit emplacements de disques dans un serveur SPARC T4-4. L'exemple suivant est basé sur un serveur SPARC T4-4 doté de quatre CPU et de huit disques durs. Ces disques durs sont déployés sous forme de six périphériques de stockage et d'un disque virtuel qui se compose de deux disques durs configurés en tant que volume RAID. Les contrôleurs 0 et 1 sont connectés à ces périphériques de stockage de la manière suivante : ¦ Le contrôleur 0 est connecté aux cibles 9 et a (deux périphériques de stockage). ¦ Le contrôleur 0 est également connecté à la cible 688 (volume RAID). ¦ Le contrôleur 1 est connecté aux cibles 9, a, b et c (quatre périphériques de stockage). Remarque – OBP utilise un autre chemin de périphérique pour le contrôleur SAS 1 dans les serveurs SPARC T4-4, selon que le serveur est équipé de quatre ou de deux processeurs. Le chemin d'accès du contrôleur SAS 0 est le même pour les deux configurations de processeur. TABLEAU : Emplacements des unités physiques dans le backplane de disque SPARC T4-4 Backplane de disque 0 Backplane de disque 1 Emplacement de disque 1 Emplacement de disque 3 Emplacement de disque 5 Emplacement de disque 7 Emplacement de disque 0 * * Unité d'initialisation par défaut Emplacement de disque 2 Emplacement de disque 4 Emplacement de disque 6 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2Identification des périphériques DIS2 compatibles WWN 95 Dans cet exemple, les ports de contrôleur sont connectés aux disques durs de la manière suivante : Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS dans un serveur SPARC T4-4 doté de deux disques durs configurés dans un volume RAID et de six disques durs disponibles en tant que périphériques de stockage. Remarque – Les valeurs cibles ne sont pas statiques. Le même périphérique de stockage peut apparaître dans deux listes probe-scsi-all consécutives avec des valeurs cible différentes. Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 688 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 ok Backplane de disque 0 Backplane de disque 1 Port de contrôleur (PhyNum) ID d'emplacement de disque Cible Port de contrôleur (PhyNum) ID d'emplacement de disque Cible 0 0 * * Unité d'initialisation par défaut 9 0 4 9 1 1 a 1 5 a 2 2 Cible RAID 688 2 6 b 3 3 Cible RAID 688 3 7 c96 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Le périphérique d'initialisation par défaut possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 Si vous voulez spécifier un autre disque en tant que périphérique d'initialisation, recherchez sa valeur PhyNum dans la sortie et utilisez la valeur SASDeviceName affectée à ce périphérique. Par exemple, si vous souhaitez utiliser le disque dur de l'emplacement 1, il possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 Exemple de mappage WWN probe-scsi-all (SPARC T4-4 avec deux CPU) Deux cartes REM sont connectées à la carte mère du serveur SPARC T4-4. Ces modules sont appelés les contrôleurs 0 et 1. Chaque contrôleur SAS est connecté à un backplane de disque distinct à quatre emplacements. Le tableau ci-après montre le mappage entre le PhyNume et les emplacements de disque pour les deux backplanes SPARC T4-4 à quatre emplacements.Identification des périphériques DIS2 compatibles WWN 97 Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS pour les deux contrôleurs d'un serveur SPARC T4-4. Ce tableau montre que les ports 0 à 3 du contrôleur 0 sont connectés aux emplacements de backplane 0 à 3 et que les ports 0 à 3 du contrôleur 1 sont connectés aux emplacements 4 à 7. Le tableau ci-dessous illustre les emplacements de disques dans le backplane SPARC T4-4. Le tableau suivant illustre l'organisation des huit emplacements de disques dans un serveur SPARC T4-4. L'exemple suivant est basé sur un serveur SPARC T4-4 doté de deux CPU et de huit disques durs. Ces disques durs sont déployés sous forme de six périphériques de stockage et d'un disque virtuel qui se compose de deux disques durs configurés en tant que volume RAID. Les contrôleurs 0 et 1 sont connectés à ces périphériques de stockage de la manière suivante : ¦ Le contrôleur 0 est connecté aux cibles 9 et a (deux périphériques de stockage). ¦ Le contrôleur 0 est également connecté à la cible 457 (volume RAID). TABLEAU : Mappage des ports de contrôleurs SAS2 pour le backplane de disque SPARC T4-4 Backplane de disque 0 Backplane de disque 1 Contrôleur SAS2 ID du port de contrôleur (PhyNum) ID d'emplacement de disque Contrôleur SAS2 ID du port de contrôleur (PhyNum) ID d'emplacement de disque 0 0 0 * * Unité d'initialisation par défaut 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 TABLEAU : Emplacements des disques physiques dans le backplane de disque SPARC T4-4 Backplane de disque 0 Backplane de disque 1 Emplacement de disque 1 Emplacement de disque 3 Emplacement de disque 5 Emplacement de disque 7 Emplacement de disque 0 * * Disque d'initialisation par défaut Emplacement de disque 2 Emplacement de disque 4 Emplacement de disque 698 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ¦ Le contrôleur 1 est connecté aux cibles 9, a, b et c (quatre périphériques de stockage). Remarque – OBP utilise un autre chemin de périphérique pour le contrôleur SAS 1 dans les serveurs SPARC T4-4, selon que le serveur est équipé de quatre ou de deux processeurs. Le chemin d'accès du contrôleur SAS 0 est le même pour les deux configurations de processeur. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target 457 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 okIdentification des périphériques DIS2 compatibles WWN 99 Dans cet exemple, les ports de contrôleur sont connectés aux disques durs de la manière suivante : Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS d'un serveur SPARC T4-4 doté de deux disques durs configurés dans un volume RAID et de six disques durs disponibles en tant que périphériques de stockage. Remarque – Les valeurs cibles ne sont pas statiques. Le même périphérique de stockage peut apparaître dans deux listes probe-scsi-all consécutives avec des valeurs cible différentes. Le périphérique d'initialisation par défaut possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000cca00abcede0 ¦ SASAddress = 5000cca00abcede1 Si vous voulez spécifier un autre disque en tant que périphérique d'initialisation, recherchez sa valeur PhyNum dans la sortie et utilisez la valeur SASDeviceName affectée à ce périphérique. Par exemple, si vous souhaitez utiliser le disque dur de l'emplacement 1, il possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = a ¦ PhyNum = 1 ¦ SASDeviceName = 5000cca00abc51a8 ¦ SASAddress = 5000cca00abc51a9 Backplane de disque 0 Backplane de disque 1 Port de contrôleur (PhyNum) ID d'emplaceme nt de disque Cible Port de contrôleur (PhyNum) ID d'emplaceme nt de disque Cible 0 0 * * Disque d'initialisation par défaut 9 0 4 9 1 1 a 1 5 a 2 2 Cible RAID 457 2 6 b 3 3 Cible RAID 457 3 7 c100 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 Exemple de mappage WWN probe-scsi-all (SPARC T4-1B) La lame SPARC T4-1B possède deux emplacements de disques SCSI dans son backplane de disque. Un serveur Sun Blade 6000 RAID 0/1 DIS2 HBA REM, qui est connecté à la carte mère, gère les périphériques de stockage installés dans ces emplacements de backplane. Le tableau suivant montre le mappage entre le PhyNum et les emplacements de disque pour le backplane SPARC T4-1B à deux emplacements. Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS d'un serveur SPARC T4-1B. L'exemple ci-dessous est basé sur une lame SPARC T4-1B dotée de deux disques durs connectés au contrôleur en tant que périphériques de stockage. TABLEAU : Mappage des ports de contrôleurs SAS2 pour le backplane de disque SPARC T4-1B Port de contrôleur (PhyNum) 0 Port de contrôleur (PhyNum) 1 ID d'emplacement de disque 0 * * Unité d'initialisation par défaut ID d'emplacement de disque 1 ok probe-scsi-all /pci@400/pci@1/pci@0/pci@c/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00Identification des périphériques DIS2 compatibles WWN 101 Dans cet exemple, les ports de contrôleur sont connectés aux disques durs de la manière suivante : Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS d'un serveur SPARC T4-1B doté de deux disques durs connectés en tant que périphériques de stockage. Remarque – Les valeurs cibles ne sont pas statiques. Le même périphérique de stockage peut apparaître dans deux listes probe-scsi-all consécutives avec des valeurs cible différentes. Le périphérique d'initialisation par défaut possède les valeurs suivantes : ¦ Controller = 0 ¦ Target = 9 ¦ PhyNum = 0 ¦ SASDeviceName = 5000c500231694cf ¦ SASAddress = 5000c500231694cd Si vous souhaitez spécifier le disque dur de l'emplacement 1 en tant que périphérique d'initialisation, il possède les valeurs suivantes dans l'exemple ci-après : ¦ Controller = 0 ¦ Target = a Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c500231694cf SASAddress 5000c500231694cd PhyNum 0 Target a Unit 0 Disk SEAGATE ST973402SSUN72G 0603 143374738 Blocks, 73 GB SASDeviceName 5000c50003d37fcb SASAddress 5000c50003d37fc9 PhyNum 1 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok Port de contrôleur (PhyNum) 0 Port de contrôleur (PhyNum) 1 Cible 9 (ID d'emplacement de disque 0) Cible a (ID d'emplacement de disque 1)102 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 ¦ PhyNum = 1 ¦ SASDeviceName = 5000c50003d37fcb ¦ SASAddress = 5000c50003d37fc9 L'exemple ci-dessous est basé sur une lame SPARC T4-1B dotée de deux disques durs connectés au contrôleur en tant que volume RAID. Dans cet exemple, les ports de contrôleur sont connectés à un volume RAID contenant les disques durs installés dans les emplacements 0 et 1. Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 ok probe-scsi-all /pci@400/pci@1/pci@0/pci@2/LSI,sas@0 <===== SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 377 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@0/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 okIdentification des périphériques DIS2 compatibles WWN 103 ? Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) La procédure décrite ci-après s'applique aux serveurs SPARC T4-1 et SPARC T4-4, qui sont dotés de backplanes à huit disques. La même méthode peut être utilisée pour les systèmes serveur SPARC T4-2 et lame SPARC T4-1 1. Exécutez la commande format. Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000CCA00ABBAEB8d0. 2. Exécutez prtconf -v et recherchez le lien de périphérique contenant le nom c0t5000CCA00ABBAEB8d0. 3. Recherchez dans la sortie de prtconf l'entrée name=’wwn’ comportant la valeur WWN 5000cca00abbaeb8. Notez la valeur obp-path répertoriée sous le WWN 5000cca00abbaeb8. Reportez-vous au tableau ci-dessous pour trouver le contrôleur. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device link dev_link=/dev/rsd3a104 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Ce tableau présente des exemples de sortie de prtconf pour les contrôleurs 0 et 1 des serveurs SPARC T4-1 et SPARC T4-4. Deux exemples sont fournis pour le serveur SPARC T4-4 : l'un pour un système doté de quatre CPU et un autre pour un système doté de deux CPU. Pour les serveurs SPARC T4-1, le contrôleur est identifié dans le deuxième champ : pci@1 = contrôleur 0 et pci@2 = contrôleur 1. Pour les serveurs SPARC T4-4, le contrôleur est identifié dans le premier champ. Pour les systèmes équipés de quatre processeurs, pci@400 = contrôleur 0 et pci@700 = contrôleur 1. Pour les systèmes équipés de deux processeurs, pci@400 = contrôleur 0 et pci@500 = contrôleur 1. SPARC T4-1 Contrôleur 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (processeur 4) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T4-4 (processeur 2) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Identification des périphériques DIS2 compatibles WWN 105 Remarque – Les systèmes SPARC T4-2 et SPARC T4-1B ne contenant qu'un seul contrôleur SAS, seul le contrôleur 0 est répertorié. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T4-1. Dans cet exemple de serveur SPARC T4-1, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T4-4. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive SAS address name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’106 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Dans cet exemple de serveur SPARC T4-4, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. 4. Cette valeur phy-num correspond à l'emplacement de disque physique 0, comme indiqué dans la table de mappage des ports suivante. Ce tableau met en correspondance les numéros d'emplacement de disque avec les numéros de port de contrôleur SAS pour les deux contrôleurs d'un serveur SPARC T4-4. Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 * * Disque d'initialisation par défaut 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Identification des périphériques DIS2 compatibles WWN 107 Syntaxe WWN d'une installation de système d'exploitation sur un disque L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur une unité de disque précise. Dans cet exemple, le nom du périphérique contient la valeur WWN 5000CCA00A75DCAC. Remarque – Tous les caractères alphabétiques de la valeur WWN doivent être en majuscules. Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) », page 85 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 108 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap108 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur un volume RAID. Lors de l'installation d'un logiciel sur un volume RAID, utilisez la valeur VolumeDeviceName du périphérique virtuel au lieu du nom de périphérique individuel. Dans cet exemple, le nom du volume RAID est 3ce534e42c02a3c0. Informations connexes ¦ « Syntaxe de nom universel », page 83 ¦ « Présentation du mappage WWN Probe-scsi-all », page 85 ¦ « Mappage des valeurs WWN à des disques durs (commande OBP probe-scsi-all) », page 85 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (SE Oracle Solaris) », page 103 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un disque », page 107 # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs ***.***.***.***:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap109 Glossaire A ANSI SIS American National Standards Institute Status Indicator Standard, norme d’indication de statut de l’Institut de normalisation national des Etats-Unis. ASR Automatic System Recovery, fonction de récupération automatique du système. B BMC Baseboard Management Controller. BOB Tampon de mémoire figurant sur une carte. C Châssis Pour les serveurs, réfère au boîtier du serveur. Pour les modules serveur, réfère au boîtier du système modulaire. CMM Chassis Monitoring Module, module de contrôle de châssis. Le CMM est le processeur de service figurant dans le système modulaire. Oracle ILOM s’exécute sur le CMM, assurant la gestion à distance des composants du châssis du système modulaire. Voir Système modulaire et Oracle ILOM.110 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 D DHCP Dynamic Host Configuration Protocol, protocole de configuration dynamique de l’hôte. DTE Data Terminal Equipment,équipement terminal de traitement des données. E ESD Electrostatic discharge, décharge électrostatique. Espace de nom Cible Oracle ILOM CMM de niveau supérieur. F FEM Fabric Expansion Module, module d’extension de structure. Les modules FEM permettent aux modules serveur d’utiliser les connexions 10GbE fournies par certains modules NEM. Voir NEM. FRU Field-Replaceable Unit, unité remplaçable sur site. H HBA Host Bus Adapter, adaptateur de bus hôte. host Partie du serveur ou du module serveur avec la CPU et d'autres composants matériels exécutant le SE Oracle Solaris et d'autres applications. Le terme hôte est utilisé pour distinguer l'ordinateur principal du SP. Voir SP.Glossaire 111 I ID PROM Puce contenant des informations système relatives au serveur ou module serveur. IP Internet Protocol, protocole Internet. K KVM Keyboard, video, mouse, clavier-écran-souris. Fait référence à l’utilisation d’un commutateur permettant d’activer le partage d’un clavier, d’un écran et d’une souris à partir de plusieurs ordinateurs. L Lame Terme générique désignant les modules serveur et les modules de stockage. Voir Module serveur et Module de stockage. M MAC ou adresse MAC Adresse du contrôleur d’accès multimédia. Module de disque ou lame de disque Termes interchangeables désignant un module de stockage. Voir Module de stockage. Module de fixation des câbles Bras de gestion des câbles. Module de stockage Composant modulaire fournissant les modules serveur en espace de stockage informatique. Module serveur Composant modulaire fournissant les principales ressources de calcul (CPU et mémoire) d’un système modulaire. Les modules serveur peuvent également être équipés d’un système de stockage intégré et de connecteurs contenant des modules REM et FEM. MSGID Identificateur de message.112 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 N NEM Network Express Module. Les modules NEM fournissent des ports 10/100/1000 Ethernet et 10GbE Ethernet ainsi que des connexions SAS aux modules de stockage. NET MGT Network management port, port de gestion réseau. Port Ethernet figurant sur le SP du serveur, le SP du module serveur et le CMM. NIC Contrôleur ou carte d’interface réseau. NMI Interruption ne pouvant être masquée. O OBP OpenBoot PROM. Oracle ILOM Oracle Integrated Lights Out Manager. Le microprogramme Oracle ILOM est préinstallé sur divers systèmes Oracle. Oracle ILOM vous permet de gérer à distance vos serveurs Oracle indépendamment de l’état du système hôte. Oracle ILOM du CMM Oracle ILOM s’exécutant sur le module CMM. Voir Oracle ILOM. Oracle Solaris (SE) Système d’exploitation Oracle Solaris. P PCI Interconnexion de composants périphériques. PCI EM PCIe ExpressModule. Composant modulaire basé sur le facteur de forme PCI Express standard du secteur et offrant des fonctions d’E/S (Gigabit Ethernet et Fibre Channel, par exemple). POST Power-On Self-Test, autotest de l’allumage. PROM Mémoire morte programmable. PSH Autorétablissement prédictif.Glossaire 113 Q QSFP Quad Small Form-Factor Pluggable. R REM RAID Expansion Module, module d’extension RAID. Quelquefois appelé HBA Voir HBA. Prend en charge la création de volumes RAID sur des disques. S SAS Serial attached SCSI. SCC System Configuration Chip, puce de configuration système. SER MGT Serial Management Port, port de gestion série. Port série figurant sur le SP du serveur, le SP du module serveur et le CMM. Serveur lame Module serveur. Reportez-vous à la section Module serveur. SP Service Processor, processeur de service. Sur le serveur ou module serveur, le SP est une carte disposant de son propre SE. Le SP traite les commandes Oracle ILOM, offrant un contrôle de gestion à distance de l'hôte. Voir host. SSD Disque dur électronique. SSH Secure Shell, shell sécurisé. Système modulaire Châssis pouvant être monté en rack qui contient les modules serveur, les modules de stockage, les NEM et les EM PCI. Le système modulaire met Oracle ILOM à disposition via son CMM.114 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 U UCP Universal connector port, port de connecteur universel. IU Interface utilisateur. UTC Universal Time Coordinated, temps universel. UUID Universal unique identifier, identifiant universel unique. W WWN Numéro universel. Numéro unique permettant d’identifier une cible SAS.115 Index A A propos, 1 Accès à la console système, 10 Accès réseau, activation ou désactivation, 44 Activation, 72 Adresse MAC de l’hôte, affichage, 47 Affichage de la version, 77, 80, 81 Affichage des composants concernés, 74 Annulation de la configuration, 61 C Câbles, clavier et souris, 13 Chemins d’accès aux périphériques, 32 Clavier, connexion, 13 Commandes, 26 Communication système, 9 Comportement à l’expiration du délai d’initialisation, 59 Comportement en cas d’échec du redémarrage, 59 Comportement lorsque l’hôte cesse de fonctionner, 58 Comportement suite à la réinitialisation de l’hôte, 57 Configuration, 23, 62 Connexion, 9 Console système, connexion, 10 Contournement, 71 Contrôle, 17 Création de volumes, 27 D Date d’expiration, 56 Définition au redémarrage, 39 Définition de l’état d’alimentation de l’hôte au redémarrage, 39 Définition de l’intervalle du délai d’attente d’initialisation, 58 Définition du nombre maximum de tentatives de redémarrage, 60 Désactivation, 73 Détection à l’aide d’ILOM, 65 Détection à l’aide du POST, 67 DHCP, affichage de l’adresse IP du serveur, 45 Diagnostic, 64 E Effacement, 71 Exécution de diagnostics, 67 F FCode, utilitaire, 25 Fonctions spécifiques à la plate-forme, 2 FRU, modification des données, 35 G Gestion, 61, 63 Gestion de la configuration, 52 Gestion du délai de mise sous tension, 40 Gestion du script, 55 Gestion du système, 51 Gestion lors de la réinitialisation, 53 H Historique de la console, affichage, 68 I Identification du système, modification, 36 Interrupteur à clé, comportement de l’hôte, 41 Invite, 10, 13116 Guide d’administration des serveurs de la série SPARC T4 • Novembre 2011 L Localisation du serveur, 75 M Méthodes d’accès, 13 Microprogramme, mise à jour, 78 Mise hors tension, 18 Mise sous tension, 17 Moniteur graphique local, 13 Multiacheminement, logiciel, 5 N Nom d’utilisateur et mot de passe par défaut, 10 O ok, affichage de l’invite, 11 Options d’adresse réseau, 43 Oracle VM Server (LDoms), 52 Oracle VM Server pour SPARC, présentation, 4 P Présentation, 1, 51 Présentation de l’administration système, 1 Prise en charge, 23 R Réinitialisation à partir d’ILOM, 20 Réinitialisation à partir du SE, 19 Restauration au redémarrage, 38 S setting configuration variables, 14 SP, réinitialisation, 20 Stratégie d’initialisation parallèle, 40 SunVTS, 64 Serveur SPARC T3-1 Notes de produit N° de référence : E26248 Octobre 2011, révision AProduit recyclable Copyright © 2010, 2011, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065; USA. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065; USA. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Les autres noms mentionnés dans ce document peuvent correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire 1. Notes de produit du serveur SPARC T3-1 1 Logiciels préinstallés pour les configurations standard 2 Versions du SE Oracle Solaris prises en charge 2 Jusqu’à huit disques durs SSD peuvent maintenant être installés dans les serveurs SPARC T3-1 3 Règles de zonage des disques pour les backplanes à seize disques 4 Version minimale du microprogramme système pour la validité de la commande devalias dans les emplacements de disque supérieurs 5 Prise en charge des plates-formes SPARC par le pack de gestion du matériel Oracle 2.1.1 6 Gestion des zones de disque à l’aide de la commande zoningcli 6 Règles d’utilisation des emplacements d’E/S par certaines cartes 7 Shell de compatibilité ALOM CMT non pris en charge 9 Problèmes connus concernant le produit 9 Problèmes matériels 9 Message d’avertissement indiquant un DIMM non certifié Oracle (CR 7034912) 10 Echec de la liaison de ixgbe en raison de l’allocation DMA/Echec de la liaison de l’IOMMU avec plusieurs cartes (CR 6977073) 10 Non prise en charge des claviers type 6 Sun par les serveurs de la série SPARC T3 11iv Notes de produit du serveur SPARC T3-1 • Octobre 2011 Précautions à prendre lors de la déconnexion d’un câble de données SATA d’un connecteur de backplane 11 Précautions à prendre lors de la manipulation des cartes de connecteur 11 Absence d’un disque de volume RAID remplacé à chaud dans raidconfig et MegaRaid Manager (CR 7022806) 12 Dégradation des performances avec les cartes Sun Dual 10 GbE SFP+ PCIe TCP RX à 4 ports (cartes 8 voies en cuivre GigE à quatre ports PCI-E) sur les serveurs SPARC T3-1 (6943558) 12 Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) 13 Problèmes liés au système d’exploitation Oracle Solaris 14 Impossible de démarrer le SE Oracle Solaris 10 10/09 (U8) à partir du DVD interne 14 Blocage possible des opérations de suppression de DR lorsque plusieurs périphériques NIU sont plombés (6983286) 14 Erreur fault.memory.memlink-uc n’ayant pas causé de panique contrairement au texte du message système (6940599) 15 Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 ( 6995458) 15 Problèmes d’allocation de mémoire avec les HBA Emulex 8 Gbits installés dans un boîtier d’expansion d’E/S Magma (6982072) 16 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) 17 Message d’interruption parasite affiché sur la console système (CR 6963563) 17 Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) 18 Messages d’avertissement nxge erronés (CR 6938085) 18 Message d’erreur mineur : mptsas request inquiry page 0x89 for SATA target :a failed (6986482) 19 Problèmes liés au microprogramme 19Sommaire v Suppression des configurations RAID des deux contrôleurs en raison de la définition d’un contrôleur RAID sur son état par défaut (6999411) 19 e1000g : pilote générant des ereports parasites lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (6958011) 20 envtest : génération de rapports erronés sur les températures pour certains composants (6975427) 20 Système mis hors tension suite à l’exécution de la commande reset /HOST/domain/control avec des domaines invités actifs (6987371) 21 Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (6968801) 21 spconfig : erreurs de communication générées par des noms de plus de 36 caractères avec la commande ldm add/rm-config (6987310) 22 Verrouillage sans accès du processeur de service (6985738) 22 Impossible de lancer deux commandes probe-scsi-all consécutives sur des systèmes équipés de HBA Emulex PCI-Express FC de 8 Gbits (6983959) 22 SDIO : ereports liés aux cartes Sun Dual 10GbE SFP+ PCIe lors du redémarrage du domaine principal (6986960) 23 ereport.chassis.sp.unavailable non généré dans le cas d’un processeur de service endommagé (CR 6978171) 24 Numéro de référence erroné fourni à Oracle Solaris FMA (6978447) 25 Avertissement erroné généré par la commande OpenBoot setsecurity-key : Unable to store security key (6986849) 25 Clarification du message Sas2ircu indiquant que les tailles de volume RAID autres que MAX ne sont pas prises en charge (6983210) 25vi Notes de produit du serveur SPARC T3-1 • Octobre 20111 C H A P I T R E Notes de produit du serveur SPARC T3-1 Ces notes de produit contiennent des informations importantes de dernière minute concernant le serveur SPARC T3-1 d’Oracle. Ce document se compose des sections suivantes : ¦ « Logiciels préinstallés pour les configurations standard », page 2 ¦ « Versions du SE Oracle Solaris prises en charge », page 2 ¦ « Jusqu’à huit disques durs SSD peuvent maintenant être installés dans les serveurs SPARC T3-1 », page 3 ¦ « Règles de zonage des disques pour les backplanes à seize disques », page 4 ¦ « Version minimale du microprogramme système pour la validité de la commande devalias dans les emplacements de disque supérieurs », page 5 ¦ « Prise en charge des plates-formes SPARC par le pack de gestion du matériel Oracle 2.1.1 », page 6 ¦ « Règles d’utilisation des emplacements d’E/S par certaines cartes », page 7 ¦ « Shell de compatibilité ALOM CMT non pris en charge », page 9 ¦ « Problèmes connus concernant le produit », page 92 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Logiciels préinstallés pour les configurations standard Le tableau suivant dresse la liste des logiciels préinstallés sur le serveur. Les patchs requis au moment où le serveur était prêt à être expédié ont été installés en usine. Pour des informations récentes sur tous les patchs, y compris ceux destinés aux logiciels préinstallés, rendez-vous sur le site Web My Oracle Support : (http://support.oracle.com/) Remarque – Le SE Oracle Solaris est préinstallé sur un système de fichiers ZFS. Versions du SE Oracle Solaris prises en charge Une copie du SE Oracle Solaris 10 9/10 est préinstallée sur le premier disque du serveur. Le SE est prêt à être configuré lorsque le serveur est mis sous tension pour la première fois. Cette version du serveur prend en charge les versions suivantes du SE Oracle Solaris : ¦ SE Oracle Solaris 10 9/10 (préinstallé sur le serveur) ¦ SE Oracle Solaris 10 10/09 avec le bundle de patchs Oracle Solaris 10 9/10 ou les bundles compatibles avec les futures versions Logiciel Emplacement Fonction SE Oracle Solaris 10 9/10 Tranche 0 du disque root (et tranche 3 pour un ABE). Système d’exploitation Oracle VM Server pour SPARC 2.0 /opt/SUNWldm Gestion des domaines logiques Electronic Prognostics 1.1 /opt/ep Génération d’avertissements précoces concernant des pannes de FRU potentiellesChapitre Notes de produit du serveur SPARC T3-1 3 Jusqu’à huit disques durs SSD peuvent maintenant être installés dans les serveurs SPARC T3-1 Les disques durs SSD (Solid State Drive) qui ont été qualifiés par Oracle peuvent maintenant être utilisés dans les serveurs SPARC T3-1 configurés avec des backplanes à huit ou seize disques. Auparavant, seuls les backplanes à huit disques du serveur SPARC T3-1 prenaient en charge les disques durs SSD. Ce qui suit est une synthèse des règles régissant le déploiement des disques durs SSD dans un serveur SPARC T3-1 : ¦ Un maximum de huit disques durs SSD peut être installé sur un serveur, quel que soit le type de backplane. ¦ L’installation des disques durs SSD et des disques durs traditionnels basés sur disque peut suivre n’importe quelle combinaison numérique, tant que le nombre de disques durs SSD ne dépasse pas 8. ¦ Les disques durs traditionnels basés sur disque et SSD peuvent être répartis sur les emplacements de disque en suivant n’importe quelle configuration. ¦ Les volumes RAID ne peuvent pas être configurés à la fois avec des disques durs SSD et des disques durs basés sur disque. L’une ou l’autre de ces technologies de stockage peut être utilisée dans une matrice RAID, mais l’utilisation des deux dans un volume unique compromet l’intégrité des données. ¦ Dans les serveurs équipés de backplanes à seize disques utilisant les contrôleurs SAS-2 embarqués, le backplane doit être partitionné en deux zones de huit disques. Pour plus d’informations sur le zonage des disques, reportez-vous aux sections « Règles de zonage des disques pour les backplanes à seize disques », page 4 et « Gestion des zones de disque à l’aide de la commande zoningcli », page 6. ¦ Dans les serveurs équipés de backplanes à seize disques utilisant un HBA RAID PCIe interne au lieu de contrôleurs SAS-2 embarqués, le zonage des disques doit être désactivé. Dans ce cas, tous les disques du backplane sont considérés comme un pool de périphériques de stockage par le HBA. Reportez-vous à la section « Gestion des zones de disque à l’aide de la commande zoningcli », page 6.4 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Règles de zonage des disques pour les backplanes à seize disques Si votre serveur SPARC T3-1 dispose d’un backplane à seize disques et utilise les contrôleurs SAS-2 embarqués pour gérer les disques, vous devez appliquer le patch 147034-01 au microprogramme LSI sur le backplane de disques. Attention – Veillez à sauvegarder toutes les données stockées sur les disques avant d’appliquer le patch. Vous pouvez restaurer les fichiers après l’application du patch. Le patch 147034-01 entraîne la partition du backplane en deux zones de disque, qui ont les caractéristiques suivantes : ¦ La zone A se compose d’emplacements de backplane numérotés de 0 à 7. Les disques de la zone A sont gérés exclusivement par le contrôleur SAS-2 embarqué 0. Ils sont visibles uniquement entre eux et pour le contrôleur 0. Les disques de la zone A ne sont pas visibles pour les périphériques de la zone B. ¦ La zone B se compose d’emplacements de backplane numérotés de 8 à 15. Les disques de la zone B sont gérés exclusivement par le contrôleur SAS-2 embarqué 1. Ils sont visibles uniquement entre eux et pour le contrôleur 1. Les disques de la zone B ne sont pas visibles pour les périphériques de la zone A. Remarque – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour vers 8.0.5.b (ou vers une version supérieure à 8.0) ou vers 8.1.0 (ou version ultérieure). Pour plus d’informations, reportez-vous à la section « Version minimale du microprogramme système pour la validité de la commande devalias dans les emplacements de disque supérieurs », page 5. Ces définitions de zone de disques sont persistantes. Leur configuration ne peut pas être modifiée et elles restent en vigueur au fur et à mesure des opérations de mise sous tension et de redémarrage. Elles doivent être actives chaque fois que les contrôleurs SAS-2 embarqués sont utilisés pour gérer les disques dans un backplane à seize disques. Toutefois, si vous utilisez un HBA RAID PCIe interne au lieu des contrôleurs SAS-2 embarqués, vous devez désactiver le zonage de disque. Pour ce faire, utilisez la commande suivante : # zoningcli disable zoningChapitre Notes de produit du serveur SPARC T3-1 5 La commande zoningcli est contenue dans la version 2.1.1 du pack de gestion du matériel Oracle. Pour plus d’informations, reportez-vous à la section « Prise en charge des plates-formes SPARC par le pack de gestion du matériel Oracle 2.1.1 », page 6. La syntaxe de la commande zoningcli prend également en charge une souscommande enable, que vous pouvez utiliser pour réactiver les zones de disque A et B si elles sont désactivées. Par exemple, cette étape n’est pas nécessaire si vous supprimez une carte HBA RAID PCIe et renvoyez le contrôle des disques aux contrôleurs SAS-2 embarqués. Les zones étant isolées l’une de l’autre de manière logique, les volumes RAID créés par le contrôleur 0 sont restreints aux disques de la zone A. De la même manière, les volumes RAID créés par le contrôleur 1 sont restreints aux disques de la zone B. Chaque contrôleur SAS-2 embarqué peut créer jusqu’à deux volumes RAID matériels. Ainsi, le nombre maximal de volumes RAID par zone de disque est de deux. Version minimale du microprogramme système pour la validité de la commande devalias dans les emplacements de disque supérieurs Pour que la commande devalias soit valide pour les emplacements de disque 8 à 15, la version du microprogramme système doit être 8.0.5.b (ou supérieure à 8.0) ou alors 8.1.0.c (ou version supérieure). Si le microprogramme système de votre serveur ne correspond pas à la configuration requise, il vous faut utiliser le chemin d’accès complet au disque afin d’identifier les disques individuels dans la plage 8-15. Par exemple, si la version minimale du microprogramme système est exécutée avec la commande devalias correcte, vous pouvez utiliser la ligne de commande suivante pour démarrer à partir du disque à l’emplacement 12 : # boot disk126 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Si l’emplacement de disque se trouve dans la plage 8-15 et que la version du microprogramme système ne correspond pas à la configuration requise décrite ci-dessus, vous devez indiquer le chemin complet d’accès au périphérique pour le disque d’initialisation. Cet exemple montre le chemin d’accès pour le disque 12 : Prise en charge des plates-formes SPARC par le pack de gestion du matériel Oracle 2.1.1 La version 2.1.1 du pack de gestion du matériel Oracle étend la prise en charge du pack de gestion du matériel aux serveurs SPARC. Le pack de gestion du matériel Oracle est un mécanisme de distribution pour les outils et agents natifs Oracle Solaris utilisés pour configurer et gérer le matériel de serveur. Remarque – La version 2.1.1 est la première version du pack de gestion du matériel Oracle à prendre en charge les serveurs de la série SPARC T3. Pour utiliser les commandes de gestion du matériel Oracle 2.1.1, téléchargez et installez la dernière version du pack de gestion du matériel depuis My Oracle Support : http://support.oracle.com/CSP/ui/flash.html Cliquez sur le lien suivant pour accéder au guide d’installation du pack de gestion du matériel Oracle 2.1. http://download.oracle.com/docs/cd/E19960_01/index.html Gestion des zones de disque à l’aide de la commande zoningcli La version 2.1.1du pack de gestion du matériel Oracle comprend l’outil ZoningCLI, qui est nécessaire pour l’activation des zones de disque dans les serveurs SPARC T3- 1 qui utilisent les contrôleurs SAS-2 embarqués pour gérer les disques dans les backplanes à seize disques. Cet outil est également utilisé pour désactiver les zones de disque lorsqu’un HBA RAID PCIe interne est utilisé à la place des contrôleurs SAS-2 embarqués. # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10cChapitre Notes de produit du serveur SPARC T3-1 7 Remarque – Reportez-vous à la section « Règles de zonage des disques pour les backplanes à seize disques », page 4. L’outil ZoningCLI présente la syntaxe suivante : Les sous-commandes suivantes sont prises en charge par la commande zoningcli : Les options suivantes peuvent être utilisées avec la commande zoningcli : Règles d’utilisation des emplacements d’E/S par certaines cartes Certaines cartes d’E/S optionnelles sont limitées à des emplacements d’E/S particuliers afin de répondre aux conditions de refroidissement système requises. D’autres cartes d’E/S offrent de meilleures performances lorsqu’elles sont installées à des emplacements spécifiques. Le diagramme suivant permet d’identifier les conditions requises et les recommandations relatives aux emplacements. zoningcli subcommand options Commande Fonction enable Active le zonage disable Désactive le zonage list Affiche les informations sur le zonage Option courte Option longue Description -? --help Aide--Affiche les informations de l’aide -V --version Version--Affiche la version de l’outil8 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Remarque – Ce tableau dresse la liste des cartes d’E/S possédant des limitations ou d’autres exigences en matière d’emplacement ou de quantité. TABLEAU 1-1 Règles d’utilisation des emplacements PCIe concernant certaines cartes HBA Carte d’E/S N° de référence Emplacements d’E/S pris en charge Nb. maximum de cartes HBA PCIe SAS 8 ports, 6 Gbit/s, externe SGX-SAS6-EXT-Z (option X) SG-SAS6-EXT-Z (ATO) 3, 4, 5 Limite = 3 Sun Dual 10GbE SFP+ PCIe X1109A-Z (option X) 1109A-Z (ATO) Tous Limit e = 4 HBA RAID SAS 2.0, PCIe LP à 8 ports SGX-SAS6-R-INT-Z (option X) 3 Limite = 1 Carte 8 voies PCI-E à quatre ports GigE (en cuivre) X4447A-Z-N (option X) 4447A-Z-N (ATO) Tous Limit e = 5 Accélérateur Flash de disque dur électronique 96 Go XTA-FAS-S3IE96GB-N (option X) TA-FAS-S3IE96GB-N (ATO) 0, 2, 3, 5 Limite = 4 HBA Qlogic PCI-Express FC 8 Gbits * Tous Limit e = 6 Un seul port SG-XPCIE1FC-QF8-N (option X) SG-PCIE1FC-QF8-Z (ATO) Deux ports SG-XPCIE2FC-QF8-N (option X) SG-PCIE2FC-QF8-Z (ATO) HBA Emulex PCI-Express FC 8 Gbits † Tous Limit e = 6 Un seul port SG-XPCIE1FC-EM8-N (option X) SG-PCIE1FC-EM8-Z (ATO) Deux ports SG-XPCIE2FC-EM8-N (option X) SG-PCIE2FC-EM8-Z (ATO) FCoE 10 Gbits/s à courte portée CNA Qlogic SG-XPCIEFCOE2-QSR (option X) SG-PCIEFCOE2-QSR (ATO) Tous Limit e = 3 HCA InfiniBand à quadruple vitesse de transfert de données X4242A (option X) 4242A (ATO) Tous Limit e = 2 XAUI à un port 10 GigE Fiber SESX7XA1Z-N (option X) SESY7XA1Z-N (ATO) 0, 3 Limite = 2 Sun Crypto Accelerator 6000 X6000A-N (option X) 6000A-N (ATO) Tous Limit e = 2Chapitre Notes de produit du serveur SPARC T3-1 9 Shell de compatibilité ALOM CMT non pris en charge Le serveur SPARC T3-1 ne prend pas en charge le shell de compatibilité de ligne de commande ALOM (Advanced Lights Out Manager) CMT (cli_mode=alom), disponible sur les plates-formes antérieures. Pour plus d’informations sur les fonctions Oracle ILOM (Integrated Lights Out Manager) prises en charge, reportezvous au Guide d’administration des serveurs de la série SPARC T3. Problèmes connus concernant le produit Cette section décrit des problèmes connus pour affecter les serveurs SPARC T3-1 d’Oracle au moment de la parution de cette version. Les problèmes sont décrits de la manière suivante : ¦ « Problèmes matériels », page 9 ¦ « Problèmes liés au système d’exploitation Oracle Solaris », page 14 ¦ « Problèmes liés au microprogramme », page 19 Problèmes matériels Cette section décrit des problèmes liés aux composants du serveur SPARC T3-1. * La table de préchargement PCI installée sur votre carte HBA QLogic PCI-Express à 8 Gbits doit être au minimum la version 2.5.2. Pour vérifier le numéro de version, consultez le numéro de référence de la carte. Les cartes à un port dotées du n° de référence 375-4324- 02 et les cartes à deux ports possédant le n° de référence 375-4325-02 intègrent déjà cette version de la table de préchargement. Pour mettre à jour la table de préchargement vers la version 2.5.2 sur une carte dotée du n° de référence 375-4324-01 ou 375-4325-01, suivez les instructions disponibles à l’adresse : (http://driverdownloads.qlogic.com/QLogicDriverDownloads_UI/SunOEM.aspx?oemid= 124). † Le mode SDIO n’est pas pris en charge pour l’instant par la carte HBA Emulex PCI-Express FC 8 Gbits. 10 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Message d’avertissement indiquant un DIMM non certifié Oracle (CR 7034912) Après l’installation des composants facultatifs DIMM pris en charge obtenus auprès d’Oracle Corporation ou d’un revendeur Oracle agréé, ou après le remplacement d’un DIMM défaillant par une unité DIMM remplaçable sur site (FRU), des messages d’avertissement similaires à l’exemple suivant peuvent s’afficher : Le système affiche ces messages car les DIMM facultatifs et FRU n’ont pas été marqués comme étant certifiés. Oracle certifie uniquement les DIMM installés dans un système en usine. Bien qu’Oracle ne certifie pas ces DIMM, ils sont tout de même pris en charge. Vous pouvez ignorer ces messages d’avertissement en toute sécurité. Echec de la liaison de ixgbe en raison de l’allocation DMA/Echec de la liaison de l’IOMMU avec plusieurs cartes (CR 6977073) Lorsque deux ou davantage de cartes 10 GbE SFP+ PCIe 2.0 LP à double accès Sun (avec contrôleur Intel 82599 10G bE) sont présentes sur un serveur SPARC T3-1 exécutant le système d’exploitation Solaris 10 9/10 (mise à jour 9), certains ports de ces cartes peuvent ne pas fonctionner correctement. Solution : pour les serveurs disposant de deux ou trois cartes 10 GbE à double accès Sun, ajoutez les paramètres suivants au fichier /kernel/drv/ixgbe.conf : Pour les serveurs disposant de plus de trois cartes 10 GbE à double accès Sun, ajoutez les paramètres suivants au fichier /kernel/drv/ixgbe.conf : Une fois le fichier ixgbe.conf modifié, redémarrez le système. [CPU 0:0:0] WARNING: /SYS/MB/CMP0/BOB0/CH0/D0: Not Oracle Certified rx_ring_size = 512; tx_ring_size = 512; rx_queue_number = 4; tx_queue_number = 4; rx_ring_size = 512; tx_ring_size = 512;Chapitre Notes de produit du serveur SPARC T3-1 11 Non prise en charge des claviers type 6 Sun par les serveurs de la série SPARC T3 Les claviers type 6 Sun ne peuvent pas être utilisés avec les serveurs de la série SPARC T3. Précautions à prendre lors de la déconnexion d’un câble de données SATA d’un connecteur de backplane Lorsque vous déconnectez un câble de données SATA du backplane de disque, tirez sur le câble dans une direction perpendiculaire par rapport au backplane. Attention – Ne secouez ou ne tordez pas le câble dans une autre direction. Vous risqueriez d’endommager l’intégrité de la connexion du câble de données. Précautions à prendre lors de la manipulation des cartes de connecteur Manipulez les cartes de connecteur avec précaution afin d’éviter d’exercer avec la main une pression sur l’extrémité pointue de la tige de guidage située sous le support de montage. La tige de guidage est indiquée par une flèche dans l’illustration suivante.12 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Absence d’un disque de volume RAID remplacé à chaud dans raidconfig et MegaRaid Manager (CR 7022806) Lorsqu’un disque qui fait partie d’un volume RAID 1 (miroir) est remplacé à chaud, il n’est pas répertorié dans la sortie de raidconfig ou MegaRaid Manager (MSM). Par conséquent, l’intégrité du volume reste inconnue jusqu’au redémarrage du système. La commande de liste SAS2ircu ne fonctionne pas correctement non plus. Au lieu de répertorier les informations sur le contrôleur, elle renvoie l’erreur suivante. Dégradation des performances avec les cartes Sun Dual 10 GbE SFP+ PCIe TCP RX à 4 ports (cartes 8 voies en cuivre GigE à quatre ports PCI-E) sur les serveurs SPARC T3-1 (6943558) Une perte de paquets excessive peut se produire lorsque trois ports ou plus sont utilisés par plusieurs cartes Sun Dual 10GbE SFP+ PCIe installées sur un serveur SPARC T3-1. Les performances d’émission et de réception risquent d’être considérablement diminuées. Lorsque deux ports seulement sont utilisés, la perte de paquets est minime et les performances d’émission et de réception sont conformes aux attentes. Solution : utilisez l’une des procédures suivantes pour activer le contrôle de flux sur les interfaces. Vous pourrez ainsi considérablement réduire la perte de paquets observée et augmenter les performances. # /opt/sas2ircu list LSI Corporation SAS2 IR Configuration Utility. Version 4.250.04.02 (2010.02.19) Copyright (c) 2009 LSI Corporation. All rights reserved. SAS2IRCU: MPTLib2 Error 1Chapitre Notes de produit du serveur SPARC T3-1 13 Activation du contrôle de flux (avec redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf : 2. Redémarrez le système afin d’appliquer ces modifications. Activation du contrôle de flux (sans redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf : 2. Déplombez toutes les interfaces ixgbe. 3. Emettez la commande update_drv ixgbe. 4. Plombez à nouveau toutes les interfaces ixgbe. Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) Lorsque vous tentez de démarrer à partir d’une clé USB insérée dans l’un des ports USB avant (USB2 ou USB3), le serveur peut paniquer. Solution : utilisez les ports USB arrière du serveur (USB0 ou USB1) pour démarrer depuis un périphérique USB externe. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;14 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Problèmes liés au système d’exploitation Oracle Solaris Cette section décrit les problèmes liés au SE Oracle Solaris observés dans cette version. Impossible de démarrer le SE Oracle Solaris 10 10/09 (U8) à partir du DVD interne Vous ne pouvez pas démarrer le système d’exploitation Oracle Solaris U8 partir du DVD interne. Remarque – Cette limitation ne s’applique pas aux mises à jour ultérieures d’Oracle Solaris 10. Solution : vous pouvez utiliser un CD-Rom/DVD distant (espace de stockage de rKVMS) pour initialiser le média DVD ou l’image ISO. Une unité DVD USB externe permet également d’initialiser le média. Blocage possible des opérations de suppression de DR lorsque plusieurs périphériques NIU sont plombés (6983286) Le plombage de plusieurs périphériques NIU dans un domaine crée une condition dans le noyau Oracle Solaris qui peut entraîner le blocage d’une opération de reconfiguration dynamique (DR) lors du retrait de mémoire du domaine. Solution : si vous envisagez d’effectuer des opérations de retrait de mémoire DR, ne plombez pas plus d’un périphérique NIU. Méthode de récupération : en cas de blocage d’une opération de DR, réinitialisez le domaine afin de résoudre le problème.Chapitre Notes de produit du serveur SPARC T3-1 15 Erreur fault.memory.memlink-uc n’ayant pas causé de panique contrairement au texte du message système (6940599) Lorsqu’une erreur d’interconnexion de type fault.memory.memlink-uc est détectée, le système devrait s’arrêter afin de protéger l’intégrité de la mémoire. De manière intermittente, cette panne a été signalée lors d’opérations d’initialisation sans que le système ne s’arrête. Même s’il est possible que ce comportement irrégulier indique la récupération effective du système suite à l’erreur de liaison de mémoire, et la restauration d’un état d’initialisation normal, la mesure la plus sûre à prendre consiste à effectuer une séquence de mise hors/sous tension. Récupération : procédez à une mise sous tension CA progressive du système. Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 ( 6995458) Le processus d’installation du package Oracle S10U8 présente un bogue qui empêche l’insertion de la définition d’alias nxge conçue pour les serveurs SPARC T3 dans /etc/driver_aliases. Si cet alias n’est pas correctement défini, il est impossible de connecter nxge. Méthode de récupération : pour remédier à ce problème, suivez les étapes décrites ci-dessous. Remarque – Connectez-vous en tant qu’utilisateurroot afin de pouvoir modifier le fichier driver_aliases. 1. Ajoutez l’entrée suivante à /etc/driver_aliases : 2. Redémarrez le système. 3. Configurez les interfaces réseau. nxge "SUNW,niusl-kt"16 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Problèmes d’allocation de mémoire avec les HBA Emulex 8 Gbits installés dans un boîtier d’expansion d’E/S Magma (6982072) Des erreurs d’allocation de mémoire peuvent se produire lorsque quatre cartes HBA Emulex PCI-Express FC 8 Gbits ou plus sont utilisées dans un boîtier d’expansion d’E/S Magma connecté à un serveur Oracle SPARC T3. L’exemple ci-dessous illustre l’un des types de messages pouvant être consignés dans le répertoire /var/adm/messages avec la configuration suivante : Solution : limitez à trois au maximum le nombre de cartes HBA Emulex PCI-Express FC 8 Gbits dans un boîtier d’expansion d’E/S Magma. date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs22: ERROR: 301: Memory alloc failed. (BPL Pool buffer[1760]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs20: ERROR: 301: Memory alloc failed. (BPL Pool buffer[2765]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [ 8.019A]emlxs24: ERROR: 301: Memory alloc failed. (BPL Pool buffer[3437]. size=1024) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs22: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs22: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs22: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs20: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs20: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.) date time hostname emlxs: [ID 349649 kern.info] [13.0363]emlxs24: ERROR: 201: Adapter initialization failed. (Unable to allocate memory buffers.) date time hostname emlxs: [ID 349649 kern.info] [ 5.064D]emlxs24: ERROR: 201: Adapter initialization failed. (status=c) date time hostname emlxs: [ID 349649 kern.info] [ B.1949]emlxs24: ERROR: 101: Driver attach failed. (Unable to initialize adapter.)Chapitre Notes de produit du serveur SPARC T3-1 17 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) Le système miniroot est un système de fichiers root initialisable comprenant la version minimale du SE Oracle Solaris requise pour démarrer le serveur et configurer le système d’exploitation. Le système miniroot s’exécute uniquement lors du processus d’installation. Lorsque le serveur démarre le système miniroot pour la configuration initiale, les messages suivants peuvent s’afficher sur la console système : Le messages indique que le serveur Xsun sous le système miniroot Oracle Solaris ne parvient pas à détecter un pilote pris en charge par le périphérique graphique AST dans le processeur de service. Ces messages sont légitimes, car le système miniroot contient uniquement l’environnement Xsun alors que le tampon de mémoire AST (astfb) est uniquement pris en charge par l’environnement Xorg. L’environnement Xorg est inclus dans le système installé. Par conséquent, le périphérique graphique peut être utilisé lors de l’exécution du SE Oracle Solaris installé. Solution : Vous pouvez ignorer ce message en toute sécurité. Message d’interruption parasite affiché sur la console système (CR 6963563) Au cours du fonctionnement normal du serveur et lors de l’exécution du programme de test système SunVTS, la console système peut afficher le message suivant : Solution : Vous pouvez ignorer ce message en toute sécurité. Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error. date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info]18 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Echec de la mise à jour de la mémoire EEPROM pour le redémarrage automatique par le SE Oracle Solaris lorsque diag-switch? est défini sur true (CR 6982060) Dans le cadre de l’installation du SE Oracle Solaris sur un périphérique, si le paramètre OBP diag-switch? est défini sur true, le programme d’installation d’Oracle Solaris ne parvient pas à mettre à jour le paramètre bootdevice pour refléter le nouveau chemin d’accès au périphérique sur lequel le SE a été installé. Par conséquent, ce chemin ne pourra pas être utilisé lors des redémarrages système automatiques suivants. Dans ces conditions, vous ne pouvez plus redémarrer à partir du périphérique et le serveur affiche le message d’erreur suivant : Sur les systèmes précédents, le paramètre OBP diag-device définissait le nouveau chemin d’accès au périphérique d’initialisation lorsque le paramètre diag-switch? était défini sur true. Sur les systèmes SPARC T3, le paramètre diag-device n’est plus pris en charge et le programme d’installation du SE Oracle Solaris génère un avertissement concernant le paramètre OBP boot-device. Solution : à partir de l’invite d’ILOM, définissez le paramètre OBP diag-switch? sur false : Autre solution : définissez ce paramètre à partir de l’invite ok d’OBP : Messages d’avertissement nxge erronés (CR 6938085) Au cours du fonctionnement normal de votre serveur, des messages d’avertissement tels que le suivant peuvent s’afficher sur la console système : Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebooting -> set /HOST/bootmode script="setenv diag-switch? false" ok setenv diag-switch? false date time hostname nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.0Chapitre Notes de produit du serveur SPARC T3-1 19 Ces messages ne sont pas de véritables messages d’avertissement. Ces messages relatifs au pilote Gigabit Ethernet (nxge) affichent le numéro de version de l’hyperviseur, car le pilote est compatible avec plusieurs versions de l’hyperviseur. Ces messages devraient être désignés comme messages INFORMATIONNELS ou AVIS plutôt que sous forme d’AVERTISSEMENTS. Solution : vous pouvez ignorer ces messages en toute sécurité. Message d’erreur mineur : mptsas request inquiry page 0x89 for SATA target :a failed (6986482) Vous pouvez voir l’un des messages d’erreur suivants ou les deux dans /var/adm/messages lorsque le système est redémarré. Solution : vous pouvez ignorer ces messages en toute sécurité. Problèmes liés au microprogramme Cette section décrit des problèmes relatifs au microprogramme système. Suppression des configurations RAID des deux contrôleurs en raison de la définition d’un contrôleur RAID sur son état par défaut (6999411) Lorsque les données de configuration RAID sont supprimées d’un contrôleur SAS et que le système est redémarré, toutes les données de configuration RAID sont perdues pour les deux contrôleurs. mptsas request inquiry page 0x89 for SATA target:a failed! mptsas request inquiry page 0x83 for target:a, lun:0 failed!20 Notes de produit du serveur SPARC T3-1 • Octobre 2011 e1000g : pilote générant des ereports parasites lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (6958011) Lors de l’installation du SE Oracle Solaris sur des domaines contrôlés au moyen d’adaptateurs Sun PCIe Dual Gigabit Ethernet (UTP ou MMF), le pilote Gigabit Ethernet e1000g peut générer des rapports de fausses erreurs sur les domaines SDIO (Static Direct Input/Output) et principaux. L’exemple suivant illustre ce type de rapport parasite : Solution : vous pouvez ignorer ces ereports en toute sécurité. envtest : génération de rapports erronés sur les températures pour certains composants (6975427) Lorsque vous exécutez la commande envtest -v à partir du shell limité, la section de vérification de l’état des températures système indique que les sondes suivantes présentent des relevés de température extrêmement bas : Les valeurs indiquées ne reflètent pas les températures réelles. Ce sont des valeurs discrètes présentées comme des températures. Solution : aucune. date time ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 ena = 0x298a9f62243802 detector = (embedded nvlist) nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600 source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a0 /SYS/MB/DVRM_CMP0/TEMP_FAULT Status: OK Temp: 1 (Celsius) /SYS/MB/DVRM_M0/TEMP_FAULT Status: OK Temp: 1 (Celsius) /SYS/MB/DVRM_M1/TEMP_FAULT Status: OK Temp: 1 (Celsius)Chapitre Notes de produit du serveur SPARC T3-1 21 Système mis hors tension suite à l’exécution de la commande reset /HOST/domain/control avec des domaines invités actifs (6987371) Si vous exécutez la commande permettant de réinitialiser le composant /HOST/domain/control en présence de domaines invités actifs, /SYS sera mis hors tension brutalement. Le système risque alors de se trouver dans un état instable. Remarque – En l’absence de domaines logiques actifs, la réinitialisation de /HOST/domain/control entraînera celle du domaine de contrôle de manière ordonnée. Solution : pour réinitialiser le domaine de contrôle en présence de domaines invités actifs, procédez à partir du domaine de contrôle lui-même. N’utilisez pas la commande de réinitialisation à distance reset /HOST/domain/console du processeur de service. Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (6968801) Lors de l’exécution de SunVTS sur des plates-formes de la série T3, il est possible (quoi que rare) qu’un test SunVTS se bloque. Si cela arrive, d’autres processus et commandes peuvent également se bloquer, notamment fmadm et prtconf. Il est impossible de terminer les processus bloqués. Solution : redémarrez le système. Si le problème se répète, contactez votre fournisseur de services agréé. Evitez d’exécuter SunVTS dans des environnements de production. -> reset /HOST/domain/control22 Notes de produit du serveur SPARC T3-1 • Octobre 2011 spconfig : erreurs de communication générées par des noms de plus de 36 caractères avec la commande ldm add/rm-config (6987310) Lorsque vous enregistrez des configurations OVM pour serveurs SPARC (LDom) sur le processeur de service, si le nom d’une configuration dépasse 36 caractères, l’erreur suivante sera générée. Après une telle erreur, le processeur de service doit être réinitialisé. Remarque – L’espace alloué au nom d’une configuration par la commande ldm add-spconfig est de 32 caractères. Cependant, l’erreur n’est pas détectée sauf si le nom comprend 37 caractères ou plus. Si le nom d’une configuration comprend de 33 à 36 caractères, il est simplement tronqué. Solution : limitez le nombre de caractères des noms de configurations à 32 au maximum. Verrouillage sans accès du processeur de service (6985738) Bien que hautement improbable, suite à l’ajout et à la suppression répétées de configurations par Oracle VM Server pour SPARC, le processeur de service peut ne plus répondre. Lorsqu’il se trouve dans cet état, il est inaccessible tant que le système n’est pas mis hors puis sous tension CA. Méthode récupération : procédez à une mise sous tension CA progressive du système. Impossible de lancer deux commandes probe-scsiall consécutives sur des systèmes équipés de HBA Emulex PCI-Express FC de 8 Gbits (6983959) Sur les systèmes équipés de HBA Emulex PCI-Express FC 8 Gbits, vous ne pouvez pas exécuter la commande probe-scsi-all plus d’une fois sans lancer une réinitialisation OBP entre les exécutions. # ldm add-spconfig primary_8cpus_0mau_4G_vsw0_vsw4_vds0_ Error: Operation failed because of an error communicating with the system controllerChapitre Notes de produit du serveur SPARC T3-1 23 La première exécution de la commande probe-scsi-all se déroule normalement. Si la commande est émise une seconde fois avant une réinitialisation d’OBP, la deuxième session échoue, générant un message d’erreur similaire à l’exemple suivant : Solution : lancez toujours une réinitialisation OBP entre deux sessions probe-scsiall. SDIO : ereports liés aux cartes Sun Dual 10GbE SFP+ PCIe lors du redémarrage du domaine principal (6986960) Lors du redémarrage du domaine principal dans une configuration SDIO, il se peut qu’un ensemble de rapports électroniques (ereports) soit consigné pour la ou les cartes Sun Dual 10GbE I2 SFP+ PCIe assignées à ce domaine. Ce comportement a été observé dans le cas d’une configuration SDIO qui appliquait la stratégie de panne maître/esclave "stop" à tous les domaines SDIO. Méthode de récupération : exécutez la commande fmadm pour effacer les ereports et les éventuelles pannes associées. FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00ab4403c SASAddress 5000cca00ab4403d PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00ab2551c SASAddress 5000cca00ab2551d PhyNum 1 [...] /pci@600/pci@2/pci@0/pci@5/pci@0/pci@3/SUNW,emlxs@0,1 Cannot Init Link. /pci@600/pci@2/pci@0/pci@5/pci@0/pci@3/SUNW,emlxs@0 Cannot Init Link. [...] Cannot initialize port. READ_LA Failed.24 Notes de produit du serveur SPARC T3-1 • Octobre 2011 ereport.chassis.sp.unavailable non généré dans le cas d’un processeur de service endommagé (CR 6978171) Lorsque le processeur de service se trouve dans un état endommagé, il génère l’erreur ereport : ereport.fm.fmd.module L’exemple suivant illustre le contenu détaillé de cet ereport : Un processeur de service endommagé devrait également générer l’ereport suivant, mais ce n’est pas le cas : ereport.chassis.sp.unavailable # fmdump -eV date time ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = sun4v server-id = hostname (end authority) mod-name = etm mod-version = 1.2 (end detector) ena = 0x2653413e3403001 msg = error: bad conn open during ver negot: errno 5 __ttl = 0x1 __tod = 0x4c6bd664 0x35f96563Chapitre Notes de produit du serveur SPARC T3-1 25 Numéro de référence erroné fourni à Oracle Solaris FMA (6978447) Le numéro de référence signalé par la commande fmadm faulty d’Oracle Solaris pour une FRU défectueuse peut s’avérer différent de celui indiqué par les commandes fmadm faulty et show faulty d’Oracle ILOM pour la même FRU. Remarque – Cette divergence ne se produit pas dans le cas des modules DIMM. Solution : lorsque la commande fmadm faulty d’Oracle Solaris signale une FRU défectueuse (autre qu’un module DIMM), exécutez soit fmadm faulty soit show faulty à partir d’Oracle ILOM afin d’identifier le numéro de référence correct de cette FRU. Avertissement erroné généré par la commande OpenBoot set-security-key : Unable to store security key (6986849) OpenBoot signale un avertissement erroné selon lequel la commande setsecurity-key n’enregistre pas les clés de sécurité sur le processeur de service. Il s’agit d’un avertissement erroné : Solution : les clés de sécurité sont en réalité stockées sur le processeur de service. Vous pouvez donc ignorer ce message. Clarification du message Sas2ircu indiquant que les tailles de volume RAID autres que MAX ne sont pas prises en charge (6983210) Si vous tentez de créer un volume RAID d’une taille inférieure à la taille MAX, la série de messages suivante s’affiche : WARNING: Unable to store security key. No space left, check SP and other logs You are about to create an IR volume. WARNING: Proceeding with this operation may cause data loss or data corruption. Are you sure you want to proceed (YES/NO)? yes WARNING: Volume created with size other than ’MAX’ is not supported.26 Notes de produit du serveur SPARC T3-1 • Octobre 2011 Il est vrai que les volumes RAID dont la taille est inférieure à la taille MAX ne sont pas pris en charge. Toutefois, si vous souhaitez créer un volume d’une taille inférieure à la taille MAX pour une utilisation autre qu’en production, le logiciel vous permet de le faire. Le message n’est pas clair sur ce point. Solution : ignorez les messages et répondez Oui à la question demandant si vous souhaitez continuer la création du volume. Do you want to continue with volume creation (YES/NO)? n SAS2IRCU: you must answer "YES" or "yes" to proceed; operation aborted! SAS2IRCU: Error executing command CREATE. 1 Ce guide décrit les étapes minimales à effectuer pour mettre sous tension et initialiser pour la première fois votre serveur Oracle SPARC T3-1 à l’aide du système d’exploitation Oracle Solaris (SE Oracle Solaris). FIGURE 1 Serveur SPARC T3-1 Contenu de la livraison Avant de commencer Prenez connaissance des informations suivantes avant de configurer le serveur pour la première fois : ¦ Ne mettez pas le courant avant d’y être invité : ce système comprend un processeur de service (SP) permettant de configurer et de démarrer le serveur hôte. Afin de configurer correctement le serveur hôte et d’afficher les messages du SP, n’alimentez pas le serveur en courant alternatif (CA) tant que les connexions réseau de l’hôte et du SP ne sont pas établies, comme décrit dans ce guide. ¦ Choisissez les instructions les plus adaptées à votre situation : les instructions d’installation rapide s’appliquent à tous les environnements réseau et nécessitent l’utilisation d’un périphérique terminal pour établir les connexions avec un port série. Si votre environnement réseau utilise le protocole DHCP, vous pouvez configurer votre système à l’aide du port de gestion Ethernet. Pour tirer parti de la méthode de configuration DHCP, reportez-vous au guide d’installation en ligne faisant partie de la documentation produit disponible à l’adresse : http://docs.sun.com/app/docs/prod/sparc.t3.1#hic. Quantité Article 1 Serveur 1 Adaptateur (croisé) RJ-45/DB-9 1 Bracelet antistatique 1 ou 2 Cordons d’alimentation (quantité variant en fonction du nombre de PSU commandées) N/D Autres composants disponibles en option * * Certains composants optionnels ne sont pas nécessairement livrés avec le serveur. Vérifiez la liste des articles figurant sur le bon de commande afin d’être certain que les composants optionnels dont vous avez besoin pour terminer l’installation et la configuration du serveur ont bien été livrés. Serveur SPARC T3-1 Guide de démarrage2 ¦ Planifiez un laps de temps suffisant : la durée d’une installation est variable. Cependant, si vous suivez ces instructions pour la première fois, prévoyez environ 45 minutes à 1 h 15 pour effectuer la totalité de ces instructions. Vous aurez peut-être besoin de plus de temps si vous installez des kits de montage en rack et des composants matériels supplémentaires. ¦ Procurez-vous un périphérique terminal : configurez ce serveur montable en rack par le biais du SP au moyen des ports de gestion série et réseau intégrés (ni interface graphique, ni clavier Sun). Pour communiquer avec le SP, vous aurez besoin d’un périphérique terminal : terminal, serveur de terminal ou ordinateur portable exécutant un logiciel d’émulation de terminal. ¦ Réunissez les informations de configuration nécessaires : pendant la configuration, vous êtes invité à spécifier les paramètres de fuseau horaire et réseau spécifiques à votre environnement. Le TABLEAU 1 vous permet de consigner vos informations de configuration. TABLEAU 1 Informations de configuration Paramètre Description Vos informations Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui). Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. Si vous avez des doutes, sélectionnez la première de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur. IP Address (Adresse IP) Saisissez l’adresse IP des interfaces Ethernet sélectionnées. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Subnet Netmask (Masque de sousréseau) (Avec une réponse affirmative pour le sous-réseau) Indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez.3 Instructions d’installation rapide Pour une installation et une configuration rapides, suivez cette procédure. 1. Déballez le serveur et vérifiez que tous les articles commandés sont présents (voir FIGURE 1). 2. Placez le serveur à l’emplacement prévu à titre de vérification. Vous trouverez des instructions de montage en rack avec le kit de rails, sur l’étiquette de maintenance attachée au serveur et dans le Guide d’installation du serveur SPARC T3-1 disponible en ligne. 3. Reliez le port SER MGT du serveur (voir FIGURE 2) au périphérique terminal à l’aide d’un câble série. Cette connexion assure la communication initiale avec le SP. Le périphérique doit être configuré de manière à communiquer à 9 600 bauds, 8 bits, sans parité et avec 1 bit d’arrêt. Une configuration de type inverseur est requise, signifiant que les signaux de transmission et de réception sont inversés (croisés) pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. Si vous avez des doutes, sélectionnez Use the NFSv4 domain derived by the system (Utiliser le domaine NFSv4 dérivé par le système). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Saisissez deux fois le mot de passe root. Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP. TABLEAU 1 Informations de configuration4 FIGURE 2 Connexions du serveur 4. (Facultatif) Reliez au moyen d’un câble Ethernet le port Net MGT du serveur (voir FIGURE 2) au réseau avec lequel les futures connexions au SP et à l’hôte seront établies. Une fois la configuration initiale du système effectuée à l’aide du port SER MGT, la communication avec le SP et l’hôte est généralement assurée par le biais de cette interface Ethernet. 5. Reliez au moyen d’un câble Ethernet l’un des ports NET du serveur (voir FIGURE 2) au réseau avec lequel le serveur communiquera. 6. Branchez les cordons d’alimentation sur les alimentations et des sources de courant distinctes. Si le serveur est équipé de deux alimentations, branchez celles-ci sur des sources de courant distinctes. Votre système bénéficiera ainsi d’une alimentation redondante. Le système peut fonctionner avec une seule connexion d’alimentation, mais il ne dispose alors d’aucune redondance. Lorsqu’il est mis sous tension, le SP s’initialise et les DEL d’alimentation s’allument. Après quelques minutes, l’invite de connexion du SP s’affiche sur le périphérique terminal. Notez que l’hôte n’est pas encore initialisé ou mis sous tension à ce stade.5 7. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM (Integrated Lights Out Manager). Par exemple, pour créer un utilisateur nommé admin et pour dé?nir le rôle du compte admin sur Administrator, saisissez : Vous noterez que les astérisques indiqués dans l’exemple ne s’af?chent pas lorsque vous tapez le mot de passe. Vous trouverez des informations supplémentaires sur le SP (modification du mot de passe, configuration des paramètres réseau, etc.) dans la documentation en ligne. 8. Mettez le serveur sous tension et redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console de l’hôte démarrée, l’initialisation du serveur prend une vingtaine de minutes. 9. Lorsque vous y êtes invité, suivez les instructions qui s’affichent à l’écran et saisissez les informations de configuration. Pour obtenir la liste des informations de configuration et vos données personnelles, reportez-vous au TABLEAU 1. Vous êtes invité à confirmer la configuration à plusieurs reprises, ce qui vous permet de confirmer ou de modifier des paramètres. Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la lorsque le SE Oracle Solaris est exécuté. Lorsque tous les menus de configuration sont paramétrés, le serveur redémarre et affiche l’invite de connexion d’Oracle Solaris. 10. Connectez-vous au serveur et explorez ses fonctions. Les commandes suivantes fournissent des informations sur le système : ¦ showrev : affiche le nom d’hôte et les informations sur l’architecture du système. Utilisez l’option -a avec cette commande pour afficher les patchs installés. ¦ psrinfo : affiche des informations sur le nombre et le statut des processeurs et noyaux de l’hôte. Pour plus d’informations, consultez les pages de manuel et la documentation du SE Oracle Solaris. SUNSP-0921EA0008 login: root Password: changeme . . . -> -> create /SP/users/admin role=cuar Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/admin -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. . . .6 Documentation du produit Vous pouvez consulter, imprimer ou acquérir une large sélection de documents Sun (versions traduites comprises) à l’adresse suivante : http://docs.sun.com/app/docs/prod/sparc.t3.1#hic Support technique Pour toute question d’ordre technique sur ce produit à laquelle ce document ne répond pas, consultez l’adresse suivante : http://www.sun.com/service/contacting Commentaires sur la documentation Pour nous envoyer vos commentaires sur ce document, cliquez sur le lien Feedback[+] à l’adresse : http://docs.sun.com/ N’oubliez pas de mentionner le titre et le numéro de référence du document dans votre commentaire : Guide de démarrage du serveur SPARC T3-1, numéro de référence 821-2876-10 Copyright © 2010, Oracle et/ou ses sociétés affiliées. Tous droits réservés. N° de référence : 821-2876-10, rév. A Octobre 2010 Serveur SPARC T3-1 Guide d’installation N° de référence Octobre 2011 Octobre 2011Produit recyclable Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation vii Préparation de l’installation 1 Présentation des tâches d’installation 1 Présentation du serveur 3 Spécifications du serveur 4 Spécifications physiques 5 Espace libre minimal pour les interventions de maintenance 5 Spécifications environnementales 6 Présentation de l’alimentation d’entrée 7 Instructions pour la planification des conditions électriques requises 8 Emissions sonores 10 Spécifications de conformité aux agences de régulation 10 Exigences relatives à l’environnement d’exploitation 11 Observations relatives à la circulation de l’air 11 Composants du panneau avant 13 Boutons et DEL système du panneau avant 15 Composants du panneau arrière 17 DEL et bouton du panneau arrière du système 18 Précautions de manipulation du serveur 19 Précautions au sujet des dommages électrostatiques 20iv Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Outils nécessaires pour l’installation 21 Installation des composants optionnels 21 Installation du serveur 23 ? Pour stabiliser le rack 23 Présentation de l’assemblage de rails coulissants 24 Détails de l’assemblage de rails coulissants pour le kit de montage en rack avec vis 24 Détails de l’assemblage de rails coulissants pour le kit de montage en rack avec clips 27 ? Pour installer un assemblage de rails coulissants pour montage avec vis 29 ? Pour installer un assemblage de rails coulissants pour montage avec clips 35 ? Pour insérer et verrouiller le serveur dans le rack 39 ? Pour installer le bras de gestion des câbles 41 ? Pour vérifier le fonctionnement des rails coulissants et du bras 46 Connexion des câbles du serveur 49 Câblage requis 49 ? Pour connecter le câble du port SER MGT 51 ? Pour connecter le câble du port NET MGT 52 ? Pour connecter les câbles réseau Ethernet 53 ? Pour connecter d’autres câbles d’E/S 55 ? Pour préparer les cordons d’alimentation 55 Présentation de la gestion des câbles 56 ? Pour fixer les câbles du serveur au bras 57 Mise sous tension initiale du serveur 59 Présentation des tâches de mise sous tension initiale 59 Présentation de la console système Oracle ILOM 60Sommaire v ? Pour connecter un terminal ou un émulateur au port SER MGT 61 ? Pour mettre le serveur sous tension pour la première fois 62 ? Pour vérifier la fonctionnalité système 64 ? Pour assigner une adresse IP statique au processeur de service 64 Index 67vi Guide d’installation du serveur SPARC T3-1 • Octobre 2011vii Utilisation de cette documentation Ce guide d’installation contient des instructions, des informations d’ordre général et des données de référence visant à faciliter l’installation du serveur SPARC T3-1 d’Oracle. ¦ « Documentation connexe », page vii ¦ « Commentaires », page vii ¦ « Support technique et accessibilité », page viii Documentation connexe Commentaires Vous pouvez laisser vos commentaires relatifs à cette documentation sur le site : http://www.oracle.com/goto/docfeedback Documentation Liens Tous les produits Oracle http://www.oracle.com/documentation Serveur SPARC T3-1 http://www.oracle.com/pls/topic/lookup?ctx=E19836-01&id=homepage Utilitaire de gestion RAID LSI SAS2 pour serveurs SPARC T3 http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspxviii Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Support technique et accessibilité Description Liens Accédez au support électronique via My Oracle Support http://support.oracle.com Pour malentendants : http://www.oracle.com/accessibility/support.html Pour plus d’informations sur l’engagement d’Oracle en matière d’accessibilité http://www.oracle.com/us/corporate/accessibility/index.html1 Préparation de l’installation Ce chapitre présente des informations d’ordre général concernant les procédures d’installation du serveur. Il aborde les sujets suivants : ¦ « Présentation des tâches d’installation », page 1 ¦ « Présentation du serveur », page 3 ¦ « Spécifications du serveur », page 4 ¦ « Composants du panneau avant », page 13 ¦ « Boutons et DEL système du panneau avant », page 15 ¦ « Composants du panneau arrière », page 17 ¦ « DEL et bouton du panneau arrière du système », page 18 ¦ « Précautions de manipulation du serveur », page 19 ¦ « Précautions au sujet des dommages électrostatiques », page 20 ¦ « Outils nécessaires pour l’installation », page 21 ¦ « Installation des composants optionnels », page 21 Présentation des tâches d’installation Le diagramme suivant illustre les principales tâches relatives à l’installation du serveur et l’ordre dans lequel elles doivent être effectuées.2 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Organigramme des tâches d’installation du serveurPréparation de l’installation 3 Présentation du serveur Le serveur est un système montable en rack d’un facteur de forme 2 RU. FIGURE : Serveur SPARC T3-1 La liste suivante répertorie les éléments constituant la configuration de base du serveur : ¦ Boîtier système 2 RU avec matériel coulissant de montage en rack ¦ Carte mère assortie d’un processeur de service, deux contrôleurs de disque dur RAID 0, 1 et 1E incorporés, une PROM de configuration système et d’autres composants d’infrastructure système ¦ Emplacements de mémoire pouvant accueillir jusqu’à 16 modules mémoire DDR3 ¦ Un boîtier de disques durs comportant 8 ou 16 baies d’unité et un backplane de connecteur correspondant pouvant prendre en charge 8 ou 16 unités de disque dur (HDD). ¦ Une unité de disque optique compatible avec le boîtier de disques durs et se branchant au backplane de disque ¦ Six modules de ventilation (deux ventilateurs par module)4 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ¦ Une ou deux alimentations et le circuit de distribution d’énergie associé ¦ Interface d’E/S prenant en charge jusqu’à six modules d’extension PCIe (deux emplacements pouvant être utilisés par des modules XAUI) Informations connexes ¦ « Composants du panneau avant », page 13 ¦ « Boutons et DEL système du panneau avant », page 15 ¦ « Composants du panneau arrière », page 17 ¦ « DEL et bouton du panneau arrière du système », page 18 Spécifications du serveur Cette section présente les spécifications environnementales et physiques du serveur. ¦ « Spécifications physiques », page 5 ¦ « Espace libre minimal pour les interventions de maintenance », page 5 ¦ « Spécifications environnementales », page 6 ¦ « Présentation de l’alimentation d’entrée », page 7 ¦ « Emissions sonores », page 10 ¦ « Spécifications de conformité aux agences de régulation », page 10 ¦ « Exigences relatives à l’environnement d’exploitation », page 11 ¦ « Observations relatives à la circulation de l’air », page 11Préparation de l’installation 5 Spécifications physiques Informations connexes ¦ « Espace libre minimal pour les interventions de maintenance », page 5 Espace libre minimal pour les interventions de maintenance Informations connexes ¦ « Spécifications physiques », page 5 TABLEAU : Spécifications du système Mesure Système anglo-saxon Système métrique Largeur 17,6 po 447 mm Profondeur 26,5 po 673,1 mm Hauteur (2 unités en rack) 3,49 po 88,65 mm Poids approximatif (avec 2 alimentations et 16 disques durs, mais sans cartes PCI et matériel de montage en rack) 60 lb 27,2 kg TABLEAU : Espace libre minimal requis Description Espace libre Espace libre à l’avant du système 36 po (91 cm) Espace libre à l’arrière du système 36 po (91 cm)6 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Spécifications environnementales TABLEAU : Spécifications environnementales Spécification En service Hors service Remarques Te mpé r a t ur e • Niveau de la mer à 900 m (2 953 pieds) : 41 ºF à 95 ºF (5 ºC à 35 ºC ) • Au-dessus de 900 m (2 953 pieds) : Baisse de la température admise maximale de 1,6 ºF/1 000 pieds (1 ºC/300 m) IEC 60068-2-1 Test Ad et 60068-2-2 Test Bd -40 ºF à 149 ºF (-40 ºC à 65 ºC ) IEC 60068-2-1 Test Ab et 60068-2-2 Test Bb Une plage de températures ambiantes comprises entre 21 °C (69,8 °F) et 23 °C (73,4 °F) est idéale pour assurer la fiabilité du système. A 22 °C, il est facile de maintenir des niveaux d’humidité relatifs sûrs. Le fonctionnement dans cette plage de température fournit une marge de sécurité dans le cas d’une défaillance du système de contrôle environnemental. Humidité relative 10 à 90 %, 27 ºC max. avec thermomètre humide (sans condensation) IEC 60068-2-56 Test Cb 93 %, 35 ºC max. avec thermomètre humide (sans condensation) IEC 60068-2-56 Test Cb Des niveaux d’humidité relative ambiante de 45 à 50 % sont les mieux adaptés aux opérations de traitement des données pour différentes raisons : • empêcher la corrosion ; • offrir une marge de sécurité en cas de panne du système de contrôle des conditions environnementales ; • contribuer à éviter les pannes dues aux interférences intermittentes des décharges d’électricité statique qui se produisent lorsque l’humidité relative est trop basse. Les décharges électrostatiques se produisent facilement. Elles se dissipent plus difficilement lorsque l’humidité relative est inférieure à 35 % et deviennent critiques lorsque le niveau tombe en dessous de 30 %.Préparation de l’installation 7 Informations connexes ¦ « Spécifications du serveur », page 4 Présentation de l’alimentation d’entrée Le serveur SPARC T3-1 peut être équipé d’une ou de deux alimentations électriques autocalibrées. Celles-ci disposent des exigences d’alimentation en entrée suivantes : Afin de garantir la redondance des alimentations, branchez les deux cordons d’alimentation sur des circuits électriques distincts. Altitude maximale 3 000 m (10 000 pieds)) IEC 60068-2-13 Test M et 60068-2-41 Test Z/BM 12 000 m (40 000 pieds) IEC 60068-2-13 Test M Vibrations 0,15 G (axe x) 0,10 G (axes x et y), choc sinusoïdal de 5 à 500 Hz IEC 60068-2-6 Test Fc 0,5 G (axe x) 0,25 G (axes x et y), choc sinusoïdal de 5 à 500 Hz IEC 60068-2-6 Test Fc Chocs Pulsation demi-sinusoïdale de 3 Gs, 11 ms IEC 60068-2-27 Test Ea • Basculement : Chute libre avec basculement de 1 pouce (2,54 cm), de l’avant vers l’arrière • Seuil : Hauteur limite de 25 mm avec une vélocité d’impact de 0,75 m/s ETE-1010-02 Rév. A Spécification Valeurs Valeur nominale système 100 VAC, 13 A max., 50/60 Hz 110 à 127 VAC, 12 A max., 50/60 Hz 200 à 240 VAC, 7 A max., 50/60 Hz TABLEAU : Spécifications environnementales (suite) Spécification En service Hors service Remarques8 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Conseil – Ne branchez pas les câbles d’alimentation avant d’avoir connecté un périphérique terminal au serveur. Dès qu’une source de courant alimente le serveur, le processeur de service lance une routine d’initialisation, laquelle génère des messages. Si aucun terminal n’est connecté au système avant le début de cette opération, vous ne verrez pas les messages d’initialisation. Informations connexes ¦ « Spécifications du serveur », page 4 Instructions pour la planification des conditions électriques requises Utilisez seulement les spécifications fournies à titre indicatif pour la planification. Pour obtenir des valeurs plus précises, prenez des mesures électriques au sein de votre propre configuration de serveur en utilisant la charge de travail prévue. Reportez-vous à l’un des tableaux suivants selon le modèle de votre serveur. TABLEAU : Spécifications électriques du serveur SPARC T3-1 (capacité de 8 disques) Spécifications d’ordre général Valeurs Plage des tensions d’entrée en service (tolérance de tension d’entrée +/- 10 %) 100 à 240 VAC, 50 à 60 Hz Courant d’entrée maximal en service à 100 VAC Courant d’entrée maximal en service à 200 VAC 8,4 A 4,2 A Puissance d’entrée maximale en service à 100 VAC Puissance d’entrée maximale en service à 200 VAC 800 W 792 W Dissipation de la chaleur maximale 2 730 BTU/h (2 880 KJ/h) 2 702 BTU/h (2 851 KJ/h) Alimentation maximale en veille 30 W Courant d’appel (maximal) 25 A Courant de fuite 1,6 mA Spécifications maximales de configuration du serveur Aux température et tension nominales (processeur 16 coeurs, cadencé à 1,6 GHz, avec 16 modules DIMM de 8 Go, 8 disques durs, 6 cartes d’E/S PCIe)Préparation de l’installation 9 Alimentation d’entrée au repos 416 W Alimentation d’entrée de pointe lors de l’exécution de SpecJBB 582 W Spécifications minimales de configuration du serveur Aux température et tension nominales (processeur 16 coeurs, cadencé à 1,6 GHz, avec 4 modules DIMM de 2 Go, 1 disque dur, aucune carte d’E/S PCIe) Alimentation d’entrée au repos 290 W Alimentation d’entrée de pointe lors de l’exécution de SpecJBB 352 W TABLEAU : Spécifications électriques du serveur SPARC T3-1 (capacité de 16 disques) Spécifications d’ordre général Va l e ur s Plage des tensions d’entrée en service (tolérance de tension d’entrée +/- 10 %) 100 à 240 VAC, 50 à 60 Hz Courant d’entrée maximal en service à 100 VAC Courant d’entrée maximal en service à 200 VAC 9,4 A 4,7 A Puissance d’entrée maximale en service à 100 VAC Puissance d’entrée maximale en service à 200 VAC 896 W 888 W Dissipation de la chaleur maximale à 100 VAC Dissipation de la chaleur maximale à 200 VAC 3 057 BTU/h (3 226 KJ/h) 3 030 BTU/h (3 197 KJ/h) Alimentation maximale en veille 30 W Courant d’appel (maximal) 25 A Courant de fuite 1,6 mA Spécifications maximales de configuration du serveur Aux température et tension nominales (processeur 16 coeurs, cadencé à 1,6 GHz, avec 16 modules DIMM de 8 Go, 16 disques durs, 6 cartes d’E/S PCIe) Alimentation d’entrée au repos 494 W Alimentation d’entrée de pointe lors de l’exécution de SpecJBB 678 W Spécifications minimales de configuration du serveur Aux température et tension nominales (processeur 16 coeurs, cadencé à 1,6 GHz, avec 4 modules DIMM de 2 Go, 1 disque dur, aucune carte d’E/S PCIe) Alimentation d’entrée au repos 297 W Alimentation d’entrée de pointe lors de l’exécution de SpecJBB 359 W TABLEAU : Spécifications électriques du serveur SPARC T3-1 (capacité de 8 disques) (suite)10 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Remarques : ¦ Entrée maximum en service = {alimentation d’entrée maximum en service}/VAC/0,95 (pour les PSU PFC) ¦ W (CA) = W (CC)/0,90 (pour l’efficacité de la PSU) ¦ Alimentation des disques durs : 10 W (CC) en activité (selon le budget défini), 8 W au repos ¦ Alimentation de la carte PCIe : 17 W (CC) en activité (selon le budget défini), 5 W (CC) au repos Informations connexes ¦ « Spécifications du serveur », page 4 Emissions sonores Les émissions de bruit déclarées sont conformes aux normes ISO 9296 pour le serveur SPARC T3-1. Informations connexes ¦ « Spécifications du serveur », page 4 Spécifications de conformité aux agences de régulation Pour une liste complète des spécifications de conformité aux agences de régulation, reportez-vous au SPARC T3-1 Server Safety and Compliance Guide. TABLEAU : Emissions sonores du serveur SPARC T3-1 Description Mode Spécification LwAd Emissions sonores en service 7,1 B* * 1 B = 10 dB LpAm Bruit acoustique en fonctionnement (postes de spectateurs) 63 dBPréparation de l’installation 11 Informations connexes ¦ « Spécifications du serveur », page 4 Exigences relatives à l’environnement d’exploitation Votre système de contrôle de l’environnement doit fournir une arrivée d’air aux serveurs conforme aux limitations spécifiées à la section « Spécifications environnementales », page 6. Pour éviter la surchauffe, ne dirigez pas de l’air chaud : ¦ en direction de l’arrivée d’air avant du serveur ; ¦ en direction des panneaux d’accès au serveur. Remarque – Lorsque vous réceptionnez le serveur, placez-le dans l’environnement dans lequel il sera installé. Laissez-le dans son carton d’emballage à sa destination finale pendant 24 heures. Cette période de repos évite les chocs thermiques et la condensation. Les serveurs ont été testés en vue de répondre à toutes les conditions de fonctionnement requises lors de leur mise en service dans les limites environnementales décrites à la section « Spécifications environnementales », page 6. L’utilisation de matériel informatique dans des conditions extrêmes de température ou d’humidité augmente le taux de pannes des composants matériels. Pour réduire les risques de pannes de composants, utilisez le serveur dans les plages optimales de température et d’humidité. Informations connexes ¦ « Observations relatives à la circulation de l’air », page 11 ¦ « Espace libre minimal pour les interventions de maintenance », page 5 Observations relatives à la circulation de l’air Veillez à assurer une circulation d’air entrant et sortant adéquate afin de maintenir la température interne du serveur dans une plage de fonctionnement sûre. ¦ Assurez-vous que la circulation de l’air dans le châssis n’est pas obstruée. ¦ Assurez-vous que l’air pénètre par l’avant du serveur et s’échappe par l’arrière. 12 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ¦ Veillez à ce que les ouvertures de ventilation du serveur utilisées pour l’arrivée et l’évacuation d’air offrent un modèle de perforations d’une zone d’ouverture de 60 % sur les parties avant et arrière du serveur. Cette zone d’ouverture minimale de 60 % équivaut aux mesures suivantes : ¦ Laissez un espace libre minimal de 5 mm (0,2 po) par rapport à l’ouverture de ventilation située à l’avant du serveur et de 80 mm (3,1 po) à l’arrière une fois le serveur installé. Ces valeurs de dégagement sont calculées à partir de l’impédance d’arrivée et d’évacuation précédentes (zone d’ouverture disponible) et supposent une distribution uniforme de la zone d’ouverture sur l’arrivée et l’évacuation d’air. Il est recommandé d’utiliser des valeurs d’espace libre supérieures aux chiffres donnés ici afin d’améliorer les performances de refroidissement. Remarque – La combinaison de restrictions d’arrivée et d’évacuation (telles que les portes de l’armoire et l’espace libre entre le serveur et les portes) peut affecter les performances de refroidissement du serveur et doit être vérifiée par l’utilisateur. ¦ Veillez à éviter la recirculation de l’air évacué dans un rack ou une armoire. ¦ Manipulez les câbles de façon à réduire les interférences avec les ouvertures d’évacuation du serveur. Informations connexes ¦ « Exigences relatives à l’environnement d’exploitation », page 11 ¦ « Espace libre minimal pour les interventions de maintenance », page 5 Système métrique Système anglo-saxon 224,4 cm2 (425 x 88 mm) 34,8 po 2 (16,7 x 3,5 po)Préparation de l’installation 13 Composants du panneau avant La figure suivante illustre les composants accessibles sur le panneau avant du serveur. FIGURE : Composants du panneau avant du serveur (configuration de backplane à 8 disques) Légende de la figure 1 Boutons et indicateurs du système 8 Disque dur HDD5 2 Balise RFID 9 Disque dur HDD6 3 Disque dur HDD0 10 Disque dur HDD7 4 Disque dur HDD1 11 Module DVD SATA 5 Disque dur HDD2 12 Port USB 2 6 Disque dur HDD3 13 Port USB 3 7 Disque dur HDD414 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Composants du panneau avant du serveur (configuration de backplane à 16 disques) Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Boutons et DEL système du panneau avant », page 15 ¦ « Composants du panneau arrière », page 17 ¦ « DEL et bouton du panneau arrière du système », page 18 Légende de la figure 1 Boutons et indicateurs du système 12 Disque dur HDD9 2 Balise RFID 13 Disque dur HDD10 3 Disque dur HDD0 14 Disque dur HDD11 4 Disque dur HDD1 15 Disque dur HDD12 5 Disque dur HDD2 16 Disque dur HDD13 6 Disque dur HDD3 17 Disque dur HDD14 7 Disque dur HDD4 18 Disque dur HDD15 8 Disque dur HDD5 19 Port USB 2 9 Disque dur HDD6 20 Port USB 3 10 Disque dur HDD7 21 Module DVD SATA 11 Disque dur HDD8Préparation de l’installation 15 Boutons et DEL système du panneau avant La figure suivante illustre la disposition des DEL du système et le bouton de marche/arrêt du panneau avant. FIGURE : Boutons de marche et DEL système du panneau avant Légende de la figure 1 DEL et bouton de localisation 5 DEL d’opération de maintenance requise pour l’alimentation 2 Panne - DEL d’opération de maintenance requise 6 Défaut de température excessive du système - DEL d’opération de maintenance requise 3 DEL d’alimentation normale 7 Panne de ventilateur supérieur - DEL d’opération de maintenance requise 4 Bouton de mise sous tension/veille16 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 TABLEAU : Description des DEL système du panneau avant DEL ou bouton Icône ou étiquette Description DEL et bouton de localisation (blancs) La DEL de localisation peut être allumée pour identifier un système précis. Lorsqu’elle est allumée, elle clignote rapidement. Il existe deux méthodes pour allumer une DEL de localisation : • Emettre la commande ILOM set /SYS/LOCATE value=Fast_Blink • Appuyer sur le bouton de localisation DEL d’opération de maintenance requise (jaune) Lorsqu’elle est allumée en continu, cette DEL indique qu’une panne système a été détectée et qu’une intervention est nécessaire. DEL d’alimentation normale (verte) Indique les conditions suivantes : • Eteinte : indique que le système ne fonctionne pas dans son état normal. Il se peut que le système ne soit pas sous tension. Le processeur de service peut être en cours d’exécution. • Allumée en continu : indique que le système est sous tension et que son exécution est normale. Aucune opération de maintenance n’est requise. • Clignotement : le système fonctionne en mode veille et est prêt à être réactivé rapidement à plein régime. • Clignotement lent : une activité transitoire est en cours. • Clignotement rapide : le processeur de service est en cours d’initialisation. Bouton de marche/arrêt Le bouton de marche/arrêt encastré permet de mettre le système sous ou hors tension. • Appuyez dessus puis relâchez-le pour mettre le système sous tension. • Appuyez dessus puis relâchez-le pour arrêter normalement le système. • Maintenez le bouton enfoncé pendant plus de 5 secondes pour effectuer un arrêt d’urgence. DEL de panne d’alimentation (jaune) REAR PS Indique qu’une panne d’alimentation a été détectée et qu’une intervention est nécessaire. DEL de surchauffe (jaune) Indique qu’une condition de surchauffe a été détectée dans le châssis et qu’une intervention est nécessaire. DEL de panne de ventilateur (jaune) TOP FAN Indique qu’une panne du module de ventilation a été détectée et qu’une intervention est nécessaire.Préparation de l’installation 17 Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Composants du panneau avant », page 13 ¦ « Composants du panneau arrière », page 17 ¦ « DEL et bouton du panneau arrière du système », page 18 Composants du panneau arrière La figure suivante illustre les composants accessibles sur le panneau arrière du serveur. FIGURE : Composants du panneau arrière du serveur Légende de la figure 1 Alimentation 0 11 Port Gbit Ethernet NET3 2 Alimentation 1 12 Port USB 0 3 Bouton DEL de localisation 13 Port USB 1 4 DEL d’opération de maintenance requise 14 Port vidéo VGA 5 DEL d’alimentation normale 15 Connecteur PCIe ou XAUI 3 6 Port de gestion série du processeur de service 16 Connecteur PCIe ou XAUI 0 7 Port de gestion réseau du processeur de service 17 Connecteur PCIe 4 8 Port Gbit Ethernet NET0 18 Connecteur PCIe 1 9 Port Gbit Ethernet NET1 19 Connecteur PCIe 5 10 Port Gbit Ethernet NET2 20 Connecteur PCIe 218 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Composants du panneau avant », page 13 ¦ « Boutons et DEL système du panneau avant », page 15 ¦ « DEL et bouton du panneau arrière du système », page 18 DEL et bouton du panneau arrière du système La figure suivante illustre l’emplacement des DEL du système et le bouton de localisation du panneau arrière. FIGURE : DEL système du panneau arrière Légende de la figure 1 DEL et bouton de localisation 3 DEL d’alimentation normale 2 Panne - DEL d’opération de maintenance requisePréparation de l’installation 19 Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Composants du panneau avant », page 13 ¦ « Boutons et DEL système du panneau avant », page 15 ¦ « Composants du panneau arrière », page 17 Précautions de manipulation du serveur Attention – Déployez la barre antibasculement du rack avant de commencer l’installation. TABLEAU : Description des DEL système du panneau arrière DEL ou bouton Icône ou étiquette Description DEL et bouton de localisation (blancs) La DEL de localisation peut être allumée pour identifier un système précis. Lorsqu’elle est allumée, elle clignote rapidement. Il existe deux méthodes pour allumer une DEL de localisation : • Emettre la commande ILOM set /SYS/LOCATE value=Fast_Blink • Appuyer sur le bouton de localisation DEL d’opération de maintenance requise (jaune) Lorsqu’elle est allumée en continu, cette DEL indique qu’une panne système a été détectée et qu’une intervention est nécessaire. DEL d’alimentation normale (verte) Indique les conditions suivantes : • Eteinte : indique que le système ne fonctionne pas dans son état normal. Il se peut que le système ne soit pas sous tension. Le processeur de service peut être en cours d’exécution. • Allumée en continu : indique que le système est sous tension et que son exécution est normale. Aucune opération de maintenance n’est requise. • Clignotement : le système fonctionne en mode veille et est prêt à être réactivé rapidement à plein régime. • Clignotement lent : une activité transitoire est en cours. • Clignotement rapide : le processeur de service est en cours d’initialisation.20 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Attention – Le serveur pèse environ 60 lb (25 kg). Deux personnes sont nécessaires pour soulever le serveur et l’installer dans un rack. Attention – Dans le cadre d’une procédure dans laquelle interviennent deux personnes, communiquez toujours clairement vos intentions avant, pendant et au terme de chaque étape pour minimiser la confusion. Informations connexes ¦ « Précautions au sujet des dommages électrostatiques », page 20 Précautions au sujet des dommages électrostatiques Les équipements électroniques peuvent être endommagés par l’électricité statique. Munissez-vous d’un bracelet antistatique mis à la terre, d’un cale-pied ou d’un dispositif de sécurité équivalent afin de prévenir des dommages électrostatiques lors de l’installation ou de l’entretien des serveurs. Attention – Pour protéger les composants électriques des dégâts dus aux décharges électrostatiques, qui peuvent irrémédiablement endommager le système ou nécessiter des réparations effectuées par des techniciens de maintenance, placez les composants sur une surface antistatique (telle qu’un tapis de décharge antistatique, un sachet antistatique ou un tapis antistatique jetable). Portez un bracelet de mise à la terre antistatique raccordé à une surface métallique du châssis lorsque vous travaillez sur les composants du système.Préparation de l’installation 21 Informations connexes ¦ « Précautions de manipulation du serveur », page 19 Outils nécessaires pour l’installation Pour pouvoir installer le système, assurez-vous de disposer des outils suivants : ¦ Tournevis cruciforme n°2 ¦ Tapis antistatique et bracelet de mise à la terre En outre, vous devez disposer d’un périphérique de console système, tel que l’un des dispositifs suivants : ¦ Terminal ASCI I ¦ Station de travail ¦ Serveur de terminal ¦ Tableau de connexions relié à un serveur de terminal Informations connexes ¦ « Précautions au sujet des dommages électrostatiques », page 20 ¦ « Précautions de manipulation du serveur », page 19 Installation des composants optionnels Les composants optionnels commandés dans le cadre de la configuration initiale du serveur seront installés sur le serveur avant son expédition. Cependant, si ces composants optionnels ont été commandés séparément, vous devrez les installer sur le serveur sur votre site. Pour obtenir les instructions d’installation des composants optionnels, reportez-vous au manuel d’entretien. Conseil – Dans la mesure du possible, installez les composants supplémentaires avant de placer le serveur dans un rack ou une armoire. Informations connexes ¦ « Outils nécessaires pour l’installation », page 2122 Guide d’installation du serveur SPARC T3-1 • Octobre 201123 Installation du serveur Les sections suivantes décrivent la procédure d’installation du serveur dans un rack d’équipements : ¦ « Pour stabiliser le rack », page 23 ¦ « Présentation de l’assemblage de rails coulissants », page 24 ¦ « Pour installer un assemblage de rails coulissants pour montage avec vis », page 29 ¦ « Pour installer un assemblage de rails coulissants pour montage avec clips », page 35 ¦ « Pour insérer et verrouiller le serveur dans le rack », page 39 ¦ « Pour installer le bras de gestion des câbles », page 41 ¦ « Pour vérifier le fonctionnement des rails coulissants et du bras », page 46 ? Pour stabiliser le rack Votre rack de serveurs doit normalement être équipé de pattes anti-basculement qui l’empêchent de basculer en avant lors du retrait d’un serveur. ? Réglez les pattes anti-basculement du rack avant d’étendre les rails coulissants qui soutiennent le serveur ou avant d’installer un serveur sur les rails allongés. Pour des instructions, reportez-vous à la documentation de votre rack.24 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Présentation de l’assemblage de rails coulissants L’installation du serveur est possible avec l’un des deux kits de montage en rack suivants : ¦ Kit de montage en rack avec vis (avec outil) ¦ Kit de montage en rack avec clips (sans outil) Les deux types de kits comprennent une paire de rails coulissants qui se fixent aux montants situés aux extrémités du rack et une paire de supports de montage qui se fixent au châssis du serveur. La différence entre ces kits est le mode de fixation des rails coulissants : les rails avec des vis sont fixés aux montants du rack à l’aide de vis tandis que les rails avec clips utilisent des clips sans vis. Détails de l’assemblage de rails coulissants pour le kit de montage en rack avec vis Chaque assemblage se compose d’un rail coulissant en trois parties et d’un support de montage amovible. Ces composants peuvent être installés de l’un ou l’autre côté du châssis.Installation du serveur 25 FIGURE : Parties d’un assemblage de rails coulissants avec vis ¦ Les parties centrale et arrière disposent de trous prévus pour la fixation aux montants du rack. Elles se règlent en fonction de la profondeur du rack, de 61 cm à 93 cm. ¦ La partie avant peut être étendue dans le prolongement de la partie centrale afin de pouvoir sortir le serveur suffisamment hors du rack pour y effectuer la plupart des opérations de maintenance. ¦ Le support de montage amovible coulisse de 35,5 cm hors du rail, puis se bloque dans cette position. Si vous le débloquez à ce stade, il coulisse de 30 cm supplémentaires avant de sortir du rail coulissant. Il y a cinq verrous au total dans un assemblage de rails coulissants. Quatre se trouvent sur le support de montage et un sur la partie avant du rail coulissant. Les verrous sont décrits à la section « Installation du serveur », page 23. Légende de la figure 1 Support de montage 2 Partie avant 3 Partie centrale 4 Partie arrière26 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Emplacement des verrous sur l’assemblage de rails coulissants avec visInstallation du serveur 27 Détails de l’assemblage de rails coulissants pour le kit de montage en rack avec clips Chaque assemblage se compose d’un rail coulissant en trois parties et d’un support de montage amovible. Le rail coulissant se fixe aux montants du rack. Le support de montage se fixe au châssis du serveur. FIGURE : Parties d’un assemblage de rails coulissants avec clips ¦ Les rails coulissants se règlent en fonction de la profondeur du rack, de 61 cm à 93 cm. Les parties centrale et arrière des rails coulissants disposent de trous prévus pour la fixation des rails aux montants du rack. ¦ La partie avant peut être étendue dans le prolongement de la partie centrale afin de pouvoir sortir le serveur suffisamment hors du rack pour y effectuer la plupart des opérations de maintenance. ¦ Le support de montage amovible coulisse de 37 cm hors du rail, puis se bloque dans cette position. Si vous le débloquez à ce stade, il coulisse de 37 cm supplémentaires avant de sortir du rail coulissant. Légende de la figure 1 Support de montage 2 Partie avant 3 Partie centrale 4 Partie arrière28 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Il y a six verrous au total dans un assemblage de rails coulissants. Quatre se trouvent sur le support de montage et deux sur le rail coulissant. FIGURE : Emplacement des verrous sur l’assemblage de rails coulissants Informations connexes ¦ « Pour installer un assemblage de rails coulissants pour montage avec vis », page 29 ¦ « Pour installer un assemblage de rails coulissants pour montage avec clips », page 35Installation du serveur 29 ? Pour installer un assemblage de rails coulissants pour montage avec vis 1. Stabilisez le rack en étendant ses pattes anti-basculement. Pour des instructions, reportez-vous à la documentation de votre rack. 2. Retirez complètement les deux supports de montage de leurs rails coulissants respectifs. a. Appuyez simultanément sur les boutons de verrouillage supérieur et inférieur du verrou du rail coulissant et maintenez-les enfoncés. FIGURE : Déverrouillage d’un assemblage de rails coulissants b. Dégagez le support de montage jusqu’à ce qu’il se bloque en position étendue. c. Faites glisser le bouton de dégagement du support de montage dans le sens indiqué, puis faites coulisser le support de montage hors du rail. 30 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Emplacement du bouton de déverrouillage du support de montage d. Appuyez sur le levier métallique (étiqueté Push) de la partie centrale du rail coulissant, puis repoussez cette partie dans le rack.Installation du serveur 31 FIGURE : Déverrouillage de la partie centrale du rail coulissant 3. Fixez un support de montage au côté droit du châssis. a. Placez le support de montage contre le châssis. Assurez-vous que le verrou du rail coulissant se trouve à l’avant et que les trois ouvertures du support de montage sont alignées sur les trois broches de repère sur le côté du châssis.32 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Fixation d’un support de montage au châssis b. Assurez-vous que les têtes des broches de repère sortent par les ouvertures du support de montage. Tirez le support de montage vers l’avant du châssis jusqu’à ce qu’il s’emboîte en émettant un déclic sonore. c. Vérifiez que toutes les broches sont bien en place dans les ouvertures et que la broche appropriée a actionné le verrou du support de montage. 4. Fixez le second support de montage au côté gauche du châssis. 5. Déterminez les trous des montants du rack à utiliser pour fixer les rails coulissants. Utilisez les trous de montage qui sont alignés sur la moitié inférieure de l’espace de 2U. 6. Déterminez les vis que vous utiliserez pour monter les rails coulissants. Si les montants de votre rack présentent des trous de montage taraudés, déterminez si les taraudages sont métriques ou standard. Sélectionnez les vis appropriées dans le sachet inclus dans le kit de montage. Si le rack ne dispose pas de trous de montage taraudés, les vis de montage seront fixées au moyen d’un écrou à cage. Installation du serveur 33 7. Fixez un rail coulissant au montant avant droit du rack. a. Fixez sans serrer l’avant d’un rail coulissant au montant avant droit du rack au moyen de deux vis. Remarque – Ne serrez pas les vis pour le moment. FIGURE : Montage d’un rail coulissant b. Réglez la longueur du rail en faisant glisser la bride de montage arrière jusqu’au bord externe du montant arrière du rack. c. Fixez sans serrer l’arrière du rail coulissant au montant arrière du rack au moyen de deux vis. 8. Fixez le second rail coulissant aux montants gauches du rack de manière similaire. Ne serrez pas les vis. 9. Utilisez l’entretoise pour régler la distance entre les rails coulissants.34 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 a. A l’avant du rack, encastrez le côté gauche de l’entretoise dans les encoches de l’extrémité du rail gauche. FIGURE : Réglage de la distance entre les rails coulissants à l’aide de l’entretoise b. Insérez le côté droit de l’entretoise dans l’extrémité avant du rail de droite. c. Faites glisser l’extrémité du rail vers la droite ou la gauche afin que les extrémités de l’entretoise s’insèrent aux extrémités des deux rails. La distance entre les rails est maintenant égale à la largeur du serveur avec les supports de montage. d. Serrez les vis pour bloquer les extrémités des rails. e. A l’arrière du rack, répétez les opérations de l’étape a à l’étape d pour les extrémités arrière des rails. Informations connexes ¦ « Présentation de l’assemblage de rails coulissants », page 24Installation du serveur 35 ? Pour installer un assemblage de rails coulissants pour montage avec clips 1. Retirez complètement les deux supports de montage de leurs rails coulissants respectifs. a. Appuyez simultanément sur les boutons de verrouillage supérieur et inférieur du verrou du rail coulissant et maintenez-les enfoncés. FIGURE : Déverrouillage d’un assemblage de rails coulissants Express b. Sortez le support de montage jusqu’à ce qu’il s’arrête. c. Faites glisser le bouton de dégagement du support de montage vers la gauche, puis faites coulisser le support de montage hors du rail.36 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Bouton de dégagement du support de montage d’un rail Express 2. Fixez un support de montage au côté droit du châssis du serveur. a. Placez le support de montage contre le châssis. Assurez-vous que le verrou du rail coulissant se trouve à l’avant et que les ouvertures du support de montage sont alignées sur les broches de repère sur le côté du châssis.Installation du serveur 37 FIGURE : Fixation d’un support de montage de rail Express au châssis b. Assurez-vous que les têtes des quatre broches de repère sortent par les ouvertures du support de montage. Faites coulisser le support de montage vers l’avant du châssis jusqu’à ce que le support s’emboîte en émettant un déclic sonore. c. Vérifiez que les quatre broches sont bien logées dans les ouvertures et que la troisième broche avant a actionné le verrou du support de montage. 3. Fixez le second support de montage au côté gauche du châssis du serveur. 4. Orientez les rails coulissants en veillant à ce que les guides à billes (étiquetés FRONT) se trouvent vers l’avant.38 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Orientation des rails coulissants Express pour l’installation 5. Etendez les rails coulissants (partie externe) en fonction de la longueur du rack, puis fixez-les à ce dernier. Un déclic sonore signale que les rails sont fermement fixés au rack.Installation du serveur 39 FIGURE : Fixation des rails coulissants Express au rack Attention – Déployez le mécanisme antibasculement du rack avant de poursuivre l’installation. Informations connexes ¦ « Présentation de l’assemblage de rails coulissants », page 24 ? Pour insérer et verrouiller le serveur dans le rack 1. Insérez les extrémités des supports de montage dans les rails coulissants. Attention – Le poids des serveurs sur les rails coulissants étendus peut suffire à renverser un rack d’équipement. 40 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Attention – Le serveur pèse environ 60 lb (25 kg). Deux personnes sont nécessaires pour soulever le serveur et le monter dans un rack en suivant les procédures de ce chapitre. Attention – Vérifiez, avant de poursuivre, que le serveur est bien monté dans le rack et que les rails coulissants sont fermement fixés aux supports de montage. 2. Déployez la barre antibasculement si le châssis ou le rack en est équipé. 3. Faites glisser le châssis dans le rack. FIGURE : Montage du châssis sur les rails coulissants Informations connexes ¦ « Présentation de l’assemblage de rails coulissants », page 24Installation du serveur 41 ? Pour installer le bras de gestion des câbles Attention – Soutenez le bras de gestion des câbles pendant l’installation. Ne le laissez pas suspendu tant que les trois points d’attache ne sont pas fixés. 1. Retirez le ruban adhésif de l’extension de rail du bras (sur le côté gauche du bras), puis sortez l’extension de rail. 2. Fixez l’extension de rail du bras de gestion des câbles au rail coulissant arrière gauche. A l’arrière du rack, encastrez l’extension du rail du bras dans l’extrémité de l’assemblage de rails coulissants gauche. La languette située à l’avant de l’extension du rail devrait émettre un déclic une fois mis en place.42 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Insertion de l’extension de rail de bras à l’arrière du rail coulissant gauche Les côtés droits des deux bras du bras de gestion de câbles sont dotés d’extensions à charnières. Sur la fiche d’instruction du fabricant, l’extrémité la plus petite s’appelle CMA Connector for Inner Member (connecteur CMA pour extrémité interne). Elle se fixe au support de montage de droite. L’extension la plus longue, CMA Connector for Outer Member (connecteur CMA pour extrémité externe), se fixe au rail coulissant de droite. 3. Insérez la plus petite des extensions dans le clip situé à l’extrémité du support de montage. Faites glisser la plus petite des extensions dans l’orifice carré au centre de l’attache située à l’extrémité du support de montage.Installation du serveur 43 FIGURE : Montage du connecteur de bras interne 4. Insérez la plus grande des extensions dans l’extrémité du rail coulissant droit.44 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Fixation du connecteur de bras externe 5. Insérez le connecteur en plastique à charnières sur la gauche du CMA complètement dans l’extension de rail du CMA. La languette en plastique de l’extension de rail du bras bloque le connecteur en plastique à charnières.Installation du serveur 45 FIGURE : Montage du côté gauche du rail coulissant46 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ? Pour vérifier le fonctionnement des rails coulissants et du bras Effectuez cette procédure avant et après l’installation des câbles du serveur dans le bras. La première exécution de cette procédure (avant que le bras contienne des câbles) permet de vérifier que le bras s’allonge et se rétracte bien. Remarque – Le bras est muni de bandes Velcro qui permettent d’y fixer les câbles. Ne fixez pas les bandes Velcro avant d’avoir installé le bras de gestion, branché les câbles et les avoir disposé à l’intérieur du bras. Conseil – Deux personnes sont nécessaires pour réaliser cette opération : l’une pour insérer/sortir le serveur du rack, l’autre pour s’occuper des câbles et du bras. 1. Pour un rack autonome, déployez la barre antibasculement. 2. Débloquez les boutons de verrouillage de coulissement situés aux extrémités droite et gauche du châssis.Installation du serveur 47 FIGURE : Déverrouillage d’un assemblage de rails coulissants 3. Inspectez les câbles du serveur pour vérifier qu’ils ne sont ni pliés ni tordus dans le bras. 4. Sortez lentement le serveur du rack jusqu’à ce que les rails coulissants arrivent en fin de course. 5. Vérifiez que le bras s’étend complètement et ne tord pas les rails coulissants. 6. Vérifiez que le serveur s’étend complètement et qu’il se bloque en position de maintenance. Le serveur doit s’arrêter après une course de 40 cm environ. 7. Tirez simultanément vers vous les boutons de dégagement des rails coulissants et repoussez le serveur dans le rack. Le serveur doit normalement coulisser doucement dans le rack sans se courber.48 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Bouton de dégagement du support de montage d’un rail 8. Vérifiez que le bras de gestion des câbles est rentré sans se plier. 9. Réglez comme il convient les bandes et le bras de façon à bien fixer les câbles. 49 Connexion des câbles du serveur Les rubriques suivantes décrivent la procédure de connexion des câbles de données et d’alimentation au serveur : ¦ « Câblage requis », page 49 ¦ « Pour connecter le câble du port SER MGT », page 51 ¦ « Pour connecter le câble du port NET MGT », page 52 ¦ « Pour connecter les câbles réseau Ethernet », page 53 ¦ « Pour connecter d’autres câbles d’E/S », page 55 ¦ « Pour préparer les cordons d’alimentation », page 55 ¦ « Pour fixer les câbles du serveur au bras », page 57 Câblage requis Avant de relier les câbles au serveur, consultez les remarques suivantes concernant le câblage. ¦ Connexions de câbles minimales pour le serveur : ¦ au moins une connexion réseau Ethernet intégrée système (port NET) ; ¦ port de gestion série du processeur de service (port SER MGT) ; ¦ port de gestion réseau du processeur de service (port NET MGT) ; ¦ un câble pour chaque alimentation. ¦ Ports de gestion du processeur de service : au nombre de deux, les ports de gestion du processeur de service sont destinés à être utilisés avec le processeur de service Oracle ILOM. ¦ Le port de gestion série du processeur de service (étiqueté SER MGT) utilise un câble RJ-45 et est toujours disponible. Il s’agit du port de connexion par défaut au processeur de service. 50 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ¦ Le port de gestion réseau du processeur de service (étiqueté NET MGT) constitue la connexion facultative au processeur de service. Ce port n’est pas disponible tant que vous ne configurez pas les paramètres réseau du processeur de service (par le biais du port de gestion série de ce dernier). Le port de gestion réseau du processeur de service utilise un câble RJ-45 pour une connexion 10/100 BASE-T. Ce port ne prend pas en charge les connexions établies avec des réseaux Gigabit. ¦ Les ports Ethernet sont étiquetés NET0, NET1, NET2 et NET3. Les interfaces Ethernet fonctionnent à 10 Mbits/s, 100 Mbits/s et 1 000 Mbits/s. ¦ Port vidéo DB-15 VGA : utilise le port vidéo pour relier un moniteur couleur au serveur. ¦ Ports USB : assurent la prise en charge de l’enfichage à chaud. Vous pouvez connecter et déconnecter les câbles USB et les périphériques sans que cela n’ait d’incidence sur les opérations système. ¦ Vous pouvez uniquement effectuer des opérations d’enfichage à chaud USB quand le SE est en cours d’exécution. Les opérations d’enfichage à chaud USB ne sont pas prises en charge lorsque l’invite ok du système est affichée ou que l’initialisation du système n’est pas complètement terminée. ¦ Vous pouvez connecter jusqu’à 126 périphériques à chacun des quatre contrôleurs USB, soit au total 504 périphériques USB par système. ¦ Câbles d’alimentation : ne raccordez pas de câbles d’alimentation aux alimentations tant que vous n’avez pas terminé de relier les câbles de données et n’avez pas connecté le serveur à un terminal série ou à un émulateur de terminal série (PC ou station de travail). Remarque – Le serveur passe en mode veille et le processeur de service ILOM s’initialise dès qu’une alimentation est connectée à une source de courant externe par un câble. Les messages système peuvent se perdre après une minute si un terminal ou un émulateur de terminal n’est pas connecté au port de gestion série avant la mise sous tension. TABLEAU : Vitesses de transfert des connexions Ethernet Type de connexion Terminologie IEEE Vitesse de transfert Ethernet 10BASE-T 10 Mbits/s Fast Ethernet 100BASE-TX 100 Mbits/s Gigabit Ethernet 1000BASE-T 1 000 Mbits/sConnexion des câbles du serveur 51 Informations connexes ¦ « Connexion des câbles du serveur », page 49 ? Pour connecter le câble du port SER MGT Le port de gestion série du processeur de service est étiqueté SER MGT. Il s’agit du port RJ-45 situé le plus à gauche sur le panneau arrière. ? Connectez le port de gestion série SER MGT au périphérique terminal au moyen d’un câble de catégorie 5. FIGURE : Port de gestion série du processeur de service - Panneau arrière Ce port est requis pour configurer le port de gestion réseau du processeur de service. Lors du branchement d’un câble DB-9, servez-vous d’un adaptateur RJ-45/DB-9 pour effectuer les croisements relatifs à chaque connecteur. Remarque – Le port de gestion série du processeur de service est exclusivement réservé à la gestion du serveur. Il s’agit de la connexion par défaut entre le processeur de service et un terminal ou un ordinateur.52 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Attention – Ne connectez pas de modem à ce port. Informations connexes ¦ « Pour connecter le câble du port NET MGT », page 52 ¦ « Connexion des câbles du serveur », page 49 ? Pour connecter le câble du port NET MGT Le port de gestion réseau du processeur de service est étiqueté NET MGT. Il se trouve immédiatement à droite du port de gestion série (SER MGT) sur le panneau arrière. ? Connectez le port de gestion réseau NET MGT au commutateur ou hub de votre réseau au moyen d’un câble de catégorie 5. FIGURE : Port de gestion réseau du processeur de service - Panneau arrière Remarque – Ce port n’est pas opérationnel tant que vous ne configurez pas les paramètres réseau (au moyen du port de gestion série).Connexion des câbles du serveur 53 Remarque – Par défaut, le port de gestion réseau du processeur de service est configuré de manière à récupérer automatiquement les paramètres réseau à l’aide du protocole DHCP (Dynamic Host Configuration Protocol) et à autoriser les connexions via Solaris Secure Shell (SSH). Il peut s’avérer nécessaire de modifier ces paramètres pour votre réseau. Vous trouverez des instructions à la section « Mise sous tension initiale du serveur », page 59. Informations connexes ¦ « Pour connecter le câble du port SER MGT », page 51 ¦ « Connexion des câbles du serveur », page 49 ? Pour connecter les câbles réseau Ethernet Le serveur est équipé de quatre connecteurs réseau Gigabit Ethernet RJ-45. Ces connecteurs sont numérotés NET0, NET1, NET2 et NET3. 1. Connectez le commutateur ou hub réseau au port Ethernet 0 (NET0) situé à l’arrière du châssis au moyen d’un câble de catégorie 5. Le port NET0 se trouve complètement à gauche dans le cluster réseau de 4 ports.54 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 FIGURE : Ports réseau Ethernet du processeur de service - Panneau arrière 2. Connectez le commutateur ou hub réseau aux ports Ethernet restants (NET1, NET2 et NET3), selon les besoins, au moyen de câbles de catégorie 5. Informations connexes ¦ « Connexion des câbles du serveur », page 49Connexion des câbles du serveur 55 ? Pour connecter d’autres câbles d’E/S ? Si votre configuration serveur comprend des modules d’extension PCIe, branchez les câbles d’E/S appropriés sur les connecteurs correspondants. FIGURE : Configuration des emplacements PCIe et PCIe/XAUI Informations connexes ¦ « Connexion des câbles du serveur », page 49 ? Pour préparer les cordons d’alimentation Le processeur de service fonctionne en tension de veille de 3,3 V, disponible dès qu’une source de courant est connectée au serveur. Si vous préférez que le serveur ne lance pas les diagnostics d’initialisation à ce moment-là, connectez uniquement l’extrémité côté courant du ou des cordons d’alimentation. ? Branchez les cordons dans les blocs d’alimentation. Remarque – Ne connectez pas les cordons d’alimentation aux sources de courant pour le moment. En effet, cela empêcherait l’affichage des messages d’initialisation et de diagnostic système générés au cours de la phase de mise sous tension. 56 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Informations connexes ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 61 Présentation de la gestion des câbles Le bras de gestion des câbles (CMA, Cable Management Arm) permet de mettre à l’abri les câbles externes du serveur et de les écarter du passage lors des opérations de maintenance. Il est compatible avec les deux types de kits de montage en rack : à vis (avec outil) et à clips (sans outil). Ce bras s’encastre sur les rails coulissants. Utilisez les bandes Velcro pour fixer les câbles au bras. FIGURE : Bras de gestion des câbles Informations connexes ¦ « Pour fixer les câbles du serveur au bras », page 57Connexion des câbles du serveur 57 ? Pour fixer les câbles du serveur au bras 1. Une fois les câbles du serveur connectés et disposés à l’intérieur du bras de gestion des câbles, ouvrez les bandes Velcro et enroulez-les autour du bras de façon à bien y fixer les câbles. FIGURE : Fixation des câbles du serveur à l’aide du bras et des bandes Velcro 2. Vérifiez le fonctionnement des rails coulissants, du bras de gestion de câbles et des boucles de maintenance des câbles. Recommencez les étapes de la procédure « Pour vérifier le fonctionnement des rails coulissants et du bras », page 46. Informations connexes ¦ « Présentation de la gestion des câbles », page 5658 Guide d’installation du serveur SPARC T3-1 • Octobre 201159 Mise sous tension initiale du serveur Les sections suivantes présentent des instructions relatives à la première initialisation du serveur et à l’activation du port de gestion réseau du processeur de service. Ce chapitre aborde les sujets suivants : ¦ « Présentation des tâches de mise sous tension initiale », page 59 ¦ « Présentation de la console système Oracle ILOM », page 60 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 61 ¦ « Pour mettre le serveur sous tension pour la première fois », page 62 ¦ « Pour vérifier la fonctionnalité système », page 64 ¦ « Pour assigner une adresse IP statique au processeur de service », page 64 Présentation des tâches de mise sous tension initiale Lorsque vous mettez sous tension le serveur pour la première fois, vous devez suivre plusieurs étapes qui ne vous seront plus demandées lors des mises sous tension ultérieures. Etape préparatoire Objectif Connectez un terminal ou un émulateur de terminal au port SER MGT. Cette étape permet de se connecter au processeur de service avant qu’il ne soit configuré pour l’accès réseau. « Pour connecter un terminal ou un émulateur au port SER MGT », page 61 Connectez-vous au processeur de service et modifiez le mot de passe root par défaut. Pour protéger le système contre tout accès superutilisateur non autorisé, remplacez le mot de passe par défaut par une valeur sécurisée. « Pour mettre le serveur sous tension pour la première fois », page 6260 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Présentation de la console système Oracle ILOM Lorsque vous mettez le système sous tension, le processus d’initialisation commence sous le contrôle de la console système Oracle ILOM. Celle-ci affiche les messages de statut et d’erreur générés par les tests effectués par le microprogramme pendant le démarrage du système. Remarque – Pour afficher ces messages de statut et d’erreur, connectez un terminal ou un émulateur de terminal au port de gestion série (SER MGT) avant de mettre le serveur sous tension. Une fois que la console système a terminé ses diagnostics système de bas niveau, le processeur de service initialise et exécute une série de diagnostics d’un niveau supérieur. Lorsque vous accédez au processeur de service au moyen d’un périphérique connecté au port de gestion série, la sortie des diagnostics Oracle ILOM est générée à votre intention. Par défaut, le processeur de service configure automatiquement le port de gestion réseau, récupérant les paramètres de configuration réseau à l’aide du protocole DHCP (Dynamic Host Configuration Protocol) et autorisant les connexions via un shell sécurisé (SSH, Secure Shell). Pour une discussion plus détaillée concernant la configuration de la console système et de la connexion de terminaux, reportez-vous à la documentation d’administration système de votre serveur. Démarrez la console système Oracle ILOM. Cette étape vous permet de contrôler la sortie générée par le microprogramme Oracle ILOM suite à l’initialisation du système. « Pour mettre le serveur sous tension pour la première fois », page 62 Configurez le SE Oracle Solaris. La version préinstallée du SE Oracle Solaris est livrée déconfigurée. « Pour mettre le serveur sous tension pour la première fois », page 62 (Le cas échéant) Indiquez une adresse IP statique. Le protocole d’adressage IP par défaut est DHCP. Si le serveur va être connecté à un réseau qui utilise l’adressage IP statique, vous devez assigner une adresse IP statique au processeur de service. « Pour assigner une adresse IP statique au processeur de service », page 64 Etape préparatoire ObjectifMise sous tension initiale du serveur 61 Informations connexes ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 61 ¦ « Pour mettre le serveur sous tension pour la première fois », page 62 ? Pour connecter un terminal ou un émulateur au port SER MGT Une configuration de type inverseur est requise pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. 1. Connectez un terminal ou un émulateur de terminal (PC ou station de travail) au port de gestion série du processeur de service. 2. Configurez ce terminal ou cet émulateur de terminal avec les paramètres suivants : ¦ 9 600 bauds ¦ 8 bits ¦ Pas de parité ¦ 1 bit d’arrêt ¦ Pas de protocole de transfert 3. (Facultatif) Connectez au moyen d’un câble Ethernet le port Net MGT du serveur au réseau avec lequel les futures connexions au SP et à l’hôte seront établies. Informations connexes ¦ « Présentation de la console système Oracle ILOM », page 60 ¦ « Pour mettre le serveur sous tension pour la première fois », page 6262 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ? Pour mettre le serveur sous tension pour la première fois 1. Vérifiez la totalité des étapes de préparation à l’installation. Reportez-vous aux instructions de la section « Préparation de l’installation », page 1. 2. Vérifiez l’installation du serveur dans son rack. Reportez-vous aux instructions de la section « Installation du serveur », page 23. 3. (Recommandé) Connectez au moyen d’un câble Ethernet l’un des ports NET du serveur au réseau avec lequel le serveur communiquera. Remarque – Une fois la configuration initiale du système effectuée, la communication avec le processeur de service et l’hôte est généralement assurée par le biais d’une interface Ethernet. 4. Branchez les cordons d’alimentation sur les alimentations et des sources de courant distinctes. Pour assurer la redondance, branchez les deux alimentations sur des sources de courant distinctes. Le système peut fonctionner avec une seule connexion d’alimentation, mais il ne bénéficie alors d’aucune redondance. Le processeur de service fonctionne sur la tension de veille de 3,3 V. Dès que l’alimentation CA est reliée au système, le processeur de service est mis sous tension, exécute des diagnostics et initialise le microprogramme ILOM. Après quelques minutes, l’invite de connexion du SP s’affiche sur le périphérique terminal. L’hôte n’est pas encore initialisé ou mis sous tension. 5. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. hsotname login: root Password: changeme . . . ->Mise sous tension initiale du serveur 63 6. Changez le mot de passe root. 7. Mettez le serveur sous tension et redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console de l’hôte démarrée, l’initialisation du serveur prend une vingtaine de minutes. 8. Configurez le système d’exploitation en spécifiant les valeurs de paramètres demandées dans la série d’instructions qui s’affiche à l’écran. Conseil – Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la ultérieurement lorsque le SE est exécuté. Remarque – Vous serez invité à confirmer la configuration à plusieurs reprises. Vous serez en mesure de modifier les valeurs des paramètres si vous le souhaitez à chacun de ces points confirmation. 9. (Facultatif) Déployez le serveur pour l’usage prévu. Une fois que le serveur est configuré et que vous avez changé le mot de passe par défaut, le serveur est prêt à être utilisé normalement. Informations connexes ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 61 ¦ « Connexion des câbles du serveur », page 49 ¦ « Pour assigner une adresse IP statique au processeur de service », page 64 ... Warning: password is set to factory default. -> set /SP/users/root password Enter new password: ******** Enter new password again: ******** -> -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. To stop, type #. . . .64 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 ? Pour vérifier la fonctionnalité système ? Après la mise sous tension initiale du système, utilisez le logiciel Sun Validation Test Suite (Sun VTS) afin de vérifier le fonctionnement et les performances du système, notamment les connexions réseau. Pour obtenir des instructions concernant l’exécution des utilitaires de tests, reportez-vous à la documentation de Sun VTS disponible à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id= homepage ? Pour assigner une adresse IP statique au processeur de service Si le réseau auquel le serveur est connecté ne prend pas en charge le protocole d’adressage IP DHCP, mettez à jour la configuration du SE pour un adressage IP statique et assignez une adresse IP statique au processeur de service en procédant de la manière suivante. 1. Définissez le processeur de service pour qu’il accepte une adresse IP statique. 2. Définissez l’adresse IP du processeur de service. 3. Définissez l’adresse IP de la passerelle du processeur de service. 4. Définissez le masque de réseau du processeur de service. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0' Mise sous tension initiale du serveur 65 Cet exemple utilise 255.255.255.0 pour définir le masque de réseau. Le sous-réseau de votre environnement réseau peut exiger un masque de réseau différent. Utilisez un numéro de masque de réseau approprié à votre environnement. 5. Utilisez la commande show /SP/network pour vérifier que les paramètres ont été configurés correctement. 6. Validez les modifications apportées aux paramètres réseau du processeur de service. Remarque – Vous pouvez réexécuter la commande show /SP/network (après la commande set /SP/network commitpending=true) afin de vérifier que les paramètres ont bien été mis à jour. Informations connexes ¦ « Pour mettre le serveur sous tension pour la première fois », page 62 -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true' 66 Guide d’installation du serveur SPARC T3-1 • Octobre 201167 Index A Acoustiques, 10 Adaptateurs pour câbles de données série, 51 Alimentation en CA initiale, 59 Assemblage de gestion de câbles, 48 B Bit d’arrêt, 61 Bit, paramètre du terminal série, 61 Bouton de dégagement du support de montage, 29 Broches sur les supports de montage, 35 C Circulation de l’air, 11 Circulation de l’air, conditions requises, 11 Conformité, 10 Connecteur de port vidéo DB-15 VGA, 50 Connexions de câbles minimales, 49 D Diagnostics, exécution, 62 E Emissions sonores, 10 Enfichage à chaud des ports USB, 50 Entretoise pour les rails coulissants, 33 Environnement d’exploitation, 11 Environnementales, 6 Espace libre, 5 I Initialisation du système, 59 Installation des composants optionnels, 21 L Levier de la partie centrale, 30 Levier, verrouillage, Voir Verrous des assemblages de rails coulissants, 49 M Mise sous tension initiale, 62 Modem non adapté au port de gestion série SER MGT, 52 Montage en rack, vis, 32 P Parité du terminal série, aucune, 61 Physiques, 5 Protocole de transfert du terminal série, aucun, 61 R Retrait du rail coulissant, 35 RJ-45, câble, 49 S Serveur, 4 Support de montage, 35 Support de montage, verrou de broche de repère, 32 T Tension de veille de 3,3 V, 55, 62 V Verrous des rails coulissants avant, 29 Vitesse de transmission du terminal série en bauds, 6168 Guide d’installation du serveur SPARC T3-1 • Octobre 2011 Serveurs de la série SPARC T3 Guide d’administration N° de référence : E26261 Octobre 2011, révision AProduit recyclable Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation ix Présentation des ressources de l’administration système 1 Présentation d’ILOM 1 Fonctions d’ILOM spécifiques à la plate-forme 3 Présentation du SE Oracle Solaris 4 Présentation d’OpenBoot 4 Présentation d’Oracle VM Server pour SPARC 5 Logiciel de multiacheminement 6 Présentation du pack de gestion du matériel 7 Source du téléchargement du logiciel HMP (pack de gestion du matériel) 8 Source du téléchargement de la documentation HMP (pack de gestion du matériel) 9 Accès au serveur 11 ? Pour se connecter à ILOM 11 ? Pour se connecter à la console système 12 ? Pour afficher l’invite ok 13 ? Pour afficher l’invite -> d’ILOM 15 ? Pour utiliser un moniteur graphique local 15 ILOM Remote Console 17iv Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Contrôle du serveur 19 ? Pour mettre le serveur sous tension 19 ? Pour mettre le serveur hors tension 20 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris 21 ? Pour réinitialiser le serveur à partir d’ILOM 22 ? Pour rétablir les valeurs par défaut du SP 23 Configuration de volumes RAID matériels 25 Prise en charge des volumes RAID matériels 25 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques 28 Affichage des informations de zone de disques 29 Etat des zones de disques (zoningcli list) 30 Etat des zones de disques (probe-scsi-all) 31 Activation et désactivation du zonage des disques dans le champ 33 ? Activation des zones de disques (commande zoningcli) 34 ? Désactivation des zones de disques (commande zoningcli) 34 ? Mise à jour du microprogramme pour activer le zonage 34 Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs 35 ? Pour préparer l’utilisation de l’utilitaire FCode 36 Commandes de l’utilitaire FCode 37 ? Pour créer un volume RAID matériel 38 Disques hot spare de volumes RAID (LSI) 39 Diagnostic de l'état de fonctionnement d'un disque 40 DEL avant du disque de service requis 40 Messages d'erreur (console système et fichiers journaux) 40 ? Affichage de l'état (commande show-volumes, OBP) 41 ? Affichage de l'état (utilitaire sas2ircu, LSI) 42Sommaire v Stratégies de remplacement d'un disque RAID 43 ? Pour identifier les chemins d’accès aux périphériques 43 Modification des informations d’identification du serveur 45 ? Pour modifier les informations sur les données FRU des clients 45 ? Pour modifier les informations d’identification du système 46 Configuration des paramètres de stratégie 47 ? Pour définir le mode de refroidissement 47 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage 48 ? Pour définir l’état d’alimentation de l’hôte au redémarrage 49 ? Pour désactiver ou réactiver le délai de mise sous tension 50 ? Pour définir l’initialisation parallèle du SP et de l’hôte 50 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé 51 Configuration des adresses réseau 53 Options d’adresse réseau du SP 53 ? Pour désactiver ou réactiver l’accès réseau au SP 54 ? Pour afficher l’adresse IP du serveur DHCP 54 ? Pour afficher l’adresse MAC de l’hôte 55 Utilisation d’une connexion in-band au SP 56 Gestion in-band (sideband) d’ILOM 56 ? Pour configurer l’accès in-band (sideband) au SP 57 Configuration du mode d’initialisation 61 Présentation du mode d’initialisation 61 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC 62 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations 64 ? Pour gérer le script du mode d’initialisation de l’hôte 65vi Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte 66 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur 66 Configuration du comportement du serveur au redémarrage 69 ? Pour définir le comportement de l’hôte à sa réinitialisation 69 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête 70 ? Pour définir l’intervalle du délai d’attente d’initialisation 70 ? Pour définir le comportement à l’expiration du délai d’initialisation 71 ? Pour définir le comportement en cas d’échec du redémarrage 71 ? Pour définir le nombre maximum de tentatives de redémarrage 72 Configuration des périphériques 73 ? Pour déconfigurer manuellement un périphérique 73 ? Pour reconfigurer manuellement un périphérique 74 Contrôle du serveur 75 Contrôle des pannes 75 Présentation des diagnostics 76 ? Pour détecter les pannes (ILOM) 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) 77 ? Pour détecter les pannes à l’aide du POST 79 ? Pour afficher l’historique de la console 80 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) 81 ? Pour effacer une panne 83 Activation de la récupération automatique du système 83 Présentation de la récupération automatique de système 84 ? Pour activer la fonction ASR 84 ? Pour désactiver la fonction ASR 85 ? Pour afficher des informations sur les composants concernés par l’ASR 86Sommaire vii ? Pour afficher les composants du serveur 86 ? Pour localiser le serveur 87 Mise à jour du microprogramme 89 ? Pour afficher la version du microprogramme 89 ? Pour mettre à jour le microprogramme 90 ? Pour afficher la version d’OpenBoot 92 ? Pour afficher la version de POST 93 Mise à jour du système d’exploitation Oracle Solaris 95 Syntaxe de nom universel 95 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) 99 probe-scsi-all Exemple de sortie (SPARC T3-4) 102 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs 103 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs 105 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) 107 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) 111 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique 115 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID 116 Index 119viii Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011ix Utilisation de cette documentation Ce guide d’administration s’adresse aux administrateurs système expérimentés des serveurs de la série SPARC T3 d’Oracle (ci-après appelé le « serveur »). Il comprend des informations descriptives générales sur le serveur ainsi que des instructions détaillées sur la configuration et l’administration du serveur. Pour utiliser les informations de ce document, vous devez maîtriser les concepts et la terminologie des réseaux informatiques ainsi que posséder une connaissance poussée du système d’exploitation Oracle Solaris (SE Oracle Solaris). Remarque – Le Guide d’administration des serveurs de la série SPARC T3 s’applique à plusieurs serveurs et modules serveur. Certains exemples utilisés dans ce document sont basés sur des modèles particuliers de serveur. C’est pourquoi votre sortie peut différer des exemples présentés selon le produit que vous utilisez. ¦ « Commandes UNIX », page ix ¦ « Invites de shell », page x ¦ « Documentation, support et formation », page x Commandes UNIX Ce document peut ne pas contenir d’informations sur les commandes et procédures UNIX de base telles que l’arrêt et le démarrage du système ou la configuration des périphériques. Vous trouverez de plus amples informations à ce sujet dans : ¦ la documentation accompagnant les logiciels livrés avec votre système ; ¦ la documentation relative au SE Oracle Solaris, disponible à l’adresse suivante : http://www.oracle.com/technetwork/indexes/documentation/ index.htmlx Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Invites de shell Documentation, support et formation Le site Web d'Oracle Technology Network contient des informations sur les ressources supplémentaires suivantes : ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Shell Invite C shell nom-machine% Superutilisateur C shell nom-machine# Bourne shell et Korn shell $ Superutilisateur Bourne shell et Korn shell #1 Présentation des ressources de l’administration système Les sections suivantes présentent un récapitulatif des outils courants servant à administrer le serveur. ¦ « Présentation d’ILOM », page 1 ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ¦ « Logiciel de multiacheminement », page 6 ¦ « Présentation du pack de gestion du matériel », page 7 Présentation d’ILOM Oracle Integrated Lights Out Manager est un microprogramme de gestion système préinstallé sur les serveurs SPARC de la série T4. Il vous permet de gérer et de contrôler de manière active les composants installés sur le serveur. ILOM fournit une interface Web et une interface de ligne de commande, ainsi que les interfaces SNMP et IPMI. Le processeur de service ILOM fonctionne indépendamment du serveur et quel que soit l’état de marche du serveur, du moment que ce dernier (ou le système modulaire contenant le module serveur) est alimenté en courant CA. Lorsque vous connectez un serveur à une alimentation CA, le processeur de service ILOM démarre immédiatement et commence à contrôler le serveur. ILOM gère l’ensemble des tâches de surveillance et de contrôle environnementaux. L’invite -> indique que vous interagissez directement avec le processeur de service ILOM. Il s’agit de la première invite qui s’affiche lorsque vous vous connectez au serveur via le port de gestion série ou le port de gestion réseau, quel que soit l’état 2 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 d’alimentation de l’hôte. Sur un système modulaire, cette invite est également présente lorsque vous vous connectez à un module serveur soit directement soit via ILOM sur le module CMM du système modulaire. Vous pouvez également accéder à l’invite du processeur de service ILOM (->) à partir de l’invite ok de l’OpenBoot ou de l’invite # ou % d’Oracle Solaris, du moment que la console système est configurée pour être accessible via les ports de gestion série et réseau. Le processeur de service ILOM prend en charge un total de dix sessions simultanées par serveur : neuf connexions SSH via le port de gestion réseau et une via le port de gestion série. Pour plus d’informations sur l’utilisation des fonctions ILOM communes à toutes les plates-formes gérées par ILOM, consultez la documentation suivante à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage Informations connexes ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Pour se connecter à ILOM », page 11 Type d’information Titre Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur l’interface du navigateur Guide des procédures relatives à l’interface Web d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur les procédures CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations relatives aux protocoles SNMP et IPMI Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocols Reference Guide (Guide de référence des protocoles de gestion d’Oracle Integrated Lights Out Manager (ILOM) 3.0) Informations relatives à l’installation et à la configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur le module CMM Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM - Guide d’administration pour les systèmes modulaires 6000 et 6048 Présentation des ressources de l’administration système 3 Fonctions d’ILOM spécifiques à la plate-forme ILOM fonctionne sur diverses plates-formes, dont il prend en charge les fonctions qui leur sont communes. Certaines des fonctions d’ILOM sont limitées à un sous-ensemble de plates-formes. Cette section décrit la différence entre les fonctions d’ILOM prises en charge par le serveur et le jeu de fonctions communes décrit dans la documentation de base d’ILOM 3.0. Remarque – Pour effectuer certaines procédures décrites dans la documentation de base d’Oracle ILOM 3.0, vous devez établir une connexion série avec le serveur et activer le commutateur de présence physique sur ce dernier. Pour plus d’informations sur l’établissement d’une connexion série, reportez-vous au guide d’installation de votre serveur. Parmi les fonctions d’ILOM prises en charge sur d’autres plates-formes, les suivantes ne sont pas compatibles avec ce serveur : ¦ Fonctions du module de contrôle de châssis (CMM, Chassis Monitoring Module) telles que la connexion unique SSO (Single Sign On). Remarque : les serveurs lames T3 installés dans un système modulaire prennent en charge les fonctions du CMM. ¦ Déclencheur user-reset de diagnostics du POST non disponible ILOM prend en charge la fonction suivante sur ce serveur, mais cette dernière peut très bien ne pas être disponible sur d’autres plates-formes : ¦ Déclencheur hw-change de diagnostics du POST. Ce nouveau déclencheur (hw-change error-reset) constitue le paramètre par défaut du serveur. Il déclenche l’exécution du test POST chaque fois que le serveur est mis sous tension progressive CA ou que le capot du haut est retiré (le cas échéant). Pour plus d’informations sur le POST, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Présentation d’ILOM », page 14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation du SE Oracle Solaris Le SE Oracle Solaris comprend des commandes et d’autres ressources logicielles utilisées dans le cadre de l’administration du serveur. Pour une introduction aux outils de gestion de votre version d’Oracle Solaris, reportez-vous au manuel System Administration Guide: Basic Administration dans la collection de documents Oracle Solaris. Le logiciel SunVTS est inclus dans Oracle Solaris. Il permet de tester et de valider le matériel Oracle en contrôlant la connectivité et la fonctionnalité des périphériques, contrôleurs et dispositifs matériels. Outre les informations relatives à SunVTS contenues dans la documentation d’Oracle Solaris, les collections de documentation propres à SunVTS sont disponibles à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id=homepage Informations connexes ¦ « Présentation d’OpenBoot », page 4 Présentation d’OpenBoot Le microprogramme OpenBoot démarre le système d’exploitation, valide le matériel installé et permet d’effectuer d’autres tâches d’administration serveur situées en dessous du niveau du SE. Pour plus d’informations sur les commandes d’OpenBoot, reportez-vous au manuel OpenBoot 4.x Command Reference Manual inclus dans la collection de documents Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4Présentation des ressources de l’administration système 5 Présentation d’Oracle VM Server pour SPARC Un domaine logique regroupe de manière logique et discrète ses propres ressources, systèmes d’exploitation et identité au sein d’un seul système informatique. Les applications logicielles peuvent être exécutées dans les domaines logiques. Il est possible de créer, de détruire, de reconfigurer et de réinitialiser chaque domaine logique indépendamment des autres. Le logiciel Oracle VM Server pour SPARC vous permet de créer et de gérer jusqu’à 32 domaines logiques en fonction de la configuration matérielle du serveur sur lequel Oracle VM Server pour SPARC Manager est installé. Vous avez la possibilité de virtualiser les ressources et de définir des périphériques réseau, de stockage et d’E/S en tant que services pouvant être partagés entre les différents domaines. Les configurations Oracle VM Server pour SPARC sont stockées sur le SP. A l’aide des commandes de la CLI d’Oracle VM Server pour SPARC, vous pouvez ajouter une configuration, spécifier la configuration à utiliser et répertorier les configurations figurant sur le processeur de service. Vous avez également la possibilité d’utiliser la commande set /HOST/bootmode config=fichier_de_configuration d’ILOM pour indiquer la configuration d’initialisation d’Oracle VM Server. Informations connexes ¦ « Configuration du mode d’initialisation », page 61 ¦ Documentation d'Oracle VM Server pour SPARC http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html6 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Logiciel de multiacheminement Le logiciel de multiacheminement vous permet de définir et de contrôler les chemins physiques redondants des périphériques d’E/S, tels que les périphériques de stockage et les interfaces réseau. Si le chemin d’accès actif à un périphérique devient indisponible, le logiciel peut automatiquement basculer sur un chemin secondaire pour maintenir la disponibilité. Cette fonction est connue sous l’appellation de basculement automatique. Pour tirer parti des fonctions de multiacheminement, vous devez configurer le serveur avec du matériel redondant, par exemple des interfaces réseau redondantes ou deux adaptateurs de bus hôte connectés à la même baie de stockage à double accès. Pour le serveur, trois types différents de logiciel de multiacheminement sont disponibles : ¦ Le logiciel Oracle Solaris IP Network Multipathing assure le multiacheminement et l’équilibrage de charge pour les interfaces réseau IP. Pour des instructions de configuration et d’administration du logiciel Oracle Solaris IP Network Multipathing, consultez le manuel IP Network Multipathing Administration Guide fourni avec votre version d’Oracle Solaris. ¦ Le logiciel VVM inclut une fonction appelée DMP, qui assure le multiacheminement pour les disques ainsi que l’équilibrage de charge des disques en vue d’optimiser le débit d’E/S. Pour des informations sur VVM et sa fonction DMP, reportez-vous à la documentation qui accompagne le logiciel VERITAS Vo lume Ma na ger. ¦ StorageTek Traffic Manager est une architecture entièrement intégrée au sein du SE Oracle Solaris (à partir de la version Oracle Solaris 8) qui permet d’accéder aux périphériques d’E/S par le biais de plusieurs interfaces de contrôleur hôte depuis une unique instance du périphérique d’E/S. Pour plus d’informations sur StorageTek Traffic Manager, reportez-vous à la documentation de votre SE Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5Présentation des ressources de l’administration système 7 Présentation du pack de gestion du matériel Le pack de gestion du matériel (HMP) des serveurs Sun d'Oracle fournit des outils qui permettent de gérer et de configurer les serveurs Oracle à partir du système d'exploitation de l'hôte. Pour utiliser ces outils, vous devez installer le logiciel HMP sur votre serveur. Une fois le logiciel installé, vous pouvez effectuer les tâches de gestion de serveur décrites dans le tableau ci-après. TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil Surveillance du matériel Oracle avec l'adresse IP de l'hôte Utilisez l'agent de gestion du matériel et les plug-ins du protocole SNMP (Simple Network Management Protocol) au niveau du système d'exploitation pour activer la surveillance in-band de votre matériel Oracle. Cette fonctionnalité de surveillance in-band vous permet d'utiliser l'adresse IP du système d'exploitation hôte pour surveiller vos serveurs Oracle sans connecter le port de gestion Oracle ILOM à votre réseau. Outil de gestion au niveau du système d'exploitation hôte Surveillance des périphériques de stockage, notamment des baies de disque RAID Utilisez l'agent de gestion du stockage du serveur au niveau du système d'exploitation pour activer la surveillance in-band des périphériques de stockage configurés sur vos serveurs Oracle. L'agent de gestion du stockage du serveur fournit un démon de système d'exploitation qui collecte des informations sur les périphériques de stockage du serveur, notamment les disques durs et les baies RAID, puis les envoie au processeur de service Oracle ILOM. Les fonctions de surveillance du stockage dans Oracle ILOM vous permettent de consulter et de surveiller les informations fournies par l'agent de gestion du stockage du serveur. Vous pouvez accéder aux fonctions de surveillance du stockage dans Oracle ILOM à partir de l'interface de ligne de commande (CLI). Fonctions de surveillance du stockage de la CLI Oracle ILOM 3.0 Interrogation, mise à jour et validation des versions de microprogramme sur les périphériques de stockage SAS pris en charge Utilisez l'outil CLI fwupdate à partir du système d'exploitation hôte pour interroger, mettre à jour et valider les versions de microprogramme sur les périphériques de stockage pris en charge, tels que les adaptateurs de bus hôte SAS (HBA), les contrôleurs de stockage SAS intégrés, les expandeurs de stockage SAS LSI et les disques durs. CLI fwupdate au niveau du SE hôte8 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Source du téléchargement du logiciel HMP (pack de gestion du matériel) Vous pouvez télécharger le logiciel HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://support.oracle.com Restauration, définition et consultation des paramètres de configuration d'Oracle ILOM Utilisez l'outil CLI ilomconfig à partir du système d'exploitation hôte pour restaurer les paramètres de configuration d'Oracle ILOM, ainsi que pour consulter et définir les propriétés d'Oracle ILOM associées à la gestion du réseau, la configuration de l'horloge et la gestion des utilisateurs. CLI ilomconfig au niveau du SE hôte Affichage ou création de volumes RAID sur des unités de stockage Utilisez l'outil CLI raidconfig à partir du système d'exploitation hôte pour consulter et créer des volumes RAID sur les unités de stockage connectées aux contrôleurs RAID, notamment les baies de stockage. CLI raidconfig au niveau du SE hôte Utilisation de l'outil IPMItool pour accéder aux serveurs Oracle et les gérer Utilisez la ligne de commande « open source » IPMItool à partir du système d'exploitation hôte pour accéder aux serveurs Oracle et les gérer à l'aide du protocole IPMI. Ligne de commande IMPItool au niveau du SE hôte * Les systèmes d'exploitation pris en charge sont les suivants : Solaris, Linux, Windows et VMware TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur (suite) Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel OutilPrésentation des ressources de l’administration système 9 Source du téléchargement de la documentation HMP (pack de gestion du matériel) Vous pouvez télécharger la documentation HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://www.oracle.com/technetwork/documentation/sys-mgmt-network ing-190072.html Remarque – La documentation du pack de gestion du matériel version 2.1 fournie sur ce site est valable pour le pack de gestion du matériel version 2.1.1. Pour plus d'informations sur l'utilisation des fonctions de contrôle de stockage dans Oracle ILOM, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (Guide des notions fondamentales d'Oracle Integrated Lights Out Manager (ILOM) 3.0) et au Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (Guide des procédures relatives à la CLI d'Oracle Integrated Lights Out Manager (ILOM) 3.0). Pour plus d'informations sur l'accès et la gestion d'un serveur via SNMP ou IPMI, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (Guide des références des protocoles de gestion Oracle Integrated Lights Out Manager (ILOM) 3.0). Les liens vers ces manuels Oracle ILOM sont fournis sur le site Web indiqué ci-dessus. Vous trouverez l'intégralité de la documentation Oracle ILOM à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage10 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201111 Accès au serveur Les sections suivantes présentent des informations relatives à l’établissement de communications de bas niveau avec le serveur à l’aide de l’outil ILOM et de la console système. ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour se connecter à la console système », page 12 ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « ILOM Remote Console », page 17 ? Pour se connecter à ILOM Dans cette procédure, il est supposé que vous utilisez la configuration par défaut du processeur de service comme décrite dans le guide d’installation du serveur. Remarque – Pour un module serveur SPARC T3, consultez le guide d’installation qui contient des instructions relatives au démarrage d’ILOM via le module CMM du système modulaire, ainsi que des instructions concernant la connexion directe au processeur de service sur le module serveur.12 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Ouvrez une session SSH et connectez-vous au SP en spécifiant son adresse IP. Le nom d’utilisateur par défaut ILOM est root et le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM. Exécutez les tâches nécessaires. Remarque – Pour bénéficier d’une sécurité optimale sur le serveur, changez le mot de passe par défaut de ce dernier. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à la console système », page 12 ? Pour se connecter à la console système ? A l’invite -> d’ILOM, tapez : où option correspond à l’une des valeurs suivantes : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright 2010 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accès au serveur 13 ¦ -f|force : permet à un utilisateur doté du rôle Console (c) de prendre la console à l’utilisateur qui y est connecté et d’obliger ce dernier à utiliser le mode de visualisation. ¦ -script : contourne l’invite de confirmation (yes ou no). Remarque – Si le SE Oracle Solaris n’est pas en cours d’exécution, le serveur affiche l’invite ok. Informations connexes ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « Pour se connecter à ILOM », page 11 ? Pour afficher l’invite ok Dans cette procédure, il est supposé que vous utilisez la configuration par défaut de la console système. ? Dans le tableau suivant, choisissez la méthode d’arrêt appropriée pour accéder à l’invite ok. Pour s'assurer que l'invite ok s'affiche, définissez la propriété ILOM suivante avant d'exécuter les procédures décrites dans le tableau : -> set /HOST/bootmode script=”setenv auto-boot? false”14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Attention – Dans la mesure du possible, affichez l’invite ok en effectuant un arrêt progressif du SE. Toute autre méthode risque d'entraîner la perte des informations d'état du serveur. Informations connexes ¦ « Contrôle des pannes », page 75 Etat du serveur Procédure à suivre SE en cours d’exécution et réactif Arrêtez le serveur en utilisant l’une des méthodes suivantes : • Dans une fenêtre d’utilitaire de shell ou de commande, tapez une commande appropriée (par exemple, la commande shutdown ou init 0), comme décrit dans la documentation relative à l’administration système d’Oracle Solaris. • A l’invite -> d’ILOM, tapez : -> stop /SYS • Appuyez sur le bouton de marche/arrêt du serveur. • A partir d’Oracle Solaris, exécutez la commande suivante en tant qu’utilisateur root : # uadmin 2 0 SE non réactif Arrêtez le serveur à partir d’ILOM. (à condition que le logiciel de système d’exploitation ne soit pas en cours d’exécution et que le serveur soit déjà sous le contrôle du microprogramme OpenBoot) A l’invite -> d’ILOM, tapez : -> set /HOST send_break_action=break Appuyez sur Entrée. Tapez ensuite : -> start /HOST/console SE non réactif et initialisation automatique devant être empêchée Arrêtez le serveur à partir d’ILOM et désactivez la fonction d’initialisation automatique. A l’invite -> d’ILOM, tapez : -> set /HOST/bootmode script=”setenv auto-boot? false” Appuyez sur Entrée. Tapez ensuite : -> reset /SYS -> start /HOST/consoleAccès au serveur 15 ? Pour afficher l’invite -> d’ILOM ? Utilisez l’une des méthodes suivantes pour afficher l’invite -> d’ILOM : ¦ A partir de la console système, tapez la séquence d’échappement (#.) d’ILOM. ¦ Connectez-vous directement à ILOM à partir d’un périphérique relié au port de gestion série ou au port de gestion réseau. ¦ Connectez-vous à ILOM via une connexion SSH. Reportez-vous à la section « Pour se connecter à ILOM », page 11. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à ILOM », page 11 ? Pour utiliser un moniteur graphique local Vous pouvez rediriger la console système vers un moniteur graphique local. Vous ne pouvez pas utiliser un moniteur graphique local pour effectuer l’installation initiale du serveur, ni pour afficher les messages de l’autotest de l’allumage (POST). Pour utiliser un moniteur graphique local : 1. Connectez le câble vidéo du moniteur à un port vidéo du serveur. Fixez les vis à serrage à main pour maintenir la connexion. Reportez-vous à la documentation de votre système pour connaître les instructions de connexion qui peuvent s’appliquer à votre serveur. 2. Branchez le cordon d’alimentation du moniteur sur une prise CA. 3. Connectez le câble de clavier USB à un port USB. 4. Connectez le câble de souris USB à un autre port USB sur le serveur. 5. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13.16 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 6. A l’invite ok, définissez les variables de configuration OpenBoot PROM suivantes : 7. Pour appliquer vos modifications, tapez : Le serveur enregistre les modifications de paramètres et s’initialise automatiquement. Remarque – Au lieu d’utiliser la commande reset-all pour stocker les modifications de paramètres, vous pouvez également mettre le serveur progressivement sous tension à l’aide du bouton de marche/arrêt. Vous pouvez à présent exécuter des commandes système et afficher les messages du système en utilisant le moniteur graphique local. Pour activer l’interface graphique, passez à l’étape suivante. 8. Activez l’interface graphique du SE Oracle Solaris. Une fois que le SE Oracle Solaris est installé et initialisé, tapez les commandes suivantes afin d’afficher l’écran de connexion de l’IG. Informations connexes ¦ « Pour afficher l’invite ok », page 13. ¦ « ILOM Remote Console », page 17 ok setenv input-device keyboard ok setenv output-device screen ok reset-all # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # rebootAccès au serveur 17 ILOM Remote Console ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques suivants sur un serveur hôte. Ce groupe de périphériques est couramment désigné par l’abréviation KVMS (Keyboard, Video, Mouse, Storage, c’est-à-dire clavier, vidéo, souris et stockage). ¦ Clavier ¦ Affichage vidéo de la console ¦ Souris ¦ Affichage série de la console ¦ Périphériques de stockage ou images (CD/DVD) ILOM Remote Console est documentée dans le manuel Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (à la section « Managing Remote Hosts Redirection and Securing the ILOM Remote Console »). Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 5618 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201119 Contrôle du serveur Les sections suivantes présentent les procédures de commande des opérations de base relatives au serveur. ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Pour rétablir les valeurs par défaut du SP », page 23 ? Pour mettre le serveur sous tension 1. Connectez-vous à ILOM. « Pour se connecter à ILOM », page 11. Remarque – Si vous disposez d’un système modulaire, assurez-vous que vous n’êtes pas connecté au module serveur souhaité. 2. A l’invite -> d’ILOM, tapez : Remarque – Pour éviter d’avoir à confirmer, utilisez la commande start -script /SYS. -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->20 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour mettre le serveur hors tension 1. Arrêtez le SE Oracle Solaris. A l’invite Oracle Solaris, tapez : 2. Passez de l’invite de la console système à celle de la console du processeur de service. 3. A partir de l’invite -> d’ILOM, tapez ce qui suit : Remarque – Pour exécuter un arrêt immédiat, utilisez la commande stop -force -script /SYS. Vérifiez que toutes les données sont enregistrées avant de taper cette commande. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs41-58 syslogd: going down on signal 15 svc.stard: The system is down. syncing file systems...done Program terminated r)eboot o)k prompt, h)alt? # o ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Contrôle du serveur 21 Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris Il est inutile de mettre le serveur hors puis sous tension pour effectuer une réinitialisation. ? Pour réinitialiser le serveur à partir de l’invite d’Oracle Solaris, tapez l’une des commandes suivantes : ou Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 # shutdown -g0 -i6 -y # reboot22 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour réinitialiser le serveur à partir d’ILOM La commande reset d’ILOM entraîne une réinitialisation matérielle progressive ou forcée du serveur. Par défaut, la commande reset effectue une réinitialisation progressive du serveur. ? Tapez l’une des commandes suivantes pour réinitialiser le serveur. ¦ Procédez à une réinitialisation progressive à partir d’ILOM : ¦ Si cette opération est impossible, effectuez une réinitialisation matérielle forcée à partir d’ILOM : Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 -> reset /SYS -> reset -force /SYSContrôle du serveur 23 ? Pour rétablir les valeurs par défaut du SP Si le processeur de service (SP) est endommagé ou que vous souhaitez rétablir ses valeurs par défaut définies en usine, modifiez le paramètre /SP reset_to_defaults, puis mettez l’hôte hors tension afin d’appliquer les modifications. Il s’agit d’un nouveau comportement. Dans les versions précédentes, il était inutile de mettre l’hôte hors tension pour rétablir les valeurs par défaut du SP. Vous devez disposer des autorisations d’administrateur pour effectuer cette tâche. 1. Pour rétablir les valeurs par défaut du SP, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ all : supprime l’ensemble des données de configuration du SP. ¦ factory : supprime l’ensemble des données de configuration du SP de même que tous les fichiers journaux. 2. La mise hors tension suivie du redémarrage de l’hôte permet d’achever les changements de paramètres. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP24 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201125 Configuration de volumes RAID matériels Les sections suivantes décrivent les procédures de configuration et de gestion des volumes de disques RAID à l’aide des contrôleurs de disque SAS intégrés du serveur. ¦ « Prise en charge des volumes RAID matériels », page 25 ¦ « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28 ¦ « Affichage des informations de zone de disques », page 29 ¦ « Activation et désactivation du zonage des disques dans le champ », page 33 ¦ « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Disques hot spare de volumes RAID (LSI) », page 39 ¦ « Diagnostic de l'état de fonctionnement d'un disque », page 40 ¦ « Stratégies de remplacement d'un disque RAID », page 43 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 Prise en charge des volumes RAID matériels Les serveurs de la série SPARC T3 contiennent des contrôleurs RAID SAS 2 intégrés qui permettent la formation de volumes de disques logiques composés d'un ou plusieurs disques durs redondants. Ces contrôleurs prennent en charge les niveaux RAID suivants : ¦ RAID 0 : répartition des données26 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ RAID 1 : mise en miroir des données (à l'aide de deux disques) ¦ RAID 1e : mise en miroir améliorée (à l'aide de trois à huit disques) La répartition des données fait référence à la technique de distribution des fichiers de données sur plusieurs disques, de sorte que le stockage et la récupération puissent être effectués en parallèle sur plusieurs canaux de données. La répartition des données peut réduire le temps nécessaire à la lecture et l'écriture des fichiers de données. La mise en miroir des données fait référence à la technique de stockage de copies identiques de données sur des disques séparés. La mise en miroir des données critiques permet de réduire les risques de perte de données grâce à la création d'instances dupliquées des données. Le tableau suivant décrit les ressources des contrôleurs RAID par défaut fournies sur les différents serveurs de la série SPARC T3. TABLEAU : Contrôleurs SAS-2 intégrés sur les serveurs de la série SPARC T3 Modèle SPARC T3 Détails du contrôleur SAS-2 intégré et du fond de panier de disques T3-1 Deux contrôleurs intégrés et un fond de panier de disques. Il existe deux versions du fond de panier de disques T3-1 : Capacité de huit disques : – Le contrôleur 0 gère les emplacements de disque 0 à 3 – Le contrôleur 1 gère les emplacements de disque 4 à 7 Capacité de seize disques (zones activées) : * – Le contrôleur 0 gère les emplacements de disque 0 à 7 – Le contrôleur 1 gère les emplacements de disque 8 à 15 * Les fonds de panier d'une capacité de seize disques doivent être divisés en deux zones de huit disques. Pour plus d’informations, reportez-vous à la section « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. T3-1B Un contrôleur intégré et deux fonds de panier de disques dotés de deux emplacements de disque chacun. Le contrôleur intégré est connecté aux deux fonds de panier par deux câbles de données et deux câbles d'alimentation. T3-2 Un contrôleur intégré et un fond de panier de disques doté de six emplacements de disque. Le contrôleur intégré est connecté au fond de panier par deux câbles de données distincts. T3-4 Aucun contrôleur intégré, deux modules d'extension RAID (REM) enfichables internes et deux fonds de panier de disques : – REM 0 gère les emplacements de disque 0 à 3 (fond de panier 0) – REM 1 gère les emplacements de disque 4 à 7 (fond de panier 1)Configuration de volumes RAID matériels 27 Chaque contrôleur SAS-2 vous permet de créer jusqu'à deux volumes RAID contenant des disques connectés à ce contrôleur. Un volume ne peut pas contenir des disques connectés à un autre contrôleur. Vous avez le choix entre trois environnements pour créer et gérer les ressources RAID sur votre serveur. ¦ Utilitaire Fcode : Cet utilitaire se compose d’un ensemble de commandes permettant d’afficher les cibles et de gérer les volumes logiques de votre serveur. Vous accédez à ces commandes via l'environnement OpenBoot PROM (OBP). Les exemples figurant dans ce manuel s'appuient sur les commandes Fcode. ¦ Utilitaire de gestion LSI SAS2 2008 RAID pour serveurs SPARC T3 : Vous pouvez utiliser les commandes sas2ircu contenues dans l'utilitaire de configuration intégré LSI SAS2 pour configurer et gérer les volumes RAID sur votre serveur. Pour utiliser le jeu de commandes sas2ircu, téléchargez et installez le logiciel SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/index.aspx Vous pouvez télécharger la documentation SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Pack de gestion du matériel Oracle 2.1.1 : Vous pouvez utiliser les commandes RAIDconfig figurant dans le compostant Outils de l'interface CLI des serveurs Oracle de ce logiciel pour créer et gérer des volumes RAID sur votre serveur. Pour utiliser ces commandes, téléchargez et installez la toute dernière version du pack de gestion du matériel à partir du site My Oracle Support : http://support.oracle.com/CSP/ui/flash.html Cliquez sur le lien suivant pour accéder au guide d'installation du pack de gestion du matériel Oracle 2.1. http://download.oracle.com/docs/cd/E19960-01/index.html Remarque – La version 2.1.1 est la plus ancienne version du pack de gestion du matériel Oracle prenant en charge les serveurs de la série SPARC T3. Vous trouverez une documentation complète sur l'utilisation du pack de gestion du matériel version 2.1 à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21&id=homepage28 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Conseil – Certaines commandes du pack de gestion du matériel 2.1.1 présentent parfois de longs délais de démarrage ou d'exécution sur les serveurs SPARC T3-2 and T3-4. Dans de tels cas, vous pouvez, si vous le préférez, utiliser les commandes Fcode ou LSI sas2ircu. Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques Chaque fois qu'un fond de panier à seize disques SPARC T3-1 est géré par des contrôleurs SAS-2 intégrés, le fond de panier doit être divisé en deux zones logiques, à raison de huit emplacements de disque par zone : ¦ Zone A : Contient les emplacements de fond de panier 0 à 7 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 0. ¦ Zone B : Contient les emplacements de fond de panier 8 à 15 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 1. Le zonage des disques nécessite que le microprogramme de l'expandeur LSI du fond de panier dispose au minimum du patch 147034-01. Ce patch crée les zones de disques requises. Remarque – Pour plus d'informations sur le patch 147034-01, reportez-vous à son document LISEZ-MOI (README.147034) sur le site My Oracle Support. Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35.Configuration de volumes RAID matériels 29 Si une carte HBA RAID PCIe interne est utilisée pour gérer le fond de panier des disques au lieu des contrôleurs intégrés, les zones de disques doivent être désactivées. La plupart des serveurs SPARC T3-1 dotés de fonds de panier à seize disques sont livrés avec le zonage activé. Il existe deux exceptions à cette règle par défaut : ¦ Le zonage est désactivé à l'usine lorsqu'un système SPARC T3-1 doté d'un fond de panier à seize disques est fabriqué avec une carte HBA RAID PCIe interne. ¦ Les systèmes SPARC T3-1 fabriqués avec des fonds de panier à 16 disques avant que le zonage des disques ne devienne une spécification par défaut étaient livrés sans le patch 147034-01. Pour ces systèmes, le patch doit être installé dans le champ pour prendre en charge le zonage des disques. La version 2.1.1 du pack de gestion du matériel des serveurs Sun d'Oracle inclut un utilitaire de zonage de disques que vous pouvez utiliser pour activer et désactiver le zonage, ainsi que pour afficher les informations d'état des zones. Voir « Activation et désactivation du zonage des disques dans le champ », page 33 et « Affichage des informations de zone de disques », page 29 pour plus d'informations. Remarque – Les contrôleurs n'étant pas en mesure de voir les disques au delà d'une zone, un contrôleur SAS-2 ne peut pas créer un volume RAID qui contient des disques inclus dans l'autre zone. Vous pouvez utiliser l'utilitaire zoningcli pour activer ou désactiver le zonage dans un fond de panier à seize disques. Pour plus d’informations, reportez-vous à la section « Activation et désactivation du zonage des disques dans le champ », page 33. Affichage des informations de zone de disques Ces rubriques décrivent deux méthodes d'accès aux informations de zonage de disques. ¦ « Etat des zones de disques (zoningcli list) », page 30 ¦ « Etat des zones de disques (probe-scsi-all) », page 3130 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Etat des zones de disques (zoningcli list) Si le pack de gestion du matériel version 2.1.1 (ou une version plus récente) est installé sur votre système, vous pouvez utiliser la commande zoningcli list pour déterminer si le zonage est activé ou non. L'état du zonage est indiqué sur la première ligne de la sortie dans chacun des exemples suivants. Le zonage est désactivé : Le zonage est activé : Si l'utilitaire zoningcli n'est pas disponible sur votre système, vous pouvez utiliser la commande OBP probe-scsi-all afin de déterminer si le zonage est activé ou non. Reportez-vous à la section « Etat des zones de disques (probe-scsi-all) », page 31. # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: disable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 =================================================== # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: enable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 ===================================================Configuration de volumes RAID matériels 31 Etat des zones de disques (probe-scsi-all) Les exemples de sortie de la commande probe-scsi-all suivants illustrent la différence d'affichage des périphériques de stockage lorsque le zonage est activé et lorsqu'il est désactivé. 10 disques sont représentés dans les deux exemples. Ils sont identifiés comme PhyNum 0 à 9. Remarque – Les entrées PhyNum 1 à 6 ne sont pas indiquées dans ces exemples afin de réduire leur taille. Les entrées omises n'affectent pas l'illustration du concept. Le zonage est désactivé : Lorsque le zonage est désactivé, les deux contrôleurs sont en mesure de voir tous les disques. L'exemple suivant illustre ce point en répertoriant tous les disques avec le contrôleur 0 et ceux avec le contrôleur 1. Conseil – Notez que les valeurs SASDeviceName et SASAddress de chaque PhyNum répertorié sous le contrôleur 1 correspondent aux valeurs DeviceName et SASAddress du PhyNum répertorié sous le contrôleur 0. Ceci est également valable pour PhyNum 1 à 6 qui ont été omis pour réduire la taille de la table. {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 12 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 13 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 1432 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Le zonage est activé : Dans l'exemple suivant, le zonage est activé et chaque disque est illustré connecté à un seul contrôleur SAS-2. PhyNum 0 à 7 sont connectés au contrôleur 0 et PhyNum 8 à 9 sont connectés au contrôleur 1. Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 15 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 13 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 14 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 {0} ok {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Configuration de volumes RAID matériels 33 Activation et désactivation du zonage des disques dans le champ Ces rubriques décrivent comment activer et désactiver les zones de disques dans le champ. Remarque – Vous devez disposer de la version 2.1.1 du pack de gestion du matériel d'Oracle (ou une version plus récente) pour avoir accès à la commande zoningcli. ¦ « Activation des zones de disques (commande zoningcli) », page 34 ¦ « Désactivation des zones de disques (commande zoningcli) », page 34 ¦ « Mise à jour du microprogramme pour activer le zonage », page 34 Target b Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target c Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 Target d Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 {0} ok34 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Activation des zones de disques (commande zoningcli) ? Si le zonage a été désactivé, vous pouvez l'activer en exécutant la commande suivante : ? Désactivation des zones de disques (commande zoningcli) ? Si le zonage a été activé, vous pouvez le désactiver en exécutant la commande suivante : ? Mise à jour du microprogramme pour activer le zonage Si votre serveur SPARC T3-1 nécessite un zonage de disques alors qu'il ne dispose pas du niveau de microprogramme système minimal et/ou que le microprogramme LSI du fond de panier ne dispose pas du patch 147034-01, procédez comme suit pour que les contrôleurs fonctionnent correctement. Attention – Veillez à sauvegarder toutes les données stockées sur les disques avant d'installer ce patch. Vous pouvez restaurer les fichiers une fois que le patch est installé. ? Appliquez le patch 147034-01 au microprogramme LSI sur le fond de panier des disques. Ce patch entraîne le partitionnement du fond de panier en deux zones de huit disques décrites dans « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. # zoningcli enable zoning # zoningcli disable zoningConfiguration de volumes RAID matériels 35 Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35. Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs Pour que la commande devalias soit valide pour les emplacements de disque 8 à 15, le niveau du microprogramme système doit être 8.0.5.b (ou un niveau supérieur à 8.0) ou 8.1.0.c (ou un niveau supérieur). Si le microprogramme système de votre serveur ne répond pas à la configuration minimale, vous devez utiliser le chemin d'accès complet au disque afin d'identifier les disques individuels de la plage 8 à 15. Par exemple, s'il est en cours d'exécution avec le niveau minimal du microprogramme système et la commande devalias appropriée, vous pouvez utiliser la ligne de commande suivante pour démarrer le système à partir du disque se trouvant à l'emplacement 12 : Si l'emplacement du disque est un emplacement compris entre 8 et 15 et que le niveau du microprogramme système ne répond pas aux exigences décrites ci-dessus, vous devez indiquer le chemin complet d'accès au périphérique pour le disque d'initialisation. Cet exemple illustre le chemin d'accès du disque 12 : # boot disk12 # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10c36 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour préparer l’utilisation de l’utilitaire FCode 1. Ouvrez une fenêtre de terminal xterm ou gnome. Les commandes FCode génèrent une sortie détaillée volumineuse. Les fenêtres de terminal xterm ou gnome offrent cependant une fonctionnalité de barre de défilement, destinée à faciliter la visualisation de la sortie. 2. Désactivez le paramètre auto-boot dans OBP et activez l’environnement OBP après une mise sous tension ou une réinitialisation. 3. La commande show-devs dresse la liste des chemins de périphériques connectés au serveur. Remarque – Dans le cas d’un module serveur, le chemin d’accès au périphérique peut correspondre à /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. La commande select vous permet de choisir le contrôleur sur lequel vous souhaitez créer un volume RAID matériel. Au lieu d’utiliser l’intégralité du chemin d’accès au périphérique pour le contrôleur, vous pouvez définir un alias préconfiguré à associer à ce dernier. Par exemple : Pour afficher les alias préconfigurés sur le serveur, exécutez la commande devalias. Reportez-vous à la section « Pour identifier les chemins d’accès aux périphériques », page 43. Affichez les adresses SAS des unités connectées à l’aide de la commande show-children. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi0Configuration de volumes RAID matériels 37 Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Commandes de l’utilitaire FCode Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Commande FCode Description show-children Dresse la liste complète des unités physiques et des volumes logiques connectés. show-volumes Dresse une liste détaillée des volumes logiques connectés. create-raid0-volume Crée un volume RAID 0 (au minimum deux cibles). create-raid1-volume Crée un volume RAID 1 (exactement deux cibles). create-raid1e-volume Crée un volume RAID 1e (au minimum trois cibles). delete-volume Supprime un volume RAID. activate-volume Réactive un volume RAID après le remplacement de disques.38 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour créer un volume RAID matériel 1. Préparez la création du volume RAID. Reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 2. La commande show-children permet de répertorier les unités physiques situées sur le contrôleur sélectionné. 3. Exécutez la commande create-raid0-volume, create-raid1-volume ou create-raid1e-volume pour créer une unité logique à partir des disques physiques. Par exemple, pour créer un volume RAID 0 avec les cibles 9 et a, commencez par spécifier les cibles, puis tapez la commande create : Par exemple, pour créer un volume RAID 1e avec les cibles a, b et c, tapez : {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volumeConfiguration de volumes RAID matériels 39 4. Pour vérifier la création du volume, tapez : 5. Saisissez unselect-dev pour désélectionner le contrôleur. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Disques hot spare de volumes RAID (LSI) Vous pouvez configurer deux disques hot spare globaux pour protéger les données figurant sur des volumes RAID mis en miroir. Si l'un des disques d'un volume RAID 1 ou RAID 1E mis en miroir échoue, le contrôleur RAID intégré remplace automatiquement le disque défaillant par un disque hot spare, puis resynchronise les données mises en miroir. Utilisez l'utilitaire LSI sas2ircu pour ajouter des disques hot spare globaux. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'ajout de disques hot spare. {0} ok show-volumes {0} ok unselect-dev40 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Diagnostic de l'état de fonctionnement d'un disque Les rubriques suivantes traitent des diverses façons de déterminer si un disque figurant dans un volume RAID a échoué ou non : ¦ « DEL avant du disque de service requis », page 40 ¦ « Messages d'erreur (console système et fichiers journaux) », page 40 ¦ « Affichage de l'état (commande show-volumes, OBP) », page 41 ¦ « Affichage de l'état (utilitaire sas2ircu, LSI) », page 42 DEL avant du disque de service requis Lorsqu'une erreur se produit sur un disque d'un système SPARC T3, la DEL jaune de service requis s'allume à l'avant du disque. Cette DEL jaune vous permet de localiser le disque défaillant dans le système. Par ailleurs, les DEL d’opération de maintenance requise des panneaux avant et arrière s’allument également lorsque le système détecte une panne au niveau du disque dur. Reportez-vous à votre manuel d'entretien pour connaître l'emplacement et la description de ces DEL. Messages d'erreur (console système et fichiers journaux) Lorsqu'une erreur se produit sur un disque, des messages d'erreur s'affichent sur la console système. Il s'agit d'un exemple d'affichage de console système indiquant que le volume 905 a été endommagé par la perte de PhysDiskNum 1 : Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degradedConfiguration de volumes RAID matériels 41 Vous pouvez également afficher ces messages en consultant les fichiers /var/adm/messages : Reportez-vous à la rubrique View the System Message Log Files (Affichage des fichiers journaux de messages système) du manuel d'entretien pour plus d'informations sur la consultation de ces messages. ? Affichage de l'état (commande show-volumes, OBP) Vous pouvez arrêter le système et utilisez la commande show-volumes de l'OBP pour savoir si un disque est en panne. 1. Arrêtez le système et affichez l'invite ok de l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded42 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Sélectionnez le contrôleur SAS. Pour plus d’informations, reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 3. Saisissez la commande show-volumes pour afficher les volumes RAID et les disques qui leur sont associés. Dans l'exemple suivant, le disque secondaire d'un volume RAID 1 est hors ligne. 4. Saisissez la commande unselect-dev pour désélectionner le contrôleur SAS. ? Affichage de l'état (utilitaire sas2ircu, LSI) ? Utilisez l'utilitaire sas2ircu LSI pour afficher l'état du volume RAID et des périphériques qui lui sont associés. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'affichage et l'interprétation de l'état du périphérique à l'aide de l'utilitaire sas2ircu. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguration de volumes RAID matériels 43 Stratégies de remplacement d'un disque RAID Suivez les stratégies décrites ci-dessous lors du remplacement d'un disque défectueux dans un volume RAID. Remarque – Les instructions cfgadm figurant dans le manuel d'entretien s'appliquent à des disques individuels ne faisant pas partie de volumes RAID. Lorsqu'un disque fait partie d'un volume RAID, il n'est pas nécessaire d'annuler la configuration avant de le remplacer à chaud par un nouveau disque. ? Pour identifier les chemins d’accès aux périphériques La procédure suivante permet de localiser les chemins d’accès aux périphériques propres à votre serveur. 1. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Niveau de volume RAID Stratégie RAID 0 Lorsqu'un disque d'un volume RAID 0 tombe en panne, toutes les données figurant sur ce volume sont perdues. Remplacez le disque défectueux par un disque de même capacité, recréez le volume RAID 0, puis restaurez les données à partir d'une sauvegarde. RAID 1 Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID. RAID 1E Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID.44 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. A partir de l’invite ok, tapez : Informations connexes ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok45 Modification des informations d’identification du serveur Les sections suivantes décrivent la procédure de stockage des informations (à des fins de contrôle d’inventaire ou de gestion des ressources du site, par exemple) sur le SP et les PROM des FRU à l’aide de l’interface CLI d’ILOM. ¦ « Pour modifier les informations sur les données FRU des clients », page 45 ¦ « Pour modifier les informations d’identification du système », page 46 ? Pour modifier les informations sur les données FRU des clients La propriété /SP customer_frudata permet de stocker des informations dans toutes les PROM de FRU. Ce champ peut servir à identifier un système particulier pour une application tierce ou pour tout autre besoin d’identification au sein de votre environnement. ? A l’invite -> d’ILOM, tapez : Remarque – Vous devez placer la chaîne de données (données) entre guillemets anglo-saxons. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations d’identification du système », page 46 -> set /SP customer_frudata=”data”46 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier les informations d’identification du système La propriété /SP system_identifier permet de stocker les informations d’identification client. Cette chaîne de caractères est codée dans tous les messages d’interruption générés par SNMP. L’affectation d’un identificateur de système unique peut se révéler utile pour déterminer le système qui génère le message SNMP. ? A l’invite -> d’ILOM, tapez : Remarque – La chaîne des données (données) doit être placée entre guillemets anglo-saxons doubles. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations sur les données FRU des clients », page 45 -> set /SP system_identifier=”data”47 Configuration des paramètres de stratégie Les sections suivantes décrivent la gestion des stratégies de configuration à l’aide d’ILOM. ¦ « Pour définir le mode de refroidissement », page 47 ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’initialisation parallèle du SP et de l’hôte », page 50 ¦ « Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé », page 51 ? Pour définir le mode de refroidissement La propriété HOST_COOLDOWN, lorsqu’elle est activée, oblige le serveur à entrer en mode de refroidissement (cooldown) à la mise hors tension de l’hôte. Dès lors que le serveur est hors tension et que le mode de refroidissement est activé, ILOM est redirigé de manière à contrôler certains composants et à garantir qu’ils restent en dessous d’une température minimale et qu’ils ne présentent aucun danger pour l’utilisateur. Une fois les composants passés en dessous de la température minimale, le serveur n’est plus alimenté en courant ou, si cette opération prend plus de 4 minutes, l’hôte s’éteint. Remarque – La propriété HOST_COOLDOWN ne concerne pas les modules serveur.48 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le serveur refroidit certains composants avant d’être mis hors tension. ¦ disabled : la température des composants n’est pas contrôlée lors de la mise hors tension. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_LAST_POWER_STATE permet de contrôler le comportement du serveur après une panne de courant inattendue. Une fois le courant externe rétabli, le processeur de service d’ILOM est exécuté automatiquement. En général, l’hôte n’est pas remis sous tension tant que vous n’utilisez pas ILOM pour cette opération. ILOM enregistre l’état de l’alimentation actuelle du serveur dans l’espace de stockage non volatile. Si la stratégie HOST_LAST_POWER_STATE est activée, ILOM peut rétablir l’état d’alimentation précédent de l’hôte. Cette stratégie s’avère pratique en cas de panne d’alimentation ou si vous changez le serveur d’emplacement physique. Par exemple, si le serveur hôte est en cours d’exécution lors d’une panne d’alimentation et que la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur disabled, le serveur hôte demeure hors tension lorsque l’alimentation est rétablie. Si la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur enabled, le serveur hôte redémarre lorsque l’alimentation est rétablie. ? A l’invite -> d’ILOM, tapez : -> set /SP/policy HOST_COOLDOWN=value -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguration des paramètres de stratégie 49 où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : lorsque l’alimentation est rétablie, le serveur revient à l’état où il se trouvait au moment de la mise hors tension. ¦ disabled : maintient le serveur hors tension au retour du courant (valeur par défaut). Si vous activez HOST_LAST_POWER_STATE, vous devriez également configurer /SP/policy HOST_POWER_ON_DELAY. Pour plus d’informations, reportez-vous à la section « Pour désactiver ou réactiver le délai de mise sous tension », page 50. Informations connexes ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_AUTO_POWER_ON permet de mettre l’hôte sous tension lorsque le serveur est alimenté par du courant externe. Si cette stratégie est définie sur enabled, le processeur de service définit HOST_LAST_POWER_STATE sur disabled. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : une fois le courant rétabli, l’hôte est automatiquement mis sous tension après l’initialisation du SP. ¦ disabled : maintient l’hôte hors tension au retour du courant (valeur par défaut). Informations connexes ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 -> set /SP/policy HOST_AUTO_POWER_ON=value50 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour désactiver ou réactiver le délai de mise sous tension La propriété /SP/policy HOST_POWER_ON_DELAY permet de définir un délai d’attente avant la remise automatique sous tension du serveur. Ce délai est un intervalle aléatoire compris entre une et cinq secondes. Retarder la mise sous tension du serveur permet de minimiser les surintensités au niveau de la source d’alimentation principale. Cela est important lorsque plusieurs serveurs montés en rack se mettent sous tension après une coupure de courant. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : oblige le serveur à attendre un court moment avant de se mettre sous tension automatiquement. ¦ disabled : le serveur se met automatiquement et sans délai sous tension (valeur par défaut). Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’initialisation parallèle du SP et de l’hôte La propriété /SP/policy PARALLEL_BOOT, lorsqu’elle est activée, permet à l’hôte de s’initialiser/se mettre sous tension parallèlement au SP quand une stratégie de mise sous tension automatique (HOST_AUTO_POWER_ON ou HOST_LAST_POWER_STATE) est activée ou que l’utilisateur appuie sur le bouton de marche/arrêt pendant que le SP est en cours d’initialisation. ILOM doit être en cours d’exécution pour permettre la mise sous tension de l’hôte lorsque l’utilisateur appuie sur le bouton de marche/arrêt ou que les stratégies de mise sous tension automatique sont configurées. Lorsque cette propriété est désactivée, le SP s’initialise avant l’hôte. -> set /SP/policy HOST_POWER_ON_DELAY=valueConfiguration des paramètres de stratégie 51 Remarque – L’initialisation parallèle n’est pas prise en charge par les modules serveur. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le SP et l’hôte s’initialisent en même temps. ¦ disabled : le SP et l’hôte s’initialisent de manière consécutive (en série). Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé La propriété /SYS setkeyswitch_state permet de contrôler la position de l’interrupteur à clé virtuel. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ normal : le serveur peut se mettre automatiquement sous tension et lancer le processus d’initialisation (valeur par défaut). ¦ standby : met l’hôte hors tension et désactive la mise sous tension. ¦ diag : la mise sous tension de l’hôte est autorisée ; ce paramètre remplace ceux de /HOST/diag cible, ce qui se traduit par l’exécution d’un nombre maximum de POST. -> set /SP/policy PARALLEL_BOOT=value -> set /SYS keyswitch_state=value52 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ locked : la mise sous tension de l’hôte est autorisée. Toutefois, vous ne pouvez pas mettre à jour les périphériques flash ni définir la propriété /HOST send_break_action=break. Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 2053 Configuration des adresses réseau Les sections suivantes décrivent la gestion des adresses réseau à l’aide d’ILOM. ¦ « Options d’adresse réseau du SP », page 53 ¦ « Pour désactiver ou réactiver l’accès réseau au SP », page 54 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ¦ « Utilisation d’une connexion in-band au SP », page 56 Options d’adresse réseau du SP Vous pouvez accéder au SP de votre système de plusieurs façons. Tenez compte des options disponibles et choisissez la méthode d’accès la plus adaptée à votre environnement. Vous pouvez établir des connexions physiques avec le SP au moyen d’une connexion série ou réseau. La connexion réseau peut être configurée de manière à utiliser une adresse IP statique ou le protocole DHCP (valeur par défaut). Le cas échéant, les serveurs de la série T3 peuvent se connecter au SP via une connexion réseau in-band au lieu d’utiliser le port de gestion réseau out-of-band défini par défaut. Pour plus d’informations sur chaque option, reportez-vous à la documentation suivante : ¦ Pour utiliser une connexion série au SP, consultez la section suivante : Pour connecter un terminal ou un émulateur au port SER MGT, dans le guide d’installation de votre serveur ou Communication avec le module serveur au démarrage, dans le guide d’installation de votre module serveur. ¦ Pour assigner une adresse IP statique au SP, consultez la section suivante : Pour assigner une adresse IP statique au SP, dans le guide d’installation du serveur ¦ Pour utiliser une connexion in-band au SP, reportez-vous à la section suivante : « Gestion in-band (sideband) d’ILOM », page 5654 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ Documentation d’Oracle Integrated Lights Out Manager (ILOM) 3.0 ¦ « Présentation d’ILOM », page 1 ? Pour désactiver ou réactiver l’accès réseau au SP La propriété /SP/network state permet d’activer ou de désactiver l’interface réseau du processeur de service. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled (valeur par défaut) ¦ disabled Informations connexes ¦ « Options d’adresse réseau du SP », page 53 ? Pour afficher l’adresse IP du serveur DHCP Afin d’afficher l’adresse IP du serveur DHCP ayant fourni l’adresse IP dynamique requise par le processeur de service, affichez la propriété dhcp_server_ip. ? A l’invite -> d’ILOM, tapez : -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguration des adresses réseau 55 Remarque – La liste des propriétés peut varier en fonction de votre serveur. Informations connexes ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ? Pour afficher l’adresse MAC de l’hôte La propriété /HOST macaddress est automatiquement configurée par le logiciel serveur de sorte que vous ne pouvez ni la définir ni la modifier. La valeur est lue et déterminée à partir de la carte de configuration système amovible du serveur (PROM SCC) ou à partir de l’ID de PROM du module serveur, puis stockée en tant que propriété dans ILOM. /HOST macaddress désigne l’adresse MAC du port net0. Chaque adresse MAC de port supplémentaire augmente d’une unité, l’adresse de base étant /HOST macaddress. Par exemple, net1 équivaut à la valeur de /HOST macaddress plus un (1). ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show56 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 Utilisation d’une connexion in-band au SP Les sections suivantes décrivent l’utilisation d’une connexion in-band (ou sideband) au SP. ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 Gestion in-band (sideband) d’ILOM Par défaut, la connexion au SP du serveur est établie par le biais du port de gestion réseau out-of-band (NET MGT). La fonction de gestion sideband ILOM vous permet de sélectionner le port NET MGT ou l’un des ports Gigabit Ethernet du serveur (NETn), en l’occurrence des ports in-band, pour envoyer ou recevoir des commandes ILOM vers et à partir du SP du serveur. Les ports in-band sont également désignés en tant que ports sideband. En utilisant un port de gestion sideband pour gérer le processeur de service du serveur, une connexion par câble et un port de commutateur réseau ne sont plus nécessaires. Dans des configurations où de nombreux serveurs sont gérés, comme par exemple dans les centres de données, la gestion sideband peut ainsi permettre des économies importantes en termes d’utilisation de matériel et de réseau. Remarque – L’utilisation de connexions in-band est déconseillée avec les modules serveur. -> show /HOST macaddressConfiguration des adresses réseau 57 Lorsque la gestion sideband est active dans ILOM, les situations suivantes peuvent se produire : ¦ La connexion au SP du serveur peut être interrompue si vous changez la configuration du port de gestion SP lorsque vous êtes connecté au SP via une connexion réseau, telle que SSH, Web ou ILOM Remote Console. ¦ La connectivité intégrée entre le processeur de service et le système d’exploitation hôte peut ne pas être prise en charge par le contrôleur Gigabit Ethernet hôte intégré. Dans ce cas, utilisez un port différent ou routez le trafic de transmission entre la source et les cibles de destination au lieu d’utiliser la commutation/un pont L2. ¦ Les mises hors et sous tension de l’hôte du serveur peuvent interrompre la connectivité réseau des ports Gigabit Ethernet du serveur (NETn) configurés pour la gestion sideband. Dans ce cas, configurez les ports de commutation/pont contigus sous forme de ports hôtes. Informations connexes ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 ¦ « Options d’adresse réseau du SP », page 53 ? Pour configurer l’accès in-band (sideband) au SP Cette procédure décrit la méthode d’accès au SP via une gestion in-band (ou sideband) au moyen d’un port réseau hôte. Si vous effectuez cette procédure via une connexion réseau, vous risquez de perdre la connectivité au serveur. Une connexion série pour cette procédure permet d’éviter la perte de connectivité pendant les modifications de configuration de la gestion sideband. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. En cas de connexion par le port série, vous pouvez assigner une adresse IP statique. Pour obtenir les instructions, consultez les informations relatives à l’assignation d’une adresse IP dans le guide d’installation de votre serveur.58 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Affichez les paramètres réseau actuels : 4. Définissez le port de gestion du SP sur un port sideband (où n correspond à un chiffre compris entre 0 et 3) : -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set commitpending=trueConfiguration des adresses réseau 59 5. Vérifiez l’application de la modification : Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Options d’adresse réseau du SP », page 53 -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NET0 sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show60 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201161 Configuration du mode d’initialisation Les propriétés du mode d’initialisation d’ILOM permettent de spécifier la manière dont l’hôte s’initialise dans le cadre de la résolution d’un problème lié à OpenBoot ou Oracle VM Server pour SPARC. ¦ « Présentation du mode d’initialisation », page 61 ¦ « Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC », page 62 ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Pour gérer le script du mode d’initialisation de l’hôte », page 65 ¦ « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 Présentation du mode d’initialisation Les propriétés du mode d’initialisation (bootmode) annulent et remplacent la méthode d’initialisation par défaut du serveur. Cette possibilité s’avère pratique pour remplacer des paramètres OpenBoot ou Oracle VM Server particuliers pouvant être incorrects, pour configurer des variables OpenBoot à l’aide d’un script ou pour effectuer d’autres tâches similaires. Si, par exemple, les paramètres OpenBoot viennent à être endommagés, vous pouvez définir la propriété bootmode state sur reset_nvram, puis réinitialiser le serveur sur les paramètres OpenBoot par défaut définis en usine. Le personnel de maintenance peut également vous demander d’utiliser la propriété bootmode script afin de résoudre un problème. La portée intégrale des fonctionnalités de script n’est pas documentée et sert principalement à des fins de débogage.62 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Comme bootmode est destiné à corriger un problème lié aux paramètres OpenBoot ou Oracle VM Server, il ne s’applique qu’à une seule initialisation. De plus, pour éviter qu’un administrateur ne définisse la propriété bootmode state puis l’oublie, celle-ci expire lorsque l’hôte n’est pas réinitialisé dans les 10 minutes suivant la configuration de la propriété bootmode state. Informations connexes ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC Remarque – Vous devez utiliser un nom de configuration Oracle VM Server pour cette tâche. 1. Déterminez les configurations Oracle VM Server valides sur votre processeur de service en tapant ce qui suit à l’invite -> d’ILOM : -> show /HOST/domain/configsConfiguration du mode d’initialisation 63 2. Définissez la configuration du mode d’initialisation en tapant ce qui suit à l’invite -> d’ILOM : où la propriété config est dotée d’une valeur configname correspondant à une configuration de domaine logique nommée correcte. Par exemple, si vous avez créé une configuration Oracle VM Server intitulée ldm-set1 : Pour que le mode d’initialisation config revienne à la configuration par défaut d’usine, spécifiez factory-default. Par exemple : Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode config=configname -> set bootmode config=ldm-set1 -> set bootmode config=factory-default64 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations La propriété /HOST/bootmode state contrôle la manière dont les variables de la NVRAM OpenBoot sont utilisées. En général, les paramètres actifs de ces variables sont conservés. Définir /HOST/ bootmode state=reset_nvram permet de ramener les variables de la NVRAM OpenBoot à leurs valeurs par défaut à la réinitialisation suivante. ? A l’invite -> d’ILOM, tapez : où valeur correspond à l’un des paramètres suivants : ¦ normal : conserve les paramètres actifs des variables de la NVRAM à la réinitialisation suivante. ¦ reset_nvram : redéfinit les variables OpenBoot sur les paramètres par défaut à la réinitialisation suivante. Remarque – state=reset_nvram rétablit la valeur « normal » après la prochaine réinitialisation du serveur ou après dix minutes (voir la propriété expires décrite à la section « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66). Les propriétés config et script n’arrivent pas à échéance et sont effacées lors de la prochaine réinitialisation du serveur ou manuellement en définissant la valeur sur "". Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode state=valueConfiguration du mode d’initialisation 65 ? Pour gérer le script du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où script contrôle la méthode d’initialisation du microprogramme OpenBoot PROM du serveur hôte. Le script n’a aucune incidence sur le paramètre /HOST/bootmode actuel. valeur peut compter jusqu’à 64 octets. Vous pouvez spécifier le paramètre /HOST/bootmode et définir le script dans la même commande. Par exemple : Une fois que le serveur est réinitialisé et que l’OpenBoot PROM lit les valeurs stockées dans le script, le microprogramme définit la variable OpenBoot PROM diag-switch? sur la valeur requise par l’utilisateur : true. Remarque – Si vous définissez /HOST/bootmode script="", ILOM configure script sur une valeur vide. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"66 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où expires correspond aux date et heure d’échéance du mode d’initialisation actif. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur Cette procédure vous permet de remplacer les paramètres de l’OpenBoot PROM et de lancer la réinitialisation du domaine de contrôle, ce qui entraîne le démarrage de l’hôte à l’invite ok. ? A l’invite -> d’ILOM, tapez : L’hôte redémarre puis s’arrête à l’invite ok. -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled reset /HOST/domain/control [-force] [-script]Configuration du mode d’initialisation 67 Informations connexes ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Configuration du mode d’initialisation », page 61 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 568 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201169 Configuration du comportement du serveur au redémarrage Pour configurer le comportement d’ILOM dans les scénarios de redémarrage ci-dessous, suivez les procédures indiquées ci-après. ¦ « Pour définir le comportement de l’hôte à sa réinitialisation », page 69 ¦ « Pour définir le comportement de l’hôte lorsque son exécution s’arrête », page 70 ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 ? Pour définir le comportement de l’hôte à sa réinitialisation Spécifiez si l’hôte doit continuer à démarrer lorsqu’une erreur se produit. ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ false : l’hôte continue la procédure d’initialisation même s’il rencontre une erreur. ¦ true : l’hôte ne continue pas la procédure d’initialisation s’il rencontre une erreur. Informations connexes ¦ « Configuration des paramètres de stratégie », page 47 -> set /HOST autorunonerror=value70 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête Spécifiez le comportement d’ILOM lorsque l’hôte quitte l’état d’EXECUTION (à l’expiration de l’horloge chien de garde). ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none : ILOM ne prend pas d’autre mesure que l’émission d’un avertissement. ¦ reset : ILOM tente de réinitialiser le serveur lorsque l’horloge chien de garde Oracle Solaris expire (option par défaut). ¦ dumpcore : ILOM tente de forcer un core dump du SE lorsque l’horloge chien de garde expire. Informations connexes ¦ « Pour afficher l’historique de la console », page 80 ? Pour définir l’intervalle du délai d’attente d’initialisation ? Définissez le délai d’attente entre une requête d’initialisation de l’hôte et l’initialisation proprement dite : La valeur par défaut de boottimeout correspond à 0 (zéro seconde) ou aucun délai d’attente. Les valeurs possibles sont comprises entre 0 et 36 000 secondes. Informations connexes ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguration du comportement du serveur au redémarrage 71 ? Pour définir le comportement à l’expiration du délai d’initialisation Spécifiez le comportement d’ILOM en cas d’échec de l’initialisation de l’hôte avant l’expiration du délai d’initialisation. ? Définissez le comportement au terme de la commande boottimeout : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune, par défaut) ¦ Réinitialisation Informations connexes ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ? Pour définir le comportement en cas d’échec du redémarrage Spécifiez le comportement d’ILOM lorsque l’hôte ne parvient pas à atteindre l’état running pour Oracle Solaris. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ powercycle ¦ poweroff (valeur par défaut) Informations connexes ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value72 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le nombre maximum de tentatives de redémarrage Indiquez le nombre de fois qu’ILOM doit tenter de redémarrer l’hôte. ? A l’invite -> d’ILOM, tapez : La valeur par défaut de maxbootfail est 3 (trois tentatives). Si l’initialisation de l’hôte échoue après le nombre de tentatives indiqué par maxbootfail, l’hôte est mis hors tension ou soumis à un cycle d’alimentation progressive (selon la configuration de bootfailrecovery). Dans les deux cas, la commande boottimeout est définie sur 0 (zéro seconde), empêchant d’autres tentatives de redémarrage de l’hôte. Informations connexes ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 -> set /HOST maxbootfail=attempts73 Configuration des périphériques Les sections suivantes présentent des informations sur la configuration des périphériques du serveur. ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour déconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=disabled permettant de déconfigurer manuellement les périphériques du serveur. Cette commande identifie le périphérique spécifié comme étant désactivé (disabled). Tout périphérique marqué disabled, que ce soit manuellement ou par le microprogramme système, est supprimé de la description de machine du serveur avant le transfert de contrôle à d’autres couches du microprogramme système, comme l’OpenBoot PROM. ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=disabled74 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour reconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=enabled permettant de reconfigurer manuellement les périphériques serveur. Cette commande vous permet de marquer le périphérique spécifié comme étant activé (enabled). ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=enabled75 Contrôle du serveur Le serveur dispose de nombreuses méthodes pour signaler un comportement défectueux, notamment les DEL, ILOM et l’autotest de l’allumage (POST). Pour en savoir plus sur les DEL et obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Contrôle des pannes », page 75 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour localiser le serveur », page 87 Contrôle des pannes Les sections suivantes présentent un récapitulatif des outils de diagnostic ainsi que des informations de base sur la détection des pannes du serveur à l’aide d’outils exécutés en amont du système d’exploitation, notamment ILOM et le POST. Pour obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Présentation des diagnostics », page 76 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher l’historique de la console », page 80 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ¦ « Pour effacer une panne », page 8376 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation des diagnostics Vous disposez de toute une gamme d’outils de diagnostic, de commandes et d’indicateurs permettant de contrôler et de dépanner un serveur. Reportez-vous au manuel d’entretien de votre serveur pour obtenir des informations complètes sur ces outils de diagnostic : ¦ DEL : fournissent une indication visuelle rapide du statut du serveur et de certaines FRU. ¦ ILOM : microprogramme exécuté sur le processeur de service. Outre l’interface qu’il fournit entre le matériel et le SE, le microprogramme ILOM permet également de suivre et de signaler l’état général des composants clés du serveur. ILOM exploite pleinement le POST et la technologie d’autorétablissement prédictif d’Oracle Solaris pour maintenir le serveur en état de fonctionnement, même en présence d’un composant défectueux. ¦ Autotest de l’allumage (POST) : le POST effectue des tests de diagnostic sur les composants du serveur après une réinitialisation manuelle pour s’assurer de leur intégrité. Configurable, le POST utilise le microprogramme ILOM pour mettre hors tension les composants défectueux, le cas échéant. ¦ Autorétablissement prédictif du SE Oracle Solaris : cette technologie contrôle en permanence l’intégrité du processeur et de la mémoire, et fonctionne avec ILOM pour placer un composant défectueux hors ligne, le cas échéant. Elle permet aux serveurs de prévoir avec précision les pannes de composants et de limiter de nombreux problèmes graves avant qu’ils ne surviennent. ¦ Fichiers journaux et interface de commandes : fournissent les fichiers journaux standard du SE Oracle Solaris, ainsi que les commandes d’investigation qui peuvent être utilisées et affichées sur le périphérique de votre choix. ¦ SunVTS : application qui permet de tester le serveur, de vérifier le fonctionnement du matériel et d’identifier les composants éventuellement défectueux en fournissant des recommandations pour leur réparation. Les DEL, le microprogramme ILOM, l’autorétablissement prédictif du SE et les nombreux fichiers journaux et messages de la console offrent une intégration mutuelle totale. Cela signifie que, par exemple, en cas de panne détectée par le logiciel Oracle Solaris, celle-ci est affichée et consignée, tandis que les informations correspondantes sont transmises à ILOM qui les consigne. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ Consultez la section du manuel d’entretien du serveur concernant la détection et la gestion des pannes.Contrôle du serveur 77 ? Pour détecter les pannes (ILOM) ? A l’invite -> d’ILOM, tapez : Cette commande affiche la cible, la propriété et la valeur de la panne. Par exemple : Informations connexes ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) Le shell de gestion des pannes d’ILOM (Fault Management Shell) permet d’utiliser les commandes du gestionnaire des pannes d’Oracle Solaris (fmadm et fmstat à partir d’ILOM, afin de visualiser à la fois les pannes relatives à l’hôte et à ILOM. 1. Pour lancer le shell intégré, à l’invite -> d’ILOM, tapez : -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/Faultmgt/shell (y/n)? y faultmgmtsp>78 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Pour obtenir la liste des pannes actuelles du serveur, tapez : Remarque – Si le serveur détecte le remplacement de la FRU défectueuse, la réparation ne nécessite pas l’exécution d’une commande par l’utilisateur, car la panne sera effacée automatiquement. 3. Détectez des informations complémentaires sur une panne donnée. Recherchez l’identificateur de panne MSG-ID (SPT-8000-42 dans l’exemple précédent), puis saisissez-le dans la zone de recherche à l’adresse http://www.sun.com/msg. 4. Pour réparer la panne, reportez-vous à la section : « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81. 5. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Contrôle du serveur 79 Informations connexes ¦ Article sur l'autorétablissement prédictif (en anglais) « Oracle Solaris 10 OS Feature Sportlight: Predictive Self Healing » disponible à l’adresse www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ? Pour détecter les pannes à l’aide du POST L’interrupteur à clé virtuel permet d’exécuter des diagnostics POST complets sans avoir à modifier les paramètres des propriétés de diagnostic. Notez que l’exécution des diagnostics POST peuvent prendre temps considérable lors de la réinitialisation du serveur. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. A l’invite -> d’ILOM, tapez : Le serveur est configuré pour exécuter les diagnostics POST complets au moment de sa réinitialisation. 3. Pour revenir aux paramètres de diagnostic standard après l’exécution du POST, à l’invite -> d’ILOM, tapez ce qui suit : Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal80 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher l’historique de la console Cette rubrique décrit la procédure d’affichage des tampons de sortie de la console du serveur hôte. Il existe deux tampons d’historique de console pouvant contenir jusqu’à 1 Mo d’informations. La cible /HOST/console/history écrit tous les types d’informations de journalisation. La cible /HOST/console/bootlog consigne les informations de démarrage et les données d’initialisation dans le tampon de la console jusqu’à ce qu’ILOM soit notifié par le serveur que le SE Oracle Solaris est exécuté et opérationnel. Ce tampon est conservé jusqu’à ce que l’hôte soit réinitialisé. Remarque – Vous devez disposer des droits d’administrateur ILOM pour utiliser cette commande. 1. Pour gérer le journal /HOST/console/history, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 1 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 1 et tout nombre entier ou "" pour indiquer un nombre de lignes illimité. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Si vous tapez la commande show /HOST/console/history sans définir d’arguments préalables à l’aide de la commande set, ILOM affiche toutes les lignes du journal de la console en commençant par la fin. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. -> set /HOST/console/history property=option [...] -> show /HOST/console/historyContrôle du serveur 81 2. Pour afficher le journal /HOST/console/bootlog, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) Vous pouvez utiliser la commande fmadm repair pour corriger des pannes diagnostiquées par ILOM. (Contrairement aux pannes détectées par l’hôte, les pannes et erreurs diagnostiquées par ILOM sont dotées d’un ID de message commençant par SPT.) Le seul moment auquel vous devriez utiliser la commande fmadm repair dans le shell de gestion des pannes d’ILOM pour une panne détectée par l’hôte est le cas où la panne est réparée sans qu’ILOM le remarque. Il se peut, par exemple, qu’ILOM ait été hors service lorsque la panne a été réparée. Dans ce cas, l’hôte n’afficherait plus la panne, contrairement à ILOM. Utilisez la commande fmadm repair pour effacer la panne. -> show /HOST/console/bootlog property82 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 1. Localisez la panne : 2. Pour réparer une panne détectée par ILOM, exécutez la commande fmadm repair : Remarque – Vous pouvez utiliser soit le nom NAC (par exemple, /SYS/MB) soit l’UUID (par exemple, fa4a2f86-5156-4243-8e88-d6516db12970) de la panne avec la commande fmadm repair. 3. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : Informations connexes ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit ->Contrôle du serveur 83 ? Pour effacer une panne ? A l’invite -> d’ILOM, tapez : Définissez clear_fault_action sur true pour effacer la panne au niveau du composant et à tous les niveaux inférieurs de l’arborescence /SYS. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher les composants du serveur », page 86 Activation de la récupération automatique du système Les sections suivantes présentent des informations relatives à la configuration du serveur en vue de récupérer automatiquement de pannes mineures. Remarque – Cette section fait référence à la fonction de récupération automatique du système et non à la fonction de dénomination voisine, l’Auto Service Request (requête automatique de service). ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 -> set /SYS/component clear_fault_action=true84 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation de la récupération automatique de système Le serveur assure la récupération automatique du système (ASR) en cas de panne des modules de mémoire ou des cartes PCI. La fonction ASR permet au serveur de reprendre son fonctionnement après certaines défaillances ou pannes matérielles non fatales. Lorsque l’ASR est activée, les diagnostics du microprogramme du système détectent automatiquement les composants matériels en panne. Une fonction de configuration automatique intégrée au microprogramme du système permet au système de déconfigurer les composants en panne et de rétablir le fonctionnement du serveur. Tant que le serveur est en mesure de fonctionner sans le composant en panne, la fonction ASR lui permet de redémarrer automatiquement sans intervention de l’utilisateur. Remarque – Vous devez activer l’ASR manuellement. Reportez-vous à la section « Pour activer la fonction ASR », page 84. Pour plus d’informations sur l’ASR, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour activer la fonction ASR 1. A l’invite -> d’ILOM, tapez : 2. A l’invite ok, tapez : -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? trueContrôle du serveur 85 Remarque – Pour plus d’informations sur les variables de configuration OpenBoot, reportez-vous au manuel d’entretien du serveur. 3. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke en permanence les modifications apportées aux paramètres et est automatiquement initialisé si la variable de configuration OpenBoot auto-boot? est définie sur true (valeur par défaut). Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour désactiver la fonction ASR 1. A l’invite ok, tapez : 2. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke définitivement le changement de paramètre. Une fois désactivée, la fonction ASR le reste tant que vous ne la réactivez pas. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ¦ « Présentation de la récupération automatique de système », page 84 ok reset-all ok setenv auto-boot-on-error? false ok reset-all86 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher des informations sur les composants concernés par l’ASR ? A l’invite -> d’ILOM, tapez : Dans la sortie de la commande show /SYS/composant component_state, tout périphérique indiqué comme désactivé a été déconfiguré manuellement en utilisant le microprogramme du système. La sortie de la commande indique également les périphériques qui ont échoué aux diagnostics du microprogramme et ont été automatiquement déconfigurés par le microprogramme du système. Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour afficher les composants du serveur Affichez des informations en temps réel sur les composants installés sur votre serveur en utilisant la commande show components d’ILOM. ? A l’invite -> d’ILOM, tapez : -> show /SYS/component component_state -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | EnabledContrôle du serveur 87 Remarque – Les composants varient en fonction du serveur. Informations connexes ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 ? Pour localiser le serveur Si vous avez besoin d’effectuer une opération de maintenance sur un composant, vous identifierez plus facilement le serveur concerné par la DEL de localisation système qui s’allume. Vous n’avez besoin d’aucun droit administrateur pour utiliser les commandes set /SYS/LOCATE et show /SYS/LOCATE. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. Gérez la DEL de localisation à l’aide des commandes suivantes. ¦ Pour activer la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour désactiver la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour afficher l’état de la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : Informations connexes ¦ « Contrôle des pannes », page 75 ¦ « Configuration des périphériques », page 73 /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=off -> show /SYS/LOCATE88 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201189 Mise à jour du microprogramme Les sections suivantes décrivent les procédures de mise à jour du microprogramme système et d’affichage des versions actuelles des microprogrammes des serveurs de la série SPARC T3 d’Oracle. ¦ « Pour afficher la version du microprogramme », page 89 ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Pour afficher la version d’OpenBoot », page 92 ¦ « Pour afficher la version de POST », page 93 ? Pour afficher la version du microprogramme La propriété /HOST sysfw_version affiche des informations relatives à la version du microprogramme système installée sur l’hôte. ? Affichez le paramètre actuel de cette propriété. A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST sysfw_version90 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour mettre à jour le microprogramme 1. Assurez-vous que le port de gestion réseau du processeur de service est configuré. Pour les instructions, reportez-vous au guide d’installation de votre serveur. 2. Ouvrez une session SSH pour vous connecter au processeur de service : 3. Mettez l’hôte hors tension : 4. Définissez le paramètre keyswitch_state sur normal: 5. Tapez la commande load en indiquant le chemin d’accès à la nouvelle image flash. La commande load met à jour à la fois l’image flash du processeur de service et le microprogramme de l’hôte. La commande load requiert les informations suivantes : ¦ Adresse IP d’un serveur TFTP du réseau pouvant accéder à l’image flash ¦ Chemin d’accès complet à l’image flash à laquelle l’adresse IP peut accéder % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalMise à jour du microprogramme 91 Cette commande s’utilise de la manière suivante : load [-script] -source tftp://xxx.xxx.xx.xxx/chemin d’accès où : ¦ -script : ne demande aucune confirmation et agit comme si yes était spécifié. ¦ -source : indique l’adresse IP et le chemin d’accès complet (URL) de l’image flash. Une fois l’image flash mise à jour, le serveur est réinitialisé automatiquement, puis il exécute les diagnostics et revient à l’invite de connexion sur la console série. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED92 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour afficher la version du microprogramme », page 89 ? Pour afficher la version d’OpenBoot La propriété /HOST obp_version affiche des informations sur la version d’OpenBoot installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Présentation d’OpenBoot », page 4 ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionMise à jour du microprogramme 93 ? Pour afficher la version de POST La propriété /HOST post_version affiche des informations sur la version de POST installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST post_version94 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201195 Mise à jour du système d’exploitation Oracle Solaris Ces rubriques décrivent comment mettre à jour le SE Oracle Solaris sur les serveurs Oracle SPARC de la série T3. ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe de nom universel Le SE Oracle Solaris utilise à présent la syntaxe de nom universel (WWN) au lieu du champ unique au niveau local tn (ID cible) dans les noms de périphériques logiques. Ce changement modifie la façon dont un périphérique de stockage cible est identifié lors du téléchargement du système d'exploitation sur un réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement :96 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ Avant le passage à la nomenclature WWN, le SE Oracle Solaris identifiait le périphérique d'initialisation par défaut comme étant c0t0d0. ¦ Depuis ce changement, l'identificateur du périphérique d'initialisation par défaut est désormais c0tWWNd0, où WWN correspond à une valeur hexadécimale unique à ce périphérique au niveau mondial. ¦ Cette valeur WWN n'est pas mappée de façon prévisible à l'adresse physique du périphérique auquel elle fait référence. Pour spécifier de manière fiable un périphérique de stockage particulier lors du téléchargement d'un système d'exploitation, vous devez déterminer la correspondance entre la valeur WWN affectée à ce périphérique et son emplacement physique. Vous trouverez cette correspondance à l'aide des commandes OBP ou Oracle Solaris : ¦ Dans OBP, exécutez probe-scsi-all. Voir « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ Dans Oracle Solaris, exécutez la commande format suivie de prtconf -v. Voir « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ou « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111. Ces commandes génèrent des informations sur les contrôleurs SAS et les périphériques de stockage qui leur sont connectés. Ces informations comprennent les noms logiques et physiques que vous pouvez analyser pour déterminer les relations entre les adresses physiques et logiques. Informations connexes ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116Mise à jour du système d’exploitation Oracle Solaris 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans une configuration de fond de panier à huit disques. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 7 disques durs dans une configuration de fond de panier à huit disques. Dans cet exemple, les disques durs sont connectés aux deux contrôleurs SAS de la manière suivante : ¦ Quatre disques durs sont connectés au contrôleur SAS 0. Il s'agit des cibles 9, a, b et c. ¦ Trois disques durs, ainsi qu'une unité de DVD SATA sont connectés au contrôleur SAS 1. Il s'agit respectivement des cibles 9, b, c et a. TABLEAU : Mappage des ports de contrôleurs SAS pour les backplanes à huit disques Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 798 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple de configuration est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7680d4 SASAddress 5000cca00a7680d5 PhyNum 2 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 3 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d40bf9b SASAddress 5000c5001d40bf99 PhyNum 1Mise à jour du système d’exploitation Oracle Solaris 99 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans un fond de panier à seize disques connectés aux contrôleurs SAS intégrés 0 et 1.100 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – La configuration d'un fond de panier à 16 disques par défaut se compose de deux zones isolées de façon logique, les emplacements de disque 0 à 7 pouvant être vus par le contrôleur SAS 0 et les emplacements de disque 8 à 15 pouvant l'être par le contrôleur SAS 1. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 9 disques durs dans une configuration de fond de panier à seize disques. Remarque – Le contrôleur 1 gère l'unité de DVD SATA. L'emplacement d'initialisation par défaut (emplacement physique 0) est répertorié sous le nom PhyNum 0 dans la section du contrôleur SAS 0. Son SASDeviceName a la valeur 5000cca00a59278c et son SASAddress a la valeur 5000cca00a59278d. TABLEAU : Mappage des ports de contrôleurs SAS pour les fonds de panier à seize disques Contrôleur SAS PhyNum (Hexadécimal) Emplacement de disque (Décimal) Contrôleur SAS PhyNum (Hexadéci mal) Emplacement de disque (Décimal) 0 0 0 1 8 8 1 1 9 9 2 2 A 10 3 3 B 11 4 4 C 12 5 5 D 13 6 6 E 14 7 7 F 15 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a746490 SASAddress 5000cca00a746491 PhyNum 8 Target bMise à jour du système d’exploitation Oracle Solaris 101 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d1283 SASAddress 5000c5001d0d1281 PhyNum 9 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a01014c SASAddress 5000cca00a01014d PhyNum a Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0ca947 SASAddress 5000c5001d0ca945 PhyNum b Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d2857 SASAddress 5000c5001d0d2855 PhyNum c Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02f5d0 SASAddress 5000cca00a02f5d1 PhyNum d Target 10 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c3d9b SASAddress 5000c5001d0c3d99 PhyNum e Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097737 SASAddress 5000c5001d097735 PhyNum f Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a59278c SASAddress 5000cca00a59278d PhyNum 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7e6fb SASAddress 5000c50017c7e6f9 PhyNum 1 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4bfcb8 SASAddress 5000cca00a4bfcb9 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7a3a3 SASAddress 5000c50017c7a3a1 PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02cc18 SASAddress 5000cca00a02cc19 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76dec0 SASAddress 5000cca00a76dec1 PhyNum 5 Target 10 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a773eac SASAddress 5000cca00a773ead PhyNum 6102 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-4) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09654f SASAddress 5000c5001d09654d PhyNum d Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 okMise à jour du système d’exploitation Oracle Solaris 103 ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Un serveur SPARC T3-4 a deux contrôleurs SAS intégrés, chacun connecté à un fond de panier à quatre disques différent. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque de ces fonds de panier. Remarque – OBP utilise un chemin d'accès différent au contrôleur SAS 1 dans les serveurs SPARC T3-4, selon que le serveur dispose de quatre ou deux processeurs. Le chemin d'accès au contrôleur SAS 0 est le même pour les deux configurations de processeurs. Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à quatre processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. TABLEAU : Mappage des ports de contrôleurs SAS pour un fond de panier à huit disques SAS Contrôleur PhyNum Emplacement de disque SAS Contrôleur PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00104 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 105 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à deux processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2106 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 107 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) Utilisez probe-scsi-all pour afficher les informations suivantes d'un périphérique SAS : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. L'exemple suivant est basé sur un serveur SPARC T3-2 à six disques durs. Quatre disques durs sont connectés au contrôleur SAS en tant que périphériques de stockage individuels. Il s'agit de Target 9, d, e et f. Deux disques durs sont configurés en tant que volume RAID. Cette baie de disques est Target 389. ? Exécutez probe-scsi-all. Dans l'exemple suivant, le disque dur installé à l'emplacement physique 0 a la valeur PhyNum 0. Il est désigné Target 9 et son SASDeviceName a la valeur 5000c5001cb4a637. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB108 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – L'exemple de sortie de probe-scsi-all illustré ci-dessus peut être appliqué à l'interprétation de la sortie de probe-scsi-all pour les systèmes SPARC T3-1B. Remarque – La sortie de probe-scsi-all des serveurs SPARC T3-1 et SPARC T3-4 présente des caractéristiques spéciales en raison de leur utilisation de deux contrôleurs SAS intégrés. En outre, sur les serveurs SPARC T3-1 dotés d'un fond de panier à seize disques, les deux contrôleurs se connectent aux disques durs à l'aide d'un expandeur SAS figurant sur le fond de panier. Ces différences sont expliquées dans « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 et « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00Mise à jour du système d’exploitation Oracle Solaris 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 dotés d'un fond de panier à seize disques. Ces systèmes disposent d'un expandeur SAS placé entre les deux contrôleurs SAS intégrés et les connecteurs de disque dur. Le fond de panier à 16 disques est divisé en zones, la valeur phy-num associée à chaque disque étant relative à son contrôleur. Remarque – Pour les systèmes dotés d'un fond de panier à huit disques et de deux contrôleurs intégrés, chaque contrôleur fournit une interface à quatre emplacements de disque. La valeur phy-num associée à chaque disque est ainsi relative à son contrôleur. Un exemple de la procédure de configuration d'un seul initiateur est donné dans « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 1. Exécutez la commande format. Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000c5001d3ff2d7d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000c5001d3ff2d7d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000C5001D3FF2D7d0 /scsi_vhci/disk@g5000c5001d3ff2d7 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/sd3a110 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000c5001d3ff2d7. Notez la valeur target-port répertoriée avec cette valeur WWN. Dans cet exemple, il s'agit de 5000c5001d3ff2d5. Il s'agit de l'ID cible du disque physique. Remarque – Dans un système SPARC T3-1 doté d'un fond de panier à seize disques, les deux contrôleurs répertorient le nom logique (la valeur wwn), le nom de port correspondant (valeur target-port) et l'emplacement de disque physique (valeur phy-num) de chaque disque dur connecté. dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/rsd3a Paths from multipath bus adapters: mpt_sas#2 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ <<=== Hard drive target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 <<=== Hard drive slot number name=’path-class’ type=string items=1 value=’primary’ mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 name=’path-class’ type=string items=1 value=’primary’Mise à jour du système d’exploitation Oracle Solaris 111 4. The value shown for the name=’phy-num’ entry indicates the physical slot containing the hard drive. Dans cet exemple, le périphérique cible se trouve à l'emplacement 4. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 et aux serveurs SPARC T3-4 d'une configuration de fond de panier à huit disques et un seul initiateur. 1. Exécutez la commande format. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]112 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000CCA00ABBAEB8d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000CCA00ABBAEB8d0. 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000cca00abbaeb8. Notez la valeur obp-path répertoriée sous le WWN 5000cca00abbaeb8. Reportez-vous au tableau ci-dessous pour trouver le contrôleur. Pour les serveurs SPARC T3-1, le contrôleur est identifié dans le deuxième champ : pci@1 = contrôleur 0 et pci@2 = contrôleur 1. Pour les serveurs SPARC T3-4, le contrôleur est identifié dans le premier champ. Pour les systèmes équipés de quatre processeurs, pci@400 = contrôleur 0 et pci@700 = contrôleur 1. Pour les systèmes équipés de deux processeurs, pci@400 = contrôleur 0 et pci@500 = contrôleur 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/rsd3a SPARC T3-1 Contrôleur 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 4) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 2) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Mise à jour du système d’exploitation Oracle Solaris 113 L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-1. Dans cet exemple de serveur SPARC T3-1, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-4. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’114 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Dans cet exemple de serveur SPARC T3-4, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. 4. Cette valeur phy-num correspond à l'emplacement de disque physique 0, comme indiqué dans la table de mappage des ports suivante. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Mise à jour du système d’exploitation Oracle Solaris 115 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur une unité de disque précise. Dans cet exemple, le nom du périphérique contient la valeur WWN 5000CCA00A75DCAC. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap116 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur un volume RAID. Lors de l'installation d'un logiciel sur un volume RAID, utilisez la valeur VolumeDeviceName du périphérique virtuel au lieu du nom de périphérique individuel. Dans cet exemple, le nom du volume RAID est 3ce534e42c02a3c0. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapMise à jour du système d’exploitation Oracle Solaris 117 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115118 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011119 Index A A propos, 1 Accès à la console système, 12 Accès réseau, activation ou désactivation, 54 Activation, 84 Adresse MAC de l’hôte, affichage, 55 Affichage de la version, 89, 92, 93 Affichage des composants concernés, 86 Annulation de la configuration, 73 C Câbles, clavier et souris, 15 Chemins d’accès aux périphériques, 43 Clavier, connexion, 15 Commandes, 37 Communication système, 11 Comportement à l’expiration du délai d’initialisation, 71 Comportement en cas d’échec du redémarrage, 71 Comportement lorsque l’hôte cesse de fonctionner, 70 Comportement suite à la réinitialisation de l’hôte, 69 Configuration, 25, 74 Connexion, 11 Console système, connexion, 12 Contournement, 83 Contrôle, 19 Création de volumes, 38 D Date d’expiration, 66 Définition au redémarrage, 49 Définition de l’état d’alimentation de l’hôte au redémarrage, 49 Définition de l’intervalle du délai d’attente d’initialisation, 70 Définition du nombre maximum de tentatives de redémarrage, 72 Désactivation, 85 Détection à l’aide d’ILOM, 77 Détection à l’aide du POST, 79 DHCP, affichage de l’adresse IP du serveur, 54 Diagnostic, 76 E Effacement, 83 Exécution de diagnostics, 79 F FCode, utilitaire, 36 Fonctions spécifiques à la plate-forme, 3 FRU, modification des données, 45 G Gestion, 73, 75 Gestion de la configuration, 62 Gestion du délai de mise sous tension, 50 Gestion du script, 65 Gestion du système, 61 Gestion lors de la réinitialisation, 64 H Historique de la console, affichage, 80 I Identification du système, modification, 46 Interrupteur à clé, comportement de l’hôte, 51 Invite, 12, 15120 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 L Localisation du serveur, 87 M Méthodes d’accès, 15 Microprogramme, mise à jour, 90 Mise hors tension, 20 Mise sous tension, 19 Moniteur graphique local, 15 Multiacheminement, logiciel, 6 N Nom d’utilisateur et mot de passe par défaut, 12 O ok, affichage de l’invite, 13 Options d’adresse réseau, 53 Oracle VM Server (LDoms), 62 Oracle VM Server pour SPARC, présentation, 5 P Présentation, 1, 61 Présentation de l’administration système, 1 Prise en charge, 25 R Réinitialisation à partir d’ILOM, 22 Réinitialisation à partir du SE, 21 Restauration au redémarrage, 48 S setting configuration variables, 16 SP, réinitialisation, 23 Stratégie d’initialisation parallèle, 50 SunVTS, 76 Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes Part No. E21444-01 May 2011, Revision APlease Recycle Copyright © 2009, 2010, 2011 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2009, 2010, 2011 Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd.iii Contents Using This Documentation xi ? Download Product Software and Firmware xiii Oracle ILOM 3.0 Feature Set 1 Oracle ILOM 3.0 Feature Set Overview 2 Server-Specific Oracle ILOM Features 3 CMM-Specific Features 3 CMM Chassis-Level Management 3 Updates to Oracle ILOM 3.0.3 Firmware 5 New Features for Oracle ILOM 3.0.3 6 Resolved Issues as of Oracle ILOM 3.0.3 7 Alt-Graph Key Functionality on International Keyboards 8 Web Interface Does Not Display the Browse Button When Uploading Files 9 Newly Generated SSH Keys Require SSH Server Restart 9 Loading SSH Host Key Results in Error Message 9 Email Address Using IP Address Is Accepted in Alert Management Rule Query 10 When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (SPARC Servers) 10 Known Issues as of Oracle ILOM 3.0.3 11 BIOS Upgrade Is Delayed After SP Reboot 11 External Serial Port Settings Do Not Reset to Default Value 12iv Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour 12 SSH Keys Fail to Restore After a Backup/Restore 13 Updates to Oracle ILOM 3.0.4 Firmware 15 New Features for Oracle ILOM 3.0.4 16 Resolved Issues as of Oracle ILOM 3.0.4 18 LDAP or RADIUS Commands Do Not Work When Default Role Is Set to none 18 Difficulty Removing dnslocatorquery Records From Active Directory Configuration 19 When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (x86 Servers) 19 Snapshot Utility Missing Log Files for Debugging 20 Oracle ILOM CLI for set /{target}/config dump_uri Does Not Provide Confirmation Message 20 Role Help Text for Read-Only /SYS Properties Is Incorrect 20 Help Text for Power Management Properties Is Incorrect 21 Help Output Results for Is Confusing 21 Inaccurate Help Text Values for /SP/users/root/ssh/key/1-5 22 Oracle ILOM External Serial Port Flow Control Is Implemented Incorrectly 22 CLI Auto Completion for Read-Only Properties Does Not Work on Sun Fire X4140, X4240, and X4440 Servers 23 Known Issues as of Oracle ILOM 3.0.4 23 ? Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image 23 Unrecoverable Oracle ILOM Remote Console Sessions 24 Updates to Oracle ILOM 3.0.6 Firmware 27 New Features for Oracle ILOM 3.0.6 28 Resolved Issues as of Oracle ILOM 3.0.6 29Contents v Inability to Send SMTP Test Alert Email Notification 29 Inability to Navigate From CMM to Server Module After Disabling SSH 29 Power Management Events Are Not Recorded in Log File 30 Known Issues as of Oracle ILOM 3.0.6 30 Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0 30 Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool 31 Console Error Appears After Performing Backup and Restore 31 Windows Server 2008 R2 Generates System Event Log Warning Messages When Power Is Being Limited by Oracle ILOM Power Management 31 Updates to Oracle ILOM 3.0.8 Firmware 33 New Features for Oracle ILOM 3.0.8 34 Resolved Issues as of Oracle ILOM 3.0.8 35 Invalid Time Zone Settings in Oracle ILOM CLI 35 Snapshot Properties Are Not Persistent After a Reset 36 Known Issues as of Oracle ILOM 3.0.8 36 Storage Redirection Not Supported With 64-bit JRE 36 5-Minute Delay to View Storage Monitoring Information 37 Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface 38 Updates to Oracle ILOM 3.0.9 Firmware 39 New Features for Oracle ILOM 3.0.9 40 Resolved Issues as of Oracle ILOM 3.0.9 41 Unrecoverable Oracle ILOM Remote Console Sessions 41 Known Issues as of Oracle ILOM 3.0.9 43 ? DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9 43vi Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Invalid Help Command (help /SP system_contact=test) Results in Unusable Output 44 Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled 44 Updates to Oracle ILOM 3.0.10 Firmware 45 New Features for Oracle ILOM 3.0.10 46 Resolved Issues as of Oracle ILOM 3.0.10 47 Invalid Help Command (help /SP system_contact=test) Results in Unusable Output 47 IPMItool sunoem CLI Might Be Denied If All Session Slots Are Busy 47 Known Issues as of Oracle ILOM 3.0.10 48 ? DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount 48 Storage Redirection CLI Service Requires 32-bit JDK to Successfully Start 49 ? Specify the 32-bit JDK File to Start Storage Redirection Service Using Firefox Web Browser 49 ? Specify the 32-bit JDK File to Start Storage Redirection Service Using Internet Explorer Web Browser 50 Oracle ILOM Remote Console Requires 32-bit JDK to Successfully Launch 51 ? Specify the 32-bit JDK File to Launch the Oracle ILOM Remote Console Using Firefox Web Browser 51 ? Specify the 32-bit JDK File to Launch the Oracle ILOM Remote Console Using Internet Explorer Web Browser 51 Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6 52 Updates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware 53 New Features for Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 54 Resolved Issues as of Oracle ILOM 3.0.14 55 BIOS Upgrade Is Delayed After SP Reboot 56Contents vii External Serial Port Settings Do Not Reset to Default Value 56 Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour 57 Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image 57 Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0 57 Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool 58 Console Error Appears After Performing Backup and Restore 58 Windows Server 2008 R2 Generates System Event Log Warning Messages When Power Is Being Limited by Oracle ILOM Power Management 58 5-Minute Delay to View Storage Monitoring Information 59 Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface 59 DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9 59 Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled 60 Updated Documentation Describing Storage Redirection 32-bit JDK Requirement 60 Updated Documentation Describing Oracle ILOM Remote Console 32-bit JDK Requirement 60 DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount 61 Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6 61 Known Issues as of Oracle ILOM 3.0.14 62 Updates to Oracle ILOM 3.0.16 Firmware 63 Resolved Issues as of ILOM 3.0.16 64 Fault Not Reported When Soft Threshold (Critical) Is Crossed 65 Event List Showing SNMP Authentication Password as Plain Text 65viii Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Setting Customer FRU Data Causes User Interface to Hang 66 Installation Record Created After Rebooting the Server SP 66 UDP Ports 781 and 782 Not Detected 66 IPv6 Settings in Web Interface Allows Invalid Combination of Options 67 AES Encryption Not Working for SNMPv3 Traps 67 Help Text for load Command Displays Command Failed Message 67 Unable to Set Blade IPv4 Network Settings From CMM Web Interface 68 IPv6 CLI Properties and Values Not Shown 69 Unable to Log In to Oracle ILOM After LDAP Modifications 69 Event Filtering for Email Alerts Not Working 69 IPv6 Autoconfig Value Appears as None When DHCPv6 Is Not Configured 70 Error Message About No IPv6 Configuration During SP Boot 70 URL Button Enabled While Uploading Firmware Image 71 Enhanced FRU Information In Fault Management Shell 71 Restore Operation Does Not Restore Alert Rules 71 Two Identical SNMP Traps Created After Fault Status Is Cleared 72 Enhancement for RADIUS IPv6 Authentication 72 Enhancement for Active Directory Group Names to Support 128 Characters 72 Oracle ILOM Does Not Solicit for IPv6 Address After Re-Enabling DHCPv6 73 Missing Time Zone Options in Web Interface 73 UTC Date and Time Changes to Local Date and Time After Reseating Power Cord 73 Enhancement to Extend SNMP Support for Ethernet USB Device 74 Known Issue as of Oracle ILOM 3.0.16 74 Oracle ILOM Remote Console IPv6 Requirement for Windows Client 74 Unable to Set Single or Double Quote Character for Remote Console Custom Lock Key (CLI) 75Contents ix Enhancements to Oracle ILOM Documentation Library 75x Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011xi Using This Documentation This Feature Updates and Release Notes guide describes enhancements that have been made to Oracle Integrated Lights Out Manager (ILOM) firmware since the Oracle ILOM 3.0 release. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is intended for technicians, system administrators, and authorized Oracle service providers, and users who have experience managing system hardware. ¦ “Documentation and Feedback” on page xii ¦ “Product Downloads” on page xiii ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xiv ¦ “Documentation, Support, and Training” on page xvxii Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xiii Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, and then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right pane that appears, click Download.xiv Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform product notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface.Using This Documentation xv Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)xvi Oracle ILOM 3.0 Feature Updates and Release Notes • May 20111 Oracle ILOM 3.0 Feature Set This chapter includes the following information about the Oracle ILOM 3.0 feature set: ¦ “Oracle ILOM 3.0 Feature Set Overview” on page 2 ¦ “Server-Specific Oracle ILOM Features” on page 2 ¦ “CMM-Specific Features” on page 2 ¦ “CMM Chassis-Level Management” on page 32 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Oracle ILOM 3.0 Feature Set Overview The Oracle ILOM 3.0 feature set provides common Oracle ILOM functionality that applies to all Oracle Sun Blade Modular Systems, server modules (blades), and rackmount servers. These features are built into the Oracle ILOM 3.0.x firmware that is installed on the server service processor (SP) and, if applicable, on the chassis monitoring module (CMM). Note – CMMs are applicable to Oracle Sun Blade Modular Systems. CMMs are not applicable to Oracle rackmount servers. This section includes the following topics: ¦ “Server-Specific Oracle ILOM Features” on page 2 ¦ “CMM-Specific Features” on page 2 ¦ “CMM Chassis-Level Management” on page 3 Server-Specific Oracle ILOM Features The Oracle ILOM 3.0.x SP firmware operates on many Oracle server platforms, supporting features that are common to all platforms, as well as other features that are specific to an Oracle server. For additional information about the Oracle ILOM 3.0.x features that are supported specifically for your server, see the Oracle ILOM Supplement guide or Administration guide that is provided for your server. CMM-Specific Features The Oracle ILOM 3.0 firmware on the chassis monitoring module (CMM) is configured with an individual IP address assigned either statically or dynamically using DHCP. The CMM acts as a conduit to the server module Oracle ILOM configuration, enabling settings such as network addresses and administrative user accounts to be configured or viewed. In addition, the CMM supports HTTP and CLI "pass-through" interfaces that provide access to all chassis features through a direct serial port connection or a 10/100/1000-BASE-T network management port connection on the CMM.Oracle ILOM 3.0 Feature Set 3 CMM Chassis-Level Management Oracle ILOM on the CMM offers a tiered management architecture that enables system management of individual components or aggregated management of components at the chassis level. A summary of the CMM’s management functions include: ¦ Implementation of an IPMI satellite controller, making the chassis environmental sensors visible to the server module’s BMC functions ¦ Direct environmental and inventory management using CLI, web, SNMP, and IPMI interfaces ¦ Firmware management of CMM, network express module (NEM), and server module SPs ¦ Pass-through management of server modules and HTTP links along with CLI SSH contexts ¦ Chassis power control ¦ Access to the following components: ¦ Chassis ¦ Power supplies ¦ Fans ¦ Network express modules (NEMs) ¦ Server module SPs4 Oracle ILOM 3.0 Feature Updates and Release Notes • May 20115 Updates to Oracle ILOM 3.0.3 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.3 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.3” on page 6 ¦ “Resolved Issues as of Oracle ILOM 3.0.3” on page 7 ¦ “Known Issues as of Oracle ILOM 3.0.3” on page 116 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.3 The following table identifies new features available in the Oracle ILOM 3.0.3 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: Updated CMM chassis management view and documentation • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Web Interface Overview Enhanced CMM power management metrics • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Power Monitoring and Management of Hardware Interfaces Enhanced feature for displaying the history of platform-specific power consumption • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Power Monitoring and Management of Hardware Interfaces Enhanced feature to override the boot device settings in BIOS using the Oracle ILOM CLI or web interface • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Remote Host Management Options • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing Remote Hosts Power States • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing Remote Hosts Power StatesUpdates to Oracle ILOM 3.0.3 Firmware 7 Resolved Issues as of Oracle ILOM 3.0.3 This section describes the issues that have been resolved as of Oracle ILOM 3.0.3. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. Updated information for clearing faults from the event log after fixing a faulted component • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, System Monitoring and Alert Management • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Monitoring System Components • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Monitoring System Components Enhanced web pages with jump links • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Web Interface Overview New data collection options for Snapshot Utility • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Remote Hosts Diagnostics for x86 and SPARC Systems • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Performing Remote Host System Diagnostics • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Performing Remote Host System Diagnostics Topic Descriptions Links Oracle ILOM Remote Console resolved issue • “Alt-Graph Key Functionality on International Keyboards” on page 8 User management resolved issue • “Web Interface Does Not Display the Browse Button When Uploading Files” on page 9 Topic Descriptions Refer To:8 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Alt-Graph Key Functionality on International Keyboards When running certain versions of the Oracle ILOM Remote Console on a client, the Alt-Graph key works incorrectly on international keyboards. This problem was addressed in two phases: 1. Workaround: A Workaround is provided that adds a short-cut key combination (ALT-z) for toggling on or off the "Right Alt" Keyboard menu item in Oracle ILOM Remote Console. This Workaround does not depend on a specific version of the Java Development Kit (JDK). However, this Workaround is limited in that it is not possible to send the ALT-GR key directly. To use the Workaround, you must be running a version of Oracle ILOM Remote Console that contains the supported short-cut key (ALT-z). 2. Complete Solution: This solution sends the ALT-GR key directly without any special Remote Console menu options or intervention. However, it requires using a more recent version of the JDK. To use the Complete Solution, you must be running a version of Oracle ILOM Remote Console that sends the ALT-GR key directly. The following JDK requirements also apply to the Complete Solution: ¦ For Windows, use JDK 1.5 or higher. ¦ For Solaris and Linux, use JDK 1.6 update 10 or higher. You can use the Oracle ILOM version command to determine which version of Oracle ILOM is running on a platform. Note – Linux and Solaris versions of Oracle ILOM 3.0.x contain both the Workaround and Complete Solution. Windows versions of Oracle ILOM 3.0.x contain the functionality as described for the Complete Solution, but not the Workaround. SSH host keys resolved issues • “Newly Generated SSH Keys Require SSH Server Restart” on page 9 • “Loading SSH Host Key Results in Error Message” on page 9 Alert management known issue • “Email Address Using IP Address Is Accepted in Alert Management Rule Query” on page 10 System clock setting resolved issue for SPARC servers • “When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (SPARC Servers)” on page 10 Topic Descriptions LinksUpdates to Oracle ILOM 3.0.3 Firmware 9 Web Interface Does Not Display the Browse Button When Uploading Files CR 6787083 Issue: In earlier versions of Oracle ILOM, a configuration page did not display the Browse option to upload an SSL certificate in the following situations: ¦ When uploading a different SSL certificate and key for HTTPS access ¦ When configuring an optional certificate for LDAP/SSL ¦ When configuring an optional certificate for Active Directory ¦ When configuring user SSH keys ¦ When configuring backup and restore operations Clicking the Upload button to obtain an SSL certificate prompted a new window to appear; however, you were unable to select and upload a file. Update: This issue is fixed in the Oracle ILOM 3.0.3 release. The Browse option to upload an SSL certificate is now available. Newly Generated SSH Keys Require SSH Server Restart CR 6781487 Issue: When you are generating a new SSH key, you do not need to restart the SSH server for the new key to take effect. The new SSH key will become immediately available for new connections. Update: SSH keys are now available for new connections immediately without a server restart as a Oracle ILOM 3.0.3. Loading SSH Host Key Results in Error Message CR 6776200 Issue: In earlier versions of Oracle ILOM, using the load command to upload an SSH host key might result in a set: Command Failed error message, even when the SSH host key was uploaded successfully. This error message no longer appears in Oracle ILOM 3.0.3 and later versions. Update: This issue is fixed in the Oracle ILOM 3.0.3 release.10 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Email Address Using IP Address Is Accepted in Alert Management Rule Query CR 6776214 Issue: When using Oracle ILOM’s alert management feature, previous versions of Oracle ILOM required you to use a host name-based email address. You can now send an email alert using an IP address. Update: A separate check for IP-based email addresses has been added to the Oracle ILOM 3.0.3 release so that if the original validation fails, the system will then check specifically for an email with an IP address. When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (SPARC Servers) CR 6798875 Issue: When using the CLI to set the time zone, some time zones either do not recalculate the clock correctly or update the time zone setting on the clock. Update: As of Oracle ILOM 3.0.3.20b this issue has been fixed for SPARC servers. You must use valid global time zone nomenclature to set the time zone to recalculate the clock correctly. You can find a list of the valid global time zone nomenclature on the Internet, for example, at: (http://en.wikipedia.org/wiki/List_of_zoneinfo_time_zones) Examples: ¦ To set the SP clock time zone property value to the US standard eastern zone, you would type: -> set /SP/clock/ timezone=America/New_York or ¦ To set the SP clock time zone property value to the US central time zone, you would type: -> set /SP/clock/ timezone=America/ChicagoUpdates to Oracle ILOM 3.0.3 Firmware 11 Known Issues as of Oracle ILOM 3.0.3 This section describes the known issues as of Oracle ILOM 3.0.3. The following table identifies the known issues and points you to the sections that describe the issues. Specific change request (CR) numbers and workarounds or updates for the issues are provided, where available. BIOS Upgrade Is Delayed After SP Reboot CR 6813514 Issue: When you upgrade the SP firmware, you can choose to upgrade the BIOS firmware immediately or to delay the BIOS upgrade until a later time. If you choose to immediately upgrade the BIOS, the SP firmware is upgraded, the host is forced to power off, and the SP reboots. If you choose to delay the BIOS upgrade, the SP firmware is upgraded and the SP reboots. Regardless of your choice, the BIOS is not programmed immediately. Instead, the SP reboots the new 3.0.x image and waits for the host to power off. The host will be powered off if you chose the immediate BIOS upgrade option and will begin to program the host BIOS. This process can take two to five minutes to complete. However, two issues can occur: ¦ Issue 1: If you chose the immediate BIOS upgrade option, while the host BIOS is being programmed, there is no indication that the BIOS upgrade is being programmed. If you power on the host while the BIOS is being programmed, the BIOS will become garbled and the host will not boot. The solution is to power off the host, wait two to five minutes for the SP to program the BIOS, then power on the host. Topic Descriptions Links Unexpected BIOS behavior • “BIOS Upgrade Is Delayed After SP Reboot” on page 11 Unexpected behavior when resetting to defaults • “External Serial Port Settings Do Not Reset to Default Value” on page 12 Hourly timestamp behavior • “Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour” on page 12 SSH keys are not loaded • “SSH Keys Fail to Restore After a Backup/Restore” on page 1312 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 ¦ Issue 2: If you chose the delayed BIOS option and do not power off the host, the BIOS will not be upgraded. The host must be powered off for the SP to program the BIOS. If you simply reboot the host, the old BIOS will still be present. Mismatched BIOS and SP firmware might result in incorrect system behavior. Workaround: It is strongly recommended that you power off the host as soon as possible following an SP firmware upgrade, and wait at least five minutes before rebooting the system. External Serial Port Settings Do Not Reset to Default Value CR 6676339 Issue: The reset_to_defaults command enables a user to reset the Oracle ILOM configuration back to the default values. However, external serial port settings are not reset when reset_to_defaults action is performed. Workaround: Use the CLI or web interface to set the external port settings to the desired values before rebooting Oracle ILOM. The external serial port settings can be accessed by typing /SP/serial/external in the CLI or by selecting Configuration --> Serial Port in the web interface. Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour CR 6803961 Issue: When logging in to a CMM using the CLI, the hourly power history includes an entry with a timestamp one hour into the future. This entry shows the average power from the prior timestamp to the current moment. Workaround: None. The power average timestamp is not a "rolling average" of the last minute or hour. Instead, Oracle ILOM selects a starting point in time (call it time 0). At 60 seconds, Oracle ILOM records the first minute average. For the next 59 seconds there would be no change, then at time 120, Oracle ILOM records the second minute average. The last minute average is the average of the most recent minute, and not the average of the last minute the sensor was readable. For the hour average, no samples are taken until time 3600 when the first one-hour average is recorded. Oracle ILOM records the second hour average at time 7200.Updates to Oracle ILOM 3.0.3 Firmware 13 The last 60 one-minute averages will not equal the last one-hour average, unless you compare it with the exact correct time when the most recent hourly average was stored. Note that the hourly minimum and maximum average can have a later timestamp than the minute averages. This occurs when Oracle ILOM does not record data, which only happens if the sensor is no longer readable (power has been turned off, or has dropped too low to measure). In this instance, Oracle ILOM records "no data" while the sensor is unreadable to ensure that the historical data is not lost. SSH Keys Fail to Restore After a Backup/Restore CR 6808138 Issue: When backing up and restoring an Oracle ILOM configuration, RSA and DSA private keys that exist under /SP/services/ssh/keys or /CMM/services/ssh/keys fail to restore. Workaround: When a new key is generated on the SP, this message appears: Warning: the RSA host key for ’xxx.xxx.xxx.xxx’ differs from the key for the IP address ’xxx.xxx.xxx.xxx’ Offending key for IP in ~/.ssh/known_hosts:216 Matching host key in ~/.ssh/known_hosts:189 Are you sure you want to continue connecting (yes/no)? Type yes or edit the known_hosts file.14 Oracle ILOM 3.0 Feature Updates and Release Notes • May 201115 Updates to Oracle ILOM 3.0.4 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.4 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.4” on page 16 ¦ “Resolved Issues as of Oracle ILOM 3.0.4” on page 18 ¦ “Known Issues as of Oracle ILOM 3.0.4” on page 2316 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.4 The following table identifies new features available in the Oracle ILOM 3.0.4 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: New power management layout and threshold control • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Power Monitoring and Management of Hardware Interfaces Updated idle time setting for a CLI session • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Logging In to and Out of Oracle ILOM New target added for LDAP/SSL authentication attributes • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing User Accounts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing User Accounts New ability to download SNMP MIBs from Oracle ILOM • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing System Alerts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing System Alerts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide, SNMP Overview New ability to display user roles that are assigned to a user session • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing User Accounts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing User Accounts Enhanced expanded search mode in Active Directory • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing User Accounts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing User AccountsUpdates to Oracle ILOM 3.0.4 Firmware 17 Enhanced test alert when setting IPMI traps, Email alerts, or SNMP traps • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing System Alerts • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing System Alerts New locking ability for the Oracle ILOM Remote Console • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Network Configurations • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing Remote Hosts Storage Redirection and Securing the Oracle ILOM Remote Console • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console New Oracle ILOM SP network ports • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Network Configurations Updated mouse mode setting for remote host KVMS • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, CLI Command Reference • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console Topic Descriptions Refer To:18 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Resolved Issues as of Oracle ILOM 3.0.4 This section describes the issues that have been resolved in the Oracle ILOM 3.0.4 release. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. LDAP or RADIUS Commands Do Not Work When Default Role Is Set to none CR 6804986 Topic Descriptions Links User management resolved issues • “LDAP or RADIUS Commands Do Not Work When Default Role Is Set to none” on page 18 • “Difficulty Removing dnslocatorquery Records From Active Directory Configuration” on page 19 System clock setting resolved issue • “When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (x86 Servers)” on page 19 Power management resovled issue • “Help Text for Power Management Properties Is Incorrect” on page 21 Snapshot SP data resolved issue • “Snapshot Utility Missing Log Files for Debugging” on page 20 Oracle ILOM backup CLI feature resolved issue • “Oracle ILOM CLI for set /{target}/config dump_uri Does Not Provide Confirmation Message” on page 20 CLI Help text function resolved issues • “Role Help Text for Read-Only /SYS Properties Is Incorrect” on page 20 • “Help Output Results for Is Confusing” on page 21 • “Inaccurate Help Text Values for /SP/users/root/ssh/key/1-5” on page 22 Serial port setting in CLI resolved issue • “Oracle ILOM External Serial Port Flow Control Is Implemented Incorrectly” on page 22 CLI read-only properites resolved issue • “CLI Auto Completion for Read-Only Properties Does Not Work on Sun Fire X4140, X4240, and X4440 Servers” on page 23Updates to Oracle ILOM 3.0.4 Firmware 19 Issue: When you set the LDAP or RADIUS default role to none, the Read Only (-o) role is not automatically assigned as it should be. Update: This issue is fixed in the Oracle ILOM 3.0.4 release. Now when you set the LDAP or RADIUS default role to none and log in as an LDAP or RADIUS user, the Read Only (o) role is assigned. Difficulty Removing dnslocatorquery Records From Active Directory Configuration CR 6797346 Issue: dnslocatorquery records cannot be removed during configuration of Active Directory. Update: This issue is fixed in the Oracle ILOM 3.0.4 release. The content and range rules for the dnslocatorquery records have been relaxed to allow for the clearing or removal of the entries. This allows an empty string value to be accepted to completely remove the entry. When Using the CLI to Set the Time Zone, Certain Time Zones Do Not Recalculate the Clock Correctly (x86 Servers) CR 6798875 Issue: When using the CLI to set the time zone, some time zones either do not recalculate the clock correctly or update the time zone setting on the clock. Update: As of Oracle ILOM 3.0.4 this issue has been fixed for x86 servers. You must use valid global time zone nomenclature to set the time zone to recalculate the clock correctly. You can find a list of the valid global time zone nomenclature on the Internet, for example, at: (http://en.wikipedia.org/wiki/List_of_zoneinfo_time_zones) Examples: ¦ To set the SP clock time zone property value to the US standard eastern zone, you would type: -> set /SP/clock/ timezone=America/New_York or20 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 ¦ To set the SP clock time zone property value to the US central time zone, you would type: -> set /SP/clock/ timezone=America/Chicago Snapshot Utility Missing Log Files for Debugging CR 6811375 Issue: Missing files from /var/log impairs debug process when collecting data for Service personnel using the Snapshot Utility. Update: The missing Snapshot Utility /var/log files have been restored in the Oracle ILOM 3.0.4 release. Oracle ILOM CLI for set /{target}/config dump_uri Does Not Provide Confirmation Message CR 6804202 Issue: When you set the dump_uri on /{target}/config, the Oracle ILOM CLI does not display a confirmation message to indicate whether the command was successful. Update: The print confirmation message for set /{target}/config dump_uri has been corrected in the Oracle ILOM 3.0.4 release. Role Help Text for Read-Only /SYS Properties Is Incorrect CR 6764923, CR 6770180 Issue: The Oracle ILOM CLI Help provides misleading user role information for read-only /SYS properties. For example: -> help /SYS fru_part_number Properties: fru_part_number : FRU part number fru_part_number : User role required for set = rUpdates to Oracle ILOM 3.0.4 Firmware 21 User role information provided by the Help text for read-only properties is misleading since the read-only properties cannot be configured regardless of user role. Update: As of Oracle ILOM 3.0.4, the Oracle ILOM Help function was updated to remove the required user role value for read-only /SYS properties. Help Text for Power Management Properties Is Incorrect CR 6770180 Issue: The following properties are read-only and are not configurable; therefore, the role required to view these properties is Read Only (o): -> help /SP/powermmgmt Properties: actual_power : Actual power consumed by the system actual_power : User role required for set = o permitted_power : Total power permitted for the system permitted_power : User role required for set = o available_power : Available power for the system available_power : User role required for set = o Update: This issue is fixed in the Oracle ILOM 3.0.4 release. The Help text associated with the properties now correctly specifies that the required role to view the properties is Read Only (o). Help Output Results for Is Confusing CR 6770069 Issue: Help function displays confusing text when listing values for multiple properties, for example: Help output prints: -> help /HOST send_break_action boottimeout status Properties: send_break_action : Send Break Action to Host send_break_action : Possible values = break, dumpcore send_break_action : User role required for set = c22 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Help output should print: Update: The Help function was updated in the Oracle ILOM 3.0.4 release to remove property values that were not applicable. Inaccurate Help Text Values for /SP/users/root/ssh/key/1-5 CR 6783032 Issue: The Help text has several inaccuracies for the different properties under /SP/users/root/ssh/key/. Update: The Help function for /SP/users/root/ssh/key has been corrected in the Oracle ILOM 3.0.4 release. Oracle ILOM External Serial Port Flow Control Is Implemented Incorrectly CR 6822067 Issue: Writable support (using the set command) for Oracle ILOM’s external serial port flow control is supported only on Oracle’s AST2000 server-based platforms. boottimeout : Boot time out send_break_action : Possible values = break, dumpcore boottimeout : User role required for set = r status : Host Status send_break_action : Possible values = break, dumpcore boottimeout : User role required for set = r -> help /HOST send_break_action boottimeout status Properties: send_break_action : Send Break Action to Host send_break_action : Possible values = break, dumpcore send_break_action : User role required for set = c boottimeout : Boot time out boottimeout : User role required for set = r status : Host StatusUpdates to Oracle ILOM 3.0.4 Firmware 23 Update: As of Oracle ILOM 3.0.4, writable support for Oracle ILOM’s external serial port flow control is supported on all Oracle platforms. CLI Auto Completion for Read-Only Properties Does Not Work on Sun Fire X4140, X4240, and X4440 Servers CR 6729108 Issue: CLI does not recognize read-only properties when using the show command. Update: Support was added to the Oracle ILOM 3.0.4 release to recognize read-only properties while using the show command. Known Issues as of Oracle ILOM 3.0.4 This section describes known issues and workarounds as of Oracle ILOM 3.0.4. Specific change request (CR) identification numbers and workarounds for these issues are provided, where available. ? Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image CR 6806444 Issue: When using a Windows client to redirect a CD-ROM image or floppy image from the Oracle ILOM Remote Console, the Oracle ILOM Remote Console might not respond. Topic Descriptions Links Oracle ILOM Remote Console known issues • “Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image” on page 23 • “Unrecoverable Oracle ILOM Remote Console Sessions” on page 2424 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Affected Software: ¦ Oracle ILOM 2.0 or later and Oracle ILOM 3.0 or later ¦ Oracle ILOM Remote Console ¦ JDK 1.6 ¦ Windows operating system installed on client system. Workaround: ? Close the Oracle ILOM Remote Console window on the Windows client, then perform one of the following workarounds: ¦ Using a Linux or Solaris client, launch the Oracle ILOM Remote Console to redirect the CD-ROM image or floppy image. or ¦ Using a Windows, Solaris, or Linux client, launch the Storage Redirection Utility in Oracle ILOM 3.0 to redirect the CD-ROM image or floppy image. Note – The Storage Redirection Utility feature is a command-line utility that is only available in Oracle ILOM 3.0. For instructions about how to use the Storage Redirection Utility, see the Oracle ILOM 3.0 Documentation Collection. Unrecoverable Oracle ILOM Remote Console Sessions CR 6867870 Issue: Unrecoverable Oracle ILOM Remote Console sessions can occur when: ¦ The Oracle ILOM Remote Console client has multiple tabs showing connections to three different hosts while the state of the Oracle ILOM Remote Console client is in sleep mode (or network cable is disconnected).Updates to Oracle ILOM 3.0.4 Firmware 25 ¦ A second and third Oracle ILOM Remote Console client have the same connections established to the same three hosts while the state of these Remote Console clients are also in sleep mode (or network cable is disconnected). When one (or more) of the Oracle ILOM Remote Console clients returns from sleep mode (or the network cable is reconnected) and is unable to restart an inactive session, the following occurs: ¦ A system dialog appears stating the “Connection with SP is down, try redirection later.” Click OK to dismiss the dialog. ¦ A second dialog appears stating “The maximum number of connections have been reached.” Click OK to dismiss the dialog. Workaround: To recover the inactive Oracle ILOM Remote Console sessions on the first two hosts, you must reset the SP (reset /SP) on both systems. For the third host, the inactive Oracle ILOM Remote Console sessions typically recover within five minutes after resetting the SPs on the first two hosts. However, if the state of the third Oracle ILOM Remote Console client is in hibernation mode or screen saver mode, the inactive Remote Console sessions on the third host might not recover. Should this occur, you will need to reset the SP on the third host to recover the inactive Oracle ILOM Remote Console sessions. Oracle ILOM Remote Console supports up to three user session connections to a host system.26 Oracle ILOM 3.0 Feature Updates and Release Notes • May 201127 Updates to Oracle ILOM 3.0.6 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.6 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.6” on page 28 ¦ “Resolved Issues as of Oracle ILOM 3.0.6” on page 29 ¦ “Known Issues as of Oracle ILOM 3.0.6” on page 3028 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.6 The following table identifies new features available in the Oracle ILOM 3.0.6 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: New storage monitoring properties for HDDs and RAID configurations • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Storage Monitoring and Zone Management • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Monitoring Storage Components and Zone Manager Enhancements to power management • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Power Monitoring and Management of Hardware Interfaces New root password warning message • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Overview Updated list of network ports used by Oracle ILOM • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Network ConfigurationsUpdates to Oracle ILOM 3.0.6 Firmware 29 Resolved Issues as of Oracle ILOM 3.0.6 This section describes the issues that have been resolved as of the Oracle ILOM 3.0.6. Specific change request (CR) identification numbers for these fixed issues are provided, where available. Inability to Send SMTP Test Alert Email Notification CR 6850298 Issue: After pressing Test (on SMTP page) the test email notification was not sent and there was no entry found in event log for this event. Update: This issue has been resolved as of Oracle ILOM 3.0.6. Inability to Navigate From CMM to Server Module After Disabling SSH CR 6837359 Issue: After disabling SSH on a server module it was impossible to navigate to the server module from the CMM. Update: This issue has been resolved as of Oracle ILOM 3.0.6. Topic Descriptions Links Unexpected SMTP test email notification behavior • “Inability to Send SMTP Test Alert Email Notification” on page 29 Unexpected drill-down behavior from CMM to blade • “Inability to Navigate From CMM to Server Module After Disabling SSH” on page 29 Unexpected power management event behavior • “Power Management Events Are Not Recorded in Log File” on page 3030 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Power Management Events Are Not Recorded in Log File CR 6831492 Issue: Power management was not triggering an event after crossing a threshold. Update: This issue has been resolved as of Oracle ILOM 3.0.6. Known Issues as of Oracle ILOM 3.0.6 This section describes known issues and workarounds as of Oracle ILOM 3.0.6. Specific change request (CR) identification numbers and workarounds for these issues are provided, where available. Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0 CR 6858008 Issue: When the SP firmware is updated from Oracle ILOM 2.0 to 3.0, the Oracle ILOM web interface might not be able to retrieve the remote host power state after the upgrade completes. If this occurs, a blank page appears on the Remote Power Control tab. Workaround: Perform one of the following actions: Topic Descriptions Links Oracle ILOM web interface known issues • “Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0” on page 30 • “Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool” on page 31 IPMI interface known issue • “Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool” on page 31 Back up and restore known issue • “Console Error Appears After Performing Backup and Restore” on page 31Updates to Oracle ILOM 3.0.6 Firmware 31 ¦ Clear your browser cache and refresh your browser after completing the upgrade. or ¦ In the header area of the Oracle ILOM web page, click the Refresh button (on the Oracle ILOM web interface page) to correct the browser caching issue. Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool CR 6848980 Issue: Unknown sensor LED statuses are shown in the Oracle ILOM web interface when using IPMItool to monitor Oracle servers. This issue is likely to occur when concurrently running the SP and the IPMI KCS interface from the operating system (OS). As a result of this configuration, the IPMI messages are overloaded to the SP. Workaround: To enable the Oracle ILOM web interface sufficient time to read the IPMI sensors, you should limit the rate of KCS message responses to the host OS by inserting the command sleep 1 between commands in your host IPMItool script. Console Error Appears After Performing Backup and Restore CR 6847309 Issue: The following console error message might appear after backing up and restoring the Oracle ILOM configuration. bind (udp): Address already in use Workaround: None. This is a benign error message. Windows Server 2008 R2 Generates System Event Log Warning Messages When Power Is Being Limited by Oracle ILOM Power Management CR 688128432 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Issue: When power is being limited by the Oracle ILOM Power Management feature, the Windows Server 2008 R2 operating system will generate warning messages in the System Event Log informing the user that the processor(s) are being restricted. Example Event: The Speed of Processor xx in group x is being limited by system firmware. The processor has been in this reduced performance state for xxxx seconds since last report. Workaround. None needed. These are expected events and are not indicative of a problem.33 Updates to Oracle ILOM 3.0.8 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.8 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.8” on page 34 ¦ “Resolved Issues as of Oracle ILOM 3.0.8” on page 35 ¦ “Known Issues as of Oracle ILOM 3.0.8” on page 3634 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.8 The following table identifies new features available in the Oracle ILOM 3.0.8 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: Enhanced web interface page that enables you to view and manage system summary information and power-on settings from one page • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Web Interface Overview New power management terminology and web layout for SP • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Power Monitoring and Management of Hardware Interfaces New IPMI power capping (Power Limit) capability and new IPMI procedures for: • Set Power-Limit Budget Activation State • Get Power-Limit Budget Wattage • Set Power Limit Budget Wattage • Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide, IPMI Overview New power capping (Power Limit) capability for SNMP implementations For more information, see the Hardware Control MIB for power management data objects • Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide, IPMI Overview New functionality added in Oracle ILOM for system banner messages • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Overview • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Logging In to and Out of Oracle ILOM • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Logging In to and Out of Oracle ILOM New Oracle ILOM web interface support for Storage Monitoring • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Monitoring Storage Components and Zone ManagerUpdates to Oracle ILOM 3.0.8 Firmware 35 Resolved Issues as of Oracle ILOM 3.0.8 This section describes the issues that have been resolved in the Oracle ILOM 3.0.8 release. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. Invalid Time Zone Settings in Oracle ILOM CLI CR 6871128 Issue: Incomplete time zone names were accepted by Oracle ILOM for the CLI target: SP/clock/timezone. An incomplete time zone name could cause the system to use the time zone for Greenwich Mean Time (GMT). New functionality added in Oracle ILOM to support WS-Management and CIM as a standard management interface • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Overview • Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide, Server Management Using WS-Management and CIM New SP History Log functionality added in Oracle ILOM for Oracle x86 servers Note - This content is applicable to Oracle SPARC servers as well. • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Monitoring System Components New TPM management for SPARC servers • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing TPM and LDom States on SPARC Servers • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing TPM and LDom States on SPARC Servers Topic Descriptions Links Time zone CLI setting issue resolved • “Invalid Time Zone Settings in Oracle ILOM CLI” on page 35 Snapshot properties are not persistent after resetting the SP • “Snapshot Properties Are Not Persistent After a Reset” on page 36 Topic Descriptions Refer To:36 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Update: This issue is fixed in the Oracle ILOM 3.0.8 release. The Oracle ILOM CLI only accepts and validates complete time zone names. Snapshot Properties Are Not Persistent After a Reset Issue: If you use the CLI to change the Snapshot property values and then reset the SP, the Snapshot property values revert to their default property values. Update: The Snapshot feature in Oracle ILOM is working as designed. The Snapshot properties are not persistent after resetting the SP. Known Issues as of Oracle ILOM 3.0.8 This section describes known issues and workarounds as of Oracle ILOM 3.0.8. Specific change request (CR) identification numbers and workarounds for these issues are provided, where available. Storage Redirection Not Supported With 64-bit JRE CR 6800702 and CR 6805732 Topic Descriptions Links The 64-bit JRE is not supported for Storage Redirection • “Storage Redirection Not Supported With 64-bit JRE” on page 36 Long delay populating storage monitoring devices after performing upgrade • “5-Minute Delay to View Storage Monitoring Information” on page 37 Oracle ILOM version not shown when upgrading Oracle ILOM using Oracle Hardware Installation Assistant and an inband management interface • “Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface” on page 38Updates to Oracle ILOM 3.0.8 Firmware 37 Issue: An attempt to start Storage Redirection might fail when using a 64-bit Java runtime environment (JRE). Since the 64-bit JRE is the default on a 64-bit system, you will need to have the 32-bit JRE installed as well. When using a 64-bit JRE to start Storage Redirection, the following error message appears: "Unsupported platform" Workaround: Install a 32-bit JRE on the 64-bit system. JREs can be downloaded from this site: (http://java.com/en/download/index.jsp) 5-Minute Delay to View Storage Monitoring Information CR 6870530 Issue: You might experience up to a 5-minute delay before storage monitoring information is present or up to date in the Oracle ILOM CLI or the web interface. This delay typically occurs after: ¦ Upgrading to Oracle ILOM 3.0.6 (or later) and installing the required System Management Pack. or ¦ Querying the system after updates were made to the RAID or disk information. Note – The Storage Monitoring feature is not available on all Oracle servers. To determine whether your server is enabled to support this feature, refer to the Oracle ILOM Supplement guide or Administration guide for your server. Note – If the Storage Monitoring feature is available on your server, a System Management Pack is required to be installed prior to using the Storage Monitoring feature. For more information about the System Management pack required for your server, refer to the Oracle ILOM Supplement guide or Administration guide for your server. Workaround: There is no workaround. This 5-minute delay only occurs after installation of the required System Management Pack or after RAID or disk updates have been made to the system.38 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface CR 6867109 Issue: When upgrading Oracle ILOM from the Oracle Hardware Installation Assistant (HIA) using the inband interface, HIA might not (on some Oracle servers) display the running version of Oracle ILOM. Workaround:Use the Oracle ILOM web interface to determine the running version of Oracle ILOM.39 Updates to Oracle ILOM 3.0.9 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.9 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.9” on page 40 ¦ “Resolved Issues as of Oracle ILOM 3.0.9” on page 41 ¦ “Known Issues as of Oracle ILOM 3.0.9” on page 4340 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.9 The following table identifies new features available in the Oracle ILOM 3.0.9 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: New component firmware update capability for modular chassis systems • Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems, Firmware Update Procedures New component firmware management capability for Sun Fire X4800 Systems • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Updating Oracle ILOM Firmware • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Updating Oracle ILOM Firmware New international keyboard support for Oracle ILOM Remote Console • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Remote Host Management Options New system uptime display available in Oracle ILOM CLI and web interface • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, CLI Command Reference • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Web Interface Overview Support for Microsoft Windows 7 and Internet Explorer 8 Clients • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote ConsoleUpdates to Oracle ILOM 3.0.9 Firmware 41 Resolved Issues as of Oracle ILOM 3.0.9 This section describes the issues that have been resolved in the Oracle ILOM 3.0.9 release. Specific change request (CR) identification number and workaround for the issues are provided, where available. Unrecoverable Oracle ILOM Remote Console Sessions CR 6867870 Issue: Prior to Oracle ILOM 3.0.6, some users experienced problems when recovering an inactive Oracle ILOM Remote Console session to a host and were required, as a workaround, to reboot the host server SP to recover the session. For further details about this problem and the workaround, see “Unrecoverable Oracle ILOM Remote Console Sessions” on page 24 in the Known Issues section of “Updates to Oracle ILOM 3.0.4 Firmware” on page 15. Update: A fix that no longer requires the rebooting of the SP to recover an inactive Remote Console session is available for all Oracle server systems shipping with (or supporting) one of the following Oracle ILOM firmware releases: ¦ Oracle ILOM 3.0.6 ¦ Oracle ILOM 3.0.8 ¦ Oracle ILOM 3.0.9 If your server has Oracle ILOM 3.0.6 or later installed, the Oracle ILOM Remote Console could take up to five minutes to release and recover an inactive session. However, if the host server is powered off, the recovery time for the Oracle ILOM Remote Console session can take approximately 15 minutes. Note that the recovery Topic Descriptions Links Remote Console resolved issue • “Unrecoverable Oracle ILOM Remote Console Sessions” on page 4142 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 time for the Oracle ILOM Remote Console session is dependent on the amount of video traffic that is present. The following table provides a guideline for how long the Oracle ILOM Remote Console might take to release and recover a session. Video Screen Traffic Estimated Recovery Time for Remote Console Session Console or Host Scenario Extremely High (>30 KB per second of video traffic between host system and SP) Approximately 10 seconds Remote Console has an xterm window running “ls -R /” High (1 KB per second between host system and SP) Approximately 3 minutes Remote Console display is dynamic. For example: blinking mouse cursor Regular (500 bytes per second between host system and SP) Approximately 5 minutes Remote Console display is static. For example, it has no keyboard, mouse activity or any real-time graphical display. Low (100 bytes per second between host system and SP) Approximately 11 minutes Remote Console has a black or blank display. Very Low (7 bytes per second between host system and SP) Approximately 15 minutes Host is powered off. None (0 bytes between host system and SP) Approximately 6 minutes Remote Console session is in suspend mode (inactive tab).Updates to Oracle ILOM 3.0.9 Firmware 43 Known Issues as of Oracle ILOM 3.0.9 This section describes known issues and workarounds as of Oracle ILOM 3.0.9. Specific change request (CR) identification numbers and workarounds for these issues are provided, where available. ? DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9 CR 6913593, 6850456, and 6916007 Issue: On some platform servers, Oracle ILOM displays null DIMM FRU data fields after upgrading or downgrading the Oracle ILOM SP firmware (between 3.0.3 and 3.0.9) with the Delay BIOS Update option enabled. Workaround: Perform the following steps: 1. Power off the host before downgrading or upgrading the firmware between Oracle ILOM 3.0.3 and 3.0.9. 2. Do not enable the firmware option to Delay BIOS Update when downgrading or updating the Oracle ILOM firmware. Topic Descriptions Links Oracle ILOM displays null FRU data fields • “DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9” on page 43 Usable output appears for invalid Help command syntax • “Invalid Help Command (help /SP system_contact=test) Results in Unusable Output” on page 44 Unable to collect SP data with Snapshot Utility when web browser security setting is enabled • “Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled” on page 4444 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Invalid Help Command (help /SP system_contact=test) Results in Unusable Output CR 6884556 and 6923383 Issue: Using an invalid help command such as help /SP system_contact=test results in unusable output displayed. Workaround: Use the correct syntax for help /SP system_contact. Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled CR 6877868 Issue: If the Internet Explorer (IE) web browser Security option for Save Encrypted Pages To Disk is enabled, the following error message appears when attempting to collect SP data using the Service Snapshot Utility: Internet Explorer cannot download mdccvm02i - spanshot.cgi?dataset=ioh. Internet Explorer was not able to open this Internet site. The requested site is either unavailable or cannot be found. Please try again later. Workaround: Prior to using the Service Snapshot Utility to collect SP data, disable the Internet Explorer web browser Security option for Save Encrypted Pages To Disk (Tools -->Internet Options-->Advanced tab).45 Updates to Oracle ILOM 3.0.10 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.10 firmware release. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.10” on page 46 ¦ “Resolved Issues as of Oracle ILOM 3.0.10” on page 47 ¦ “Known Issues as of Oracle ILOM 3.0.10” on page 4846 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.10 The following table identifies new features available in the Oracle ILOM 3.0.10 release. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: Updates made to Power Management CMM terminology, web layout, and CLI properties • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Power Monitoring and Management of Hardware Interfaces • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Power Monitoring and Management of Hardware Interfaces New centralized interface for managing chassis component firmware • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Configuration Management and Firmware Update Operations • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Updating Oracle ILOM Firmware • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Updating Oracle ILOM Firmware New SAS-2 zoning management feature available for Oracle ILOM CMM 3.0.10 • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Storage Monitoring and Zone Management • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Monitoring Storage Components and Zone Manager • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Monitoring Storage Components and Zone Manager Ability to make CMM CLI prompt specific to CMM or blade • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, CLI OverviewUpdates to Oracle ILOM 3.0.10 Firmware 47 Resolved Issues as of Oracle ILOM 3.0.10 This section describes the issues that have been resolved in the Oracle ILOM 3.0.10 release. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. Invalid Help Command (help /SP system_contact=test) Results in Unusable Output CR 6884556 Issue: Using an invalid CLI help command such as help /SP system_contact= test results in unusable output displayed. Update: The CLI help feature in Oracle ILOM 3.0.10 has been updated. When invalid syntax for the help command is entered in the CLI, the following message and usage information appears. help: Invalid command syntax Usage: help [-o|-output terse|verbose] [|legal|targets|| ] IPMItool sunoem CLI Might Be Denied If All Session Slots Are Busy CR 6884556 Issue: IPMItool sunoem CLI could be denied because all session slots appear to be busy. Topic Descriptions Links Display output for invalid CLI help command syntax fixed • “Invalid Help Command (help /SP system_contact=test) Results in Unusable Output” on page 47 Force option made available for IPMItool sunoem CLI • “IPMItool sunoem CLI Might Be Denied If All Session Slots Are Busy” on page 4748 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Update: The IPMItool sunoem CLI has been updated as of Oracle ILOM 3.0.10 to offer a force command that closes any currently running IPMI sunoem CLI session in favor of the new one that is being invoked. You can invoke the force command by including the word force as part of the argument to invoke the CLI. For example: ipmitool -I open sunoem cli force version Known Issues as of Oracle ILOM 3.0.10 This section describes the known issues and workarounds as of Oracle ILOM 3.0.10. Specific change request (CR) identification numbers and workarounds for these issues are provided, where available. ? DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount CR 6876387 Issue: When you redirect a DVD (physical driver or image file) from Oracle Solaris to Red Hat Enterprise Linux (RHEL), the floppy and CD-ROM icon will appear in RHEL, but when you click the CD-ROM icon you are unable to see the content of the DVD. Update: You need to manually mount the DVD device to see the content of the DVD. To manually mount the DVD device, follow these steps: Topic Descriptions Links Unable to view DVD content from Solaris client redirection • “DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount” on page 48 Oracle ILOM CLI Storage Redirection fails to launch with 64-bit JDK • “Storage Redirection CLI Service Requires 32-bit JDK to Successfully Start” on page 49 Oracle ILOM Remote Console fails to launch with 64-bit JDK • “Oracle ILOM Remote Console Requires 32-bit JDK to Successfully Launch” on page 51 Internet Explorer 6 unable to launch Oracle ILOM 3.0 web interface • “Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6” on page 52Updates to Oracle ILOM 3.0.10 Firmware 49 1. Use the lsscsi command to check the device name of DVD. For example, the lsscsi output might look like: [5:0:0:0] cd/dvd AMI Virtual CDROM 1.00 /dev/scd1 Where the device name is: /dev/scd1 2. Create a new directory as the mount point or use the existing directory. For example: /mnt 3. Mount the DVD device. For example: # mount /dev/scd1 /mnt mount: block device /dev/scd1 is write-protected, mounting read-only The contents the DVD appears under /mnt. Storage Redirection CLI Service Requires 32-bit JDK to Successfully Start CR 6938720 Issue: The service for the Storage Redirection CLI feature in Oracle ILOM fails to start if the 64-bit JDK file type is specified to start the service. Workaround: Specify the 32-bit JDK file type to start the Storage Redirection Service. Instructions for specifying the 32-bit JDK file type when using either the FireFox web browser or Internet Explorer web browser follow: ? Specify the 32-bit JDK File to Start Storage Redirection Service Using Firefox Web Browser 1. In the Oracle ILOM web browser, start the service for Storage Redirection. For example, click Remote Console --> Redirection then in the Launch Redirection page, click Launch Service. Note – For details about how to start the Storage Redirection Service, see the procedure “Start Storage Redirection Service” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.50 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 ¦ A dialog appears indicating the file type chosen to start the service. 2. In the dialog, do the following: a. Click Open with... to specify the 32-bit JDK file. b. Select the check box for Do this automatically for files like this from now on. ? Specify the 32-bit JDK File to Start Storage Redirection Service Using Internet Explorer Web Browser Note – Perform the following steps prior to starting the service for the Storage Redirection CLI feature in Oracle ILOM. These steps describe how to register the 32-bit JDK file type for the Storage Redirection Service in Oracle ILOM using Windows Explorer. 1. On the Windows client, open Windows Explorer (not Internet Explorer). 2. In the Windows Explorer dialog, select Tools --> Folder Options then select the Files Types tab. 3. In the Files Types tab, do the following: a. In the registered file type list, select the JNLP file type and click Change. b. In the Open With... dialog, click Browse to select the 32-bit JDK file. c. Select the check box for Always use the selected program to open this kind of file. d. Click OK, then start the service for Storage Redirection in the Oracle ILOM web interface. For details, see the procedure “Start Storage Redirection Service” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. Oracle ILOM Remote Console Requires 32-bit JDK to Successfully Launch CR 6938720 Issue: The Oracle ILOM Remote Console feature fails to launch if the 64-bit JDK file type is specified by the web browser.Updates to Oracle ILOM 3.0.10 Firmware 51 Workaround: Specify the 32-bit JDK file type to launch the Oracle ILOM Remote Console. Instructions for specifying the 32-bit JDK file type when using either the FireFox web browser or Internet Explorer web browser follow: ? Specify the 32-bit JDK File to Launch the Oracle ILOM Remote Console Using Firefox Web Browser 1. In the Oracle ILOM web browser, launch the Oracle ILOM Remote Console. For example, click Remote Console --> Redirection then in the Launch Redirection page, click Launch Remote Console. Note – For details about how to launch the Oracle ILOM Remote Console, see the procedure “Launch the Oracle ILOM Remote Console” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. ¦ A dialog appears indicating the file type chosen to launch the program. 2. In the dialog, do the following: a. Click Open with... to specify the 32-bit JDK file. b. Select the check box for Do this automatically for files like this from now on. ? Specify the 32-bit JDK File to Launch the Oracle ILOM Remote Console Using Internet Explorer Web Browser Note – Perform the following steps prior to launching the Oracle ILOM Remote Console feature in Oracle ILOM. These steps describe how to register the 32-bit JDK file type for the Oracle ILOM Remote Console feature in Oracle ILOM using Windows Explorer. 1. On the Windows client, open Windows Explorer (not Internet Explorer). 2. In the Windows Explorer dialog, select Tools --> Folder Options then select the Files Types tab. 3. In the Files Types tab, do the following: a. In the registered file type list, select the JNLP file type and click Change. b. In the Open With... dialog, click Browse to select the 32-bit JDK file.52 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 c. Select the check box for Always use the selected program to open this kind of file. d. Click OK, then start the service for Storage Redirection in the Oracle ILOM web interface. For details, see the procedure “Launch the Oracle ILOM Remote Console” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6 CR 6934155 Issue. Due to increased SSL security in Oracle ILOM, Internet Explorer (IE) 6 is unable to launch the Oracle ILOM SP web interface over HTTPS. Workarounds: Perform any of the following workarounds: ¦ Upgrade Internet Explorer to a later version and launch the Oracle ILOM SP web interface. ¦ Use a different web browser such as FireFox 2.0 to launch the Oracle ILOM SP web interface. ¦ Enable the weak_ciphers setting in the Oracle ILOM SP CLI, then launch the Oracle ILOM SP web interface using IE 6. To enable the setting for weak_ciphers in the Oracle ILOM CLI, type: -> set /SP/services/https weak_ciphers=enabled ¦ Launch the Oracle ILOM SP web interface over HTTP from IE 6. To launch the Oracle ILOM SP web interface over HTTP from IE 6, you must first in the Oracle ILOM SP CLI enable HTTP and disable redirection. To enable HTTP and disable redirection in the Oracle ILOM SP CLI, type: -> set /SP/services/http secureredirect=disabled servicestate= enabled53 Updates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware This chapter describes the new features and functionality that have been added to the Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 firmware releases. Procedures to implement the new functionality are explained. Resolved issues and known issues are also described. In addition, references to the Oracle ILOM 3.0 documents in which the new features are described in detail are provided. This chapter includes the following topics: ¦ “New Features for Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14” on page 54 ¦ “Resolved Issues as of Oracle ILOM 3.0.14” on page 55 ¦ “Known Issues as of Oracle ILOM 3.0.14” on page 6254 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 New Features for Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 The following table identifies new features available in the Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 releases. References to the appropriate guides in the Oracle ILOM 3.0 Documentation Collection that describe the features are also provided. Topic Descriptions Refer To: As of Oracle ILOM 3.0.12, new dual-stack IPv4 and IPv6 settings are provided that enable Oracle ILOM to fully operate in IPv4 and IPv6 network environments • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Network Configurations • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Configuring Oracle ILOM Communication Settings • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Configuring Oracle ILOM Communication Settings As of Oracle ILOM 3.0.14, new Oracle ILOM CLI and web interfaces are provided for viewing and managing LDom configurations for SPARC servers • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Remote Host Management Options • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Managing TPM and LDom States on SPARC Servers • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Managing TPM and LDom States on SPARC Servers As of Oracle ILOM 3.0.12, a new communication channel known as the Local Interconnect Interface is provided that enables you to locally communicate with Oracle ILOM from the host OS without the use of a network management (NET MGT) connection to the server • Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide, Oracle ILOM Network Configurations • Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, Configuring Oracle ILOM Communication Settings • Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide, Configuring Oracle ILOM Communication Settings As of Oracle ILOM 3.0.14, Oracle Sun supported CIM classes have been renamed from Sun_xxx to Oracle_xxx • Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide, Oracle’s Sun-Supported CIM ClassesUpdates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware 55 Resolved Issues as of Oracle ILOM 3.0.14 This section describes the issues that have been resolved as of the Oracle ILOM 3.0.14 release. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. Topic Descriptions Links BIOS upgrade is delayed • “BIOS Upgrade Is Delayed After SP Reboot” on page 56 External serial port settings do not reset • “External Serial Port Settings Do Not Reset to Default Value” on page 56 Hourly power average does not account for increments of less than one hour • “Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour” on page 57 Oracle ILOM Remote Console might hang on a Windows client • “Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image” on page 57 Unable to retrieve hot power state after upgrading Oracle ILOM firmware • “Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0” on page 57 Access page error appears after configuring unknown sensor LED status • “Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool” on page 58 Console error appears after backup and restore • “Console Error Appears After Performing Backup and Restore” on page 58 Windows Server 2008 R2 generates system event log warning messages • “Windows Server 2008 R2 Generates System Event Log Warning Messages When Power Is Being Limited by Oracle ILOM Power Management” on page 58 A 5-minute delay might occur when viewing storage monitoring information • “5-Minute Delay to View Storage Monitoring Information” on page 59 Oracle ILOM version not shown when using HIA to upgrade Oracle ILOM • “Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface” on page 59 DIMM FRU data fields are Null after downgrading or upgrading SP firmware • “DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9” on page 5956 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 BIOS Upgrade Is Delayed After SP Reboot CR 6813514 Issue: When you upgrade the SP firmware, you can choose to upgrade the BIOS firmware immediately or to delay the BIOS upgrade until a later time. If you choose to immediately upgrade the BIOS, the SP firmware is upgraded, the host is forced to power off, and the SP reboots. If you choose to delay the BIOS upgrade, the SP firmware is upgraded and the SP reboots. Update: This issue is expected system behavior and will not be fixed. For workaround instructions, see “BIOS Upgrade Is Delayed After SP Reboot” on page 11. External Serial Port Settings Do Not Reset to Default Value CR 6676339 Issue: The reset_to_defaults command enables a user to reset the Oracle ILOM configuration back to the default values. However, external serial port settings are not reset when reset_to_defaults action is performed. Update: The serial port settings are now set back to the factory default 9600 baud rate when the reset_to_defaults action is performed. Service Snapshot Utility is unable to collect SP data using the IE web browser • “Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled” on page 60 Oracle ILOM CLI Storage Redirection fails to start with 64-bit JDK • “Updated Documentation Describing Storage Redirection 32-bit JDK Requirement” on page 60 Oracle ILOM Remote Console fails to launch with 64-bit JDK • “Updated Documentation Describing Oracle ILOM Remote Console 32-bit JDK Requirement” on page 60 DVD redirection requires a manual mount • “DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount” on page 61 Oracle ILOM web interface is unable to connect to the SP when using IE 6 • “Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6” on page 61 Topic Descriptions LinksUpdates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware 57 Hourly Power Average Timestamp Does Not Account for Increments of Less Than One Hour CR 6803961 Issue: When logging in to a CMM using the CLI, the hourly power history includes an entry with a timestamp one hour into the future. This entry shows the average power from the prior timestamp to the current moment. Update: This issue is expected system behavior and will not be fixed. No workaround exists for this issue. Oracle ILOM Remote Console Might Hang on Windows Client When Redirecting a CD-ROM Image or Floppy Image CR 6806444 Issue: When using a Windows client to redirect a CD-ROM image or floppy image from the Oracle ILOM Remote Console, the Oracle ILOM Remote Console might not respond. Update: This issue has been fixed. Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0 CR 6858008 Issue: When the SP firmware is updated from Oracle ILOM 2.0 to 3.0, the Oracle ILOM web interface might not be able to retrieve the remote host power state after the upgrade completes. If this occurs, a blank page appears on the Remote Power Control tab. Update: This issue is expected system behavior and will not be fixed. For workaround instructions, see “Unable to Retrieve Host Power State After Upgrading Oracle ILOM Firmware From 2.0 to 3.0” on page 30.58 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Access Page Error Appears After Configuring Unknown Sensor LED Status When Monitoring System From IPMItool CR 6848980 Issue: Unknown sensor LED statuses are shown in the Oracle ILOM web interface when using IPMItool to monitor Oracle servers. This issue is likely to occur when concurrently running the SP and the IPMI KCS interface from the operating system (OS). As a result of this configuration, the IPMI messages are overloaded to the SP. Update: This was reported and fixed in Oracle ILOM 3.0.6. Console Error Appears After Performing Backup and Restore CR 6847309 Issue: The following console error message might appear after backing up and restoring the Oracle ILOM configuration. bind (udp): Address already in use Update: This was reported as a known issue in Oracle ILOM 3.0.6. This is a benign error message and is no longer reproducible as of Oracle ILOM 3.0.10. Windows Server 2008 R2 Generates System Event Log Warning Messages When Power Is Being Limited by Oracle ILOM Power Management CR 6881284 Issue: When power is being limited by the Oracle ILOM Power Management feature, the Windows Server 2008 R2 operating system will generate warning messages in the System Event Log informing the user that the processor(s) are being restricted. Update: This issue is expected system behavior and will not be fixed. No workaround exists for this issue.Updates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware 59 5-Minute Delay to View Storage Monitoring Information CR 6870530 Issue: You might experience up to a 5-minute delay before storage monitoring information is present or up to date in the Oracle ILOM CLI or the web interface. This delay typically occurs after: ¦ Upgrading to Oracle ILOM 3.0.6 (or later) and installing the required System Management Pack. or ¦ Querying the system after updates were made to the RAID or disk information. Update: This issue is expected system behavior and will not be fixed. This 5-minute delay only occurs after installation of the required System Management Pack or after RAID or disk updates have been made to the system. Oracle ILOM Version Not Shown When Using HIA to Upgrade Oracle ILOM From an Inband Management Interface CR 6867109 Issue: When upgrading Oracle ILOM from the Oracle Hardware Installation Assistant (HIA) using the inband interface, HIA might not (on some Oracle servers) display the running version of Oracle ILOM. Update: This issue is expected system behavior and will not be fixed. Use the Oracle ILOM web interface to determine the running version of Oracle ILOM. DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9 CR 6913593, 6850456, and 6916007 Issue: On some platform servers, Oracle ILOM displays null DIMM FRU data fields after upgrading or downgrading the Oracle ILOM SP firmware (between 3.0.3 and 3.0.9) with the Delay BIOS Update option enabled.60 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Update: This was reported as a known issue in Oracle ILOM 3.0.9. This issue was fixed as of Oracle ILOM 3.0.9 by adding workaround instructions to the Oracle ILOM 3.0 Feature Updates and Release Notes. For workaround instructions, see “DIMM FRU Data Fields Are Null After Downgrading or Upgrading SP Firmware Between 3.0.3 and 3.0.9” on page 43. Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled CR 6877868 Issue: If the Internet Explorer (IE) web browser Security option for Save Encrypted Pages To Disk is enabled, an error message appears when attempting to collect SP data using the Service Snapshot Utility. Update: This was reported as a known issue in Oracle ILOM 3.0.9. This issue was fixed as of Oracle ILOM 3.0.9 by adding workaround instructions to the Oracle ILOM 3.0 Feature Updates and Release Notes. For workaround instructions, see “Service Snapshot Utility Unable to Collect SP Data When IE Web Browser Security Option Is Enabled” on page 44. Updated Documentation Describing Storage Redirection 32-bit JDK Requirement CR 6938720 Issue: The service for the Storage Redirection CLI feature in Oracle ILOM fails to start if the 64-bit JDK file type is specified to start the service. Update: Procedures have been added to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide instructing users to specify the 32-bit JDK file when using either the FireFox web browser or Internet Explorer web browser. Updated Documentation Describing Oracle ILOM Remote Console 32-bit JDK Requirement CR 6938720 Issue: The Oracle ILOM Remote Console feature fails to launch if the 64-bit JDK file type is specified by the web browser.Updates to Oracle ILOM 3.0.12 and Oracle ILOM 3.0.14 Firmware 61 Update: Procedures have been added to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide instructing users to specify the 32-bit JDK file when using either the FireFox web browser or Internet Explorer web browser. DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount CR 6876387 Issue: When you redirect a DVD (physical driver or image file) from Oracle Solaris to Red Hat Enterprise Linux (RHEL), the floppy and CD-ROM icon will appear in RHEL, but when you click the CD-ROM icon you are unable to see the content of the DVD. Update: This was reported as a known issue in Oracle ILOM 3.0.10. This issue was fixed as of Oracle ILOM 3.0.10 by adding workaround instructions to the Oracle ILOM 3.0 Feature Updates and Release Notes. For workaround instructions, see “DVD Redirection From Solaris Client to RHEL Host Requires Manual Mount” on page 48. Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6 CR 6934155 Issue. Due to increased SSL security in Oracle ILOM, Internet Explorer (IE) 6 is unable to launch the Oracle ILOM SP web interface over HTTPS. Update: This was reported as a known issue in Oracle ILOM 3.0.10. This issue was fixed as of Oracle ILOM 3.0.10 by adding workaround instructions to the Oracle ILOM 3.0 Feature Updates and Release Notes. For workaround instructions, see “Oracle ILOM Web Interface Unable to Connect to SP When Using Internet Explorer 6” on page 52.62 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Known Issues as of Oracle ILOM 3.0.14 Topics No known issues reported63 Updates to Oracle ILOM 3.0.16 Firmware The Oracle ILOM 3.0.16 firmware release consists entirely of fixes for reported issues, and contains no new features. Topics in this section include: ¦ “Resolved Issues as of ILOM 3.0.16” on page 64 ¦ “Known Issue as of Oracle ILOM 3.0.16” on page 74 ¦ “Enhancements to Oracle ILOM Documentation Library” on page 7564 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Resolved Issues as of ILOM 3.0.16 This section describes the issues that have been resolved as of the Oracle ILOM 3.0.16 release. Specific change request (CR) identification numbers and workarounds for the issues are provided, where available. Description Links Fault is not reported when critical threshold is crossed. • “Fault Not Reported When Soft Threshold (Critical) Is Crossed” on page 65 SNMP authentication password appears as plain text in event log. • “Event List Showing SNMP Authentication Password as Plain Text” on page 65 Oracle ILOM user interface hangs after setting customer FRU data. • “Setting Customer FRU Data Causes User Interface to Hang” on page 66 Installation record is automatically created after rebooting the server SP. • “Installation Record Created After Rebooting the Server SP” on page 66 TCP UDP ports are not detected by port scan. • “UDP Ports 781 and 782 Not Detected” on page 66 CMM web interface allows invalid combination of settings for IPv6. • “IPv6 Settings in Web Interface Allows Invalid Combination of Options” on page 67 AES encryption is not supported for SNMPv3 traps. • “AES Encryption Not Working for SNMPv3 Traps” on page 67 Help text for load command displays error message. • “Help Text for load Command Displays Command Failed Message” on page 67 Setting IPv4 network settings from CMM web interface fails. • “Unable to Set Blade IPv4 Network Settings From CMM Web Interface” on page 68 Properties and values for IPv6 are not shown in the Oracle ILOM CLI. • “IPv6 CLI Properties and Values Not Shown” on page 69 Login fails after modifying the LDAP configuration settings. • “Unable to Log In to Oracle ILOM After LDAP Modifications” on page 69 Email alerts are not filtered properly. • “Event Filtering for Email Alerts Not Working” on page 69 Incorrect CLI property value is shown for IPv6 autoconfig. • “IPv6 Autoconfig Value Appears as None When DHCPv6 Is Not Configured” on page 70 Benign IPv6 configuration error message appears after booting the server. • “Error Message About No IPv6 Configuration During SP Boot” on page 70 Web interface buttons for firmware upgrade are not hidden. • “URL Button Enabled While Uploading Firmware Image” on page 71Updates to Oracle ILOM 3.0.16 Firmware 65 Fault Not Reported When Soft Threshold (Critical) Is Crossed CR 7001929 Issue: Oracle ILOM does not report a fault after the sensor soft threshold (Critical) is crossed. Update: This issue was reported on both SPARC and x86 servers running Oracle ILOM firmware version 3.0.12 or 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Event List Showing SNMP Authentication Password as Plain Text CR 6801690 Issue: Security data is not hidden. Enhancement to FRU data is available in Oracle ILOM firmware version 3.0.16. • “Enhanced FRU Information In Fault Management Shell” on page 71 Alert rules data is not restored. • “Restore Operation Does Not Restore Alert Rules” on page 71 Duplicate SNMP traps are created after clearing a fault. • “Two Identical SNMP Traps Created After Fault Status Is Cleared” on page 72 Enhanced RADIUS authentication support for IPv6 configurations. • “Enhancement for RADIUS IPv6 Authentication” on page 72 Active Directory group names in web interface now support 180 characters. • “Enhancement for Active Directory Group Names to Support 128 Characters” on page 72 IPv6 addresses are not updated after re-enabling DHCPv6. • “Oracle ILOM Does Not Solicit for IPv6 Address After Re-Enabling DHCPv6” on page 73 Incomplete list of time zone options appear in the web interface. • “Missing Time Zone Options in Web Interface” on page 73 UTC date is changed to local date and time after re-seating power cord. • “UTC Date and Time Changes to Local Date and Time After Reseating Power Cord” on page 73 Enhanced SNMP support for Ethernet USB devices. • “Enhancement to Extend SNMP Support for Ethernet USB Device” on page 74 Description Links66 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Update: This issue was reported for the following Oracle ILOM firmware versions: 3.0.9, 3.0.10, 3.0.12, and 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Setting Customer FRU Data Causes User Interface to Hang CR 7009655 Issue: The spsh operation and equivalent web interface operation for setting the customer FRU data (-> set /SP customer_frudata=) causes the user interface to hang. Workaround: Reboot the SP. Update: This issue was reported on both SPARC and x86 servers running Oracle ILOM firmware version 3.0.12 or 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Installation Record Created After Rebooting the Server SP CR 7007378, 7023811 Issue: A new installation record is automatically written to the history event log after rebooting the SP. Update: This issue was reported in the following Oracle ILOM firmware versions: 3.0.3, 3.0.6, 3.0.8, and 3.0.9. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. UDP Ports 781 and 782 Not Detected CR 7008946 Issue: After performing a port scan, the following TCP - User Datagram Protocol (UDP) ports were not detected: 781 and 782. Update: This issue was reported in the following Oracle ILOM firmware versions: 3.0.9, 3.0.10, 3.0.12, and 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16.Updates to Oracle ILOM 3.0.16 Firmware 67 IPv6 Settings in Web Interface Allows Invalid Combination of Options CR 7013078 Issue: Users are allowed to select an invalid combination of IPv6 settings on the Network page in the Oracle ILOM we b interface. Affected systems: Sun Fire X4800 and X4800 M2 Servers and Sun Blade CMMs running Oracle ILOM firmware version 3.0.12 or 3.0.14. Update: A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. AES Encryption Not Working for SNMPv3 Traps CR 7025333 Issue: Oracle ILOM does not send trap-session encryption parameters when AES is enabled for SNMPv3. Update: This issue was reported in Oracle ILOM firmware version 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Help Text for load Command Displays Command Failed Message CR 697573568 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Issue: A failed message appears at the end of the Help text for the load command, for example: Update: This issue was first reported on both SPARC and x86 servers running Oracle ILOM firmware version 3.0.12. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Unable to Set Blade IPv4 Network Settings From CMM Web Interface CR 7030118 Issue: When modifying IPv4 settings for blade servers using the CMM web interface, the operation fails and an error message appears. Error message example: Update: This issue was reported on blade servers and CMMs. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. -> load -h -source tftp://archive1.east/newmainimage /CMM/image/main The load command transfers a file from a remote location specified by the URI and updates the given target. Usage: load [-o verbose] [-force] [-script] -source [target] Available options for this command: -script : do not prompt for yes/no confirmation and act as if yes was specified -source : specify the location to get a file -force (-f) : override internal checks and load requested file. -output (-o) verbose : display extensive information load: Command Failed User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; CIBA; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; aff-kingsoft-ciba; staticlogin:product= cboxf09&act=login&info= ZmlsZW5hbWU9UG93ZXJ3b3JkMjAwOU94Zi4yNTI2OS40MDExLmV4ZSZtYWM9NzQzR UMwMzY0QTlCNENFRTlDODVEQ0FDREE2REUzQjImcGFzc3BvcnQ9JnZlcnNpb249Mj AwOS4wNS4yNS4zLjI3MiZjcmFzaHR5cGU9MQ==&verify= 1416024ee173e70d401133eab2eed626) Timestamp: Wed, 23 Mar 2011 05:41:26 UTCUpdates to Oracle ILOM 3.0.16 Firmware 69 IPv6 CLI Properties and Values Not Shown CR 7022641 Issue: The IPv6 CLI properties and values do not always appear after issuing the ls or show command under the target /SP/network/ipv6. Example: Update: This issue was reported on both SPARC and x86 servers running Oracle ILOM firmware version 3.0.12 or 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Unable to Log In to Oracle ILOM After LDAP Modifications CR 6957377 Issue: Non-sunservice account users are unable to log in to the Oracle ILOM SP after modifying LDAP configuration settings. Update: This issue was reported for both x86 and SPARC servers running Oracle ILOM firmware version 3.0.12 or 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Event Filtering for Email Alerts Not Working CR 6960012 Issue: After setting event filtering for email alerts, the email alerts received do not match the event filter specified. -> show /SP/network/ipv6 Targets: Properties: Commands: cd show70 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Update: This issue was reported for both x86 and SPARC servers running Oracle ILOM firmware version 3.0.12. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. IPv6 Autoconfig Value Appears as None When DHCPv6 Is Not Configured CR 6971302 Issue: If the option for DHCPv6 is not set, the autoconfig property value appears as none under the /ipv6 target, for example: Update: This issue was reported on x86 servers and CMMs running Oracle ILOM firmware version 3.0.12. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Error Message About No IPv6 Configuration During SP Boot CR 6972218 Issue: An error message appears on non-IPv6 enabled systems that states there is no configuration for IPv6. Error message example: Update: This is a benign error message. This error message was first reported in Oracle ILOM firmware version 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. -> show /CMM/network/ipv6 /CMM/network/ipv6 Targets: Properties: state = enabled autoconfig = (none) No /conf/ipv6.confUpdates to Oracle ILOM 3.0.16 Firmware 71 URL Button Enabled While Uploading Firmware Image CR 6905194 Issue: After browsing to select the firmware upgrade package, and then clicking the Upload button, the URL button remains enabled on the Firmware Upgrade page in the Oracle ILOM web interface. Update: This issue was first reported in Oracle ILOM firmware version 3.0.6. A fix was committed in Oracle ILOM firmware version 3.0.16 for disabling the URL button during File mode and disabling the File button during URL mode. Enhanced FRU Information In Fault Management Shell CR 6986979 Issue: After running the fmadm faulty command in the Oracle ILOM Fault Management Shell, limited information regarding the FRU description is reported. Update: This issue was first reported on SPARC and x86 servers running Oracle ILOM firmware version 3.0.12 or 3.0.14. A fix was committed in Oracle ILOM firmware version 3.0.16 to report the FRU part number and serial number. Restore Operation Does Not Restore Alert Rules CR 6974627 Issue: After performing a backup and restore operation, the community or user name properties in the alert rules are not restored properly. Update: This issue was first reported in Oracle ILOM firmware versions 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16.72 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Two Identical SNMP Traps Created After Fault Status Is Cleared CR 6937119 Issue. After clearing the component fault status, two identical SNMP traps are generated. Update: This issue was first reported in Oracle ILOM firmware version 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Enhancement for RADIUS IPv6 Authentication CR 6971702 Issue. RADIUS authentication is not supported for IPv6. Update: A request to enhance RADIUS authentication for IPv6 was first reported in Oracle ILOM firmware version 3.0.14. A fix for this enhancement was committed in Oracle ILOM firmware version 3.0.16. Enhancement for Active Directory Group Names to Support 128 Characters CR 6904821 Issue: Activity Directory in Oracle ILOM web interface supports 80 characters. Update: The enhancement to support 128 characters for Active Directory Group Names was committed in Oracle ILOM firmware version 3.0.16.Updates to Oracle ILOM 3.0.16 Firmware 73 Oracle ILOM Does Not Solicit for IPv6 Address After Re-Enabling DHCPv6 CR 6978898 Issue: After configuring the server SP to use dhcpv6_stateful, and then rebooting the SP, Oracle ILOM will successfully solicit the DHCPv6 server for an IPv6 address. However, if you disable the IPv6 state, and then enable the IPv6 state, Oracle ILOM will not solicit the DHCPv6 server for an IPv6 address. Update: This issue was first reported in Oracle ILOM firmware version 3.0.14. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. Missing Time Zone Options in Web Interface CR 6976772 Issue: The Oracle ILOM web interface is missing time zone options for: ¦ America/Argentina/Salta ¦ America/Argentina/San_Luis ¦ America/Santarem ¦ Asia/Ho_Chi_Minh ¦ Asia/Kathmandu ¦ Asia/Kolkata Update: A fix for this issue was committed in Oracle ILOM firmware version 3.0.16. UTC Date and Time Changes to Local Date and Time After Reseating Power Cord CR 6922544 Issue: The Oracle ILOM UTC clock settings change to local time after unplugging and replugging the power cord. Workaround: Reset the /SP before reseating the power cord. Update: This issue was first reported in Oracle ILOM firmware version 3.0.12. A fix for this issue was committed in Oracle ILOM firmware version 3.0.16.74 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 Enhancement to Extend SNMP Support for Ethernet USB Device CR 6941313 Issue: The SNMP management interface in Oracle ILOM does not provide support for Ethernet USB devices. Update: As of Oracle ILOM firmware version 3.0.16, the SNMP interface for Oracle ILOM supports the management of Ethernet USB devices. This enhancement is equivalent to the Ethernet USB support provided in the Oracle ILOM CLI and web interface. Known Issue as of Oracle ILOM 3.0.16 This section describes the known issues reported as of Oracle ILOM firmware version 3.0.16. Oracle ILOM Remote Console IPv6 Requirement for Windows Client CR 6993498 Issue: Since the Java Development Kit (JDK) does not support Microsoft Windows XP for IPv6 network environments, launching the Oracle ILOM Remote Console from a Windows XP IPv6 client is not supported. Workaround: For network environments using IPv6 and running Microsoft Windows operating systems, launch the ILOM Remote Console from a Microsoft Windows Vista/2008/7 client using JDK170b36 or higher. Description Links Oracle ILOM Remote Console requirement for IPv6 network environments. • “Oracle ILOM Remote Console IPv6 Requirement for Windows Client” on page 74 Unable to set the KVMS custom lock property value using a single or double quote. • “Unable to Set Single or Double Quote Character for Remote Console Custom Lock Key (CLI)” on page 75Updates to Oracle ILOM 3.0.16 Firmware 75 Unable to Set Single or Double Quote Character for Remote Console Custom Lock Key (CLI) CR 7017023 Issue: Unable to set /SP/services/kvms custom_lock_key to double ( “ ) or single ( ‘ ) quote using the Oracle ILOM CLI. Workarounds: Perform one of the following workarounds: ¦ Use a different character to set the property value for /kvms custom_lock_key in the Oracle ILOM CLI. - or- ¦ Use the Oracle ILOM web interface to set double or single quote characters for the custom lock option in the Oracle ILOM Remote Console. For instructions, refer to the Oracle ILOM 3.0 Remote Redirection Consoles – CLI and Web Guide. Enhancements to Oracle ILOM Documentation Library As of Oracle ILOM firmware version 3.0.16, the following enhancements were made to the Oracle ILOM 3.0 Documentation Library: ¦ The guides describing the Oracle ILOM system management functions were reorganized to include daily management tasks, maintenance and diagnostic tasks, remote redirection consoles tasks, CMM administration tasks, and protocol management tasks. ¦ In addition to the individual Oracle ILOM PDF guides, a new HTML online documentation collection is available. The Oracle ILOM 3.0 HTML Documentation Collection comprises all guides in the Oracle ILOM Documentation Library, with the exception of the Oracle ILOM 3.0 Feature Updates and Release Notes. You can access the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage)76 Oracle ILOM 3.0 Feature Updates and Release Notes • May 2011 The following table describes the updated Oracle ILOM 3.0 titles and document descriptions. Application Title Format Online Documentation Collection Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Reference PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDF Oracle® Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide Part No. E21450-02 June 2011, Revision APlease Recycle Copyright © 2009, 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2009, 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation v ? Download Product Software and Firmware vii Oracle ILOM 3.0 – Quick Start 1 Factory Default Settings 2 Mandatory Setup Tasks 3 ? Connect to Oracle ILOM 3 ? Log In to Oracle ILOM 5 ? Add New Users to Oracle ILOM 6 Optional Setup Tasks 10 ? Set Descriptive System Identification Labels 10 ? Modify Default Network Settings 11 ? Install Software Using Remote KVMS 14 Daily Management Tasks 15 ? Monitor System Status and View Faults 15 ? Clear System Component Fault States 16 ? View and Clear System Event Log 17 ? Monitor System Power Consumption 18 ? Manage SPARC Server Power Policy 19 ? Monitor Server Component Power Allocations 20 ? Monitor Blade Chassis Component Power Allocations 22 Routine Maintenance Tasks 23iv Oracle ILOM 3.0 Quick Start Guide • June 2011 ? Locate Oracle Sun Server Using Locator LED 23 ? Manage Host Server Power State 25 ? Update Oracle ILOM Firmware 26 ? Reset Oracle ILOM 28 Initial Setup FAQs 28v Using This Documentation This guide will help you get the Oracle Integrated Lights Out Manager (ILOM) 3.0 firmware up and running so that you can remotely manage your Oracle Sun servers and Oracle Sun blade chassis systems. Although this guide provides only the details you need to get started with Oracle ILOM, more in-depth information is available from the Concepts and Procedures Guide topics listed in the Related Information sections. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is intended for technicians, system administrators, authorized Oracle service providers, and users who have experience managing system hardware. ¦ “Documentation and Feedback” on page vi ¦ “Product Downloads” on page vii ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page viii ¦ “Documentation, Support, and Training” on page ixvi Oracle ILOM 3.0 Quick Start Guide • June 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oracle.com/goto/docfeedback) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late-Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation vii Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right pane that appears, click Download.viii Oracle ILOM 3.0 Quick Start Guide • June 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or chassis monitoring module (CMM). This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform product notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface.Using This Documentation ix Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)x Oracle ILOM 3.0 Quick Start Guide • June 20111 Oracle ILOM 3.0 – Quick Start Description LInks Factory Defaults • “Factory Default Settings” on page 2 Mandatory Setup • “Connect to Oracle ILOM” on page 3 • “Log In to Oracle ILOM” on page 5 • “Add New Users to Oracle ILOM” on page 6 Optional Setup • “Set Descriptive System Identification Labels” on page 10 • “Modify Default Network Settings” on page 11 • “Install Software Using Remote KVMS” on page 14 Daily Management • “Monitor System Status and View Faults” on page 15 • “Clear System Component Fault States” on page 16 • “View and Clear System Event Log” on page 17 • “Monitor System Power Consumption” on page 18 • “Manage SPARC Server Power Policy” on page 19 • “Monitor Server Component Power Allocations” on page 20 • “Monitor Blade Chassis Component Power Allocations” on page 22 Routine Maintenance • “Locate Oracle Sun Server Using Locator LED” on page 23 • “Manage Host Server Power State” on page 25 • “Update Oracle ILOM Firmware” on page 26 • “Reset Oracle ILOM” on page 28 FAQs • “Initial Setup FAQs” on page 282 Oracle ILOM 3.0 Quick Start Guide • June 2011 Factory Default Settings TABLE: Oracle ILOM 3.0 Factory Default Property Values Property Default Value For details, see IPv4 DHCP enabled; Automatic DNS Network settings in the Daily Management Concepts, Web Procedures, or CLI Procedures Guide. IPv6 Stateless auto-configuration enabled; Automatic DNS IPMI Enabled IPMI server management in the Protocol Management Reference. Serial consoles port Enabled: serial port 9600; baud, no flow Network ports in the Daily Management Concepts Guide. SNMP management Enabled: port 161 SNMP server management in the Protocol Management Reference. SNMP service state Enabled SNMP set (write permission) Disabled Security certificate or private key None SSL certificate in the Daily Management Web Procedures or CLI Procedures Guide. SSH Enabled Configure secure shell settings in the Daily Management CLI Procedures Guide. Session time-out 15 Set time-out session in the Daily Management Web Procedures or CLI Procedures Guide. SP clock GMT Configure clock settings in the Daily Management Web Procedures or CLI Procedures Guide. SMTP client Enabled SNTP client in the Daily Management Web Procedures or CLI Procedures Guide. LDAP Disabled User management in the Daily Management Concepts, Web Procedures, or CLI Procedures Guide. RADIUS users Disabled Active Directory Disabled Factory root account Login: root Password: changme “Add New Users to Oracle ILOM” on page 6Oracle ILOM 3.0 – Quick Start 3 Mandatory Setup Tasks ¦ “Connect to Oracle ILOM” on page 3 ¦ “Log In to Oracle ILOM” on page 5 ¦ “Add New Users to Oracle ILOM” on page 6 Note – The procedures in this section provide a quick overview of the mandatory setup tasks required to access Oracle ILOM. If further assistance is needed to perform these tasks, refer to the guides listed in the Related Information section. ? Connect to Oracle ILOM Establish a physical management connection to Oracle ILOM by performing one of the following procedures: ¦ Local serial management connection – Procedure 1 ¦ Network management connection – Procedure 2 1. Local Serial Management Connection Procedure a. Attach a serial cable between a console (workstation or terminal) and the SER MGT port on the server or the Sun blade chassis monitoring module (CMM). This physical connection provides your initial communication with the service processor (SP). You must set the terminal device communication properties to these values: 9600 baud, 8 bit, no parity, 1 stop bit. Web interface ports Enabled port: 80; SSL443 Network ports and protocols in the Daily Management Concepts Guide. Storage Redirection CLI socket port on management station 2121 Remote storage redirection in the Remote Redirection Consoles CLI and Web Guide. Power consumption notifications Disabled Alert management in the Daily Management Concepts, Web Procedures, or CLI Procedures Guide. TABLE: Oracle ILOM 3.0 Factory Default Property Values (Continued) Property Default Value For details, see4 Oracle ILOM 3.0 Quick Start Guide • June 2011 Note – If the transmit and receive signals are reversed (crossed over) for DTE to DTE communications, a null modem configuration will be required. Use the adapter cable that is supplied with your system to achieve a null modem configuration. b. Press Enter on the terminal device to create a connection between the terminal device and the Oracle ILOM SP or CMM. 2. Network Management Connection Procedure a. Attach an Ethernet cable between the network switch and the NET MGT port on the server or CMM. Oracle ILOM automatically learns the network address of the Sun server SP or the CMM from both the IPv4 DHCP server and the IPv6 router on your network. If you need to modify these network settings, see “Modify Default Network Settings” on page 11. b. Determine the IP address assigned to the server SP or the CMM. To determine the IP address assigned, establish a local serial management (SER MGT) connection to the ILOM SP or CMM, log in to ILOM, and then view the network properties under the /network and /networkipv6 targets using the show command. It is also possible to determine the IP address from the DHCP server on your network. Related Information ¦ “Initial Setup FAQs” on page 28 ¦ “Log In to Oracle ILOM” on page 5 ¦ “Modify Default Network Settings” on page 11 ¦ Oracle ILOM 3.0 Daily Management Concepts, network management ¦ Sun Blade Chassis Modular System 6000 or 6048 Installation, connecting cables and apply power to the system ¦ Sun server installation guide, connecting cables and applying power to the system ¦ Sun x86 server service manual, configuring BIOS settingsOracle ILOM 3.0 – Quick Start 5 ? Log In to Oracle ILOM To log in to Oracle ILOM, perform one of the following procedures based on the physical management connection established to Oracle ILOM: ¦ Local serial management connection – Login Procedure 1 ¦ Web browser-based network management connection – Login Procedure 2 ¦ Command-line SSH network management connection – Login Procedure 3 Note – The following procedure assumes that you will use the root account to initially log in to ILOM. This account provides built-in administrative privileges (read and write) for all Oracle ILOM features, functions, and commands. To prevent unauthorized access to system, you should change the root account password (changeme) on each service processor (SP) or chassis monitoring module (CMM). 1. Local Serial Management Connection – Login Procedure ¦ At the Oracle ILOM login prompt (->), type root for the account and changeme for the password. 2. Web Browser-Based Network Management Connection – Login Procedure a. Type http://ILOM_SP_or_CMM_ipaddress into the web browser and press Enter. The Oracle ILOM Login dialog appears. b. Log in to the Oracle ILOM web interface using the root user account and the password, changeme. The Oracle ILOM web interface appears. 3. Command-Line SSH Network Management Connection – Login Procedure a. To establish an SSH session to the Oracle ILOM CLI, open a terminal window. b. To log in to Oracle ILOM using the default root account, type: $ ssh root@ILOM_SP_or_CMM_ipaddress Oracle ILOM prompts you for the root password. c. At the Password prompt, type changme. The ILOM CLI prompt appears (->). Related Information ¦ “Connect to Oracle ILOM” on page 3 ¦ “Add New Users to Oracle ILOM” on page 66 Oracle ILOM 3.0 Quick Start Guide • June 2011 ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configuring user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, logging in to and out of Oracle ILOM ¦ Oracle ILOM 3.0 Daily Management CLI Procedure, logging in to and out of Oracle ILOM ? Add New Users to Oracle ILOM Before You Begin ¦ You can create up to 10 local user accounts in Oracle ILOM. To locate instructions for configuring Oracle ILOM for Active Directory, LDAP, or RADIUS, see the Related Information section following this procedure. ¦ You can use the CLI, web interface, SNMP interface, or IPMI interface to manage user accounts. The following procedure identifies how to perform this task using the web interface and the CLI. To locate instructions on how to perform this task using an SNMP or IPMI interface, see the Related Information section following this procedure. ¦ The following procedure assumes you are logged in to ILOM as a root user. For root user login instructions, see “Log In to Oracle ILOM” on page 5. To add new local user accounts to Oracle ILOM, perform one of the following procedures: ¦ Add new local user accounts – Web Procedure 1 ¦ Add new local user accounts – CLI Procedure 2 1. Add New Local User Accounts – Web Procedure a. In the Oracle ILOM web interface, click User Management --> User Accounts. b. In the Users table, click Add. The Add User dialog appears. c. In the Add User dialog, specify a name and new password for the user account, and then select a user role profile. Oracle ILOM enables you to select one of three user role profiles from the web interface: Administrator, Operator, and Advanced. For a description of each user role profile, see EXAMPLE: Oracle ILOM User Role Descriptions on page 8. d. Click Save to add the user account properties.Oracle ILOM 3.0 – Quick Start 7 2. Add New Local User Accounts – CLI Procedure a. To add a local user account using the Oracle ILOM CLI, type: —> create /SP/users/username password=password For example: -> create /SP/users/user5 Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/user5 b. Type the following command to assign a role to the user account: —> set /SP/users/username role=aucr For example: To grant user5 read and write permissions to all user role privileges, type: -> set /SP/users/user5 role=aucro Set ’role’ to ’aucro’ Note – aurco is equivalent to the setting the Administrator role profile option in the web interface. For more information about the user roles and privileges supported in Oracle ILOM, see the following EXAMPLE: Oracle ILOM User Role Descriptions on page 8.8 Oracle ILOM 3.0 Quick Start Guide • June 2011 EXAMPLE: Oracle ILOM User Role Descriptions User Role Descriptions User role profiles (web) User role profile permissions granted (web) Administrator When selected, the Administrator role profile in the Oracle ILOM web interface automatically grants read and write permissions to the following user roles: • Admin (a) • User Management (u) • Console (c) • Reset and Host Control (r) • Read only (o) For definitions of roles supported by the Administrator role profile, see the user role definitions listed in this table under User role permissions granted (CLI). Operator When selected, the Operator role profile in the Oracle ILOM web interface automatically grants the following user role permissions: • Console (c) • Reset and Host Control (r) • Read only (o) For definitions of roles granted by the Operator role profile, see the user role definitions listed in this table under User role permissions granted (CLI). Advanced When selected, the Advanced role profile in the Oracle ILOM Web interface automatically grants Read Only (o) permissions to all Oracle functions and enables you to assign all or any combination of the following role permissions of interest: • Admin (a) • User Management (u) • Console (c) • Reset and Host Control (r). • Services (s) For definitions of roles granted by the Advanced role profile, see the user role definitions listed in this table under User role permissions granted (CLI). User roles (CLI) User role permissions granted (CLI) (a) Admin (a) – Read and write permissions are granted to a user for all Oracle ILOM system management functions with the exception of the functions that would require the Admin to have these additional user roles enabled: User Management (u), Reset and Host Control (r), Console (c), and Services (s). (u) User Management (u) – Read and write permissions are granted to a user for all Oracle ILOM user account management functions. (c) Console (c) – Read and write permissions are granted to a user to perform these remote console management functions: manage remote console lock options, manage SP console history log options, launch and use Oracle ILOM Remote Console, and launch and use Oracle ILOM Storage Redirection CLI.Oracle ILOM 3.0 – Quick Start 9 Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, user management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure active directory properties ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure LDAP properties ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure RADIUS properties ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, user management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure active directory properties ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure LDAP properties ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure RADIUS properties ¦ Oracle ILOM 3.0 Protocol Management Reference, SNMP, user management ¦ Oracle ILOM 3.0 Protocol Management Reference, SNMP, IPMI administrator and operator roles (r) Reset and Host Control (r) – Read and write permissions are granted to a user to perform these remote host management functions: host boot device control, run and configure diagnostics utilities, reset SP, reset CMM, component management service actions, fault management actions, SPARC TPM management actions, and downloads of SNMP MIBs. (o) Read-Only (o) – Read-only permissions are granted to a user to view the state of all ILOM configuration properties. In addition, write permissions are granted to a user to change only the password and session time-out properties assigned to their own user account. (s) Services (s) – Read and write permissions are granted to a user to assist Oracle service engineers if on-site service is required. (aucro) A combination of all these users roles (aucro) grant read and write permissions to a user to perform backup and restore configuration functions. Note - aucro is equivalent to the Administrator user role profile in the web interface. User Role Descriptions10 Oracle ILOM 3.0 Quick Start Guide • June 2011 Optional Setup Tasks ¦ “Set Descriptive System Identification Labels” on page 10 ¦ “Modify Default Network Settings” on page 11 ¦ “Install Software Using Remote KVMS” on page 14 Note – The procedures in this section provide a quick overview of the optional setup tasks that you might need to perform when setting up a Sun server or CMM. If further assistance is needed to perform these tasks, refer to the guides listed in the Related Information section. ? Set Descriptive System Identification Labels Before You Begin ¦ Admin (a) role privileges are required to set SP system identification labels in Oracle ILOM. You can set descriptive system identification labels for the SP host name, SP system identifier, SP system contact, and the SP system location by using the Oracle ILOM CLI or web interface. ¦ Set descriptive system identification labels – Web Procedure 1 ¦ Set descriptive system identification labels – CLI Procedure 2 1. Web Procedure – Set Descriptive System Identification Labels a. To set descriptive system identification labels from the web interface, click System Information --> Identification Information. The Identification Information page appears providing fields to specify: ¦ SP Hostname – Type a host name for the SP. The SP host name can contain up to 60 characters. It must begin with a letter and it must contain only alphanumeric, hyphen, and underscore characters. ¦ SP System Identifier –Type system identifier for the SP. The system identifier can consist of a text string using any standard keyboard keys except quotation marks. ¦ SP System Contact – Type a system contact for the SP. The system contact can consist of a text string using any standard keyboard keys except quotation marks.Oracle ILOM 3.0 – Quick Start 11 ¦ SP System Location – Type a system location for the SP. The system location can consist of a text string using any standard keyboard keys except quotation marks. b. Click Save for your settings to take effect. 2. CLI Procedure – Set Descriptive System Identification Labels a. To view the system SP identification labels from the CLI, type: -> show /SP b. To set identification labels for the SP, type: ¦ -> set /SP hostname=text_string ¦ -> set /SP system_identifier=text_string ¦ -> set /SP system_contact=text_string ¦ -> set /SP system_location=text_string Where: The text_string for hostname can contain up 60 characters and include alphanumeric characters, hyphen, and underscore characters. The text_string for system_identifier can identify the system contact or system location. It can include all standard keyboard keys except for quotation marks. Related Information ¦ Oracle ILOM 3.0 Daily Management Web Procedures, assign host name and system identifier ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, assign host name and system identifier ? Modify Default Network Settings Before You Begin ¦ This procedure assumes that you have an established local or network management connection to the Oracle ILOM server SP or CMM. For instructions on how to establish a physical local or network connection to Oracle ILOM, see “Connect to Oracle ILOM” on page 3. ¦ Oracle ILOM is shipped with IPv4 DHCP and IPv6 Stateless default network settings. When the network property for IPv4 is set to DHCP, the SP or the CMM will automatically configure the DHCP IP address using the DHCP advertisement messages received from the DHCP IPv4 server.12 Oracle ILOM 3.0 Quick Start Guide • June 2011 When the auto-configuration property for IPv6 is set to stateless, the SP or the CMM will automatically configure its dynamic address using the IPv6 router advertisement messages. In addition, the SP or the CMM will always generate a non-routable Link-Local IPv6 address, which allows it to be reachable from its local subnet. Note – The IPv6 network setting are supported in Oracle ILOM as of Oracle ILOM version 3.0.12 or later. ¦ Admin (a) role privileges are required to modify network settings in Oracle ILOM. ¦ You can modify the network settings in Oracle ILOM using the CLI or web interface, or by using an SNMP client. To locate instructions on performing this task from an SNMP client, see the Related Information section following this procedure. To modify the default network settings in Oracle ILOM, perform one of the following steps: ¦ Modify default network settings – Web Procedure 1 ¦ Modify default network settings – CLI Procedure 2 1. Modify Default Network Settings – Web Procedure a. Click Configuration --> Network. b. To assign a static IPv4 address, enable the Static IP radio button, and specify the static IPv4 address, subnet mask, and gateway address. c. To change the IPv6 network options, perform one or both of the following: ¦ Autoconfig options: Select or clear the check box associated with the IPv6 autoconfig option. ¦ Static IP Address: In the Static IP Address text box, type the following input parameters to specify the IPv6 address and subnet mask address: / For example: fec0:a:8:b7:214:4fff:feca:5f7e/64 d. Click Save to apply the changes. 2. Modify Default Network Settings – CLI Procedure a. To change the default IPv4 dhcp property and set property values for a static IPv4 address, type: -> set /SP/network pendingipdiscovery=static pendingipaddress= pendingipgateway= pendingipnetmask=Oracle ILOM 3.0 – Quick Start 13 b. To change the default IPv6 autoconfig=stateless property, navigate to the /network/ipv6 target and perform one or both of the following: ¦ To change the default autoconfig=stateless property value, type: -> set autoconfig= Where property value can equal one of the following: stateless stateless_only, dhcpv6_stateless, dhcpv6_stateful, or disable. ¦ To assign a static IPv6 address, type: -> set pendingipdiscovery=/ For example: -> set pendingipdiscovery=fec0:a:8:b7:214:4fff:feca:5f7e/64 c. To save static IPv4 or IPv6 property changes, navigate to the /network target and type: -> set commitpending=true Related Information ¦ “Initial Setup FAQs” on page 28 ¦ Oracle ILOM 3.0 Daily Management Concepts, Oracle ILOM communication settings ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure Oracle ILOM’s communication settings ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure network settings ¦ Oracle ILOM 3.0 Protocol Management Reference, configure network settings14 Oracle ILOM 3.0 Quick Start Guide • June 2011 ? Install Software Using Remote KVMS Before You Begin ¦ The Oracle ILOM Remote Console, available from the web interface, provides remote redirection for the following devices: keyboard, video, mouse, and storage. As an alternative method for redirecting storage devices in Oracle ILOM, you can use the Oracle ILOM Storage Redirection CLI. To locate instructions on how to use this feature, refer the Related Information section following this procedure. ¦ Console (c) role privileges are required to operate the Oracle ILOM Remote Console. ¦ The Java Runtime Environment (1.5 or later) must be installed on your local system. To launch the Oracle ILOM Remote Console in the web interface, follow these steps: 1. To verify that the default KVMS settings provided in Oracle ILOM match your desktop environment, perform these steps: a. In the web interface, click Remote Control --> KVMS. b. In the KVMS page, ensure that the video redirection state is enabled, and then verify that the appropriate mouse mode option (absolute or relative) is enabled. For best performance, absolute mode is typically chosen for Oracle Solaris-based operating systems, and relative mode is chosen for Linux-based operating systems. Tip – To toggle the keyboard or mouse input between the managed server and the local desktop, use one of the following key sequences: alt-m (for mouse) or alt-k (for keyboard). 2. For Windows Internet Explorer (IE) web browser users, register the 32-bit JDK file on your local system before launching the Oracle ILOM Remote Console. a. In the Windows Explorer dialog, Click Tools --> Folder Options, and then click the Files Types tab. b. Select the JNLP file, browse to its location, and then click OK. 3. To launch the Oracle ILOM Remote Console, click Remote Control --> Redirection --> Launch Remote Console. For details about how to use the redirection options available in the Oracle ILOM Remote Console, refer to Oracle ILOM 3.0 Remote Redirection Console Guide. Related Information ¦ Oracle ILOM 3.0 Remote Redirection Consoles, overviewOracle ILOM 3.0 – Quick Start 15 ¦ Oracle ILOM 3.0 Remote Redirection Consoles, Oracle ILOM Remote Console initial setup ¦ Oracle ILOM 3.0 Remote Redirection Consoles, launching Oracle ILOM Remote Console redirection ¦ Oracle ILOM 3.0 Remote Redirection Consoles, using Oracle ILOM Storage Redirection CLI to redirect storage devices Daily Management Tasks ¦ “Monitor System Status and View Faults” on page 15 ¦ “Clear System Component Fault States” on page 16 ¦ “View and Clear System Event Log” on page 17 ¦ “Monitor System Power Consumption” on page 18 ¦ “Manage SPARC Server Power Policy” on page 19 ¦ “Monitor Server Component Power Allocations” on page 20 ¦ “Monitor Blade Chassis Component Power Allocations” on page 22 Note – The procedures in this section provide a quick overview of some of the daily management tasks that you might want perform from Oracle ILOM after your system is set up. If further assistance is needed to perform these tasks, refer to the guides listed in the Related Information section. ? Monitor System Status and View Faults To monitor the state of the system and view faults, you can use the Oracle ILOM CLI or web interface. ¦ Monitor system status and view faults – Web Procedure 1 ¦ Monitor system status and view faults – CLI Procedure 1 1. Web Procedure – Monitor System Status and View faults a. To monitor the system status, click System Information --> Overview. View the System Status field to determine the current state of the system. b. To view a list of faulty system components detected by Oracle ILOM, click System Information --> Fault Management.16 Oracle ILOM 3.0 Quick Start Guide • June 2011 Note – Oracle ILOM populates this list only when it detects a system component in a faulted state. 2. CLI Procedure – Monitor System Status and View Faults a. To monitor the system fault state from a server SP, type: -> show /SYS fault_state Under the Properties verify the fault_state status. b. To view a tabular output of faulty system targets, properties, and values, type: -> show faulty Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitoring system ¦ Oracle ILOM 3.0 Protocol Management Reference, monitoring system sensors, indicators, and event log (SNMP) ? Clear System Component Fault States Before You Begin ¦ Reset and Host Control (r) role privileges are required to clear the status of a faulted component. To clear the state of a faulted component, you can use the Oracle ILOM CLI or web interface. ¦ Clear system component faults – Web Procedure 1 ¦ Clear system component faults – CLI Procedure 2 1. Web Procedure – Clear System Component Faults To clear the state of a faulted component (after fixing or replacing the faulted component) in the web interface, perform these steps: a. Click System Information --> Component. b. Select the radio button that is adjacent to the faulty components, then click Clear Faults. 2. CLI Procedure – Clear system component faultsOracle ILOM 3.0 – Quick Start 17 a. To clear the state of a faulty component (after fixing or replacing the faulted component), type: Where component_path is one of the following faulted components: ¦ Host CPU (/SYS/MB/P#) ¦ Memory Riser (/SYS/MB/P0/MR#) ¦ DIMM (/SYS/MB/P0/MR0/D#) ¦ Motherboard (/SYS/MB) ¦ Fan module (/SYS/FM#) ¦ Power supply (/SYS/PS#) ¦ CMM (/CH/CMM) ¦ NEM (/CH/NEM#) ¦ PCI card (SYS/MB/PCIE#) For example, to clear a fault on the host CPU, you would type the following: Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, clear faults detected by Oracle ILOM ¦ Oracle ILOM 3.0 Daily Management Web Procedures, clear faults detected by Oracle ILOM ? View and Clear System Event Log Before You Begin ¦ Admin (a) role privileges are required to modify the event log. To view and clear the system event log, you can use the Oracle ILOM CLI or web interface. ¦ View and clear system event log – Web Procedure 1 ¦ View and clear system event log – CLI Procedure 2 -> set component_path clear_fault_action=true Are you sure you want to clear component_path (y/n)? y Set ‘clear_fault_action’ to ‘true’ -> set /SYS/MB/P0 clear_fault_action=true Are you sure you want to clear /SYS/MB/P0 (y/n)? y Set ‘clear_fault_action’ to ‘true’18 Oracle ILOM 3.0 Quick Start Guide • June 2011 1. Web Procedure – View and Clear System Event Log a. To view the system event log in the web interface, click System Monitoring --> Event Log. Use the page navigation controls at the top and the bottom of the table to navigate through the available data in the table. b. To clear all system event log entries, click the Clear Log button. A confirmation dialog appears. In the confirmation dialog, click OK to clear the entries. 2. CLI Procedure – View and Clear System Event Log a. To view the system event log entries from the CLI, type: -> show /SP/logs/event/list b. To clear all system event log entries, type: -> set /SP/logs/event clear=true Related Information ¦ Oracle ILOM 3.0 Web Procedures, view and clear Oracle ILOM event log ¦ Oracle ILOM 3.0 CLI Procedures, scroll, dismiss, or clear the Oracle ILOM event log ¦ Oracle ILOM 3.0 Protocol Management Reference, view and clear Oracle ILOM event log ? Monitor System Power Consumption Before You Begin ¦ The following procedure assumes that ILOM 3.0.8 or later is running on the server SP, or ILOM 3.0.10 or later is running on the CMM. ¦ You can monitor the system power consumption from the web interface, CLI, or SNMP interface. To locate instructions on how to perform these tasks from an SNMP client, see the Related Information section that follows this procedure. To monitor the system power consumption from the CLI or web interface, follow one of these procedures: ¦ Monitor system power consumption — Web Procedure 1 ¦ Monitor system power consumption — CLI Procedure 2 1. Web Procedure – Monitor System Power Consumption a. In the Oracle ILOM SP or Oracle ILOM CMM web interface, click Power Management -->Power Consumption.Oracle ILOM 3.0 – Quick Start 19 b. In the Power Consumption page, view the following system power metrics: actual power, target limit, and peak permitted. Note – The ability to monitor power varies depending on server platform implementation of this feature. Refer to the platform-specific Oracle ILOM supplement or platform administration guide for details about platform-specific power management behavior. 2. CLI Procedure – Monitor System Power Consumption a. To view the total system power consumptions from the CLI, type one of the following: ¦ From the server SP: -> show /SP/powermgmt actual_power or -> show /SYS/VPS ¦ From the CMM: -> show /CH/powermgt actual_power or -> show /CH/VPS Related Information ¦ Oracle ILOM 3.0 Concepts, power management ¦ Oracle ILOM 3.0 Web Procedures, monitor power consumption ¦ Oracle ILOM 3.0 CLI Procedures, monitor power consumption ¦ Oracle ILOM 3.0 Protocol Management Reference, monitor power consumption ? Manage SPARC Server Power Policy Before You Begin ¦ The following procedure assumes that ILOM version 3.0.8 or later is running on the SPARC server SP. ¦ Administrator (a) role privileges are required to modify the power policy settings in Oracle ILOM. ¦ You can manage the power policy for a SPARC server from the web interface, CLI, or SNMP interface. To locate instructions on how to perform these tasks from an SNMP client, see the Related Information section that follows this procedure. To manage the power policy on a SPARC server SP from the CLI or web interface, follow one of these procedures:20 Oracle ILOM 3.0 Quick Start Guide • June 2011 ¦ Manage SPARC server power policy – Web Procedure 1 ¦ Manage SPARC server power policy – CLI Procedure 2 1. Web Procedure – Manage SPARC Server Power Policy a. In the Oracle ILOM SPARC server SP, click Power Management -->Settings. The Power Management Page appears. b. In the Power Policy list box, select either Performance or Elastic. ¦ Performance – The system is allowed to use all available power. ¦ Elastic – The system power usage is adapted to the current utilization level. For example, the system will power up or down just enough system components to keep relative utilization at 70 percent at all times, even if workload fluctuates. c. Click Save to save the Power Policy setting. 2. CLI Procedure – Manage SPARC Server Power Policy a. To view the current power policy property value set on SPARC server SP, type: -> show /SP/powermgmt policy b. To modify the power policy property value set on a SPARC server SP, type: -> set /SP/powermgmt policy=Performance|Elastic Related Information ¦ Oracle ILOM 3.0 Concepts, power management ¦ Oracle ILOM 3.0 Web Procedures, set power policy ¦ Oracle ILOM 3.0 CLI Procedures, set power policy ¦ Oracle ILOM 3.0 Protocol Management Reference, set power policy ? Monitor Server Component Power Allocations Before You Begin ¦ The following procedure assumes that ILOM 3.0.8 is running on the server. ¦ You can monitor the server component power allocations from the web interface, CLI, or SNMP interface. To locate instructions on how to perform this task from an SNMP client, see the Related Information section that follows this procedure. To monitor the power allocations for an Oracle Sun server from the web interface or the CLI, perform one of these procedures. ¦ Monitor server component power allocations – Web Procedure 1Oracle ILOM 3.0 – Quick Start 21 ¦ Monitor server component power allocations – CLI Procedure 2 1. Web Procedure – Monitor Server Component Power Allocations a. In the Oracle ILOM SP web interface, click Power Management --> Allocations. The Power Allocation Plan page appears. b. In the allocation power tables, view the following system power requirements for power capacity planning: ¦ System Power Map – The information in the System Power Map table reflects the total power allocated value in wattage for the following system power properties: Allocated Power, Installed Hardware Minimum, Peak Permitted Power, and Target Limit. ¦ Per Component Power Map – The information in Component Power Map table reflects the allocated power wattage value for each server component category (for example, memory) and each server component (for example ME_PO_D0). It also identifies whether the allocated power value can be capped. 2. CLI Procedure – Monitor Server Component Power Allocations a. To view the sum of power allocated to all components in the system, type: ¦ From an x86 server SP: -> show /SP/powermgmt/budget ¦ From a SPARC server SP: -> show /SP/powermgmt allocated_power b. To view power allocated to a component category (fans, CPUs, and so forth), type: ¦ From an x86 server SP: -> show /SP/powermgmt/powerconf/component_type/component_name ¦ From a SPARC server SP: -> show /SP/powermgmt/powerconf/component_type/component_name Where component_type is the name of the component category and component_name is the name of the component. Related Information ¦ Oracle ILOM 3.0 Concepts, power management ¦ Oracle ILOM 3.0 Web Procedures, monitor component power allocations ¦ Oracle ILOM 3.0 CLI Procedures, monitor component power allocations22 Oracle ILOM 3.0 Quick Start Guide • June 2011 ? Monitor Blade Chassis Component Power Allocations Before You Begin ¦ The following procedure assumes that ILOM version 3.0.10 or later is running on the CMM. ¦ You can monitor the power allocations for the CMM from the web interface or the CLI. To locate additional information about this task, see the Related Information section that follows this procedure. To monitor server power allocations from the CMM, follow one of these procedures: ¦ Monitor blade chassis component power allocations – Web Procedure 1 ¦ Monitor blade chassis component power allocations – CLI Procedure 2 1. Web Procedure – Monitor Blade Chassis Component Power Allocations a. In the Oracle ILOM CMM web interface, click Power Management --> Allocation. The CMM Power Allocation Plan page appears. b. In the allocation power tables, view the CMM power allocation values for grantable power, grant limit, and granted power. 2. CLI Procedure – Monitor Blade Chassis Component Power Allocations a. To view the sum of power allocated to all chassis system components, type: -> show /CMM/powermgmt grantable_power b. To view the remaining power available to allocate to blade slots, type: -> show /CMM/powermgmt allocated_power c. To view the sum of power allocated to a CMM component category (fans, blade slots, and so forth), type: -> show /CMM/powermgmt/powerconf/component_type Where component_type is the name of the component category. d. To view the sum of power granted to all blade slots or the sum of power reserved for all auto-powered I/O blade slots, type: -> show /CMM/powermgmt/powerconf/bladeslots The granted_power value and reserved_power value allocated to all chassis blade slots appears.Oracle ILOM 3.0 – Quick Start 23 e. To view the sum of power granted to an individual blade or to the grant limit value set for a blade, type: -> show /CMM/powermgmt/powerconf/bladeslot/BLn Where n represents the slot location for the blade. Related Information ¦ Oracle ILOM 3.0 Concepts, monitor power management ¦ Oracle ILOM 3.0 Web Procedures, monitor component power allocations ¦ Oracle ILOM 3.0 CLI Procedures, monitor component power allocations Routine Maintenance Tasks ¦ “Locate Oracle Sun Server Using Locator LED” on page 23 ¦ “Manage Host Server Power State” on page 25 ¦ “Update Oracle ILOM Firmware” on page 26 ¦ “Reset Oracle ILOM” on page 28 Note – The procedures in this section provide a quick overview of some of the maintenance tasks that you might need to perform from Oracle ILOM after setting up your system. If further assistance is needed to perform these tasks, refer to the guides in the Related Information section. ? Locate Oracle Sun Server Using Locator LED Before You Begin ¦ User Management (u) role privileges are required to modify the system indicator settings in Oracle ILOM To locate a specific Oracle Sun server among many servers in a data center, you can use either the Oracle ILOM CLI or web interface to illuminate the Locator LED that is typically located on both the front and back panel of an Oracle Sun server. ¦ Enable or disable Locator LED – Web Procedure 1 ¦ Enable or disable Locator LED – CLI Procedure 224 Oracle ILOM 3.0 Quick Start Guide • June 2011 1. Web Procedure – Enable or Disable Locate LED a. In the web interface, click System Monitoring --> Indicators. b. In the Actions list box, click Name: Locate. c. To illuminate the Locator LED, select the radio button adjacent to /SYS/LOCATE, and then click Set LED to Fast Blink. d. To disable the Locator LED, select the radio button adjacent to /SYS/LOCATE, and then click Turn LED Off. 2. CLI Procedure – Enable or Disable Locate LED ¦ To illuminate the Locator LED from a server SP, type: -> set /SYS/LOCATE value=fast_blink ¦ To disable the Locator LED from a server SP, type: -> set /SYS/LOCATE value=off Related Information ¦ Oracle ILOM 3.0 Daily Management Web Procedures, monitor system sensors and indicators ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitor system sensors and indicators ¦ Oracle ILOM 3.0 Protocol Management Reference, monitor system sensors, indicators, and event log (SNMP)Oracle ILOM 3.0 – Quick Start 25 ? Manage Host Server Power State Before You Begin ¦ Admin (a) role privileges are required to reset the host server power state. ¦ You can manage the host power state from the rackmount server SP, a blade server SP, or from a CMM. The following procedures pertain to managing the host server power state from a rackmount server SP. To locate instructions for how to perform this task from the CMM or a blade server SP, see the Related Information section that follows this procedure. To manage the host server power states from a rackmount server SP, you can use the Oracle ILOM CLI or web interface. ¦ Manage host server power state – Web Procedure 1. ¦ Manage host server power state – CLI Procedure 2. 1. Web Procedure – Manage Host Server Power State a. In the web interface, click Remote Control --> Remote Power Control. b. In the Actions list box, select one of the following host power states: ¦ Reset –Reboots the remote host server ¦ Immediate Power Off – Immediately turns off the power on the remote host server. ¦ Graceful Shutdown and Power Off – Gracefully shuts down the OS prior to powering off the remote host server. ¦ Power On (default setting) – Turns on full power to the remote host server. ¦ Power Cycle – Turns off the power on the remote host server, then applies full power to the remote host server. 2. CLI Procedure – Manage host server power state ¦ Reset – To reboot the host server power state, type: -> reset /SYS ¦ Immediate Power Off – To immediately turn off the power to the remote host server, type: -> stop -force /SYS ¦ Graceful Shutdown and Power Off – To shut down the OS gracefully prior to powering off the host server, type: -> stop /SYS ¦ Power On (default setting) – To turn on full power to the remote host server, type: -> start /SYS26 Oracle ILOM 3.0 Quick Start Guide • June 2011 Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, issue remote power state commands ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage host server power states ¦ Oracle ILOM 3.0 Daily Management Concepts, remote power control ? Update Oracle ILOM Firmware Before You Begin ¦ If required by your platform, shut down your host operating system before changing the firmware on your server SP. ¦ Admin (a) role privileges are required to update the firmware on an Oracle Sun server or CMM. ¦ You can initiate the firmware update process from the web interface, CLI, or SNMP client. In addition, as of ILOM 3.0.10, a new feature is available to manage firmware updates across modular system chassis components. The procedures in this section describe how to initiate the firmware update process from the web interface and CLI. To locate instructions on how to perform this task using an SNMP Client, or how to manage firmware updates across a modular chassis system, see the Related Information section following this procedure. ¦ The firmware update process takes several minutes to complete. During this time, do not perform other Oracle ILOM tasks. When the firmware update is complete, the system will reboot. To initiate the firmware update process from the web interface or CLI, follow these steps: 1. Verify that the firmware version currently installed on the server SP or CMM. ¦ For the web interface, click System Information --> Versions. ¦ For the CLI, at the command prompt, type: version For information about the numbering scheme used to identify the Oracle ILOM firmware version installed, see “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page viii.Oracle ILOM 3.0 – Quick Start 27 2. Open a new web browser tab or window and navigate to the following site to download the Oracle ILOM firmware image. (http://support.oracle.com/) For detailed instructions on downloading software updates from the My Oracle Support web site, see “Product Downloads” on page vii. Note – Generally, do not update the firmware on your system to a prior release. However, if you determine you need to run an earlier version of the firmware on your system, you can update the firmware to any prior firmware release that is available for download. 3. Place the firmware image on a server supporting one of the following protocols: TFTP, FTP, HTTP, HTTPS. ¦ For a web interface update, copy the image to the system on which the Oracle ILOM web browser is running. ¦ For a CLI update, copy the image to a server that is accessible from your network. 4. To update the Oracle ILOM firmware image using the Oracle ILOM web interface, click Maintenance --> Firmware Upgrade, and then click Enter Upgrade Mode. For detailed instructions about using the firmware update dialogs, refer to Oracle ILOM 3.0 Maintenance and Diagnostics CLI and Web Guide, update Oracle ILOM firmware (web). 5. To update the Oracle ILOM firmware image from the Oracle ILOM CLI, type: -> load -source ://// For detailed instructions about using the CLI firmware update prompts, refer to Oracle ILOM 3.0 Maintenance and Diagnostics CLI and Web Guide, update Oracle ILOM firmware (CLI). 6. Verify that the appropriate firmware version was installed after the system reboots. Related Information ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, update Oracle ILOM firmware (web and CLI) ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, recover from a network failure during the firmware update process ¦ Oracle ILOM 3.0 Protocol Management, update Oracle ILOM firmware (SNMP) ¦ Oracle Integrated Lights Out Manager (ILOM) CMM Administration, update firmware28 Oracle ILOM 3.0 Quick Start Guide • June 2011 ? Reset Oracle ILOM Before You Begin ¦ Reset and Host Control (r) role privileges are required to reset the server SP. Note – If you need to reset your Oracle ILOM service processor (SP), you can do so without affecting the host OS. However, resetting the SP disconnects your current Oracle ILOM session and renders the SP unmanageable during reset. To reset the Oracle ILOM SP using the web interface or CLI, follow these steps: 1. To reset the Oracle ILOM server SP from the web interface, click Maintenance --> Reset SP --> Reset SP. 2. To reset the Oracle ILOM server SP from the CLI, type: -> reset /SP Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, reset Oracle ILOM SP ¦ Oracle ILOM 3.0 Daily Management Web Procedures, reset Oracle ILOM SP Initial Setup FAQs Does the Oracle ILOM service processor (SP) boot up automatically? The Oracle ILOM service processor boots automatically when a power cable is connected to your Oracle Sun server or CMM. For information about how to connect a power cable to your system chassis or rackmount server, refer to the hardware installation documentation shipped with your rackmount server or system chassis. Is a default user account and password provided with Oracle ILOM? Oracle ILOM is shipped from the factory with a preconfigured root user account and a password. You should use the preconfigured account for initial login and user account setup. To prevent unauthorized access to your system, you should change the preconfigured root account and password on each service processor (SP) or chassis monitoring module (CMM).Oracle ILOM 3.0 – Quick Start 29 What format does Oracle ILOM accept for IPv4 and IPv6 network addresses? If ILOM is operating in a dual-stack network environment, the system_ipaddress can be entered using either an IPv4 or IPv6 address format. For example: ¦ For IPv4: 10.8.183.106 or ¦ For IPv6: [fec0:a:8:b7:214:4fff:5eca:5f7e/64] For more information, refer to the topic about dual-stack IPv4 and IPv6 network configurations in the Oracle ILOM 3.0 Daily Management Concepts Guide. Are factory default settings provided with Oracle ILOM? Factory default settings are provided for most Oracle ILOM system management features. You can choose to use these default settings, or you can customize them to meet your needs. For a list of factory default settings shipped with Oracle ILOM 3.0, see “Factory Default Settings” on page 2. Which Oracle ILOM user interface should I use? All Oracle ILOM features and functions are accessible from the web interface and command-line interface (CLI). A sub-set of Oracle ILOM features and functions are also available from the SNMP interface, IPMI interface, and the CIM WS-Management interface. For more information about Oracle ILOM features that are supported by SNMP, IPMI, and CIM WS-Management, refer to Oracle ILOM 3.0 Protocol Management Reference. I am not able to establish a network management connection to Oracle ILOM If you are experiencing difficulties with connecting to Oracle ILOM, see the following suggested solutions for resolving connection issues: ¦ Verify that a physical Ethernet connection between your network and the NET MGT port on your server or CMM is established. ¦ Through a local (non-network) connection to Oracle ILOM, ensure that the IPv4 state is enabled, or both the IPv4 and IPv6 states are enabled for dual-stack network environments. ¦ Use a command-line network tool, like Ping, to verify connectivity to the network. ¦ For IPv6 management connections, ensure that the IPv6 address in the URL is enclosed by brackets. For example: ¦ Web interface URL: https://[fe80::221:28ff:fe77:1402]30 Oracle ILOM 3.0 Quick Start Guide • June 2011 ¦ CLI download file URL: -> load -source tftp://[fec0:a:8:b7:214:rfff:fe01:851d]desktop.pkg If I prematurely deleted the root user account how can I recreate it? You can re-create the root user account or recover a password for an account by using the default account provided in Oracle ILOM. For instructions on how log in to Oracle ILOM using the default user account, refer to topic about recovering a password in the Oracle ILOM 3.0 Daily Management CLI Procedures Guide. What features are now available with Oracle ILOM 3.0? The Oracle ILOM 3.0 Feature Updates and Release Notes identifies the new feature updates for each Oracle ILOM 3.0 firmware point release. Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts ¦ Oracle ILOM 3.0 Daily Management Web Procedures ¦ Oracle ILOM 3.0 Daily Management CLI Procedures ¦ Oracle ILOM 3.0 Remote Redirection Consoles Web and CLI ¦ Oracle ILOM 3.0 Maintenance and Diagnostics Web and CLI ¦ Oracle ILOM 3.0 SNMP, IPMI, CIM, WS-Man Protocol Management Reference ¦ Oracle Integrated Lights Out Manager (ILOM) CMM Administration ¦ Oracle ILOM 3.0 Feature Updates and Release Notes Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide Part No. E21448-01 May 2011, Revision 01Please Recycle Copyright © 2008, 2010, 2011 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011 Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation vii ? Download Product Software and Firmware ix Oracle ILOM Web and CLI Remote Redirection Options 1 Oracle ILOM Remote Console 2 Oracle ILOM Storage Redirection CLI 3 Understanding Oracle ILOM Remote Console Features 5 International Keyboard Support 6 Single or Multiple Management Views 6 Network Communication Ports and Protocols 8 Sign-In Authentication 9 Secure Remote Console 9 Setting Up the Oracle ILOM Remote Console for First-Time Use 11 Initial Setup Requirements (Oracle ILOM Remote Console) 12 ? Configure KVMS Redirection Settings 13 Registering 32-bit JDK 14 ? Register 32-bit JDK File Type When Using Windows Internet Explorer 15 ? Register 32-bit JDK File Type When Using Firefox 15 Securing the Oracle ILOM Remote Console 18 Special Considerations When Enabling the Oracle ILOM Remote Console Lock Option 18iv Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 ? Set the Oracle ILOM Remote Console KVMS Lock From the Web Interface 19 ? Set the Oracle ILOM Remote Console KVMS Lock From the CLI 20 Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 25 Usage Requirements (Oracle ILOM Remote Console) 26 ? Launch the Oracle ILOM Remote Console 26 ? Start, Stop, or Restart Device Redirection 29 ? Toggle Keyboard and Mouse Control 30 ? Control Keyboard Modes and Key Send Options 30 ? Redirect Keyboard Input (Serial Redirection Only) 31 ? Redirect Mouse Input (Video Redirection Only) 32 ? Redirect Storage Media 32 ? Add New Server Redirection Session 35 ? Exit the Oracle ILOM Remote Console 36 Understanding Oracle ILOM Storage Redirection CLI Features 37 First-Time Use (Oracle ILOM Storage Redirection CLI) 38 Storage Redirection CLI Architecture 38 Default Network Communication Port 39 Setting Up Oracle ILOM Storage Redirection CLI for First Time Use 41 Initial Setup Requirements (Oracle ILOM Storage Redirection CLI) 42 ? Change the Default Storage Redirection Network Port: 2121 43 Starting the Storage Redirection Service 44 ? Start the Storage Redirection Service Using the Mozilla Firefox Web Browser 44 ? Start the Storage Redirection Service Using the Internet Explorer (IE) Web Browser 46 ? Download and Install the Storage Redirection Client 49Contents v Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 51 Usage Requirements (Storage Redirection CLI) 52 ? Launch the Storage Redirection CLI Using a Command Window or Terminal 53 ? Verify That the Storage Redirection Service Is Running 54 ? Display Storage Redirection CLI Help Information 55 ? Start Redirection of Storage Device 56 ? View Active Storage Redirections 56 ? Stop Redirection of Storage Device 57 Supported Storage Redirection Commands and Options 58 Syntax 58 Command Options 60 Sub-Commands 60 Sub-Command Options 61 Index 63vi Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011vii Using This Documentation This guide describes the setup and use of the Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Console feature for accessing a host console remotely. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is intended for technicians, system administrators, and authorized Oracle service providers, and users who have experience managing system hardware. ¦ “Documentation and Feedback” on page viii ¦ “Product Downloads” on page ix ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page x ¦ “Documentation, Support, and Training” on page xviii Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management — Web Interface Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management — CLI Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation ix Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the Oracle ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.x Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface. Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)1 Oracle ILOM Web and CLI Remote Redirection Options Related Information ¦ “Understanding Oracle ILOM Remote Console Features” on page 5 ¦ “Setting Up the Oracle ILOM Remote Console for First-Time Use” on page 11 ¦ “Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console” on page 25 ¦ “Understanding Oracle ILOM Storage Redirection CLI Features” on page 37 ¦ “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41 ¦ “Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI” on page 51 Description Links Learn about Oracle ILOM SP remote redirection. • “Oracle ILOM Remote Console” on page 2 Learn about the Oracle ILOM Storage Redirection command-line interface. • “Oracle ILOM Storage Redirection CLI” on page 32 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Oracle ILOM Remote Console The Oracle ILOM Remote Console is supported on all Oracle Sun x86 processor-based servers. It is also supported on some SPARC processor-based servers. The Oracle ILOM Remote Console is a Java application that you can launch from the Oracle ILOM web interface. When you use the Oracle ILOM Remote Console, you can remotely redirect and control the following devices on a remote host server: ¦ Keyboard ¦ Mouse ¦ Video console display ¦ Storage devices or images (CD/DVD, floppy device, ISO image) The Oracle ILOM Remote Console enables the devices on your local client to behave as if they were directly attached to the remote host server. For instance, the redirection functionality enables you to perform any of the following tasks: ¦ Install software from your local media drive to a remote host server. ¦ Run command-line utilities on a remote host server from a local client. ¦ Access and run GUI-based programs on a remote host server from a local client. ¦ Remotely configure server features from a local client. ¦ Remotely manage server policies from a local client. ¦ Remotely monitor server elements from a local client. ¦ Perform almost any software task from a local client that you normally could perform while sitting at a remote host server. The Oracle ILOM Remote Console supports two methods of redirection: video and serial console. Video redirection is supported on all Sun x86 processor-based servers and some Sun SPARC processor-based servers. Serial console redirection is supported on all SPARC processor-based servers. Serial console redirection is not currently supported on x86 processor-based servers. For instructions for redirecting host devices using the Oracle ILOM Remote Console, see the following: ¦ “Understanding Oracle ILOM Remote Console Features” on page 5 ¦ “Setting Up the Oracle ILOM Remote Console for First-Time Use” on page 11 ¦ “Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console” on page 25Oracle ILOM Web and CLI Remote Redirection Options 3 Oracle ILOM Storage Redirection CLI The Storage Redirection CLI in ILOM is supported on all Oracle Sun x86 processorbased servers. This CLI is also supported on some SPARC processor-based servers. However, the Storage Redirection CLI is not supported on Sun server SPs or chassis monitoring modules (CMMs) running ILOM 2.0. It is also not supported on CMMs running ILOM 3.0; although, the CMM web interface still provides the download links to the Storage Redirection service and client CLI tools. Once the service and client tools are downloaded and running on your machine, they can be used for Storage redirection to a server module running ILOM 3.0. The Storage Redirection CLI enables the storage devices (CD/DVD drive or ISO images) on your local client to behave as if they were directly attached to the remote host server. For instance, the redirection functionality enables you to locally perform these actions: ¦ Mount a storage device or image directly from your desktop to a remote SP host without launching the Oracle ILOM Remote Console Java application. ¦ Redirect media to use the /HOST/console for text-based console interaction. ¦ Write scripts to start and stop storage redirection on multiple SP host servers. Note – The Storage Redirection CLI is limited to remote media control. If you need to remotely manage other devices on a remote host server (such as the keyboard, video display, or mouse), you should use the Oracle ILOM Remote Console. For more information about the Oracle ILOM Remote Console, see “Oracle ILOM Remote Console” on page 2. For more infomation about setting up and using Oracle ILOM Storage Redirection CLI, see: ¦ “Understanding Oracle ILOM Storage Redirection CLI Features” on page 37 ¦ “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41 ¦ “Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI” on page 514 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 20115 Understanding Oracle ILOM Remote Console Features The information in this topic describes Oracle ILOM Remote Console features. Related Information ¦ “Setting Up the Oracle ILOM Remote Console for First-Time Use” on page 11 ¦ “Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console” on page 25 Descriptions Links Learn about international keyboard support. “International Keyboard Support” on page 6 Learn about managing multiple Remote Console sessions. “Single or Multiple Management Views” on page 6 Learn about Remote Console default network port and protocols. “Network Communication Ports and Protocols” on page 8 Learn about required sign-in authority. “Sign-In Authentication” on page 9 Learn about securing Oracle ILOM Remote Console. “Secure Remote Console” on page 96 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 International Keyboard Support As of Oracle ILOM 3.0.9, the Oracle ILOM Remote Console additionally supports the use of all characters on the following international keyboards: ¦ Swedish keyboard ¦ Swiss-French keyboard ¦ Finnish keyboard Note – Prior to Oracle ILOM 3.0.9, the Oracle ILOM Remote Console did not support the use of all the international characters on these keyboards. Single or Multiple Management Views The Oracle ILOM Remote Console supports both single and multiple remote server management views. Single and multiple server management views are currently supported on all x86 processor-based servers and some SPARC processor-based servers. ¦ Single remote server management view – You can launch the Oracle ILOM Remote Console to manage a single remote host server from one window and utilize the remote keyboard, video, mouse, storage (KVMS) features. Single remote server management views are supported when you connect to the IP address of any server SP.Understanding Oracle ILOM Remote Console Features 7 FIGURE: Single Server Management View ¦ Multiple remote server management views – You can launch the Oracle ILOM Remote Console to manage multiple remote host server views. Multiple remote server management views are supported when you either: (1) add a new Oracle ILOM Remote Control session to manage another remote host server; or (2) connect to the IP addresses that are associated with an x86 chassis monitoring module (CMM).8 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 FIGURE: Multiple Server Management Views Network Communication Ports and Protocols The Oracle ILOM Remote Console communicates to a remote host server SP using the following network ports and protocols. TABLE: SP Oracle ILOM Remote Console Network Ports and Protocols Port Protocol SP - Oracle ILOM Remote Console 5120 TCP CD 5123 TCP Diskette 5121 TCP Keyboard and mouseUnderstanding Oracle ILOM Remote Console Features 9 Sign-In Authentication When you launch the Oracle ILOM Remote Console from the Oracle ILOM web interface, you must sign in using a user account with Administrator user role profile privileges or Console (c) role privileges. The system will subsequently prompt you to re-enter the account each time you perform one of the following: start a redirection, stop a redirection, or restart a redirection. Note – If the Single Sign On feature is disabled in Oracle ILOM, users with Administrator user role profile or Console (c) role privileges will be prompted to sign in to Oracle ILOM again using the Login dialog box. For additional information about the Single Sign On feature, refer to the Oracle ILOM 3.0 Daily Management Concepts Guide. Secure Remote Console As of Oracle ILOM 3.0.4 or later, a lock feature is available for the Oracle ILOM Remote Console that enhances your system security by enabling you to lock your computer when terminating a Oracle ILOM Remote Console session. Specifically, the lock behavior takes place either when you terminate an Oracle ILOM Remote Console session or when the managed network connection to the server is lost. If you are running a Windows operating system on your host, you can enable the computer lock feature in Oracle ILOM by selecting Windows as your option. The Windows lock mode option works in conjunction with the standard Windows keyboard shortcut for locking the Windows operating system (Ctrl-Alt-Del K). If you are running a Solaris or Linux operating system on your host, you can execute the computer lock behavior when the Oracle ILOM Remote Console terminates by implementing the custom lock mode feature in Oracle ILOM. 5556 TCP Redirection authentication 7578 TCP Video 7579 TCP SPARC servers only TABLE: SP Oracle ILOM Remote Console Network Ports and Protocols (Continued) Port Protocol SP - Oracle ILOM Remote Console10 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 The custom lock mode feature in Oracle ILOM enables you to execute any system behavior that is tied to a predefined keyboard shortcut on your host operating system. To execute a custom keyboard shortcut behavior in Oracle ILOM, you must first define the behavior you want to take place on your host operating system with a keyboard shortcut. Then, to execute this behavior when the Oracle ILOM Remote Console terminates, you must specify the OS keyboard shortcut parameters in the custom KVMS lock mode feature in Oracle ILOM. For more information, see “Securing the Oracle ILOM Remote Console” on page 18.11 Setting Up the Oracle ILOM Remote Console for First-Time Use Related Information ¦ “Network Communication Ports and Protocols” on page 8 ¦ “International Keyboard Support” on page 6 ¦ “Oracle ILOM Remote Console” on page 2 ¦ “Sign-In Authentication” on page 9 Description Links Platform Feature Support Identify the requirements for setting up Oracle ILOM Remote Console. • “Initial Setup Requirements (Oracle ILOM Remote Console)” on page 12 • x86 system server SP • SPARC system server SP Perform initial setup procedures. • “Configure KVMS Redirection Settings” on page 13 • “Registering 32-bit JDK” on page 14 Optionally, secure the Oracle ILOM Remote Console. • “Securing the Oracle ILOM Remote Console” on page 1812 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Initial Setup Requirements (Oracle ILOM Remote Console) Prior to performing the procedures in this section, ensure that the following requirements are met. ¦ You must have already preformed basic set up and network configuration for the server’s ILOM service processor to the point that you can log in to Oracle ILOM as described in Oracle ILOM 3.0 Daily Management Web Interface Procedures Guide. ¦ You must have a user account with Administrator user role profile or Console (c) role privileges to use the Oracle ILOM Remote Console. ¦ The Oracle ILOM Remote Console supports two methods of redirection: video and serial console. Video redirection is supported on all Oracle Sun x86 processor-based servers, as well as some SPARC processor-based servers. Serial console redirection is supported on all SPARC servers, but it is currently not supported on x86 servers. ¦ To run the Oracle ILOM Remote Console, you must have the JRE 1.5 or higher (Java 5.0 or higher) software installed on your local client. To download the Java 1.5 Runtime Environment, go to (http://java.com). ¦ The Oracle ILOM Remote Console is supported on your local client with the operating systems, web browsers, and JVM listed below: TABLE: Supported Operating Systems, Web Browsers, and JVM Operating System Web Browser Java Virtual Machine (JVM) Oracle Solaris (9 and 10) • Mozilla 1.7.5 and above • Firefox 1.0 and above • 32-bit JDK Linux (Red Hat, SuSE, Ubuntu, Oracle) • Mozilla 1.7.5 and above • Firefox 1.0 and above • Opera 6.x and above • 32-bit JDK Microsoft Windows (98, 2000, XP, Vista) Note - For IPv6 networks, only Vista, Windows Server 2008 and Windows 7 clients are supported. • Internet Explorer 6.0 and above • Mozilla 1.7.5 and above • Firefox 1.0 and above • Opera 6.x and above • 32-bit JDK Note - For IPv6 networks, use JDK170b36 or higher.Setting Up the Oracle ILOM Remote Console for First-Time Use 13 ? Configure KVMS Redirection Settings To configure Oracle ILOM Remote Console settings for video console remote KVMS management of host servers, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control --> KVMS. The KVMS Settings page appears. Note – The Remote Control second-level tab options that are shown in the preceding figure differ depending on your server. Likewise, the KVMS settings options on the KVMS Settings page differ depending on your Sun server. For more information, see the descriptions provided for the remote control settings in Step 3 of this procedure.14 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 3. Use the options on the KVMS Settings page to specify the following remote control settings for managing a remote server. Note – For serial console redirection, the KVMS setting is enabled during an active remote console session. Registering 32-bit JDK The initial setup procedures described in this section apply only to video redirection and the registration of the 32-bit JDK file. If you plan to redirect devices from a SPARC serial console, the initial setup tasks described in this section are not necessary. ¦ “Register 32-bit JDK File Type When Using Windows Internet Explorer” on page 15 ¦ “Register 32-bit JDK File Type When Using Firefox” on page 15 Remote Control Setting Applies To Action KVMS State Video redirection Click Enabled to enable the redirection of keyboard, video, mouse, and storage devices of the managed host. If the check box is left cleared, the KVMS device redirection will be disabled. Mouse Mode Settings Video redirection Select one of the following mouse mode settings: • Absolute – Select Absolute mouse mode for best performance when you are using Oracle Solaris or Windows operating systems. Absolute is the default. • Relative – Select Relative mouse mode when you are using a Linux operating system. Note that not all Linux operating systems support Absolute mode. Note - As of Oracle ILOM 3.0.4 and later versions of Oracle ILOM, you can toggle between the Relative and Absolute settings without having to restart the server SP. Changes take effect immediately in the Oracle ILOM Remote Console.Setting Up the Oracle ILOM Remote Console for First-Time Use 15 ? Register 32-bit JDK File Type When Using Windows Internet Explorer If you will be using Windows Internet Explorer (IE) web browser to launch the Oracle ILOM Remote Console, you must register the 32-bit JDK file on your system before using Internet Explorer to launch the Oracle ILOM Remote Console. Note – The JDK does not support Windows XP for IPv6 network environments, therefore launching the ILOM Remote Console from a Windows XP IPv6 client is not supported. For network environments using IPv6 and running Microsoft Windows operating systems, launch the ILOM Remote Console from a Microsoft Windows Vista, Windows Server 2008, or Windows 7 client using JDK170b36 or higher. To register the 32-bit JDK file, follow these steps: 1. On the Windows client, open Windows Explorer (not Internet Explorer). 2. In the Windows Explorer dialog box, choose Tools --> Folder Options, and then the Files Types tab. 3. In the Files Types tab, do the following: a. In the registered file type list, select the JNLP file type and click Change. b. In the Open With dialog box, click Browse to select the 32-bit JDK file. c. Click the “Always use the selected program to open this kind of file” check box. d. Click OK, and then start the Storage Redirection service in the Oracle ILOM web interface. ? Register 32-bit JDK File Type When Using Firefox If you will be using Mozilla Firefox web browser to launch the Oracle ILOM Remote Console, you must register the 32-bit JDK file on your system before using Firefox to launch the Oracle ILOM Remote Console. To register the 32-bit JDK file, follow these steps: 1. Log in to the Oracle ILOM web interface for the server SP. 2. Click Remote Control --> Redirection. The Launch Redirection page appears.16 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Note – Depending on your platform, the Launch Redirection page will offer different combinations of redirection options. If multiple options are presented, select the type of redirection that you want to use to remotely manage this host. 3. To specify how you want to see the redirected system console, click one of the radio buttons. 4. Click Launch Redirection. A dialog box appears indicating the file type chosen to launch the program.Setting Up the Oracle ILOM Remote Console for First-Time Use 17 5. In the Java Start Web Program dialog box, do the following: a. Click Open with... to specify the 32-bit JDK file. b. Click the “Do this automatically for files like this from now on” check box. Note – If a certificate warning message appears stating that the name of the site does not match the name on the certificate, click Run to continue. The Oracle ILOM Remote Console window appears.18 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Securing the Oracle ILOM Remote Console Special Considerations When Enabling the Oracle ILOM Remote Console Lock Option Review the following special considerations prior to enabling the KVMS lock mode option in Oracle ILOM. Description Links Platform Feature Support Learn about the special considerations when enabling Remote Console lock. • “Special Considerations When Enabling the Oracle ILOM Remote Console Lock Option” on page 18 • x86 system server SP • SPARC system server SP • CMM Enable or disable Oracle ILOM Remote Console lock options from the web interface. • “Set the Oracle ILOM Remote Console KVMS Lock From the Web Interface” on page 19 Enable or disable Oracle ILOM Remote Console lock options from the CLI. • “Set the Oracle ILOM Remote Console KVMS Lock From the CLI” on page 20 Special Consideration Description Console user role is required to set lock option. To enable the Oracle ILOM Remote Console lock option in Oracle ILOM, you must have Console (c) role privileges associated with your user account. For more information about setting up a user account in Oracle ILOM with Console privileges, refer to the user management section in the Oracle ILOM 3.0 Daily Management Web Procedures Guide or the Oracle ILOM 3.0 Daily Management CLI Procedures Guide.Setting Up the Oracle ILOM Remote Console for First-Time Use 19 For instructions about how to configure the remote console lock option in Oracle ILOM, see: ¦ “Set the Oracle ILOM Remote Console KVMS Lock From the Web Interface” on page 19 ¦ “Set the Oracle ILOM Remote Console KVMS Lock From the CLI” on page 20 ? Set the Oracle ILOM Remote Console KVMS Lock From the Web Interface Before You Begin ¦ To enable the Oracle ILOM Remote Console lock option in Oracle ILOM, you must have Console (c) role privileges associated with your user account. ¦ You must be running Oracle ILOM 3.0.4 or later on the server SP. 1. Log in to the Oracle ILOM SP or CMM web interface. Note – When logging in to the CMM web interface, navigate to the SP target where you want to enable or disable the KVMS lock option for the Oracle ILOM Remote Console. A predefined keyboard shortcut on the OS is required to execute the custom lock mode feature. Prior to enabling a custom keyboard shortcut in ILOM for when the Oracle ILOM Remote Console connection terminates, you must first define the keyboard shortcut behavior on your host operating system. For instructions for creating a keyboard shortcut on your host operating system, refer to the documentation supplied with your operating system. The custom lock mode feature can be defined with up to four modifiers and one key. When you specify the custom lock mode feature in Oracle ILOM, you can specify up to four modifiers and one key. A list of supported modifiers and keys that you can use to match your predefined OS keyboard shortcut appear in both the CLI KVMS help and the web interface KVMS page. Lock behavior when running multiple Oracle ILOM Remote Console sessions. If more than one Oracle ILOM Remote Console session is opened to the same SP, the Windows lock or custom keyboard shortcut behavior configured in Oracle ILOM will take place only when you close the last SP Oracle ILOM Remote Console session. Special Consideration Description20 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 2. In the web interface page, click Remote Console --> KVMS. The KVMS page appears displaying the options available for KVMS Settings and Host Lock Settings. 3. In the Host Lock Settings section of the KVMS page, perform one of the following tasks: 4. Click Save to apply the changes you specified. ? Set the Oracle ILOM Remote Console KVMS Lock From the CLI Before You Begin ¦ To enable the Oracle ILOM Remote Console Lock option in Oracle ILOM, you must have Console (c) role privileges associated with your user account. ¦ You must be running Oracle ILOM 3.0.4 or later on the server SP. 1. Log in to the Oracle ILOM CLI SP or CMM. Note – When logging in to the CMM CLI, navigate to the SP target where you want to enable or disable the KVMS lock option for the Oracle ILOM Remote Console. Task Instructions Enable the standard Windows host lock mode option. • In the Lock Mode list box, select Windows. Enable the custom host lock mode feature. 1. In the Lock Mode list, select Custom. 2. In the Custom Lock Modifiers list, select up to four custom modifiers that match the keyboard shortcut modifiers that are predefined in your operating system. 3. In the Custom Lock Key list, select the key that matches the keyboard shortcut key that is predefined in your operating system. Disable the host lock mode feature. • In the Lock Mode list, select Disabled.Setting Up the Oracle ILOM Remote Console for First-Time Use 21 2. To view all the possible properties associated with the management of the SP KVMS services, type: -> help /SP/services/kvms The following sample output appears: /SP/services/kvms : Management of the KVMS service Targets: Properties: custom_lock_key : KVMS custom lock key custom_lock_key : Possible values = esc, end, tab, ins, del, home, enter, space, break, backspace, pg_up, pg_down, scrl_lck, sys_rq, num_plus, num_minus, f1, f2, f3, f4, f5, f6, f7, f8, f9, f10, f11, f12, a-z, 0-9, !, @, #, $, %, ^, &, *, (, ), -, _, =, +,‚ |, ~, ‘, [, {, ], }, ;, :, ’, ", <, ., >, /, ? custom_lock_key : User role required for set = c custom_lock_modifiers : KVMS custom lock modifiers custom_lock_modifiers : Possible values = l_alt, r_alt, l_shift, r_shift, l_ctrl, r_ctrl, l_gui, r_gui custom_lock_modifiers : User role required for set = c lockmode : KVMS lock mode lockmode : Possible values = disabled, windows, custom lockmode : User role required for set = c mousemode : KVMS mouse mode mousemode : Possible values = absolute, relative mousemode : User role required for set = c servicestate : KVMS service state servicestate : Possible values = enabled, disabled servicestate : User role required for set = a22 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 3. Perform any of the following tasks using either the cd, set, or show commands to manage the SP KVMS target properties. EXAMPLE: Enabled Custom Lock Mode In this example, you have defined, in your host OS, the following custom keyboard shortcut sequence to log you off the operating system: Shift-Control-Backspace Task Instructions Navigate to the KVMS target. • To navigate to the KVMS target, type the following command: -> cd /SP/services/kvms Note - You must navigate to the KVMS target prior to enabling or disabling the KVMS lock mode options. Display the KVMS lock mode properties. • To display the KVMS lock mode properties, type the following command: -> show The target, properties, and commands that are associated with the management of the SP KVMS service appear. Disable the Oracle ILOM Remote Console lock mode feature. • To disable the Oracle ILOM Remote Console lock mode feature, type the following command: -> set lockmode=disabled Enable the standard Windows host lock mode feature. • To enable the standard lock mode feature on a Windows system, type the following command: -> set lockmode=windows Enable the custom host lock mode feature. • To enable the custom lock mode feature on a Linux, Solaris, or Windows system, type following commands: -> set lockmode=custom -> set custom_lock_key= -> set lock_modifiers= Note - Each custom lock modifier specified must be separated by a comma.Setting Up the Oracle ILOM Remote Console for First-Time Use 23 To execute this custom keyboard shortcut sequence when exiting an Oracle ILOM Remote Console session, the following KVMS properties would be set in the Oracle ILOM CLI: /SP/services/kvms Targets: Properties: custom_lock_key = backspace custom_lock_modifiers = l_shift, l_ctrl lockmode = custom mousemode = absolute servicestate = enabled24 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 201125 Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console Description Links Platform Feature Support Identify the requirements for launching and using the Oracle ILOM Remote Console. • “Usage Requirements (Oracle ILOM Remote Console)” on page 26 • x86 system server SP • SPARC system server SP • CMM Perform these procedures to launch Oracle ILOM Remote Console and to manage a redirection session. • “Launch the Oracle ILOM Remote Console” on page 26 • “Start, Stop, or Restart Device Redirection” on page 29 Perform these procedures to redirect the KVMS devices. • “Toggle Keyboard and Mouse Control” on page 30 • “Control Keyboard Modes and Key Send Options” on page 30 • “Redirect Keyboard Input (Serial Redirection Only)” on page 31 • “Redirect Mouse Input (Video Redirection Only)” on page 32 • “Redirect Storage Media” on page 32 Perform this proceduredure when you want to create a redirection session for another remote server. • “Add New Server Redirection Session” on page 35 Perform this procedure to exit Oracle ILOM Remote Console. • “Exit the Oracle ILOM Remote Console” on page 3626 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Related Information ¦ “Setting Up the Oracle ILOM Remote Console for First-Time Use” on page 11 ¦ “Secure Remote Console” on page 9 Usage Requirements (Oracle ILOM Remote Console) Prior to performing the procedures in this section, ensure that the following requirements are met. ¦ You must have the Java Runtime Environment (1.5 or later) installed on your local system. To download the latest Java Runtime Environment, go to (http://java.com). ¦ The 32-bit JDK file needs to be specified when starting the Oracle ILOM Remote Console as described in “Launch the Oracle ILOM Remote Console” on page 26. However, if you are using Windows Internet Explorer to launch the Oracle ILOM Remote Console for the first time, you must first register the 32-bit JDK file on your system. For more details, see “Register 32-bit JDK File Type When Using Windows Internet Explorer” on page 15. ¦ You must log in to the Oracle ILOM SP web interface using an Admin (a) or Console (c) role account. Either an Admin or Console role account is required to launch the Oracle ILOM Remote Console. ¦ You must have configured the Remote Control settings in the Oracle ILOM web interface. For instructions, see “Configure KVMS Redirection Settings” on page 13. ? Launch the Oracle ILOM Remote Console 1. Log in to the Oracle ILOM web interface for the server SP. 2. Click Remote Control --> Redirection. The Launch Redirection page appears.Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 27 Note – Depending on your platform, the Launch Redirection page will offer different combinations of redirection options. If multiple options are presented, select the type of redirection that you want to use to remotely manage this host. 3. To specify how you want to see the redirected system console, click one of the radio buttons. 4. Click Launch Redirection. A dialog box appears indicating the file type chosen to launch the program.28 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 5. In the Java Start Web Program dialog box do the following: a. Click Open with and select the 32-bit JDK file. b. Click the “Do this automatically for files like this from now on” check box. Note – If a certificate warning message appears stating that the name of the site does not match the name on the certificate, click Run to continue. The Oracle ILOM Remote Console window appears.Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 29 ? Start, Stop, or Restart Device Redirection 1. In the Oracle ILOM Remote Console window, click the Redirection menu. 2. In the Redirection menu, specify, one of the following redirection options. A confirmation message appears confirming that you want to change the redirection setting. 3. In the Confirmation message, click Yes to proceed or No to cancel the operation. Option Description Start Redirection Choose Start Redirection to enable redirection of devices. Start Redirection is enabled by default. Restart Redirection Choose Restart Redirection to stop and start redirection of devices. Typically, this option is used when a valid redirection is still established. Stop Redirection Choose Stop Redirection to disable the redirection of devices.30 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 ? Toggle Keyboard and Mouse Control You can toggle control of your keyboard and mouse from the remote console application to the local client desktop using a keyboard sequence. This is especially useful when using relative KVMS mode in Oracle ILOM. ? When the Oracle ILOM Remote Console window is displayed, use the following key sequences to toggle mouse and keyboard control to the remote console and back to the local client: ¦ To toggle keyboard control, type Alt-k. ¦ To toggle mouse control, type Alt-m. ? Control Keyboard Modes and Key Send Options Before You Begin ¦ A server redirection session must be active for the remote host server SP. For details, see “Add New Server Redirection Session” on page 35. ¦ Device redirection must be started. For details, see “Start, Stop, or Restart Device Redirection” on page 29. ¦ Keyboard redirection must be enabled. For details, see “Redirect Keyboard Input (Serial Redirection Only)” on page 31. To control keyboard modes and individual key send options, follow these steps: 1. In the Oracle ILOM Remote Console window, click the Keyboard menu. 2. In the Keyboard menu, specify any of the following keyboard settings. Option Description Auto-keybreak Mode Choose Auto-keybreak Mode to automatically send a keybreak after every key stroke. Use this option to help resolve keyboard problems over slow network connections. The Auto-keybreak Mode is enabled by default. Stateful Key Locking Choose Stateful Key Locking if your client uses stateful key locking. Stateful key locking applies to these three lock keys: Caps Lock, Num Lock, and Scroll Lock.Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 31 Note – Not all of these keyboard settings apply during serial redirection. ? Redirect Keyboard Input (Serial Redirection Only) Before You Begin ¦ This procedure applies only to serial console redirection. ¦ Although multiple users can connect to the system serial console, only one user at a time has write access to the console (that is, only one user can type commands into the system console). Any characters that other users type are ignored. This is referred to as a write lock, and the other user sessions are in read-only mode. If no other users are currently logged in to the system console, then you obtain the write lock automatically when you start keyboard redirection. If another user currently has write access to the console, you will be prompted to forcibly transfer write access away from the other session. ¦ A server redirection session must be active for the remote host server SP. For details, see “Add New Server Redirection Session” on page 35. ¦ Device redirection must be started. For details, see “Start, Stop, or Restart Device Redirection” on page 29. Left Alt Key* *Not available on Windows Client Choose Left Alt Key to toggle the left Alt key on or off. Right Alt Key* *Not available on Windows Client Choose Right Alt Key to toggle the right Alt key on or off for non-U.S. keyboards. When enabled, this option enables you to type the third key character on a key. This keyboard option provides the same capabilities of an Alt Graph key. F10 Choose F10 to apply the F10 function key (typically used in BIOS). Control Alt Delete Choose Control Alt Delete to send the Ctrl-Alt-Del sequence. Control Space Choose Control Space to send a Control-Space sequence to enable input on remote host. Caps Lock Choose Caps Lock to send the Caps Lock key to enable input with Russian and Greek keyboards.32 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 To redirect a remote host server keyboard to your local client, follow these steps: 1. In Oracle ILOM, click Remote Control --> KVMS. The KVMS Settings page appears. 2. Click the KVMS Settings check box to enable the remote management state of the keyboard. The KVMS state is enabled by default. ? Redirect Mouse Input (Video Redirection Only) Before You Begin ¦ Mouse redirection is supported only for video redirection settings. ¦ Configure your mouse settings to Absolute or Relative mouse mode. See “Configure KVMS Redirection Settings” on page 13. ¦ A server redirection session must be active for the remote host server SP. For details, see “Add New Server Redirection Session” on page 35. ¦ Device redirection must be started. For details, see “Start, Stop, or Restart Device Redirection” on page 29. To redirect a remote host server mouse to your local client, follow these steps: 1. In Oracle ILOM, click Remote Control --> KVMS. The KVMS Settings page is displayed. 2. Click the KVMS State check box to enable the remote host management state of the mouse. The KVMS state is set to Enabled by default. ? Redirect Storage Media Before You Begin ¦ A server redirection session must be active for the remote host server SP. For details, see “Add New Server Redirection Session” on page 35.Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 33 ¦ Device redirection must be started. For details, see “Start, Stop, or Restart Device Redirection” on page 29. ¦ For Oracle Solaris client systems, you must perform the following actions prior to redirecting storage devices: ¦ If Volume Manager is enabled, you will need to disable this feature. ¦ Assign root privilege to the processor that is running the Oracle ILOM Remote Console by entering these commands: su to root ppriv -s +file_dac_read pid_javarconsole To redirect storage media (CD/DVD or ISO image) from your desktop to a host server, follow these steps: 1. In the Oracle ILOM Remote Console window, click the Devices menu. 2. In the Devices menu, perform the following actions: a. Enable the appropriate storage device or image setting. Note – Floppy storage media redirection is not supported on SPARC systems. Note – If you are installing software from distribution media (CD/DVD), ensure that the media is inserted in the redirected drive. If you are installing software from an ISO image, ensure that the ISO image is stored on your local client or network shared file system. A dialog appears prompting you to specify a storage drive location or image file location. Option Description CD-ROM Choose CD-ROM to enable the local CD device. This option causes your local CD-ROM drive to behave as though it were a CD device directly attached to the remote host server. Floppy Choose Floppy to enable the local floppy device. This option causes your local floppy drive to behave as though it were a floppy device directly attached to the remote host server. CD-ROM Image Choose CD-ROM Image to specify the location of a CD-ROM image on your local client or network share. Floppy Image Choose Floppy Image to specify the location of a floppy image on your local client or network share.34 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 b. To specify the storage drive location or image file location, perform one of the following actions: ¦ In the Drive Selection dialog box, select or type a drive location, and then click OK. ¦ In the File Open dialog box, browse to the location of the image, and then click OK. 3. To reuse these storage settings on the host at a later time, click the Devices menu, and then Save as Host Default. Note – The operation of a redirected CD drive or diskette can vary depending upon its state. For more information about understanding these different behaviors see the following section. Interpreting CD and Diskette Redirection Behavior Use the information in the following table to help identify different case scenarios in which the CD drive or diskette drive redirection functionality might behave during a Remote Console session. Case Status DVD as Seen by Remote Host Diskette as Seen by Remote Host 1 Remote Console application not started, or Remote Console started but DVD/diskette redirection not started. DVD device present. No medium indication is sent to the host from Oracle ILOM when the hosts asks. Diskette device present. No medium indication is sent to the host from Oracle ILOM when the host asks. 2 Remote Console application started with no medium present in the drive. DVD device present. When the host asks, which might be automatic or when you access the device on the host, the remote client sends a status message. In this case, since there is no medium, the status is no medium. Diskette device present. When the host asks (for example, you double-click a drive), the remote client sends a status message. In this case, since there is no medium, the status is no medium. 3 Remote Console application started with no medium, then medium is inserted. DVD device present. When the hosts asks (automatic or manual), the remote client sends a status message as medium present and also indicates the medium change. Diskette device present. When the host asks (manual), the remote client sends a status message as medium present and also indicates the medium change. 4 Remote Console application started with medium inserted. Same as case 3. Same as case 3. 5 Remote Console application started with medium present, then medium is removed. Next command from the host will get a status message indicating medium not present. Next command from the host will get a status message indicating medium not present.Launching and Redirecting KVMS Devices Using the Oracle ILOM Remote Console 35 ? Add New Server Redirection Session 1. In the Oracle ILOM Remote Console window, click the Redirection menu, and then New Session. The New Session Creation dialog box appears. 2. In the New Session Creation dialog box, type the IP address of a remote host server SP, and then click OK. The Login dialog box appears. 3. In the Login dialog box, type a user name and password. A session tab for the newly added remote host server appears in the tab set of the Oracle ILOM Remote Console. Note – The Login dialog box also asks you whether the new session is to be video redirection (which is supported on all x86 systems and some SPARC systems) or serial redirection (which is currently supported on SPARC systems). Consult your platform documentation for more information about which type of redirection is supported. 6 Remote Console application started with image redirection. Same as case 3. Same as case 3. 7 Remote Console application started with image, but redirection is stopped (which is the only way to stop ISO redirection). Driver knows DVD redirection stopped, so it sends a medium absent status on the next host query. Driver knows DVD redirection stopped, so it sends a medium absent status on the next diskette query. 8 Network failure. The software has a keep-alive mechanism. The software will detect keep-alive failure since there is no communication and will close the socket, assuming the client is unresponsive. Driver will send a no medium status to the host. The software has a keep-alive mechanism. The software will detect unresponsive client and close the socket, as well as indicate to the driver that the remote connection went away. Driver will send a no medium status to the host. 9 Client crashes. Same as case 8. Same as case 8. Case Status DVD as Seen by Remote Host Diskette as Seen by Remote Host36 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 ? Exit the Oracle ILOM Remote Console To exit the Oracle ILOM Remote Console and close all remote server sessions, follow this step: ? In the Oracle ILOM Remote Console window, click the Redirection menu, and then Quit.37 Understanding Oracle ILOM Storage Redirection CLI Features The information in this topic describes Oracle ILOM Storage Redirection CLI features. Related Information ¦ “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41 ¦ “Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI” on page 51 Descriptions Links Learn about using the Oracle ILOM Storage Redirection CLI for the first time. “First-Time Use (Oracle ILOM Storage Redirection CLI)” on page 38 Learn about Oracle ILOM Storage Redirection CLI architecture. “Storage Redirection CLI Architecture” on page 38 Learn about Oracle ILOM Storage Redirection CLI default network port. “Default Network Communication Port” on page 3938 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 First-Time Use (Oracle ILOM Storage Redirection CLI) When you access the Storage Redirection CLI for the first time, you must sign in to the Oracle ILOM web interface to install the service and the client. After the service and client are installed on your system, you can subsequently start the service and launch the Storage Redirection CLI directly from a command window or terminal. Note – You can, alternatively, choose to start the service directly from the Oracle ILOM web interface. If you choose to start the service from the Oracle ILOM web interface without installing it, you will need to subsequently access the Oracle ILOM web interface to start the service prior to launching the Storage Redirection CLI from a command window or terminal. For more information about how to install or start the service, see “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41. Storage Redirection CLI Architecture The Storage Redirection CLI consists of a Java Web Start service and a scriptable, Java command-line client. You must start the service and initially install the client from the Oracle ILOM web interface. The Storage Redirection service runs in the background of your local client and establishes the connection between your local client and the remote host server. After a connection is established, you can locally launch the Storage Redirection CLI from a command window or terminal. The Storage Redirection CLI enables you to issue commands to the service for starting and stopping storage redirection.Understanding Oracle ILOM Storage Redirection CLI Features 39 FIGURE: Storage Redirection Service and Client Note – You can run only one instance of the Storage Redirection service on your local system at one time. However, you can launch multiple Storage Redirection CLIs by issuing the Storage Redirection command (-jar StorageRedir.jar) from a local command window or terminal. For instructions about how to launch and use the Storage Redirection feature in Oracle ILOM, see: ¦ “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41 ¦ “Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI” on page 51 Default Network Communication Port The default network communication port provided for Storage Redirection CLI is 2121. This default socket port enables the Storage Redirection CLI to communicate over the network with a remote host server SP. If you need to change the default network port, you must edit the Jnlpgenerator-cli file to manually override the default port number (2121). Figure Legend 1 Local client running Storage Redirection command-line client 2 Storage Redirection service running on local client 3 Remote host server40 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 For more information about how to edit the network port number that is referenced in the Jnlpgenerator-cli file, see “Change the Default Storage Redirection Network Port: 2121” on page 43.41 Setting Up Oracle ILOM Storage Redirection CLI for First Time Use Related Information ¦ “Understanding Oracle ILOM Storage Redirection CLI Features” on page 37 ¦ “Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI” on page 51 Task Description Platform Feature Support Ensure that all requirements are met prior to performing the initial setup procedures in this section. • “Initial Setup Requirements (Oracle ILOM Storage Redirection CLI)” on page 42 • x86 system server SP • SPARC system server SP Change the default network port used for the Storage Redirection CLI. • “Change the Default Storage Redirection Network Port: 2121” on page 43. Start the Storage Redirection service on your system. • “Start the Storage Redirection Service Using the Mozilla Firefox Web Browser” on page 44 - or- • “Start the Storage Redirection Service Using the Internet Explorer (IE) Web Browser” on page 46 Download and install the Storage Redirection client. • “Download and Install the Storage Redirection Client” on page 49.42 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Initial Setup Requirements (Oracle ILOM Storage Redirection CLI) Before you set up your system for storage redirection, the following prerequisites must be met. ¦ A connection is established from your local system to a remote host server SP Oracle ILOM web interface. ¦ Server module SP must be running Oracle ILOM 3.0 or later. ¦ The Java Runtime Environment (1.5 or later) is installed on your local system. To download the latest Java Runtime Environment, see (http://java.com). Note – If you do not have JAVA_HOME environment configured on your desktop, you might need to enter the full path. ¦ The 32-bit Java Development Kit (JDK) file needs to be specified when you start the Storage Redirection service. You can choose (as described in the procedures) to initially save this file to disk and subsequently run this service directly from the command-line interface, or you can choose to initially open the file with the default application and subsequently start the service from the Oracle ILOM web interface prior to using the Storage Redirection properties from the CLI. ¦ Any user with a valid user account in Oracle ILOM can start or install the Storage Redirection service or client on his or her local system. However, after the initial setup for the Storage Redirection CLI is complete, you will be required to enter a valid Admin (a) or Console (c) role account to start or stop the redirection of a storage device (CD/DVD, or ISO image) on a remote server. ¦ The default network communication port provided for Storage Redirection CLI is 2121. This default socket port enables the Storage Redirection CLI to communicate over the network with a remote host server SP. If you need to change the default network port, you must edit the Jnlpgenerator-cli file to manually override the default port number (2121). For instructions for changing this port, see “Change the Default Storage Redirection Network Port: 2121” on page 43.Setting Up Oracle ILOM Storage Redirection CLI for First Time Use 43 ? Change the Default Storage Redirection Network Port: 2121 1. In the Oracle ILOM SP web interface, click Remote Control --> Redirection. The Launch Redirection page appears. 2. Click Launch Service. The Opening Jnlpgenerator-cli dialog box appears. 3. In the Opening Jnlpgenerator-cli dialog, select Save it to disk, and then click OK. The Save As dialog box appears. 4. In the Save As dialog box, specify the location where you want to save the jnlpgenerator-cli file. 5. Open the jnlpgenerator-cli file using a text editor and modify the port number referenced in this file. For example: cli 2121 In the you can change the second argument to any port number that you want to use.44 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 6. Save the changes you made and close the jnlpgenerator-cli file. 7. Use the javaws to start the Storage Redirection service from your local client. For example: javaws jnlpgenerator-cli Note – If you do not use the default port number provided, you must always identify the non-default port number in the Storage Redirection command-line interface when starting, stopping or viewing storage redirections. Starting the Storage Redirection Service ? Start the Storage Redirection Service Using the Mozilla Firefox Web Browser Follow these steps to specify the 32-bit JDK when starting the service for the Storage Redirection CLI using the Mozilla Firefox web browser. 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control --> Redirection --> Launch Service. A dialog box appears indicating the file type chosen to start the service. Task Description Platform Feature Support Start the Storage Redirection Service using the Firefox browser. • “Start the Storage Redirection Service Using the Mozilla Firefox Web Browser” on page 44 • x86 system server SP • SPARC system server SP Start the Storage Redirection Service using the IE browser. • “Start the Storage Redirection Service Using the Internet Explorer (IE) Web Browser” on page 46Setting Up Oracle ILOM Storage Redirection CLI for First Time Use 45 3. In the Opening jnlpgenerator-cli file dialog box, do the following: a. Specify one of the following options for accessing the 32-bit JDK file. ¦ Save to Disk - To save the jnlpgenerator-cli file on your local system and run the service directly from a command line, select Save it to disk, and then click OK. If you select this option, you will not need to subsequently sign in to the Oracle ILOM web interface to start the service. You will be able to start the service directly from a command window or terminal. ¦ Open with… - To run the service directly from the Oracle ILOM web interface, select Open it with javaws (default) (32-bit JDK file), and then click OK. If you select this option, the jnlp file is not saved on your local system and you will need to subsequently sign in to the Oracle ILOM web interface to start the service prior to launching the Storage Redirection CLI. b. (Optional) Select the “Do this automatically for files like this from now on” check box, and then click OK. Note – To prevent the Opening Jnlpgenerator-cli dialog from reappearing each time you start the service from the Oracle ILOM web interface, you can select the “Do this automatically for files like this from now on” check box. However, if you choose to enable this option, you will no longer be able to display this dialog box when starting the service or installing the service from the Oracle ILOM web interface.46 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Note – If, in the future, you need to modify the default communication port number (2121) shipped with the Storage Redirection feature, you will need to display the Opening Jnlpgenerator-cli dialog to save and edit the jnlpgenerator-cli file on your system. In this instance, it is not recommended that you select the “Always perform this action when handling files of this type” check box. For more information about changing the default port number, see “Change the Default Storage Redirection Network Port: 2121” on page 43. 4. Perform one of the following actions: ? Start the Storage Redirection Service Using the Internet Explorer (IE) Web Browser Perform the following steps prior to starting the service for the Storage Redirection CLI feature in Oracle ILOM. These steps describe how to start the Storage Redirection service after registering the 32-bit JDK file. 1. Prior to starting the Storage Redirection service on your Windows system for the first time, you must register the 32-bit JDK file by following these steps: a. On the Windows client, open Windows Explorer (not Internet Explorer). b. In the Windows Explorer dialog box, click Tools --> Folder Options, and then click the Files Types tab. c. In the Files Types tab, do the following: ¦ In the registered file type list, select the JNLP file type and click Change. If you chose in Step 3 to: Perform these steps: • Save the jnlpgenerator-cli file. 1. In the Save As dialog box, save the jnlpgenerator-cli file to a location on your local system. 2. To start the service from the command line, open a command window or terminal. 3. Navigate to the location where the jnlpgenerator-cli file is installed, then issue the javaws rconsole.jnlp command to start the service. For example: -> cd javaws rconsole.jnlp • Run the service directly from the web interface. • In the Warning Security dialog, click Run to start the Storage Redirection service.Setting Up Oracle ILOM Storage Redirection CLI for First Time Use 47 ¦ In the Open With… dialog box, click Browse to select the 32-bit JDK file. ¦ Select the “Always use the selected program t open this kind of file” check box. ¦ Click OK, and then start the service for Storage Redirection in the Oracle ILOM web interface. 2. To start the Storage Redirection service (after registering the 32-bit JDK file), do the following: a. Log in to the Oracle ILOM SP web interface. b. Click Remote Control --> Redirection --> Launch Service. The Opening Jnlpgenerator-cli dialog box appears. c. In the Opening Jnlpgenerator-cli dialog box, perform one of the following actions: ¦ Save it to disk - To save the jnlpgenerator-cli file on your local system and run the service directly from a command line, select Save it to disk, and then click OK. If you select this option, you will not need to subsequently sign in to the Oracle ILOM web interface to start the service. You will be able to start the service directly from a command window or terminal. ¦ Open with… - To run the service directly from the Oracle ILOM web interface, select Open it with javaws (default) (32-bit JDK file), and then click OK. If you select this option, the jnlp file is not saved on your local system and you will need to subsequently sign in to the Oracle ILOM web interface to start the service prior to launching the Storage Redirection CLI.48 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Note – To prevent the Opening Jnlpgenerator-cli dialog box from reappearing each time you start the service from the Oracle ILOM web interface, you can select the “Always perform this action when handling files of this type” check box. However, if you choose to enable this option, you will no longer be able to display this dialog box when starting the service or installing the service from the Oracle ILOM web interface. Note – If, in the future, you need to modify the default communication port number (2121) shipped with the Storage Redirection feature, you will need to display the Opening Jnlpgenerator-cli dialog box to save and edit the jnlpgenerator-cli file on your system. In this instance, it is not recommended that you select the “Always perform this action when handling files of this type” check box. For more information about changing the default port number, see “Change the Default Storage Redirection Network Port: 2121” on page 43. d. Perform one of the following actions: If the Storage Redirection service fails to start, an error message appears informing you of an error condition. Otherwise, if an error message did not appear, the service is started and is waiting for user input. If you chose in Step C to: Perform these steps: • Save the jnlpgenerator-cli file 1. In the Save As dialog box, save the jnlpgenerator-cli file to a location on your local system. 2. To start the service from the command line, open a command window or terminal. 3. Navigate to the location where the jnlpgenerator-cli file is installed, then issue the javaws rconsole.jnlp command to start the service. For example: -> cd javaws rconsole.jnlp • Run the service directly from the web interface • In the Warning Security dialog box, click Run to start the Storage Redirection service.Setting Up Oracle ILOM Storage Redirection CLI for First Time Use 49 ? Download and Install the Storage Redirection Client Follow these steps to download and install the Storage Redirection client on your local system. Note – The Storage Redirection client is a one-time client installation. 1. In the Oracle ILOM SP web interface, click Remote Control --> Redirection. The Launch Redirection page appears. 2. Click Download Client. The Opening StorageRedir.jar dialog box appears. 3. In the Opening StorageRedir.jar dialog box, click Save it to Disk, and then click OK. The Save As dialog box appears. Note – If you do not want the Opening StorageRedir dialog to reappear when installing the .jar file on other remote clients, you can select the “Always perform this action when handling files of this type” check box. However, if you choose to enable this option, you will no longer be able to display this dialog box (Opening StorageRedir) in the future when downloading the .jar file. 4. In the Save As dialog box, save the StorageRedir.jar file to a location on your local system.50 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 201151 Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI Related Information ¦ “Understanding Oracle ILOM Storage Redirection CLI Features” on page 37 Description Links Platform Feature Support Ensure that all requirements are met before using the Storage Redirection CLI. • “Usage Requirements (Storage Redirection CLI)” on page 52 • x86 system server SP • SPARC system server SP Launch the Storage Redirection CLI. • “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53 If applicable, verify that Storage Redirection service is running. • “Verify That the Storage Redirection Service Is Running” on page 54 If applicable, display command-line Help; or learn more about the Storage Redirection command-line modes, syntax, and usage. • “Display Storage Redirection CLI Help Information” on page 55 Redirect a storage device from the CLI. • “Start Redirection of Storage Device” on page 56 View a list of active storage devices. • “View Active Storage Redirections” on page 56 Stop the redirection of a storage device. • “Stop Redirection of Storage Device” on page 57 Learn about Storage Redirection CLI commands. • “Supported Storage Redirection Commands and Options” on page 5852 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 ¦ “Setting Up Oracle ILOM Storage Redirection CLI for First Time Use” on page 41 Usage Requirements (Storage Redirection CLI) The following requirements must be met before you perform the procedures in this section. ¦ The Storage Redirection service must be started on your local system. If you installed the service on your local system, you can start it from a command window or terminal. If you did not install the service on your local system, you must start it from the Oracle ILOM web interface. For information about how to start or install the Storage Redirection service, see “Starting the Storage Redirection Service” on page 44. Note – You can only run one instance of the Storage Redirection service on your local system at one time. ¦ The Storage Redirection client (StorageRedir.jar) must be installed on your local system. For more information about how to install the Storage Redirection client, see “Download and Install the Storage Redirection Client” on page 49. ¦ The Java Runtime Environment (1.5 or later) must be installed on your local system. To download the latest Java Runtime Environment, see (http://java.com). ¦ A valid Oracle ILOM account with Administrator user role profile privileges is required to start or stop the redirection of a storage device (CD/DVD, or ISO image) on a remote server. Note – Any user with a valid user account in Oracle ILOM can launch the Storage Redirection CLI (from a command window or terminal) and verify the status of the the service, or view the occurrence of an active storage redirection. ¦ On Windows systems, both uppercase drive letter 'C:\' and lowercase letter 'c:\' are accepted for CD-ROM and floppy image redirection. However, only uppercase drive letters ('D:\', 'A:\') are accepted for both CD-ROM drive and floppy drive redirection. ¦ For more information about the Storage Redirection command-line modes, syntax and usage, see “Supported Storage Redirection Commands and Options” on page 58.Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 53 ? Launch the Storage Redirection CLI Using a Command Window or Terminal Prior to launching the Storage Redirection CLI, you must have started the Storage Redirection service. For instructions for launching the service, see “Starting the Storage Redirection Service” on page 44. 1. Open a command-line interface. For example: ¦ Windows systems: From the Start menu, click Run, type cmd, and then click OK. ¦ Solaris or Linux systems: Open a terminal window on the desktop. 2. Perform one of the following actions: ¦ To enter commands from an interactive shell mode, do the following: a. In the command-line interface, navigate to the directory where the Storage Redirection client (StorageRedir.jar) was installed using the cd command. For example: cd / b. Enter the following command to launch the Storage Redirection CLI. java -jar StorageRedir.jar For example: C:\Documents and Settings\java -jar StorageRedir.jar The prompt appears. Note – If you are using Windows, you must specify an uppercase letter for the target drive directory. For example, if you are using a DVD drive location, you need to specify C:\ instead of c:\. ¦ To enter commands from an non-interactive shell mode, do the following: a. In the command-line interface, enter the command to launch the Storage Redirection CLI (java -jar StorageRedir.jar) at the shell prompt ($).54 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 $ java -jar StorageRedir.jar Note – If you do not have a JAVA_HOME environment configured, you might need to use the full path to your Java binary. For example, if your JDK package was installed under /home/user_name/jdk then you would type: /home/user_name/jdk/bin/java -jar ... If the Storage Redirection CLI fails to launch, a detailed error message appears explaining the error condition. Otherwise, the Storage Redirection CLI is ready for user input. Note – You can launch multiple Storage Redirection CLIs by issuing the Storage Redirection command (-jar StorageRedir.jar) from a local command window or terminal. ? Verify That the Storage Redirection Service Is Running The following procedure assumes that you have already launched the Storage Redirection CLI from a command window or terminal. For instructions for launching the Storage Redirection CLI, see “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53. ? Type the following command at the prompt to verify that the Storage Redirection service is active: test-service For example: test-service Alternatively, you could enter this same command (test-service) using the non-interactive shell mode syntax. For more information, see “Supported Storage Redirection Commands and Options” on page 58. A message appears stating whether the service connection passed or failed.Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 55 Note – If the service connection fails, you will need to start the Storage Redirection service from the Oracle ILOM web interface or from a command window (if the service was installed) by issuing the javaws rconsole.jnlp command. For details, see “Starting the Storage Redirection Service” on page 44. ? Display Storage Redirection CLI Help Information The following procedure assumes that you have already launched the Storage Redirection CLI from a command window or terminal. For instructions for launching the Storage Redirection CLI, see “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53. ? Type the following command at the prompt to display the command-line help: help For example: help The following information about the command syntax and usage appears: Alternatively, you could enter this same command (help) using the non-interactive shell mode syntax. For more information, see “Supported Storage Redirection Commands and Options” on page 58. Usage: list [-p storageredir_port] [remote_SP] start -r redir_type -t redir_type_path -u remote_username [-s remote_user_password] [-p storageredir_port] remote_SP stop -r redir_type -u remote_username [-s remote_user_password] [-p storageredir_port] remote_SP stop-service [-p storageredir_port] test-service [-p storageredir_port] help version quit56 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 ? Start Redirection of Storage Device Before You Begin The following procedure assumes that you have already launched the Storage Redirection CLI from a command window or terminal. For instructions for launching the Storage Redirection CLI, see “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53. Note – Commands shown in the following procedure should be entered as one continuous string. ? At the prompt, type the start command followed by the commands and properties for the redirection device type, path to device, remote SP user_name and password, and the IP address of the remote SP. For example: start -r redir_type -t redir_type_path -u remote_username [-s remote_user_password] [-p non_default_storageredir_port] remote_SP_IP Note – On Windows systems, both uppercase drive letter 'C:\' and lowercase letter 'c:\' are accepted for CD-ROM and floppy image redirection. However, only uppercase drive letters ('D:\', 'A:\') are accepted for both CD-ROM drive and floppy drive redirection. Alternatively, you could enter this same command (start) using the non-interactive shell mode syntax. For more information, see “Supported Storage Redirection Commands and Options” on page 58. Note – You must specify a valid Admin or Console role account (-u remote_username [-s remote_user_password]) to start the redirection of a storage device on a remote server. If you do not specify the password command (-s remote_user_password), the system will automatically prompt you for it. ? View Active Storage Redirections Before You BeginRedirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 57 The following procedure assumes that you have already launched the Storage Redirection CLI from a command window or terminal. For instructions for launching the Storage Redirection CLI, see “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53. Note – Commands shown in the following procedure should be entered as one continuous string. ? At the prompt, type the list command followed by the sub-commands and properties for any non-default storage redirection ports and the IP addresses of the remote host server SP. For example: list [-p non_default _storageredir_port] remote_SP Alternatively, you could enter this same command (list) using the non-interactive shell mode syntax. For more information, see “Supported Storage Redirection Commands and Options” on page 58. A list appears identifying the active storage redirections for each server SP specified. ? Stop Redirection of Storage Device Before You Begin The following procedure assumes that you have already launched the Storage Redirection CLI from a command window or terminal. For instructions for launching the Storage Redirection CLI, see “Launch the Storage Redirection CLI Using a Command Window or Terminal” on page 53. Note – Commands shown in the following procedure should be entered as one continuous string. ? At the prompt, type the stop command followed by the commands and properties for the: storage device type, remote SP user name and password, storage redirection port, and the IP address of the remote host server SP. For example:58 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 stop -r redir_type -u remote_username [-s remote_user_password] [-p non_defult_storageredir_port] remote_SP Alternatively, you could enter this same command (stop) using the non-interactive shell mode syntax. For more information, see “Supported Storage Redirection Commands and Options” on page 58. Note – You must specify a valid Admin or Console role account (-u remote_username [-s remote_user_password]) to stop the redirection of a storage device on a remote server. If you do not specify the password command (-s remote_user_password), the system will automatically prompt you for it. Supported Storage Redirection Commands and Options The Storage Redirection CLI supports both an interactive and non-interactive mode for entering commands. The interactive mode is useful when you need to enter a series of Storage Redirection commands. The non-interactive mode is useful when you need to run a batch procedure or script. Syntax The syntax required for entering the Storage Redirection commands in either of these modes is as follows: ¦ Interactive shell mode syntax ¦ Non-interactive shell mode syntax $ java -jar StorageRedir.jar Command Name Description java -jar StorageRedir.jar The java -jar command is used to launch the Storage Redirection client (StorageRedir.jar) from a command window or terminal.Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 59 storageredir The storagedir command performs all storage redirection operations. Command Name Description60 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 Command Options Sub-Commands Option Name Description - h The - h command option displays the command-line Help information. - v The -v command option displays the Java command version information. Sub-Command Name Description list The list sub-command provides a list of the currently active storage redirections on one or all remote SPs. Syntax usage example: storageredir list [-p storageredir_port] [remote_SP] start The start sub-command invokes the specified redirection between the local host and the remote host server. If the authentication password is not provided, the system will prompt for it. Syntax usage example: storageredir start -r redir_type -t redir_type_path -u remote_username [-s remote_user_password] [-p storageredir_port] remote_SP Note - You must specify a valid Admin or Console role account in Oracle ILOM to start the redirection of storage device on a remote server. stop The stop sub-command stops the specified redirection between the local host and the remote host server. If the authentication password is not provided, the system will prompt for it. Syntax usage example: storageredir stop -r redir_type -u remote_username [-s remote_user_password] [-p storageredir_port] remote_SP Note - You must specify a valid Admin or Console role account in Oracle ILOM to stop the redirection of storage device on a remote server.Redirecting a Storage Device Using the Oracle ILOM Storage Redirection CLI 61 Sub-Command Options test-service The test-service sub-command verifies whether the Storage Redirection service connection is active on the local host. Syntax usage example: storageredir test-service [-p storageredir_port] stop-service The stop-service sub-command stops the Storage Redirection service connection to the remote host server. Syntax usage example: storageredir stop-service [-p storageredir_port] Sub-Command Option Name Description -r redir_type The -r redir_type identifies the type of storage media being redirected. Valid device values for redir_type include: • CD-ROM device Syntax: -r cdrom • CD-ROM image: Syntax: -r cdrom_img • Floppy device: Syntax: -r floppy • Floppy image: Syntax: -r floppy_img -t redir_type_path The -t redir_type_path identifies the full path to where the storage redirection media is stored or mounted. Example: -t /home/username/JRC_Test_Images/CDROM.iso -u remote_username The -u remote_username identifies the user name required to log in to the Oracle ILOM SP. Example: -u john_smith Note - Any valid user account in Oracle ILOM can install or launch the Storage Redirection service or client on a local system. However, a valid Admin or Console role in Oracle ILOM is required to start or stop the redirection of a storage device on a remote server. Sub-Command Name Description62 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 -s remote_user_password The -s remote_user_password identifies the password required to log in to the Oracle ILOM SP. If this password command is not specified at the command line, the system will automatically prompt you for it. -p storageredir_port The -p storageredir_port identifies the Storage Redirection communication port on the local host. The default port provided is 2121. Example: -p 2121 Sub-Command Option Name Description63 Index B Before, 20 browsers, supported, 12 D device redirection host console, 26 network ports and protocols, 8 toggling keyboard and mouse control, 30 using Remote Console, 29 using Storage Redirection CLI, 37 download storage redirection CLI client, 49 downloading Java Runtime Environment, 12 E exiting a remote console session, 36 exiting the Storage Redirection CLI, 57 F Firefox, registering the 32-bit JDK, 15 H host console redirection overview, 1 host console redirection, starting, 26 host console, locking, 18 I installation requirements, Remote Console, 12 installation requirements, Storage Redirection CLI, 42 Internet Explorer, registering the 32-bit JDK, 15 IPv6 support with Windows, 12 J Java Development Kit, registering, 14 Java Runtime Environment downloading for Remote Console, 12 downloading for Storage Redirection CLI, 42 Jnlpgenerator service for Storage Redirection CLI, 45 K keyboard control modes, 30 keyboard control, toggling between local and remote console, 30 Keyboard/Video/Mouse/Screen (KVMS), 13 KVMS, 13 KVMS lock, 18 L launching Remote Console, 25 launching Storage Redirection CLI, 53 locking the system console remotely how to, 18 overview, 9 M mouse control, toggling between local and remote console, 30 N network port 2121 default storage redirection port, 43 network ports and protocols, 8 O operating system support, 12 R redirection CD or diskette in Remote Console, 3464 Oracle ILOM 3.0 Remote Redirection Consoles - CLI and Web Guide • May 2011 device behavior during Remote Console session, 34 keyboard input, 31 mouse input for video redirection, 32 starting, stopping , restarting, 29 storage media using Remote Console, 32 storage media using Storage Redirection CLI, 52 registering 32-bit JDK when using Firefox, 15 when using Internet Explorer, 15 Remote Console about, 2 sign-in authentication, 9 single and multiple server views, 6 video redirection, 13 remote console sessions, adding, 35 Remote Console, overview, 5 remote host managing, 41 redirecting storage devices, 51 starting redirection of storage device, 56 stopping redirection of storage device, 57 storage redirection changing default network port, 43 Storage Redirection CLI, 51 remote host console managment, overview, 1 S serial redirection, 31 sign-in authentication required for Remote Console, 9 required for Storage Redirection CLI, 42 Single Sign On when launching the Remote Console, 9 start, stop, or restart device redirection, 29 storage media redirection in Remote Console, 32 Storage Redirection CLI architecture, 38 commands and options, 58 default communication port, 42 installing client, 49 launching, 53 overview, 3 sign-in authentication, 42 supported commands and options, 58 viewing active redirections, 56 Storage Redirection client downloading and installing, 49 V video redirection, 13 W web browsers, supported, 12 web interface overview, 11 Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide Part No. E21447-01, May 2011, Revision 01Please Recycle Copyright © 2010, 2011 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011 Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation ix ? Download Product Software and Firmware xi Oracle ILOM Overview 1 What Is Oracle ILOM? 2 What Does Oracle ILOM Do? 2 Oracle ILOM Features and Functionality 4 New Features in Oracle ILOM 3.0 5 User Accounts – Backward Compatibly 6 Preconfigured User Accounts 7 root User Account 7 root Factory Default Password Warning Message 7 default User Account 8 Oracle ILOM Supported Interfaces 9 Oracle ILOM on the Server SP and CMM 10 System Banner Messages 10 Network Configurations 13 Oracle ILOM Network Management 14 Oracle ILOM Connection Methods 14 Initial Setup Worksheet 16 Default Network Port Used By Oracle ILOM 16 Switch Serial Port Console Output (Serial Port Owner) 18iv Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Oracle ILOM Communication Settings 19 SP Management Port – Recommended Practice for Spanning Tree Parameters 19 Network Configurations for IPv4 20 Dual-Stack Network Configurations for IPv4 and IPv6 (ILOM 3.0.12) 20 Oracle ILOM IPv6 Enhancements 21 Dual-Stack Network Options in Oracle ILOM CLI and Web Interface 23 Legacy Sun Server Platforms Not Supporting IPv6 24 Local Interconnect Interface: Local Connection to ILOM From Host OS 25 Platform Server Support and Oracle ILOM Access Through the Local Interconnect Interface 25 Local Interconnect Interface Configuration Options 26 Local Host Interconnect Configuration Settings in Oracle ILOM 27 User Account Management 31 Guidelines for Managing User Accounts 32 User Account Roles and Privileges 32 Oracle ILOM 3.0 User Account Roles 33 Single Sign On 33 SSH User Key-Based Authentication 34 Active Directory 34 User Authentication and Authorization 35 User Authorization Levels 35 Lightweight Directory Access Protocol 36 LDAP/SSL 36 RADIUS 37 System Monitoring and Alert Management 39 System Monitoring 40Contents v Sensor Readings 41 System Indicators 41 Supported System Indicator States 41 Types of System Indicator States 42 Component Management 42 Fault Management 45 Clear Faults After Replacement of Faulted Components on Server or CMM 46 Oracle ILOM Event Log 47 Event Log Time Stamps and Oracle ILOM Clock Settings 48 Manage Event Log and Time Stamps From CLI, Web, or SNMP Host 48 Syslog Information 48 Collect SP Data to Diagnose System Problems 49 Alert Management 49 Alert Rule Configuration 49 Alert Rule Property Definitions 50 Alert Management From the CLI 53 Alert Management From the Web Interface 54 Alert Management From an SNMP Host 55 Storage Monitoring and Zone Management 57 Storage Monitoring for HDDs and RAID Controllers 58 CLI Storage Properties Shown for HDDs and RAID Controllers 58 RAID Status Definitions for Physical and Logical Drives 60 Monitoring Storage Components Using the CLI 61 Monitoring Storage Components Using the Web Interface 62 RAID Controllers Tab Details 62 Disks Attached to RAID Controllers Details 64 RAID Controller Volume Details 66vi Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 CMM Zone Management Feature 67 Power Monitoring and Management of Hardware Interfaces 69 Summary of Power Management Feature Updates 70 Power Monitoring Terminology 73 Real-Time Power Monitoring and Management Features 75 System Power Consumption Metrics 75 Web Interface Power Consumption Metrics as of Oracle ILOM 3.0 76 CLI Power Consumption Metrics as of Oracle ILOM 3.0 77 Web Interface Server and CMM Power Consumption Metrics As of Oracle ILOM 3.0.4 78 Web Enhancements for Server SP Power Consumption Metrics As of 3.0.8 79 Web Enhancements for CMM Power Consumption Metrics As of 3.0.10 81 Power Policy Settings for Managing Server Power Usage 83 Power Policy Settings as of Oracle ILOM 3.0 83 Power Policy Settings as of Oracle ILOM 3.0.4 84 Power Capping Policy Settings as of Oracle ILOM 3.0.8 84 Power Usage Statistics and History Metrics for Server SP and CMM 86 Web Interface Power Usage Statistics and History Metrics 87 Power Usage Statistics and History as of Oracle ILOM 3.0.3 87 Power History - Data Set Sample of Power Consumed 88 Power Usage Statistics and History Web Enhancements as of Oracle ILOM 3.0.4 89 Power Usage Statistics and Power History Web Enhancements as of Oracle ILOM 3.0.14 90 CLI Power Consumption History Metrics 92 Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4 92 Component Allocation Distribution as of Oracle ILOM 3.0.6 for Server SP and CMM 93Contents vii Monitoring Server Power Allocated Components 93 Monitoring CMM Power Allocated Components 95 Component Power Allocation Special Considerations 97 Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP) 98 Updated Server SP Power Allocation Web Procedure 99 Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM) 100 Revised CLI Power Allocation Properties as of Oracle ILOM 3.0.10 102 Power Budget as of Oracle ILOM 3.0.6 for Server SPs 102 Why Use a Power Budget? 103 Server Power Budget Properties as Oracle ILOM 3.0.6 104 Advanced Server Power Budget Features as of Oracle ILOM 3.0.6 105 Power Management --> Budget Tab Renamed to Limit Tab as of Oracle ILOM 3.0.8 107 Updated Power Limit Configuration Procedure 109 Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6 109 Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6 110 Remote Host Management Operations 113 Remote Power Control 114 Host Control - Boot Device on x86 Systems 114 Oracle ILOM Operations for LDom Configurations on SPARC Servers 115 Remote Redirection Console Options 115 Oracle ILOM Host Maintenance and Diagnostics Options 117 Host Maintenance Operations 118 Host Diagnostic Options 118 Example Setup of Dynamic DNS 119viii Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Dynamic DNS Overview 119 Example Dynamic DNS Configuration 121 Assumptions 121 ? Configure and Start the DHCP and DNS Servers 121 References 123 Glossary 125 Index 143ix Using This Documentation This concepts guide describes the Oracle Integrated Lights Out Manager (ILOM) 3.0 daily management features that are common to Oracle’s Sun rack-mounted servers, server modules, and CMMs supporting Oracle ILOM 3.0. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Collection. This guide is written for technicians, system administrators, authorized service providers, and users who have experience managing system hardware. This section includes the following topics: ¦ “Documentation and Feedback” on page x ¦ “Product Downloads” on page xi ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xii ¦ “Documentation, Support, and Training” on page xiiix Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Collection at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xi Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the product of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.xii Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface.Using This Documentation xiii Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)xiv Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 20111 Oracle ILOM Overview Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, overview CLI ¦ Oracle ILOM 3.0 Daily Management Web Procedures, overview web interface ¦ Oracle ILOM 3.0 Protocol Management, management using SNMP ¦ Oracle ILOM 3.0 Protocol Management, management using IPMI ¦ Oracle ILOM 3.0 Protocol Management, CIM and WS-MAN ¦ Oracle ILOM 3.0 Remote Redirection Consoles, remote redirection consoles ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, host maintenance operations, host diagnostics Description Links Learn about Oracle ILOM features and functionality. • “What Is Oracle ILOM?” on page 2 • “What Does Oracle ILOM Do?” on page 2 • “Oracle ILOM Features and Functionality” on page 4 • “New Features in Oracle ILOM 3.0” on page 5 Get started with using Oracle ILOM 3.0 user accounts. • “User Accounts – Backward Compatibly” on page 6 • “Preconfigured User Accounts” on page 7 Identify Oracle ILOM 3.0 user interfaces, device management options, and ways you can publish system messages to Oracle ILOM users. • “Oracle ILOM Supported Interfaces” on page 9 • “Oracle ILOM on the Server SP and CMM” on page 10 • “System Banner Messages” on page 102 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 What Is Oracle ILOM? Oracle’s Integrated Lights Out Manager (ILOM) provides advanced service processor hardware and software that you can use to manage and monitor your Oracle Sun servers. Oracle ILOM’s dedicated hardware and software is preinstalled on a variety of Oracle Sun server platforms, including x86-based Sun Fire servers, Sun Blade modular chassis systems, Sun Blade server modules, as well as on SPARC-based servers. Oracle ILOM is a vital management tool in the data center and can be used to integrate with other data center management tools already installed on your systems. Oracle ILOM is supported on many Oracle systems enabling users to experience a single, consistent, and standards-based service processor (SP) across all Oracle Sun server product lines. This means you will have: ¦ Single, consistent system management interfaces for operators ¦ Rich protocol and standards support ¦ Broadening third-party management support ¦ System management functions integrated into Oracle’s Sun servers at no extra cost What Does Oracle ILOM Do? Oracle ILOM enables you to actively manage and monitor the server independently of the operating system state, providing you with a reliable lights out management (LOM) system. With Oracle ILOM, you can proactively: ¦ Learn about hardware errors and faults as they occur ¦ Remotely control the power state of your server ¦ View the graphical and non-graphical consoles for the host ¦ View the current status of sensors and indicators on the system ¦ Determine the hardware configuration of your system ¦ Receive generated alerts about system events in advance through IPMI PETs, SNMP traps, or email alerts. The Oracle ILOM service processor (SP) runs its own embedded operating system and has a dedicated Ethernet port, which together provide out-of-band management capability. In addition, you can access Oracle ILOM from the server’s host operatingOracle ILOM Overview 3 system (Solaris, Linux, and Windows). Using Oracle ILOM, you can remotely manage your server as if you were using a locally attached keyboard, monitor, and mouse. Oracle ILOM automatically initializes as soon as power is applied to your server. It provides a full-featured, browser-based web interface and has an equivalent command-line interface (CLI). There is also an industry-standard SNMP interface and IPMI interface. You can easily integrate these management interfaces with other management tools and processes that you might have working already with your servers, such as Oracle Enterprise Ops Center. This easy-to-use system management platform for Solaris and Linux provides the tools that you need to efficiently manage systems on your network. Oracle Enterprise Ops Center can discover new and existing systems on your network, update firmware and BIOS configurations, provision the operating environment with off-the-shelf distributions or Solaris images, manage updates and configuration changes, and remotely control key aspects of the service processor such as boot control, power status, and indicator lights. For more information about Oracle Enterprise Ops Center, go to: (http://www.oracle.com/us/products/enterprise-manager/opscenter/ index.html) In addition, you can integrate Oracle ILOM with these third-party management tools: ¦ Oracle Hardware Management Connector 1.2 for Altiris Deployment Solution ¦ BMC PATROL 6.9 ¦ CA Unicenter Network and Systems Management (NSM) ¦ HP OpenView Operations for UNIX ¦ HP OpenView Operations for Windows ¦ HP Systems Insight Manager ¦ IBM Director ¦ IBM Tivoli Enterprise Console ¦ IBM Tivoli Monitoring (ITM) ¦ IBM Tivoli Netcool/OMNIbus ¦ IPMItool 1.8.10.3 for Microsoft Windows 2003 ¦ Microsoft Operations Manager 2005 ¦ Microsoft System Management ¦ Microsoft Systems Center Operations Manager 2007 ¦ Sun Deployment Pack 1.0 for Microsoft System Center Configuration Manager 2007 ¦ Sun Update Catalog for Microsoft System Center Configuration Manager 2007 ¦ Sun IPMI System Management Driver for Server 2003 prior to R24 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Sun ILOM Common SNMP MIBs ¦ Service Processor Error Injector 1.0 A description of these third-party system management tools and their support for Oracle’s Sun systems is available at: (http://www.sun.com/system-management/tools.jsp) Oracle ILOM Features and Functionality Oracle ILOM offers a full set of features, functions, and protocols that will help you monitor and manage your server systems. TABLE: Oracle ILOM Features and Functionality Oracle ILOM Feature What You Can Do Dedicated service processor and resources • Manage the server without consuming system resources. • Continue to manage the server using standby power even when the server is powered off. Simple Oracle ILOM initial configuration • ILOM automatically learns the network address of the server SP or CMM using IPv4 and IPv6 default settings. Downloadable firmware updates • Download firmware updates using the browser-based web interface. Remote hardware monitoring • Monitor system status and event logs. • Monitor customer-replaceable units (CRUs) and field-replaceable units (FRUs), including power supplies, fans, host bus adapters (HBAs), disks, CPUs, memory, and motherboard. • Monitor environmentals (component temperatures). • Monitor sensors, including voltage and power. • Monitor indicators (LEDs). Hardware and FRU inventory and presence • Identify installed CRUs and FRUs and their status. • Identify part numbers, versions, and product serial numbers. • Identify NIC card MAC addresses. Remote KVMS • Redirect the system serial console via serial port and LAN. • Access keyboard, video, and mouse (KVM) on remote x86 systems and on some SPARC systems. • Redirect the OS graphical console to a remote client browser. • Connect a remote CD/DVD/floppy to the system for remote storage.Oracle ILOM Overview 5 New Features in Oracle ILOM 3.0 Oracle ILOM 3.0 is enhanced with many new features and functions that were not available in Oracle ILOM 2.x, including improved security, improved usability, and easier integration into your data center environment. The following table identifies some of the new features provided in Oracle ILOM 3.0. System power control and monitoring • Power the system on or off, either locally or remotely. • Force power-off for emergency shutdown or perform a graceful shutdown to shut down the host operating system before power off. Configuration and management of user accounts • Configure local user accounts. • Authenticate user accounts using LDAP, LDAP/SSL, RADIUS, and Active Directory. Error and fault management • Monitor system BIOS, POST, and sensor messages. • Log events in a consistent method for all “service” data. • Monitor hardware and system-related errors, as well as ECC memory errors, reported into SP logs, syslog, and remote log-host. System alerts, including SNMP traps, IPMI PETs, remote syslog, and email alerts • Monitor components using industry-standard SNMP commands and the IPMItool utility. TABLE: Oracle ILOM 3.0 New Features Category Feature General Functionality DNS support Timezone support Configuration backup and restore Restore to factory defaults Enhanced LDAP and LDAP/SSL support Java-based remote storage CLI Power management capabilities TABLE: Oracle ILOM Features and Functionality (Continued) (Continued) Oracle ILOM Feature What You Can Do6 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 For more information about new point release features implemented after Oracle ILOM 3.0, see the Oracle ILOM 3.0 Feature Updates and Release Notes. User Accounts – Backward Compatibly For Oracle ILOM 3.0, user roles are implemented to control user privileges. However, for backward compatibility, Oracle ILOM 2.x style user accounts (which have either Administrator or Operator privileges) are still supported. For more information about Oracle ILOM 3.0 user roles, see “Oracle ILOM 3.0 User Account Roles” on page 33. Ability to generate new SSH keys Scalability and Usability User-configurable filtering of hardware monitoring information in CLI and web interface Use host name to access other services by name, such as LDAP, Active Directory, LDAP/SSL Security More granular user roles Predefined root and default accounts User SSH key authentication Ability to disable the network management port when you are using only the serial port Ability to disable individual services, such as IPMI, SSH, and KVMS, so that the port is closed Serviceability Data collection utility to diagnose system problems TABLE: Oracle ILOM 3.0 New Features (Continued) (Continued) Category FeatureOracle ILOM Overview 7 Preconfigured User Accounts Oracle ILOM 3.0 provides the following two preconfigured accounts: ¦ “root User Account” on page 7 ¦ “default User Account” on page 8 root User Account The root user account is persistent and is available on all interfaces (web interface, CLI, SSH, serial console, and IPMI) unless you choose to delete the root account. The root account provides built-in administrative privileges (read and write) for all Oracle ILOM features, functions, and commands. To log in to Oracle ILOM, use the following root account user name and password: User name: root Password: changeme To prevent unauthorized access to your system, you should change the root password (changeme) on each service processor (SP) or chassis monitoring module (CMM) installed in your system. Alternatively, you can delete the root account to secure access to your system. However, before you delete the root account, you must set up a new user account or configure a directory service so that you will be able to log in to Oracle ILOM. root Factory Default Password Warning Message As of Oracle ILOM 3.0.6, when the root password in Oracle ILOM is set to the factory default, a warning appears on the Oracle ILOM CLI and web interface. For example: ¦ In the Oracle ILOM web interface, a warning link appears in the page header. Placing your pointer over the link displays the warning message or clicking the warning link displays the warning message in a dialog box.8 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ In the Oracle ILOM CLI, the following factory default warning message appears after logging in to Oracle ILOM. default User Account The default user account is used for password recovery. The default user account is available through the serial console only and you must prove physical presence at the server to use the default user account. The default user account cannot be changed or deleted. If you delete the root account before you have configured another user account to log in to Oracle ILOM, you can use the default account as an alternative way to log in and re-create the root account. To re-create the root user account, use the normal Oracle ILOM user commands to create a new account. For information about how to create a user account, see the section about Add User Account in the Oracle ILOM 3.0 Quick Start Guide. For password recovery, use the following user name and password to log in using the default account: User name: default Password: defaultpassword Password: Waiting for daemons to initialize... Daemons ready Oracle (TM) Integrated Lights Out Manager Version 3.0.0.0 r46636 Copyright 2009 Sun Microsystems, Inc. All Rights reserved. Use is subject to license terms.Oracle ILOM Overview 9 Oracle ILOM Supported Interfaces To access all of Oracle ILOM’s features and functions, you can choose to use a browser-based web interface, a command-line interface, or industry-standard protocols. ¦ Web interface – The web interface enables you to access the Oracle ILOM SP or CMM through a web browser. From the Oracle ILOM’s web interface, you can perform daily system management operations remotely. Additionally, from the web interface, you can launch tools to redirect KVMS, or to perform maintenance and diagnostic operations. ¦ Command-line interface (CLI) – Using an SSH client, you can access the Oracle ILOM CLI on the server SP or CMM. This command-line interface enables you to perform server management operations remotely using industry-standard DMTF-style keyboard commands and scripting protocols. ¦ Intelligent Platform Management Interface (IPMI) – IPMI is an open, industry-standard interface that was designed for the management of server systems over a number of different types of networks. IPMI functionality includes field-replaceable unit (FRU) inventory reporting, system monitoring, logging of system events, system recovery (including system resets and power-on and power-off capabilities), and alerting. For more information about using IPMI to monitor or manage your Oracle Sun server, see the Oracle IILOM 3.0 Protocol Management Reference Guide. ¦ WS-Management/CIM – As of version 3.0.8, Oracle ILOM supports the use of the Distributed Management Task Force (DMTF) Web Services for Management (WS-Management) protocol and Common Information Model (CIM). The support for these DMTF standards in Oracle ILOM enables developers to build and deploy network management applications to monitor and manage information about Oracle’s Sun system hardware. For more information about WS-Management/CIM, refer to the Oracle ILOM 3.0 Protocol Management Reference Guide. ¦ Simple Network Management Protocol (SNMP) interface – Oracle ILOM also provides an SNMP v3.0 interface for third-party applications such as HP OpenView and IBM Tivoli. Some of the MIBs supported by Oracle ILOM 3.0 include: ¦ SUN-PLATFORM-MIB ¦ SUN-ILOM-CONTROL-MIB ¦ SUN-HW-TRAP-MIB ¦ SUN-ILOM-PET-MIB ¦ SNMP-FRAMEWORK-MIB (9RFC2271.txt)10 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ SNMP-MPD-MIB (RFC2572) ¦ System and SNMP groups from SNMPv2-MIB (RFC1907) ¦ entPhysicalTable from ENTITY-MIB (RFC2737) For a complete list of SNMP MIBs supported and used by Oracle ILOM, refer to the Oracle ILOM 3.0 Protocol Management Reference Guide. For more information about Oracle ILOM interfaces, refer to the Overview sections in the Oracle ILOM 3.0 CLI Procedures Guide and Oracle ILOM 3.0 Web Procedures Guide. Oracle ILOM on the Server SP and CMM Oracle ILOM supports the following two ways of managing a system: ¦ Using the service processor (SP) directly – Communicating directly with the rackmounted server SP or server module SP enables you to manage and monitor an individual server. ¦ Using the chassis monitoring module – Communicating directly with the CMM enables you to manage individual chassis components and an aggregate of components at the chassis level. For more information about managing ILOM on the server SP and CMM using Oracle ILOM interfaces, refer to: ¦ Oracle ILOM 3.0 CLI Procedures Guide, CLI Overview ¦ Oracle ILOM 3.0 Web Procedures Guide, Web Interface Overview System Banner Messages As of Oracle ILOM 3.0.8, system administrators can create banner messages and display them on the Login page. Creating and displaying banner messages in Oracle ILOM is optional. However, system administrators can use this capability whenever there is a need to share information about system updates, system policies, or other important announcements. Examples of where (Login page or after login) the banner message appear in Oracle ILOM after they have been created are shown in FIGURE: Login Page – Connect Banner Example – Web Interface on page 11, FIGURE: After Logging In - Banner Message Example - Web Interface on page 12, and FIGURE: Banner Message Example - CLI on page 12.Oracle ILOM Overview 11 For instructions about how to create the banner messages in Oracle ILOM, refer to the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide FIGURE: Login Page – Connect Banner Example – Web Interface12 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: After Logging In - Banner Message Example - Web Interface FIGURE: Banner Message Example - CLI13 Network Configurations Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configuring communication settings ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configuring communication settings ¦ Oracle ILOM 3.0 Protocol Management Reference, configuring communication settings Description Links Learn about Oracle ILOM network management and connection methods. • “Oracle ILOM Network Management” on page 14 Learn about Oracle ILOM network communication settings and network port assignments. • “Oracle ILOM Communication Settings” on page 19 • “Default Network Port Used By Oracle ILOM” on page 16 • “Switch Serial Port Console Output (Serial Port Owner)” on page 18 • “SP Management Port – Recommended Practice for Spanning Tree Parameters” on page 19 Learn about configuring Oracle ILOM in an IPv4 network environment. • “Network Configurations for IPv4” on page 20 Learn about configuring Oracle ILOM in a dual-stack IPv4/IPv6 network environment. • “Dual-Stack Network Configurations for IPv4 and IPv6 (ILOM 3.0.12)” on page 20 Learn about configuring the Local Interconnect Interface. • “Local Interconnect Interface: Local Connection to ILOM From Host OS” on page 2514 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Oracle ILOM Network Management You can establish communication with Oracle ILOM through a console connection to the serial management port on the server or chassis monitoring module (CMM), or through an Ethernet connection to the network management port on the server or CMM. A dedicated network management port will help you manage your server platform optimally with Oracle ILOM. Using the network management port, traffic destined for Oracle ILOM is kept separate from any data transfers made by the host operating system. Refer to your platform documentation to determine how to connect to your network management port. You can use Dynamic DNS to automatically assign a host name and IP address on new Oracle ILOM installations based on the system’s serial number. See “Example Setup of Dynamic DNS” on page 119 for an overview of Dynamic DNS and configuration instructions. This topic contains the following information: ¦ “Oracle ILOM Connection Methods” on page 14 ¦ “Initial Setup Worksheet” on page 16 ¦ “Default Network Port Used By Oracle ILOM” on page 16 ¦ “Switch Serial Port Console Output (Serial Port Owner)” on page 18 Oracle ILOM Connection Methods The way in which you connect to Oracle ILOM depends on your server platform. Refer to your platform documentation for details.Network Configurations 15 The following table lists the different methods you can use to connect to Oracle ILOM. Note – Oracle ILOM supports a maximum of 10 active user sessions, including serial, Secure Shell (SSH), and web interface sessions per service processor (SP). Some SPARC systems support a maximum of only 5 active user sessions per SP. TABLE: Oracle ILOM Connection Methods Connection Method RackMounted Blade Supported Interface Description Ethernet network management connection Yes Yes CLI and web interface Connect to the Ethernet network management port. You must know Oracle ILOM’s host name or IP address. Serial connection Yes Yes CLI only Connect directly to the serial management port. Local Interconnect Interface (as of Oracle ILOM 3.0.12) Verify support for this feature in your platform Oracle ILOM Supplement Guide or Administration Guide. Enables you to connect to Oracle ILOM directly from the host operating system without the need of a physical network connection to the server SP. This feature is not supported on all Sun servers. For more information, see “Local Interconnect Interface: Local Connection to ILOM From Host OS” on page 25.16 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Initial Setup Worksheet The following table describes the information that you need to establish initial communication with Oracle ILOM Default Network Port Used By Oracle ILOM The following table identifies the default network ports used by Oracle ILOM. Most of these network ports are configurable. TABLE: Initial Setup Worksheet to Establish Communication With Oracle ILOM Information for Setup Requirement Description Management Connection– Serial Mandatory - if network environment does not support IPv4 DHCP or IPv6 stateless Oracle ILOM, by default, learns the IPv4 network address using DHCP and the IPv6 network address using IPv6 stateless. If your network environment does not support IPv4 DHCP or IPv6 stateless, you must establish a local serial console connection to Oracle ILOM via the serial management port on the server or Chassis Monitoring Module (CMM). If your network environment supports IPv4 DHCP or IPv6 stateless, see the setup information for Management Connection - Ethernet (below). For more information about how to attach a serial console to a server or CMM, refer to your platform documentation. Management Connection– Ethernet Optional You can access Oracle ILOM remotely when using the IP address, host name, or local link address assigned to the server SP. This method requires a connection from your local area network to the Ethernet network management port (NET MGT) on the server or CMM. To establish a physical network connection to your server, refer to the installation documentation provided for your server or CMM. SP Host Name Assignment Optional You can assign a meaningful host name to a server SP. For more information, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide or the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. System Identifier Assignment Optional You can assign a system identifier (meaningful name) to a Sun server. For more information, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide or the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Dynamic DNS Configuration Optional You can configure Dynamic DNS to support the use of host names to access server SPs. For example information about setting up Dynamic DNS, see “Example Setup of Dynamic DNS” on page 119. For Dynamic DNS configuration procedures, see Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.Network Configurations 17 Note – TABLE: Oracle ILOM Network Ports on page 17 identifies default network ports as of Oracle ILOM 3.0.6. Some network ports might not be available if you are not using Oracle ILOM 3.0.6 or a later version of Oracle ILOM. TABLE: Oracle ILOM Network Ports Port Protocol Application Common Network Ports 22 SSH over TCP SSH - Secure Shell 69 TFTP over UDP TFTP - Trivial File Transfer Protocol (outgoing) 80 HTTP over TCP Web (user-configurable) 123 NTP over UDP NTP - Network Time Protocol (outgoing) 161 SNMP over UDP SNMP - Simple Network Management Protocol (user-configurable) 162 IPMI over UDP IPMI - Platform Event Trap (PET) (outgoing) 389 LDAP over UDP/TCP LDAP - Lightweight Directory Access Protocol (outgoing; user-configurable) 443 HTTPS over TCP Web (user-configurable)) 514 Syslog over UDP Syslog - (outgoing) 623 IPMI over UDP IPMI - Intelligent Platform Management Interface 546 DHCP over UDP DHCP - Dynamic Host Configuration Protocol (client) 1812 RADIUS over UDP RADIUS - Remote Authentication Dial In User Service (outgoing; user-configurable) SP Network Ports 5120 TCP Oracle ILOM Remote Console: CD 5121 TCP Oracle ILOM Remote Console: Keyboard and Mouse 5123 TCP Oracle ILOM Remote Console: Diskette 5555 TCP Oracle ILOM Remote Console: Encryption 5556 TCP Oracle ILOM Remote Console: Authentication 6481 TCP Oracle ILOM Remote Console: Servicetag Daemon 7578 TCP Oracle ILOM Remote Console: Video18 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Switch Serial Port Console Output (Serial Port Owner) Oracle ILOM, by default, displays the serial port output from the server to the server SP console (SER MGT port). On some Sun servers, however, you can choose to switch the owner of the serial port output between the server SP and the Host console (COMM1 port). Note – Switching the serial port output owner to the Host console is helpful during windows debugging situations, as this output configuration enables you to view non-ASCII character traffic from the Host console. For more information and procedures for switching the serial port output, see the Oracle ILOM 3.0 CLI Procedures, Switch Serial Port Output. 7579 TCP Oracle ILOM Remote Console: Serial CMM Network Ports 8000 - 8023 HTTP over TCP Oracle ILOM drill-down to server modules (blades) 8400 - 8423 HTTPS over TCP Oracle ILOM drill-down to server modules (blades) 8200 - 8219 HTTP over TCP Oracle ILOM drill-own to NEMs 8600 - 8619 HTTPS over TCP Oracle ILOM drill-down to NEMs TABLE: Oracle ILOM Network Ports (Continued) (Continued) Port Protocol ApplicationNetwork Configurations 19 Oracle ILOM Communication Settings You can use the Oracle ILOM CLI interface, web interface, or SNMP to manage Oracle ILOM’s communication settings, including network, serial port, web, and Secure Shell (SSH) configurations. Oracle ILOM lets you view and configure system host names, IP addresses, DNS settings, and serial port settings. You also can enable or disable HTTP or HTTPS web access, and enable or disable SSH. For more information and procedures for managing Oracle ILOM communication settings, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide SP Management Port – Recommended Practice for Spanning Tree Parameters Since the SP network management port is not designed to behave like a switch port, the SP network management port does not support switch port features like spanning-tree portfast. When configuring spanning tree parameters, consider these recommendations: ¦ The port used to connect the SP network management port to the adjacent network switch should always treat the SP network management port as a host port. ¦ The spanning tree option on the port connecting to the adjacent network switch should either be disabled entirely or at a minimum configured with the following parameters: Spanning Tree Parameter Recommended Setting portfast Enable this interface to immediately move to a forwarding state. bpdufilter Do not send or receive BPDUs on this interface. bpduguard Do not accept BPDUs on this interface. cdp Do not enable the discovery protocol on this interface.20 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Network Configurations for IPv4 Oracle ILOM, by default, uses IPv4 DHCP to learn the IPv4 address for the server SP. If DHCP is not supported in your network environment or if you prefer to set up a static IPv4 address, you can configure the IPv4 network settings in Oracle ILOM from the CLI or web interface. For instructions on how to configure the network settings in Oracle ILOM for IPv4, refer to one of the following Oracle ILOM procedure guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (820-6411), Chapter 4. ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (820-6412), Chapter 4. Dual-Stack Network Configurations for IPv4 and IPv6 (ILOM 3.0.12) Oracle ILOM, by default, uses IPv6 stateless to learn the IPv6 address for the server SP. If IPv6 stateless is not supported in your network environment or if you prefer to use another IPv6 network setting to communicate with Oracle ILOM, you can modify the IPv6 network settings using the Oracle ILOM CLI or web interface. Note – As of Oracle ILOM 3.0.12, dual-stack IPv4 and IPv6 network settings are supported on some servers. Verify support of the IPv6 settings in your platform Oracle ILOM Supplement Guide or Administration Guide.Network Configurations 21 This topic includes the following information: ¦ “Oracle ILOM IPv6 Enhancements” on page 21 ¦ “Legacy Sun Server Platforms Not Supporting IPv6” on page 24 Oracle ILOM IPv6 Enhancements Oracle ILOM enhancements for IPv6 include: ¦ Support for a larger 128-bit IPv6 addressing space. ¦ Acceptance of IPv6 addresses in designated text entry fields and URLs throughout Oracle ILOM. Note – IPv6 addresses are written with hexadecimal digits and colon separators like 2001:0db0:000:82a1:0000:0000:1234:abcd, as opposed to the dot-decimal notation of the 32-bit IPv4 addresses. IPv6 addresses are composed of two parts: a 64-bit subnet prefix, and a 64-bit host interface ID. To shorten the IPv6 address, you can: (1) omit all leading zeros and (2) replace one consecutive group of zeros with a double colon (::). For example: 2001:db0:0:82a1::1234:abcd ¦ Ability for Oracle ILOM to operate fully in a dual-stack IPv4 and IPv6 environment. Within a dual-stack network environment, Oracle ILOM is capable of responding to both IPv4 and IPv6 addresses that are concurrently configured for a device (server SP or CMM). ¦ Support for IPv6 protocols. As of Oracle ILOM 3.0.12, IPv6 protocol support includes: SSH, HTTP, HTTPS, Ping6, SNMP, JRC, NTP, KVMS, and all file transfer protocols (tftp, scp, ftp, and so on). Full support for all remaining IPv6 protocols is available as of Oracle ILOM 3.0.14.22 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Support for the following IPv6 auto-configuration options are available for a device (server SP or CMM): Note – As of Oracle ILOM 3.0.14, you can enable more than one IPv6 auto-configuration option to run at the same time with the exception of enabling these two auto-configuration options: to run at the same time: DHCPv6 Stateless and DHCPv6 Stateful. ¦ Ability to obtain routable IPv6 addresses from any of the following IPv6 network configurations: ¦ Stateless auto-configuration (requires a network router configured for IPv6) ¦ DHCPv6 Stateful auto-configuration ¦ Manual configuration of single static IPv6 address. ¦ Support for reporting a Link-Local IPv6 address and up to 10 auto-configured IPv6 addresses per device. TABLE: IPv6 Address Auto-Configuration Options in Oracle ILOM IPv6 Address Auto-Configurations Description Supported in Oracle ILOM Release: Stateless (enabled by default) When enabled, the IPv6 Stateless auto-configuration is run to learn the IPv6 address(es) for the device. Note - If you are running Oracle ILOM 3.0.12, this option appears as stateless_only in the CLI. If you are running Oracle ILOM 3.0.14 or later, this option appears as stateless in the CLI. 3.0.12 DHCPv6 Stateless When enabled, the DHCPv6 Stateless auto-configuration is run to learn the DNS and domain information for the device. 3.0.14 DHCPv6 Stateful When enabled, the DHCPv6 Stateful auto-configuration is run to learn the IPv6 address(es) and DNS information for the device. 3.0.14 Disabled When enabled, the Disabled state will only set the Link Local address in Oracle ILOM. Oracle ILOM will not run any of the IPv6 auto-configuration options to configure an IPv6 address. 3.0.12Network Configurations 23 Note – The Link-Local IPv6 address is always shown in Oracle ILOM under the /network/IPv6 target or on the Network Settings page. This address is a non-routable address that you can use to connect to the Oracle ILOM SP (or the CMM) from another IPv6 enabled node on the same network. ¦ Availability of a network configuration testing tool for IPv6 (Ping6). Dual-Stack Network Options in Oracle ILOM CLI and Web Interface The settings for configuring Oracle ILOM in a dual-stack IPv4 and IPv6 network environment are accessible for the server SP (web and CLI) or CMM (CLI only). See the following figure for an example of the dual-stack IPv4 and IPv6 web interface properties available for a server SP.24 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Note – The dual-stack IPv4 and IPv6 properties for the CMM ar only accessible from the CLI. However, you can access the dual-stack IPv4 and IPv6 properties from CMM web interface for the individual server SPs. For a brief description of the IPv6 configuration options, see TABLE: IPv6 Address Auto-Configuration Options in Oracle ILOM on page 22. For instructions on how to configure the dual-stack network settings in Oracle ILOM for IPv4 and IPv6, refer to one of the following Oracle ILOM procedure guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (820-6411), Chapter 4. ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (820-6412), Chapter 4. Legacy Sun Server Platforms Not Supporting IPv6 The following table identifies the legacy Sun server platforms that will not support IPv6 network configurations in Oracle ILOM. Sun Platform Server Model SPARC Enterprise • T5440 • T5220 • T5120 • T5140 • T5240 • T6340 x86 Sun Fire • X4140 • X4150 • X4240 • X4440 • X4450 • X4600 • X4600 M2 • X4640Network Configurations 25 Local Interconnect Interface: Local Connection to ILOM From Host OS As of Oracle ILOM 3.0.12, a communication channel known as the Local Interconnect Interface was added to Oracle ILOM to enable you to locally communicate with Oracle ILOM from the host operating system (OS) without the use of a network management (NET MGT) connection to the server. The local interconnect feature to Oracle ILOM is particularly useful when you want to locally perform these Oracle ILOM tasks from the host operating system: ¦ Server management functions in Oracle ILOM that you would have typically performed from the Oracle ILOM CLI, web interface, or IPMI interface through the network management (NET MGT) connection on the server. ¦ Data transfers, such as firmware upgrades, to Oracle ILOM that you would have typically performed from the host over a Keyboard Controller Style (KCS) interface using IPMI flash tools. In particular, the Local Interconnect Interface to Oracle ILOM can provide a more reliable and faster data transfer rate than traditional KCS interfaces. ¦ To enable future server monitoring and fault detection tools from Oracle. This topic includes the following information: ¦ “Platform Server Support and Oracle ILOM Access Through the Local Interconnect Interface” on page 25 ¦ “Local Interconnect Interface Configuration Options” on page 26 ¦ “Local Host Interconnect Configuration Settings in Oracle ILOM” on page 27 Platform Server Support and Oracle ILOM Access Through the Local Interconnect Interface Oracle servers supporting the Local Interconnect Interface between Oracle ILOM and the host operating system are shipped from the factory with an internal USB Ethernet device installed.26 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 The internal USB Ethernet device provides two network connection points that are known as the Oracle ILOM SP connection point and the host OS connection point. In order to establish a local connection to Oracle ILOM from the host operating system, each connection point (ILOM SP and host OS) must be either automatically or manually assigned a unique non-routable IPv4 address on the same subnet. Note – By default, Oracle provides non-routable IPv4 addresses for each connection point (ILOM SP and host OS). Oracle recommends not changing these addresses unless a conflict exists in your network environment with the provided non-routable IPv4 addresses. Note – Non-routable IPv4 addresses are considered secured private addresses that prevent external Internet users from navigating to your system. To verify whether your server supports the Local Interconnect Interface feature in Oracle ILOM, refer to the Oracle ILOM Supplement guide or Administration guide that is provided with your server. Local Interconnect Interface Configuration Options In Oracle ILOM you can choose to either have the Local Interconnect Interface automatically configured for you or manually configured. Details about both of these configuration options are provided below. ¦ Automatic Configuration (Recommended) Oracle automates the configuration of the Local Interconnect Interface feature when you install the Oracle Hardware Management Pack 2.1.0 or later software. No configuration is necessary from Oracle ILOM in this case.Network Configurations 27 For more details about using the Oracle Hardware Management Pack 2.1.0 software to auto-configure the Local Interconnect Interface between the Oracle ILOM SP and the local host OS, see the Oracle Server Hardware Management Pack User’s Guide (821-1609). Note – If you choose to auto-configure the Local Interconnect Interface using the Oracle Hardware Management Pack software, you should accept the factory defaults provided in Oracle ILOM for Local Host Interconnect. ¦ Manually Configured (Advanced Users Only) If you are an advanced network administrator and prefer not to auto-configure the Local Interconnect Interface by installing the Oracle Hardware Management Pack 2.1.0 or later software, you can manually configure the connection points on the Oracle ILOM SP and host operating system. In order to manually configure the Local Interconnect Interface connection points, you must: 1. On the host operating side, ensure that an Ethernet driver for your host OS was provided by the OS distribution and installed on the server. After you have confirmed that the appropriate Ethernet driver was installed on your server and your operating system recognizes the internal USB Ethernet device, you must manually configure an IPv4 address for the host OS connection point. For more details, see the Manual Host Configuration Guidelines in the Oracle ILOM 3.0 CLI or Web Procedure guides. 2. On the Oracle ILOM SP side, you must manually configure the Local Host Interconnect settings in Oracle ILOM. For more details about these settings, see “Local Host Interconnect Configuration Settings in Oracle ILOM” on page 27. For procedural information describing how to configure the Local Interconnect Interface, see Chapter 3 of the Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide or the Integrated Lights Out Manager (ILOM) Web Interface Procedures Guide. Local Host Interconnect Configuration Settings in Oracle ILOM The Local Host Interconnect configuration settings in the Oracle ILOM web interface (or CLI) enable users with admin (a) role privileges to control the Local Interconnect Interface between the host OS and the Oracle ILOM SP.28 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011Network Configurations 29 For a description of the Local Host Interconnect settings provided in Oracle ILOM, see the following table. TABLE: Local Host Interconnect Configuration Settings Settings Description -Host Managed The -Host Managed setting, by default, is set to -True. When the -Host Managed setting is set to -True (enabled), Oracle ILOM permits the Oracle Hardware Management Pack configuration utility (known as ilomconfig) to auto-configure the connection points for the Oracle ILOM SP and the host OS on the Local Interconnect Interface. To prevent the Oracle Hardware Management Pack software from auto-configuring the connection points on the Local Interconnect Interface, the setting for Host Managed must be set to False (disabled). -State The State setting, by default, is disabled. When the setting for State is disabled, the Local Interconnect Interface feature between the Oracle ILOM SP and the host OS is disabled. When the setting for State is enabled, the Local Interconnect Interface feature between the Oracle ILOM SP and host OS is enabled. -IP Address Oracle ILOM, by default, provides a static non-routable IPv4 address (169.254.182.76) for the Oracle ILOM SP connection point on the Local Interconnect Interface. The IP address property is, by default, a read-only setting when the -Host Managed setting is set to -True. When the -Host Managed setting is disabled (or property value is set to -False), Oracle ILOM will allow you to modify the property value for the IPv4 address. Note - The default non-routable IPv4 address (169.254.182.76) should not be changed unless a conflict exists in your network environment with the default IPv4 address. When this address is left unchanged, this is the IP address you would use to locally connect to Oracle ILOM from the host operating system. -Netmask Oracle ILOM, by default, provides a static -Netmask address (255.255.255.0) for the Oracle ILOM SP connection point on the Local Interconnect Interface. The -Netmask property is, by default, a read-only setting when the -Host Managed setting is set to -True. When the -Host Managed setting is disabled (or property value is set to -False), Oracle ILOM will allow you to modify the property value for the -Netmask address. The default -Netmask address (255.255.255.0) should not be changed unless a conflict exists in your network environment with the default -Netmask address.30 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 -Service Processor MAC Address The -Service Processor MAC Address is a read-only setting. This setting displays the MAC address assigned to the Oracle ILOM SP. Host MAC Address The Host MAC Address is a read-only setting. This setting displays the MAC address assigned to the server and it represents how the host server sees the internal USB Ethernet device. Note - The internal USB Ethernet device is presented in the system as a traditional “Ethernet” interface. If you decide to manually configure the Local Interconnect Interface between the Oracle ILOM SP and the host OS, it might be necessary to use the host MAC address to determine which interface you will need to configure from the host OS side (like Solaris). For additional information about manually configuring the Local Interconnect Interface on the host OS connection point, see the Manual Host OS Configuration Guidelines for Local Interconnect Interface in the Oracle ILOM 3.0 CLI or Web Procedures guide. -Connection Type The -Connection Type is a read-only setting. This setting indicates a USB Ethernet connection. TABLE: Local Host Interconnect Configuration Settings (Continued) (Continued) Settings Description31 User Account Management Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, manage user accounts using SNMP ¦ Oracle ILOM 3.0 Protocol Management Reference, SNMP commands Description Links Learn about managing user accounts and roles • “Guidelines for Managing User Accounts” on page 32 • “User Account Roles and Privileges” on page 32 Learn about establishing user credentials with Single Sign On • “Single Sign On” on page 33 Learn about password automation using SSH authentication. • “SSH User Key-Based Authentication” on page 34 Learn about using Active Directory to authenticate user accounts • “Active Directory” on page 34 Learn about user authentication using LDAP. • “Lightweight Directory Access Protocol” on page 36 • “LDAP/SSL” on page 36 Learn about remote user authentication using RADIUS. • “RADIUS” on page 3732 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Guidelines for Managing User Accounts Apply the following general guidelines when you manage user accounts: ¦ Oracle ILOM supports a maximum of 10 active user sessions per service processor (SP). Some SPARC systems support a maximum of only 5 active user sessions per SP. ¦ The user name of an account must be at least four characters and no more than 16 characters. User names are case sensitive and must start with an alphabetical character. You can use alphabetical characters, numerals, hyphens, and underscores. Do not include spaces in user names. ¦ Each user account is assigned one or more advanced roles, which determine the privileges of the user account. Depending on the roles assigned to your user account, you can use the Oracle ILOM web interface, command-line interface (CLI), or SNMP to view account information and perform various administrative functions. ¦ You can either configure local accounts or you can have Oracle ILOM authenticate accounts against a remote user database, such as Active Directory, LDAP, LDAP/SSL, or RADIUS. With remote authentication, you can use a centralized user database rather than configuring local accounts on each Oracle ILOM instance. For more information and procedures for managing user accounts, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide User Account Roles and Privileges For Oracle ILOM 3.0, user roles are implemented to control user privileges. However, for backward compatibility, Oracle ILOM 2.x style user accounts (which have either Administrator or Operator privileges) are still supported.User Account Management 33 Oracle ILOM 3.0 User Account Roles Oracle ILOM 3.0 user accounts have defined roles that determine Oracle ILOM user access and rights. You can manage user accounts using the Oracle ILOM web interface or the CLI. The roles assigned to Oracle ILOM accounts are listed in TABLE: Oracle ILOM 3.0 User Account Roles on page 33. Single Sign On Single Sign On (SSO) is a convenient authentication service that enables you to log in to Oracle ILOM once to establish your credentials, thus reducing the number of times you need to enter your password to gain access to Oracle ILOM. Single Sign On is enabled by default. As with any authentication service, authentication credentials are passed over the network. If this is not desirable, consider disabling the SSO authentication service. TABLE: Oracle ILOM 3.0 User Account Roles Roles Definition Privileges a Admin A user who is assigned the Admin (a) role is authorized to view and change the state of Oracle ILOM configuration variables. With the exception of tasks that require Admin users to have User Management, Reset and Host Control and Console roles enabled. u User Management A user who is assigned the User Management (u) role is authorized to create and delete user accounts, change user passwords, change roles assigned to other users, and enable/disable the physical-access requirement for the default user account. This role also includes authorization to set up LDAP, LDAP/SSL, RADIUS, and Active Directory. c Console A user who is assigned the Console (c) role is authorized to access the Oracle ILOM Remote Console and the SP console and to view and change the state of the Oracle ILOM console configuration variables. r Reset and Host Control A user who is assigned the Reset and Host Control (r) role is authorized to operate the system, which includes power control, reset, hot-plug, enabling and disabling components, and fault management. This role maps very closely to the Oracle ILOM 2.0 user with Operator privileges. o Read Only A user who is assigned the Read Only (o) role is authorized to view the state of the Oracle ILOM configuration variables but cannot make any changes. Users assigned this role can also change the password and the Session Time-Out setting for their own user account. s Service A user who is assigned the Service (s) role can assist Sun service engineers in the event that on-site service is required.34 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 SSH User Key-Based Authentication Traditionally, automation of password authentication is made possible by SSH key-based authentication. Prior to the implementation of the SSH key-based authentication feature, users who logged in to the Oracle ILOM SP using SSH were required to supply a password interactively. An automatic mechanism for password authentication is most beneficial when you have multiple systems that require a similar update. The primary capabilities afforded by SSH key-based authentication are as follows: ¦ Users are able to write scripts that automatically copy log files off of a service processor (SP) for archival and analysis. ¦ Users are able to write scripts that automatically and/or regularly execute SP commands over a network-based SSH connection from a remote system. Thus, SSH key-based authentication enables you to accomplish both of the above activities through the use of scripts that execute without manual intervention and that do not include embedded passwords. Regarding the use and handling of SSH keys, Oracle ILOM enables users to add generated keys to individual user accounts on the SP. For more information and procedures for adding and deleting SSH keys, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Active Directory Oracle ILOM supports Active Directory, the distributed directory service included with Microsoft Windows Server operating systems. Like an LDAP directory service implementation, Active Directory is used to authenticate user credentials. Note – The service processor (SP) expects to communicate with the Active Directory server using a secure channel. To ensure security, the Active Directory server should be loaded with a certificate that can be presented during the SP user authentication process so that protocol negotiations can allow a private channel to be set up.User Account Management 35 User Authentication and Authorization Active Directory provides both authentication of user credentials and authorization of user access levels to networked resources. Active Directory uses authentication to verify the identity of a user before that user can access system resources. Active Directory uses authorization to grant specific access privileges to a user in order to control a user’s rights to access networked resources. User access levels are configured or learned from the server based on the user’s group membership in a network domain, which is a group of hosts identified by a specific Internet name. A user can belong to more than one group. Active Directory authenticates users in the order in which the user’s domains were configured. User Authorization Levels Once authenticated, the user’s authorization level can be determined in the following ways: ¦ In the simplest case, the user authorization of either Operator, Administrator, or Advanced Roles (see “User Account Roles and Privileges” on page 32) is learned directly through the Active Directory’s configuration of the SP. Access and authorization levels are dictated by the defaultrole property. Setting up users in the Active Directory database requires only a password with no regard to group membership. On the SP, the defaultrole will be set to either Administrator, Operator, or the Advanced Role settings a/u/c/r/o/s. All users authenticated through Active Directory are assigned the privileges associated with the Administrator, Operator, or Advanced Roles based solely on this configuration. ¦ A more integrated approach is also available by querying the server. For configuration, the SP Administrator Group Tables, Operator Group Tables, or Custom Group Tables must be configured with the corresponding group names from the Active Directory server that will be used to determine access levels. Up to five Active Directory groups can be entered to designate an Administrator; another five can be used to assign Operator privileges; and up to five groups can be assigned to Custom Groups, which contain Advanced Roles (see “User Account Roles and Privileges” on page 32). Group membership of the user is used to identify the proper access level of either Administrator, Operator, or Advanced Roles by looking up each group name in the configured Active Directory tables on the SP. If the user’s group list is not in either of the defined SP user groups, then access is denied. A user assigned to more than one group will receive the sum of all privileges. For more information and procedures for configuring Active Directory settings, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide36 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide Lightweight Directory Access Protocol Oracle ILOM supports Lightweight Directory Access Protocol (LDAP) authentication for users, based on the OpenLDAP software. LDAP is a general-purpose directory service. A directory service is a centralized database for distributed applications designed to manage the entries in a directory. Thus, multiple applications can share a single user database. For more detailed information about LDAP, go to: (http://www.openldap.org/) For more information and procedures for configuring LDAP settings, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide LDAP/SSL LDAP/SSL offers enhanced security to LDAP users by way of Secure Socket Layer (SSL) technology. To configure LDAP/SSL in a SP, you need to enter basic data—such as primary server, port number, and certificate mode—and optional data such as alternate server or event or severity levels. You can enter this data using the LDAP/SSL configuration page of the Oracle ILOM web interface, the CLI, or SNMP. For more information and procedures for configuring LDAP/SSL settings, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference GuideUser Account Management 37 RADIUS Oracle ILOM supports Remote Authentication Dial-In User Service (RADIUS) authentication. RADIUS is an authentication protocol that facilitates centralized user administration. RADIUS provides many servers shared access to user data in a central database, providing better security and easier administration. A RADIUS server can work in conjunction with multiple RADIUS servers and other types of authentication servers. RADIUS is based on a client-server model. The RADIUS server provides the user authentication data and can grant or deny access, and the clients send user data to the server and receive an “accept” or “deny” response. In the RADIUS client-server model, the client sends an Access-Request query to the RADIUS server. When the server receives an Access-Request message from a client, it searches the database for that user's authentication information. If the user's information is not found, the server sends an Access-Reject message and the user is denied access to the requested service. If the user's information is found, the server responds with an Access-Accept message. The Access-Accept message confirms the user's authentication data and grants the user access to the requested service. All transactions between the RADIUS client and server are authenticated by the use of a specific text string password known as a shared secret. The client and server must each know the shared secret because it is never passed over the network. You must know the shared secret to configure RADIUS authentication for Oracle ILOM. In order to use RADIUS authentication with Oracle ILOM, you must configure Oracle ILOM as a RADIUS client. For more information and procedures for configuring RADIUS settings, see one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide38 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 201139 System Monitoring and Alert Management Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage system components ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage system alerts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage system components ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage system alerts ¦ Oracle ILOM 3.0 Protocol Management Reference, manage system components ¦ Oracle ILOM 3.0 Protocol Management Reference, manage system alerts Description Links Learn about system monitoring and management features in Oracle ILOM. • “System Monitoring” on page 40 • “Sensor Readings” on page 41 • “System Indicators” on page 41 • “Component Management” on page 42 • “Fault Management” on page 45 • “Clear Faults After Replacement of Faulted Components on Server or CMM” on page 46 • “Oracle ILOM Event Log” on page 47 • “Syslog Information” on page 48 • “Collect SP Data to Diagnose System Problems” on page 49 Learn about managing system alerts in Oracle ILOM. • “Alert Management” on page 49 • “Alert Management From the CLI” on page 53 • “Alert Management From the Web Interface” on page 54 • “Alert Management From an SNMP Host” on page 5540 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 System Monitoring The system monitoring features in Oracle ILOM enable you to easily determine the health of the system and to detect errors, at a glance, when they occur. For instance, in Oracle ILOM you can: ¦ View instantaneous sensor readings about system component temperatures, current, voltage, speed, and presence. For more information, see “Sensor Readings” on page 41. ¦ Determine the state of indicators throughout the system. For more information, see “System Indicators” on page 41. ¦ Monitor the state of system components. For more information, see “Component Management” on page 42. ¦ Monitor the health of system components, as well as diagnose hardware failures, see “Fault Management” on page 45. ¦ Clear faults after replacement of faulty components, see “Clear Faults After Replacement of Faulted Components on Server or CMM” on page 46. ¦ Identify system errors and view event information in the Oracle ILOM event log. For more information, see “Oracle ILOM Event Log” on page 47. ¦ Combine and view events from multiple instances in Oracle ILOM by sending Syslog information. For more information, see “Syslog Information” on page 48. ¦ Collect data for use by Oracle Services personnel to diagnose system problems. For more information, see “Collect SP Data to Diagnose System Problems” on page 49. This topic contains the following information: ¦ “Sensor Readings” on page 41 ¦ “System Indicators” on page 41 ¦ “Component Management” on page 42 ¦ “Fault Management” on page 45 ¦ “Clear Faults After Replacement of Faulted Components on Server or CMM” on page 46 ¦ “Oracle ILOM Event Log” on page 47 ¦ “Syslog Information” on page 48 ¦ “Collect SP Data to Diagnose System Problems” on page 49System Monitoring and Alert Management 41 Sensor Readings All Oracle Sun server platforms are equipped with a number of sensors that measure voltages, temperatures, fan speeds, and other attributes about the system. Each sensor in Oracle ILOM contains nine properties describing various settings related to a sensor such as sensor type, sensor class, sensor value, as well as the sensor values for upper and lower thresholds. Oracle ILOM regularly polls the sensors in the system and reports any events it encounters about sensor state changes or sensor threshold crossings to the Oracle ILOM event log. Additionally, if an alert rule was enabled in the system that matched the crossing threshold level, Oracle ILOM would automatically generate an alert message to the alert destination that you have defined. You can view sensor readings from the Oracle ILOM web interface or CLI. For details, see “View Sensor Readings” in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide System Indicators System indicator LEDs are generally illuminated on the system by Oracle ILOM based on the server platform policy. Typically the system indicator LEDs are illuminated by Oracle ILOM when any of the following conditions occur: ¦ Fault or error is detected on a component. ¦ Field-replacement unit (FRU) requires service. ¦ Hot-plug module is ready for removal. ¦ Activity is occurring on FRU or system. You can view the states of system indictors from the Oracle ILOM web interface or the CLI. Additionally, in some instances, you might be able to modify the state of a system indicator. For details, see the section about View and Manage System Indicators in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Supported System Indicator States Oracle ILOM supports the following system indicator states: ¦ Off – Normal operating status. Service is not required. ¦ Steady On – Component is ready for removal.42 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Slow Blink – Component is changing state. ¦ Fast Blink – Helps locate a system in a data center. ¦ Standby Blink – Component is ready for activation, but is not operational at this time. Types of System Indicator States Oracle ILOM supports two types of system indicator states: customer changeable and system assigned. ¦ Customer Changeable States – Some system indicator LEDs in Oracle ILOM offer customer changeable states. Typically, these types of system indicators provide operational states of various system components. The type of states presented is determined by the system indicator. For example, depending on the system indicator, the following customer changeable states might be present: ¦ Off – Normal operating status. Service is not required. ¦ Fast Blink – Helps locate system in a data center. ¦ System Assigned States – System assigned indicators are not customer configurable. These types of system indicators provide read-only values about the operational state of a component. On most Oracle Sun server platforms, system assigned indicators are Service Action Required LEDs. These types of LEDs are typically illuminated when any of the following conditions are detected: ¦ Fault or error is detected on a system component. ¦ Hot-plug module is ready for removal. ¦ Field-replacement unit (FRU) requires service. Component Management The Component Management features in Oracle ILOM enable you to monitor the state of various components that are installed on the server or managed by the Chassis Monitoring Module (CMM). For example, by using the Component Management features, you can: ¦ Identify the component name and type. ¦ Identify and change the component state (enabled or disabled). ¦ Identify the component’s fault status and, if necessary, clear the fault. ¦ Prepare to install or remove a component.System Monitoring and Alert Management 43 ¦ Filter the component management display by Fault Status, Component State, Hardware Type, and Ready to Remove Status. Or, create a Custom Filter to filter the component management display by Component or FRU Name, Component or FRU part number, Ready to Remove Status (Ready or Not Ready), and Fault Status (OK or Faulted). Depending on the component type, you can view the component information or you can view and modify the state of component. The Component Management features are supported in both the Oracle ILOM Web Interface and command-line interface (CLI) for x86 systems server SPs, SPARC systems server SPs, and CMMs. For detailed instructions for managing system components from the Oracle ILOM web interface or the CLI, see the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Oracle ILOM web interface examples of the Component Management features for a server SP and CMM are shown in the following figures.44 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Server SP Component Management Features in Web InterfaceSystem Monitoring and Alert Management 45 FIGURE: CMM Component Management Features in Web Interface Fault Management Most Oracle Sun server platforms support the fault management software feature in Oracle ILOM. This feature enables you to proactively monitor the health of your system hardware, as well as diagnose hardware failures as they occur. In addition to monitoring the system hardware, the fault management software monitors environmental conditions and reports when the system's environment is outside acceptable parameters. Various sensors on the system components are continuously monitored. When a problem is detected, the fault management software automatically: ¦ Illuminates the Server Action Required LED on the faulted component. ¦ Updates the Oracle ILOM management interfaces to reflect the fault condition. ¦ Records information about the fault in the Oracle ILOM event log.46 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 The type of system components and environmental conditions monitored by the fault management software are determined by the server platform. For more details about which components are monitored by the fault management software, consult your Sun server platform documentation. Note – The Oracle ILOM fault management feature is currently available on all Sun server platforms, with the exception of the Sun Fire X4100 or X4200 series servers. You can view the status of faulted components from the Oracle ILOM web interface or CLI. For details, see “View Fault Status” in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Clear Faults After Replacement of Faulted Components on Server or CMM The Oracle ILOM-based service processor (SP) receives error telemetry about error events that occur within the major system components on the host (CPU, memory, and I/O hub) and the environmental subsystem within the chassis (such as fans, power supplies, and temperature). The components and conditions are then diagnosed as fault events and captured in the Oracle ILOM event log. As of Oracle ILOM 3.0.3, the steps that are necessary to clear a fault are largely dependent on the type of server platform you are using (server module versus rackmount server). For example: ¦ Oracle ILOM-based faults that occur on a server module are NOT persistent once the server module has been properly prepared for removal and is physically removed from the chassis. Therefore, no service actions are required to clear the fault after the component is physically replaced. The fault message is captured in the Oracle ILOM event log for historical purposes. ¦ Oracle ILOM-based faults that occur on a rackmount server ARE persistent and might require service actions to clear the fault after the component is physically replaced, unless the component is a hot-swappable component (such as a fan or power supply). Hot-swappable components are platform-specific; therefore, refer to the platform documentation for a list of the hot-swappable components. The fault message is captured in the Oracle ILOM event log for historical purposes. On a rackmount server, you must manually clear the following faults after physically replacing the components, which are not hot-swappable: ¦ CPU fault ¦ DIMM (memory module) fault ¦ PCI card faultSystem Monitoring and Alert Management 47 ¦ Motherboard fault (if the motherboard is not being replaced) ¦ Oracle ILOM-based faults that occur on components installed in a chassis containing CMM(s) are automatically cleared by the Oracle ILOM CMM when the faulted component is replaced. However, if the chassis-level component is not hot-serviceable, then the fault needs to be manually cleared from the Oracle ILOM CMM. In particular, the CMM automatically clears faults on the following chassis-level components after the faulted components are replaced: ¦ CMM fault ¦ Fan fault ¦ Power supply fault ¦ Network express module (NEM) fault ¦ PCI express module fault Note – For more information about the Oracle ILOM fault management features offered on your system, refer to the procedures guides in the Oracle ILOM 3.0 Documentation Collection and the documentation provided with your Oracle server platform. For instructions about clearing a fault using the Oracle ILOM CLI or web interface, see the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Oracle ILOM Event Log The Oracle ILOM event log enables you to view information about any event that occurred on the system. Some of these events include Oracle ILOM configuration changes, software events, warnings, alerts, component failure, as well as IPMI, PET, and SNMP events. The type of events recorded in the Oracle ILOM event log is determined by the server platform. For information about which events are recorded in the Oracle ILOM event log, consult your Sun server platform documentation.48 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Event Log Time Stamps and Oracle ILOM Clock Settings Oracle ILOM captures time stamps in the event log based on the host server UTC/GMT timezone. However, if you view the event log from a client system that is located in a different timezone, the time stamps are automatically adjusted to the timezone of the client system. Therefore, a single event in the Oracle ILOM event log might appear with two timestamps. In Oracle ILOM, you can choose to manually configure the Oracle ILOM clock based on the UTC/GMT timezone of the host server, or you can choose to synchronize the Oracle ILOM clock with other systems on your network by configuring the Oracle ILOM clock with an NTP server IP address. Manage Event Log and Time Stamps From CLI, Web, or SNMP Host You can view and manage the event log and time stamps in Oracle ILOM from the CLI, web interface, or an SNMP host. For details, see “Configure Clock Settings” and “Filter Event Log Output” in the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Syslog Information Syslog is a standard logging utility used in many environments. Syslog defines a common set of features for logging events and also a protocol for transmitting events to a remote log host. You can use syslog to combine events from multiple instances of Oracle ILOM within a single place. The log entry contains all the same information that you would see in the local Oracle ILOM event log, including class, type, severity, and description. For information about configuring Oracle ILOM to send syslog to one or two IP addresses, see “Configure Remote Syslog Receiver IP Addresses” in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management GuideSystem Monitoring and Alert Management 49 Collect SP Data to Diagnose System Problems The Oracle ILOM Service Snapshot utility enables you to produce a snapshot of the SP at any instant in time. You can run the utility from the Oracle ILOM CLI or the web interface. For more information about collecting SP data to diagnose system problems, refer the Oracle ILOM 3.0 Maintenance and Diagnostics CLI and Web Guide. Alert Management Oracle ILOM supports alerts in the form of IPMI PET alerts, SNMP Trap alerts, and Email Notification alerts. Alerts provide advance warning of possible system failures. Alert configuration is available from the Oracle ILOM SP on your server. Each Sun server platform is equipped with a number of sensors that measure voltages, temperatures, and other service-related attributes about the system. Oracle ILOM automatically polls these sensors and posts any events crossing a threshold to an Oracle ILOM event log, as well as generates alert message(s) to one or more customer-specified alert destinations. The alert destination specified must support the receipt of the alert message (IPMI PET or SNMP). If the alert destination does not support the receipt of the alert message, the alert recipient will be unable to decode the alert message. Caution – Oracle ILOM tags all events or actions with LocalTime=GMT (or UTC). Browser clients show these events in LocalTime. This can cause apparent discrepancies in the event log. When an event occurs in Oracle ILOM, the event log shows it in UTC, but a client would show it in LocalTime. For more information about Oracle ILOM timestamps and clock settings, see “Event Log Time Stamps and Oracle ILOM Clock Settings” on page 48. Alert Rule Configuration In Oracle ILOM you can configure up to 15 alert rules using the Oracle ILOM web interface or CLI. For each alert rule you configure in Oracle ILOM, you must define three or more properties about the alert depending on the alert type. The alert type defines the messaging format and the method for sending and receiving an alert message. Oracle ILOM supports these three alert types: ¦ IPMI PET alerts ¦ SNMP Trap alerts50 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Email Notification alerts All Sun server platforms support all three alert types. Alert Rule Property Definitions Oracle ILOM offers the following property values for defining an alert rule: ¦ Alert Type ¦ Alert Level ¦ Alert Destination ¦ Alert Destination Port ¦ Email Custom Sender ¦ Email Message Prefix ¦ Email Class Filter ¦ Email Type Filter ¦ SNMP Version (SNMP Trap alerts only) ¦ SNMP Community Name or User Name (SNMP Trap alerts only)System Monitoring and Alert Management 51 For information about each of these property values, see TABLE: Properties for Defining Alert Rules on page 51. TABLE: Properties for Defining Alert Rules Property Name Requirement Description Alert Type Mandatory The alert type property specifies the message format and the delivery method that Oracle ILOM will use when creating and sending the alert message. You can choose to configure one of the following alert types: • IPMI PET Alerts. IPMI Platform Event Trap (PET) alerts are supported on all Sun server platforms and CMMs. For each IPMI PET alert you configure in Oracle ILOM, you must specify an IP address for an alert destination and one of four supported alert levels. Note that the alert destination specified must support the receipt of IPMI PET messages. If the alert destination does not support the receipt of IPMI PET messages, the alert recipient will not be able to decode the alert message. • SNMP Trap Alerts. Oracle ILOM supports the generation of SNMP Trap alerts to a customer-specified IP destination. All destinations specified must support the receipt of SNMP Trap messages. Note that SNMP Trap alerts are supported on rackmounted servers and blade server modules. Filtering options for SNMP traps are not available. • Email Notification Alerts. Oracle ILOM supports the generation of Email Notification alerts to a customer-specified email address. To enable the Oracle ILOM client to generate Email Notification alerts, Oracle ILOM initially requires you to configure the name of the outgoing SMTP email server that would be sending the Email alert messages. Alert Destination Mandatory The alert destination property specifies where to send the alert message. The alert type determines which destination you can choose to send an alert message. For example, IPMI PET and SNMP Trap alerts must specify an IP address destination. Email Notification alerts must specify an email address. If the proper format is not entered for an alert destination, Oracle ILOM will report an error. Alert Destination Port Optional The alert destination port only applies when the alert type is an SNMP Trap. The destination port property specifies the UDP port to which SNMP Trap alerts are sent.52 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Alert Level Mandatory Alert levels act as a filter mechanism to ensure alert recipients only receive the alert messages that they are most interested in receiving. Each time you define an alert rule in Oracle ILOM, you must specify an alert level. The alert level determines which events generate an alert. The lowest level alert generates alerts for that level and for all alert levels above it. Oracle ILOM offers the following alert levels with Minor being the lowest alert offered: • Minor. This alert level generates alerts for informational events, lower and upper non-critical events, upper and lower critical events, and, upper and lower non-recoverable events. • Major. This alert level generates alerts for upper and lower non-critical events, upper and lower critical events, and, upper and lower non-recoverable events. • Critical. This alert level generates alerts for upper and lower critical events and upper and lower non-recoverable events. • Down. This alert level generates alerts for only upper non-recoverable and lower non-recoverable events. • Disabled. Disables the alert. Oracle ILOM will not generate an alert message. All the alert levels will enable the sending of a alert with the exception of Disabled. Important - Oracle ILOM supports alert level filtering for all IPMI traps and Email Notification traps. Oracle ILOM does not support alert level filtering for SNMP traps. To enable the sending of an SNMP trap (but not filter the SNMP trap by alert level) you can choose anyone of the following options: Minor, Major, Critical, or Down. To disable the sending of an SNMP trap, you must choose the Disabled option. Email Custom Sender Optional The email custom sender property applies only when the alert type is an email alert. You can use the email_custom_sender property to override the format of the “from” address. You can use either one of these substitution strings: or ; for example, alert@[]. Once this property is set, this value will override any SMPT custom sender information. Email Message Prefix Optional The email message prefix property applies only when the alert type is an email alert. You can use the email_message_prefix property to prepend information to the message content. Event Class Filter Optional The event class filter property applies only when the alert type is an email alert. The default setting is to send every Oracle ILOM event as an email alert. You can use the event_class_filter property to filter out all information except the selected event class. You can use ““ (empty double quotes) to clear the filter and send information about all classes. TABLE: Properties for Defining Alert Rules (Continued) Property Name Requirement DescriptionSystem Monitoring and Alert Management 53 Alert Management From the CLI You can enable, modify, or disable any alert rule configuration in Oracle ILOM from the command-line interface (CLI). All 15 alert rule configurations defined in Oracle ILOM are disabled by default. To enable alert rule configurations in Oracle ILOM, you must set values for the following properties: alert type, alert level, and alert destination. You can also generate test alerts to any enabled alert rule configuration in Oracle ILOM from the CLI. This test alert feature enables you to verify that the alert recipient(s) specified in an enabled alert rule configuration receives the alert message. For additional information about how to manage alerts using the Oracle ILOM CLI, see “Managing System Alerts” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. Event Type Filter Optional The event type filter property applies only when the alert type is an email alert. You can use the event_type_filter property to filter out all information except the event type. You can use ““ (empty double quotes) to clear the filter and send information about all event types. SNMP Version Optional The SNMP version property enables you to specify which version of an SNMP trap that you are sending. You can choose to specify: 1, 2c, or 3. This property value only applies to SNMP Trap alerts. SNMP Community Name or User Name Optional The SNMP community name or user name property enables you to specify the community string or SNMP v3 user name used in the SNMP Trap alert. • For SNMP v1 or v2c, you can choose to specify a community name value for an SNMP alert. • For SNMP v3, you can choose to specify a user name value for an SNMP alert. Note - If you choose to specify an SNMP v3 user name value, you must define this user in Oracle ILOM as an SNMP user. If you do not define this user as an SNMP user, the trap receiver will not be able to decode the SNMP Trap alert. For more information about defining an SNMP user in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide, or the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. TABLE: Properties for Defining Alert Rules (Continued) Property Name Requirement Description54 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Alert Management From the Web Interface You can enable, modify, or disable any alert rule configuration in Oracle ILOM from the Alert Settings web interface page. All 15 alert rule configurations presented on this page are disabled by default. The Actions drop-down list box on the page enables you to edit the properties associated with an alert rule. To enable an alert rule on this page, you must define an alert type, alert level, and a valid alert destination. The Alert Settings page also presents a Send Test Alert button. This test alert feature enables you to verify that each alert recipient specified in an enabled alert rule receives an alert message. FIGURE: Alert Settings Page For additional information about how to manage alerts using the Oracle ILOM web interface, see “Managing System Alerts” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide.System Monitoring and Alert Management 55 Alert Management From an SNMP Host You can use the get and set commands to view and configure alert rule configurations using an SNMP host. Before you can use SNMP to view and configure Oracle ILOM settings, you must configure SNMP. For more information about how to use SNMP to manage system alerts, see “Managing System Alerts” in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide.56 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 201157 Storage Monitoring and Zone Management Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitor storage components ¦ Oracle ILOM 3.0 Daily Management Web Procedures, monitor storage components ¦ Oracle ILOM 3.0 CMM Administration, using Sun Blade Zone Manager Description Links Learn about storage monitoring for HDDs and RAID controller. • “Storage Monitoring for HDDs and RAID Controllers” on page 58 • “CLI Storage Properties Shown for HDDs and RAID Controllers” on page 58 • “Monitoring Storage Components Using the CLI” on page 61 • “Monitoring Storage Components Using the Web Interface” on page 62 Learn about the CMM Zone Management feature. • “CMM Zone Management Feature” on page 6758 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Storage Monitoring for HDDs and RAID Controllers As of Oracle ILOM 3.0.6, Oracle ILOM supports additional storage monitoring functions for viewing and monitoring storage details that are associated with system hard disk drives (HDDs) and RAID controllers. These enhanced storage property details are available in Oracle ILOM from the CLI (as of Oracle ILOM 3.0.6) and the web interface (as of Oracle ILOM 3.0.8). Note – Some Oracle Sun servers might not enable support for the storage monitoring functions that are described in this chapter. To determine whether storage monitoring support on your server has been enabled, see the Oracle ILOM Supplement guide for your server. For Oracle Sun servers supporting the Storage Monitoring feature in Oracle ILOM, a system management pack must be installed to use the Storage Monitoring features. For information about how to download this management pack, see Oracle Server Hardware Management Pack User’s Guide (821-1609). Topics in this section include: ¦ “CLI Storage Properties Shown for HDDs and RAID Controllers” on page 58 ¦ “Monitoring Storage Components Using the CLI” on page 61 ¦ “Monitoring Storage Components Using the Web Interface” on page 62 CLI Storage Properties Shown for HDDs and RAID Controllers Using the Oracle ILOM CLI, you can view the following properties (TABLE: Storage Properties Shown for HDDs and RAID Controllers on page 59) that are associated with your system server HDDs and RAID controller options.Storage Monitoring and Zone Management 59 Note – The storage properties appearing in TABLE: Storage Properties Shown for HDDs and RAID Controllers on page 59 might not be available for all storage configurations. TABLE: Storage Properties Shown for HDDs and RAID Controllers HDD Storage Properties (shown in Oracle ILOM CLI under /SYS) • Disk type (SATA or SAS) • OK to remove status • HBA ID for controller • FRU type (hard disk) • Service fault state • HBA ID for disk • FRU name • Present device state • RAID status (online, offline, failed, missing, and so on) • FRU part number • Disk capacity • RAID dedicated hot-spare (for disk) • FRU serial number • Device name • RAID global hot-spare (disk group) • FRU manufacturer • World Wide Name (WWN) • RAID ID list that is applicable to the HDD • FRU version • FRU description RAID Controller Properties (shown in Oracle ILOM CLI under /STORAGE/raid) • FRU manufacturer • PCI subdevice • Maximum global hot spares (allowed number of global hot spares for controller) • FRU model • RAID levels supported • Minimum stripe size (supported size in kilobytes) • PCI vendor ID • Maximum disks (allowed disks for controller) • Maximum stripe size (supported size in kilobytes) • PCI device ID • Maximum RAIDs (allowed logical volumes for controller) • PCI subvendor ID • Maximum hot spares (allowed dedicated hot spares for single RAID)60 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 RAID Status Definitions for Physical and Logical Drives When a physical disk is configured as part of a volume and is attached to a powered-on controller, Oracle ILOM reports one of the following status values for configured physical (TABLE: RAID Status Definitions for Physical RAID Disks on page 61) and logical (TABLE: Status Definitions for Logical RAID Volumes on page 61) drives. RAID Controller Disk Properties (shown in Oracle ILOM CLI under /STORAGE/raid) • FRU name • FRU version • World Wide Name (WWN) • FRU part number • RAID status (offline, online, failed, missing, initializing) • Dedicated hot spare (for disk) • FRU serial number • Disk capacity (supported size in byte) • Global hot spare (for disk group) • FRU manufacturer • Device name • RAID IDs (list for this device) • FRU description • Disk type (SAS or SATA known by host operating system) • System drive slot (corresponding internal hard drive NAC name for RAID) RAID Controller Volume Properties (shown in Oracle ILOM CLI under /STORAGE/raid) • RAID level • Mounted status • Stripe size • RAID volume status (OK, degraded, failed, missing) • Device name, known by host operating system • Targets for child member of RAID ID • Disk capacity • Resync status TABLE: Storage Properties Shown for HDDs and RAID Controllers (Continued)Storage Monitoring and Zone Management 61 Monitoring Storage Components Using the CLI To view and monitor storage details related to the HDDs and RAID controllers that are configured on your system, log in to the Oracle ILOM CLI and drill down the following target properties under: ¦ /SYS/ to show details for HDDs or ¦ /STORAGE/raid to show details for a RAID disk controller For CLI procedures about how to view and monitor storage properties in Oracle ILOM, see the section about Viewing and Monitoring Storage Components in the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide TABLE: RAID Status Definitions for Physical RAID Disks Physical RAID Disk ID Status OK The disk is online. Offline The disk is offline per host request or for another reason such as disk is not compatible for use in volume. Failed The disk has failed. Initializing The disk is being initialized or rebuilt. Missing The disk is missing or not responding. Unknown The disk is not recognized. TABLE: Status Definitions for Logical RAID Volumes Logical RAID Volume Status OK The volume is running at optimal level. Degraded The volume is running in degraded mode. An additional disk loss could result in permanent data loss. Failed The volume has too many failed disks and is not running. Missing The volume is not found or not available. Unknown The volume is not recognized or is not defined.62 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Monitoring Storage Components Using the Web Interface To view and monitor storage details related to the HDDs and RAID controllers that are configured on your system, log in to the Oracle ILOM web interface and drill-down to the web interface Storage --> RAID tabs. From the RAID tab, you can view and monitor details about: ¦ Raid controllers (Controller tab) – see “RAID Controllers Tab Details” on page 62. ¦ Disks attached to RAID controllers (Disk tab) – see “Disks Attached to RAID Controllers Details” on page 64. ¦ RAID controller volume details (Volumes tab) – see “RAID Controller Volume Details” on page 66. RAID Controllers Tab Details From the Storage --> RAID --> Controller tab in Oracle ILOM, you can access configuration information about each RAID controller installed on your system. This information includes: ¦ RAID controller configuration details that describe the RAID levels, maximum number of disks, and the maximum number of RAIDs that can be configured on each installed RAID controller. For example, see FIGURE: RAID Controller Configuration Details on page 63. ¦ RAID controller FRU properties and values for each installed RAID controller. For example, see FIGURE: RAID Controller FRU Properties and Values on page 63. ¦ RAID controller topology details that display information about attached disks, configured RAID volumes, and disks that are part of a RAID. For example, see FIGURE: RAID Controller Topology Details on page 64.Storage Monitoring and Zone Management 63 FIGURE: RAID Controller Configuration Details FIGURE: RAID Controller FRU Properties and Values64 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: RAID Controller Topology Details Disks Attached to RAID Controllers Details From the Storage --> RAID --> Disks tab in Oracle ILOM, you can access configuration information about the disks that are attached to your RAID controllers. This information includes: ¦ Disk configuration details for each disk attached to a RAID controller. These details include the disk name, status, serial number, capacity, and device name. For example, see FIGURE: Disk Details - Attached to RAID Controller on page 65. ¦ Disk FRU properties and values for each disk attached to a RAID controller. For example, see FIGURE: Disk FRU Properties and Values on page 65.Storage Monitoring and Zone Management 65 FIGURE: Disk Details - Attached to RAID Controller FIGURE: Disk FRU Properties and Values66 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 RAID Controller Volume Details From the Storage --> RAID --> Volume tab in Oracle ILOM, you can access configuration information about the RAID volumes that are configured on RAID controllers. This information includes: ¦ Volume configuration details for each volume configured on a RAID controller. These details include the volume name, status, RAID level, capacity, and device name. For example, see FIGURE: RAID Volume Configuration Details on page 66. ¦ Volume properties and values for each volume configured on a RAID controller. For example, see FIGURE: RAID Volume Properties and Values on page 66. FIGURE: RAID Volume Configuration Details FIGURE: RAID Volume Properties and Values For web procedures about how to view and monitor storage properties in Oracle ILOM, see the section about Viewing and Monitoring Storage Components in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures GuideStorage Monitoring and Zone Management 67 CMM Zone Management Feature As of Oracle ILOM 3.0.10, a new zoning management feature is available on the CMM for SAS-2 storage devices that are installed in Oracle Sun Blade 6000 or Sun Blade 6048 Modular Systems. For more information about how to manage SAS-2 chassis storage devices from Oracle ILOM, see the section about Zone management in the Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems (820-0052).68 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 201169 Power Monitoring and Management of Hardware Interfaces Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage power consumption ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage power consumption ¦ Oracle ILOM 3.0 Protocol Management, manage power consumption Description Links Identify Power Monitoring and Management feature updates per Oracle ILOM firmware point release. • “Summary of Power Management Feature Updates” on page 70 Become familiar with the power management terminology. • “Power Monitoring Terminology” on page 73 Learn about Oracle ILOM’s real-time power monitoring and management features. • “System Power Consumption Metrics” on page 75 • “Power Policy Settings for Managing Server Power Usage” on page 83 • “Power Usage Statistics and History Metrics for Server SP and CMM” on page 86 • “Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4” on page 92 • “Component Allocation Distribution as of Oracle ILOM 3.0.6 for Server SP and CMM” on page 93 • “Power Budget as of Oracle ILOM 3.0.6 for Server SPs” on page 102 • “Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6” on page 109 • “Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6” on page 11070 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Summary of Power Management Feature Updates TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release on page 70 identifies the common power management feature enhancements and documentation updates made since Oracle ILOM 3.0. . TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release New or Enhanced Feature Firmware Point Release Documentation Updates For Conceptual Information, See: Monitor Power Consumption Metrics Oracle ILOM 3.0 • New terms and definitions explained for Power Management Metrics. • New System Monitoring -->Power Management Consumption Metric properties. • New CLI and web procedures added for monitoring device power consumption. • “Power Monitoring Terminology” on page 73 • “Web Interface Power Consumption Metrics as of Oracle ILOM 3.0” on page 76 Configure Power Policy Properties Oracle ILOM 3.0 • New power policy properties explained. • New cli and web procedures added for configuring power policy settings. • “Power Policy Settings as of Oracle ILOM 3.0” on page 83 Monitor Power Consumption History Oracle ILOM 3.0.3 • New power consumption history metrics explained. • New CLI and web procedures added for monitoring power consumption. • “Power Usage Statistics and History Metrics for Server SP and CMM” on page 86 Web Interface Layout Update for Server Power Management Oracle ILOM 3.0.4 • New top level tab added to Oracle ILOM web interface for Power Management -->Consumption page and History page • Updated procedures for Monitoring Power Consumption and History. • “Web Interface Server and CMM Power Consumption Metrics As of Oracle ILOM 3.0.4” on page 78 Configure Power Consumption Notification Thresholds Oracle ILOM 3.0.4 • New power consumption notification threshold settings explained. • New CLI and web procedures added for configuring the power consumption thresholds. • “Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4” on page 92Power Monitoring and Management of Hardware Interfaces 71 Monitor Allocation Power Distribution Metrics Oracle ILOM 3.0.6 • New component allocation distribution metrics explained. • New CLI and web procedures added for monitoring power allocations. • New CLI and web procedures for configuring permitted power for blade slots. • “Component Allocation Distribution as of Oracle ILOM 3.0.6 for Server SP and CMM” on page 93 Configure Power Budget Properties Oracle ILOM 3.0.6 • New power budget properties explained. • New CLI and web procedures added for configuring power budget properties. • “Power Budget as of Oracle ILOM 3.0.6 for Server SPs” on page 102 Configure Power Supply Redundancy Properties for CMM Systems Oracle ILOM 3.0.6 • New power supply redundancy properties for CMM systems explained. • New CLI and web procedures added for configuring power supply redundancy properties on CMM systems. • “Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6” on page 109 Monitor Advanced Power Metrics for Server Module from CMM Oracle ILOM 3.0.6 • New CMM advanced power metrics explained for server modules. • “Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6” on page 110 Server Power Consumption Tab Properties Renamed Oracle ILOM 3.0.8 • Revised Oracle ILOM web interface Power Consumption tab properties explained for server SPs. • “Web Enhancements for Server SP Power Consumption Metrics As of 3.0.8” on page 79 Server Power Allocation Tab Replaces Distribution Tab Oracle ILOM 3.0.8 • Oracle ILOM web Allocation tab replaces Distribution tab for server SPs. • New web procedure for viewing server power allocation properties • “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP)” on page 98 Server Limit Tab Replaces Budget Tab Oracle ILOM 3.0.8 • Oracle ILOM web Limit tab replaces Budget tab for server SPs. • New web procedure for configuring power limit properties • “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP)” on page 98 TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release (Continued) New or Enhanced Feature Firmware Point Release Documentation Updates For Conceptual Information, See:72 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Web Interface Layout Update for CMM Power Management Oracle ILOM 3.0.10 • New top level tab added to Oracle ILOM web interface for Power Management • Revised Oracle ILOM web Power Consumption tab properties for CMMs explained. • Oracle ILOM web Allocation tab replaces Distribution tab for CMMs. • Power Management Metrics tab removed from CMM Oracle ILOM web interface • Updated web procedure for configuring a grant limit for blade slots (previously known as allocatable power) • “Web Enhancements for CMM Power Consumption Metrics As of 3.0.10” on page 81 • “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM)” on page 100 • “Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6” on page 110 CLI Property Update for CMM Power Management Oracle ILOM 3.0.10 • Revised CLI properties under the blade slot target explained. • Updated CLI procedure for configuring granted power or reserved power for blade slots • Updated CLI procedure for viewing power or grant limit for blade • Updated CLI procedure for configuring grant limit for blade • “Revised CLI Power Allocation Properties as of Oracle ILOM 3.0.10” on page 102 Web Power Management Statistics tab Oracle ILOM 3.0.14 • Power statistics previously available on the History tab have been moved to the Power Management -->Statistic tab. • “Power Usage Statistics and History Web Enhancements as of Oracle ILOM 3.0.4” on page 89 TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release (Continued) New or Enhanced Feature Firmware Point Release Documentation Updates For Conceptual Information, See:Power Monitoring and Management of Hardware Interfaces 73 Power Monitoring Terminology TABLE: Power Monitoring Terminology as of Oracle ILOM 3.0.3 on page 73 identifies the initial power monitoring terminology and definitions as of Oracle ILOM 3.0.3. TABLE: Power Monitoring Terminology as of Oracle ILOM 3.0.3 Terms Definition Real-time power monitoring hardware interfaces Power monitoring hardware interfaces enable real-time real time means that the service processor (SP) or individual power supply can be polled at any instance to retrieve and report “live” data to within one second accuracy Power Consumption Power consumption that is reported in Oracle ILOM includes input and output power. • Input Power Input power is the power that is pulled into the system’s power supplies from an external source. • Output Power Output power is the amount of power provided from the power supply to the system components. Total Power Consumption The total power consumption that is reported in Oracle ILOM is dependent on the hardware configuration: rackmount server, server module, or chassis monitoring module. • Rackmount Server Total Power Consumption The rackmount server total power consumption is the input power consumed by the server. • Server Module Total Power Consumption The server module (blade) total power consumption is the input power consumed only by the blade and not including any power consumed by shared components. • CMM Total Power Consumption The CMM total power consumption is the input power consumed by the entire chassis or shelf. Power Consumption Monitoring Properties Power consumption monitoring properties include: maximum power, actual power, available power, and permitted power. Note - Some Oracle server platforms might not provide the power management metrics for maximum power, actual power, available power and permitted power.74 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 For information about how to view the power management metrics in Oracle ILOM using the CLI or web interface, see the section about Monitoring the Power Consumption Interfaces in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (820-6411) • Hardware Maximum Power Consumption Property Hardware maximum power identifies the maximum input power that a system is capable of consuming at any instant given the hardware configuration of the system. Therefore, the hardware configuration maximum power is the sum of the maximum power that each processor, I/O module, memory module, fan, and so forth is capable of consuming. Note - The hardware maximum power consumption metric is not available from the Oracle ILOM web interface. • Actual Power Property Actual Power represents the consumed power for the rackmount server or chassis system. On a chassis monitoring module, this is the input power consumed by the entire chassis or shelf (all blades, NEMS, fans, and so forth). Note - .The Actual Power value is made available via the /SYS/VPS sensor. • Available Power Property Available power is the maximum power that the power supplies in the system can draw from an external source, for example: • For rackmount servers, the available power value represents the maximum input power that the power supplies are cable of consuming. • For chassis systems, this available power value represents the available amount of power guaranteed to the server module (blade) by the chassis. • Permitted Power Property or • Peak Permitted Property The Permitted Power or Peak Permitted (see note below) is the maximum power consumption guaranteed, for example: • For rackmount servers, the permitted power represents the maximum input power that the server guarantees it will consume at any instant. • For chassis systems, the permitted power represents the maximum power a server module guarantees it will consume at any instant. Note - The Permitted Power property on the server SP was renamed to Peak Permitted as of Oracle ILOM 3.0.8. The Permitted Power property on the CMM was renamed to Peak Permitted as of Oracle ILOM 3.0.10. • Additional platform-speci fic power management metrics Some servers might provide additional platform-specific power metrics under the /SP/powermgmt/advanced mode in the CLI or the Advanced Power Metrics table in the system Monitoring --> Power Management page in the web interface. Each advanced power metric includes a name, a unit, and a value. For additional information about platform-specific power management information, see the Oracle ILOM Supplement guide or the administrator guide that was provided with your server system. TABLE: Power Monitoring Terminology as of Oracle ILOM 3.0.3 (Continued) Terms DefinitionPower Monitoring and Management of Hardware Interfaces 75 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (820-6412) Real-Time Power Monitoring and Management Features For details, about using Oracle ILOM’s real-time power monitoring and management features see these topics: ¦ “System Power Consumption Metrics” on page 75 ¦ “Power Policy Settings for Managing Server Power Usage” on page 83 ¦ “Power Usage Statistics and History Metrics for Server SP and CMM” on page 86 ¦ “Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4” on page 92 ¦ “Component Allocation Distribution as of Oracle ILOM 3.0.6 for Server SP and CMM” on page 93 ¦ “Power Budget as of Oracle ILOM 3.0.6 for Server SPs” on page 102 ¦ “Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6” on page 109 ¦ “Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6” on page 110 System Power Consumption Metrics As of Oracle ILOM 3.0, you can view the server SP and CMM power consumption metrics using the Oracle ILOM CLI or web interface. Since Oracle ILOM 3.0, web enhancements for the Power Consumption metrics have been made in Oracle ILOM 3.0.4, 3.0.8, and 3.0.10. The CLI power consumption metrics targets and properties have not changed since Oracle ILOM 3.0.76 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 For information about how to access the power consumption metrics in Oracle ILOM, as well as updates made to the power consumption web interface since Oracle ILOM 3.0, see the following topics: Note – The ability to monitor and provide the power consumption metrics in Oracle ILOM varies depending on the platform server implementation of this feature. For information about hardware platform-specific power consumption metrics provided for your server, see the Oracle ILOM Supplement Guide or administration guide provided with your system. Web Interface Power Consumption Metrics as of Oracle ILOM 3.0 As of Oracle ILOM 3.0, you can control the power policy and view the power consumption metrics for a server SP or a CMM from the Power Management tab in the web interface. The power consumption metrics (shown in FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. on page 77) for Actual Power, Permitted Power and Available Power are defined in TABLE: Power Monitoring Terminology as of Oracle ILOM 3.0.3 on page 73. For information describing the use of the Power Policy property, see “Power Policy Settings for Managing Server Power Usage” on page 83. Oracle ILOM Interface Platform Hardware As of Oracle ILOM Firmware Power Consumption Topic Web Server SP and CMM Oracle ILOM 3.0 “Web Interface Power Usage Statistics and History Metrics” on page 87 CLI Server SP and CMM Oracle ILOM 3.0 “CLI Power Consumption Metrics as of Oracle ILOM 3.0” on page 77 Web Server SP and CMM Oracle ILOM 3.0.4 “Web Interface Server and CMM Power Consumption Metrics As of Oracle ILOM 3.0.4” on page 78 Web Server SP Oracle ILOM 3.0.8 “Web Enhancements for Server SP Power Consumption Metrics As of 3.0.8” on page 79 Web CMM Oracle ILOM 3.0.10 “Web Enhancements for CMM Power Consumption Metrics As of 3.0.10” on page 81 CLI CMM Oracle ILOM 3.0.10 “Revised CLI Power Allocation Properties as of Oracle ILOM 3.0.10” on page 102Power Monitoring and Management of Hardware Interfaces 77 FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. CLI Power Consumption Metrics as of Oracle ILOM 3.0 The following table identifies the server SP and CMM power consumption metric properties available from the Oracle ILOM CLI as of Oracle ILOM 3.0. TABLE: CLI Power Consumption Properties Power Consumption Property Use the show command to view the power consumption property value, for example: Total System Power Consumption show /SYS/VPS Actual Power Consumption show /SP/powermangment actual_power Note - The actual power value returned is the same as the value returned by /SYS/VPS sensor. Power Supply Consumption • For rackmount server power supply: show /SYS/platform_path_to_powersupply/INPUT_POWER|OUTPUT POWER • For CMM power supply: show /CH/platform_path_to_powersupply/INPUT_POWER|OUTPUT POWER78 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Web Interface Server and CMM Power Consumption Metrics As of Oracle ILOM 3.0.4 As of Oracle ILOM 3.0.4, the server SP and CMM power consumption metrics in the web interface have been moved to the Power Management --> Consumption page. FIGURE: Power Consumption Page as of Oracle ILOM 3.0.4 A list of the server SP and CMM power consumption changes made in Oracle ILOM 3.04 are as follows: Actual Power • For rackmount servers: show /SP/powermgmt available_power • For CMMs: show /CMM/powermgmt available_power Maximum Hardware Power Consumption show /SP/powermgmt hwconfig_power Permitted Power Consumption • For rackmount servers: show /SP/powermgmt permitted_power • For CMMs: show /CMM/powermgmt permitted_power TABLE: CLI Power Consumption Properties (Continued) Power Consumption Property Use the show command to view the power consumption property value, for example:Power Monitoring and Management of Hardware Interfaces 79 ¦ New properties for Notification Thresholds were added. For information about the Notification Threshold properties, see “Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4” on page 92. ¦ The Power Policy property (shown in FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. on page 77) was removed from the earlier version of the Power Management page. For more information about using the power policy property after Oracle ILOM 3.0.4, see “Power Policy Settings for Managing Server Power Usage” on page 83. ¦ The properties for Actual Power, Permitted Power, and Available Power remained unchanged. For more information about these properties, see TABLE: Power Monitoring Terminology as of Oracle ILOM 3.0.3 on page 73. Web Enhancements for Server SP Power Consumption Metrics As of 3.0.8 As of Oracle ILOM 3.0.8, some of the power consumption properties on the web interface for the server SP have changed. For more information about these property changes, see TABLE: Consumption Tab Server SP Settings Changes in Oracle ILOM 3.0.8 on page 81.80 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Updated Power Management --> Consumption Tabe - Oracle ILOM SP 3.0.8Power Monitoring and Management of Hardware Interfaces 8182 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Web Enhancements for CMM Power Consumption Metrics As of 3.0.10 As of Oracle ILOM 3.0.10, some of the power consumption properties on the web interface for the CMM have changed. For more information about these property changes, see TABLE: Consumption Tab CMM Settings Changes in Oracle ILOM 3.0.10 on page 82. TABLE: Consumption Tab Server SP Settings Changes in Oracle ILOM 3.0.8 Consumption Tab Changes Details -Target -Limit (new property) A new read-only property for -Target -Limit is available on the Power Management --> Consumption tab as of Oracle ILOM 3.0.8. The -Target -Limit (shown in FIGURE: Updated Power Management --> Consumption Tabe - Oracle ILOM SP 3.0.8 on page 80) property represents the power consumption limit value that was configured for the server. Note - The configuration options for the -Target -Limit property appear on the Power Management --> Limit tab. For more details about the -Target -Limit configuration options, see “Power Management --> Budget Tab Renamed to Limit Tab as of Oracle ILOM 3.0.8” on page 107. -Peak -Permitted (renamed property) The -Permitted -Power property on the Power Management --> Consumption tab in Oracle ILOM 3.0.4 (shown in FIGURE: Updated Power Management --> Consumption Tabe - Oracle ILOM SP 3.0.8 on page 80) was renamed to -Peak -Permitted in Oracle ILOM 3.0.8. The -Peak -Permitted read-only property (shown in FIGURE: Updated Power Management --> Consumption Tabe - Oracle ILOM SP 3.0.8 on page 80) represents the maximum power the system can consume. Note - For servers, the Peak Permitted value in Oracle ILOM is derived from the System Allocated power and the Target Limit. For more details, see “Advanced Server Power Budget Features as of Oracle ILOM 3.0.6” on page 105. -Allocated -Power (removed) The read-only property for -Allocated Power (shown in FIGURE: Power Consumption Page as of Oracle ILOM 3.0.4 on page 78) was removed from the Power Management --> Consumption tab as of Oracle ILOM 3.0.8 (shown in FIGURE: Power Consumption Page as of Oracle ILOM 3.0.4 on page 78). Note - In Oracle ILOM 3.0.8, you can view Allocated Power values for the system and for each component on the Power Allocation Plan page. For more details, see “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP)” on page 98.Power Monitoring and Management of Hardware Interfaces 83 FIGURE: Updated Power Management --> Consumption Tab - Oracle ILOM CMM 3.0.10 TABLE: Consumption Tab CMM Settings Changes in Oracle ILOM 3.0.10 Consumption Tab Changes Details -Peak -Permitted (renamed property) The -Permitted -Power property on the CMM Power Management --> Consumption tab was renamed to -Peak -Permitted in Oracle ILOM 3.0.10. The -Peak -Permitted read-only property (shown in FIGURE: Updated Power Management --> Consumption Tab - Oracle ILOM CMM 3.0.10 on page 82) represents the maximum power the system is permitted to use. -Available Power (renamed property and moved) The read-only property for -Available Power (previously available in Oracle ILOM 3.0.4) was removed from the CMM Power Management --> Consumption tab as of Oracle ILOM 3.0.10 (shown in FIGURE: Updated Power Management --> Consumption Tab - Oracle ILOM CMM 3.0.10 on page 82). The read-only property for Available Power was renamed to Grantable Power in Oracle ILOM 3.0.10 and moved to the Power Summary table on the Allocation tab. For more details, see “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM)” on page 100.84 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Power Policy Settings for Managing Server Power Usage To help manage the power usage of your system, Oracle ILOM supports the following Power policies: ¦ “Power Policy Settings as of Oracle ILOM 3.0” on page 83 ¦ “Power Policy Settings as of Oracle ILOM 3.0.4” on page 84 ¦ “Power Capping Policy Settings as of Oracle ILOM 3.0.8” on page 84 Power Policy Settings as of Oracle ILOM 3.0 As of Oracle ILOM 3.0, two Power Policy settings (shown in FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. on page 77) are available from the Oracle ILOM CLI and web interface to help you manage the power usage on your system. Note – The Power Policy feature was initially available on most x86 servers as of Oracle ILOM 3.0. As of Oracle ILOM 3.0.3, some SPARC platform servers supported this feature as well. To determine if your server supports a Power Policy feature, see the Oracle ILOM Supplement guide or administration guide provided for your server. TABLE: Power Policy Properties Defined as of Oracle ILOM 3.0 on page 83 defines the two Policy settings you can choose to configure from the Oracle ILOM CLI and web interface: For more details about how to access and configure the power policy settings in Oracle ILOM, see the section about Monitoring Power Consumption in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide TABLE: Power Policy Properties Defined as of Oracle ILOM 3.0 Property Description Performance The system is allowed to use all of the power that is available. Elastic The system power usage is adapted to the current utilization level. For example, the system will power up or down just enough system components to keep relative utilization at 70% at all times, even if workload fluctuatesPower Monitoring and Management of Hardware Interfaces 85 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management Guide Power Policy Settings as of Oracle ILOM 3.0.4 As of Oracle ILOM 3.0.4, the Power Policy settings in the Oracle ILOM interface have been changed as follows: ¦ The Power Management Power Policy properties available in the Oracle ILOM CLI or web interface (shown in FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. on page 77) were removed for x86 server SPs as of Oracle ILOM 3.0.4. ¦ The Power Management Power Policy properties available in the Oracle ILOM web interface (shown in FIGURE: Power Management Web Interface Page as of Oracle ILOM 3.0. on page 77) for SPARC server supporting this feature have been moved to the Power Management -->Settings tab (shown in FIGURE: Policy on Limit Tab for Some SPARC Servers as of Oracle ILOM 3.04. on page 84). To verify if your SPARC system supports this feature, see the Oracle ILOM Supplement Guide or the administration guide supplied for your server. FIGURE: Policy on Limit Tab for Some SPARC Servers as of Oracle ILOM 3.04. Power Capping Policy Settings as of Oracle ILOM 3.0.8 As of Oracle ILOM 3.0.8, advanced policy settings (shown in FIGURE: Advanced Power Policy Appear on Limit Tab as of Oracle ILOM 3.0.8 on page 86) for power capping where added to the Oracle ILOM web interface for x86 servers and some SPARC servers.86 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 For detailed description of the power capping properties, see TABLE: Advanced Power Capping Policy Property Descriptions on page 85. Note – The Advanced Power Capping Policy settings replaced the Time Limit properties originally available from the Power Management -> Budget tab in Oracle ILOM 3.0.6. TABLE: Advanced Power Capping Policy Property Descriptions Power Limit Property Description Policy The Policy property enables you to configure the power capping policy. In the Policy property, specify which of the following types of power capping you want to apply: • Soft - Only cap if actual power exceeds Target Limit. – If you enabled the soft cap option, you can configure the grace period for capping -Actual -Power to within the -Target -Limit. - -System -Default – Platform selected optimum grace period. or - -Custom – User-specified grace period. • Hard - Fixed cap keeps Peak Permitted power under Target Limit. – If you enable this option, power capping is permanently applied without a grace period. Violation Actions The Violation Actions property enables you to specify the settings you want Oracle ILOM to take if the power limit cannot be achieved within the set grace period. You can choose to specify one of the following actions: • -None – If you enable this option and the power limit cannot be achieved, Oracle ILOM will display a -Status -Error -Message to notify you that Oracle ILOM is unable to achieve the power capping limit specified. or • -Hard-Power-Off – If this option is chosen and the power limit cannot be achieved, Oracle ILOM takes the following actions: * Display a -Status -Error -Message. * Hard-power-off the server. Note - The default option for Violation Actions is -None.Power Monitoring and Management of Hardware Interfaces 87 FIGURE: Advanced Power Policy Appear on Limit Tab as of Oracle ILOM 3.0.8 For more information about configuring power limit properties using the Oracle ILOM web interface, see the section about Configure Server Power Limit Properties in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Power Usage Statistics and History Metrics for Server SP and CMM As of Oracle ILOM 3.0.3, a rolling average of power consumption in 15, 30, and 60 second intervals is available for the server SP and CMM. Specifically, these rolling averages displayed by the Oracle ILOM CLI or web interface are obtained by leveraging Oracle ILOM’s sensor history capability. Note – The power consumption history information presented in Oracle ILOM is retrieved at a rate determined by the individual platform server or CMM, which could range from 1 to 8 seconds, and typically could average between 3 to 5 seconds. For more details about viewing the power usage and history information for a hardware device in Oracle ILOM, see the following topics: ¦ “Web Interface Power Usage Statistics and History Metrics” on page 87 ¦ “CLI Power Consumption History Metrics” on page 9288 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Web Interface Power Usage Statistics and History Metrics The Power Consumption History metrics for the server SP and CMM are available from the Oracle ILOM CLI and web interface. ¦ “Power Usage Statistics and History as of Oracle ILOM 3.0.3” on page 87 ¦ “Power Usage Statistics and History Web Enhancements as of Oracle ILOM 3.0.4” on page 89 ¦ “Power Usage Statistics and Power History Web Enhancements as of Oracle ILOM 3.0.14” on page 90 ¦ “Updated Server SP Power Allocation Web Procedure” on page 99 Power Usage Statistics and History as of Oracle ILOM 3.0.3 As of Oracle ILOM 3.0.3, you can access power metrics for system Power Usage Averages and History in the Oracle ILOM web interface from the System Monitoring -> Power Management page (click History link).Power Monitoring and Management of Hardware Interfaces 89 FIGURE: Web Power Usage and History Metrics for CMM as of Oracle ILOM 3.0.3 Power History - Data Set Sample of Power Consumed You can obtain a sample data set of the power consumed by the system for a specific duration by clicking the Sample Set link on the History page.90 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 EXAMPLE: Data Set Sample of Power Consumed by System Power Usage Statistics and History Web Enhancements as of Oracle ILOM 3.0.4 As of Oracle ILOM 3.0.4, the metrics for the power usage statistics and history was removed from the Power Management page (shown in FIGURE: Web Power Usage and History Metrics for CMM as of Oracle ILOM 3.0.3 on page 88) to a separate Power Management --> History tab (shown in FIGURE: Web Power Usage and History Metrics for CMM as of Oracle ILOM 3.0.3 on page 88).Power Monitoring and Management of Hardware Interfaces 91 FIGURE: Web Power Statistics and Power History for Server as of Oracle ILOM 3.0.4 Power Usage Statistics and Power History Web Enhancements as of Oracle ILOM 3.0.14 As of Oracle ILOM 3.0.14, the Statistics table appearing on the Power Management --> History tab in Oracle ILOM 3.0.4 (shown in FIGURE: Web Power Statistics and Power History for Server as of Oracle ILOM 3.0.4 on page 90) was moved to a separate Statistic tab (shown in FIGURE: Power Statistics Tab for Server as of Oracle ILOM 3.0.14 on page 90 and FIGURE: Power Statistics Tab for CMM as of Oracle ILOM 3.0.14 on page 91) in the Oracle ILOM web interface. FIGURE: Power Statistics Tab for Server as of Oracle ILOM 3.0.1492 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Power Statistics Tab for CMM as of Oracle ILOM 3.0.14 FIGURE: Power History Tab for Server as of Oracle ILOM 3.0.14Power Monitoring and Management of Hardware Interfaces 93 CLI Power Consumption History Metrics TABLE: CLI Power Consumption History Properties as of Oracle ILOM 3.0.3 on page 92 identifies the power consumption history properties available from the Oracle ILOM CLI as of Oracle ILOM 3.0.3. Power Consumption Threshold Notifications as of Oracle ILOM 3.0.4 As of Oracle ILOM 3.0.4, two new Notification Threshold settings are available in the CLI and web interface (as shown in FIGURE: Power Consumption Page as of Oracle ILOM 3.0.4 on page 78). These Notification Threshold settings enable you to generate up two power consumption notifications when the specified power consumption value (in watts) exceeds the threshold. Each time the power consumption value exceeds the specified threshold (in watts) an Oracle ILOM event is generated and logged in the Oracle ILOM event log. The power consumption notification generated by Oracle ILOM is dependent on the whether email alerts have been configured or if SNMP traps have been enabled. For more information, about email alerts and SNMP traps, see “System Monitoring and Alert Management” on page 39. For more information about configuring the power consumption notification thresholds, see the section about View and Configure Notification Thresholds in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. TABLE: CLI Power Consumption History Properties as of Oracle ILOM 3.0.3 Power Consumption History Property Use the show command to view the power consumption history value, for example: Rolling Power Usage Averages • For server SPs: show /SYS/VPS/history • For CMMs: show /CH/VPS/history Average Power Consumption • For server SPs: show /SYS/VPS/history/0 • For CMMs: show /CH/VPS/history/0 Sample set details for time stamp and power consumed in watts • For server SPs: show /SYS/VPS/history/0/list • For CMMs: show /CH/VPS/history/0/list94 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide Component Allocation Distribution as of Oracle ILOM 3.0.6 for Server SP and CMM The Component Allocation Power Distribution feature in Oracle ILOM enables you to monitor, in real-time, the amount of power that is allocated to server components and, if applicable, CMM components. Topics described in this section: ¦ “Monitoring Server Power Allocated Components” on page 93 ¦ “Monitoring CMM Power Allocated Components” on page 95 ¦ “Component Power Allocation Special Considerations” on page 97 ¦ “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP)” on page 98 ¦ “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM)” on page 100 ¦ “Revised CLI Power Allocation Properties as of Oracle ILOM 3.0.10” on page 102 Monitoring Server Power Allocated Components TABLE: Server Power Allocated Components on page 93 identifies the components that are allocated power in Oracle ILOM by your Oracle Sun server. For each component listed in TABLE: Server Power Allocated Components on page 93, Oracle ILOM provides an allocated server power value in wattage that represents the sum of the maximum power consumed by either a single server component (such as a memory module), a category of server components (all memory modules), or all server power-consuming components. TABLE: Server Power Allocated Components Server Power Allocated Component Allocated Power (Watts) Applicable to Rackmount Server Applicable to Sun Blade Server Module All server power-consuming components X X X CPUs X X X Memory modules, such as DIMMs X X X I/O modules, such as HDDs, PEMs, REMs * , RFEMs * X X XPower Monitoring and Management of Hardware Interfaces 95 You can monitor the server power allocated components from the Power Management --> Distribution page in the Oracle ILOM SP web interface or from the SP/powermgmt/powerconf CLI target in the Oracle ILOM SP CLI. An example of the Power Management --> Distribution page is shown in FIGURE: Power Management --> Distribution Tab - Oracle ILOM SP 3.0.6 on page 95. Motherboard (MB) X X X Power Supply Units (PSUs) X X Does not apply † Fans (FM) X X Does not apply † * These I/O modules apply only to Sun Blade server modules. † These devices for server modules are allocated power by the CIMM. See TABLE: CMM Power Allocated Components on page 96 for details. TABLE: Server Power Allocated Components (Continued) Server Power Allocated Component Allocated Power (Watts) Applicable to Rackmount Server Applicable to Sun Blade Server Module96 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Power Management --> Distribution Tab - Oracle ILOM SP 3.0.6 For more details about how to view the server or CMM power allocation, see the sections about View Server Component Power Allocation or View CMM Component Power Allocation in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Update: As of Oracle ILOM 3.0.8 the Distribution tab is replaced by the Allocation tab. For more details, see “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP)” on page 98 or “Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM)” on page 100. Monitoring CMM Power Allocated Components TABLE: CMM Power Allocated Components on page 96 identifies the components that are allocated power in Oracle ILOM by the CMM in your Sun system chassis. For each component listed in TABLE: CMM Power Allocated Components onPower Monitoring and Management of Hardware Interfaces 97 page 96, Oracle ILOM provides an allocated CMM power value in wattage that represents the sum of the maximum power consumed by either a single CMM component (a blade), a category of CMM components (all blades), or all CMM power-consuming components. It also provides a permitted CMM power value in wattage that represents the guaranteed maximum power the CMM component (or component category) can consume. Note – The Permitted Power value in Oracle ILOM is derived from the Power Supply Redundancy Policy and the Redundant Power available (for details see,“Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6” on page 109). The CMM continuously monitors and tracks all the Allocated Power to the system, as well as the Allocatable Power remaining and it ensures that the sum for these numbers (allocated and allocatable) never exceeds the chassis Permitted Power value. Note – Power to a Sun Blade server module is allocated by the CMM when a request for power is made by the server module. The server module requests power whenever it is powered on, and releases power back to the CMM whenever it is powered off. The CMM allocates power to the server module if the remaining allocatable power is sufficient to meet the server module’s request. The CMM also checks whether there is a limit set to the amount of power that it is permitted to a server module (which is known as the Blade Slot Permitted Power in the web interface or CMM/powermgmt/powerconf/bladeslots/BLn permitted_power in the CLI). The CMM only allocates power to the server module if the requested power is less than or equal to this property. TABLE: CMM Power Allocated Components CMM Power Allocated Component Allocated Power (Watts) Permitted Power (Watts) Allocatable Power (Watts) All CMM power-consuming components (aggregate value for all powered entities listed) X X X Blade slots (BL#) X X* Does not apply CMM X Does not apply Does not apply Network Express Modules (NEMs) X Does not apply Does not apply Power Supply Units (PSUs) X Does not apply Does not apply Fans (FM) X Does not apply Does not apply * The permitted power allocated to slots is user configurable.98 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 You can monitor the power allocated CMM components from the Power Management --> Distribution page in the Oracle ILOM CMM web interface or from the CMM/powermgmt/powerconf CLI target in the Oracle ILOM CMM CLI. For instructions, see the section about View CMM Component Power Allocation in one of the following guides. ¦ Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide In addition to monitoring the power allocation for each CMM power allocated component, you can modify the permitted (maximum) power the CMM allocates to blade slots within the chassis. For instructions, see the section about Configure Permitted Power for Blade Slots in one of the following guides: ¦ Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Component Power Allocation Special Considerations When monitoring the server or CMM power allocated components, consider the following information: ¦ Power allocation for component categories. For component categories that include multiple components, such as fans, you will be able to monitor the total sum of power consumed by all components (fans), as well as the total sum of power consumed by an individual component (fan). ¦ Hot-pluggable component power allocation. Oracle ILOM automatically displays a pre-allocated maximum power value for any known component that can be placed in a hot-plug component location either on a server or on a system chassis. For example: ¦ A hot-pluggable component location on an Oracle Sun server could include storage slots for hard disk drives (HDDs). In this case, Oracle ILOM will display a maximum power value for the HDD to be placed in the storage slot. ¦ A hot-pluggable component location on a system chassis (with a CMM) can include blade slots for server modules or I/O server modules. In this case, Oracle ILOM will display a maximum power value for any I/O server module that could be placed in the blade slots. However, if I/O server modules are not supported in the system chassis, then Oracle ILOM will display a maximum power value for a server module (and not an I/O server module). For more information about which locations or components on your server or CMM chassis system are hot-pluggable, refer to the platform documentation shipped with your system. ¦ Power supply power allocation. Oracle ILOM automatically allocates power to the power supply to account for power losses between the wall outlet and the component.Power Monitoring and Management of Hardware Interfaces 99 ¦ Troubleshooting Sun Blade server module power-on issues. If the Sun Blade server module is unable to power on, verify that the SP permitted power property value (/SP/powermgmt permitted_power) is not more than the CMM blade slot permitted power property value (/CMM/powermmgt/powerconf/bladeslots/BLn permitted_power). Note – Oracle ILOM 3.x server modules negotiate with the CMM and honor the permitted power restriction. Pre-3.x Oracle ILOM server modules will power on as long as there is enough allocatable power. Therefore, the permitted power constraint is only honored by server modules running Oracle ILOM 3.x or subsequent release. Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.8 (Server SP) The Distribution tab that was previously available for the server SP in Oracle ILOM 3.0.6 (shown in FIGURE: Power Management --> Allocation Tab - Oracle ILOM SP 3.0.8 on page 99) was renamed in Oracle ILOM 3.0.8 to the Allocation tab (shown in FIGURE: Power Management --> Allocation Tab - Oracle ILOM SP 3.0.8 on page 99). The Allocation tab, in Oracle ILOM 3.0.8, provides all the same power requirement information previously available on the Distribution tab in Oracle ILOM 3.0.6 (shown in FIGURE: Power Management --> Distribution Tab - Oracle ILOM SP 3.0.6 on page 95). However, the Allocation tab uses two tables to separate the system power requirements from the component power requirements (shown in FIGURE: Power Management --> Allocation Tab - Oracle ILOM SP 3.0.8 on page 99)100 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Power Management --> Allocation Tab - Oracle ILOM SP 3.0.8 Updated Server SP Power Allocation Web Procedure For instructions for viewing the server power allocations in Oracle ILOM, see the section about View Server Power Allocation Plan in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Power Management --> Distribution Tab Renamed to Allocation Tab as of Oracle ILOM 3.0.10 (CMM) The Distribution tab that was previously available for the CMM in Oracle ILOM 3.0.6 (shown in FIGURE: Power Management --> Distribution Tab - Oracle ILOM SP 3.0.6 on page 95) was renamed in Oracle ILOM 3.0.10 to the Allocation tab (shown in FIGURE: Power Management -> Allocation Tab - Oracle ILOM CMM 3.0.10 on page 101).Power Monitoring and Management of Hardware Interfaces 101 The Allocation tab, in Oracle ILOM 3.0.10, provides all the same power requirement information previously available on the CMM Power Distribution tab in Oracle ILOM 3.0.6. However, the new CMM Allocation tab in Oracle ILOM 3.0.10 provides two additional tables that identify the System Power Specifications and the Blade Power Grants (as shown in FIGURE: Power Management -> Allocation Tab - Oracle ILOM CMM 3.0.10 on page 101). TABLE: New or Revised Properties on CMM Allocation Tab on page 100 defines the property changes made on the CMM Allocation Tab as of 3.0.10. TABLE: New or Revised Properties on CMM Allocation Tab Updated Property Name Details Grantable Power (renamed property) Allocatable Power in Oracle ILOM 3.0.6 was renamed to Grantable Power in Oracle ILOM 3.0.10. Grantable Power indicates the total remaining power (watts) available from the CMM to allocate to blade slots without exceeding grant limit. Grant Limit (renamed property) Permitted Power in Oracle ILOM 3.0.6 was renamed to Grant Limit in Oracle ILOM 3.0.10. Grant Limit represents the maximum power the system will grant to a blade slot. For instructions for setting the grant limit on a blade see, the procedure for Configure Grant Limit for Blade Slots in the Oracle Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Granted Power (renamed property) Allocated Power in Oracle ILOM 3.0.6 was renamed to Granted Power in Oracle ILOM 3.0.10. Granted Power represents the sum of the maximum power consumed by either a single server component (such as a memory module), a category of server components (all memory modules), or all server power-consuming components.102 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 FIGURE: Power Management -> Allocation Tab - Oracle ILOM CMM 3.0.10 Revised CLI Power Allocation Properties as of Oracle ILOM 3.0.10 A summary of the CLI changes that were made in Oracle ILOM 3.0.10 to the CMM power configuration is provided in TABLE: New Power Management CLI Properties in Oracle ILOM 3.0.10 on page 102. TABLE: New Power Management CLI Properties in Oracle ILOM 3.0.10 Renamed CLI Properties Details allocated_power renamed to granted_power for blade slots The following CLI allocated_power property for all blade slots in Oracle ILOM 3.0.6: /CMM/powermgmt/powerconf/bladeslot allocated_power changed in Oracle ILOM 3.0.10 to granted_power: /CMM/powermgmt/powerconf/bladeslot granted_power allocated_power renamed granted_power for blades The following CLI allocated_power property for blades in Oracle ILOM 3.0.6: /CMM/powermgmt/powerconf/bladeslot/BLn allocated_power -> granted_power changed in Oracle ILOM 3.0.10 to granted_power: /CMM/powermgmt/powerconf/bladeslot/BLn granted_power permitted_power renamed grant_limit for blades The following CLI permitted_power property for blades in Oracle ILOM 3.0.6: /CMM/powermgmt/powerconf/bladeslot/BLn permitted_power changed in Oracle ILOM 3.0.10 to grant_limit: /CMM/powermgmt/powerconf/bladeslot/BLn grant_limitPower Monitoring and Management of Hardware Interfaces 103 For instructions for using these latest CLI properties to view granted power or grant limit per blade, see the procedures about View Granted Power or Grant Limit in the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. Power Budget as of Oracle ILOM 3.0.6 for Server SPs Note – The Power Budget properties described in this section are replaced in the web interface with the Limit tab properties as of Oracle ILOM 3.08. For updated details, see. Some Oracle server platforms support a power budget. A power budget sets a limit on the system’s power consumption. The system applies power capping when power consumption exceeds the power limit and guarantees that the maximum power consumption will not exceed the system’s Permitted Power. You can configure a power budget and then, at a later time, enable or disable the configuration properties that are set. After a power budget is enabled, the Oracle ILOM SP monitors the power consumption and applies power capping when needed. Power capping is achieved by limiting the maximum frequency at which the CPUs run. The Oracle ILOM SP coordinates this process with the operating system (OS) to ensure that the OS can continue applying its own power management policies within the set limit. Power budget settings in Oracle ILOM are saved across all SP reboots and host power-off and power-on states. During an SP reboot, the applied power capping budget that is in effect will remain. After the SP completes the reboot process, power capping is then automatically adjusted, as needed, by the system. Oracle ILOM’s ability to achieve a power budget depends on the workload running on the system. For example, if the workload is causing the system to operate near the maximum power consumption, Oracle ILOM will be unable to achieve a budget that is close to the minimum power consumption. If Oracle ILOM is unable to achieve the set Power Limit, it will automatically generate a violation notification. For information about configuring Power Budget properties in the Oracle ILOM, see the section about Configure Server Power Budget Properties in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Power Budget topics described in this section include: ¦ “Why Use a Power Budget?” on page 103104 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ “Server Power Budget Properties as Oracle ILOM 3.0.6” on page 104 ¦ “Advanced Server Power Budget Features as of Oracle ILOM 3.0.6” on page 105 ¦ “Power Management --> Budget Tab Renamed to Limit Tab as of Oracle ILOM 3.0.8” on page 107 Why Use a Power Budget? The Power Budget feature in Oracle ILOM helps you to better plan and manage the power required for your data center. Typically the power allocated to a server is based on the nameplate power, as provided by the /SP/powermgmt allocated_power property. The most effective way to use the Power Budget feature in Oracle ILOM is to: 1. Determine the workload that will operate on the Oracle server. 2. Set the Power Limit property in Oracle ILOM that is near (for example, at or slightly above) to the workload’s normal operating power consumption. 3. Use the Power Limit property value to help plan the amount of power that will need to be allocated in your data center for this system.Power Monitoring and Management of Hardware Interfaces 105 Server Power Budget Properties as Oracle ILOM 3.0.6 TABLE: Server Power Budget Properties as of Oracle ILOM 3.0.6 on page 104 identifies the server power budget properties that you can view or configure from the CLI or web interface in Oracle ILOM. Advanced Server Power Budget Features as of Oracle ILOM 3.0.6 The advanced server power budget features in Oracle ILOM include properties for Time Limit and Violation Actions. These property settings (see TABLE: Advanced Server Power Budget Properties as of Oracle ILOM 3.0.6 on page 106) enable you to control the aggressiveness of power capping, and to configure a system action in response to a violated budget. The server power budget is designed to ensure that power capping is not applied until the Power Limit is exceeded. The Time Limit property specifies the grace period for capping power to within the Power Limit, if exceeded. The system TABLE: Server Power Budget Properties as of Oracle ILOM 3.0.6 Power Budget Property Description Activation State Enable this property to enable the power budget configuration. Status The Status reports one of the following current power budget states: • OK – The OK status appears when the system is able to achieve the power limit, or when the power budget is not enabled. • Violation – The Violation status occurs when the system is not able to reduce power to the power limit. If the power consumption falls below the Power Limit, the violation is cleared and the status returns to ok. The budget status is also reported through a system sensor: /SYS/PWRBS. This is a discreet sensor which is set to 1 (deasserted) when the budget is ok, and to 2 (asserted) when the budget has been violated. Power Limit Set a Power Limit in watts or as a percentage of the range between minimum and maximum system power. Note - The minimum system power is viewable in the CLI under the target /SP/powermgmt/budget min_powerlimit. The maximum system power is viewable from the Allocated Power property in the web interface or from the CLI under the target /SP/powermgmt allocated_power.106 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 provides a default grace period that is set to achieve responsiveness at the least cost to the system performance. When the default grace period is enabled for the Time Limit property, anomalous spikes are ignored and power capping is applied only when power consumption remains above the Power Limit. If you specify a different grace period than the default grace period provided, the user-modified grace period could cause Oracle ILOM to increase or decrease the power cap severity in response to exceeding the Power Limit. Server modules are allocated power by the chassis CMM, and must guarantee to not exceed this allocated amount. It might be necessary to reduce the server module's guaranteed maximum power to allow the server module to power on, or there might be some other administrative reason for requiring that the server power never exceeds a watts value. Setting the budget grace period to None instructs Oracle ILOM to permanently apply power capping to ensure that the Power Limit is never exceeded, at the cost of limited performance. If Oracle ILOM can guarantee the Power Limit with a grace period of None, it reduces the value of the Permitted Power property to reflect the new guaranteed maximum power. If the power limit or grace period is later increased, the Permitted Power value on a rackmount server is increased. However, the Permitted Power value for a Sun Blade server module will only increase if the chassis CMM is able to provide the server module with additional power. TABLE: Advanced Server Power Budget Properties as of Oracle ILOM 3.0.6 on page 106 identifies the advanced server power budget property settings that you can view or configure from the Oracle ILOM CLI or web interface. Note – For best power capping performance, the default values are recommended for all advanced server power budget properties. An example of the web interface Power Management --> Budget properties is shown in FIGURE: SP - Power Management Budget Tab - Oracle ILOM 3.0.6 on page 107. TABLE: Advanced Server Power Budget Properties as of Oracle ILOM 3.0.6 Power Budget Property Description Time Limit Specify one of the following grace periods for capping the power usage to the limit: • Default – Platform selected optimum grace period. • None – No grace period. Power capping is permanently applied. • Custom – User-specified grace period. Violation Actions The actions that the system will take if the power limit cannot be achieved within the grace period. This option can be set to -None or -Hard Power Off. This setting, by default, is set to None.Power Monitoring and Management of Hardware Interfaces 107 FIGURE: SP - Power Management Budget Tab - Oracle ILOM 3.0.6 For instructions about how to view or configure the server and advanced server power budget properties in Oracle ILOM, see the section about Configure Server Power Budget Properties in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Power Management --> Budget Tab Renamed to Limit Tab as of Oracle ILOM 3.0.8 The Budget tab that was previously available for server SPs in Oracle ILOM 3.0.6 was renamed in Oracle ILOM 3.0.8 to the Limit tab (shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109). The Limit tab in Oracle ILOM 3.0.8 provides all the same SP power capping information that was previously available on the Budget tab. However, some of the previous power capping properties have been renamed on the Power Management108 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 --> Limit tab in Oracle ILOM 3.0.8. For more details about the property changes made to the Limit tab, see TABLE: Limit Tab Server SP Setting Changes in Oracle ILOM 3.0.8 on page 108. TABLE: Limit Tab Server SP Setting Changes in Oracle ILOM 3.0.8 Limit Tab Property Changes Details -Power -Limiting (renamed property) The -Activation -State property on the Budget tab in Oracle ILOM 3.0.6 (shown in FIGURE: SP - Power Management Budget Tab - Oracle ILOM 3.0.6 on page 107) was renamed to -Power -Limiting on the Power Management --> Limit tab in Oracle ILOM 3.0.8. The -Powering -Limiting -[] -enable property (shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109) when selected enables the power limit configuration. -Status -Error -Message (replaces -Status property) The -Status read-only property previously available on the Budget tab in Oracle ILOM 3.0.6 (shown in FIGURE: SP - Power Management Budget Tab - Oracle ILOM 3.0.6 on page 107) was replaced by a new Status Error Message on the Power Management --> Limit tab or Consumption tab in Oracle ILOM 3.0.8 (shown in FIGURE: Sample Power Management Metrics Page on page 111). The new Status Error Message only appears on your system when Oracle ILOM fails to achieve the power limit that was configured. -Target -Limit (renamed property) The -Power -Limit property on the Budget tab in Oracle ILOM 3.0.6 (shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109) was renamed to -Target -Limit on the Power Management --> Limit tab in Oracle ILOM 3.0.8. The -Target -Limit property (shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109) enables you to specify the a target limit value in watts or as a percentage. This value must be a range between the minimum and maximum system power. -Policy (renamed advanced property) The -Time -Limit property on the Budget tab in Oracle ILOM 3.0.6 (shown in FIGURE: SP - Power Management Budget Tab - Oracle ILOM 3.0.6 on page 107) was renamed to -Policy on the Power Management --> Limit tab in Oracle ILOM 3.0.8. The -Policy property (shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109) enables you to specify the type of power capping to apply: • Soft - Only cap if actual power exceeds Target Limit – If you enabled the soft cap option, you can configure the grace period for capping Actual Power to within the Target Limit. - -System -Default – Platform selected optimum grace period. or - -Custom – User-specified grace period. • Hard - Fixed cap keeps Peak Permitted power under Target Limit – If you enabled this option, power capping is permanently applied without a grace period.Power Monitoring and Management of Hardware Interfaces 109 An example of the new Power Management --> Limit tab properties that are available for server SPs as of Oracle ILOM version 3.0.8 is shown in FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 on page 109. FIGURE: Power Management --> Limit Tab - Oracle ILOM SP 3.0.8 Updated Power Limit Configuration Procedure For information about configuring Power Limit properties in Oracle ILOM, see the section about Configure Server Power Limit Properties in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. Power Supply Redundancy for CMM Systems as of Oracle ILOM 3.0.6 From the Oracle ILOM CMM CLI or web interface you can view and configure the following power supply redundancy options: ¦ Power Supply Redundancy Policy – This policy controls the number of power supplies that are currently allocating power in addition to the number of power supplies that are reserved to handle power supply failures. Values for this redundancy policy property can be set to: ¦ None – Reserves no power supplies.110 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 ¦ n+n – Reserves half of the power supplies to handle power supply failures. ¦ Redundant Power – This value is provided by the system. It represents the available power that is not allocated. To view or configure the CMM power supply redundancy options in the Oracle ILOM CLI or web interface, see the section about View or Configure CMM Power Supply Redundancy Properties in one of the following guides: ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Platform-Specific CMM Power Metrics as of Oracle ILOM 3.0.6 Note – As of Oracle ILOM 3.0.10, the CMM Power Metrics tab was removed from the Oracle ILOM CLI and web interface. As of Oracle ILOM version 3.0.6, advanced power metrics are available in some Oracle systems from the Oracle ILOM CMM CLI or web interface. These metrics represent the maximum allocated power value for each blade slot. For empty slots or slots with I/O server modules, the value presented by Oracle ILOM represents the maximum power that an I/O server module could consume. To determine whether your CMM system supports this Oracle ILOM 3.0.6 feature, refer to the platform Oracle ILOM Supplement for your server or CMM. For Oracle systems supporting the CMM advanced power metrics, you can view the power metrics in the Power Management --> Metrics page of the Oracle ILOM web interface (FIGURE: Sample Power Management Metrics Page on page 111) or from the Oracle ILOM CLI under the target /CMM/powermgmt/advanced/BLn.Power Monitoring and Management of Hardware Interfaces 111 FIGURE: Sample Power Management Metrics Page112 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011113 Remote Host Management Operations Related Information ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage remote host power states ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage SPARC LDOM states ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage remote host power states ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage SPARC LDOM states ¦ Oracle ILOM 3.0 Remote Redirection Consoles, Oracle ILOM Remote Console ¦ Oracle ILOM 3.0 Remote Redirection Consoles, Oracle ILOM Storage Redirection CLI Description Links Learn about controlling the power state of a remote server. • “Remote Power Control” on page 114 Learn how to control the host boot device on an x86 system SP. • “Host Control - Boot Device on x86 Systems” on page 114 Learn about Logical Domain (LDom) configurations on SPARC servers. • “Oracle ILOM Operations for LDom Configurations on SPARC Servers” on page 115 Learn about Oracle ILOM CLI and web remote redirection consoles. • “Remote Redirection Console Options” on page 115114 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Remote Power Control The remote power states in Oracle ILOM are available for all Oracle Sun servers from the Oracle ILOM CLI or web interface. These options enable you to control the power state of a remote host server or chassis. For information about remotely managing the power states on a managed device, see the section about Managing Host Remote Power States in one of the following guides: ¦ Oracle ILOM 3.0 Daily Management CLI Procedures ¦ Oracle ILOM 3.0 Daily Management Web Procedures Host Control - Boot Device on x86 Systems As of Oracle ILOM 3.0.3, you can use the Host Control features in the CLI and web interface to select the host boot device settings that will override the boot device order in the BIOS. This ability gives the CLI and web interface parity with the existing IPMI interface. The primary purpose of the boot device override feature is to enable the administrator to perform a one-time manual override of the server’s BIOS boot order settings. This enables the administrator to quickly configure a machine or group of machines to boot from another device, such as the PXE boot environment. The Host Control boot device settings are available in Oracle ILOM for Oracle Sun x86 systems SPs. This feature is not supported on the CMM. For Host Control settings in Oracle ILOM specific to SPARC system server SPs, consult the Oracle ILOM Supplement guide or platform Administration guide provided for that system. For procedures on how to use the Host Control boot settings in Oracle ILOM on an x86 system SP, see the Remote Management Option procedures in the following Oracle ILOM guides: ¦ Oracle ILOM 3.0 Daily Management CLI Procedures ¦ Oracle ILOM 3.0 Daily Management Web ProceduresRemote Host Management Operations 115 Oracle ILOM Operations for LDom Configurations on SPARC Servers You can use Oracle ILOM to perform the following tasks on SPARC servers that have stored Logical Domain (LDom) configurations. For more information and procedures on how to view and configure LDom configurations on SPARC servers, see the following Oracle ILOM guides: ¦ Oracle ILOM 3.0 Daily Management CLI Procedures Guide, manage LDOM states ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage LDOM states Remote Redirection Console Options Oracle ILOM 3.0 supports the following remote redirection console options: ¦ Oracle ILOM Remote Console – Web-based remote KVMS console. ¦ Oracle ILOM Remote Redirection Console – CLI-based remote storage redirection console For detailed information about these remote redirection console options, see the Oracle ILOM 3.0 Remote Redirection Console – CLI and Web Guide. Task Supported Oracle ILOM Point Release View Oracle ILOM CLI targets and properties for stored LDom configurations from a host SPARC T3 Series server. • 3.0.12 (CLI only) • 3.0.14 (CLI and web interface) Specify which stored LDom configuration is used on the host SPARC server when the server is powered-on. • 2.0.0 (CLI and web interface) Enable (default) or disable the control domain boot property values from the host SPARC server. • 2.0.0 (CLI and web interface)116 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011117 Oracle ILOM Host Maintenance and Diagnostics Options Related Information ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, launch embedded version of Oracle ILOM Installation Assistant ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, back up and restore Oracle ILOM configuration ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, update Oracle ILOM firmware ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, x86 server diagnostics ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, SPARC server diagnostics ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, Oracle Service diagnostics Description Links List of host maintenance operations available in Oracle ILOM. • “Host Maintenance Operations” on page 118 List of host diagnostic options available in Oracle ILOM. • “Host Diagnostic Options” on page 118118 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Host Maintenance Operations Oracle ILOM 3.0 supports the following maintenance operations: ¦ Embedded Oracle Hardware Installation ¦ Oracle ILOM firmware updates ¦ Back up, restore, and reset Oracle ILOM configurations For detailed information about these host maintenance operations, see the Oracle ILOM 3.0 Maintenance and Diagnostics CLI and Web Guide. Host Diagnostic Options Oracle ILOM 3.0 supports the following host diagnostic options: ¦ x86 server host diagnostic tools ¦ SPARC server host diagnostic tools ¦ Oracle Service related diagnostic tools For detailed information about using these host diagnostic options, refer to the Oracle ILOM 3.0 Oracle ILOM 3.0 Maintenance and Diagnostics CLI and Web Guide.119 Example Setup of Dynamic DNS This appendix describes how to configure the Dynamic Domain Name Service (DDNS) on a typical customer’s infrastructure. The instructions and example configuration provided here do not affect Oracle ILOM or the service processor (SP). The following topics are covered in this appendix: ¦ “Dynamic DNS Overview” on page 119 ¦ “Example Dynamic DNS Configuration” on page 121 Dynamic DNS Overview Once DDNS is configured, new Oracle ILOM systems will be automatically assigned a host name and an IP address at install time. Thus, once you have configured DDNS, clients can use either host names or IP addresses to access any Oracle ILOM SPs that have been added to the network. By default, Oracle ILOM systems are shipped with Dynamic Host Configuration Protocol (DHCP) enabled so that you can use DHCP to configure the SP’s network interface. With DDNS, you can further leverage DHCP to automatically make the DNS server aware of the host names of Oracle ILOM systems that have been added to the network and configured using DHCP. Note – Domain Name Service (DNS) support, which was added to Oracle ILOM in the 3.0 release, allows hosts such as NTP servers, logging servers, and firmware upgrade servers, to be referred to within the Oracle ILOM command-line interface (CLI) and other user interfaces by host name or IP address. DDNS support, as described in this appendix, allows SPs to be referred to by their host names without being manually configured. Oracle ILOM systems are assigned well-known host names consisting of a prefix followed by a hyphen and the Oracle ILOM SP product serial number. For rackmounted systems and server modules, the host name will consist of the prefix SUNSP and the product serial number. For a server chassis with multiple chassis120 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 monitoring modules (CMMs), the host name for each CMM will consist of the prefix SUNCMMn and the product serial number, where n is 0 or 1. For example, given a product serial number of 0641AMA007, the host name for a rackmounted system or a server module would be SUNSP-0641AMA007. For a server chassis with two CMMs, the host names for the CMMs would be SUNCMM0-0641AMA007 and SUNCMM1-0641AMA007. Once DDNS has been configured, SP/DHCP/DNS transactions are automatically executed to add new host names and associated IP addresses to the DNS database. Each transaction comprises the following steps: 1. Oracle ILOM creates the SP host name using the appropriate prefix and the product serial number and the Oracle ILOM SP sends the host name to the DHCP server as part of the DHCP request. 2. When the DHCP server receives the request, it assigns an IP address to the Oracle ILOM SP from an available pool of addresses. 3. The DHCP server then sends an update to the DNS server to notify it of the newly configured Oracle ILOM SP’s host name and IP address. 4. The DNS server updates its database with the new information, thus completing the SP/DHCP/DNS transaction. Once an SP/DHCP/DNS transaction is completed for a given host name, clients can make a DNS request using that host name and DNS will return the assigned IP address. To determine the host name of a particular Oracle ILOM SP, simply check the product serial number on the outside of the SP itself and combine the product serial number with the appropriate prefix as described above. You can also determine host names by checking the server logs for DNS zone update messages. Note – You can use the CLI to change the SP host name to something other than the default. However, if you change the host name to a non-default name, clients must use that host name to refer to the SP using DNS. The DNS information is updated when a DHCP lease renewal causes an IP address change, and the DNS information is deleted when the DHCP lease is released. Note – For all Oracle ILOM SPs that have been assigned host names prior to DDNS support or that may have been configured using DDNS and MAC address-based host names, the previously configured host names will remain in effect.Example Setup of Dynamic DNS 121 Example Dynamic DNS Configuration This section describes how to set up an example DDNS configuration. You can use the procedures and sample files provided here, with site-specific modifications, to set up your own DDNS configuration. Note – How you set up DDNS depends on the infrastructure in use at your site. Solaris, Linux, and Windows operating systems all support server solutions that offer DDNS functionality. This example configuration uses Debian r4.0 as the server operating system environment. This following topics are covered in this section: ¦ “Assumptions” on page 121 ¦ “Configure and Start the DHCP and DNS Servers” on page 121 ¦ “References” on page 123 Assumptions This example configuration is based on the following assumptions: ¦ There is a single server that handles both DNS and DHCP for the network the SP resides on. ¦ The SP network address is 192.168.1.0. ¦ The DHCP/DNS server address is 192.168.1.2 ¦ The IP addresses from 192.168.1.100 to 192.168.1.199 are used as a pool to provide addresses to the SP and other clients. ¦ The domain name is example.com. ¦ There is no existing DNS or DHCP configuration in place. If there is, use the following files as a guideline to update the existing configuration. ? Configure and Start the DHCP and DNS Servers To configure the servers, follow these steps: 1. Install the bind9 and dhcp3-server packages from the Debian distribution. Installing the dnsutils package provides access to dig, nslookup and other useful tools as well.122 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 2. Using dnssec-keygen, generate a key to be shared between the DHCP and DNS servers to control access to the DNS data. 3. Create a DNS configuration file named /etc/bind/named.conf that contains the following: options { directory "/var/cache/bind"; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { any; }; }; // prime the server with knowledge of the root servers zone "." { type hint; file "/etc/bind/db.root"; }; // be authoritative for the localhost forward and reverse zones, // and for broadcast zones as per RFC 1912 zone "localhost" { type master; file "/etc/bind/db.local"; }; zone "127.in-addr.arpa" { type master; file "/etc/bind/db.127"; }; zone "0.in-addr.arpa" { type master; file "/etc/bind/db.0"; }; zone "255.in-addr.arpa" { type master; file "/etc/bind/db.255"; }; // additions to named.conf to support DDNS updates from dhcp server key server.example.com { algorithm HMAC-MD5; secret "your-key-from-step-2-here" }; zone "example.com" { type master; file "/etc/bind/db.example.com"; allow-update { key server.example.com; }; }; zone "1.168.192.in-addr.arpa" { type master; file "/etc/bind/db.example.rev"; allow-update { key server.example.com; }; };Example Setup of Dynamic DNS 123 4. Add empty zone files for the local network. Empty zone files should be named /etc/bind/db.example.com and /etc/bind/db.example.rev. Copying the distribution supplied db.empty files is sufficient; they will be updated automatically by the DNS server. 5. Create a /etc/dhcp3/dhcpd.conf file that contains the following: 6. After completing steps 1 through 5 above, run the /etc/init.d script to start the DNS and DHCP servers. Once the servers are running, any new Oracle ILOM SPs configured for DHCP will be automatically accessible using their host name when they are powered on. Use log files, dig, nslookup, and other utilities for debugging, if necessary. References For more information on the Linux DHCP and DNS servers used in this example, see the Internet Systems Consortium web site at: (http://www.isc.org/) ddns-update-style interim; ddns-updates on; server-identifier server; ddns-domainname "example.com."; ignore client-updates; key server.example.com { algorithm hmac-md5; secret your-key-from-step-2-here; } zone example.com. { primary 127.0.0.1; key server.example.com; } zone 1.168.192.in-addr.arpa. { primary 127.0.0.1; key server.example.com; } default-lease-time 600; max-lease-time 7200; authoritative; log-facility local7; subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.100 192.168.1.199; option domain-name-servers 192.168.1.2; }124 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011125 Glossary A access control list (ACL) A software authorization mechanism that enables you to control which users have access to a server. Users can define ACL rules that are specific to a particular file or directory, granting or denying access to one or more users or groups. Active Directory A distributed directory service included with Microsoft Windows Server operating systems. It provides both authentication of user credentials and authorization of user access levels to networked resources. actual power The amount of power consumed by all power supplies in the system. address In networking, a unique code that identifies a node in the network. Names such as “host1.companyname.com” are translated to dotted-quad addresses, such as “168.124.3.4” by the Domain Name Service (DNS). address resolution A means for mapping Internet addresses into physical media access control (MAC) addresses or domain addresses. Address Resolution Protocol (ARP) A protocol used to associate an Internet Protocol (IP) address with a network hardware address (MAC address). Administrator The person with full access (root) privileges to the managed host system. agent A software process, usually corresponding to a particular local managed host, that carries out manager requests and makes local system and application information available to remote users. alert A message or log generated by the collection and analysis of error events. An alert indicates that there is a need to perform some hardware or software corrective action. Alert Standard Format (ASF) A preboot or out-of-band platform management specification that enables a device, such as an intelligent Ethernet controller, to autonomously scan ASF-compliant sensors on the motherboard for voltage, temperature, or other excursions and to send Remote Management and Control Protocol126 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 (RMCP) alerts according to the Platform Event Trap (PET) specification. ASF was intended primarily for out-of-band management functions for client desktops. ASF is defined by the Distributed Management Task Force (DMTF). authentication The process that verifies the identity of a user in a communication session, or a device or other entity in a computer system, before that user, device, or other entity can access system resources. Session authentication can work in two directions. A server authenticates a client to make access-control decisions. The client can authenticate the server as well. With Secure Sockets Layer (SSL), the client always authenticates the server. authenticated user A user that has successfully undergone the process of authentication and has subsequently been granted access privileges to particular system resources. authorization The process of granting specific access privileges to a user. Authorization is based on authentication and access control. available power On a rackmounted server, available power is the sum of all the power that the power supplies can provide. On a server module, available power is the amount of power the chassis is willing to provide to the server module. B bandwidth A measure of the volume of information that can be transmitted over a communication link. Often used to describe the number of bits per second a network can deliver. baseboard management controller (BMC) A device used to manage chassis environmental, configuration, and service functions, and receive event data from other parts of the system. It receives data through sensor interfaces and interprets this data by using the sensor data record (SDR) to which it provides an interface. The BMC provides another interface to the system event log (SEL). Typical functions of the BMC are to measure processor temperature, power supply values, and cooling fan status. The BMC can take autonomous action to preserve system integrity. baud rate The rate at which information is transmitted between devices, for example, between a terminal and a server. bind In the Lightweight Directory Access Protocol (LDAP), this refers to the authentication process that LDAP requires when users access the LDAP directory. Authentication occurs when the LDAP client binds to the LDAP server. BIOS (Basic Input/Output System) System software that controls the loading of the operating system and testing of hardware at system power on. BIOS is stored in read-only memory (ROM).Glossary 127 bits per second (bps) The unit of measurement for data transmission speed. boot loader A program contained in read-only memory (ROM) that automatically runs at system power-on to control the first stage of system initialization and hardware tests. The boot loader then transfers control to a more complex program that loads the operating system. C cache A copy of original data that is stored locally, often with instructions or the most frequently accessed information. Cached data does not have to be retrieved from a remote server again when requested. A cache increases effective memory transfer rates and processor speed. certificate Public key data assigned by a trusted Certificate Authority (CA) to provide verification of an entity’s identity. This is a digitally signed document. Both clients and servers can have certificates. Also called a “public key certificate.” Certificate Authority (CA) A trusted organization that issues public key certificates and provides identification to the owner of the certificate. A public key Certificate Authority issues certificates that state a relationship between an entity named in the certificate, and a public key that belongs to that entity, which is also present in the certificate. chassis monitoring module (CMM) A typically redundant, hot-pluggable module that works with the service processor (SP) on each blade to form a complete chassis management system. client In the client/server model, a system or software on a network that remotely accesses resources of a server on a network. command-line interface (CLI) A text-based interface that enables users to type executable instructions at a command prompt. console A terminal, or dedicated window on a screen, where system messages are displayed. The console window enables you to configure, monitor, maintain, and troubleshoot many server software components. Coordinated Universal Time (UTC) The international standard for time. UTC was formerly called Greenwich Meridian Time (GMT). UTC is used by Network Time Protocol (NTP) servers to synchronize systems and devices on a network. core file A file created by the Solaris or Linux operating system when a program malfunctions and terminates. The core file holds a snapshot of memory, taken at the time the fault occurred. Also called a “crash dump file.”128 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 critical event A system event that seriously impairs service and requires immediate attention. customer-replaceable unit (CRU) A system component that the user can replace without special training or tools. D Data Encryption Standard (DES) A common algorithm for encrypting and decrypting data. Desktop Management Interface (DMI) A specification that sets standards for accessing technical support information about computer hardware and software. DMI is hardware and operating system (OS) independent, and can manage workstations, servers, or other computing systems. DMI is defined by the Distributed Management Task Force (DMTF). digital signature A certification of the source of digital data. A digital signature is a number derived from a public key cryptographic process. If the data is modified after the signature was created, the signature becomes invalid. For this reason, a digital signature can ensure data integrity and detection of data modification. Digital Signature Algorithm (DSA) A cryptographic algorithm specified by the Digital Signature Standard (DSS). DSA is a standard algorithm used to create digital signatures. direct memory access (DMA) The transfer of data directly into memory without supervision of the processor. directory server In the Lightweight Directory Access Protocol (LDAP), a server which stores and provides information about people and resources within an organization from a logically centralized location. Distinguished Name (DN) In the Lightweight Directory Access Protocol (LDAP), a unique text string that identifies an entry’s name and location within the directory. A DN can be a fully qualified domain name (FQDN) that includes the complete path from the root of the tree. Distributed Management Task Force (DMTF) A consortium of over 200 companies that authors and promotes standards for the purpose of furthering the ability to remotely manage computer systems. Specifications from the DTMF include the Desktop Management Interface (DMI), the Common Information Model (CIM), and the Alert Standard Format (ASF).Glossary 129 domain A grouping of hosts that is identified by a name. The hosts usually belong to the same Internet Protocol (IP) network address. The domain also refers to the last part of a fully qualified domain name (FQDN) that identifies the company or organization that owns the domain. For example, “oracle.com” identifies Oracle Corporation as the owner of the domain. domain name The unique name assigned to a system or group of systems on the Internet. The host names of all the systems in the group have the same domain name suffix, such as “oracle.com.” Domain names are interpreted from right to left. For example, “oracle.com” is both the domain name of Oracle Corporation, and a subdomain of the top-level “.com” domain. Domain Name Server (DNS) The server that typically manages host names in a domain. DNS servers translate host names, such as “www.example.com,” into Internet Protocol (IP) addresses, such as “030.120.000.168.” Domain Name System (DNS) A distributed name resolution system that enables computers to locate other computers on a network or the Internet by domain name. The system associates standard Internet Protocol (IP) addresses, such as “00.120.000.168,” with host names, such as “www.oracle.com.” Machines typically get this information from a DNS server. Dynamic Domain Name Service (DDNS) A service that ensures that a Domain Name Server (DNS) always knows the dynamic or static IP address associated with a domain name. Dynamic Host Configuration Protocol (DHCP) A protocol that enables a DHCP server to assign Internet Protocol (IP) addresses dynamically to systems on a Transmission Control Protocol/Internet Protocol (TCP/IP) network. E enhanced parallel port (EPP) A hardware and software standard that enables systems to transmit data at twice the speed of standard parallel ports. Ethernet An industry-standard type of local area network (LAN) that enables real-time communication between systems connected directly through cables. Ethernet uses a Carrier Sense Multiple Access/Collision Detection (CSMA/CD) algorithm as its access method, wherein all nodes listen for, and any node can begin transmitting data. If multiple nodes attempt to transmit at the same time (a collision), the transmitting nodes wait for a random time before attempting to transmit again. event A change in the state of a managed object. The event-handling subsystem can provide a notification to which a software system must respond when it occurs, but which the software did not solicit or control. external serial port The RJ-45 serial port on the server.130 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 externally initiated reset (XIR) A signal that sends a “soft” reset to the processor in a domain. XIR does not reboot the domain. An XIR is generally used to escape from a hung system in order to reach the console prompt. A user can then generate a core dump file, which can be useful in diagnosing the cause of the hung system. F failover The automatic transfer of a computer service from one system, or more often a subsystem, to another to provide redundant capability. Fast Ethernet Ethernet technology that transfers data up to 100M bits per second. Fast Ethernet is backward-compatible with 10M-bit per second Ethernet installations. Fault Management Architecture (FMA) An architecture that ensures a computer can continue to function despite a hardware or software failure. field-replaceable unit (FRU) A system component that is replaceable at the customer site. file system A consistent method by which information is organized and stored on physical media. Different operating systems typically have different file systems. File systems are often a tree-structured network of files and directories, with a root directory at the top and parent and child directories below root. File Transfer Protocol (FTP) A basic Internet protocol based on Transmission Control Protocol/Internet Protocol (TCP/IP) that enables the retrieving and storing of files between systems on the Internet without regard for the operating systems or architectures of the systems involved in the file transfer. firewall A network configuration, usually both hardware and software, that protects networked computers within an organization from outside access. A firewall can monitor or prohibit connections to and from specified services or hosts. firmware Software that is typically used to help with the initial booting stage of a system and with system management. Firmware is embedded in read-only memory (ROM) or programmable ROM (PROM). fully qualified domain name (FQDN) The complete and unique Internet name of a system, such as “www.oracle.com.” The FQDN includes a host server name (www) and its top-level (.com) and second-level (.oracle) domain names. An FQDN can be mapped to a system’s Internet Protocol (IP) address.Glossary 131 G gateway A computer or program that interconnects two networks and then passes data packets between the networks. A gateway has more than one network interface. Gigabit Ethernet Ethernet technology that transfers data up to 1000M bits per second. graphical user interface (GUI) An interface that uses graphics, along with a keyboard and mouse, to provide easy-to-use access to an application. H host A system, such as a backend server, with an assigned Internet Protocol (IP) address and host name. The host is accessed by other remote systems on the network. host ID Part of the 32-bit Internet Protocol (IP) address used to identify a host on a network. host name The name of a particular machine within a domain. Host names always map to a specific Internet Protocol (IP) address. hot-plug Describes a component that is safe to remove or add while the system is running. However, before removing the component, the system administrator must prepare the system for the hot-plug operation. After the new component is inserted, the system administrator must instruct the system to reconfigure the device into the system. hot-swap Describes a component that can be installed or removed by simply pulling the component out and putting a new component into a running system. The system either automatically recognizes the component change and configures it or requires user interaction to configure the system. However, in neither case is a reboot required. All hot-swappable components are hot pluggable, but not all hot-pluggable components are hot-swappable. Hypertext Transfer Protocol (HTTP) The Internet protocol that retrieves hypertext objects from remote hosts. HTTP messages consist of requests from client to server and responses from server to client. HTTP is based on Transmission Control Protocol/Internet Protocol (TCP/IP). Hypertext Transfer Protocol Secure (HTTPS) An extension of HTTP that uses Secure Sockets Layer (SSL) to enable secure transmissions over a Transmission Control Protocol/Internet Protocol (TCP/IP) network.132 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 I in-band system management Server management capability that is enabled only when the operating system is initialized and the server is functioning properly. Integrated Lights Out Manager (ILOM) An integrated hardware, firmware, and software solution for in-chassis or in-blade system management. Intelligent Platform Management Interface (IPMI) A hardware-level interface specification that was designed primarily for out-of-band management of server systems over a number of different physical interconnects. The IPMI specification describes extensive abstractions regarding sensors. This enables a management application running on the operating system (OS) or in a remote system to comprehend the environmental makeup of the system and to register with the system’s IPMI subsystem to receive events. IPMI is compatible with management software from heterogeneous vendors. IPMI functionality includes Field Replacable Unit (FRU) inventory reporting, system monitoring, logging, system recovery (including local and remote system resets and power on and off capabilities), and alerting. internal serial port The connection between the host server and Oracle ILOM that enables an Oracle ILOM user to access the host serial console. The Oracle ILOM internal serial port speed must match the speed of the serial console port on the host server, often referred to as serial port 0, COM1, or /dev/ttyS0. Normally, the host serial console settings match Oracle ILOM’s default settings (9600 baud, 8N1 [eight data bits, no parity, one stop bit], no flow control). Internet Control Message Protocol (ICMP) An extension to the Internet Protocol (IP) that provides for routing, reliability, flow control, and sequencing of data. ICMP specifies error and control messages used with the IP. Internet Protocol (IP) The basic network layer protocol of the Internet. IP enables the unreliable delivery of individual packets from one host to another. IP does not guarantee that the packet will be delivered, how long it will take, or if multiple packets will be delivered in the order they were sent. Protocols layered on top of IP add connection reliability. Internet Protocol (IP) address In Transmission Control Protocol/Internet Protocol (TCP/IP), a unique 32-bit number that identifies each host or other hardware system on a network. The IP address is a set of numbers separated by dots, such as “192.168.255.256,” which specifies the actual location of a machine on an intranet or the Internet. IPMItool A utility used to manage IPMI-enabled devices. IPMItool can manage IPMI functions of either the local system or a remote system. Functions include managing field-replaceable unit (FRU) information, local area network (LAN) configurations, sensor readings, and remote system power control.Glossary 133 J Java Remote Console A console written in Java that allows a user to access an application while it is running. Java(TM) Web Start application A web application launcher. With Java Web Start, applications are launched by clicking on the web link. If the application is not present on your system, Java Web Start downloads it and caches it onto your system. Once an application is downloaded to its cache, it can be launched from a desktop icon or browser K kernel The core of the operating system (OS) that manages the hardware and provides fundamental services, such as filing and resource allocation, that the hardware does not provide. Keyboard Controller Style (KCS) interface A type of interface implemented in legacy personal computer (PC) keyboard controllers. Data is transferred across the KCS interface using a per-byte handshake. keyboard, video, mouse, storage (KVMS) A series of interfaces that enables a system to respond to keyboard, video, mouse, and storage events. L lights out management (LOM) Technology that provides the capability for out-of-band communication with the server even if the operating system is not running. This enables the system administrator to switch the server on and off; view system temperatures, fan speeds, and so forth; and restart the system from a remote location. Lightweight Directory Access Protocol (LDAP) A directory service protocol used for the storage, retrieval, and distribution of information, including user profiles, distribution lists, and configuration data. LDAP runs over Transmission Control Protocol/Internet Protocol (TCP/IP) and across multiple platforms. Lightweight Directory Access Protocol (LDAP) server A software server that maintains an LDAP directory and service queries to the directory. The Oracle Sun Directory Services and the Netscape Directory Services are implementations of an LDAP server.134 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 local area network (LAN) A group of systems in close proximity that can communicate via connecting hardware and software. Ethernet is the most widely used LAN technology. local host The processor or system on which a software application is running. M major event A system event that impairs service, but not seriously. Management Information Base (MIB) A tree-like, hierarchical system for classifying information about resources in a network. The MIB defines the variables that the master Simple Network Management Protocol (SNMP) agent can access. The MIB provides access to the server’s network configuration, status, and statistics. Using SNMP, you can view this information from a network management station (NMS). By industry agreement, individual developers are assigned portions of the tree structure to which they may attach descriptions that are specific to their own devices. man pages Online UNIX documentation. media access control (MAC) address Worldwide unique, 48-bit, hardware address number that is programmed in to each local area network interface card (NIC) at the time of manufacture. Message Digest 5 (MD5) A secure hashing function that converts an arbitrarily long data string into a short digest of data that is unique and of fixed size. minor event A system event that does not currently impair service, but which needs correction before it becomes more severe. N namespace In the tree structure of a Lightweight Directory Access Protocol (LDAP) directory, a set of unique names from which an object name is derived and understood. For example, files are named within the file namespace and printers are named within the printer namespace. Network File System (NFS) A protocol that enables disparate hardware configurations to function together transparently. Network Information Service (NIS) A system of programs and data files that UNIX systems use to collect, collate, and share specific information about machines, users, file systems, and network parameters throughout a network of computer systems.Glossary 135 network interface card (NIC) An internal circuit board or card that connects a workstation or server to a networked device. network management station (NMS) A powerful workstation with one or more network management applications installed. The NMS is used to remotely manage a network. network mask A number used by software to separate the local subnet address from the rest of a given Internet Protocol (IP) address. Network Time Protocol (NTP) An Internet standard for Transmission Control Protocol/Internet Protocol (TCP/IP) networks. NTP synchronizes the clock times of networked devices with NTP servers to the millisecond using Coordinated Universal Time (UTC). node An addressable point or device on a network. A node can connect a computing system, a terminal, or various peripheral devices to the network. nonvolatile memory A type of memory that ensures that data is not lost when system power is off. O object identifier (OID) A number that identifies an object’s position in a global object registration tree. Each node of the tree is assigned a number, so that an OID is a sequence of numbers. In Internet usage the OID numbers are delimited by dots, for example, “0.128.45.12.” In the Lightweight Directory Access Protocol (LDAP), OIDs are used to uniquely identify schema elements, including object classes and attribute types. OpenBoot(TM) PROM A layer of software that takes control of an initialized system after the power-on self-test (POST) successfully tests components. OpenBoot PROM builds data structures in memory and boots the operating system. OpenIPMI An operating system-independent, event-driven library for simplifying access to the Intelligent Platform Management Interface (IPMI). Operator A user with limited privileges to the managed host system. out-of-band (OOB) system management Server management capability that is enabled when the operating system network drivers or the server are not functioning properly.136 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 P parity A method used by a computer for checking that data received matches data sent. Also refers to information stored with data on a disk that enables the controller to rebuild data after a drive failure. Pc-Check An application made by Eurosoft (UK) Ltd. that runs diagnostic tests on computer hardware. permissions A set of privileges granted or denied to a user or group that specify read, write, or execution access to a file or directory. For access control, permissions state whether access to the directory information is granted or denied, and the level of access that is granted or denied. permitted power The maximum power that the server will permit to be used at any given time. physical address An actual hardware address that matches a memory location. Programs that refer to virtual addresses are subsequently mapped to physical addresses. Platform Event Filtering (PEF) A mechanism that configures the service processor to take selected actions when it receives event messages, for example, powering off or resetting the system or triggering an alert. Platform Event Trap (PET) A configured alert triggered by a hardware or firmware (BIOS) event. A PET is an Intelligent Platform Management Interface (IPMI)-specific, Simple Network Management Protocol (SNMP) trap, which operates independently of the operating system. port The location (socket) to which Transmission Control Protocol/Internet Protocol (TCP/IP) connections are made. Web servers traditionally use port 80, the File Transfer Protocol (FTP) uses port 21, and Telnet uses port 23. A port enables a client program to specify a particular server program in a computer on a network. When a server program is started initially, it binds to its designated port number. Any client that wants to use that server must send a request to bind to the designated port number. port number A number that specifies an individual Transmission Control Protocol/Internet Protocol (TCP/IP) application on a host machine, providing a destination for transmitted data. power cycling The process of turning the power to a system off then on again. Power Monitoring interface An interface that enables a user to monitor real-time power consumption, including available power, actual power, and permitted power, for the service processor (SP) or an individual power supply with accuracy to within one minute of the time the power usage occurred.Glossary 137 power-on self-test (POST) A program that takes uninitialized system hardware and probes and tests its components at system startup. POST configures useful components into a coherent, initialized system and hands it over to the OpenBoot PROM. POST passes to OpenBoot PROM a list of only those components that have been successfully tested. Preboot Execution Environment (PXE) An industry-standard client/server interface that enables a server to boot an operating system (OS) over a Transmission Control Protocol/Internet Protocol (TCP/IP) network using Dynamic Host Configuration Protocol (DHCP). The PXE specification describes how the network adapter card and BIOS work together to provide basic networking capabilities for the primary bootstrap program, enabling it to perform a secondary bootstrap over the network, such as a TFTP load of an OS image. Thus, the primary bootstrap program, if coded to PXE standards, does not need knowledge of the system’s networking hardware. Privacy Enhanced Mail (PEM) A standard for Internet electronic mail that encrypts data to ensure privacy and data integrity. protocol A set of rules that describes how systems or devices on a network exchange information. proxy A mechanism whereby one system acts on behalf of another system in responding to protocol requests. public key encryption A cryptographic method that uses a two-part key (code) that is made up of public and private components. To encrypt messages, the published public keys of the recipients are used. To decrypt messages, the recipients use their unpublished private keys, which are known only to them. Knowing the public key does not enable users to deduce the corresponding private key. R real-time clock (RTC) A battery-backed component that maintains the time and date for a system, even when the system is powered off. reboot An operating system-level operation that performs a system shutdown followed by a system boot. Power is a prerequisite. redirection The channeling of input or output to a file or device rather than to the standard input or output of a system. The result of redirection sends input or output that a system would normally display to the display of another system. Remote Authentication Dial-In User Service (RADIUS) A protocol that authenticates users against information in a database on a server and grants authorized users access to a resource.138 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Remote Management and Control Protocol (RMCP) A networking protocol that enables an administrator to respond to an alert remotely by powering the system on or off or forcing a reboot. remote procedure call (RPC) A method of network programming that enables a client system to call functions on a remote server. The client starts a procedure at the server and the result is transmitted back to the client. remote system A system other than the one on which the user is working. reset A hardware-level operation that performs a system power-off, followed by a system power-on. role An attribute of user accounts that determines user access rights. root In UNIX operating systems, the name of the superuser (root). The root user has permissions to access any file and carry out other operations not permitted to ordinary users. Roughly equivalent to the Administrator user name on Windows Server operating systems. root directory The base directory from which all other directories stem, either directly or indirectly. router A system that assigns a path over which to send network packets or other Internet traffic. Although both hosts and gateways do routing, the term “router” commonly refers to a device that connects two networks. RSA algorithm A cryptographic algorithm developed by RSA Data Security, Inc. It can be used for both encryption and digital signatures. schema Definitions that describe what type of information can be stored as entries in the directory. When information that does not match the schema is stored in the directory, clients attempting to access the directory might be unable to display the proper results. S Secure Shell (SSH) A UNIX shell program and network protocol that enables secure and encrypted log in and execution of commands on a remote system over an insecure network. Secure Socket Layer (SSL) A protocol that enables client-to-server communication on a network to be encrypted for privacy. SSL uses a key exchange method to establish an environment in which all data exchanged is encrypted with a cipher and hashed to protect it from eavesdropping and alteration. SSL creates a secure connection between a web server and a web client. Hypertext Transfer Protocol Secure (HTTPS) uses SSL.Glossary 139 sensor data record (SDR) To facilitate dynamic discovery of features, the Intelligent Platform Management Interface (IPMI) includes this set of records. They include software information, such as how many sensors are present, what type they are, their events, threshold information, and so on. The sensor data records enable software to interpret and present sensor data without any prior knowledge about the platform. serial console A terminal or a tip line connected to the serial port on the service processor. A serial console is used to configure the system to perform other administrative tasks. serial port A port that provides access to the command-line interface (CLI) and the system console stream using serial port redirection. server certificate A certificate used with Hypertext Transfer Protocol Secure (HTTPS) to authenticate web applications. The certificate can be self-signed or issued by a Certificate Authority (CA). Server Message Block (SMB) protocol A network protocol that enables files and printers to be shared across a network. The SMB protocol provides a method for client applications to read and write to files on and request services from server programs in the network. The SMB protocol enables you to mount file systems between Windows and UNIX systems. The SMB protocol was designed by IBM and subsequently modified by Microsoft Corp. Microsoft renamed the protocol the Common Internet File System (CIFS). service processor (SP) A device used to manage chassis environmental, configuration, and service functions, and receive event data from other parts of the system. It receives data through sensor interfaces and interprets this data by using the sensor data record (SDR) to which it provides an interface. The SP provides another interface to the system event log (SEL). Typical functions of the SP are to measure processor temperature, power supply values, and cooling fan status. The SP can take autonomous action to preserve system integrity. session time-out A specified duration after which a server can invalidate a user session. Simple Mail Transfer Protocol (SMTP) A Transmission Control Protocol/Internet Protocol (TCP/IP) used for sending and receiving email. Simple Network Management Protocol (SNMP) A simple protocol used to exchange data about network activity. With SNMP, data travels between a managed device and a network management station (NMS). A managed device can be any device that runs SNMP, such as hosts, routers, web servers, or other servers on the network. Single Sign On (SSO) A form of authentication in which a user enters credentials once to access multiple applications. Snapshot utility An application that collects data about the state of the server processor (SP). Oracle Services uses this data for diagnostic purposes.140 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 subnet A working scheme that divides a single logical network into smaller physical networks to simplify routing. The subnet is the portion of an Internet Protocol (IP) address that identifies a block of host IDs. subnet mask A bit mask used to select bits from an Internet address for subnet addressing. The mask is 32 bits long and selects the network portion of the Internet address and one or more bits of the local portion. Also called an “address mask.” Sun Blade Modular System A chassis that holds multiple Sun Blade server modules. Sun Blade server module A server module (blade) that can be plugged into a chassis, also known as a modular system Sun Oracle ILOM Remote Console A graphical user interface that enables a user to redirect devices (keyboard, mouse, video display, storage media) from a desktop to a remote host server. superuser A special user who has privileges to perform all administrative functions on a UNIX system. Also called “root.” syslog A protocol over which log messages can be sent to a server. system event log (SEL) A log that provides nonvolatile storage for system events that are logged autonomously by the service processor or directly with event messages sent from the host. system identifier A text string that helps identify the host system. This string is included as a varbind in SNMP traps generated from the SUN-HW-TRAP-MIB. While the system identifier can be set to any string, it is most commonly used to help identify the host system. The host system can be identified by a description of its location or by referencing the host name used by the operating system on the host. T Telnet The virtual terminal program that enables the user of one host to log in to a remote host. A Telnet user of one host who is logged in to a remote host can interact as a normal terminal user of the remote host. threshold Minimum and maximum values within a range that sensors use when monitoring temperature, voltage, current, and fan speed. time-out A specified time after which the server should stop trying to finish a service routine that appears to be hung. transmission control block (TCB) Part of the Transmission Control Protocol/Internet Protocol (TCP/IP) that records and maintains information about the state of a connection.Glossary 141 Transmission Control Protocol/Internet Protocol (TCP/IP) An Internet protocol that provides for the reliable delivery of data streams from one host to another. TCP/IP transfers data between different types of networked systems, such as systems running Solaris, Microsoft Windows, or Linux software. TCP guarantees delivery of data and that packets will be delivered in the same sequence in which they were sent. trap Event notification made by Simple Network Management Protocol (SNMP) agents by their own initiative when certain conditions are detected. SNMP formally defines seven types of traps and permits subtypes to be defined. Trivial File Transport Protocol (TFTP) A simple transport protocol that transfers files to systems. TFTP uses User Datagram Protocol (UDP). U Uniform Resource Identifier (URI) A unique string that identifies a resource on the Internet or an intranet. Universal Serial Bus (USB) An external bus standard that supports data transfer rates of 450M bits per second (USB 2.0). A USB port connects devices, such as mouse pointers, user account A record of essential user information that is stored on the system. Each user who accesses a system has a user account. User Datagram Protocol (UDP) A connectionless transport layer protocol that adds some reliability and multiplexing to the Internet Protocol (IP). UDP enables one application program to deliver, via IP, datagrams to another application program on another machine. The Simple Network Management Protocol (SNMP) is usually implemented over UDP. user privilege levels An attribute of a user that designates the operations a user can perform and the resources a user can access. user identification (userid) A unique string identifying a user to a system. user identification number (UID number) The number assigned to each user accessing a UNIX system. The system uses UID numbers to identify, by number, the owners of files and directories. user name A combination of letters, and possibly numbers, that identifies a user to the system.142 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 W web server Software that provides services to access the Internet or an intranet. A web server hosts web sites, provides support for HTTP/HTTPS and other protocols, and executes server-side programs. wide area network (WAN) A network consisting of many systems that provides file transfer services. A WAN can cover a large physical area, sometimes worldwide. X X.509 certificate The most common certificate standard. X.509 certificates are documents containing a public key and associated identity information, digitally signed by a Certificate Authority (CA). X Window System A common UNIX window system that enables a workstation or terminal to control multiple sessions simultaneously.143 Index A Active Directory, 34 determining user authorization levels, 35 overview, 35 user authentication/authorization, 35 active ILOM sessions supported, 15 alerts de?ning an alert rule, 50, 54 managing from CLI, 53 managing from SNMP host, 55 managing from web interface, 54 specifying destination, 51 types of levels, 52 types supported, 49, 51 warnings for system failures, 49 authentication using Active Directory, 34 using LDAP, 36 using RADIUS, 37 using SSH host keys, 34 available power, 74 B BIOS con?gurations updating, 3 C chassis monitoring module (CMM) managing with ILOM, 10 clock settings, 48 collecting data for Sun Services, 49 connecting to ILOM, 14 D data network compared to management network, 14 default user account, 8 DHCP lease release, 120 lease renewal, 120 uses, 119 DNS database, 120 dnssec-keygen, 122 Domain Name Service (DNS), 119 downloadable ?rmware updates, 4 Dynamic DNS con?guration assumptions, 121 con?guration example, 121 con?guring DHCP and DNS, 121 Debian r4.0 environment, 121 dnssec-keygen, 122 host name, determining, 120 MAC address-based host names, 120 operating systems supported, 121 overview, 119 transaction, description of, 120 well-known host name, 119 Dynamic Domain Name Service See Dynamic DNS Dynamic Host Con?guration Protocol (DHCP) uses, 119 E Email Noti?cation alerts, 51 ENTITY-MIB, 10 Error and fault management, 5 Ethernet connection to ILOM, 16 Ethernet management port connecting to ILOM, 15 event log capturing timestamps, 48 types of events displayed, 47144 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 examples, 119 F fault management monitoring and diagnosing hardware, 45 viewing faulted components, 47 ?rmware updating, 3 H hardware and FRU inventory, 4 host name assigned using DDNS, 14 assigning, 16 host name format and contents, 119 I ILOM service processor embedded operating system, 2 management capabilities, 10 init.d script, 123 input power, 73 Integrated Lights Out Manager (ILOM) capabilities, 2 connecting to, 15 description, 2 features and functionality, 4 integrating with other management tools, 3 interfaces to, 9 new 3.0 features, 5 roles assigned to accounts, 33 system monitoring features, 40 user interfaces supported, 3, 9 Intelligent Platform Management Interface (IPMI) capabilities, 9 interfaces to ILOM, 9 IPMI PET alerts, 51 L LDAP/SSL overview, 36 LEDs when illuminated by ILOM, 41 Lightweight Directory Access Protocol (LDAP) overview, 36 used for authentication, 36 log in to ILOM using root user account password, 7 M management network compared to data network, 14 overview, 14 MIBs supported, 9 N network connection using network management port, 14 using serial management port, 14 network ports used by ILOM, 16 nslookup, 123 O out-of-band management, 2 output power, 73 P power monitoring terminology, 73 R RADIUS client-server model, 37 overview, 37 used for authentication, 37 remote access, 4 remote hardware monitoring, 4 remote power control about, 114 roles for user accounts, 6, 32 S sensor readings monitoring and diagnosing faults, 45 types of data reported, 41 serial management port connecting to ILOM, 16 service processor (SP) managing with ILOM, 10 Service Snapshot utility, 49 Simple Network Management Protocol (SNMP) capabilities, 9 con?guring alert rules, 55Index 145 MIBs supported, 9 Single Sign On overview, 33 SNMP Trap alerts, 51 SNMP-FRAMEWORK-MIB, 9 SNMP-MPD-MIB, 10 SNMPv2-MIB, 10 SSH key-based authentication, 34 Sun xVM Ops Center using with ILOM, 3 SUN-HW-TRAP-MIB, 9 SUN-ILOM-CONTROL-MIB, 9 SUN-ILOM-PET-MIB, 9 SUN-PLATFORM-MIB, 9 syslog logging utility, 48 System alerts, 5 system identi?er assigning, 16 system indicators customer changeable states, 42 illuminating conditions, 41 states, 41 system assigned states, 42 system monitoring features overview, 40 system power control and monitoring, 5 T third-party management tools, 4 U user accounts authentication, 32 con?guring, 5 default user account, 8 guidelines for managing, 32 number of accounts supported, 32 privileges assigned, 33 roles assigned, 33 root user account, 7 specifying names for, 32 W web interface capabilities, 9146 Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide • May 2011 Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management – Web Procedures Guide Part No. E21446-01 May 2011, Revision APlease Recycle Copyright © 2008, 2010, 2011 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011 , Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation x ? Download Product Software and Firmware xii Web Interface Overview 1 About the Web Interface 2 Browser and Software Requirements 2 Supported Web Browsers 2 Network Addresses Accepted by Oracle ILOM 3 Examples for Entering an IPv6 Address 4 CMM and Server SP Web Interface Connection 4 Oracle ILOM Welcome Page 5 Server SP Web Interface Components 5 CMM Web Interface 7 Web Interface Navigation Tabs 9 Navigation Tab Descriptions 9 Jump Links 14 Logging In to and Out of Oracle ILOM and Displaying Banner Messages (Web) 17 Before Your Initial Login 18 ? Log In Using the Root User Account (Web) 19 ? Log In to Oracle ILOM With User Account (Web) 20 ? Log Out of Oracle ILOM (Web) 21v Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Display Banner Messages on Login Page (Web) 22 Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 23 Configuring Network Settings (Web) 24 Requirements for Network Settings (Web) 25 ? View and Configure IPv4 Network Settings (Web) 26 ? View and Configure Dual-Stack IPv4 and IPv6 Network Settings (Web) 27 ? Test IPv4 or IPv6 Network Configuration (Web) 32 ? Assign Host Name and System Identifier (Web) 33 ? View and Configure DNS Settings (Web) 33 ? View and Configure Baud Rate for Serial Port (Web) 34 ? Configure x86 Host Serial Port Owner (Web) 35 ? Enable HTTP or HTTPS Web Access (Web) 36 ? Upload the SSL Certificate (Web) 38 Configuring Secure Shell Settings 39 ? Enable or Disable SSH 39 ? Generate a New SSH Key 39 ? Restart the SSH Server 40 Configuring the Local Interconnect Interface (Web) 41 Requirements for Configure Local Interconnect 41 ? Configure the Local Interconnect Interface (Web) 42 Managing User Accounts (Web) 45 Configuring User Accounts (Web) 46 ? Configure Single Sign On (Web) 46 ? Set the Session Time-Out (Web) 47 ? Add User Accounts and Assign Roles (Web) 47 ? Modify a User Account (Web) 50 ? Delete a User Account (Web) 51Contents vi ? View User Sessions (Web) 52 Configuring SSH Keys (Web) 52 ? Add an SSH Key (Web) 52 ? Delete an SSH Key (Web) 54 Configuring Active Directory (Web) 55 ? View and Configure Active Directory Settings (Web) 55 ? Configure Active Directory Tables (Web) 60 ? Troubleshoot Active Directory Authentication and Authorization (Web) 63 Configuring Lightweight Directory Access Protocol (LDAP) 65 ? Configure LDAP Server Settings (Web) 65 ? Configure Oracle ILOM for LDAP (Web) 66 Configuring LDAP/SSL Settings (Web) 67 ? View and Configure LDAP/SSL Settings (Web) 67 ? Configure LDAP/SSL Tables (Web) 71 ? Troubleshoot LDAP/SSL Authentication and Authorization (Web) 74 Configuring RADIUS (Web) 76 ? Configure RADIUS Settings (Web) 76 Managing Component Status and Service Actions (Web) 79 ? View Component Status Information (Web) 80 ? Prepare to Remove a Component (Web) 81 ? Return a Component to Service (Web) 82 ? Enable or Disable Components (Web) 82 ? Clear Faults Detected by Oracle ILOM (Web) 83 Monitoring System Sensors and Managing the Event Log (Web) 85 ? View Sensor Readings (Web) 86 ? Configure System Indicators (Web) 86vii Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Configure Clock Settings (Web) 87 ? Configure Time Zone Settings (Web) 88 ? Filter Event Log Output (Web) 88 ? View and Clear Oracle ILOM Event Log (Web) 90 ? Configure Remote Syslog Receiver IP Addresses (Web) 92 Monitoring Storage Components and Zone Manager (Web) 93 Requirements for Monitoring Storage Components 94 ? View and Monitor RAID Controller Details (Web) 94 ? View and Monitor Details for Disks That Are Attached to RAID Controllers (Web) 96 ? View and Monitor RAID Controller Volume Details (Web) 98 Enabling or Disabling Zone Manager for SAS-2 Storage Devices 99 Managing System Alerts and Email Notifications (Web) 101 Managing Alert Rule Configurations (Web) 102 Requirements for Configuring Alert Rules 102 ? Create or Edit Alert Rules (Web) 102 ? Disable an Alert Rule (Web) 104 ? Send Test Alert for Specific Alert Rules (Web) 104 Configuring SMTP Client for Email Notification Alerts (Web) 105 ? Enable SMTP Client for Email Alerts (Web) 105 Power Monitoring and Management of Hardware Interfaces (Web) 107 Summary of Power Management Feature Updates (Web) 108 Monitoring System Power Consumption (Web) 110 Requirements for Monitoring Power Consumption (Web) 110 ? Monitor System Power Consumption (Web) 111 ? Monitor Individual Power Supply Consumption (Web) 112 ? Monitor Power History Statistics (Web) 112Contents viii Configuring Power Policy Settings to Manage Server Power Usage (Web) 114 Requirements for Configuring the Power Policy (Web) 114 ? Configure Power Consumption Policy (Web) 115 ? Configure Server Power Policy For Power Capping (Web) 116 Configuring Power Consumption Threshold Notifications (Web) 118 ? View and Configure Notification Thresholds Using the Web Interface 118 Monitoring and Configuring Component Power Allocation Distributions (Web) 119 Requirements for Power Allocation Distributions (Web) 119 ? View Server Component Power Allocations (Web) 120 ? Configure Server Power Limit Properties as of Oracle ILOM 3.0.8 (Web) 121 ? View CMM Component Power Allocations 123 ? Configure Permitted Power for Blade Slots in CMM as of Oracle ILOM 3.0.6 126 ? Configure Grant Limit for Blade Slots in CMM as of Oracle ILOM 3.0.10 128 Configuring Server Power Limit Properties (Web) 130 ? Configure Server Power Limit Properties (Web) 130 Monitoring or Configuring CMM Power Supply Redundancy (Web) 133 ? View or Configure CMM Power Supply Redundancy Properties (Web) 133 Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console (Web) 135 Web Procedures for Redirecting Remote Host KVMS 136 Managing Remote Hosts Power States (Web) 137 Controlling Power States From Remote Server SP or CMM (Web) 138 ? Control Power State of Remote Host Server Using Server SP (Web) 138ix Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Control Power State of Remote Chassis Using the CMM Web Interface 139 Managing Host Control of Boot Device on x86 Systems (Web) 140 Requirements for Host Boot Device (Web) 140 ? Configure Host Boot Device (Web) 140 Managing TPM and LDom States on SPARC Servers (Web) 143 Controlling the TPM State on SPARC Servers (Web) 144 ? Control TPM State on a SPARC Server (Web) 144 Managing LDom Configurations on SPARC Servers (Web) 145 Requirements for SPARC LDom Configurations (Web) 145 ? View Stored LDom Configurations on SPARC T3 Series Server (Web) 146 ? Configure Host Power to Stored LDom Configurations (Web) 147 ? Specify Host Power to a Stored LDom Configuration (Web) 148 Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues 149 Diagnosing Oracle ILOM Connection Issues 150 Manual Host OS Configuration Guidelines for Local Interconnect Interface 151 Configuring Internal USB Ethernet Device on Host OS 152 Index 159x Using This Documentation This web interface procedures guide describes the Oracle Integrated Lights Out Manager (ILOM) daily management features that are common to Oracle’s Sun rackmounted servers, server modules, and CMMs supporting Oracle ILOM 3.0. For further information about the features presented in this guide, use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is written for technicians, system administrators, authorized service providers, and users who have experience managing system hardware. This chapter includes the following topics: ¦ “Documentation and Feedback” on page xi ¦ “Product Downloads” on page xii ¦ “Oracle ILOM 3.0 Version Numbers” on page xiii ¦ “Documentation, Support, and Training” on page xiiixi Oracle ILOM 3.0 Web Procedures Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xii Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.xiii Oracle ILOM 3.0 Web Procedures Guide • May 2011 Oracle ILOM 3.0 Version Numbers Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version of Oracle ILOM ¦ Oracle ILOM 3.1 as a minor version of Oracle ILOM 3 ¦ Oracle ILOM 3.1.2 as the second update version of Oracle ILOM 3.1 ¦ Oracle ILOM 3.1.2.1 as a micro version of Oracle ILOM 3.1.2 ¦ Oracle ILOM 3.1.2.1.a as a nano version of Oracle ILOM 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface. Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)1 Web Interface Overview Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, Oracle ILOM overview ¦ Oracle ILOM 3.0 Daily ManagementCLI Procedures, CLI overview ¦ Oracle ILOM 3.0 Protocol Management Reference , SNMP overview ¦ Oracle ILOM 3.0 Protocol Management Reference, IPMI overview ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, maintenance and diagnostics overview ¦ Oracle ILOM 3.0 Feature Updates and Release Notes, new or updated features Description Links Identify requirements for using Oracle ILOM’s web interface • “About the Web Interface” on page 2 • “Browser and Software Requirements” on page 2 Compare Oracle ILOM’s server SP and CMM web interface components • “CMM and Server SP Web Interface Connection” on page 4 Learn about Oracle ILOM’s web interface tabs and the functions you perform from them • “Web Interface Navigation Tabs” on page 92 Oracle ILOM 3.0 Web Procedures Guide • May 2011 About the Web Interface The Oracle ILOM web interface is accessible through a browser and uses a standard interface. The Oracle ILOM web interface enables you to monitor and manage local and remote systems. One of the most powerful features of Oracle ILOM is the ability to redirect the server's graphical console to a local workstation or laptop system. When you redirect the host console, you can configure the local system's keyboard and mouse to act as the server's keyboard and mouse. You can also configure the diskette drive or CD-ROM drive on the remote system as a device virtually connected to your Oracle Sun system. You can access these features using the Oracle ILOM Remote Console application. Browser and Software Requirements Refer to the following topics for a list of supported web browsers and network addresses accepted by the Oracle ILOM web interface. ¦ “Supported Web Browsers” on page 2 ¦ “Network Addresses Accepted by Oracle ILOM” on page 3 Supported Web Browsers The web interface has been tested successfully with recently released Mozilla Firefox, and Internet Explorer web browsers, and may be compatible with other web browsers.Web Interface Overview 3 Oracle ILOM supports the browsers listed in the following table. Note – Oracle ILOM comes preinstalled on your Sun system and includes the Remote Console application. To run the Oracle ILOM Remote Console, you must have the Java 1.5 Runtime Environment (JRE 1.5) or later version of the JRE software installed on your local client. To download the JRE software, go to http://java.com. For a list of web browsers and operating systems supported by the Oracle ILOM Remote Console, refer to the Oracle ILOM 3.0 Remote Redirection Consoles CLI and Web Guide. Network Addresses Accepted by Oracle ILOM As of Oracle ILOM 3.0.12 or later, the following network addresses are accepted by the Oracle ILOM interfaces. Note – When entering an IPv6 address or Link-Local IPv6 address, the address must be enclosed within brackets to work correctly. ¦ IPv4 address. 10.8.183.106 ¦ IPv6 address. [fec0:a:8:b7:214:4fff:5eca:5f7e/64] ¦ Link-Local IPv6 address. [e80::214:4fff:feca:5f7e/64] TABLE: Supported Web Browsers Operating System Web Browser Oracle Solaris (9 and 10) • Mozilla 1.4 and 1.7 • Firefox 1.x and later Linux (Red Hat, SuSE, Ubuntu, Oracle) • Mozilla 1.x and later • Firefox 1.x and later • Opera 6.x and later Microsoft Windows (98, 2000, XP, Vista) • Internet Explorer 5.5, 6.x, and 7.x • Mozilla 1.x and later • Firefox 1.x and later • Opera 6.x and later Macintosh (OSX v10.1 and above) • Internet Explorer 5.2 • Mozilla 1.x and later • Firefox 1.x and later • Safari – all4 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ¦ DNS host domain address. company.com Examples for Entering an IPv6 Address When you specify an IPv6 address in a URL with a web browser or when you transfer a file, the IPv6 address must be enclosed in brackets to work correctly. When you specify an IPv6 address to log in to Oracle ILOM using an SSH connection, the IPv6 address should not be enclosed in brackets. Examples: ¦ When entering the URL in a web browser, type: https://[ipv6address] ¦ When establishing an Oracle ILOM CLI session using SSH and the default Oracle ILOM root user account, type: ssh root@ipv6address Note that when you specify an IPv6 address to log in to Oracle ILOM using an SSH connection, the IPv6 address should not be enclosed in brackets. ¦ When transferring a file using the CLI load -source command and tftp, type: load -source tftp://[ipv6address]filename.extension For additional information about entering IPv6 addresses, refer to the Oracle ILOM 3.0 Daily Management – Concepts Guide. For help with diagnosing IPv4 and IPv6 connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 149. CMM and Server SP Web Interface Connection Topics discussed in this section include: ¦ “Oracle ILOM Welcome Page” on page 5 ¦ “Server SP Web Interface Components” on page 5 ¦ “CMM Web Interface” on page 7Web Interface Overview 5 Oracle ILOM Welcome Page To establish a web interface connection to Oracle ILOM on the CMM or server SP, specify the IP address of the CMM or server SP in the web browser. A welcome page appears prompting you to enter a user name and password. Server SP Web Interface Components The main Oracle ILOM web page for the server SP organizes the settings you can view or configure for that server within the tabs appearing at the top of the page, as shown in the following example. For a description of the CMM Oracle ILOM web interface, see “CMM Web Interface” on page 7. Note – The Oracle ILOM web interface navigation tabs differ slightly depending on the Oracle ILOM features implemented on a specific platform and on the Oracle ILOM version currently installed on your system. Therefore, you might have access to different tabs from those described in this section. For information about the Oracle ILOM interface for your system, refer to your Oracle ILOM supplement or platform administration guide.6 Oracle ILOM 3.0 Web Procedures Guide • May 2011 FIGURE: Oracle ILOM Web Interface Main Page Each web interface page has three main sections: the masthead, the navigation tabs, and the content area. The masthead provides the following buttons and information on each page of the web interface: ¦ About button – Click to view product and copyright information. ¦ User field – Displays the user name of the current user of the web interface and the user’s role. ¦ Server field – Displays the host name of the Oracle ILOM SP or CMM. ¦ Refresh button – Click to refresh the information in the content area of the page. The Refresh button does not save new data that you might have entered or selected on the page. ¦ Log Out button – Click to end the current session of the web interface. The Oracle ILOM web interface navigation structure includes first and second-level tabs that you can click to open a specific page. For example, when you click a first-level tab, one or more second-level tabs might display that provide you with further options. The content area is where you find information about a specific feature or operation.Web Interface Overview 7 CMM Web Interface The Oracle ILOM web page for the CMM includes: ¦ The Navigation pane on the left side of the screen that lists visible entries only for components that are present and manageable in the chassis. ¦ A Chassis view and inventory table appear on the right side of the screen when the Chassis entry in the navigation pane is selected. The Chassis view displays the front and rear view of the chassis. The Chassis Inventory table provides information about the manageable chassis components present in the chassis. ¦ The CMM management settings appear in the right side of the screen when a CMM entry is selected in the navigation pane. The settings you can view or configure for the CMM are organized in the eight tabs appearing at the top of the page, as shown in the following example.8 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – For details about the CMM Zoning Management features available in Oracle ILOM as 3.0.10, refer to the Oracle ILOM) 3.0 CMM Administration Guide For Sun Blade 6000 and Sun Blade 6048 Modular Systems. ¦ The Blade management settings appear in the right side of the screen when a blade entry in the navigation pane is selected. If you are managing a blade with multiple Service Processors (SPs), an Node entry for each dedicated SP appears in the navigation pane, as shown in the following example.Web Interface Overview 9 The settings you can view or configure for an individual blade SP are organized in the seven tabs appearing in the right side of the Oracle ILOM Web Interface page, as shown in the previous example. For more information about the tabs described in this section, see “Web Interface Navigation Tabs” on page 9. Web Interface Navigation Tabs Topics discussed in this section include: ¦ “Navigation Tab Descriptions” on page 9 ¦ “Jump Links” on page 14 Navigation Tab Descriptions The following table describes the web interface tabs that you can use to access Oracle ILOM functions.10 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – The Oracle ILOM web interface navigation tabs differ slightly depending on the Oracle ILOM features implemented on a specific server platform and on the Oracle ILOM firmware version currently installed on your server or CMM. Therefore, you might have access to different tabs from those described in the following table. For information about the Oracle ILOM interface for your system, refer to your Oracle ILOM supplement or platform administration guide. First-level Tab Second and Third-level Tabs What You Can Do Applicable To System Information Overview View the product name, part or serial number, host power state, system status state, BIOS version, SP host name, system uptime, IP address, and Oracle ILOM version that is running. • Host Power state offers you the ability to control the system power state • System Status state offers you the ability to view faulted hardware • SysFW Information (SPARC only) indicates the system firmware version embedded on the server Server SP CMM Components View the names, types, and status of the components that Oracle ILOM is monitoring. Server SP CMM Fault Management View information about components that are in a faulted state. Server SP CMM Identification Information Enter or change the service processor identification information by assigning a host name or system identifier. Server SP CMM Banner Messages View and configure a message that appears prior to log in and login message that appears after user log-in. Server SP CMM Session Timeout View the session time-out or change the session time-out parameter. Server SP CMM Versions View the SP file system version, the SP firmware version, SP firmware build number, and SP firmware date. Server SP CMM System MonitoringWeb Interface Overview 11 Sensor Readings View the name, type, and reading of the sensors. Server SP CMM Indicators View the name and status of the indicators and LEDs. Server SP CMM Event Logs View various details about each particular event, including the event ID, class, type, severity, date and time, and description of the event. Server SP CMM Power Management Consumption View power consumption metrics for actual power and permitted power, as well as set power consumption thresholds to generate email alerts or SNMP notifications. Server SP CMM Allocation View system power requirements for capacity planning. This tab was previously named Distribution prior to Oracle ILOM 3.0.10. Server SP CMM Limit View or configure server power limits. This tab was previously named Budget prior to Oracle ILOM 3.0.8. Server SP Settings Configure policy options for power consumption on SPARC servers. SPARC Redundancy View and configure CMM power supply redundancy options. This tab became available as of Oracle ILOM 3.0.6. CMM Statistics View power statistical data for CMM and server modules (blades). CMM History View a history of rolling averages for power consumption. Server SP CMM Storage RAID --> Controllers View information for RAID controllers. To get further details, click the controller name. Server SP RAID --> Disks View information for all disks attached to RAID controllers. To view further details, click the disk name. Server SP First-level Tab Second and Third-level Tabs What You Can Do Applicable To12 Oracle ILOM 3.0 Web Procedures Guide • May 2011 RAID --> Volumes View information for RAID volumes. To view further details, click the volume name. Server SP Zoning Enable or disable Zone Manager settings and reset the Zone Manager password. CMM Configuration System Management Access --> Web Server Edit or update the web server settings, such as the HTTP web server or the HTTP port. Server SP CMM System Management Access --> SSL Certificate View information about the default SSL certificate, or optionally find and enter a new SSL certificate. Server SP CMM System Management Access --> SNMP Edit or update SNMP settings Server SP CMM System Management Access --> SSH Server Configure Secure Shell (SSH) server access and key generation. Server SP CMM System Management Access --> IPMI Use a command-line interface to monitor and control your server platform, as well as to retrieve information about your server platform. Server SP CMM System Management Access --> CLI Configure the CLI settings. The Session Time-out value indicates the number of idle minutes that can lapse before automatic CLI logout occurs. Server SP CMM System Management Access --> WS-Man Configure the WS-Management settings. WS-Management is a Web Services and SOAP-based protocol for managing servers and devices. Server SP Alert Management View details about each alert and change the list of configured alerts. Server SP CMM Network View and edit the IPv4 and IPv6 network settings for Oracle ILOM and for local interconnect interface settings. Server SP CMM DNS Specify host names, and have those host names resolved into IP addresses using the Domain Name Service (DNS). Server SP CMM Serial Port View and edit the baud rate of the internal and external serial ports. Server SP CMM Clock View and edit the Oracle ILOM clock time manually, or synchronize the Oracle ILOM clock with an NTP server. Server SP CMM First-level Tab Second and Third-level Tabs What You Can Do Applicable ToWeb Interface Overview 13 Timezone Specify a particular timezone so that timestamps displayed by the service processor can be correlated to logs created elsewhere (for example, in the Oracle Solaris Operating System). Server SP CMM Syslog Configure the server addresses to which the syslog messages will be sent. Server SP CMM SMTP Client Configure the state of the SMTP client, which is used for sending email notifications of alerts. Server SP CMM Policy Enable or disable settings that control the behavior of the system, such as power-on policies. Server SP CMM User Management Active Sessions View the users currently logged in to Oracle ILOM, as well as the type of session users have initiated. Server SP CMM User Accounts Add, delete, or modify local Oracle ILOM user accounts. Server SP CMM LDAP Configure Oracle ILOM access for LDAP users. Server SP CMM LDAP/SSL Configure Oracle ILOM access for LDAP users with enhanced security settings enabled by Secure Socket Layer (SSL) technology. Server SP CMM RADIUS Configure Oracle ILOM access for RADIUS users. Server SP CMM Active Directory Configure Oracle ILOM access for Active Directory users Server SP CMM Remote Control Redirection Manage the host remotely by redirecting the system console to your local machine. Server SP CMM KVMS Enable or disable the remote management state of the keyboard, video, mouse, or storage device. Server SP Remote Power Control Select a power state: Immediate Power Off, Graceful Shutdown and Power Off, Power On, Power Cycle, or Reset. Server SP CMM First-level Tab Second and Third-level Tabs What You Can Do Applicable To14 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Jump Links As of Oracle ILOM 3.0.3, jump links were added on some web pages for easier navigation to sub-sections within a page. An example of an Oracle ILOM web page that includes jump links is shown in the following figure. Diagnostics Enable or disable diagnostics for x64 processor-based systems or SPARC processor-based systems. Server SP Host Control View and configure the host control information. Configure the boot device at the next system power-on. Server SP Maintenance Firmware Upgrade Start the process to obtain an upgrade of the Oracle ILOM firmware. Server SP CMM Backup/Restore Backup and restore the service processor configuration to a remote host or removable storage device in a secure manner. Server SP CMM Reset SP Reset the service processor. Server SP Configuration Management Manage the service processor configuration data. Server SP CMM Reset Components Reset chassis monitoring modules and service processors. CMM Snapshot Collect environmental, log, error, and FRUID data and send it to a USB thumb drive, an external host using CLI, or as a downloaded file. Server SP CMM First-level Tab Second and Third-level Tabs What You Can Do Applicable ToWeb Interface Overview 1516 Oracle ILOM 3.0 Web Procedures Guide • May 201117 Logging In to and Out of Oracle ILOM and Displaying Banner Messages (Web) Related Information ¦ Oracle ILOM 3.0 Quick Start, logging in to Oracle ILOM ¦ Oracle ILOM 3.0 Quick Start, mandatory setup tasks (web) ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, logging in to Oracle ILOM ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, banner messages ¦ Oracle ILOM 3.0 Daily Management Concepts, banner messages Description Links Identify requirements for logging into to Oracle ILOM. • “Before Your Initial Login” on page 18 Procedure for logging in to Oracle ILOM using the default root user account • “Log In Using the Root User Account (Web)” on page 19 Procedure for logging in to Oracle ILOM using a user account • “Log In to Oracle ILOM With User Account (Web)” on page 20 Procedure for logging out of Oracle ILOM • “Log Out of Oracle ILOM (Web)” on page 21 Procedure for configuring banner messages to appear on the Oracle ILOM Login page • “Display Banner Messages on Login Page (Web)” on page 2218 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Before Your Initial Login Prior to performing the procedures in this section, you should ensure that the following requirements are met. ¦ Ensure that a physical network management connection to the system (server or CMM) is established. For instructions about how to establish a physical connection to the SER MGT or NET MGT port on your system, refer to the installation guide provided with your server or CMM. The login procedures in this section assume you are logging in to the Oracle ILOM web interface through a physical network connection. Note – Alternatively, for Oracle Sun servers supporting a Local Interconnect Interface connection, you can connect directly to ILOM from the host operating system. For more details about connecting to ILOM using a Local Interconnect Interface connection, see “Configuring the Local Interconnect Interface (Web)” on page 41. ¦ Obtain the server SP or CMM network address. Oracle ILOM, by default, will automatically attempt to obtain and assign an IPv4 or IPv6 address for the server SP or CMM. To determine the default IP address assigned to the server SP or CMM, establish a local serial management connection to the server SP or CMM and view the /network (or /network/ipv6) properties. For more information about how to establish a local serial management connection to Oracle ILOM, refer to the Oracle ILOM 3.0 Quick Start Guide or refer to the documentation provided with your Sun server or Sun blade chassis system For information about modifying the default IP address assigned to your server SP or CMM, see “Configuring Network Settings (Web)” on page 24. ¦ Obtain an Oracle ILOM user account. If you are setting up Oracle ILOM for this first-time, use the default root account and changeme password to log in. It is highly recommended after your system is set up that a new user account is created for each Oracle ILOM user. For more information about setting up user accounts, see “Configuring User Accounts (Web)” on page 46.Logging In to and Out of Oracle ILOM and Displaying Banner Messages (Web) 19 ? Log In Using the Root User Account (Web) 1. In the web browser address bar, type the network address for the server SP or CMM. Examples: ¦ IPv4 network address example: http://10.8.183.106 ¦ IPv6 network address example: http://[fec0:a:8:b7:214:4fff:5eca:5f7e/64] For more information about network addresses accepted by Oracle ILOM, see “Network Addresses Accepted by Oracle ILOM” on page 3. For help with diagnosing Oracle ILOM connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 149. The web interface Login page appears.20 Oracle ILOM 3.0 Web Procedures Guide • May 2011 2. Type the root user name and password. For instance, the default root user name and password provided with Oracle ILOM are as follows: User name: root Password: changeme 3. Click Log In. The Version page in the web interface appears. ? Log In to Oracle ILOM With User Account (Web) 1. In the web browser address bar, type the network address for the server SP or CMM. Examples: ¦ IPv4 network address example: http://10.8.183.106 ¦ IPv6 network address example: http://[fec0:a:8:b7:214:4fff:5eca:5f7e/64] For more information about network addresses accepted by Oracle ILOM, see “Network Addresses Accepted by Oracle ILOM” on page 3. For help with diagnosing Oracle ILOM connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 149. The web interface Login page appears.Logging In to and Out of Oracle ILOM and Displaying Banner Messages (Web) 21 2. Type your Oracle ILOM user name and password. 3. Click Log In. The Oracle ILOM web interface appears, displaying the Version page. ? Log Out of Oracle ILOM (Web) ? Click the Log Out button in the Oracle ILOM web interface. The Log Out button is located in the top right corner of the web interface. Do not use the Log Out button on your web browser to exit Oracle ILOM.22 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Display Banner Messages on Login Page (Web) Before You Begin ¦ The Admin (a) role is required for you to configure banner messages in Oracle ILOM. ¦ The server must be running Oracle ILOM firmware version 3.0.8 or later. Follow these steps to configure banner messages. 1. Log in to the Oracle ILOM SP web interface or the Oracle ILOM CMM web interface. 2. In the Oracle ILOM web interface, click System Information --> Banner Messages. 3. In the Banner Message page, do the follow: 4. Click Message Acceptance check box to enable the system to display the banner message(s). 5. Click Save. Task Instructions To create a banner message to appear on the Login page Enter the message in the Connect Message text box. To create banner message to appear in a dialog box after users log in to Oracle ILOM. Enter the message in the Login Message text box.23 Configuring Network, Secure Shell, and Local Interconnect Settings (Web) Related Information ¦ Oracle ILOM 3.0 Quick Start, establish a network management connection ¦ Oracle ILOM 3.0 Quick Start, modify default network settings ¦ Oracle ILOM 3.0 Daily Management Concepts, network communication settings ¦ Oracle ILOM 3.0 Daily Management Concepts, switch serial port console output ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure network settings ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure secure shell settings ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure serial port sharing ¦ Oracle ILOM 3.0 Protocol Management Reference, configure network settings ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, configure the local interconnect interface Description Links Configure network properties for IP, host name, DNS, serial port output, as well as HTTP web access. • “Configuring Network Settings (Web)” on page 24 Manage secure shell settings. • “Configuring Secure Shell Settings” on page 39 Manage the local interconnect interface settings in Oracle ILOM • “Configure the Local Interconnect Interface (Web)” on page 4224 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring Network Settings (Web) Description Links Platform Feature Support Identify requirements for managing Oracle ILOM’s network settings • “Requirements for Network Settings (Web)” on page 25 • x86 system server SP • SPARC system server SP • CMM Manage and test IPv4 or IPv6 settings • “View and Configure IPv4 Network Settings (Web)” on page 26 • “View and Configure Dual-Stack IPv4 and IPv6 Network Settings (Web)” on page 27 • “Test IPv4 or IPv6 Network Configuration (Web)” on page 32 • x86 system server SP • SPARC system server SP • CMM Manage host name, DNS, and serial port settings • “Assign Host Name and System Identifier (Web)” on page 33 • “View and Configure DNS Settings (Web)” on page 33 • “View and Configure Baud Rate for Serial Port (Web)” on page 34 • x86 system server SP • SPARC system server SP • CMM Manage serial port sharing settings on x86 hosts • “Configure x86 Host Serial Port Owner (Web)” on page 35 • • x86 servers SP Manage HTTP and HTTPS settings, and upload SSL certificates • “Enable HTTP or HTTPS Web Access (Web)” on page 36 • “Upload the SSL Certificate (Web)” on page 38 • x86 system server SP • SPARC system server SP • CMMConfiguring Network, Secure Shell, and Local Interconnect Settings (Web) 25 Requirements for Network Settings (Web) Review the following information before you view or configure Oracle ILOM network settings. Network Environment Before You Begin IPv4-only • To easily locate Oracle ILOM on the network, you should ensure the same IP address is always assigned to Oracle ILOM. Oracle ILOM by default will attempt to obtain IPv4 network settings using DHCP. Dual-stack IPv4 and IPv6 • Oracle ILOM is shipped with IPv4 DHCP and IPv6 Stateless default network settings. • Verify that your server or CMM has Oracle ILOM firmware 3.0.12 or later installed. • The IPv4 network state must always be enabled in order for Oracle ILOM to operate in an IPv4 network environment or in a dual-stack IPv4 and IPv6 network environment. • For IPv6 Stateless auto-configurations, Oracle ILOM (3.0.12 or later) requires a network router to be configured for IPv6. • For DHCPv6 auto-configuration options, Oracle ILOM (3.0.14 or later) requires a network DHCPv6 server to provide the IPv6 address(es) and DNS information for the device. Note. DHCP and DHCPv6 are separate protocols. In a dual-stack network environment, DHCP and DHCPv6 operate as follows: (1) the DHCPv6 server can provide IPv6 addresses to a network node and the network node always uses the IPv6 protocol to communicate with a DHCPv6 server; and (2) the DHCP server can provide IPv4 addresses to a network node and the network node will always use the IPv4 protocol to communicate with a DHCP server • For DHCP and DHCPv6 auto-configurations, you should choose to receive the DNS information from either an IPv6 DHCP server or from an IPv4 DHCP server, but not from both. You can manually configure the settings for the DNS name server in Oracle ILOM. For instructions, see “View and Configure DNS Settings (Web)” on page 33. Note - For a list of legacy Sun platform servers not supporting IPv6 configurations in Oracle ILOM, refer to Legacy Sun Systems Not Supporting IPv6 in the Oracle ILOM 3.0 Daily Management Concepts Guide. Network settings described in this section • You need to have the Admin (a) role enabled to modify any server SP or CMM network properties or options.26 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View and Configure IPv4 Network Settings (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. Note – This procedure provides instructions for configuring Oracle ILOM to operate in an IPv4-only network environment. If you are configuring Oracle ILOM to operate in an dual-stack IPv4 and IPv6 network environment, see “View and Configure Dual-Stack IPv4 and IPv6 Network Settings (Web)” on page 27. To view and configure IPv4 network settings, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Network. The Network Settings page appears. 3. You can have DHCP assign IP addresses automatically, or you can choose to assign the addresses manually. ¦ To automatically obtain an IP address, click the radio button next to DHCP. See the following figure.Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 27 ¦ To manually set a static IP address, complete the information in the Network Settings page; use the descriptions in the following table. 4. Click Save for your settings to take effect. Settings are considered pending until you click Save. Changing the IP address will end your Oracle ILOM session. You are prompted to close your web browser. 5. Log back in to Oracle ILOM using the new IP address. Note – If you changed the network settings, you might need to log back in with a new browser session. ? View and Configure Dual-Stack IPv4 and IPv6 Network Settings (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. Note – This procedure provides instructions for configuring Oracle ILOM to operate in a dual-stack IPv4 and IPv6 network environment. If you are configuring Oracle ILOM to operate in an IPv4-only network environment, refer to “View and Configure IPv4 Network Settings (Web)” on page 26. Item Description State Click the check box to enable the network state. MAC Address The SP’s media access control (MAC) address is set at the factory. The MAC address is a hardware address that is unique to each networked device. The MAC address is provided on a label on the SP or CMM, on the Customer Information Sheet included in the ship kit, and in the BIOS Setup screen. IP Discovery Mode Click the Static radio button to manually assign an IP address, netmask, and gateway. IP Address Type the server’s IP address. The IP address is a unique name that identifies the system on a TCP/IP network. Netmask Type the subnet mask of the network on which the SP resides. Gateway Type SP’s gateway access address.28 Oracle ILOM 3.0 Web Procedures Guide • May 2011 To view and configure dual-stack IPv4 and IPv6 network settings, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Navigate to the IPv4 and IPv6 network settings that are available on the Network tab. For example: ¦ On a server SP, click Configuration --> Network. ¦ On a CMM, do the following: ¦ Select the blade SP (in the left pane), then (in the right pane) click Configuration --> Network. Note – The dual-stack IPv4 and IPv6 settings cannot be edited at the CMM level in the Oracle ILOM web interface. To edit the dual-stack IPv4 and IPv6 properties at the CMM level, you must use the Oracle ILOM CLI. For details, see the Oracle ILOM 3.0 Daily Management – CLI Procedures Guides. The following illustration shows the Oracle ILOM SP network settings for IPv4 and IPv6.Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 29 3. Verify that the network State is enabled. Note – The network State setting is enabled by default for both IPv4 and IPv6. If necessary, you can optionally disable (unchecked) the network State for IPv6. However, the IPv4 network State must always be enabled in order for Oracle ILOM to operate in an IPv4 network environment or within a dual-stack IPv4 and IPv6 network environment. 4. To manually configure a static IPv4 address, perform these steps Steps Description a. Enable the Static radio button for IPv4.30 Oracle ILOM 3.0 Web Procedures Guide • May 2011 5. To enable DHCP to automatically assign an IPv4 address, select the IPv4 DHCP radio button. 6. To manually configure a static IPv6 address, type the IP address for the device in the IPv6 address text box. The input parameters for specifying the IPv6 static IP and netmask is: / For example: fec0:a:8:b7:214:4fff:feca:5f7e/64 Note – IPv6 supports the assignment of multiple IP addresses for a device. Therefore, you can manually configure a single static IPv6 address in Oracle ILOM, as well as enable one or more of the IPv6 auto-configuration options in Oracle ILOM if desired. 7. To enable one or more of the IPv6 auto-configuration options, select the appropriate option(s) described below. b. Type the IP address for the device in the IP address text box. c. Type the subnet mask of the network on which the device resides. d. Type the device gateway access address. IPv6 Auto-Configuration Option Description Stateless (enabled by default) When enabled, the Stateless auto-configuration option is run to learn the IPv6 Stateless addresses for the device from the network IPv6 router. DHCPv6 Stateless When enabled, the DHCPv6 Stateless auto-configuration option is run to learn the DNS information for the device from the network DHCPv6 server. Note - The DHCPv6 Stateless auto-configuration option is available in Oracle ILOM as of 3.0.14. DHCPv6 Stateful When enabled, the DHCPv6 Stateful auto-configuration option is run to learn the IPv6 address(es) and DNS information for the device from the network DHCPv6 server. Note - The DHCPv6 Stateful auto-configuration option is available in Oracle ILOM as of 3.0.14. Steps DescriptionConfiguring Network, Secure Shell, and Local Interconnect Settings (Web) 31 Note – As of Oracle ILOM 3.0.14 or later, you can enable the option for Stateless auto-configuration to run at the same time as when the option for DHCPv6 Stateless is enabled or as when the option for DHCPv6 Stateful is enabled. However, the auto-configuration options for DHCPv6 Stateless and DHCPv6 Stateful should not be enabled to run at the same time. Note – When you enable the auto-configuration for either DHCPv6 Stateful or DHCPv6 Stateless, Oracle ILOM will identify in the Network Settings page the DHCP unique ID for the DHCPv6 server that was last used to retrieve the DHCP information. 8. Click Save to apply the changes made. All changes to the network settings are considered pending within the Oracle ILOM session until you click Save. Note – Changing the static IP address on the device (SP or CMM) will end all active Oracle ILOM sessions to the device. A message will appear prompting you to close your browser session. You will need to log back in to Oracle ILOM using the newly assigned static IP address. Note – IPv6 addresses learned for the device from any of the IPv6 auto-configuration options will not affect any of the active Oracle ILOM sessions to the device. You can verify the newly learned auto-configured addresses on the Network tab. 9. To test the IPv4 or IPv6 network configuration from Oracle ILOM, use the Network Test Tools (Ping or Ping6). For details, see “Test IPv4 or IPv6 Network Configuration (Web)” on page 32. ? Test IPv4 or IPv6 Network Configuration (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. To test the configuration for IPv4 or IPv6, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. In the web interface page, click Configuration --> Network.32 Oracle ILOM 3.0 Web Procedures Guide • May 2011 3. In the Network Settings page, click the Tools button appearing at the bottom of the page. The Test Tools dialog appears. 4. In the Test Tools dialog, specify the following information: ? Assign Host Name and System Identifier (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. To assign host name and system identifier, follow these steps: 1. Log in to the ILOM SP or CMM web interface. 2. Click System Information --> Identification Information. The Identification Information page appears. 3. In the SP host name field, type the SP host name. The host name can contain up to 60 characters. 4. In the SP System Identifier field, type the text that you will use to identify the system. The system identifier can consist of a text string using any standard keyboard keys except quotation marks. 5. In the SP System Contact field, type the name of a person you will contact. The system contact can consist of a text string using any standard keyboard keys except quotation marks. Field Description Test Type • Select Ping to test the IPv4 network configuration. or • Select Ping6 to test the IPv6 network configuration. Destination Type the IP address of a device on your network (the test is sent to this destination on your network).Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 33 6. In the SP System Location field, type the text that describes the physical location of the system. The system location can consist of a text string using any standard keyboard keys except quotation marks. 7. Click Save for your settings to take effect. ? View and Configure DNS Settings (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. To view and configure DNS settings, follow these steps: 1. Log in to the ILOM SP web interface or the CMM ILOM web interface. 2. Click Configuration --> DNS. The DNS Configuration page appears. 3. You can have DHCP assign the DNS name server and search path automatically, or you can choose to assign the addresses manually. ¦ To automatically assign the addresses, enable the checkbox next to Auto DNS via DHCP. ¦ To manually assign the addresses, complete the DNS name server and DNS search path text boxes. See the following figure.34 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View and Configure Baud Rate for Serial Port (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. To view and configure serial port baud rate, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Serial Port. The Serial Port Settings page appears. 3. View the baud rate for the internal host serial port and the external serial port. 4. From the Host Serial Port Baud Rate drop-down list, select the baud rate for the internal serial port For x64 systems, this setting must match the setting for serial port 0, COM1, or /dev/ttyS0 on the host operating system. The baud rate value must match the speed that was specified for the BIOS serial redirection feature (default is 9600 baud) and the speed used for the boot loader and operating system configuration. To connect to the system console using Oracle ILOM, you must set the default host serial settings (9600 baud, 8N1 [eight data bits, no parity, one stop bit], no flow control).Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 35 5. From the External Serial Port Baud Rate drop-down list, select the baud rate for the external serial port. This setting must match the baud rate on the RJ-45 serial port on the Oracle Sun server. 6. Click Save for your changes to take effect. ? Configure x86 Host Serial Port Owner (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. Note – To determine whether serial port sharing is supported for your server, refer to the platform Oracle ILOM Supplement guide or Platform Administration guide provided for your server. Caution – You should set up a network management connection to the SP before attempting to switch the serial port owner to the host server. If a network management connection is not set up to the server SP, and the serial port owner was changed from the SP to the host server, you will not be able to use the ILOM CLI or web interface to return the SP as the serial port owner. In order to return the serial port owner to the SP, you will need to restore access to ILOM through the serial management port on the server. For more details about accessing ILOM through the serial management (SER MGT) port on your server, see the platform documentation supplied with your server. To configure the host serial port owner on an x86 platform server, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Select the Configuration --> Serial Port. The Serial Port Settings page appears. 3. In the Serial Port Settings page, select Host Server as the serial port owner. Note – The service processor is the default serial port owner property value. 4. Click Save for the changes to take effect.36 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – Changing the "serial port owner" and saving this change might result in the following benign error: Can not change serial settings - the serial console in use. This error occurs if there is an active session on the serial port. However, changes to the port owner, as well as any changes to the port speed will take affect in Oracle ILOM. 5. Connect a serial host to the server. For details on how to attach devices to the server, see the platform documentation supplied with your server. ? Enable HTTP or HTTPS Web Access (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. To enable HTTP or HTTPS web access, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> System Management Access --> Web Server. The Web Server Settings page appears. 3. Perform one of the following: ¦ To enable HTTP, select Enabled from the HTTP Webserver: drop-down list. ¦ To automatically redirect HTTP connections to HTTPS, select Redirect HTTP Connection to HTTPS from the HTTP Webserver: drop-down list ¦ To disable HTTP, select Disabled from the HTTP Webserver: drop-down listConfiguring Network, Secure Shell, and Local Interconnect Settings (Web) 37 ¦ To enable HTTPS, select the checkbox for HTTPS Web Server Enabled. The HTTPS web server is enabled by default. Note – If you disable HTTP or select Redirect HTTP Connection to HTTPS, and then disable HTTPS, you will be unable to access the Oracle ILOM web interface. To restore access, use the CLI /SP/services/http or /SP/services/https commands, as described in “Enable HTTP or HTTPS Web Access“ in the Oracle ILOM 3.0 CLI Procedures Guide. 4. Assign an HTTP or HTTPS port number. 5. Click Save. ? Upload the SSL Certificate (Web) Before You Begin ¦ Review the “Requirements for Network Settings (Web)” on page 25. Note – Oracle ILOM provides a default SSL certificate and self-signed key for HTTPS access. Optionally, you can upload a different SSL certificate and matching private key. Ensure that you can access the new certificate and key through your network or local file system. To upload the SSL certificate, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface 2. Click Configuration --> System Management Access --> SSL Certificate. The SSL Certificate Upload page appears. 3. Type the file name of the new SSL certificate or click the Browse button to search for a new SSL certificate. The file name has a .pem file extension. The service processor does not support pass-phrase-encrypted certificates. 4. Click the Upload button to obtain the selected SSL certificate. The SSL Certificate Upload Status dialog box appears. 5. After you have uploaded the certificate and private key, click the OK button to reset the Oracle ILOM web server and begin using the new SSL certificate. The Oracle ILOM web server must be reset for the new certificate to take effect.38 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring Secure Shell Settings ? Enable or Disable SSH Before You Begin Note – SSH is enabled by default in Oracle ILOM. ¦ To configure Secure Shell (SSH) settings, you need the Admin (a) role enabled. To enable or disable SSH, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface 2. Click Configuration --> System Management Access --> SSH Server. The SSH Server Settings page appears. 3. To enable the SSH server, click the Enabled check box next to State. 4. Click Save for your settings to take effect. ? Generate a New SSH Key Before You Begin ¦ To configure Secure Shell (SSH) settings, you need the Admin (a) role enabled. To generate a new SSH Key, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface Description Links Platform Feature Support Manage Secure Shell settings • “Enable or Disable SSH” on page 39 • “Generate a New SSH Key” on page 39 • “Restart the SSH Server” on page 40 • x86 system server SP • SPARC system server SP • CMMConfiguring Network, Secure Shell, and Local Interconnect Settings (Web) 39 2. Click Configuration --> System Management Access --> SSH Server. The SSH Server Settings page appears. 3. Select RSA by clicking the Generate RSA Key button, or select DSA by clicking the Generate DSA Key button. Click OK or Cancel when you are prompted. The new key will take effect immediately for new connections. ? Restart the SSH Server Note – Restarting the SSH server will end any existing SSH connections. To restart the SSH server, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> System Management Access --> SSH Server. The SSH Server Settings page appears. 3. Click the Restart button to restart the SSH server.40 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring the Local Interconnect Interface (Web) Requirements for Configure Local Interconnect The following requirements must be met before you perform the procedures described in this section. ¦ Review the concepts describing the use of a Local Interconnect Interface between the Oracle ILOM SP and the host OS. For details, refer to “Local Interconnect Interface: Local Connection to Oracle ILOM From Host ” in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the Oracle ILOM descriptions for the Local Host Interconnect configuration settings. For details, refer to “Local Host Interconnect Configuration Settings in Oracle ILOM” in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Verify that your server is running Oracle ILOM 3.0.12 or a later version of Oracle ILOM. ¦ Verify that your platform supports the Local Interconnect Interface. Refer to your platform server Oracle ILOM supplement guide or administration guide. Note – The settings in Oracle ILOM for the Local Interconnect Interface are not supported on the CMM. ¦ Automatic configuration of the Local Interconnect Interface requires the Host Managed (hostmanaged) setting in Oracle ILOM to be enabled (set to True), as well as the installation of the Oracle Hardware Management Pack 2.1.0 or later software on the server. For more information about installing the Oracle Hardware Management Pack 2.1.0 software, refer to the Oracle Server Hardware Management Pack User’s Guide. Description Links Platform Feature Support Identify requirements for configuring the local interconnect interface • “Requirements for Configure Local Interconnect” on page 41 • x86 system server SP • SPARC system server SP Configure the Local Interconnect Interface • “Configure the Local Interconnect Interface (Web)” on page 42Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 41 ¦ Manual configuration of the Local Interconnect Interface between the Oracle ILOM SP and the host operating system requires the Host Managed (hostmanaged) setting in Oracle ILOM to be disabled (set to False), as well as other configuration settings to be set on the host operating system. For guidelines for configuring the host OS connection point on the Local Interconnect Interface, see “Manual Host OS Configuration Guidelines for Local Interconnect Interface” on page 151. ¦ The host operating system must support the internal USB Ethernet device that is presented from the Oracle ILOM SP. Therefore, prior to configuring the Local Interconnect Interface in Oracle ILOM, you should verify that an internal USB Ethernet device driver was included in the operating system distribution and installed on your server. If an internal USB Ethernet device driver was not installed by the operating system distribution, you can obtain the device driver for your operating system from the Oracle Hardware Management Pack 2.1.0 software. For more details, refer to the Oracle Server Hardware Management Pack User’s Guide. ¦ Network parameter changes to the settings in Oracle ILOM for the Local Interconnect Interface are considered pending until you commit the changes in the Oracle ILOM. For example, in the Oracle ILOM CLI, you must issue the commitpending=true command to save the pendingipaddress and the pendingipnetmask under the network/interconnect target. In the Oracle ILOM web interface, network parameter changes entered on the Configure USB Ethernet Parameters dialog box are committed after you click Save. ¦ An Oracle ILOM user account with Admin (a) role privileges is required in order to change any of the settings in Oracle ILOM for the Local Interconnect Interface. ¦ To determine the operating systems supported on your server, refer to the platform server installation guide or operating system guide. ? Configure the Local Interconnect Interface (Web) Before You Begin ¦ Review the “Requirements for Configure Local Interconnect” on page 41 To configure the local interconnect interface using the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the web interface page, click Configuration --> Network. 3. In the Network Settings page, scroll down the page until you see the section labeled “Local Host Interconnect,” then click Configure.42 Oracle ILOM 3.0 Web Procedures Guide • May 2011 The dialog box to configure the USB Ethernet Parameters appears. 4. To configure the assignment of the non-routable IPv4 addresses to the connection points on the Local Interconnect Interface, you can choose to: ¦ Automatically assign non-routable IPv4 addresses to each connection point on the Local Interconnect Interface by enabling the check box for True Host Management. ¦ When you enable the Host Managed property setting, you also must install the Oracle Hardware Management Pack 2.1.0 (or later) software on your server and accept the installation default for enabling Local Oracle ILOM Interconnect. For more information, refer to the section about configuring the Local Oracle ILOM Interconnect in the Oracle Server Hardware Management Pack User’s Guide.Configuring Network, Secure Shell, and Local Interconnect Settings (Web) 43 ¦ Manually assign non-routable IPv4 addresses to each connection point on the Local Interconnect Interface by specifying the following properties in the Configure USB Ethernet Parameters dialog: Note – To prevent the Oracle Hardware Management Pack software from auto-configuring the Local Interconnect Interface between the Oracle ILOM SP and the host OS, the Host Managed must be cleared (disabled). To prevent the use of the Local Interconnect Interface between the Oracle ILOM SP and the host OS, both the Host Managed check box and the State check box must be cleared (disabled). 5. To commit the changes entered on the Configure USB Ethernet Parameters dialog box, click Save. Note – If you chose to manually configure the Local Interconnect Interface in Oracle ILOM without the use of the Oracle Hardware Management Pack 2.1.0 or later software, you will need to perform some additional configuration on the host operating system. For general details about these additional host OS configuration settings, see “Manual Host OS Configuration Guidelines for Local Interconnect Interface” on page 151. Field Instructions and Description Host Managed Clear the check box for Host Managed to disable the host managed mode. State Click the check box for State to manually enable the local interconnect mode between the Oracle ILOM SP and the host OS. The State is, by default, disabled. IP Address Oracle ILOM, by default, provides a default non-routable IPv4 address for the Oracle ILOM SP connection point on the Local Interconnect Interface. This default IPv4 address (169.254.182.76) should not be changed unless a conflict exists in your network environment with this IPv4 address. NetMask Oracle ILOM, by default, provides a default IPv4 Netmask address for the Oracle ILOM SP connection point on the Local Interconnect Interface. This default IPv4 Netmask (255.255.255.0) address should not be changed unless a conflict exists in your network environment with this address.44 Oracle ILOM 3.0 Web Procedures Guide • May 201145 Managing User Accounts (Web) Related Information ¦ Oracle ILOM 3.0 Quick Start, add user account ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Daily Management Concepts, guidelines for managing user accounts ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, recover a lost password ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, manage user accounts Description Links Configure user accounts • “Configuring User Accounts (Web)” on page 46 Configure SSH user key • “Configuring SSH Keys (Web)” on page 52 Configure Active Directory settings • “Configuring Active Directory (Web)” on page 55 Configure LDAP settings • “Configuring Lightweight Directory Access Protocol (LDAP)” on page 65 Configure LDAP/SSL settings • “Configuring LDAP/SSL Settings (Web)” on page 67 Configure RADIUS settings • “Configuring RADIUS (Web)” on page 7646 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring User Accounts (Web) ? Configure Single Sign On (Web) Before You Begin ¦ To set properties for Single Sign On, you need the Admin (a) role enabled. To enable or disable single sign on, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> User Accounts. The User Account Settings page appears. 3. Click the check box next to Enable Single Sign On to enable the feature, or clear the check box to disable the feature. Description Links Platform Feature Support Manage Oracle ILOM’s single sign on and user session settings • “Configure Single Sign On (Web)” on page 46 • “Set the Session Time-Out (Web)” on page 47 • x86 system server SP • SPARC system server SP • CMM Manage Oracle ILOM user accounts and roles • “Add User Accounts and Assign Roles (Web)” on page 47 • “Modify a User Account (Web)” on page 50 • “Delete a User Account (Web)” on page 51 • “View User Sessions (Web)” on page 52 • x86 system server SP • SPARC system server SP • CMMManaging User Accounts (Web) 47 ? Set the Session Time-Out (Web) Note – The session time-out setting controls the amount of time an Oracle ILOM session will remain idle before logging out. The session time-out setting does not persist after you log out of the current Oracle ILOM session. You must reset the session time-out each time you log in to the Oracle ILOM web interface. Before You Begin ¦ To set properties for session time-out, you need the Admin (a) role enabled. To set the session time-out property value, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click System Information --> Session Time-Out. The Session Time-Out page appears. 3. In the Session Time-Out drop-down list, select a preferred time-out increment (15 mins, 30 mins, 1 hr, or 3 hrs). 4. Click Apply to save your changes. ? Add User Accounts and Assign Roles (Web) Before You Begin ¦ To set properties for User Management (user accounts and roles), you need the User Management (u) role enabled. To add a user account and assign privileges (roles), follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> User Accounts. The User Account Settings page appears. 3. In the Users table, click Add. The Add User dialog box appears.48 Oracle ILOM 3.0 Web Procedures Guide • May 2011 4. Complete the following information: a. In the User Name text box, specify a name for this user account. b. In the Roles drop-down list, select a user role profile (administrator, operator, or advanced). User role profile descriptions follow. User Role Descriptions User role profiles User role profile permissions granted (web) Administrator When selected, the Administrator role profile in the Oracle ILOM web interface automatically grants read and write permissions to the following user role permissions. • Admin (a) • User Management (u) • Console (c) • Reset and Host Control (r) • Read only (o) For definitions of roles supported by the Administrator role profile, see the user role definitions listed in this table under User role permissions granted.Managing User Accounts (Web) 49 Operator When selected, the Operator role profile in the Oracle ILOM web interface automatically grants the following user role permissions: • Console (c) • Reset and Host Control (r) • Read only (o) For definitions of roles granted by the Operator role profile, see the user role definitions listed in this table under User role permissions granted. Advanced When selected, the Advanced role profile in the Oracle ILOM web interface automatically grants Read Only (o) permissions to all Oracle functions and enables you to assign all or any combination of the following role permissions of interest: • Admin (a) • User Management (u) • Console (c) • Reset and Host Control (r). • Services (s) For definitions of roles granted by the Advanced role profile, see the user role definitions listed in this table under User role permissions granted. User roles User role permissions granted (CLI) (a) Admin (a). Read and write permissions are granted to all Oracle ILOM system management functions with the exception of the functions that would require the Admin to have these additional user roles enabled: User Management (u), Reset and Host Control (r), Console (c), and Services (s). (u) User Management (u). Read and write permissions are granted to a user for all Oracle ILOM user account management functions. (c) Console (c). Read and write permissions are granted to a user to perform these Remote Console management functions: manage Remote Console lock options, manage SP console history log options, launch and use Oracle ILOM Remote Console, and launch and use Oracle ILOM Storage Redirection CLI. (r) Reset and Host Control (r). Read and write permissions are granted to a user to perform these remote host management functions: host boot device control, run and configure diagnostics utilities, reset SP, reset CMM, component management service actions, fault management actions, SPARC TPM management actions, and downloads of SNMP MIBs. (o) Read Only (o). Read only permissions are granted to a user to view the state of all ILOM configuration properties. In addition, write permissions are granted to a user to change only the password and session time-out properties assigned to their own user account. (s) Services (s). Read and write permissions are granted to a user to assist Oracle service engineers if on-site service is required. User Role Descriptions50 Oracle ILOM 3.0 Web Procedures Guide • May 2011 c. In the New Password text box, type a password for this user account. The password must be at least 8 characters and no more than 16 characters. The password is case-sensitive. Use alphabetical, numeric, and special characters for better security. You can use any character except a colon. Do not include spaces in passwords. d. In the Confirm Password text box, retype the password previously entered in the New Password text box. e. Click Save to create the user account. The User Account Settings page refreshes. The newly created user account appears on the User Account Settings page. ? Modify a User Account (Web) Note – You can modify a user account by changing the user’s password, and the user’s network and serial privileges. Before You Begin ¦ To set properties for User Management (user accounts and roles), you need the User Management (u) role enabled. To modify a user account, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> User Accounts. The User Account Settings page appears. 3. In the Users table, enable the radio button next to the user account you want to modify and click Edit. A dialog box appears listing the role assigned. (aucro) A combination of all these users roles (aucro) grant read and write permissions to a user to perform backup and restore configuration functions. Note - aucro is equivalent to the Administrator user role profile in the web interface. User Role DescriptionsManaging User Accounts (Web) 51 4. Modify the role assigned to a user. Note that when the Advanced role is selected, a user can select any of the six available roles. However, if you selected Administrator or Operator, Oracle ILOM will automatically assign the roles. For example, the two following figures identify the roles assigned by Oracle ILOM for Administrator and Operator. 5. In the New Password text box, specify a new password for this user account. The password must be between 8 and 16 characters. The password is case-sensitive. Use alphabetical, numeric, and special characters for better security. You can use any character except a colon. Do not include spaces in passwords. 6. In the Confirm New Password text, retype the password previously entered in the New Password text box. 7. Click Save for the changes to take effect, or click Close to return to the previous settings. The User Account Settings page refreshes with your changes. ? Delete a User Account (Web) Before You Begin ¦ To set properties for User Management (user accounts and roles), you need the User Management (u) role enabled. To delete a user account, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> User Accounts. The User Account Settings page appears. 3. Enable the radio button next to the user account you want to delete. 4. In the Users table, click Delete. A confirmation dialog box appears.52 Oracle ILOM 3.0 Web Procedures Guide • May 2011 5. Click OK to delete the account or click Cancel to stop the deletion process. The User Account Settings page refreshes. ? View User Sessions (Web) 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> Active Sessions. The Active Sessions page appears listing the name of the user account, user role assigned, session start-time, session type, and the session mode. Configuring SSH Keys (Web) ? Add an SSH Key (Web) Note – The SSH key settings in Oracle ILOM enable you to automate password authentication. Before You Begin ¦ To change other user SSH keys, you need the User Management (u) role enabled. However, you can configure your own SSH key with the Read Only (o) role enabled. To add an SSH key, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> User Accounts. The User Accounts Setting page appears. Description Links Platform Feature Support Manage SSH key settings in the Oracle ILOM web interface • “Add an SSH Key (Web)” on page 52 • “Delete an SSH Key (Web)” on page 54 • x86 system server SP • SPARC system server SP • CMMManaging User Accounts (Web) 53 3. In the User Account Settings page, scroll down to the SSH table and click Add. The SSH key add screen appears. 4. In the User drop-down list, select the name of the user account. 5. In the Transfer Method drop-down list, select a transfer method. The following transfer methods are available: ¦ Browser ¦ TFTP ¦ FTP ¦ SFTP ¦ SCP ¦ HTTP ¦ HTTPS 6. If you select the Browser transfer method, click Browse and browse to the location of the SSH key. Proceed to Step 9. 7. If you select the TFTP transfer method, the prompts shown in the following figure appear and you must provide the following information, then proceed to Step 9: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to which to save the configuration file in the format: directoryPath/filename.54 Oracle ILOM 3.0 Web Procedures Guide • May 2011 8. If you select the SCP, FTP, SFTP, HTTP, or HTTPS transfer method, the prompts shown in the next figure, appear and you must provide the following information, then proceed to Step 9: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to which to save the configuration file in the format: directoryPath/filename. ¦ Username – Enter the user name of your account on the remote system. ¦ Password – Enter the password for your account on the remote system. 9. To add the SSH key to the selected user account, click Load. The SSH key is added to the user account. ? Delete an SSH Key (Web) Note – The SSH key settings in Oracle ILOM enable you to automate password authentication. Before You Begin ¦ To change other user SSH Keys, you need the User Management (u) role enabled. However, you can configure your own SSH Key with the Read Only (o) role enabled. To delete an SSH key, follow these steps:Managing User Accounts (Web) 55 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management--> User Accounts. The User Account Settings page appears. 3. Scroll down to the SSH keys section at the bottom of the page, select a user, and click Delete. A confirmation dialog box appears. 4. Click OK. The SSH key is deleted. Configuring Active Directory (Web) ? View and Configure Active Directory Settings (Web) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. ¦ To configure the Expanded Search Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.4 or later. ¦ To configure the Strict Credential Error Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.10 or later. To view and configure Active Directory settings, follow these steps: Description Links Platform Feature Support Manage and troubleshoot Active Directory settings in the Oracle ILOM web interface • “View and Configure Active Directory Settings (Web)” on page 55 • “Configure Active Directory Tables (Web)” on page 60 • “Troubleshoot Active Directory Authentication and Authorization (Web)” on page 63 • x86 system server SP • SPARC system server SP • CMM56 Oracle ILOM 3.0 Web Procedures Guide • May 2011 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> Active Directory. The Active Directory page appears. There are three sections to the Active Directory page, as shown in the following figures. ¦ The top section, which includes targets and properties: ¦ The middle section, which includes the primary certificate information: ¦ The bottom section, which includes the Active Directory tables:Managing User Accounts (Web) 57 3. Configure the Active Directory settings appearing in the top section of the Active Directory Settings page. See the following table for a description of the Active Directory settings. Property Default Description State Disabled Enabled | Disabled Roles (none) Administrator | Operator | Advanced | none Access role granted to all authenticated Active Directory users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of a, u, c, r, o, and s. For example, aucros, where a=Admin, u=User Management, c= Console, r=Reset and Host Control, o=Read-Only, and s=Service. If you do not configure a role, the Active Directory server is used to determine the role. Address 0.0.0.0 IP address or DNS name of the Active Directory server. If DNS name is used, then DNS must be configured and operational. Port 0 Port used to communicate with the server. If autoselect is selected, the port is set to 0. Available in the unlikely event of a non-standard TCP port being used. Timeout 4 Time-out value in seconds. Number of seconds to wait for individual transactions to complete. The value does not represent the total time of all transactions because the number of transactions can differ depending on the configuration. This property allows for tuning the time to wait when a server is not responding or is unreachable.58 Oracle ILOM 3.0 Web Procedures Guide • May 2011 4. Click Save in the top section of the Active Directory settings page for your settings to take effect. Strict Certificate Mode Disabled Enabled | Disabled If enabled, the server certificate contents are verified by digital signatures at the time of authentication. Certificate must be loaded before Strict Certificate Mode can be set to enabled. DNS Locator Mode Disabled Enabled | Disabled If enabled, an attempt to locate the Active Directory server is performed, based on the DNS locator queries that are configured. Expanded Search Mode Disabled Enabled | Disabled As of Oracle ILOM 3.0.4, an expanded search mode is available. When enabled, you can use the expanded search mode to control the search for user entries. Different searches are attempted if the more specific userPrincipleName search does not immediately succeed. If disabled, the userPrincipleName is expected to have a fully qualified domain name (FQDN) suffix. Strict Credential Error Mode Disabled Enabled | Disabled As of Oracle ILOM 3.0.10, the Strict Credential Error Mode is available. If the mode is set to disabled (cleared check box), user-credential errors are retried on other servers that are available (either configured through the alternate server table or found by DNS queries). The disabled state allows users from separate, disjoint domains to log in to Oracle ILOM as long as that domain authentication server is available. If the mode is set to enabled (checked check box), a credential error reported from any server fails those user credentials after the first authentication attempt showing the user-credential error. Log Detail None None | High | Medium | Low Specifies the amount of diagnostics that go into the event log. Property Default DescriptionManaging User Accounts (Web) 59 5. View the Active Directory certificate information in the middle section of the Active Directory settings page. See the following table for a description of Active Directory certificate settings. 6. If Strict Certificate Mode is enabled, perform the following steps: Note – If Strict Certificate Mode is disabled, data will continue to be protected but a certificate is not required to be uploaded. a. Complete the “Certificate File Upload” section by specifying the required parameters to upload the certificate file. b. Click the Load Certificate button. Property Displays Description Certificate File Status Certificate not present Read-only indicator of whether a certificate exists. Certificate File Status Certificate present (details) Click the (details) link to view certificate information about issuer, subject, serial number, valid from, valid to, and version. Transfer Method Required Parameters Browser File Name TFTP Host Filepath FTP Host Filepath Username Password SCP Host Filepath Username Password60 Oracle ILOM 3.0 Web Procedures Guide • May 2011 c. When the certificate is loaded, click the “details” link to show the following information. ? Configure Active Directory Tables (Web) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. ¦ To configure the Expanded Search Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.4 or later. ¦ To configure the Strict Credential Error Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.10 or later. To configure Active Directory tables, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> Active Directory. The Active Directory page appears. 3. At the top of the Active Directory page, click the link to access the category of table you want to configure: ¦ Admin Groups ¦ Operator Groups ¦ Custom Groups ¦ User Domains ¦ Alternate Servers ¦ DNS Locator Queries 4. Enable the radio button of the individual table, and then click Edit. Item Description Issuer Certificate Authority who issued the certificate. Subject Server or domain for which the certificate is intended. Valid From Date when the certificate becomes valid. Valid Until Date when the certificate becomes invalid. Serial Number Serial number of the certificate. Version Version number of the certificate.Managing User Accounts (Web) 61 5. Enter the required data into the tables. In the following tables, default data shows the expected format of the Active Directory data. ¦ Admin Groups table: The Admin Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. ¦ Operator Groups table: The Operator Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. ¦ Custom Groups table: The Custom Groups table contains the names of the Microsoft Active Directory groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. The associated roles for the entry are also configured. ¦ User Domains table: User domains are the authentication domains used to authenticate a user. When the user logs in, the name used is formatted in the specific domain name format. User authentication is attempted based on the user name that is entered and the configured user domains. In the example below, the domain listed in entry 1 shows the principle format that is used in the first attempt to authenticate the user. Entry 2 shows the complete Distinguished Name, which Active Directory would use if the attempt to authenticate with the first entry failed. ID Name 1 CN=SpSuperAdmin,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com 2 ID Name 1 CN=SpSuperOper,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com 2 ID Name Roles 1 custom_group_1 Admin, User Management, Console, Reset and Host Control, Read Only (aucro)62 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – In the example below, will be replaced with the user’s login name. During authentication, the user’s login name replaces . ¦ Alternate Servers table: The Alternate Servers table provides redundancy as well as a choice of different servers if required due to isolated domains. If a certificate is not supplied, but is required, the top-level primary certificate is used. The alternate servers have the same rules and requirements as the top-level certificate mode. Each server has its own certificate status, and its own certificate command to retrieve the certificate if it is needed. The following image shows an Alternate Servers table with a certificate present in ID 2: The following certificate information is displayed when you click on the “details” link: ID Domain 1 @sales.east.oracle.com 2 CN=,CN=Users,DC=sales,DC=east,DC=oracle,DC=com ID Address Port Certificate Status 1 - 0 certificate not present 2 10.8.136.165 0 certificate present (details) Item Description Issuer Certificate Authority who issued the certificate. Subject Server or domain for which the certificate is intended.Managing User Accounts (Web) 63 ¦ DNS Locator Queries Table: The DNS Locator Queries table queries DNS servers to learn about the hosts to use for authentication. The DNS Locator service query identifies the named DNS service. The port ID is generally part of the record, but you can override it by using the format . Also, named services specific for the domain being authenticated can be specified by using the substitution marker. Note – DNS and DNS Locator Mode must be enabled for DNS Locator Queries to work. 6. Click Save for your changes to take effect. ? Troubleshoot Active Directory Authentication and Authorization (Web) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. ¦ To configure the Expanded Search Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.4 or later. ¦ To configure the Strict Credential Error Mode property, the server or CMM must be running Oracle ILOM firmware version 3.0.10 or later. To troubleshoot the active directory authentication and authorization, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. Valid From Date when the certificate becomes valid. Valid Until Date when the certificate becomes invalid. Serial Number Serial number of the certificate. Version Version number of the certificate. Name Domain 1 _ldap._tcp.gc._msdcs.. 2 _ldap._tcp.dc._msdcs..64 Oracle ILOM 3.0 Web Procedures Guide • May 2011 2. Click User Management --> Active Directory. The Active Directory page appears. 3. In the Log Detail drop-down list, select the level of detail that you would like the event log to capture. Choices are None, High, Medium, Low, and Trace. 4. Click Save to save your changes. 5. Attempt an authentication to generate events. Follow these steps: a. From the System Monitoring tab select Event Logs. b. In the Filter drop-down list, select Custom Filter. c. In the Event Class drop-down list, select ActDir. d. Click OK. All Active Directory events will appear in the event log.Managing User Accounts (Web) 65 Configuring Lightweight Directory Access Protocol (LDAP) ? Configure LDAP Server Settings (Web) Before You Begin ¦ To modify the LDAP Server settings in Oracle ILOM, you need the User Management (u) role enabled. To configure the LDAP Server settings, follow these steps: 1. Ensure that all user accounts authenticating to Oracle ILOM have user account passwords stored in a crypt format. Oracle ILOM only supports LDAP authentication for passwords stored in one of the following two variations of crypt formats. userPassword: {CRYPT}ajCa2He4PJhNo or userPassword: {CRYPT}$1$pzKng1$du1Bf0NWBjh9t3FbUgf46. 2. Add object classes posixAccount and shadowAccount, and populate the required property values for this schema (RFC 2307). See the following table for a description of the required property values. Description Links Platform Feature Support Manage LDAP settings in the Oracle ILOM web interface • “Configure LDAP Server Settings (Web)” on page 65 • “Configure Oracle ILOM for LDAP (Web)” on page 66 • x86 system server SP • SPARC system server SP • CMM Required Property Description uid User name for logging in to Oracle ILOM uidNumber Any unique number gidNumber Any unique number66 Oracle ILOM 3.0 Web Procedures Guide • May 2011 3. Configure the LDAP server to enable LDAP server access to Oracle ILOM user accounts. Either enable your LDAP server to accept anonymous binds, or create a proxy user on your LDAP server that has read-only access to all user accounts that will authenticate through Oracle ILOM. See your LDAP server documentation for more details. ? Configure Oracle ILOM for LDAP (Web) Before You Begin ¦ To modify LDAP settings in Oracle ILOM, you need the User Management (u) role enabled. To configure Oracle ILOM for LDAP, follows these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> LDAP. The LDAP Settings page appears. 3. In the LDAP settings page, specify values for the following properties: ¦ State – Click the Enabled check box to authenticate LDAP users. ¦ Role – In the Role drop-down list, specify a default LDAP user role (Administrator, Operator. or Advanced roles). ¦ Address – In the Address text box, type the IP address or the DNS host name for the LDAP server. ¦ Port – In the Port text box, accept the default LDAP port number (389) or modify the default port number. ¦ Searchbase – In the Searchbase text box, type the branch of your LDAP server to search for users. ¦ Bind DN – In the Bind DN text box. type the Distinguished Name (DN) of a read-only proxy user on the LDAP server. Oracle ILOM must have read-only access to your LDAP server to search and authenticate users. ¦ Bind Password – In the Bind Password text box, type the password of the read-only user. userPassword Password homeDirectory Any value (this property is ignored by Oracle ILOM) loginShell Any value (this property is ignored by Oracle ILOM) Required Property DescriptionManaging User Accounts (Web) 67 4. Click Save for your changes to take effect. 5. To verify that LDAP authentication works, log in to Oracle ILOM using an LDAP user name and password. Note – Oracle ILOM searches local users before LDAP users. If an LDAP user name exists as a local user, Oracle ILOM uses the local account for authentication. Configuring LDAP/SSL Settings (Web) ? View and Configure LDAP/SSL Settings (Web) Before You Begin ¦ To modify LDAP/SSL settings in Oracle ILOM, you need the User Management (u) role enabled. ¦ To modify the Optional User Mapping property, the server must be running Oracle ILOM firmware version 3.0.4 or later. To view and configure LDAP/SSL settings, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> LDAP/SSL. The LDAP/SSL page appears. There are three sections to the LDAP/SSL page. ¦ The top section, which includes targets and properties: Description Links Platform Feature Support Manage LDAP/SSL settings in the Oracle ILOM web interface • “View and Configure LDAP/SSL Settings (Web)” on page 67 • “Configure LDAP/SSL Tables (Web)” on page 71 • “Troubleshoot LDAP/SSL Authentication and Authorization (Web)” on page 74 • x86 system server SP • SPARC system server SP • CMM68 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ¦ The middle section, which includes certificate information: ¦ The bottom section, which includes the LDAP/SSL tables:Managing User Accounts (Web) 69 3. Configure the LDAP/SSL settings displayed in the top section of the LDAP/SSL Settings page. See the following table for a description of the LDAP/SSL settings. Property (Web) Default Description State Disabled Enabled | Disabled Roles (none) Administrator | Operator | Advanced | (none) Access role granted to all authenticated LDAP/SSL users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of a, u, c, r, o and s. For example, aucros, where a=Admin, u=User Management, c= Console, r=Reset and Host Control, o=Read-Only, and s=Service. If you do not configure a role, the LDAP/SSL server is used to determine the role. Address 0.0.0.0 IP address or DNS name of the LDAP/SSL server. Port 0 Port used to communicate with the server. If autoselect option is enabled, then the port is set to 0. Available in the unlikely event of a non-standard TCP port being used. Timeout 4 Time-out value in seconds. Number of seconds to wait for individual transactions to complete. The value does not represent the total time of all transactions because the number of transactions can differ depending on the configuration. This property allows for tuning the time to wait when a server is not responding or is unreachable.70 Oracle ILOM 3.0 Web Procedures Guide • May 2011 4. Click Save in the top section of the LDAP/SSL settings page to save any changes made to this section. 5. View the LDAP/SSL certificate information in the middle section of the LDAP/SSL settings page. See the following table for a description of LDAP/SSL certificate settings. 6. If Strict Certificate Mode is enabled, perform the following steps: Note – When Strict Certificate Mode is disabled, the data will continue be protected but a certificate is not required. Strict Certificate Mode Disabled Enabled | Disabled If enabled, the server certificate contents are verified by digital signatures at the time of authentication. Certificate must be loaded before Strict Certificate Mode can be set to enabled. Optional User Mapping Disabled Enabled | Disabled As of Oracle ILOM 3.0.4, optional user mapping is available. If enabled, alternative attributes other than the Distinguished Name (DN) can be used for user credential authentication. Use this property to convert a simple user login name to the DN for user credential validation. Click edit to enable and modify the User Attribute Mapping Parameters dialog, then click Save. Log Detail None None | High | Medium | Low Specifies the amount of diagnostics that go into the event log. Property Displays Description Certificate File Status Certificate not present Read-only indicator of whether a certificate exists. Certificate File Status Certificatepres ent (details) Click the (details) link to view certificate information about the issuer, subject, serial number, valid from, valid to, and version. Property (Web) Default DescriptionManaging User Accounts (Web) 71 a. Complete the “Certificate File Upload” section by specifying the following required parameters for uploading the certificate file b. To upload the certificate, click the Load Certificate button. c. When the certificate is loaded, click the (details) to view the following information about the certificate: ? Configure LDAP/SSL Tables (Web) Before You Begin ¦ To modify LDAP/SSL settings in Oracle ILOM, you need the User Management (u) role enabled. ¦ To modify the Optional User Mapping property, the server must be running Oracle ILOM firmware version 3.0.4 or a later. To configure LDAP/SSL tables, follow these steps: Transfer Method Required Parameters Browser File Name TFTP Host Filepath FTP Host Filepath Username Password SCP Host Filepath Username Password Item Description Issuer Certificate Authority who issued the certificate. Subject Server or domain for which the certificate is intended. Valid From Date when the certificate becomes valid. Valid Until Date when the certificate becomes invalid. Serial Number Serial number of the certificate. Version Version number of the certificate.72 Oracle ILOM 3.0 Web Procedures Guide • May 2011 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> LDAP/SSL. The LDAP/SSL page appears. 3. At the bottom of the LDAP/SSL page, click the link to access the category of table you want to configure: ¦ Admin Groups ¦ Operator Groups ¦ Custom Groups ¦ User Domains ¦ Alternate Servers 4. Enable the radio button of the individual table, and then click Edit. 5. Enter the required data in the tables. In the following tables, default data shows the expected format of the LDAP/SSL data. ¦ Admin Groups table: The Admin Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format. ¦ Operator Groups table: The Operator Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format. ¦ Custom Groups table: ID Name 1 CN=SpSuperAdmin,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com 2 ID Name 1 CN=SpSuperOper,OU=Groups,DC=sales,DC=east,DC=oracle,DC=com 2Managing User Accounts (Web) 73 The Custom Groups table contains the names of the LDAP/SSL groups in the Distinguished Name (DN) format, Simple Name format, or NT-Style Name. The associated roles for the entry are also configured. The name listed in entry 1 uses the Simple Name format. ¦ User Domains table: User domains are the authentication domains used to authenticate a user. When the user logs in, the name used is formatted in the specific domain name format. User authentication is attempted based on the user name that is entered and the configured user domains. Entry 1 shows the complete Distinguished Name, which LDAP/SSL would use if the attempt to authenticate the first entry failed. ¦ Alternate Servers table: The Alternate Servers table provides redundancy for authentication. If a certificate is not supplied, but is required, the top-level primary certificate is used. The alternate servers have the same rules and requirements as the top-level certificate mode. Each server has its own certificate status, and its own certificate command to retrieve the certificate if it is needed. The following image shows an Alternate Servers table with a certificate present in ID 2: ID Name Roles 1 custom_group_1 Admin, User Management, Console, Reset and Host Control, Read Only (aucro) ID Domain 1 UID=,OU=people,DC=oracle,DC=com 2 ID Address Port Certificate Status 1 - 0 certificate not present 2 - 0 certificate not present 3 10.7.143.246 0 certificate present (details)74 Oracle ILOM 3.0 Web Procedures Guide • May 2011 The following information is displayed when you click on the “details” link: ? Troubleshoot LDAP/SSL Authentication and Authorization (Web) Before You Begin ¦ To modify LDAP/SSL settings in Oracle ILOM, you need the User Management (u) role enabled. ¦ To modify the Optional User Mapping property, the server must be running Oracle ILOM firmware version 3.0.4 or a later. To troubleshoot LDAP/SSL authentication, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> LDAP/SSL. The LDAP/SSL page appears. 3. In the Log Detail drop-down list, select the level of detail that you would like the event log to capture. Choices are None, High, Medium, Low, and Trace. 4. Click Save to save your changes. Item Description Issuer Certificate Authority who issued the certificate. Subject Server or domain for which the certificate is intended. Valid From Date when the certificate becomes valid. Valid Until Date when the certificate becomes invalid. Serial Number Serial number of the certificate. Version Version number of the certificate.Managing User Accounts (Web) 75 5. Attempt an authentication to generate events, by performing these steps: a. Select System Monitoring --> Event Logs. b. In the Filter drop-down list, select Custom Filter. c. In the Event Class drop-down list, select LdapSsl. d. Click OK for your changes to take effect. All LDAP/SSL events will appear in the event log.76 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring RADIUS (Web) ? Configure RADIUS Settings (Web) Before You Begin Description Links Platform Feature Support Manage RADIUS settings in the Oracle ILOM web interface • “Configure RADIUS Settings (Web)” on page 76 • x86 system server SP • SPARC system server SP • CMMManaging User Accounts (Web) 77 ¦ To modify the RADIUS settings in Oracle ILOM, you must have the User Management (u) role enabled. To modify the RADIUS settings, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click User Management --> RADIUS. The RADIUS Settings page appears. 3. In the RADIUS Settings page, specify values for the following web properties: Property (Web) Default Description State Disabled Enabled | Disabled Specifies whether the RADIUS client is enabled or disabled. Role Operator Administrator | Operator | Advanced Roles Access role granted to all authenticated RADIUS users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of a, u, c, r, o, and s. For example, aucros, where a=Admin, u=User Management, c= Console, r=Reset and Host Control, o=Read Only, and s= Service.78 Oracle ILOM 3.0 Web Procedures Guide • May 2011 4. Click Save for your changes to take effect. Address 0.0.0.0 IP address or DNS name of the RADIUS server. If the DNS name is used, DNS must be configured and functional. Port 1812 Specifies the port number used to communicate with the RADIUS server. The default port is 1812. Shared Secret (none) Specifies the shared secret that is used to protect sensitive data and to ensure that the client and server recognize each other. Property (Web) Default Description79 Managing Component Status and Service Actions (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, fault management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage component status and service actions Description Links Web procedures for viewing and managing system component information and service actions. • “View Component Status Information (Web)” on page 80 • “Prepare to Remove a Component (Web)” on page 81 • “Return a Component to Service (Web)” on page 82 • “Enable or Disable Components (Web)” on page 82 • “Clear Faults Detected by Oracle ILOM (Web)” on page 8380 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View Component Status Information (Web) To view component status information, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click System Information --> Components. The Component Management page appears. 3. When a component is faulted, a radio button will appear to the left of the component name. Click on the radio button to check the fault status. If a radio button does not appear next to a component’s name, click on the name of a component to verify the status. A dialog box appears with information about the selected component. See the following figure.Managing Component Status and Service Actions (Web) 81 ? Prepare to Remove a Component (Web) Before You Begin ¦ To manage system component operations in Oracle ILOM, the Reset and Host Control (r) role must be enabled. To prepare the removal of a system component, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Select System Information --> Components. The Component Management page appears. 3. Select the radio button next to the component that you want to remove. Components without radio buttons cannot be removed. 4. From the Actions drop-down list, select Prepare to Remove.82 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Return a Component to Service (Web) Before You Begin ¦ To manage system component operations in Oracle ILOM, the Reset and Host Control (r) role must be enabled. Follow these steps to return a component to service: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Select System Information --> Components. The Component Management page appears. 3. Select the radio button next to the component you want to return to service. 4. From the Actions drop-down list, select Return to Service. ? Enable or Disable Components (Web) Before You Begin ¦ To manage system component operations in Oracle ILOM, the Reset and Host Control (r) role must be enabled. To enable or disable components, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Select System Information --> Components. The Component Management page appears. 3. Select the radio button next to the component you want to enable or disable. 4. From the Actions drop-down list, select either Enable or Disable. The component is enabled or disabled, depending on your selection.Managing Component Status and Service Actions (Web) 83 ? Clear Faults Detected by Oracle ILOM (Web) Before You Begin ¦ To clear faults in Oracle ILOM, you need the Admin (a) role enabled, and the server SP or CMM must be running Oracle ILOM firmware version 3.0.3 or later. To view or clear faults using the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. To view the status of faulted components detected by Oracle ILOM, do the following: a. Click System Information --> Fault Management. The Fault Management page appears, listing faulted components by ID, FRU, and time-stamp. b. To view additional information about the faulted component, click the faulted component ID. Additional information about the faulted component appears in a dialog. Note – Alternatively, you can view the fault status for a component in the Component Management page. In the Component Management page, select the component name to view the fault status information. 3. Fix or replace the faulted component in the system. After fixing or replacing the faulted component, you should clear the fault status in Oracle ILOM. 4. To clear the status of faulted components shown in Oracle ILOM, do the following: a. Click the System Information --> Components tab. b. In the Component Management page, enable the radio button next to the faulted component, and then click Clear Faults.84 Oracle ILOM 3.0 Web Procedures Guide • May 201185 Monitoring System Sensors and Managing the Event Log (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, system monitoring and alert management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitor system sensors, indicators, and event logs ¦ Oracle ILOM 3.0 Protocol Management Reference, inventory and component management Description Links View sensor properties from Oracle ILOM • “View Sensor Readings (Web)” on page 86 Manage system indicators, clock, and time-zone settings in Oracle ILOM • “Configure System Indicators (Web)” on page 86 • “Configure Clock Settings (Web)” on page 87 • “Configure Time Zone Settings (Web)” on page 88 Filter, view, clear, and configure event logs from Oracle ILOM • “Filter Event Log Output (Web)” on page 88 • “View and Clear Oracle ILOM Event Log (Web)” on page 90 • “Configure Remote Syslog Receiver IP Addresses (Web)” on page 9286 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View Sensor Readings (Web) To view sensor readings in Oracle ILOM, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click System Monitoring --> Sensor Readings. The Sensor Readings page appears. Note – If the server is powered off, many components will appear as “no reading.” 3. In the Sensor Readings page, do the following: a. Locate the name of the sensor you want to configure. b. Click the name of the sensor to view the property values associated with that sensor. For specific details about the type of discrete sensor targets you can access, as well as the paths to access them, consult the user documentation provided with the Sun server platform. ? Configure System Indicators (Web) Before You Begin ¦ To configure the indicator state in Oracle ILOM, you need the User Management (u) role enabled. To configure the system indicator states, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click System Monitoring --> Indicators. The Indicators page appears. Note – If the server is powered off, many indicators will appear as “no reading.” 3. In the Indicators page, perform the following steps:Monitoring System Sensors and Managing the Event Log (Web) 87 a. Locate the name of the indicator you want to configure. b. To change the state of an indicator, click the radio button associated with the indicator that you want to change. Then in the Actions list box and select either Turn LED Off or Set LED to Fast Blink. A dialog appears prompting you to confirm the change. c. Click OK to confirm the change. ? Configure Clock Settings (Web) Before You Begin ¦ To set clock settings in Oracle ILOM, you need the Admin (a) role enabled. ¦ You need the IP address of your NTP server to complete this procedure. To configure the clock settings, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Clock. The Clock Settings page appears. 3. In the Clock Settings page, do one of the following: ¦ View the existing settings. ¦ Manually configure the date and time of the host server SP. See Step 4. ¦ Synchronize the date and time of the host server SP with an NTP server. See Step 5. 4. To manually set the date and time of the host server SP, follow these steps: a. In the Date text box, type the date in the format mm/dd/yy. b. In the Time list boxes, set the hour and minutes. c. Go to Step 6. 5. To configure an IP address of an NTP server and enable synchronization, follow these steps: a. Click the Enabled check box next to Synchronize Time Using NTP. b. In the Server 1 text box, type the IP address of the primary NTP server you want to use.88 Oracle ILOM 3.0 Web Procedures Guide • May 2011 c. (Optional) In the Server 2 text box, type the IP address of the secondary NTP server you want to use. 6. Click Save for your changes to take effect. Refer to your Oracle Sun server platform user documentation for platform-specific clock information about whether: ¦ The current time in Oracle ILOM persists across reboots of the SP. ¦ The current time in Oracle ILOM can be synchronized with the host at host boot time. ¦ There is a real-time clock element that stores the time. ? Configure Time Zone Settings (Web) Before You Begin ¦ To set clock time-zone settings in Oracle ILOM, you need the Admin (a) role enabled. To configure a property value for the time-zone setting, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Timezone. The Timezone Settings page appears. 3. In the Timezone drop-down list, specify the appropriate time-zone setting. Consult your Oracle Sun server platform user documentation for platform-specific clock information about whether: ¦ The current time in Oracle ILOM persists across reboots of the SP. ¦ The current time in Oracle ILOM can be synchronized with the host at host boot time. ¦ There is a real-time clock element that stores the time. ? Filter Event Log Output (Web) To filter Oracle ILOM event log output, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface.Monitoring System Sensors and Managing the Event Log (Web) 89 2. Click System Monitoring --> Event Logs. The Event Log page appears. 3. In the Filter list box on the Event Log page, click one of the following standard filters: ¦ All Events ¦ Class: Fault ¦ Type: Action ¦ Severity: Down ¦ Severity: Critical 4. Alternatively, you can specify the following parameters for a Custom Filter. Event Class Event Type Severity Developer Log Debug Email Connection Down Captive Shell Send Critical Backup Command Entered Major Restore State Minor Reset Action Chassis Fault90 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View and Clear Oracle ILOM Event Log (Web) Before You Begin ¦ To clear the Oracle ILOM event log, you need the Admin (a) role enabled. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click System Monitoring --> Event Logs. The Event Log page appears. 3. In the Event Log page, perform any of the following: ¦ Page through entries – Use the page navigation controls at the top and the bottom of the table to navigate forward and back through the available data in the table. Note that selecting a greater number of entries might cause the web interface to respond slower than selecting a fewer number of entries. Audit Repair IPMI Warning Fault System ActDir Event Class Event Type SeverityMonitoring System Sensors and Managing the Event Log (Web) 91 ¦ View the entries in the display by scrolling through the list – The following table provides descriptions about each column appearing in the log. ¦ Clear the event log – To clear the event log, click the Clear Event Log button. A confirmation dialog appears. In the confirmation dialog, click OK to clear the entries. Note – The Oracle ILOM event log accumulates many types of events, including copies of IPMI entries. Clearing the Oracle ILOM event log clears all entries in the log, including the IPMI entries. However, clearing the Oracle ILOM event log entries will not clear the actual entries posted directly to an IPMI log. Column Label Description Event ID The number of the event, in sequence from number 1. Class/Type • Audit/ Log – Commands that result in a configuration change. Description includes user, command, command parameters, and success/fail. • IPMI/Log – Any event that is placed in the IPMI SEL is also put in the management log. • Chassis/State – For changes to the inventory and general system state changes. • Chassis/Action – Category for shutdown events for server module/chassis, hot insert/removal of a FRU, and Reset Parameters button pressed. • Fault/Fault – For Fault Management faults. Description gives the time the fault was detected and suspect component. • Fault/Repair – For fault repairs. Description gives component. Severity Debug, Down, Critical, Major, or Minor. Date/Time The day and time the event occurred. If the Network Time Protocol (NTP) server is enabled to set the Oracle ILOM time, the Oracle ILOM clock will use Universal Coordinated Time (UTC). Description A description of the event.92 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Configure Remote Syslog Receiver IP Addresses (Web) Before You Begin ¦ To set remote syslog receiver IP addresses, you need the Admin (a) role enabled. To configure the remote syslog receiver IP addresses, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Syslog. The Syslog page appears. 3. In the IP Address 1 and 2 fields, type the IP addresses for the two locations to which you want to send syslog data. 4. Click Save for your settings to take effect.93 Monitoring Storage Components and Zone Manager (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, storage monitoring ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitoring storage components ¦ Oracle ILOM 3.0 CMM Administration, zone manager Description Links View and monitor storage details for HDDs and RAID controllers • “Requirements for Monitoring Storage Components” on page 94 • “View and Monitor RAID Controller Details (Web)” on page 94 • “View and Monitor Details for Disks That Are Attached to RAID Controllers (Web)” on page 96 • “View and Monitor RAID Controller Volume Details (Web)” on page 98 Manage Zone Manager settings for SAS-2 storage devices that are installed in Sun Blade 6000 or 6048 series modular systems • “Enabling or Disabling Zone Manager for SAS-2 Storage Devices” on page 9994 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Requirements for Monitoring Storage Components ¦ Some Oracle servers might not enable support for the storage monitoring functions that are described in this chapter. To determine whether the storage monitoring feature is enabled on your platform server, see the platform Oracle ILOM supplement guide or the platform server administration guide. ¦ For Oracle servers supporting the storage monitoring feature, you must download and install a hardware management pack prior to using the storage monitoring features in Oracle ILOM. For information about how to download this hardware management pack, see Oracle Server Hardware Management Pack User’s Guide. ¦ The server must be running Oracle ILOM firmware version 3.0.8 or a later version. ¦ For conceptual information and examples on viewing and monitoring storage components, see the Oracle ILOM 3.0 Daily Management Concepts Guide. ? View and Monitor RAID Controller Details (Web) Before You Begin ¦ Review the “Requirements for Monitoring Storage Components” on page 94. To view and monitor RAID controller details, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, click Storage --> RAID --> Controllers. The Controller Monitoring page appears listing the configuration details for the RAID controllers installed on your system.Monitoring Storage Components and Zone Manager (Web) 95 3. To access additional details about an installed RAID controller, do the following: ¦ To access FRU properties and values, click the RAID controller name. A dialog appears listing the RAID controller FRU properties and values. ¦ To access topology information about a RAID controller, select the radio button next to the RAID controller name, then click Show Topology. The topology details for that RAID controller appear.96 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View and Monitor Details for Disks That Are Attached to RAID Controllers (Web) Before You Begin ¦ Review the “Requirements for Monitoring Storage Components” on page 94. To view and monitor details about storage disks attached to RAID controllers, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, click Storage --> RAID --> Disks. The Disks Monitoring page appears listing the configuration details for the disks attached to RAID controllers.Monitoring Storage Components and Zone Manager (Web) 97 3. To view the FRU properties and values associated with a disk, click the disk name. A dialog appears listing the disk FRU properties and values.98 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View and Monitor RAID Controller Volume Details (Web) Before You Begin ¦ Review the “Requirements for Monitoring Storage Components” on page 94. To view and monitor RAID controller volume details, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, click Storage --> RAID --> Volumes. The Volume Monitoring page appears listing the configuration details for the RAID volumes configured on the RAID controllers. 3. To view the FRU properties and values associated with a volume, click the volume name. A dialog appears listing the volume properties and values.Monitoring Storage Components and Zone Manager (Web) 99 Enabling or Disabling Zone Manager for SAS-2 Storage Devices If you are using Oracle Sun Blade 6000 or Sun Blade 6048 Modular Systems, a new zone management feature was added as of Oracle ILOM 3.0.10. The zone management feature is available for SAS-2 storage devices that are installed in Oracle Sun Blade 6000 or Sun Blade 6048 Modular Systems. For more information about how to manage SAS-2 chassis storage devices from Oracle ILOM, refer to the Oracle ILOM 3.0 CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems.100 Oracle ILOM 3.0 Web Procedures Guide • May 2011101 Managing System Alerts and Email Notifications (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, system monitoring and alert management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage system alerts ¦ Oracle ILOM 3.0 Protocol Management Reference, inventory and component management Description Links Identify requirements for managing system alerts • “Managing Alert Rule Configurations (Web)” on page 102 Notify recipient of a system alerts using email • “Configuring SMTP Client for Email Notification Alerts (Web)” on page 105102 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Managing Alert Rule Configurations (Web) Requirements for Configuring Alert Rules ¦ If you are defining an Email Notification alert, the outgoing email server used to send the email notification must be configured in Oracle ILOM. If an outgoing email server is not configured, Oracle ILOM will not be able to successfully generate Email notifications. ¦ If you are defining an SNMP v3 trap alert, the SNMP user name must be defined in Oracle ILOM as an SNMP user. If the user is not defined as an SNMP user, the receiver of the SNMPv3 alert will not be able to decode the SNMP alert message. ¦ To manage alert rule configurations, you need the Admin (a) role enabled. ¦ To issue a test email alert from Oracle ILOM, the platform server or CMM must be running Oracle ILOM firmware version 3.0.4 or a later firmware version. ? Create or Edit Alert Rules (Web) Before You Begin ¦ Review the “Requirements for Configuring Alert Rules” on page 102. T o configure alert rules in the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. Description Links Platform Feature Support Identify requirements for managing alerts • “Requirements for Configuring Alert Rules” on page 102 • x86 system server SP • SPARC system server SP • CMM Manage alert rule configurations • “Create or Edit Alert Rules (Web)” on page 102 • “Disable an Alert Rule (Web)” on page 104 • “Send Test Alert for Specific Alert Rules (Web)” on page 104Managing System Alerts and Email Notifications (Web) 103 2. Click Configuration --> Alert Management. The Alert Settings page appears. 3. In the Alert Settings page, do the following: a. Enable the radio button for the alert rule you want to create or edit. b. In the Actions list box, select Edit. A dialog appears displaying the property values associated with the alert rule. c. In the properties dialog box, specify values for an alert type, alert level, and alert destination. If the alert type you specify is for IPMI Pet, you need to define an IPMI Pet destination address. If the alert type you specify is for SNMP trap, you need to define an SNPMP destination address and port, as well as the SNMP version and community name. If the alert type you specify is for Email, you need to define a destination email address, and, if applicable, optional settings for filters and custom send options. Note – You can specify one destination address for each alert rule type. For more information about the property values you can specify for an alert rule, refer to section about alert management in the Oracle ILOM 3.0 Daily Management Concepts Guide. d. Click Save to apply the values specified and to close the properties dialog.104 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Disable an Alert Rule (Web) Before You Begin ¦ Review the “Requirements for Configuring Alert Rules” on page 102. To disable an alert rule in the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Alert Management. The Alert Settings page appears. 3. In the Alert Settings page, enable the radio button for the alert rule you want to disable, and then in the Actions list box, click Edit. A dialog appears presenting properties you can define about the alert rule. 4. In the properties dialog box, click Disabled in the Alert Levels list box. 5. Click Save to apply your changes and to close the properties dialog. ? Send Test Alert for Specific Alert Rules (Web) Before You Begin ¦ Review the “Requirements for Configuring Alert Rules” on page 102. To send a test email alert for one or more alert rules, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> Alert Management. 3. In the Alert Settings page, perform the following steps to send a test email alert: a. Enable the radio button next to each alert rule that you want to test. b. Click the Test Rule button to send a text email alert to the alert rule destination. Note – For each alert rule, one of the following alert types can be configured: IPMI PET destination address, Email destination address, and SNMP trap destination address. To configure the alert type, refer to “Create or Edit Alert Rules (Web)” on page 102.Managing System Alerts and Email Notifications (Web) 105 Configuring SMTP Client for Email Notification Alerts (Web) ? Enable SMTP Client for Email Alerts (Web) Before You Begin ¦ To enable SMTP clients, you need the Admin (a) role enabled. ¦ To generate configured email notification alerts, you must enable the Oracle ILOM client to act as an SMTP client to send the email alert messages. ¦ Prior to enabling the Oracle ILOM client as an SMTP client, determine the IP address and port number of the outgoing SMTP email server that will process the email notification. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> SMTP Client. The SMTP Client page appears. 3. In the SMTP Client page, specify the following settings to enable the sending of Email Notification alerts. 4. Click Save to apply the SMTP settings. Description Links Platform Feature Support Notify recipient of system alerts using email • “Enable SMTP Client for Email Alerts (Web)” on page 105 • x86 system server SP • SPARC system server SP • CMM SMTP Setting Description SMTP State Enable the SMTP State check box. SMTP Server IP Type the IP address of the outgoing SMTP email server that will process the email notifications. SMTP Port Type the port number of the outgoing SMTP email server.106 Oracle ILOM 3.0 Web Procedures Guide • May 2011107 Power Monitoring and Management of Hardware Interfaces (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, power consumption ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, monitor and manage power consumption ¦ Oracle ILOM 3.0 Protocol Management Reference, monitor and manage power consumption Description Links Identify power monitoring and management feature updates per Oracle ILOM firmware point release • “Summary of Power Management Feature Updates (Web)” on page 108 Perform power monitoring and management of hardware interfaces from Oracle ILOM • “Monitoring System Power Consumption (Web)” on page 110 • “Configuring Power Policy Settings to Manage Server Power Usage (Web)” on page 114 • “Configuring Power Consumption Threshold Notifications (Web)” on page 118 • “Monitoring and Configuring Component Power Allocation Distributions (Web)” on page 119 • “Configuring Server Power Limit Properties (Web)” on page 130 • “Monitoring or Configuring CMM Power Supply Redundancy (Web)” on page 133108 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Summary of Power Management Feature Updates (Web) The following table identifies power management feature enhancements and documentation updates made since Oracle ILOM 3.0. TABLE: Power Management Feature Updates New or Enhanced Feature Firmware Point Release Documentation Updates For Updated Web Procedures, See: Monitor power consumption metrics Oracle ILOM 3.0 • New terms and definitions for power management metrics • New System Monitoring --> Power Management Consumption Metric properties • New CLI and web procedures added for monitoring device power consumption • “Monitoring System Power Consumption (Web)” on page 110 Configure power policy properties Oracle ILOM 3.0 • New power policy properties explained. • New CLI and web procedures added for configuring power policy settings • “Configuring Power Policy Settings to Manage Server Power Usage (Web)” on page 114 Monitor power consumption history Oracle ILOM 3.0.3 • New power consumption history metrics • New CLI and web procedures added for monitoring power consumption • “Monitor Power History Statistics (Web)” on page 112 Configure power consumption notification thresholds Oracle ILOM 3.0.4 • New power consumption notification threshold settings • New CLI and web procedures added for configuring the power consumption thresholds • “Configuring Power Consumption Threshold Notifications (Web)” on page 118 Monitor allocation power distribution metrics Oracle ILOM 3.0.6 • New component allocation distribution metrics • New CLI and web procedures added for monitoring power allocations • New CLI and web procedures added for configuring permitted power for blade slots • “Monitoring and Configuring Component Power Allocation Distributions (Web)” on page 119 Configure power budget properties Oracle ILOM 3.0.6 • New power budget properties • New CLI and web procedures added for configuring power budget properties • “Configuring Server Power Limit Properties (Web)” on page 130Power Monitoring and Management of Hardware Interfaces (Web) 109 Configure power supply redundancy properties for CMM systems Oracle ILOM 3.0.6 • New power supply redundancy properties for CMM systems • New CLI and web procedures added for configuring power supply redundancy properties on CMM systems • “Monitoring or Configuring CMM Power Supply Redundancy (Web)” on page 133 Server power Allocation tab replaces Distribution tab Oracle ILOM 3.0.8 • Oracle ILOM web Allocation tab replaces Distribution tab for server SPs • New web procedure added for viewing server power allocation properties • “Monitoring and Configuring Component Power Allocation Distributions (Web)” on page 119 Server Limit tab Replaces Budget tab Oracle ILOM 3.0.8 • Oracle ILOM web Limit tab replaces Budget tab for server SPs • New web procedure added for configuring power limit properties • “Configuring Server Power Limit Properties (Web)” on page 130 Web interface layout update for CMM power management Oracle ILOM 3.0.10 • New top-level tab added to Oracle ILOM web interface for power management • Revised Oracle ILOM web Power Consumption tab properties for CMMs • Oracle ILOM web Allocation tab replaces Distribution tab for CMMs • Power Management Metrics tab removed from CMM Oracle ILOM web interface • Updated web procedure for configuring a grant limit for blade slots (previously known as allocatable power) • “Monitor System Power Consumption (Web)” on page 111 • “View CMM Component Power Allocations” on page 123 • “Configure Grant Limit for Blade Slots in CMM as of Oracle ILOM 3.0.10” on page 128 • “View CMM Component Power Allocations” on page 123 Power Management Statistic tab Oracle ILOM 3.0.14 • The Power Statistics table on the History tab was moved to a Power Management --> Statistics tab • “Monitor Power History Statistics (Web)” on page 112 TABLE: Power Management Feature Updates (Continued) New or Enhanced Feature Firmware Point Release Documentation Updates For Updated Web Procedures, See:110 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Monitoring System Power Consumption (Web) Requirements for Monitoring Power Consumption (Web) Prior to performing the procedures described in this section, you should ensure that the following requirements are met: ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the web interface enhancements described in the section about system power consumption metrics in the Oracle ILOM 3.0 Daily Management Concepts Guide. Note – The power consumption features described in this section might not be implemented on the platform server or CMM that you are using. To determine whether the power consumption features described in this section are supported on your server or CMM, see the Oracle ILOM supplement or administration guide provided for your server or CMM. Description Links Platform Feature Support Review the prerequisites for monitoring system power consumption. • “Requirements for Monitoring Power Consumption (Web)” on page 110 • x86 server SP • SPARC server • CMM Monitor power consumption properties from Oracle ILOM. • “Monitor System Power Consumption (Web)” on page 111 • “Monitor Individual Power Supply Consumption (Web)” on page 112 Monitor power consumption history from Oracle ILOM • “Monitor Power History Statistics (Web)” on page 112Power Monitoring and Management of Hardware Interfaces (Web) 111 ¦ To access the power consumption metrics provided in Oracle ILOM the server must be running Oracle ILOM firmware version 3.0 or later. To access the power consumption history metrics provided in Oracle ILOM, the server must be running Oracle ILOM firmware version 3.0.3 or later. To access the enhanced power consumption properties and the threshold notification properties provided in Oracle ILOM, the server must be running Oracle ILOM firmware version 3.0.4 or later. Note – Power consumption history is provided using the Oracle ILOM CLI and web interfaces. This information is not available through IPMI or SNMP. ? Monitor System Power Consumption (Web) Before You Begin ¦ Review the “Requirements for Monitoring Power Consumption (Web)” on page 110. To monitor the total system power consumption, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface. 2. In the Oracle ILOM web interface, do one of the following: ¦ If the server or CMM is running Oracle ILOM firmware version 3.0.3 or later, click Power Management -->Consumption. ¦ If the server or CMM is running an earlier firmware version that is prior to Oracle ILOM 3.0.3, click System Monitoring --> Power Management. The Power Consumption page appears. Note – The ability to monitor power varies depending on the platform server implementation for this feature. Refer to the Oracle ILOM supplement or platform administration guide for platform-specific details or procedures about this feature. 3. In the Power Consumption page, you can view power metrics provided for actual power, target limit, and peak permitted. Note – The properties on the Power Consumption page were updated for server SPs as of Oracle ILOM firmware version 3.0.8, and for CMMs as of Oracle ILOM firmware version 3.0.10. For more information about these properties, refer to the section about web enhancements for power metrics in the Oracle ILOM 3.0 Daily Management Concepts Guide.112 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Monitor Individual Power Supply Consumption (Web) ? See the instructions for viewing sensors in“View Sensor Readings (Web)” on page 86. ? Monitor Power History Statistics (Web) Before You Begin ¦ Review the “Requirements for Monitoring Power Consumption (Web)” on page 110. To monitor the power history statistics, follow these steps: 1. Log in to Oracle ILOM SP or CMM web interface. 2. In the Oracle ILOM web interface, do one of the following: ¦ If the server or CMM is running Oracle ILOM firmware prior to Oracle ILOM 3.0.3, click System Monitoring --> Power Management, and then click the Power History link.Power Monitoring and Management of Hardware Interfaces (Web) 113 ¦ If the server or CMM is running Oracle ILOM firmware version 3.0.3 or later, click Power Management --> History. ¦ If the server or CMM is running Oracle ILOM firmware version 3.0.14 or later, click Power Management --> Statistics to view the power statistics, or click Power Management --> History to view the power history. Refer to the section about power monitoring terminology in the Oracle ILOM 3.0 Daily Management Concepts Guide for definitions describing the power monitoring history terms. Note – The Statistic table available on the History tab as of Oracle ILOM firmware version 3.0.3 was moved to the Statistic tab in Oracle ILOM firmware version 3.0.14. CMM Power History Example 3. To view a sample data set of power consumed by a device for a specific duration, click the link appearing under the Sample Set column in the Power History table.114 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring Power Policy Settings to Manage Server Power Usage (Web) Requirements for Configuring the Power Policy (Web) Prior to performing the procedures described in this section, you should ensure that the following requirements are met: ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the web interface enhancements described in the section about power policy settings in the Oracle ILOM 3.0 Daily Management Concepts Guide. Note – The power policy features described in this section might not be implemented on the platform server that you are using. To determine whether the power policy features described in this section are supported on your server, refer to the Oracle ILOM supplement or administration guide provided for your server. ¦ To configure the power consumption policy properties in Oracle ILOM for x86 servers, you must have Admin (a) role privileges enabled, and the server must be running Oracle ILOM firmware version 3.0.3 or earlier. Description Links Platform Feature Support Review the prerequisites for configuring the power policy and usage properties • “Requirements for Configuring the Power Policy (Web)” on page 114 • x86 server SP • SPARC servers Configure policy to control power consumption • “Configure Power Consumption Policy (Web)” on page 115 • x86 server SP (prior to Oracle ILOM 3.0.4) • SPARC servers Configure policy to control power capping • “Configure Server Power Policy For Power Capping (Web)” on page 116 • x86 server SP • SPARC serversPower Monitoring and Management of Hardware Interfaces (Web) 115 ¦ To configure the power consumption policy properties in Oracle ILOM for SPARC servers, you must have Admin (a) role privileges enabled, and the server must be running Oracle ILOM firmware version 3.0 or later. ¦ To configure the policy for powering capping on the Limit tab of the web interface, you must have Admin (a) role privileges enabled, and the server must be running Oracle ILOM firmware version 3.0.8 or later. ? Configure Power Consumption Policy (Web) Before You Begin ¦ Review the “Requirements for Configuring the Power Policy (Web)” on page 114. To configure the power consumption policy for an Oracle Sun server, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, do one of the following: ¦ If the server is running firmware earlier than Oracle ILOM 3.0.3, click System Monitoring --> Power Management to view the Power Policy settings. Note – The Power Policy settings on the Power Management Consumption page were removed from the Oracle ILOM web interface for x86 servers as of Oracle ILOM 3.0.4. ¦ If the server is running Oracle ILOM firmware version 3.0.4 or later on a SPARC server, click Power Management --> Settings to view the Power Policy settings. 3. In the Power Policy list box, click either Performance or Elastic. ¦ Performance – The system is allowed to use all of the power that is available. ¦ Elastic – The system power usage is adapted to the current utilization level. For example, the system will power up or down just enough system components to keep relative utilization at 70 percent at all times, even if workload fluctuates.116 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – The Power Policy settings were removed in Oracle ILOM 3.0.4 from the web and CLI interface for x86 servers. 4. To apply the new setting, click Save. ? Configure Server Power Policy For Power Capping (Web) Before You Begin ¦ Review the “Requirements for Configuring the Power Policy (Web)” on page 114. To configure the server power limit for power capping, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, click Power Management --> Limit.Power Monitoring and Management of Hardware Interfaces (Web) 117 3. In the Power Limit page, configure the policy settings for power capping as described in the following table. Note – For best power capping performance, the default values are recommended for all advanced server power limit properties. 4. To apply the power limit property changes, click Save. Property Description Policy The Policy property enables you to configure the power capping policy. In the Policy property, specify which of the following types of power capping you want to apply: • Soft - Only cap if actual power exceeds target limit. If you enabled the soft cap option, you can configure the grace period for capping actual power to within the target limit. - System default. This option, when selected, applies the default optimum grace period property values that is specified by the platform server. or - Custom. This option, when selected, applies the grace period property value specified by the user. • Hard - Fixed cap keeps peak permitted power under target limit. If you enable this hard cap option, power capping is permanently set on the server without a grace period. Violation Actions The Violation Actions property enables you to specify the settings you want Oracle ILOM to take if the power target limit is not achieved within the specified power policy grace period. You can choose to specify one of the following actions: • None. If you enable this option and the power target limit is not achieved, Oracle ILOM will display a status error message to notify you that Oracle ILOM is unable to achieve the power capping limit specified. or • Hard Power Off. If you enable this option and the power target limit is not achieved, Oracle ILOM takes the following actions: * Displays a status error message. * Initiates a hard-power-off of the server. Note - The default option for Violation Actions is None.118 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring Power Consumption Threshold Notifications (Web) ? View and Configure Notification Thresholds Using the Web Interface Before You Begin ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ The platform server or CMM must be running Oracle ILOM firmware version 3.0.4 or later. ¦ You must have the Admin (a) role enabled in Oracle ILOM to modify the power consumption configuration variables. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. In the web interface page, click Power Management --> Consumption. The Power Consumption page appears. 3. In the Power Consumption page, perform the following steps: a. Click (check) the Enabled check box for Notification Threshold (1) or (2). b. Based on your system requirements, type a notification threshold wattage value in the Watts text box. c. To apply these changes, click Save. Description Links Platform Feature Support View or configure power consumption notification thresholds from Oracle ILOM • “View and Configure Notification Thresholds Using the Web Interface” on page 118 • x86 servers • SPARC servers • CMMPower Monitoring and Management of Hardware Interfaces (Web) 119 Monitoring and Configuring Component Power Allocation Distributions (Web) Requirements for Power Allocation Distributions (Web) ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the conceptual information about Component Allocation Power Distribution in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ The platform server or the CMM must be running Oracle ILOM firmware version 3.0.6 or later. Where noted, some procedures described in this section require the server SP or CMM to be running Oracle ILOM firmware version 3.0.10 or later. ¦ You must have the admin (a) role enabled in Oracle ILOM to modify power consumption or allocation configuration property values. Note – As of Oracle ILOM firmware version 3.0.8, the server SP Power Management --> Distribution tab was renamed to Allocation. As of Oracle ILOM firmware version 3.0.10, the CMM Power Management --> Distribution tab was renamed to Allocation. Description Links Platform Feature Support Review the prerequisites for configuring the component power allocations • “Requirements for Power Allocation Distributions (Web)” on page 119 • x86 servers • SPARC servers • CMM View component allocation metrics for server or CMM • “View Server Component Power Allocations (Web)” on page 120 • “View CMM Component Power Allocations” on page 123 • x86 servers • SPARC servers • CMM Configure permitted power for blade slots in chassis • “Configure Permitted Power for Blade Slots in CMM as of Oracle ILOM 3.0.6” on page 126 • “Configure Grant Limit for Blade Slots in CMM as of Oracle ILOM 3.0.10” on page 128 • CMM120 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? View Server Component Power Allocations (Web) Before You Begin ¦ Review the “Requirements for Power Allocation Distributions (Web)” on page 119. To review the server component power allocations, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the web interface, do one of the following: ¦ If the server is running ILOM firmware version 3.0.6, click Power Management --> Distribution. ¦ If the server is running Oracle ILOM firmware version 3.0.8 or later, click Power Management --> Allocation. The Power Distribution or Power Allocation Plan page appears.Power Monitoring and Management of Hardware Interfaces (Web) 121 3. In the allocation power tables, view the following system power requirements for power capacity planning: ¦ System Power Map – This table reflects the total power allocated value in wattage for the following system power properties: Allocated Power, Installed Hardware Minimum, Peak Permitted Power, and Target Limit. ¦ Per Component Power Map – This table reflects the allocated power wattage value for each server component category (for example, memory) and each server component (for example ME_PO_D0). It also identifies whether the allocated power value can be capped. ? Configure Server Power Limit Properties as of Oracle ILOM 3.0.8 (Web) Before You Begin ¦ Review the “Requirements for Power Allocation Distributions (Web)” on page 119. To set power limit properties for servers running Oracle ILOM firmware version 3.0.8 or later, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, click Power Management --> Limit tabs. Note – The Power Management --> Distribution tab was renamed to Limit as of Oracle ILOM 3.0.8. The Power Limit page appears.122 Oracle ILOM 3.0 Web Procedures Guide • May 2011 3. In the Power Limit page, view or modify any of the following power limit properties. Note – For best power capping performance, the default values are recommended for all advanced server power limit properties. Power Limit Property Description Power Limiting Enable this property to enable the power limit configuration. Target Limit Set a target limit in watts or as a percentage. This value should reflect a range between the installed hardware minimum power and the allocated power. Note - You can view the installed hardware minimum power value and the allocated power value on the power management --> allocation tab. Policy The Policy property enables you to configure the power capping policy. In the policy property, specify which of the following types of power capping you want to apply: • Soft - Only cap if actual power exceeds target limit. If you enabled the soft cap option, you can configure the grace period for capping actual power to within the target limit. - System Default. This option, when selected, applies the default optimum grace period property values that is specified by the platform server. or - Custom. This option, when selected, applies the grace period property value specified by the user. • Hard - Fixed cap keeps peak permitted power under target limit. If you enable the hard cap option, power capping is permanently applied without a grace period. Violation Actions The Violation Actions property enables you to specify the settings you want Oracle ILOM to take if the power target limit cannot be achieved within the set grace period. You can choose to specify one of the following actions: • None. If you enable this option and the power target limit is not achieved, Oracle ILOM will display a status error message to notify you that Oracle ILOM is unable to achieve the power capping limit specified. or • Hard Power Off. If this option is chosen and the power target limit is not achieved, Oracle ILOM takes the following actions: * Display a status error message. * Initiates a hard-power-off of the server. Note - The default option for Violation Actions is None.Power Monitoring and Management of Hardware Interfaces (Web) 123 4. To apply the power limit property changes, click Save. ? View CMM Component Power Allocations Before You Begin ¦ Review the “Requirements for Power Allocation Distributions (Web)” on page 119. To view the CMM component power allocations in the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM CMM web interface. 2. In the left pane of the CMM web interface page, select CMM then do one of the following: ¦ If the CMM is running Oracle ILOM firmware version 3.0.6 or later, select the Power Management --> Distribution tabs. ¦ If the CMM is running Oracle ILOM firmware version 3.0.10 or later, select Power Management --> Allocation tabs. Note – The CMM Power Management --> Distribution tab was renamed to Allocation in Oracle ILOM firmware version 3.0.10. The CMM Power Allocation Plan page appears.124 Oracle ILOM 3.0 Web Procedures Guide • May 2011 3. In the CMM Power Allocation page, view the power allocation values.Power Monitoring and Management of Hardware Interfaces (Web) 125 ¦ For Oracle ILOM firmware version 3.0.6 or later, the CMM power allocation values appear as follows: Updated Property Name Details Allocated Power Total power allocated value in wattage for all power-consuming CMM components in the system chassis. Allocatable Power Total remaining power (watts) available from CMM to allocate to blade slots. Blade Slot Power Distribution View power allocation values for: • Allocated Power – Total power (watts) allocated to the server module (blade) in this slot. The CMM always allocates enough power to handle an unengaged I/O server module, whether or not an I/O server module is present. • Permitted Power – Maximum power allocation permitted for a server module in this blade slot. Note - To modify the permitted power allocated to a server module slot, refer to the “Configure Permitted Power for Blade Slots in CMM as of Oracle ILOM 3.0.6” on page 126. Component Power Distribution View allocated power for each non-blade component in the system.126 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ¦ For Oracle ILOM firmware version 3.0.10 or later, the CMM power allocation values appear as follows: ? Configure Permitted Power for Blade Slots in CMM as of Oracle ILOM 3.0.6 Before You Begin ¦ Review the “Requirements for Power Allocation Distributions (Web)” on page 119. To configure the permitted blade slot power in the Oracle ILOM web interface, follow these steps: 1. Log in to the Oracle ILOM CMM web interface. 2. In the left pane of the web interface page, click CMM, and then click Power Management --> Distribution. 3. Scroll down to the Blade Slot Power Distribution table. Updated Property Name Details Grantable Power (renamed property) Allocatable Power in Oracle ILOM 3.0.6 was renamed to Grantable Power in Oracle ILOM firmware version 3.0.10. Grantable Power indicates the total remaining power (watts) available from the CMM to allocate to blade slots without exceeding grant limit. Grant Limit (renamed property) Permitted Power in Oracle ILOM 3.0.6 was renamed to Grant Limit in Oracle ILOM firmware version 3.0.10. Grant Limit represents the maximum power the system will grant to a blade slot. For instructions for setting the grant limit on a blade, see “Configure Permitted Power for Blade Slots in CMM as of Oracle ILOM 3.0.6” on page 126. Granted Power (renamed property) Allocated Power in Oracle ILOM 3.0.6 was renamed to Granted Power in Oracle ILOM firmware version 3.0.10. Granted Power represents the sum of the maximum power consumed by either a single server component (such as a memory module), a category of server components (all memory modules), or all server power-consuming components.Power Monitoring and Management of Hardware Interfaces (Web) 127 4. In the Blade Slot Power Distribution table, do the following. a. Enable the radio buttons next to the blade slots that you want to modify. b. Click Edit. A dialog appears listing information about the Allocated and Permitted Power value. c. In the dialog, modify the Permitted Power value, and then click Save. Note – To prevent server module from powering-on, you can set the Permitted Power value to 0.128 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Configure Grant Limit for Blade Slots in CMM as of Oracle ILOM 3.0.10 Before You Begin ¦ Review the “Requirements for Power Allocation Distributions (Web)” on page 119. To configure the blade slot grant limit in the Oracle ILOM CMM web interface, follow these steps: 1. Log in to the Oracle ILOM CMM web interface. 2. In the left pane of the web interface page, select CMM, and then in the right pane of the web interface page, click Power Management --> Allocation. The CMM Power Allocation page appears. 3. Scroll down to the Blade Slot Grants table. 4. In the Blade Slot Grants table, do the following. a. Enable the radio buttons next to the blade slot that you want to modify. b. Click Edit. A dialog appears listing power configuration information for the blade.Power Monitoring and Management of Hardware Interfaces (Web) 129 c. In the Grant Limit list box, choose to use the default slot maximum grant limit (1200 watts), or click Custom and type a power grant value and click Save. Note – To prevent the blade from powering-on, you can set the Grant Limit value to 0. Configuring Server Power Limit Properties (Web) ? Configure Server Power Limit Properties (Web) Before You Begin Description Links Feature Platform Support Manage server power limit properties from Oracle ILOM • “Configure Server Power Limit Properties (Web)” on page 130 • x86 Server SP • SPARC Server130 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the conceptual information about server power limit (or server power budget) in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ The platform server must be running Oracle ILOM firmware version 3.0.6 or later to configure the server power limit properties. ¦ You must have the admin (a) role enabled in Oracle ILOM to modify power management configuration property values. Note – As of Oracle ILOM firmware version 3.0.8, the server SP Power Management --> Budget tab was renamed to Limit. 1. Log in to the Oracle ILOM SP web interface. 2. In the Oracle ILOM web interface, do one of the following: ¦ If the platform server is running Oracle ILOM firmware version 3.0.6, click Power Management --> Budget. ¦ If the platform server is running Oracle ILOM firmware version 3.0.8 or later, click Power Management --> Limit. 3. In the Power Limit page, view or modify the power limit properties described in the following table. Power Limit Property Description Power Limiting Enable this property to enable the power limit configuration. Note - Power limiting was previously named Activation State on the Budget tab in Oracle ILOM 3.0.6. Target Limit Set a target limit in watts or as a percentage. This value should reflect a range between the Installed Hardware Minimum Power and the Allocated Power. Note - In Oracle ILOM firmware version 3.0.6, the Budget tab option for Target Limit was previously named Power Limit. Note - You can view the installed hardware minimum power value and the allocated power value on the Power Management --> Allocation tab.Power Monitoring and Management of Hardware Interfaces (Web) 131 Note – For best power capping performance, the default values are recommended for all advanced server power limit properties. Status Error Message The status error message read-only property only appears on the Limit page when Oracle ILOM fails to achieve the power limit that was configured. Note - The status error message read-only property was previously named Status on the Budget tab in Oracle ILOM firmware version 3.0.6. Policy The Policy property enables you to configure the power capping policy. In the Policy property, specify which of the following types of power capping you want to apply: • Soft - Only cap if actual power exceeds Target Limit. If you enabled the soft cap option, you can configure the grace period for capping actual power to within the target limit. - System Default. This option, when selected, applies the default optimum grace period property values that is specified by the platform server. or - Custom. his option, when selected, applies the grace period property value specified by the user. • Hard - Fixed cap keeps Peak Permitted power under Target Limit. If you enable the hard cap option, power capping is permanently applied without a grace period. Note - The Policy was previously named Time Limit on the Budget tab in Oracle ILOM firmware version 3.0.6. Violation Actions The Violation Actions property enables you to specify the settings you want Oracle ILOM to take if the power target limit is not achieved within the set grace period. You can choose to specify one of the following actions: • None. If you enable this option and the power target limit is not achieved, Oracle ILOM will display a status error message to notify you that Oracle ILOM is unable to achieve the power capping limit specified. or • Hard-Power Off. If you enable this option and the power target limit is not achieved, Oracle ILOM takes the following actions: * Display a status error message. * Initiates a hard-power-off of the server. Note - The default option for Violation Actions is None. Power Limit Property Description132 Oracle ILOM 3.0 Web Procedures Guide • May 2011 4. To apply the power limit property changes, click Save. Monitoring or Configuring CMM Power Supply Redundancy (Web) ? View or Configure CMM Power Supply Redundancy Properties (Web) Before You Begin ¦ Review the power monitoring terminology defined in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the conceptual information about power supply redundancy for CMM systems in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ The server must be running Oracle ILOM firmware version 3.0.6 or later to configure the CMM power supply redundancy properties. ¦ You must have the admin (a) role enabled in Oracle ILOM to modify power management configuration property values. To view or configure the CMM power supply redundancy property values, follow these steps: 1. Log in to the Oracle ILOM CMM web interface. 2. In the left pane of the CMM web interface, click CMM, and then in the right pane of the web interface page, click Power Management --> Redundancy. The Power Management Redundancy page appears. 3. In the Redundancy page, view or configure the properties.: ¦ Power Supply Redundancy Policy – Select the number of power supplies to allocate for redundancy. Description Links Feature Platform Support Manage CMM power supply redundancy properties from Oracle ILOM • “View or Configure CMM Power Supply Redundancy Properties (Web)” on page 133 • CMMPower Monitoring and Management of Hardware Interfaces (Web) 133 ¦ None – To reserve no power supplies. ¦ N+N – To reserve half of the power supplies. Note – When you change the redundancy policy, this change affects the amount of power the CMM is permitted to allocate to server modules (blades). The chassis Permitted Power is set to the power that the available power supplies can provide minus the redundant power available. In addition, when there is no redundant power available to the system, a loss of a power supply will cause the system to reduce the Permitted Power. If the system reduces the permitted power below the power that had already been allocated, you should immediately take steps to turn off the server modules to reduce the allocated power. ¦ Redundant Power – This value is provided by the system. It represents the available power that is not allocated. 4. To apply the changes made, click Save.134 Oracle ILOM 3.0 Web Procedures Guide • May 2011135 Managing Remote Hosts Redirection and Securing the Oracle ILOM Remote Console (Web) Related Information ¦ Oracle ILOM 3.0 Remote Redirection Consoles, remote host management Options ¦ Oracle ILOM 3.0 Remote Redirection Consoles, manage remote hosts storage Redirection ¦ Oracle ILOM 3.0 Remote Redirection Consoles, secure the Oracle ILOM Remote Console Description Links Details for locating instructions for using the Oracle ILOM Remote Console. • “Web Procedures for Redirecting Remote Host KVMS” on page 136136 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Web Procedures for Redirecting Remote Host KVMS The Oracle ILOM Remote Console, available from the web interface, provides remote redirection for the following devices: keyboard, video, mouse, and storage devices. To use the Oracle ILOM Remote Console, you must have the Console (c) role enabled in Oracle ILOM. As of ILOM 3.0.16, the information describing how to use Oracle ILOM Remote Console was moved to the Oracle ILOM 3.0 Remote Redirection Consoles CLI and Web Guide. For detailed instructions for using the Oracle ILOM Remote Console, refer to these topics: ¦ Oracle ILOM 3.0 Remote Redirection Consoles, initial set up tasks to support the Oracle ILOM Remote Console ¦ Oracle ILOM 3.0 Remote Redirection Consoles, redirecting devices using the Oracle ILOM Remote Console ¦ Oracle ILOM 3.0 Remote Redirection Consoles, securing the Oracle ILOM Remote Console.137 Managing Remote Hosts Power States (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, remote host management options ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage remote hosts power states ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage BIOS boot device ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage host server console Description Links Control the power state of a remote server module or CMM • “Controlling Power States From Remote Server SP or CMM (Web)” on page 138 Control x86 Host boot device settings • “Managing Host Control of Boot Device on x86 Systems (Web)” on page 140138 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Controlling Power States From Remote Server SP or CMM (Web) ? Control Power State of Remote Host Server Using Server SP (Web) Before You Begin ¦ To control the power state of the remote host server, you need the Admin (a) role enabled. To control the power state of a remote host server, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click the Remote Power Control tab. The Server Power Control page appears. 3. From the Server Power Control page, you can remotely control the power state of a host server by selecting one of the following options from the Action menu: ¦ Reset – This option immediately reboots the remote host server. ¦ Immediate Power Off – This option immediately turns off the power on the remote host server. ¦ Graceful Shutdown and Power Off – This option shuts down the OS gracefully prior to powering off the remote host server. ¦ Power On (default) – This option turns on full power to the remote host server. ¦ Power Cycle – This option immediately turns off the power on the remote host server, then applies full power to the remote host server. Description Links Platform Feature Support Control the power state of the remote host server • “Control Power State of Remote Host Server Using Server SP (Web)” on page 138 • x86 system server SP • SPARC system server SP Control the power state of the remote CMM • “Control Power State of Remote Chassis Using the CMM Web Interface” on page 139 • CMMManaging Remote Hosts Power States (Web) 139 ? Control Power State of Remote Chassis Using the CMM Web Interface Before You Begin ¦ To control the power state of the remote chassis and its system components, you need the admin (a) role enabled. To control the power state of the chassis and its system components, follow these steps: 1. Log in to the Oracle ILOM CMM web interface. 2. Click the Remote Power Control tab. The Server Power Control page appears. 3. From the CMM Remote Power Control page, you can remotely control the power state of the chassis and its system components by selecting the radio button next to /CH (Chassis) or /CH/BL# (individual blade slot #) then selecting one of the following options from the Action menu: ¦ Immediate Power Off – This option immediately turns off the power to the chassis components, including the blades. ¦ Graceful Shutdown and Power Off – This option attempts to bring the OS down gracefully on the blades, then cuts power to the system components. ¦ Power On – This option gives full power to the chassis and blades, subject to system policies. ¦ Power Cycle – This option powers off the blade, then automatically powers the system back on (not applicable to /CH).140 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Managing Host Control of Boot Device on x86 Systems (Web) Requirements for Host Boot Device (Web) ¦ To modify the host boot device configuration property value, you must have the Reset and Host Control (r) role enabled in Oracle ILOM. ¦ The host control BIOS boot device feature in Oracle ILOM is supported on x86 system SPs. This feature is not supported on the CMM or on SPARC system SPs. For information about Oracle ILOM Host Control boot options on SPARC systems, review to the platform server Oracle ILOM supplement guide or platform administration guide. ? Configure Host Boot Device (Web) Before You Begin ¦ Review the “Requirements for Host Boot Device (Web)” on page 140 To override the BIOS boot device setting from Oracle ILOM web interface, follow these steps:. 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control --> Host Control. The Host Control page appears. Description Link Platform Feature Support Review the prerequisites • “Requirements for Host Boot Device (Web)” on page 140 • x86 system server SP Override host boot device order in BIOS • “Configure Host Boot Device (Web)” on page 140Managing Remote Hosts Power States (Web) 141 3. In the Host Control page, click the Next Boot Device list box and specify a boot device option. Possible boot device options available: ¦ default – Setting the value to default means that there is no override to the BIOS settings. Setting to default will also clear any previously chosen selection. ¦ pxe – Setting the value to pxe means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the network, following the PXE boot specification. ¦ disk – Setting the value to disk means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the first disk as determined by BIOS. The specific disk chosen depends on configuration. Typically, hosts use this option by default and the host's behavior might not change by selecting this option. ¦ diagnostic – Setting the value to diagnostic means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot into the diagnostic partition, if configured. ¦ cdrom – Setting the value to cdrom means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the attached CD-ROM or DVD device. ¦ bios – Setting the value to bios means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot into the BIOS Setup screen. 4. To apply your changes, click Save.142 Oracle ILOM 3.0 Web Procedures Guide • May 2011143 Managing TPM and LDom States on SPARC Servers (Web) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, remote host management options ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage TPM and LDom states on SPARC servers Description Links Control the TPM state on a SPARC server • “Controlling the TPM State on SPARC Servers (Web)” on page 144 Manage Logical Domain (LDom) configurations on SPARC servers • “Managing LDom Configurations on SPARC Servers (Web)” on page 145144 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Controlling the TPM State on SPARC Servers (Web) ? Control TPM State on a SPARC Server (Web) Before You Begin ¦ The TPM feature in Oracle ILOM is available for SPARC servers only. ¦ The SPARC server should be running a version of Oracle Solaris that supports TPM. For more information about configuring TPM support in Oracle Solaris, refer to the Oracle Solaris documentation or the platform documentation shipped with your server. ¦ You must be using Oracle ILOM 3.0.8 or a later version on the SPARC server SP. ¦ You need to have the Reset and Host Control (r) role enabled in Oracle ILOM to modify the TPM settings. To control the TPM state on a SPARC server, following these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click the Remote Control --> TPM tab. The TPM Settings page appears. 3. In the TPM Settings page, do one of the following: ¦ To enable the TPM state and activate this enabled state on the SPARC server the next time it is powered on, select True for the following TPM settings: ¦ Enable – Click (check) the Enable True check box to enable the TPM state on the SPARC server. ¦ Activate – Click (check) the Activate True check box to activate the configuration change on the SPARC server the next time the server powers on. or Description Link Platform Feature Support Control the TPM state on a SPARC server • “Control TPM State on a SPARC Server (Web)” on page 144 • SPARC system server SPManaging TPM and LDom States on SPARC Servers (Web) 145 ¦ To purge (disable) an enabled TPM state on the SPARC server the next time the server powers on, select True for following three TPM settings: ¦ Enable – Clear the Enable True check box to disable the TPM state on the SPARC. ¦ Activate – Click (check) the Activate True check box to activate the configuration change on the SPARC server. ¦ Forceclear – Click (check) the Forceclear True check box to purge the enabled TPM state from the SPARC server the next time the server powers on. Managing LDom Configurations on SPARC Servers (Web) Requirements for SPARC LDom Configurations (Web) To view and manage the Oracle ILOM settings for stored LDom configurations, the following requirements must be met: ¦ You must access Oracle ILOM on a SPARC server that has the appropriate Oracle ILOM point release firmware installed (see Note below). Descriptions Links Platform Feature Support Review the prerequisites • “Requirements for SPARC LDom Configurations (Web)” on page 145 • SPARC system server SP View and manage Oracle ILOM settings for stored LDom configurations • “View Stored LDom Configurations on SPARC T3 Series Server (Web)” on page 146 • “Configure Host Power to Stored LDom Configurations (Web)” on page 147 • “Specify Host Power to a Stored LDom Configuration (Web)” on page 148146 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Note – Oracle ILOM firmware version 3.0.12 or later is required to view the LDom targets and properties from a SPARC T3 Series server. Oracle ILOM firmware version 2.0.0 or later is required to: (1) specify which LDom configuration is used on the host SPARC server, and (2) to manage the boot property values for the control domain from the host SPARC server. ¦ You must have the Oracle VM Server for SPARC (Logical Domains Manager) 2.0 or later software installed on your host SPARC server. ¦ The host SPARC server must have saved LDom configurations. For instructions on how to create and save LDom configurations on a host SPARC server, see the Logical Domains 1.3 Administration Guide. ¦ You must have the Remote Host Reset and Host Control (r) role enabled in Oracle ILOM to modify the LDom host domains property values. ? View Stored LDom Configurations on SPARC T3 Series Server (Web) Before You Begin ¦ Review the “Requirements for SPARC LDom Configurations (Web)” on page 145 To view LDom configurations on a SPARC T3 series server, follow these steps: 1. Log in to the Oracle ILOM web interface on a SPARC T3 Series Server. 2. In the web interface, click Remote Host --> Host Domains. 3. In the Domain Configurations table, you can view a list of LDom Configurations currently saved in LDom Manager.Managing TPM and LDom States on SPARC Servers (Web) 147 4. To commit the changes made on the Host Domain page, click Save. ? Configure Host Power to Stored LDom Configurations (Web) Before You Begin ¦ Review the “Requirements for SPARC LDom Configurations (Web)” on page 145. To configure host power to the stored LDom configurations, follow these steps: 1. Log in to the Oracle ILOM web interface on a SPARC server. 2. In the web interface, click Remote Host --> Host Domains. 3. In the Host Domain page, enable or disable the Auto Boot or Boot Guest check boxes. By default, the Auto Boot check box for the host control domain and guest domains are set to enabled (boots when server is powered-on or reset). Disabling the auto-boot property value on the control domain will prevent automatic reboots and stop the control domain at the OpenBoot ok prompt after the next power-on or reset. Disabling the boot guests property value for the guest domains will prevent the guest domains from booting after the next power-on or reset.148 Oracle ILOM 3.0 Web Procedures Guide • May 2011 ? Specify Host Power to a Stored LDom Configuration (Web) Before You Begin ¦ Review the “Requirements for SPARC LDom Configurations (Web)” on page 145. To specify host power to a stored LDom configuration, follow these steps: 1. Log in to the Oracle ILOM web interface on a SPARC server. 2. In the web interface, click Remote Host --> Host Boot Mode. 3. In the Host Boot Mode Settings page, specify the following information to override the default method the server uses to boot. 4. To commit the changes made on the Host Boot Mode Settings page, click Save. Field Instructions and Description State In the State list box, select one of the following options: • Normal. At next reset, this option will retain the current NVRAM variable settings. • Reset NVRAM. At next reset, this option will return all OpenBoot variables to default settings. The State dictates the boot mode at reset. Note - The Reset NVRAM value will return to normal after the next server reset or 10 minutes. The Config and Script properties do not expire and will be cleared upon the next server reset or manually by leaving the fields blank. Script Specify a boot script. The script controls the host server OpenBoot PROM firmware method of booting. It does not affect the current /HOST/bootmode setting. LDOM Config Specify a saved LDom configuration file name.149 Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues The following topic provides solutions to help resolve common problems when accessing Oracle ILOM using IPv6. ¦ “Diagnosing Oracle ILOM Connection Issues” on page 150150 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Diagnosing Oracle ILOM Connection Issues If you are experiencing difficulties with connecting to Oracle ILOM when using IPv6, use the information provided in TABLE: Common IPv6 Connection Problems and Suggested Resolutions on page 150 to help resolve common problems when accessing Oracle ILOM using IPv6. TABLE: Common IPv6 Connection Problems and Suggested Resolutions IPv6 Common Connection Problems Suggested Resolution Unable to access the Oracle ILOM web interface using an IPv6 address. Ensure that the IPv6 address in the URL is enclosed by brackets, for example: (https://[fe80::221:28ff:fe77:1402]) Unable to download a file using an IPv6 address. Ensure that the IPv6 address in the URL is enabled by brackets, for example: load -source tftp://[fec0:a:8:b7:214:rfff:fe01:851d]desktop.pkg Unable to access Oracle ILOM using IPv6 from a network client. If on a separate subnet, try the following: • Verify that Oracle ILOM has a dynamic or static address (not just a Link-Local address). • Verify that the network client has IPv6 address configured (not just a Link-Local address). If on the same or separate subnet, try the following • Ensure that setting for IPv6 State is enabled on the Network Settings Page in the Oracle ILOM web interface or under the /SP/network/ipv6 target in the Oracle ILOM CLI. • Run ping6 in a restricted shell. • Run traceroute in a restricted shell. Unable to access Oracle ILOM from a client within a dual-stack IPv4 and IPv6 network environment. Ensure that the following settings are enabled: • State. You can enable the setting for State on the Network Settings page in the Oracle ILOM web interface or under the /SP/network target in the CLI. • IPv6 State. You can enable the setting for IPv6 State on the Network Settings page in the Oracle ILOM web interface or under the /SP/network/ipv6 target. Unable to access Oracle ILOM using IPv4 from a network client. Ensure that the setting for State is enabled on the Network Settings page in the Oracle ILOM web interface or under the /SP/network target in the Oracle ILOM CLI.151 Manual Host OS Configuration Guidelines for Local Interconnect Interface The following topic provides guidelines for manually configuring a non-routable IPv4 address for the host OS connection point on the Local Interconnect Interface. ¦ “Configuring Internal USB Ethernet Device on Host OS” on page 152152 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Configuring Internal USB Ethernet Device on Host OS If you chose to manually configure a non-routable IPv4 address for the Oracle ILOM SP connection point on the Local Interconnect Interface, you will also need to manually configure a non-routable IPv4 address for the host OS connection point on the Local Interconnect Interface. General guidelines, per operating system, for configuring a static non-routable IPv4 address for the host OS connection point are provided in the following table. For additional information about configuring IP addresses on the host operating system, consult the vendor operating system documentation.Manual Host OS Configuration Guidelines for Local Interconnect Interface 153 Note – Oracle ILOM will present the internal USB Ethernet device installed on your154 Oracle ILOM 3.0 Web Procedures Guide • May 2011 server as an USB Ethernet interface to the host operating system.Manual Host OS Configuration Guidelines for Local Interconnect Interface 155 TABLE: General Guidelines for Configuring Internal USB Ethernet Device on Host OS Operating System General Guidelines Windows Server 2008 After Windows discovers the internal USB Ethernet device, you will most likely be prompted to identify a device driver for this device. Since no driver is actually required, identifying the .inf file should satisfy the communication stack for the internal USB Ethernet device. The .inf file is available from the Oracle Hardware Management Pack 2.1.0 software distribution. You can download this management pack software from the Oracle software product download page ((www.oracle.com)) as well as extract the .inf file from the Management Pack software. For additional information about extracting the .inf file from the Management Pack software, see the Oracle Server Hardware Management Pack User’s Guide. After applying the .inf file from the Oracle Hardware Management Pack 2.1.0 software distribution, you can then proceed to configure a static IP address for the host OS connection point of the Local Interconnect Interface by using the Microsoft Windows Network configuration option located in the Control Panel (Start --> Control Panel). For more information about configuring an IPv4 address in Windows 2008, see the Microsoft Windows Operating System documentation or the Microsoft Tech Net site ((http://technet.microsoft.com/en-us/library/cc754203%28WS.10%29.a spx)). Linux Most supported Linux operating system installations on an Oracle Sun platform server include the installation of the device driver for an internal Ethernet device. Typically, the internal USB Ethernet device is automatically discovered by the Linux operating system. The internal Ethernet device typically appears as usb0. However, the name for the internal Ethernet device might be different based on the distribution of the Linux operating system. The instructions below demonstrate how to configure a static IP address corresponding to usb0, which typically represents an internal USB Ethernet device found on the server: \>lsusb usb0 \> ifconfig usb0 169.254.182.77 \> ifconfig usb0 netmask 255.255.255.0 \> ifconfig usb0 broadcast 169.254.182.255 \> ifconfig usb0 \> ip addr show usb0 Note - Rather than performing the typical ifconfig steps, it is possible to script the configuration of the interface. However, the exact network scripts vary among the Linux distributions. Typically, the operating version of Linux will have examples to model the network scripts. For more information about how to configure an IP address for device using a Linux operation system, see the Linux operating system documentation.156 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Oracle Solaris Most Oracle Solaris Operating System installations on a Oracle Sun platform server include the installation of the device driver for an internal USB Ethernet device. If this driver was not supported, you can extract this driver from the Oracle Hardware Management Pack 2.1.0 or later software. For information about how to extract the Oracle Solaris-specific OS driver for the Ethernet interface, see the Oracle Server Hardware Management Pack User’s Guide. Typically, the internal USB Ethernet device is automatically discovered by the Oracle Solaris operating system. The internal Ethernet device typically appears as usbecm0. However, the name for the internal Ethernet device might be different based on the distribution of the Oracle Solaris operating system. After the Oracle Solaris Operating System recognizes the local USB Ethernet device, the IP interface for the USB Ethernet device needs to be configured. The following instructions demonstrate how to configure a static IP address corresponding to usbecm0, which typically represents an internal USB Ethernet device found on the server. • Type the following command to plumb the IP interface or unplumb the IP interface: ifconfig usbecm0 plumb ifconfig usbecm0 unplumb • Type the following commands to set the address information: ifconfig usbecm0 netmask 255.255.255.0 broadcast 169.254.182.255 169.254.182.77 • To set up the interface, type: ifconfig usbecm0 up • To bring the interface down, type: ifconfig usbecm0 down • To show the active interfaces, type: ifconfig -a • To test connectivity, ping the Oracle Solaris host or the SP internal USB Ethernet device. ping ping Note - Rather than performing the typical ifconfig steps, it is possible to script the configuration of the interface. However, the exact network scripts can vary among the Oracle Solaris distributions. Typically, the operating version will have examples to model the network scripts. For more information about how to configure a static IP address for a device using the Oracle Solaris Operating System, refer to the Oracle Solaris Operating System documentation. TABLE: General Guidelines for Configuring Internal USB Ethernet Device on Host OS (Continued) Operating System General GuidelinesManual Host OS Configuration Guidelines for Local Interconnect Interface 157 Note – If the internal USB Ethernet device driver was not included in your operating system installation, you can obtain the device driver for the Ethernet device from the Oracle Hardware Management Pack 2.1.0 or later software. For more information about extracting this file from the Management Pack, refer to the Oracle Server Hardware Management Pack User’s Guide.158 Oracle ILOM 3.0 Web Procedures Guide • May 2011159 Index A Active Directory certi?cate, 59 certi?cate ?le upload, 59 con?guring, 55 event class, 64 event class custom ?lter, 64 strict certi?cate mode, 59 tables, 60 Admin Groups, 61 Alternate Servers, 62 Custom Groups, 61 DNS Locator Queries, 63 Operator Groups, 61 User Domains, 61 troubleshooting, 63 Administrator role, 51 alert rules creating or editing, 102 disabling, 104 alerts generating email noti?cation, 105 automatic IP address, 26 B baud rate setting, 35 browser and software requirements, 2 C clock settings con?guring, 87 components enabling and disabling, 82 monitoring, 85 preparing to remove, 81 returning to service, 82 viewing status information, 80 create or edit alert rules, 102 D Distinguished Name (DN) format, 61 Domain Name Service (DNS) viewing and con?guring, 33 E event log custom ?lters, 75 ?ltering output, 88 H host name assigning, 33 host power state controlling, 137, 138 HTTP or HTTPS web access enabling, 36 to 37 L LDAP con?guring ILOM for LDAP, 66 con?guring the LDAP server, 65 object classes, 65 LDAP/SSL admin groups, 72 alternate servers, 72 certi?cate ?le upload, 71 con?gure, 67 custom groups, 72 event class, 75 operator groups, 72 tables, 71 Admin Groups, 72 Alternative Servers, 73160 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Custom Groups, 72 Operator Groups, 72 User Domains, 73 troubleshooting authentication and authorization, 74 user domains, 72 web interface tables, 71 load certi?cate, 71 logging in to ILOM, 17 logging out of ILOM using the web interface, 21 N network settings pending and active properties, 25 viewing and con?guring, 26 O Operator role, 51 P port ID, 63 power consumption monitoring, 110 monitoring individual power supply, 112 monitoring system, 111 pro?le choosing, 48 R RADIUS con?guring, 76 remote hosts managing, 135 managing power states, 137 remote syslog, 92 remove certi?cate, 71 root user account, 19 S Secure Shell (SSH) settings con?guring, 39 enabling or disabling, 39 generating new key, 39 restarting the server, 40 Secure Socket Layer (SSL) certi?cate uploading certi?cate, 38 sensor readings, 86 serial port output switch using ILOM web interface, 36 serial port, internal setting baud rate, 35 session time-out resetting, 47 setting, 47 single sign on con?guring, 46 SMTP client, 105 enabling, 105 SPARC servers managing TPM and LDom states, 143 SSH key, 39 adding, 52 con?guring, 52 deleting, 54 supported transfer methods, 53 browser, 53 FTP, 53 HTTP, 53 HTTPS, 53 SCP, 53 SFTP, 53 TFTP, 53 static IP address, 27 storage components monitoring, 93 system contact ?eld, 33 system identi?er assigning, 33 system identi?er ?eld, 33 system indicators, 86 system location ?eld, 33 T timezone settings con?guring, 88 viewing or setting, 88 U user account adding, 47 assigning roles, 47Index 161 con?guring, 50 deleting, 51 root, 19 user accounts con?gure, 46 user pro?le modifying, 51 user sessions viewing, 52 W web interface buttons, 6 components, 5 overview, 1, 2 supported browsers, 3162 Oracle ILOM 3.0 Web Procedures Guide • May 2011 Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide Part No. E21445-01, May 2011, Revision APlease Recycle Copyright © 2008, 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation xiv ? Download Product Software and Firmware xvi CLI Overview 1 Oracle ILOM CLI — DMTF Server Management Command-Line Protocol User-Interface 2 Oracle ILOM CLI Connection 2 Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI 3 Examples for Entering an IPv6 Address 3 Oracle ILOM CLI Firmware and CLI Prompt 4 Oracle ILOM CLI Management Namespace 4 Oracle ILOM CLI Target Namespace 5 CLI Management Target Namespace 5 DMTF Supported CLP Commands 7 CLI Command Options 8 Server SP — CLI Target Tree 9 Entering CLI Command Syntax and Executing Commands 10 Entering CLI Command Syntax 10 Executing Commands 10 ? Execute Commands Individually 11 ? Execute Combined Commands 11 Common CLI Commands 12 Oracle ILOM 3.0 Properties Versus Oracle ILOM 2.x Properties 17v Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Logging In to ILOM, Displaying Banner Messages, and Setting the CLI Session Time-out 19 Logging In and Out of ILOM and Recovering a Password 20 Before Your Initial Login 20 ? Log In Using the Root Account (CLI) 21 ? Log In to Oracle ILOM With User Account (CLI) 22 ? Log Out of Oracle ILOM CLI 22 ? Recover a Lost Password (CLI) 23 Setting Up Banner Messages and CLI Session Time-Out 24 ? Display Banner Messages on Login Page (CLI) 24 ? Set CLI Session Time-Out Property Value 25 Configuring Network, Secure Shell, and Local Interconnect Settings 27 Configuring Network Settings (CLI) 28 Before You Begin — Network Settings (CLI) 29 ? View and Configure IPv4 Network Settings (CLI) 30 ? Edit Existing IPv4 Addresses (CLI) 31 ? View and Configure Dual-Stack IPv4 and IPv6 Network Settings (CLI) 32 ? Test IPv4 or IPv6 Network Configuration (CLI) 38 ? Assign Host Name and System Identifier (CLI) 39 ? View and Configure DNS Settings (CLI) 40 ? View and Configure Serial Port Settings (CLI) 41 ? Enable HTTP or HTTPS Web Access (CLI) 42 ? Switch Serial Port Output (CLI) 43 Configuring Secure Shell Settings (CLI) 44 ? Establish a Remote SSH Connection (CLI) 44 ? Enable or Disable SSH (CLI) 46 ? View the SSH Authentication Keys (CLI) 46 ? Generate a New SSH Authentication Key (CLI) 47Contents vi ? Restart the SSH Server (CLI) 47 Configuring the Local Interconnect Interface (CLI) 48 Local Interconnect Requirements (CLI) 48 ? Configure Local Interconnect Interface Between Server SP and Host OS(CLI) 49 Managing User Accounts (CLI) 55 Configuring User Accounts (CLI) 56 ? Configure Single Sign On (CLI) 56 ? Add a User Account (CLI) 56 ? Change a User Account Password (CLI) 57 ? Assign Roles to a User Account (CLI) 57 ? Delete a User Account (CLI) 59 ? View Individual User Accounts (CLI) 59 ? View a List of User Accounts (CLI) 60 ? View a List of User Sessions (CLI) 60 ? View an Individual User Session (CLI) 61 Configuring SSH User Keys (CLI) 62 ? Add an SSH Key 62 ? Delete an SSH Key (CLI) 63 Configuring Active Directory (CLI) 64 ? Enable Active Directory strictcertmode (CLI) 64 ? Check Active Directory certstatus (CLI) 65 ? Remove an Active Directory Certificate (CLI) 66 ? View and Configure Active Directory Settings (CLI) 67 ? Troubleshoot Active Directory Authentication and Authorization (CLI) 74 Configuring Lightweight Directory Access Protocol (LDAP) (CLI) 75 ? Configure the LDAP Server (CLI) 75 ? Configure Oracle ILOM for LDAP (CLI) 76vii Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring LDAP/SSL (CLI) 77 ? Enable LDAP/SSL strictcertmode 77 ? Check LDAP/SSL certstatus 78 ? Remove an LDAP/SSL Certificate (CLI) 79 ? View and Configure LDAP/SSL Settings (CLI)P 79 ? Troubleshoot LDAP/SSL Authentication and Authorization (CLI) 84 Configuring RADIUS (CLI) 85 ? Configure RADIUS (CLI) 85 Managing Component Status and Service Actions (CLI) 89 ? View Component Information (CLI) 90 ? Prepare to Remove a Component (CLI) 91 ? Return a Component to Service (CLI) 92 ? Enable and Disable Component State (CLI) 92 ? View and Clear Faults (CLI) 93 Monitoring System Sensors and Managing the Event Log (CLI) 95 Monitoring System Sensors, Indicators, and Oracle ILOM Event Logs (CLI) 96 ? View Sensor Readings (CLI) 96 ? Configure System Status Indicators (CLI) 98 ? Configure Clock Properties (CLI) 99 ? Filter Oracle ILOM Event Log List (CLI) 100 ? Scroll, Dismiss, or Clear the Oracle ILOM Event Log List 100 ? Configure Remote Syslog Receiver IP Addresses (CLI) 102 ? View and Manage SP Console Log Output (CLI) 103 Monitoring Storage Components and Zone Manager 107 ? Monitor Storage Component Details on x86 Servers (CLI) 108 Accessing Sun Blade Zone Manager Functions 112Contents viii Managing System Alerts (CLI) 117 Managing Alert Rule Configurations (CLI) 118 Requirements - Alert Rules (CLI) 118 ? Create or Edit Alert Rules (CLI) 119 ? Disable an Alert Rule (CLI) 121 ? Enable Test Alerts (CLI) 122 CLI Commands: Alert Rules 123 ? Configure the SMTP Client (CLI) 124 Power Monitoring and Managing of Hardware Interfaces 127 Summary of Power Management Feature Updates (CLI) 128 Monitoring System Power Consumption (CLI) 130 Requirements — Power Consumption Monitoring (CLI) 130 ? Monitor Total System Power Consumption (CLI) 131 ? Monitor Actual Power Consumption (CLI) 133 ? Monitor Individual Power Supply Consumption (CLI) 133 ? Monitor Available Power (CLI) 134 ? Monitor Server Hardware Maximum Power Consumption (CLI) 135 ? Monitor Permitted Power Consumption (CLI) 135 ? Monitor Power Consumption History (CLI) 136 Configuring the Power Policy and Notification Threshold Values (CLI) 139 ? Configure Server SP Power Policy Value (CLI) 139 ? View and Configure the Power Wattage Notification Threshold Value (CLI) 140 Monitoring Component Power Allocation Distributions (CLI) 142 Special Considerations for Power Allocation (CLI) 142 ? View Server Power Allocations for All System Components (CLI) 143 ? View Server Component Category Power Allocations (CLI) 143 ? View CMM Power Allocations for All Chassis Components (CLI) 145ix Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? View CMM Component Category Power Allocations (CLI) 145 ? View Blade Slots Granted Power or Reserved Power as of Oracle ILOM 3.0.10 (CLI) 146 ? View Granted Power or Grant Limit for Blade as of Oracle ILOM 3.0.10 (CLI) 147 Configuring Power Limit Properties (CLI) 148 Special Considerations for Setting Power Limits (CLI) 148 ? Set Permitted Power for Chassis Blade Slots (CLI) 149 ? Set Server Power Budget Properties (CLI) 150 ? Set CMM Grant Limit to Blade Server as of Oracle ILOM 3.0.10 (CLI) 152 Manage CMM Power Supply Redundancy Properties (CLI) 153 ? View or Set CMM Power Supply Redundancy Properties (CLI) 153 Redirecting Storage Media and Locking the Oracle ILOM Remote Console Display 155 CLI Procedures: Redirect Storage Media 156 CLI Procedures: Manage Oracle ILOM Remote Console Lock Options 156 Managing Remote Host Power States, BIOS Boot Device, and Host Server Console 157 Issuing Remote Power State Commands From Server SP or CMM CLI 158 ? Configure BIOS Host Boot Device Override (CLI) 160 Managing the SP Host Console 162 ? View and Configure Host Console Properties 162 ? Start Host Console and Display Console History and Bootlog 164 Managing TPM and LDom States on SPARC Servers (CLI) 167 ? Control TPM State on a SPARC Server (CLI) 168 Managing LDom Configurations on SPARC Servers (CLI) 171 Requirements — LDOM Configuration (CLI) 171Contents x ? View Targets and Properties for Stored LDom Configurations on SPARC T3 Series Server (CLI) 172 ? Specify Host Power to a Stored LDom Configuration (CLI) 173 ? Enable or Disable the Control Domain Property Values (CLI) 173 CLI Command Reference 177 cd Command 178 Syntax 178 Options 178 Targets and Properties 178 Examples 178 create Command 179 Syntax 179 Options 179 Targets, Properties, and Values 179 Example 179 delete Command 180 Syntax 180 Options 180 Targets 180 Examples 180 dump Command 181 Syntax 181 Options 181 exit Command 181 Syntax 181 Options 181 help Command 182 Syntax 182xi Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Options 182 Commands 182 Examples 183 load Command 183 Syntax 183 Options 184 Example 184 reset Command 184 Syntax 184 Options 185 Targets 185 Examples 185 set Command 185 Syntax 185 Options 185 Targets, Properties, and Values 186 Examples 192 show Command 193 Syntax 193 Options 193 Targets and Properties 194 Examples 201 start Command 202 Syntax 202 Options 202 Targets 202 Examples 202 stop Command 203Contents xii Syntax 203 Options 203 Targets 203 Examples 203 version Command 204 Syntax 204 Options 204 Example 204 Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues 205 Diagnosing Oracle ILOM Connection Issues 206 Manual Host OS Configuration Guidelines for Local Interconnect Interface 207 Configuring Internal USB Ethernet Device on Host OS 208 Index 213xiii Oracle ILOM 3.0 CLI Procedures Guide • May 2011xiv Using This Documentation This command-line interface (CLI) procedures guide describes the Oracle Integrated Lights Out Manager (ILOM) daily management features that are common to Oracle’s Sun rack-mounted servers, server modules, and CMMs supporting Oracle ILOM 3.0. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Collection. This guide is intended for technicians, system administrators, authorized Oracle service providers, and users who have experience managing system hardware. This preface contains the following topics: ¦ “Documentation and Feedback” on page xv ¦ “Product Downloads” on page xvi ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xvii ¦ “Documentation, Support, and Training” on page xviixv Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Collection at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PD CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xvi Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.xvii Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)1 CLI Overview Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, Oracle ILOM overview ¦ Oracle ILOM 3.0 Daily Management Web Procedures, web interface overview ¦ Oracle ILOM 3.0 Protocol Management Reference, SNMP overview ¦ Oracle ILOM 3.0 Protocol Management Reference, IPMI overview ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, maintenance and diagnostics overview Description Links Learn about the Oracle ILOM CLI industry-standard user interface model. • “Oracle ILOM CLI — DMTF Server Management Command-Line Protocol User-Interface” on page 2 Learn about Oracle ILOM CLI connection requirements, installed firmware, and CLI prompt. • “Oracle ILOM CLI Connection” on page 2 • “Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI” on page 3 • “Oracle ILOM CLI Firmware and CLI Prompt” on page 4 Understand Oracle ILOM CLI management namespace. • “Oracle ILOM CLI Management Namespace” on page 4 • “Oracle ILOM CLI Target Namespace” on page 5 • “CLI Management Target Namespace” on page 5 • “DMTF Supported CLP Commands” on page 7 • “CLI Command Options” on page 8 • “Server SP — CLI Target Tree” on page 9 Identify syntax requirements and examples for executing CLI commands. • “Entering CLI Command Syntax and Executing Commands” on page 10 Review common CLI commands. • “Common CLI Commands” on page 12 Compare previous Oracle ILOM 2.0 properties with later Oracle ILOM 3.0 properties. • “Oracle ILOM 3.0 Properties Versus Oracle ILOM 2.x Properties” on page 172 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ Oracle ILOM 3.0 Feature Updates and Release Notes, new or updated features Oracle ILOM CLI — DMTF Server Management Command-Line Protocol User-Interface The Oracle ILOM CLI is based on the Distributed Management Task Force specification, Server Management Command-Line Protocol Specification, version 11.0a.8 Draft (DMTF CLP). You can view the entire specification at the following site: (http://www.dmtf.org/) The DMTF CLP provides a management user-interface for one or more servers regardless of server state, method of access, or installed operating system. The DMTF CLP architecture models a hierarchical namespace, a predefined tree that contains every managed object in the system. In this model, a small number of commands operate on a large namespace of targets, which can be modified by options and properties. This namespace defines the targets for each command verb. For more information about managing objects in the Oracle ILOM CLI namespace, see “Oracle ILOM CLI Management Namespace” on page 4. Oracle ILOM CLI Connection You can use a command-line interface to access Oracle ILOM on the chassis monitoring module (CMM) or the server service processor (SP) through a network connection, or through a direct terminal connection to the serial port on the CMM or server SP. In addition, on some Oracle Sun servers you can use the Local Interconnect Interface feature in Oracle ILOM to manage the server directly from the host operating system without any physical network or local connection to the server.CLI Overview 3 Note – For more information about how to use the Local Interconnect Interface feature in Oracle ILOM, refer to Oracle ILOM 3.0 Daily Management Concepts Guide. For instructions about how to connect a local serial device to a server or how to connect a network cable to the NET MGT port on a server or CMM, refer to the installation guide provided with your server or CMM. Topics discussed in this section include: ¦ “Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI” on page 3 ¦ “Examples for Entering an IPv6 Address” on page 3 ¦ “Oracle ILOM CLI Firmware and CLI Prompt” on page 4 Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI As of Oracle ILOM 3.0.12 or later, the following network addresses are accepted by the Oracle ILOM service processor (SP) CLI. ¦ IPv4 address, such as 10.8.183.106 ¦ IPv6 address, such as fec0:a:8:b7:214:4fff:5eca:5f7e/64 ¦ Link Local IPv6 address, such as fe80::214:4fff:feca:5f7e/64 ¦ DNS host domain address, such as company.com Examples for Entering an IPv6 Address When you specify an IPv6 address to log in to Oracle ILOM using an SSH connection, the IPv6 address should not be enclosed in brackets. When you specify an IPv6 address in a URL with a web browser or when you transfer a file, the IPv6 address must be enclosed in brackets to work correctly. Examples: ¦ When entering the URL in a web browser, type: https://[ipv6address] ¦ When establishing an Oracle ILOM CLI session using SSH and the default Oracle ILOM root user account, type: ssh root@ipv6address Note that when you specify an IPv6 address to log in to Oracle ILOM using an SSH connection, the IPv6 address should not be enclosed in brackets. ¦ When transferring a file using the CLI load -source command and tftp, type:4 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 load -source tftp://[ipv6address]filename.extension For additional information about entering IPv6 addresses, refer to the Oracle ILOM 3.0 Daily Management – Concepts Guide. For help with diagnosing IPv4 and IPv6 connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 205. Oracle ILOM CLI Firmware and CLI Prompt After establishing a connection to the CLI session on a server SP or a CMM, the Oracle ILOM firmware version installed on the system is identified and the copyright information and CLI prompt appears. For example: Note – As of Oracle ILOM 3.0.10, you can change the CLI prompt on the CMM to differentiate between a CMM CLI prompt and a server module (blade) CLI prompt. For more information about the new CLI prompt properties and how to make the CLI prompt specific to a CMM or a blade, refer to Oracle ILOM CMM Administration Guide. Oracle ILOM CLI Management Namespace The Oracle ILOM CLI management namespace includes a hierarchical predefined tree that contains every managed object in the system. Within the Oracle ILOM CLI, a small number of commands operate on a large namespace of targets that are modified by options and properties. Oracle(R) Integrated Lights Out Manager Version 3.0.0.0 r54408 Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. ->CLI Overview 5 Topics discussed in this section include: ¦ “Oracle ILOM CLI Target Namespace” on page 5 ¦ “CLI Management Target Namespace” on page 5 ¦ “DMTF Supported CLP Commands” on page 7 ¦ “CLI Command Options” on page 8 ¦ “Server SP — CLI Target Tree” on page 9 Oracle ILOM CLI Target Namespace The following table describes the CLI management target namespace provided in Oracle ILOM for either a Sun server platform or a Sun blade chassis platform. CLI Management Target Namespace Oracle ILOM provides separate CLI namespaces for server management and chassis management, for instance: ¦ Server SP CLI Management – From the server SP CLI, you can access the /SP namespace to manage and configure the server SP. You can also from the SP namespace, to access the /SYS and /HOST namespaces. TABLE: Oracle ILOM Management Target Namespace Target Description * /SP The targets and properties below this target type are used on a Sun server for configuring the Oracle ILOM service processor (SP) and for viewing logs and consoles. * /CMM On blade chassis platforms, this target type replaces /SP and is used for configuring the Oracle ILOM chassis monitoring module (CMM). * /SYS The targets and properties below this target type are used on a Sun server to monitor inventory status and environmental sensors, as well as to manage service components. The targets under this target type directly correspond to the names of the hardware components, some of which are printed on the physical hardware. * /CH On blade chassis platforms, this target type replaces /SYS and provides inventory status, environmental status, and hardware management at the chassis level. The target types directly correspond to nomenclature names for all hardware components, some of which are printed onto the physical hardware. * /HOST The targets and properties below this target type are used on a Sun server to monitor and manage the host operating system.6 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ Chassis CLI Management – From the CMM CLI, you can access the /CMM namespace and the chassis component namespace, which could include: /CH/BLn, /CH/BLn/Noden, or /CH/NEM. In the /CMM namespace you can manage and configure the CMM. In the /CH namespaces you can access and configure properties for managed chassis components such as single SP server modules (blades), multiple SP server modules, and NEMs. The following table summarizes the CLI server and CMM management targets you can navigate in Oracle ILOM. TABLE: CMM and Server CP CLI Management Targets Managed Device CLI Management Target Descriptions Server • /SP is used to configure the server module SP and for viewing logs and consoles. • /SYS is used to monitor inventory status, environmental sensors, and manage hardware components at the blade level. CMM, chassis server module (blade), SPs, or NEM • /CMM is used to manage Oracle ILOM on the CMM. • /CH is used to provide inventory, environmental, and hardware management at the chassis level. The /CH address space replaces /SYS on Sun Blade Modular Systems. • /CH/BLn is used to access and configure server module SP properties and options from the CMM CLI session. • /CH/BLn/Noden where Noden is used to access and configure properties and options on a specific SP node on a server module that supports multiple SPs. • /CH/NEMn/is used to access NEM targets and properties from the CMM CLI session. Host OS on Server • /HOST is used to monitor and manage the host server operating system interactions.CLI Overview 7 DMTF Supported CLP Commands The Oracle ILOM CLI supports the following DMTF system management CLP commands. Note – CLI commands are case-sensitive. TABLE: CLI Commands Command Description cd Navigates the object namespace. create Sets up an object in the namespace. delete Removes an object from the namespace. exit Terminates a CLI session. help Displays Help information for commands and targets. load Transfers a file from an indicated source to an indicated target. dump Transfers a file from a target to a remote location specified by the URI. reset Resets the state of the target. set Sets target properties to the specified value. show Displays information about targets and properties. start Starts the target. stop Stops the target. version Displays the version of service processor running.8 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 CLI Command Options The following table describes CLI options supported by some CLI commands. Note – To determine CLI options supported by a CLI command use the help command. TABLE: CLI Options Option Long Form Short Form Description -default Causes the command to perform its default functions only. -destination Specifies the destination for data. -display -d Shows the data the user wants to display. -force -f Specifies that the action will be performed immediately. -help -h Displays Help information. -level -l Executes the command for the current target and all targets contained through the level specified. -output -o Specifies the content and form of command output. Oracle ILOM supports only -o table, which displays targets and properties in tabular form. -script Skips warnings or prompts normally associated with the command. -source Indicates the location of a source image.CLI Overview 9 Server SP — CLI Target Tree Every object in the CLI namespace is considered a target. FIGURE: /SP Example of the Oracle ILOM CLI Target Tree10 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Entering CLI Command Syntax and Executing Commands To specify target locations and successfully execute CLI commands in Oracle ILOM, you must apply the require command-line syntax when entering and executing commands. For more details, see the following topics: ¦ “Entering CLI Command Syntax” on page 10 ¦ “Executing Commands” on page 10 Entering CLI Command Syntax When using the Oracle ILOM CLI, the command syntax is entered as: [command name] [option] [target] [property] [[value] For example: -> set /SP/services/https port=portnumber servicestate= enabled|disabled Note – Syntax examples in this chapter use the target starting with /SP/, which could be interchanged with the target starting with /CMM/ depending on your server platform. Sub-targets are common across all server platforms. Executing Commands To execute most commands, specify the location of the target and then enter the command. You can perform these actions individually, or you can combine them on the same command line. ¦ “Execute Commands Individually” on page 11 ¦ “Execute Combined Commands” on page 11CLI Overview 11 ? Execute Commands Individually 1. Navigate to the namespace using the cd command. For example: cd /SP/services/http 2. Enter the command, target, and value. For example: -> set port=80 or -> set prop1=x -> set prop2=y ? Execute Combined Commands ? Using the syntax =value, enter the command on a single command line. For example: -> set /SP/services/http port=80 or -> set /SP/services/http prop1=x prop2=y12 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Common CLI Commands Note – For more information about Oracle ILOM CLI commands, see “CLI Command Reference” on page 177. TABLE: General Commands Description Command Display information about commands and targets. help Display information about a specific command. help Show all valid targets. help targets Change and display the current target cd Transfer a file from a target to a remote location specified by the URI. dump Log out of the CLI. exit Display the version of Oracle ILOM firmware running on Oracle ILOM. version Reset a target. reset Display clock information. show /SP/clock Display active Oracle ILOM sessions. show /SP/sessions Update Oracle ILOM and BIOS firmware. load -source tftp://newSPimage Display a list of Oracle ILOM event logs. show /SP/logs/event/list TABLE: User Commands Description Command Add a local user. create /SP/users/user1 password=password role=a|u|c|r|o|s Delete a local user. delete /SP/users/user1 Change a local user role. set /SP/users/user1 role=operatorCLI Overview 13 Display information about all local users. show -display [targets|properties|all] -level all /SP/users Display information about LDAP settings. show /SP/clients/ldap Change LDAP settings. set /SP/clients/ldap binddn=proxyuser bindpw=proxyuserpassword defaultrole=a|u|c|r|o|s address=ipaddress TABLE: Network and Serial Port Setting Commands Description Command Display network configuration information. show /SP/network Change network properties for Oracle ILOM. Changing certain network properties, like the IP address, will disconnect your active session. set /SP/network pendingipaddress=ipaddress pendingipdiscovery=dhcp|static pendingipgateway=ipgateway pendingipnetmask=ipnetmask commitpending=true Display information about the external serial port. show /SP/serial/external Change the external serial port configuration. set /SP/serial/external pendingspeed=integer commitpending=true Display information about the serial connection to the host. show /SP/serial/host Change the host serial port configuration. Note: This speed setting must match the speed setting for serial port 0, COM1, or /dev/ttyS0 on the host operating system. set /SP/serial/host pendingspeed=integer commitpending=true TABLE: Alert Management Commands Description Command Display information about alerts. You can configure up to 15 alerts. show /SP/alertmgmt/rules/1...15 TABLE: User Commands (Continued) Description Command14 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configure an IPMI PET alert. set /SP/alertmgmt/rules/1...15 type=ipmipet destination= ipaddress level=down|critical|major|minor Configure a SNMPv3 trap alert. set /SP/alertmgmt/rules/1...15 type=snmptrap snmp_version=3 comunity_or_username=username destination= ipaddress level=down|critical|major|minor Configure an email alert. set /SP/alertmgmt/rules/1...15 type=email destination= email_address level=down|critical|major|minor TABLE: System Management Access Commands Description Command Display information about HTTP settings. show /SP/services/http Change HTTP settings, such as enabling automatic redirection to HTTPS. set /SP/services/http port=portnumber secureredirect= enabled|disabled servicestate=enabled|disabled Display information about HTTPS access. show /SP/services/https Change HTTPS settings. set /SP/services/https port=portnumber servicestate= enabled|disabled Display SSH DSA key settings. show /SP/services/ssh/keys/dsa Display SSH RSA key settings. show /SP/services/ssh/keys/rsa TABLE: Clock Settings Commands Description Command Set Oracle ILOM clock to synchronize with a primary NTP server. set /SP/clients/ntp/server/1 address=ntpIPaddress Set Oracle ILOM clock to synchronize with a secondary NTP server. set /SP/clients/ntp/server/2 address=ntpIPaddress2 TABLE: Alert Management Commands Description CommandCLI Overview 15 TABLE: SNMP Commands Description Command Display information about SNMP settings. By default, the SNMP port is 161 and v3 is enabled. show /SP/services/snmp engineid=snmpengineid port=snmpportnumber sets=enabled|disabled v1=enabled|disabled v2c=enabled|disabled v3=enabled|disabled Display SNMP users. show /SP/services/snmp/users Add an SNMP user. create /SP/services/snmp/users/snmpusername authenticationpassword=password authenticationprotocol=MD5|SHA permissions=rw|ro privacypassword=password privacyprotocol=none|DES|AES Delete an SNMP user. delete /SP/services/snmp/users/snmpusername Display SNMP MIBs. show /SP/services/snmp/mibs Display information about SNMP public (read-only) communities. show /SP/services/snmp/communities/public Display information about SNMP private (read-write) communities. show /SP/services/snmp/communities/private Add an SNMP public community. create /SP/services/snmp/communities/ public/comm1 permission=ro|rw Add an SNMP private community. create /SP/services/snmp/communities/ private/comm2 permission=ro|rw Delete an SNMP community. delete /SP/services/snmp/communities/comm1 TABLE: Host System Commands Description Command Start the host system or chassis power. start /SYS or start /CH Stop the host system or chassis power (graceful shutdown). stop /SYS or stop /CH Stop the host system or chassis power (forced shutdown). stop [-f|force] /SYS or stop [-f|force] /CH Reset the host system or chassis. reset /SYS or reset /CH Start a session to connect to the host console. start /SP/console Stop the session connected to the host console (graceful shutdown). stop /SP/console Stop the session connected to the host console (forced shutdown). stop [-f|force] /SP/console16 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 TABLE: Filtering Output Options for Commands Description Filtered Command Display active Oracle ILOM sessions that were started on July 17th. show /SP/sessions -level all starttime=="*Jul 17*" Display users that have admin roles. show /SP/users -level all role=="a*" Display users that have only user and console roles. show /SP/users -level all role=="uc" Display all SNMP trap alerts. show /SP/alertmgmt -level all type=="snmptrap" Display all disabled services. show /SP/services -level all servicestate==disabled Display NTP clients that use the NTP address server IP 1.2.3.4 show /SP/clients/ntp -level all address=="1.2.3.4" Display all FRUs with serial number that starts with 0D01B. show /SYS fru_serial_number=="0D01B*" -level all Display all memory modules manufactured by INFINEON. show /SYS -level all type=="DIMM" fru_manufacturer= ="INFINEON" Display all power supplies whose alarm state is major. show /SYS -level all type=="Power Supply" alarm_status==major Display all components that are DIMMs or hard disks. show /SYS type==("Hard Disk",DIMM) -level all Display all voltage sensors whose upper_nonrecov_threshold value is 2.89 or 60 volts. show /SYS type==Voltage upper_nonrecov_threshold== ("2.*","60.*")CLI Overview 17 Oracle ILOM 3.0 Properties Versus Oracle ILOM 2.x Properties Note – Properties are the configurable attributes specific to each object. If you are upgrading from Oracle ILOM 2.x to Oracle ILOM 3.0 and you want to update your 2.x scripts, you need to be familiar with the new methods that Oracle ILOM 3.0 uses to implement Oracle ILOM 3.0 commands. The following table compares the Oracle ILOM 2.x properties with the later ILOM 3.0 properties. TABLE: Oracle ILOM 2.x Properties and New Oracle ILOM 3.0 Implementations Oracle ILOM 2.x Properties Oracle ILOM 3.0 Implementation /SP/clients/syslog/destination_ip1 /SP/clients/syslog/1/address /SP/clients/syslog/destination_ip2 /SP/clients/syslog/2/address /SP/clients/activedirectory/ getcertfile (load a certificate) Use load command with this target /SP/clients/activedirectory/cert /SP/clients/activedirectory/getcer tfile (remove a certificate) Use set command with /SP/client/activedirectory/cert clear_action=true /SP/clients/activedirectory/ getcertfile (restore a certificate) No longer a feature /SP/clients/activedirectory/ certfilestatus /SP/clients/activedirectory/cert/ certstatus /SP/clients/activedirectory/ ipaddress /SP/clients/activedirectory/ address /SP/clients/activedirectory/alerna tiveservers/getcertfile (load a certificate) Use load command with /SP/clients/activedirectory/ alernativeservers/cert as target /SP/clients/activedirectory/ alernativeservers/getcertfile (remove a certificate) Use set command with /SP/client/activedirectory/alernat iveservers/cert clear_action=true /SP/clients/activedirectory/ getcertfile/alernativeservers/ (restore a certificate) No longer a feature /SP/clients/activedirectory/ alernativeservers/certfilestatus /SP/clients/activedirectory/ alernativeservers/cert/certstatus18 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/clients/activedirectory/ alernativeservers/ipaddress /SP/clients/activedirectory/ alernativeservers/address /SP/clients/radius/ipaddress /SP/clients/radius/address /SP/clients/ldap/ipaddress /SP/clients/ldap/address /SP/cli/commands Use help command with a target name /SP/diag/state /HOST/diag/state /SP/diag/generate_host_nmi /HOST/generate_host_nmi /SP/diag/mode /HOST/diag/mode /SP/diag/level /HOST/diag/level /SP/diag/verbosity /HOST/diag/verbosity TABLE: Oracle ILOM 2.x Properties and New Oracle ILOM 3.0 Implementations Oracle ILOM 2.x Properties Oracle ILOM 3.0 Implementation19 Logging In to ILOM, Displaying Banner Messages, and Setting the CLI Session Time-out Related Information ¦ Oracle ILOM 3.0 Quick Start, logging in to Oracle ILOM ¦ Oracle ILOM 3.0 Quick Start, mandatory setup tasks (CLI) ¦ Oracle ILOM 3.0 Daily Management Web Procedures, logging in to Oracle ILOM ¦ Oracle ILOM 3.0 Daily Management Web Procedures, displaying banner messages ¦ Oracle ILOM 3.0 Daily Management Concepts, banner messages Description Links CLI procedures for logging in or out of ILOM, as well as procedures for recovering a password. • “Logging In and Out of ILOM and Recovering a Password” on page 20 CLI procedures for setting up banner messages and the CLI session time-out. • “Setting Up Banner Messages and CLI Session Time-Out” on page 2420 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Logging In and Out of ILOM and Recovering a Password Before Your Initial Login Prior to performing the procedures in this section, ensure that the following requirements are met: ¦ Ensure that a physical serial or network management connection to the system (server or CMM) is established. For instructions about how to establish a physical connection to the SER MGT port or NET MGT port on your system, refer to the installation guide provided with your server or CMM. The login procedures in this section assume you are logging in to the Oracle ILOM CLI through a physical network connection. Note – Alternatively, for Oracle Sun servers supporting a Local Interconnect Interface connection, you can connect directly to Oracle ILOM from the host operating system. For more details about connecting to Oracle ILOM using a Local Interconnect Interface connection, see “Configuring the Local Interconnect Interface (CLI)” on page 48. ¦ Obtain the server SP or CMM network address. Description Links Platform Feature Support Initial requirements for logging in to Oracle ILOM. • “Before Your Initial Login” on page 20 • x86 system server SP • SPARC system server SP • CMM CLI procedures for logging in to Oracle ILOM • “Log In Using the Root Account (CLI)” on page 21 • “Log In to Oracle ILOM With User Account (CLI)” on page 22 CLI procedure for logging out of Oracle ILOM • “Log Out of Oracle ILOM CLI” on page 22 CLI procedure for recovering a password • “Recover a Lost Password (CLI)” on page 23Logging In to ILOM, Displaying Banner Messages, and Setting the CLI Session Time-out 21 Oracle ILOM, by default, will automatically assign an IPv4 or IPv6 address for the server SP or CMM. To determine the default IP address assigned to the server SP or CMM, establish a local serial management connection to the server SP or CMM and view the /network (or /network/ipv6) properties. For more information about how to establish a local serial management connection to Oracle ILOM, refer to the Oracle ILOM 3.0 Quick Start Guide or refer to the documentation provided with your Sun server or Sun blade chassis system. For information about modifying the default IP address assigned to your server SP or CMM, refer to “Configuring Network Settings (CLI)” on page 28. Note – As of Oracle ILOM 3.0.12, network configuration settings for dual-stack IPv4 and IPv6 are provided. Prior to Oracle ILOM 3.0.12, network configuration settings for IPv4 are provided. ¦ Obtain an Oracle ILOM user account. If you are setting up Oracle ILOM for this first-time, use the default root account and changeme password to log in. It is highly recommended after your system is set up that a new user account is created for each Oracle ILOM user. For more information about user accounts, see “Managing User Accounts (CLI)” on page 55. ? Log In Using the Root Account (CLI) 1. Using a Secure Shell (SSH) session, log in to the Oracle ILOM CLI by specifying the default root user account, and IP address of the server SP or CMM. For example: $ ssh root@system_ipaddress If Oracle ILOM is operating in a dual-stack network environment, the system_ipaddress can be entered using either an IPv4 or IPv6 address format. For example, ¦ IPv4 address format: 10.8.183.106 or ¦ IPv6 address format: fec0:a:8:b7:214:4fff:5eca:5f7e/64 For more information about entering IP addresses in a dual-stack environment, see “Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI” on page 3. For help with diagnosing IPv4 and IPv6 connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 205. The system prompts you for a password.22 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. Type changeme as the default password. For example: Password: changeme The Oracle ILOM CLI prompt appears (->). Note – As of Oracle ILOM 3.0.4, you can set the amount of time a CLI session can remain idle before the session times out and closes. For instructions, see “Set CLI Session Time-Out Property Value” on page 25. ? Log In to Oracle ILOM With User Account (CLI) Follow these steps to log in to Oracle ILOM using a user account that created for you by the Oracle ILOM system administrator. 1. Using a Secure Shell (SSH) session, log in to Oracle ILOM by specifying your user name and IP address of the server SP or CMM. For example: $ ssh system_ipaddress If Oracle ILOM is operating in a dual-stack network environment, the system_ipaddress can be entered using either an IPv4 or IPv6 address format. For example, ¦ IPv4 address format: 10.8.183.106 ¦ IPv6 address format: fec0:a:8:b7:214:4fff:5eca:5f7e/64 For more information about entering IP addresses in a dual-stack environment, see “Server SP or CMM Network Addresses Accepted by Oracle ILOM CLI” on page 3. For help with diagnosing IPv4 and IPv6 connection issues, see “Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues” on page 205. The system prompts you for your Oracle ILOM password. 2. Type your Oracle ILOM password. Password: password The Oracle ILOM CLI prompt appears (->). ? Log Out of Oracle ILOM CLI To log out of Oracle ILOM, follow this step: ? At the command prompt, type:Logging In to ILOM, Displaying Banner Messages, and Setting the CLI Session Time-out 23 -> exit ? Recover a Lost Password (CLI) Before You Begin ¦ You must be physically present at the server to perform this procedure. ¦ This procedure uses the default user account to enable you to recover a lost password or to re-create the root user account. ¦ You cannot change or delete the default user account. 1. Establish a local serial management connection to ILOM and log in to ILOM using the default user account. For example: SUNSP-0000000000 login: default Press and release the physical presence button. Press return when this is completed... 2. Prove physical presence at your server. Refer to your platform documentation for instructions on how to prove physical presence. 3. Return to your serial console and press Enter. You will be prompted for a password. 4. Type the password for the default user account: defaultpassword 5. Reset the account password or re-create the root account. For instructions, refer to “Change a User Account Password (CLI)” on page 57 or “Add a User Account (CLI)” on page 56. Related Information ¦ Oracle ILOM 3.0 Quick Start, connect to Oracle ILOM ¦ Oracle ILOM 3.0 Quick Start, add new user account ¦ Oracle ILOM 3.0 Concepts, default and root user account24 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Setting Up Banner Messages and CLI Session Time-Out ? Display Banner Messages on Login Page (CLI) Before You Begin ¦ The Admin (a) role is required to configure banner messages in Oracle ILOM. ¦ You must be using Oracle ILOM 3.0.8 or later. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Use the show command to display the current banner properties and supported commands. For example: Description Links Feature Support Platform Configure banner messages to appear on the Oracle ILOM Login page. • “Display Banner Messages on Login Page (CLI)” on page 24 • x86 system server SP • SPARC system server SP • CMM Configure the CLI session time-out property. • “Set CLI Session Time-Out Property Value” on page 25 -> show /SP/preferences/banner /SP/preferences/banner Targets: Properties: connect_message = (none) login_message = (none) login_message_acceptance = disabled Commands: cd set showLogging In to ILOM, Displaying Banner Messages, and Setting the CLI Session Time-out 25 3. To create a banner message, perform any of the following tasks: 4. To enable the system to display the banner messages, type: -> set /SP/preferences/banner/ login_message_acceptance=enabled 5. To disable the system from displaying the banner messages type: -> set /SP/preferences/banner/ login_message_acceptance=disabled ? Set CLI Session Time-Out Property Value Before You Begin ¦ The Admin (a) role is required to change the CLI timeout property value. ¦ You must be using Oracle ILOM 3.0.4 or later to change the CLI timeout property value. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To view the current settings, type: -> show /SP/cli 3. To set the CLI timeout property value, type the following command: -> set /SP/cli timeout=n Where n is a number between 0 and 1440. Task Instructions To create a banner message to appear on the Login page Type: -> set /SP/preferences/banner connect_message=message Where message equals the content you want to appear on the Login page. To create banner message to appear in a dialog box after a user logs in to Oracle ILOM. Type: -> set /SP/preferences/banner login_message=message Where message equals the content you want to appear after logging in to Oracle ILOM. Note - Banner messages are limited to a 1000 characters. To create a new line within the message, use the following CLI characters: /r or /n.26 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – 0 (zero) indicates that the CLI session time-out is disabled, so that the CLI session will not close regardless of the amount of time the session is idle. For example, to set the time-out value to 60 minutes, type: -> set /SP/cli timeout=60 Set ‘timeout’ to ‘60’27 Configuring Network, Secure Shell, and Local Interconnect Settings Related Information ¦ Oracle ILOM 3.0 Quick Start, establish a network management connection ¦ Oracle ILOM 3.0 Quick Start, modify default network settings ¦ Oracle ILOM 3.0 Daily Management Concepts, network communication settings ¦ Oracle ILOM 3.0 Daily Management Concepts, switch serial port console output ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure network settings ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure secure shell settings ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure serial port sharing ¦ Oracle ILOM 3.0 Protocol Management Reference, configure network settings ¦ Oracle ILOM 3.0 Daily Management Web Procedures, configure the local interconnect interface Description Links Configure network properties for IP, host name, DNS, serial port output, as well as HTTP web access. • “Configuring Network Settings (CLI)” on page 28 Configure Secure Shell settings • “Configuring Secure Shell Settings (CLI)” on page 44 Configure the Local Interconnect Interface • “Configuring the Local Interconnect Interface (CLI)” on page 4828 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring Network Settings (CLI) Description Links Platform Feature Support Review the prerequisites • “Before You Begin — Network Settings (CLI)” on page 29 • x86 system server SP • SPARC system server SP View and configure IPv4 • CMM network settings • “View and Configure IPv4 Network Settings (CLI)” on page 30 Edit existing IPv4 addresses • “Edit Existing IPv4 Addresses (CLI)” on page 31 View and configure dual-stack IPv4 and IPv4 network settings • “View and Configure Dual-Stack IPv4 and IPv6 Network Settings (CLI)” on page 32 Test IPv4 or IPv6 network configuration • “Test IPv4 or IPv6 Network Configuration (CLI)” on page 38 Assign a host name and system identifier • “Assign Host Name and System Identifier (CLI)” on page 39 View and configure DNS settings • “View and Configure DNS Settings (CLI)” on page 40 View and configure serial port settings • “View and Configure Serial Port Settings (CLI)” on page 41 Enable HTTP or HTTPS web access • “Enable HTTP or HTTPS Web Access (CLI)” on page 42 Switch serial port output between the SP console and the host console • “Switch Serial Port Output (CLI)” on page 43 • x86 system server SPConfiguring Network, Secure Shell, and Local Interconnect Settings 29 Before You Begin — Network Settings (CLI) Review the following information before you view or configure Oracle ILOM network settings. Network Environment Before You Begin IPv4-only • To easily locate Oracle ILOM on the network, you should ensure the same IP address is always assigned to Oracle ILOM. Oracle ILOM by default will attempt to obtain IPv4 network settings using DHCP. Dual-stack IPv4 and IPv6 • Oracle ILOM is shipped with IPv4 DHCP and IPv6 Stateless default network settings. • Verify that your server or CMM has Oracle ILOM firmware 3.0.12 or later installed. • The IPv4 network state must always be enabled in order for Oracle ILOM to operate in an IPv4 network environment or in a dual-stack IPv4 and IPv6 network environment. • For IPv6 Stateless auto-configurations, Oracle ILOM (3.0.12 or later) requires a network router to be configured for IPv6. • For DHCPv6 auto-configuration options, Oracle ILOM (3.0.14 or later) requires a network DHCPv6 server to provide the IPv6 address(es) and DNS information for the device. Note. DHCP and DHCPv6 are separate protocols. In a dual-stack network environment, DHCP and DHCPv6 operate as follows: (1) the DHCPv6 server can provide IPv6 addresses to a network node and the network node always uses the IPv6 protocol to communicate with a DHCPv6 server; and (2) the DHCP server can provide IPv4 addresses to a network node and the network node will always use the IPv4 protocol to communicate with a DHCP server • For DHCP and DHCPv6 auto-configurations, you should choose to receive the DNS information from either an IPv6 DHCP server or from an IPv4 DHCP server, but not from both. You can manually configure the settings for the DNS name server in the Oracle ILOM CLI under the /SP/clients/dns target. For instructions, see “View and Configure DNS Settings (CLI)” on page 40. Note - For a list of legacy platform servers not supporting IPv6 configurations in Oracle ILOM, refer to Legacy Sun Systems Not Supporting IPv6 in the ILOM 3.0 Daily Management Concepts Guide. Network settings described in this section • You need to have the Admin (a) role enabled to modify any server SP or CMM network properties or options.30 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? View and Configure IPv4 Network Settings (CLI) Note – This procedure provides instructions for configuring Oracle ILOM to operate in an IPv4-only network environment. If you are configuring Oracle ILOM to operate in an dual-stack IPv4 and IPv6 network environment, see “View and Configure Dual-Stack IPv4 and IPv6 Network Settings (CLI)” on page 32. 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. At the command prompt, type: —> show /SP/network 3. Use the set command and type all of the settings that you wish to change. You can execute these commands within a combined command. See “Execute Combined Commands” on page 11. Note – Change a complete set of properties and commit to true only when the pending values are all typed into the command. Note – Settings take effect as soon you set commitpending=true. Configuring network settings might disconnect your active session if you are connected to Oracle ILOM over a network. Configure all your systems before you commit the changes. After you commit the changes you will have to reconnect to Oracle ILOM. Example To change multiple network settings from DHCP to static assigned settings, type: -> set /SP/network pendingipdiscovery=static pendingipaddress= nnn.nn.nn.nn pendingipgateway=nnn.nn.nn.nn pendingipnetmask=nnn.nn.nn.nn commitpending=true The following target, properties, and values are valid for Oracle ILOM network settings. Target Property Value Default /SP/network ipaddress ipdiscovery ipgateway ipnetmask Read-only; values are updated by the system macaddress MAC address of Oracle ILOMConfiguring Network, Secure Shell, and Local Interconnect Settings 31 ? Edit Existing IPv4 Addresses (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. Type one of the following commands to set the SP working directory: ¦ For a rackmount standalone server: cd /SP/network ¦ For a chassis server blade server module: cd /SP/network ¦ For a chassis CMM: cd /CMM/network 3. Type the show command to view the IP address assigned. 4. Type the following commands to modify the existing settings. commitpending pendingipaddress pendingipdiscover y pendingipgateway pendingipnetmask true|none dhcp|static none none dhcp none 255.255.255.0 dhcp_server_ip Read-only; value is updated when the SP receives a DHCP address state enabled|disabled none Command Description and Example set pendingipaddress= Type this command followed by the static IP address that you want to assign to the server SP or CMM. set pendingipnetmask= Type this command followed by the static Netmask address that you want to assign to the server SP or CMM. Target Property Value Default32 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – If you connected to Oracle ILOM through a remote SSH connection, the connection made to Oracle ILOM using the former IP address will time-out. Use the newly assigned settings to connect to Oracle ILOM. ? View and Configure Dual-Stack IPv4 and IPv6 Network Settings (CLI) Note – This procedure provides instructions for configuring Oracle ILOM to operate in a dual-stack IPv4 and IPv6 network environment. If you are configuring Oracle ILOM to operate in an IPv4-only network environment, as supported in Oracle ILOM 3.0.10 and earlier versions, see “View and Configure IPv4 Network Settings (CLI)” on page 30. 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. Establish a local serial console connection or SSH connection to the server SP or CMM. 2. Perform the network configuration instructions that apply to your network environment: ¦ To configure IPv4 network settings, perform Step 3 to Step 5 in this procedure. ¦ To configure IPv6 network settings, perform Step 6 to Step 10 in this procedure. set pendingipgateway= Type this command followed by the static Gateway address that you want to assign to the server SP or CMM. set pendingipdiscovery= Type this command to set a static IP address on the server SP or CMM. set commitpending=true Type this command to assign the network settings specified. For example: set pendingipaddress=129.144.82.26 set pendingipnetmask=255.255.255.0 set pendingipgateway=129.144.82.254 set pendingipdiscovery=static set commitpending=true Command Description and ExampleConfiguring Network, Secure Shell, and Local Interconnect Settings 33 3. For IPv4 network configurations, use the cd command to navigate to the /x/network working directory for the device. For example: ¦ For a rackmount server SP type: cd /SP/network ¦ For a chassis CMM type: cd /CMM/network ¦ For a chassis blade server SP type: cd /CH/BLn/network ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network 4. Type the show command to view the configured IPv4 network settings configured on the device. 5. To set IPv4 network settings for DHCP or static, perform one of the following: ¦ To configure DHCP IPv4 network settings, set values for the following properties: Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=dhcp The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the state and ipdiscovery property values.34 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ To configure static IPv4 network settings, set values for the following properties: 6. For IPv6 network configurations, use the cd command to navigate to the /x/network/ipv6 working directory for the device. For example: ¦ For a rackmount server SP type: cd /SP/network/ipv6 ¦ For a chassis CMM type: cd /CMM/network/ipv6 ¦ For a chassis blade server SP type: cd /CH/BLn/network/ipv6 ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/ipv6 7. Type the show command to view the configured IPv6 network settings configured on the device. For example, see the following sample output values for the IPv6 properties on a server SP device. Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=static To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4. pendingipaddress pendingipnetmask pendingipgateway set pendingipaddress= pendingipnetmask= pendingipgateway= To assign multiple static network settings, type the set command followed by the pending command for the each property value (IP address, netmask, and gateway), then type the static value that you want to assign. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the IPv4 network properties. -> show /SP/network/ipv6 Targets:Configuring Network, Secure Shell, and Local Interconnect Settings 35 Note – When the autoconfig= property is set to dhcpv6_stateful or dhcpv6_stateless, the read-only property for dhcpv6_server_duid will identify the DHCP unique ID of the DHCPv6 server that was last used by Oracle ILOM to retrieve the DHCP information. Note – The default IPv6 autoconfig property value provided in Oracle ILOM 3.0.14 (and later) is autoconfig=stateless. However, if you have Oracle ILOM 3.0.12 installed on your CMM or server, the default property value for autoconfig appears as autoconfig=stateless_only. Properties: state = enabled autoconfig = stateless dhcpv6_server_duid = (none) link_local_ipaddress = fe80::214:4fff:feca:5f7e/64 static_ipaddress = ::/128 ipgateway = fe80::211:5dff:febe:5000/128 pending_static_ipaddress = ::/128 dynamic_ipaddress_1 = fec0:a:8:b7:214:4fff:feca:5f7e/64 Commands: cd show36 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 8. To configure an IPv6 auto-configuration option, use the set command to specify the following auto-configuration property values. Note – The IPv6 configuration options take affect after they are set. You do not need to commit these changes under the /network target. Note – Newly learned auto-configuration IPv6 addresses will not affect any active Oracle ILOM sessions to the device. You can verify the newly learned auto-configured IPv4 addresses under the /network/ipv6 target. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. To enable an IPv6 auto-configuration option this state must be set to enabled. autoconfig set autoconfig= Specify this command followed by the autoconf value you want to set. Options include: • stateless (default setting provided in Oracle ILOM 3.0.14 or later) or stateless_only (default setting provided in Oracle ILOM 3.0.12) Automatically assigns IP address learned from the IPv6 network router. • dhcpv6_stateless Automatically assigns DNS information learned from the DHCP server. The dhcpv6_stateless property value is available in Oracle ILOM as of 3.0.14. • dhcpv6_stateful Automatically assigns the IPv6 address learned from the DHCPv6 server. The dhcpv6_stateful property value is available in Oracle ILOM as of 3.0.14. • disable Disables all auto-configuration property values and sets the read-only property value for link local address.Configuring Network, Secure Shell, and Local Interconnect Settings 37 Note – As of Oracle ILOM 3.0.14 or later, you can enable the stateless auto-configuration option to run at the same time as when the option for dhcpv6_stateless is enabled or as when the option for dhcpv6_stateful is enabled. However, the auto-configuration options for dhcpv6_stateless and dhcpv6_stateful should not be enabled to run at the same time. 9. Perform the following steps to set a static IPv6 address: a. To set a pending static IPv6 address, specify the following property value: b. To commit (save) the pending IPv6 static network parameters, perform the steps in the following table: Note – Assigning a new static IP address to the device (SP or CMM) will end all active Oracle ILOM sessions to the device. To log back in to Oracle ILOM, you will need to create a new browser session using the newly assigned IP address. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. This state must be enabled to configure a static IP address. pendingipaddress set pending_static_ipaddress= / Type this command followed by the property value for the static IPv6 address and net mask that you want to assign to the device. IPv6 address example: fec0:a:8:b7:214:4fff:feca:5f7e/64 Step Description 1 Use the cd command to change the directory to the device network target. For example: • For rackmount server type: cd /SP/network • For chassis CMM type: cd /CMM/network • For chassis blade server SP type: cd /CH/BLn/network • For chassis blade server SP with multiple nodes type: cd /CH/BLn/Noden/network 2 Type the following command to commit the changed property values for IPv6: set commitpending=true38 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 10. To test the IPv4 or IPv6 network configuration from Oracle ILOM, use the network test tools (Ping and Ping6). For details, see “Test IPv4 or IPv6 Network Configuration (CLI)” on page 38. ? Test IPv4 or IPv6 Network Configuration (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. Establish a local serial console connection or SSH connection to the server SP or CMM 2. Navigate to the /x/network/test working directory for the device by using the cd command, for example: ¦ For a rackmount server SP type: cd /SP/network/test ¦ For a chassis CMM type: cd /CMM/network/test ¦ For a chassis blade server SP type: cd /CH/BLn/network/test ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/test 3. View the network test targets and properties by typing the show command. For example, see the following output the shows the test target properties on a CMM device. -> show /CMM/network/test Targets: Properties: ping = (Cannot show property) ping6 = (Cannot show property) Commands: cd set showConfiguring Network, Secure Shell, and Local Interconnect Settings 39 4. Test the connection between the device and a specified network destination by using the set ping or set ping6 command. ? Assign Host Name and System Identifier (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. To set the SP host name and system identifier text, at the command prompt, type: -> set /SP hostname=text_string -> set /SP system_identifier=text_string where: ¦ The host name can consist of alphanumeric characters and can include hyphens. Host names can contain up to 60 characters. ¦ The system identifier can consist of a text string using any standard keyboard keys except quotation marks. For example: -> set /SP hostname=Lab2-System1 -> set /SP system_identifier=DocSystemforTesting With these settings, the show command produces the following output: Property Set Property Value Description ping set ping= Type the set ping= command at the command prompt followed by the IPv4 test destination address. For example: -> set ping=10.8.183.106 Ping of 10.8.183.106 succeeded ping6 set ping6= Type the set ping6= command followed by the IPv6 test destination address. For example: -> set ping6=fe80::211:5dff:febe:5000 Ping of fe80::211:5dff:febe:5000 succeeded -> show /SP /SP Targets: alertmgmt .40 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? View and Configure DNS Settings (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. To display settings for the external serial port, type: -> show /SP/clients/dns 3. To change DNS property values use the set command. For example: -> set /SP/clients/dns . . users Properties: check_physical_presence = false hostname = Lab2-System1 system_contact = (none) system_description = SUN BLADE X8400 SERVER MODULE, Oracle ILOM v3.0.0.0, r31470 system_identifier = DocSystemforTesting system_location = (none) Commands: cd reset set show version Target Property Value Default /SP/clients/dns auto_dns nameserver retries searchpath timeout enabled|disabled ip_address Integer between 0 and 4 Integer between 1 and 10 Up to six comma-separated search suffixes disabledConfiguring Network, Secure Shell, and Local Interconnect Settings 41 ? View and Configure Serial Port Settings (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. Perform one of the following: ¦ To display settings for the external serial port, type: -> show /SP/serial/external ¦ To display settings for the host serial port, type: -> show /SP/serial/host 3. To change the serial port property values use the set command. For example: -> set target [propertyname=value] commitpending=true EXAMPLE: Change serial port baud rate To change the baud rate for the host serial port from 9600 to 57600, type the following: ¦ For x86-based servers -> set /SP/serial/host pendingspeed=57600 commitpending=true ¦ For SPARC-based servers > set /SP/serial/external pendingspeed=57600 commitpending= true Target Property Value Default /SP/serial/external commitpending flowcontrol pendingspeed true|(none) software (none) software 9600 speed Read-only value; configured using the pendingspeed property /SP/serial/host commitpending pendingspeed true|(none) (none) (none) speed Read-only value; configured using the pendingspeed property42 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – On x86-based systems, the speed of the host serial port must match the speed setting for serial port 0, COM1, or /dev/ttys0 on the host operating system for Oracle ILOM to communicate properly with the host. ? Enable HTTP or HTTPS Web Access (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. At the command prompt, use the set command to configure the web access property values. For example, -> set /SP/services/http [propertyname=value] Target Property Value Default /SP/services/http secureredirect enabled| disabled enabled servicestate enabled| disabled disabled port 80 /SP/services/https servicestate enabled| disabled enabled port 443Configuring Network, Secure Shell, and Local Interconnect Settings 43 EXAMPLE: Common web access settings ? Switch Serial Port Output (CLI) Note – To determine whether serial port sharing is supported for your server, refer to the platform Oracle ILOM supplement guide or platform administration guide provided for your server. Caution – You should set up the network on the SP before attempting to switch the serial port owner to the host server. If a network is not set up, and you switch the serial port owner to the host server, you will be unable to connect using the CLI or web interface to change the serial port owner back to the SP. To return the serial port owner setting to the SP, you will need to restore access to the serial port on the server. For more details about restoring access to the server port on your server, refer to the platform documentation supplied with your server. 1. Log in to the Oracle ILOM SP CLI. 2. To set the serial port owner, type: -> set /SP/serial/portsharing /owner=host Desired State Target Property Value Enable HTTP only /SP/services/http secureredirect disabled /SP/services/http servicestate enabled /SP/services/https servicestate disabled Enable HTTP and HTTPS /SP/services/http secureredirect disabled /SP/services/http servicestate enabled /SP/services/https servicestate enabled Enable HTTPS only /SP/services/http secureredirect disabled /SP/services/http servicestate disabled /SP/services/https servicestate enabled Automatically redirect HTTP to HTTPS /SP/services/http /SP/services/http /SP/services/https secureredirect servicestate servicestate enabled disabled enabled44 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – The serial port sharing value by default is owner=SP. 3. Connect a serial host to the serial port on the server using a dongle or multi-port cable. For details on how to use attach devices to the server, refer to the platform installation documentation supplied with your server. Configuring Secure Shell Settings (CLI) ? Establish a Remote SSH Connection (CLI) Before You Begin ¦ To configure Secure Shell (SSH) settings, you need the Admin (a) role enabled. Perform the following step to establish a remote SSH connection to Oracle ILOM. ? To establish an SSH connection to Oracle ILOM, type the following: $ ssh -l username server_ipaddress Password: ******** The default CLI prompt appears and the system is ready for you to run the CLI commands to establish network settings. Description Links Platform Feature Support Procedures for configuring Secure Shell settings • “Establish a Remote SSH Connection (CLI)” on page 44 • “Enable or Disable SSH (CLI)” on page 46 • “View the SSH Authentication Keys (CLI)” on page 46 • “Generate a New SSH Authentication Key (CLI)” on page 47 • “Restart the SSH Server (CLI)” on page 47 • x86 system server SP • SPARC system server SP • CMMConfiguring Network, Secure Shell, and Local Interconnect Settings 45 Related Information ¦ Oracle ILOM 3.0 Quick Start, connect to Oracle ILOM ¦ Oracle ILOM 3.0 Quick Start, log in to Oracle ILOM46 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Enable or Disable SSH (CLI) Before You Begin ¦ To configure Secure Shell (SSH) settings, you need the Admin (a) role enabled. Note – SSH is enabled by default in Oracle ILOM. Follow these steps to enable or disable SSH: 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. If you do not want to provide access over the network, or if you do not want to use SSH, type the following: -> set /SP/services/ssh state=enabled | disabled ? View the SSH Authentication Keys (CLI) Before You Begin ¦ To configure Secure Shell (SSH) settings, you need the Admin (a) role enabled. Note – All of the properties below /SP/services/ssh/keys/rsa|dsa are read only. Follow one of these steps to view the current SSH keys: 1. To view the RSA key, type: -> show /SP/services/ssh/keys/rsa For example: /SP/services/ssh/keys/rsa Targets: Properties: fingerprint = ca:c0:05:ff:b7:75:15:a0:30:df:1b:a1:76:bd:fe:e5 length = 1024 publickey AAAAB3NzaC1yc2EAAAABIwAAAIEAthvlqgXbPIxN4OEvkukKupdFPr8GDaOsKGg BESVlnny4nX8yd8JC/hrw3qDHmXIZ8JAFwoLQgjtZCbEsgpn9nNIMb6nSfu6Y1t TtUZXSGFBZ48ROmU0SqqfR3i3bgDUR0siphlpgV6Yu0Zd1h3549wQ+RWk3vxqHQ Ffzhv9c= Commands: cd showConfiguring Network, Secure Shell, and Local Interconnect Settings 47 2. To view the DSA key, type: ? Generate a New SSH Authentication Key (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. 2. Set the key type by typing the following: -> set /SP/services/ssh generate_new_key_type=dsa|rsa 3. Set the action to true. -> set /SP/services/ssh generate_new_key_action=true The fingerprint and key will look different. The new key will take effect immediately for new connections. ? Restart the SSH Server (CLI) 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. -> show /SP/services/ssh/keys/dsa For example: /SP/services/ssh/keys/dsa Targets: Properties: fingerprint = 6a:90:c7:37:89:e6:73:23:45:ff:d6:8e:e7:57:2a:60 length = 1024 publickey = AAAAB3NzaC1kc3MAAACBAInrYecNH86imBbUqE+3FoUfm/fei2ZZtQzqrMx5zBm bHFIaFdRQKeoQ7gqjc9jQbO7ajLxwk2vZzkg3ntnmqHz/hwHvdho2KaolBtAFGc fLIdzGVxi4I3phVb6anmTlbqI2AILAa7JvQ8dEGbyATYR9A/pf5VTac/TQ70O/J AAAAFQCIUavkex7wtEhC0CH3s25ON0I3CwAAAIBNfHUop6ZN7i46ZuQOKhD7Mkj gdHy+8MTBkupVfXqfRE9Zw9yrBZCNsoD8XEeIeyP+puO5k5dJvkzqSqrTVoAXyY qewyZMFE7stutugw/XEmyjq+XqBWaiOAQskdiMVnHa3MSg8PKJyWP8eIMxD3rIu PTzkV632uBxzwSwfAQAAAIAtA8/3odDJUprnxLgHTowc8ksGBj/wJDgPfpGGJHB B1FDBMhSsRbwh6Z+s/gAf1f+S67HJBTUPsVSMz+czmamc1oZeOazT4+zeNG6uCl u/5/JmJSdkguc1FcoxtBFqfO/fKjyR0ecWaU7L4kjvWoSsydHJ0pMHasEecEBEr lg== Commands: cd show48 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. To restart the SSH server, type the following: -> set /SP/services/ssh restart_sshd_action=true Configuring the Local Interconnect Interface (CLI) Local Interconnect Requirements (CLI) The following requirements must be met prior to performing the procedure for configuring the Local Interconnect Interface. ¦ Review the concepts describing the use of a Local Interconnect Interface between the Oracle ILOM SP and the host OS. For details, refer to “Local Connection to Oracle ILOM From Host Operating System” in Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Review the Oracle ILOM descriptions for the Local Host Interconnect configuration settings. For details, refer to “Local Host Interconnect Configuration Settings in Oracle ILOM” in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ Verify that your server is running Oracle ILOM 3.0.12 or a later version of Oracle ILOM. ¦ Verify that your platform server supports the Local Interconnect Interface. Refer to your platform server Oracle ILOM supplement guide or administration guide. Note – The settings for configuring the Local Interconnect Interface are not supported on the CMM. However you can access and configure these settings for a Sun blade server through the Oracle ILOM CMM CLI or web interface connection. Topic Descriptions Links Platform Feature Support Review the prerequisites • “Local Interconnect Requirements (CLI)” on page 48 • x86 system server SP • SPARC system server SP Configure the Local Interconnect Interface • “Configure Local Interconnect Interface Between Server SP and Host OS(CLI)” on page 49Configuring Network, Secure Shell, and Local Interconnect Settings 49 ¦ Automatic configuration of the Local Interconnect Interface requires the Host Managed (hostmanaged) setting in Oracle ILOM to be enabled (set to True), as well as the installation of the Oracle Hardware Management Pack 2.1.0 or later software on the server. For more information about installing the Oracle Hardware Management Pack 2.1.0 software, refer to the Oracle Server Hardware Management Pack User’s Guide. ¦ Manual configuration of the Local Interconnect Interface between the Oracle ILOM SP and the host operating system requires the Host Managed (hostmanaged) setting in Oracle ILOM to be disabled (set to False), as well as other configuration settings to be set on the host operating system. For guidelines for configuring the host OS connection point on the Local Interconnect Interface, see “Manual Host OS Configuration Guidelines for Local Interconnect Interface” on page 207. ¦ The host operating system must support the internal USB Ethernet device that is presented from the Oracle ILOM SP. Therefore, prior to configuring the Local Interconnect Interface in Oracle ILOM, you should verify that an internal USB Ethernet device driver was included in the operating system distribution and installed on your server. If an internal USB Ethernet device driver was not installed by the operating system distribution, you can obtain the device driver for your operating system from the Oracle Hardware Management Pack 2.1.0 software. For more details, refer to the Oracle Server Hardware Management Pack User’s Guide. ¦ Network parameter changes to the settings in Oracle ILOM for the Local Interconnect Interface are considered pending until you commit the changes in the Oracle ILOM. For example, in the Oracle ILOM CLI, you must issue the commitpending=true command to save the pendingipaddress and the pendingipnetmask under the network/interconnect target. In the Oracle ILOM web interface, network parameter changes entered on the Configure USB Ethernet Parameters dialog box are committed after you click Save. ¦ An Oracle ILOM user account with Administrator (a) role privileges is required in order to change any of the settings in Oracle ILOM for the Local Interconnect Interface. ¦ To determine the operating systems supported on your server, refer to the platform server installation guide or operating system guide(s). ? Configure Local Interconnect Interface Between Server SP and Host OS(CLI) 1. Log in to the Oracle ILOM SP CLI. Establish a local serial console connection or SSH connection to the server SP or CMM.50 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. Navigate to the /x/network/interconnect working directory on the server using the cd command. For example: ¦ For a rackmount server SP type: cd /SP/network/interconnect ¦ For a chassis blade server SP type: cd /CH/BLn/network/interconnect 3. View the network interconnect targets and properties using the show command. Example outputs: ¦ hostmanaged property under the network/interconnect property is set to true. In this configuration example, the host managed state is enabled for auto-configuration by the Oracle Hardware Management Pack 2.1.0 or later software. ¦ hostmanaged property under the network/interconnect property is set to false. In this configuration example, the host managed state is disabled allowing you to manually configure the Oracle ILOM SP and host OS connection points on the Local Interconnect Interface. -> show /SP/network/interconnect Targets: Properties: hostmanaged = true type = USB Ethernet ipaddress = 169.254.182.76 ipnetmask = 255.255.255.0 spmacaddress = 02:21:28:57:47:16 hostmacaddress = 02:21:28:57:47:17 Commands: cd set show -> show /SP/network/interconnect Targets: Properties: hostmanaged = false state = enabled type = USB Ethernet ipaddress = 169.254.182.76 ipnetmask = 255.255.255.0 spmacaddress = 02:21:28:57:47:16Configuring Network, Secure Shell, and Local Interconnect Settings 51 4. To configure the assignment of the non-routable IPv4 addresses to the connection points on the Local Interconnect Interface, you can either: ¦ Automatically assign non-routable IPv4 addresses to each connection point on the Local Interconnect Interface by setting the hostmanaged property to true. -> set hostmanaged=true When you set the hostmanaged property to true, you must also install the Oracle Hardware Management Pack 2.1.0 (or later) software on your server and accept the installation default for enabling Local ILOM Interconnect. For more information, refer to the section about configuring the Local ILOM Interconnect in the Oracle Server Hardware Management Pack User’s Guide. - or- ¦ Manually assign non-routable IPv4 addresses to each connection point on the Local Interconnect Interface by setting the hostmanaged property to false. -> set hostmanaged=false hostmacaddress = 02:21:28:57:47:17 pendingipaddress = 169.254.182.76 pendingipnetmask = 255.255.255.0 commitpending = (Cannot show property) Commands: cd set show52 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 When you set the hostmanaged property to false, you must also manually set the values for the following /network/interconnect properties. Note – To prevent the Oracle Hardware Management Pack software from auto-configuring the connection points on the Local Interconnect Interface, you must set the hostmanaged property value to False. To prevent the use of Local Interconnect Interface between the Oracle ILOM SP and the host OS, you must set the state property value to disabled and the hostmanaged property value to False. Property Set Property Value Description state set state=enabled Type set state=enabled to manually enable the Local Interconnect Interface between the Oracle ILOM SP and host OS. The state property under the interconnect target is disabled by default. pendingipaddr ess set pendingipaddress= 169.254.182.76 Oracle ILOM, by default, provides a non-routable IPv4 address for the Oracle ILOM SP connection point on the Local Interconnect Interface. This default IPv4 address (169.254.182.76) should not be changed unless a conflict exists on the host OS with this IPv4 address. To change the default IPv4 address, type the set pendingipaddress= command followed by the internal IPv4 address that you want to assign to the Oracle ILOM SP connection point on the Local Interconnect Interface. pendingipnetm ask set pendingipnetmask= 255.255.255.0 Oracle ILOM, by default, provides an IPv4 netmask address for the Oracle ILOM SP connection point on the Local Interconnect Interface. This default IPv4 netmask (255.255.255.0) address should not be changed unless a conflict exists in your network environment with this address. To change the default netmask address, type the set pendingipnetmask= command follow by the internal IPv4 netmask that you want to assign to the Oracle ILOM SP connection point on the Local Interconnect Interface. commitpending set commitpending= Changes under the network/interconnect target for both pendingipaddress and pendingipnetmask are considered pending until they are committed. To commit the changes, type: -> set commitpending=true To cancel the changes, type: -> set commitpending=falseConfiguring Network, Secure Shell, and Local Interconnect Settings 53 5. If you chose to manually configure the Local Interconnect Interface in Oracle ILOM without the use of the Oracle Hardware Management Pack 2.1.0 software, you need to perform some additional configuration on the host operating system. For general details about these additional host OS configuration settings, see “Manual Host OS Configuration Guidelines for Local Interconnect Interface” on page 207. EXAMPLE: Help on Local Interconnect Properties For additional information about the values required for the manual local host interconnect configuration properties, type help. For example: ¦ -> help hostmanaged ¦ -> help state ¦ -> help pendingipaddresss ¦ ->help pendingipnetmask ¦ ->help commitpending For additional information about the read-only properties, type: ¦ -> help type ¦ > help ipaddress ¦ > help ipnetmask ¦ > help spmacaddress ¦ -> help hostmacaddress54 Oracle ILOM 3.0 CLI Procedures Guide • May 201155 Managing User Accounts (CLI) Related Information ¦ “Recover a Lost Password (CLI)” on page 23 ¦ Oracle ILOM 3.0 Quick Start, add user account ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Daily Management Concepts, guidelines for managing user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Protocol Management, managing user accounts Description Links CLI procedures for configuring user accounts • “Configuring User Accounts (CLI)” on page 56 CLI procedures for configuring SSH user key • “Configuring SSH User Keys (CLI)” on page 62 CLI procedure for configuring Active Directory settings • “Configuring Active Directory (CLI)” on page 64 CLI procedures for configuring LDAP settings • “Configuring Lightweight Directory Access Protocol (LDAP) (CLI)” on page 75 CLI procedures for configuring LDAP/SSL settings • “Configuring LDAP/SSL (CLI)” on page 77 CLI procedures for configuring RADIUS settings • “Configuring RADIUS (CLI)” on page 8556 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring User Accounts (CLI) ? Configure Single Sign On (CLI) Before You Begin ¦ To disable or enable Single Sign On, you need the Admin (a) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To enable or disable Single Sign On, type the following command: —> set /SP/services/sso state=disabled|enabled ? Add a User Account (CLI) Before You Begin ¦ To create a user account, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. Description Links Platform Feature Support Procedures for managing user accounts in Oracle ILOM. • “Configure Single Sign On (CLI)” on page 56 • “Add a User Account (CLI)” on page 56 • “Change a User Account Password (CLI)” on page 57 • “Assign Roles to a User Account (CLI)” on page 57 • “Delete a User Account (CLI)” on page 59 • x86 system server SP • SPARC system server SP • CMM Procedures for viewing Oracle ILOM user accounts and user sessions. • “View Individual User Accounts (CLI)” on page 59 • “View a List of User Accounts (CLI)” on page 60 • “View a List of User Sessions (CLI)” on page 60 • “View an Individual User Session (CLI)” on page 61Managing User Accounts (CLI) 57 2. To add a local user account, type the following command: —> create /SP/users/username password=password For example: Note – When adding a user account, it is unnecessary to provide a role or password property. The role will default to Read Only (o), and the CLI will prompt you to provide and confirm a password. ? Change a User Account Password (CLI) Before You Begin ¦ To add or modify user account properties, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To change a user account password, type the following command: —> set /SP/users/user password For example: ? Assign Roles to a User Account (CLI) Before You Begin ¦ To add or modify user account role properties, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To assign roles to a user account, type the following command: -> create /SP/users/user5 Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/user5 -> set /SP/users/user5 password Enter new password: ******** Enter new password again: ********58 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 —> set /SP/users/ password= role= For example: -> set /SP/users/user5 role=auc Set ’role’ to ’auc’-> show /SP/users/user5 Targets: ssh Properties: role = auco password = ******** Commands: cd set show User Role Descriptions User roles (CLI) User role permissions granted (CLI) (a) Admin (a). Read and write permissions are granted to all Oracle ILOM system management functions with the exception of the functions that would require the Admin to have these additional user roles enabled: User Management (u), Reset and Host Control (r), Console (c), and Services (s). (u) User Management (u). Read and write permissions are granted to a user for all Oracle ILOM user account management functions. (c) Console (c). Read and write permissions are granted to a user to perform these remote console management functions: manage remote console lock options, manage SP console history log options, launch and use Oracle ILOM Remote Console, and launch and use Oracle ILOM Storage Redirection CLI. (r) Reset and Host Control (r). Read and write permissions are granted to a user to perform these remote host management functions: host boot device control, run and configure diagnostics utilities, reset SP, reset CMM, component management service actions, fault management actions, SPARC TPM management actions, and downloads of SNMP MIBs. (o) Read Only (o). Read only permissions are granted to a user to view the state of all ILOM configuration properties. In addition, write permissions are granted to a user to change only the password and session time-out properties assigned to their own user account. (s) Services (s). Read and write permissions are granted to a user to assist Oracle service engineers in the event that on-site service is required.Managing User Accounts (CLI) 59 ? Delete a User Account (CLI) Before You Begin ¦ To remove a user account, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To delete a local user account, type the following command: —> delete /SP/users/username For example: -> delete /SP/users/user5 3. When queried, type y to delete, or n to cancel. For example: Are you sure you want to delete /SP/users/user5 (y/n)? y Deleted /SP/users/user5 ? View Individual User Accounts (CLI) 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display information about one specific user account, type the following command: —> show /SP/users/username For example: (aucro) A combination of all these users roles (aucro) grant read and write permissions to a user to perform backup and restore configuration functions. Note - aucro is equivalent to the Administrator user role profile in the web interface. -> show /SP/users/user1 /SP/users/user1 Targets: ssh Properties: role = aucros User Role Descriptions60 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? View a List of User Accounts (CLI) 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display information about all local user accounts, type the following command: —> show /SP/users For example: ? View a List of User Sessions (CLI) 1. Log in to the Oracle ILOM CLI SP or CMM.. 2. To display information about all local user sessions, type the following command: —> show /SP/sessions For example: password = ***** Commands: cd set show -> show /SP/users /SP/users Targets: user1 user2 user3 user4 -> show /SP/sessions /SP/sessions Targets 12 (current) Properties:Managing User Accounts (CLI) 61 ? View an Individual User Session (CLI) Note – To view an individual user’s role, you must be using Oracle ILOM 3.0.4 or a later version of Oracle ILOM. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display information about an individual user session, type the following command: —> show /SP/sessions/session_number For example: Commands: cd show -> show /SP/sessions/12 /SP/sessions/12 Targets: Properties: username = user4 role = aucro starttime = Mon Apr 13 06:25:19 2009 type = shell mode = normal Commands: cd show62 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring SSH User Keys (CLI) ? Add an SSH Key Before You Begin ¦ To add SSH keys for other users, you need to have the User Management (u) role enabled. ¦ To add an SSH key to your user account only requires you to have the Read Only (o) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To change to the directory location of a user’s SSH key, type: -> cd /SP/users/user1/ssh/keys/1 3. To add a key to the user’s account, type: -> set load_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the location of the SSH key on the remote system. Description Links Platform Feature Support Procedures for managing an SSH user key properties • “Add an SSH Key” on page 62 • “Delete an SSH Key (CLI)” on page 63 • x86 system server SP • SPARC system server SP • CMMManaging User Accounts (CLI) 63 ¦ filename is the name assigned to the SSH key file. For example: ? Delete an SSH Key (CLI) Before You Begin ¦ To delete SSH keys for other users, you need to have the User Management (u) role enabled. ¦ To delete your own SSH key only requires you to have the Read Only (o) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To change to the directory location of a user’s SSH key, type: -> cd /SP/users/user1/ssh/keys/1 3. To delete a key from the user’s account, type: -> set clear_action=true The following confirmation prompt appears: Are you sure you want to clear /SP/users/user1/ssh/keys/1 (y/n)? 4. Type y. The SSH key is deleted and the following message appears to confirm the deletion. Set ’clear_action’ to ’true’ -> set load_uri= scp://adminuser:userpswd@1.2.3.4/keys/sshkey_1.pub Set ’load_uri’ to ’scp://adminuser:userpswd@1.2.3.4/keys/sshkey_1.pub’64 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring Active Directory (CLI) ? Enable Active Directory strictcertmode (CLI) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. Note – By default, strictcertmode is disabled. When this variable is disabled, the channel is secure, but limited validation of the certificate is performed. If strictcertmode is enabled, then the server’s certificate must have already been uploaded to the server so that the certificate signatures can be validated when the server certificate is presented. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Type the following path to access the Active Directory certificate settings: ->cd /SP/clients/activedirectory/cert 3. To load a certificate, type the following: -> set load_uri=tftp://IP address/file-path/filename Description Links Platform Feature Support Procedures for managing Active Directory settings • “Enable Active Directory strictcertmode (CLI)” on page 64 • “Check Active Directory certstatus (CLI)” on page 65 • “Remove an Active Directory Certificate (CLI)” on page 66 • “View and Configure Active Directory Settings (CLI)” on page 67 • “Troubleshoot Active Directory Authentication and Authorization (CLI)” on page 74 • x86 system server SP • SPARC system server SP • CMMManaging User Accounts (CLI) 65 Note – You can use TFTP, FTP, or SCP to load a certificate. Alternatively, you can load an SSL certificate for Active Directory using the load -source command from anywhere on the CLI. For example: -> load -source URI_to_SSL_certificate target 4. To enable strictcertmode, type the following: -> set strictcertmode=enabled Note – Data is always protected, even if strictcertmode is disabled. ? Check Active Directory certstatus (CLI) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. Note – certstatus is an operational variable that should reflect the current certificate state. Neither is required to exist if strictcertmode is disabled. However, for the strictcertmode to be enabled, a certificate must be loaded. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To check the status of the certificate, type the following: -> show /SP/clients/activedirectory/cert For example: -> show /SP/clients/activedirectory/cert Targets: Properties: certstatus = certificate present clear_action = (none) issuer = /DC=com/DC=oracle/DC=east/DC=sales/CN= CAforActiveDirectory load_uri = (none) serial_number = 08:f3:2e:c0:8c:12:cd:bb:4e:7e:82:23:c4:0d:22:60 subject = /DC=com/DC=oracle/DC=east/DC=sales/CN= CAforActiveDirectory valid_from = Oct 25 22:18:26 2006 GMT66 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Remove an Active Directory Certificate (CLI) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. Note – The Authentication Server Certificate can be removed only when strictcertmode is disabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Type the following: -> cd /SP/clients/activedirectory/cert 3. To remove a certificate, type one of the following commands: ¦ -> set clear_action=true ¦ -> reset For example: -> reset /SP/clients/activedirectory/cert 4. Confirm whether you want to remove the certificate by typing y or n in response to the on-screen query. The existing certificate file that had been uploaded will be removed. valid_until = Oct 25 22:18:26 2011 GMT version = 3 (0x02) Commands: cd load reset set showManaging User Accounts (CLI) 67 ? View and Configure Active Directory Settings (CLI) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Use the show and set commands to view and modify the active directory properties: ¦ To view and modify information in the admingroups target: -> show /SP/clients/activedirectory/admingroups/n where n can be 1 to 5. For example: Then use the set command to modify properties. For example: ¦ To view and modify information in the opergroups target: -> show /SP/clients/activedirectory/opergroups/1 For example: Then use the set command to modify properties. -> show /SP/clients/activedirectory/admingroups/1 /SP/clients/activedirectory/admingroups/1 Targets: Properties: name = CN=SpSuperAdmin,OU=Groups,DC=sales,DC= east,DC=oracle,DC=com -> set /SP/clients/activedirectory/admingroups/1/ name=CN= spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle, DC=com' -> show /SP/clients/activedirectory/opergroups/1 /SP/clients/activedirectory/opergroups/1 Targets: Properties: name = CN=SpSuperOper,OU=Groups,DC=sales,DC= east,DC=oracle,DC=com68 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 For example: ¦ To view and modify information in the customgroups target: -> show /SP/clients/activedirectory/customgroups/1 For example: Then use the set command to modify properties. For example: ¦ To view and modify information in the userdomains target: -> show /SP/clients/activedirectory/userdomains/1 For example: Then use the set command to modify properties. -> set /SP/clients/activedirectory/opergroups/1 name=CN= spSuperOper,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC= com' -> show /SP/clients/activedirectory/customgroups/1 /SP/clients/activedirectory/customgroups/1 Targets: Properties name = custom_group_1 roles = aucro -> set /SP/clients/activedirectory/customgroups/1 name=CN= spSuperCust,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC= com' -> set /SP/clients/activedirectory/customgroups/1 roles=au Set 'roles' to 'au' -> show /SP/clients/activedirectory/userdomains/1 /SP/clients/activedirectory/userdomains/1 Targets: Properties: domain = @sales.example.oracle.comManaging User Accounts (CLI) 69 For example: Note – In the preceding example, will be replaced with the user’s login name. During authentication, the user’s login name replaces . Names can take the form of fully qualified domain name (FQDN), domain\name (NT), or simple name. ¦ To view and modify information in the alternateservers target: -> show /SP/clients/activedirectory/alternateservers/1 For example: Note – The address property can be either the IP address or DNS (host name). If using DNS, DNS must be enabled. For more information on enabling DNS, see “View and Configure DNS Settings (CLI)” on page 40. Then use the set command to modify properties. For example: You can also use the show command to view the alternate server certificate information. For example: -> set /SP/clients/activedirectory/userdomains/1 domain= @sales.example.oracle.com Set 'domain' to '@sales.example.oracle.com' -> show /SP/clients/activedirectory/alternateservers/1 /SP/clients/activedirectory/alternateservers/1 Targets: cert Properties: address = 10.8.168.99 port = 0 -> set /SP/clients/activedirectory/alternateservers/1 port=636 -> show /SP/clients/activedirectory/alternateservers/1/cert /SP/clients/activedirectory/alternateservers/1/cert Targets: Properties: certstatus = certificate present70 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Type the following to copy a certificate for an alternate server: -> cd /SP/clients/activedirectory/alternateservers/1 -> set load_uri= :[//]@//// The following is an example of a certificate copied using TFTP: Note – The TFTP transfer method does not require a user name and password. The following is an example of a certificate copied using FTP: The following is an example of a certificate copied using SCP: Type the following to remove a certificate for an alternate server: -> cd /SP/clients/activedirectory/alternateservers/1 -> set clear_action=true clear_action = (none) issuer = /DC=com/DC=oracle/DC=east/DC=sales/CN CAforActiveDirectory load_uri = (none) serial_number = 08:f3:2e:c0:8c:12:cd:bb:4e:7e:82:23:c4:0d:22:60 subject = /DC=com/DC=oracle/DC=east/DC=sales/CN= CAforActiveDirectory valid_from = Oct 25 22:18:26 2006 GMT valid_until = Oct 25 22:18:26 2011 GMT version = 3 (0x02) -> set load_uri=tftp://10.8.172.152/sales/cert.cert Set ’load_uri’ to ’tftp://10.8.172.152/sales/cert.cert’ -> set load_uri= ftp://sales:XpasswordX@129.148.185.50/8275_put/cert.cert Set ’load_uri’ to ’ftp://sales:XpasswordX@129.148.185.50/8275_put/cert.cert’ > set load_uri= scp://sales:XpasswordX@129.148.185.50/home/dc150698/8275_put/cert .certManaging User Accounts (CLI) 71 For example: ¦ To view information in the dnslocatorqueries target, use the show command. For example: -> show /SP/clients/activedirectory/dnslocatorqueries/1 Note – DNS and DNS Locator Mode must be enabled for DNS locator queries to work. For information about enabling DNS, see “View and Configure DNS Settings (CLI)” on page 40. The DNS locator service query identifies the named DNS service. The port ID is generally part of the record, but you can override it by using the format . In addition, you can use the substitution marker to specify named services for a specific domain being authenticated. Then use the set command to modify properties in the dnslocatorqueries target. For example: -> set clear_action=true Are you sure you want to clear /SP/clients/activedirectory/cert (y/n)? y Set ’clear_action’ to ’true’ -> show /SP/clients/activedirectory/dnslocatorqueries/1 /SP/clients/activedirectory/dnslocatorqueries/1 Targets: Properties: service = _ldap._tcp.gc._msdcs.. Commands: cd set show -> set /SP/clients/activedirectory/dnslocatorqueries/1 service= 72 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ To view and modify the expsearchmode property: Note – To view and configure the expsearchmode property, you must be using Oracle ILOM 3.0.4 or a later. -> show /SP/clients/activedirectory For example: Then use the set command to enable or disable the property. For example: ¦ To view and modify the strictcredentialerrormode property: -> show /SP/clients/activedirectory /SP/clients/activedirectory Targets: admingroups alternateservers cert customgroups dnslocatorqueries opergroups userdomains Properties: address = 0.0.0.0 defaultrole = (none) dnslocatormode = disabled expsearchmode = disabled logdetail = none port = 0 state = disabled strictcertmode = disabled strictcredentialerrormode = disabled timeout = 4 Commands: cd set show -> set /SP/clients/activedirectory expsearchmode=enabled Set 'expsearchmode' to 'enabled'Managing User Accounts (CLI) 73 Note – As of Oracle ILOM 3.0.10, the strictcredentialalerrormode is available to control how user credential errors are processed. If this mode is enabled, a credential error reported from any server fails those user credentials. When the mode is disabled (default setting), the credentials can be presented to other servers for authentication. -> show /SP/clients/activedirectory For example: Then use the set command to enable or disable the property. For example: -> show /SP/clients/activedirectory /SP/clients/activedirectory Targets: admingroups alternateservers cert customgroups dnslocatorqueries opergroups userdomains Properties address = 0.0.0.0 defaultrole = (none) dnslocatormode = disabled expsearchmode = disabled logdetail = none port = 0 state = disabled strictcertmode = disabled strictcredentialerrormode = disabled timeout = 4 Commands: cd set show -> set /SP/clients/activedirectory strictcredentialerrormode= enabled Set 'strictcredentialerrormode' to 'enabled'74 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Troubleshoot Active Directory Authentication and Authorization (CLI) Before You Begin ¦ To configure Active Directory settings, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Type the following commands: -> cd /SP/clients/activedirectory /SP/clients/activedirectory -> set logdetail=trace Set ’logdetail’ to ’trace’ 3. Perform another authorization attempt by logging out, then logging back in to the Oracle ILOM CLI and typing the following command: -> show /SP/logs/event/list Class==(ActDir) Type==(Log) Severity== (Trace) For example: For more information on configuring event log detail, see “Scroll, Dismiss, or Clear the Oracle ILOM Event Log List” on page 100. -> show /SP/logs/event/list Class==(ActDir) Type==(Log) ID Date/Time Class Type Severity ----- ------------------------ -------- -------- -------- 26 Thu Jul 10 09:40:46 2008 ActDir Log minor (ActDir) authentication status: auth-OK 25 Thu Jul 10 09:40:46 2008 ActDir Log minor (ActDir) server-authenticate: auth-success idx 100/0 dns-server 10.8.143 .231 24 Thu Jul 10 09:40:46 2008 ActDir Log debug (ActDir) custRoles 23 Thu Jul 10 09:40:46 2008 ActDir Log debug (ActDir) role-name administratorManaging User Accounts (CLI) 75 Configuring Lightweight Directory Access Protocol (LDAP) (CLI) ? Configure the LDAP Server (CLI) Before You Begin ¦ To configure LDAP settings, you need the User Management (u) role enabled. 1. Ensure that passwords for user accounts authenticating to Oracle ILOM are in crypt format, using a GNU extension, commonly referred to MD5 crypt. Oracle ILOM only supports LDAP authentication for passwords stored in these two variations of the crypt format. For example: userPassword: {CRYPT}ajCa2He4PJhNo or userPassword: {CRYPT}$1$pzKng1$du1Bf0NWBjh9t3FbUgf46. 2. Add object classes posixAccount and shadowAccount, and populate the required property values for this schema (RFC 2307). Description Links Platform Feature Support Procedures for managing LDAP settings • “Configure the LDAP Server (CLI)” on page 75 • “Configure Oracle ILOM for LDAP (CLI)” on page 76 • x86 system server SP • SPARC system server SP • CMM Required Property Description uid User name for logging in to Oracle ILOM uidNumber Any unique number gidNumber Any unique number userPassword Password homeDirectory Any value (this property is ignored by Oracle ILOM) loginShell Any value (this property is ignored by Oracle ILOM)76 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 3. Configure the LDAP server to enable LDAP server access to Oracle ILOM user accounts. Either enable your LDAP server to accept anonymous binds, or create a proxy user on your LDAP server that has read-only access to all user accounts that will authenticate through Oracle ILOM. See your LDAP server documentation for more details. ? Configure Oracle ILOM for LDAP (CLI) Before You Begin ¦ To configure LDAP settings, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Enter the proxy user name and password. Type: —> set /SP/clients/ldap binddn="cn=proxyuser, ou=people, ou=sales, dc=oracle, dc=com" bindpw=password 3. Enter the IP address of the LDAP server. Type: —> set /SP/clients/ldap address=ldapipaddress |DNS name Note – If using a DNS name, DNS must be configured and functioning. 4. Assign the port used to communicate with the LDAP server; the default port is 389. Type: —> set /SP/clients/ldap port=ldapport 5. Enter the Distinguished Name of the branch of your LDAP tree that contains users and groups. For example, type: —> set /SP/clients/ldap searchbase="ou=people, ou=sales, dc=oracle, dc=com" This is the location in your LDAP tree that you want to search for user authentication. 6. Set the state of the LDAP service to enabled. Type: —> set /SP/clients/ldap state=enabled 7. To verify that LDAP authentication works, log in to Oracle ILOM using an LDAP user name and password.Managing User Accounts (CLI) 77 Note – Oracle ILOM searches local users before LDAP users. If an LDAP user name exists as a local user, Oracle ILOM uses the local account for authentication. Configuring LDAP/SSL (CLI) ? Enable LDAP/SSL strictcertmode Before You Begin ¦ To configure LDAP/SSL settings, you need the User Management (u) role enabled. Note – By default, strictcertmode is disabled. When this variable is disabled, the channel is secure, but limited validation of the certificate is performed. If strictcertmode is enabled, then the server’s certificate must have already been uploaded to the server so that the certificate signatures can be validated when the server certificate is presented. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To navigate to the LDAP/SSL certificate target, type: -> cd /SP/clients/ldapssl/cert Description Links Platform Feature Support Procedures for configuring LDAP/SSL settings • “Enable LDAP/SSL strictcertmode” on page 77 • “Check LDAP/SSL certstatus” on page 78 • “Remove an LDAP/SSL Certificate (CLI)” on page 79 • “View and Configure LDAP/SSL Settings (CLI)P” on page 79 • “Troubleshoot LDAP/SSL Authentication and Authorization (CLI)” on page 84 • x86 system server SP • SPARC system server SP • CMM78 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 3. To load a certificate, type the following: -> set load_uri=tftp://IP address/file-path/filename Note – You can use TFTP, FTP, or SCP to load a certificate. 4. To enable strictcertmode, type the following: -> set strictcertmode=enabled ? Check LDAP/SSL certstatus Note – certstatus is an operational variable that should reflect the current certificate state of the certificate if strictcertmode is disabled. However, for the strictcertmode to be enabled, a certificate must be loaded. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To check the status of the certificate, type the following: -> show /SP/clients/ldapssl/cert For example: -> show /SP/clients/ldapssl/cert Targets: Properties: certstatus = certificate present clear_action = (none) issuer = /C=US/O=Entrust PKI Demonstration Cerificates load_uri = (none) serial_number = 08:f23:2e:c0:8c:12:cd:bb:4e:7e:82:23:c4:0d:22:60 subject = /C=US/O=Entrust PKI Demonstration Cerificates/OU=Entrust/Web Connector/OU=No Liability as per http://freecerts.entrust valid_from = Oct 25 22:18:26 2006 GMT valid_until = Oct 25 22:18:26 2011 GMT version = 3 (0x02)Managing User Accounts (CLI) 79 ? Remove an LDAP/SSL Certificate (CLI) Before You Begin ¦ To configure LDAP/SSL settings, you need the User Management (u) role enabled. Note – To remove the Authentication Server Certificate strictcertmode must be disabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Type the following: -> cd /SP/clients/ldapssl/cert 3. To remove a certificate, type the following: -> set clear_action=true 4. Confirm whether you want to remove the certificate by typing y (yes) or n (no) in response to the on-screen query. The existing certificate file that had been uploaded will be removed. ? View and Configure LDAP/SSL Settings (CLI)P Before You Begin ¦ To configure LDAP/SSL settings, you need the User Management (u) role enabled. Note – To view and configure the optionalUserMapping target, you must be using Oracle ILOM 3.0.4 or a later version of Oracle ILOM. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To view and modify LDAP/SSL properties use the show and set commands. ¦ To view and modify information in the admingroups target: -> show /SP/clients/ldapssl/admingroups/n where n can be 1 to 5. For example: -> show /SP/clients/ldapssl/admingroups/180 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Then use the set command to modify properties. For example: ¦ To view and modify information in the opergroups target: -> show /SP/clients/ldapssl/opergroups/1 For example: Then use the set command to modify properties. For example: ¦ To view and modify information in the customgroups target: -> show /SP/clients/ldapssl/customgroups/1 For example: /SP/clients/ldapssl/admingroups/1 Targets: Properties: name = CN=SpSuperAdmin,OU=Groups,DC=sales,DC= east,DC=oracle,DC=com -> set /SP/clients/ldapssl/admingroups/1/ name=CN= spSuperAdmin,OU=Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperAdmin,OU=Groups,DC=sales,DC=oracle, DC=com' -> show /SP/clients/ldapssl/opergroups/1 /SP/clients/ldapssl/opergroups/1 Targets: Properties: name = CN=SpSuperOper,OU=Groups,DC=sales,DC= east,DC=oracle,DC=com -> set /SP/clients/ldapssl/opergroups/1 name=CN=spSuperOper,OU= Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperOper,OU=Groups,DC=sales,DC=oracle,DC= com' /SP/clients/ldapssl/customgroups/1 Targets: Properties: name = roles = (none) Commands:Managing User Accounts (CLI) 81 Then use the set command to modify properties. For example: ¦ To view and modify information in the userdomains target: -> show /SP/clients/ldapssl/userdomains/1 For example: Then use the set command to modify properties. For example: Note – In the preceding example, will be replaced with the user’s login name during authentication. Names can take the form of a fully qualified domain name (FQDN). ¦ To view and modify information in the alternateservers target: -> show /SP/clients/ldapssl/alternateservers/1 cd set show -> set /SP/clients/ldapssl/customgroups/1 name=CN=spSuperCust,OU= Groups,DC=sales,DC=oracle,DC=com Set 'name' to 'CN=spSuperCust,OU=Groups,DC=sales,DC=oracle,DC= com' -> set /SP/clients/ldapssl/customgroups/1 roles=au Set 'roles' to 'au' -> show /SP/clients/ldapssl/userdomains/1 Targets: Properties: domain = uid=,ou=people,dc=oracle,dc=com Commands: cd set show -> set SP/clients/ldapssl/userdomains1 domain=uid=, ou= people,dc=oracle,dc=oracle82 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 For example: Note – In the preceding example, address can be either the IP address or DNS name. If using DNS, DNS must be enabled. For more information about enabling DNS, see “View and Configure DNS Settings (CLI)” on page 40. Then use the set command to modify properties. For example: You can also use the show command to view the alternate server certificate information. For example: -> show /SP/clients/ldapssl/alternateservers/1 /SP/clients/ldapssl/alternateservers/1 Targets: cert Properties: address = 10.8.168.99 port = 0 -> set /SP/clients/ldapssl/alternateservers/1 port=636 -> show /SP/clients/ldapssl/alternateservers/1/cert /SP/clients/ldapssl/alternateservers/1/cert Targets: Properties: certstatus = certificate present clear_action = (none) issuer = /C=US/O=Entrust PKI Demonstration Cerificates load_uri = (none) serial_number = 08:f23:2e:c0:8c:12:cd:bb:4e:7e:82:23:c4:0d:22:60 subject = /C=US/O=Entrust PKI Demonstration Cerificates/OU=Entrust/Web Connector/OU=No Liability as per http://freecerts.entrust valid_from = Oct 25 22:18:26 2006 GMT valid_until = Oct 25 22:18:26 2011 GMT version = 3 (0x02)Managing User Accounts (CLI) 83 Type the following to copy a certificate for an alternate server: -> set load_uri= :[]@//// The following is an example of a certificate copied using TFTP Note – The TFTP transfer method does not require a user name and password. The following is an example of a certificate copied using FTP: The following is an example of a certificate copied using SCP: Type the following to remove a certificate for an alternate server: -> set clear_action=true For example: ¦ To view and modify information in the optionalUserMapping target: -> show /SP/clients/ldapssl/optionalUserMapping For example: -> set load_uri=tftp://10.8.172.152/sales/cert.cert Set ’load_uri’ to ’tftp://10.8.172.152/sales/cert.cert’ -> set load_uri= ftp://sales:XpasswordX@129.148.185.50/8275_put/cert.cert Set ’load_uri’ to ’ftp://sales:XpasswordX@129.148.185.50/8275_put/cert.cert’ -> load_uri scp://sales:XpasswordX@129.148.185.50/home/dc150698/8275_put/cert.cert -> set clear_action=true Are you sure you want to clear /SP/clients/ldapssl/cert (y/n)? y Set ’clear_action’ to ’true’ -> show /SP/clients/ldapssl/optionalUserMapping Targets: Properties: attributeInfo = (&(objectclass=person)(uid=))84 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Then use the set command to modify properties. For example: ? Troubleshoot LDAP/SSL Authentication and Authorization (CLI) Before You Begin ¦ To configure LDAP/SSL settings, you need the User Management (u) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Type the following commands: -> cd /SP/clients/ldapssl /SP/clients/ldapssl -> set logdetail=trace Set ’logdetail’ to ’trace’ 3. Perform another authorization attempt by logging out, then logging back in to the Oracle ILOM CLI and typing the following: binddn = cn=Manager,dc=oracle,dc=com bindpw = (none) searchbase = ou=people,dc=oracle,dc=com state = disabled Commands: cd set show -> set state=enabled Set ’state’ to ’enabled’Managing User Accounts (CLI) 85 -> show /SP/logs/event/list Class==(ldapssl) Type==(Log) Severity= =(Trace) For example: For more information about configuring event log detail, see “Scroll, Dismiss, or Clear the Oracle ILOM Event Log List” on page 100. Configuring RADIUS (CLI) ? Configure RADIUS (CLI) Before You Begin ¦ To configure RADIUS settings, you need the User Management (u) role enabled. ¦ After the RADIUS server is properly configured, you can use RADIUS authentication to provide access to Oracle ILOM beyond the 10 local user accounts. 1. Collect the appropriate information about your RADIUS environment. -> show /SP/logs/event/list Class==(ldapssl) Type==(Log) ID Date/Time Class Type Severity ----- ------------------------ -------- -------- -------- 3155 Thu Nov 13 06:21:00 2008 LdapSsl Log critical (LdapSSL) authentication status: auth-ERROR 3154 Thu Nov 13 06:21:00 2008 LdapSsl Log major (LdapSSL) server-authenticate: auth-error idx 0 cfg-server 10.8.xxx.xxx 3153 Thu Nov 13 06:21:00 2008 LdapSsl Log major (LdapSSL) ServerUserAuth - Error 0, error binding user to ActiveDirectory server Description Links Platform Feature Support Procedures for configuring RADIUS settings • “Configure RADIUS (CLI)” on page 85 • x86 system server SP • SPARC system server SP • CMM86 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. Log in to the Oracle ILOM SP CLI or the CMM CLI and use the cd command to navigate to /SP/clients/radius. For example, type: cd /SP/clients/radius 3. Use the show command to view the radius properties. For example, type: -> show /SP/clients/radius 4. Use the set command to configure the radius properties described in the below table. Syntax: set /SP/clients/radius [defaultrole= [Administrator|Operator|a|u|c|r|s] address=radius_server_IPaddress port=port# secret=radius_secret state=[enabled|disabled]] Example: -> show /SP/clients/radius /SP/clients/radius Targets: Properties: defaultrole = Operator address = 129.144.36.142 port = 1812 secret = (none) state = enabled Commands: cd set show -> set /SP/clients/radius state=enabled address=10.8.145.77 Set 'state' to 'enabled' Set 'address' to '10.8.145.77Managing User Accounts (CLI) 87 Property (CLI) Default Description state Disabled Enabled | Disabled Specifies whether the RADIUS client is enabled or disabled. defaultrole a|u|c|r|s|Administrator| Operator Operator Administrator | Operator | Advanced Roles Access role granted to all authenticated RADIUS users. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of ’a’, ’u’, ’c’, ’r’, ’o’ and ’s’. For example, aucros, where a=Admin, u=User Management, c=Console, r=Reset and Host Control, and s=Service. ipaddress 0.0.0.0 IP address or DNS name of the RADIUS server. If the DNS name is used, DNS must be configured and functional. port 1812 Specifies the port number used to communicate with the RADIUS server. The default port is 1812. secret (none) Specifies the shared secret that is used to protect sensitive data and to ensure that the client and server recognize each other.88 Oracle ILOM 3.0 CLI Procedures Guide • May 201189 Managing Component Status and Service Actions (CLI) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, fault management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage system components ¦ Oracle ILOM 3.0 Protocol Management, managing system component information Descriptions Links CLI procedures for managing system component status and service actions • “Prepare to Remove a Component (CLI)” on page 91 • “Return a Component to Service (CLI)” on page 92 • “Enable and Disable Component State (CLI)” on page 92 • “View and Clear Faults (CLI)” on page 9390 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? View Component Information (CLI) 1. Log in to the Oracle ILOM CLI SP or CMM. 2. At the prompt, type: -> show component_name type For example: The properties that display inventory information are listed below. The properties that you are able to view depend on the target type you use. ¦ fru_part_number ¦ fru_manufacturer ¦ fru_serial_number ¦ fru_name ¦ fru_description ¦ fru_version ¦ chassis_serial_number ¦ chassis_part_number ¦ product_name ¦ product_serial_number ¦ product_part_number ¦ customer_frudata -> show /SYS/MB type Properties: type = Motherboard Commands: showManaging Component Status and Service Actions (CLI) 91 ? Prepare to Remove a Component (CLI) Before You Begin ¦ For you to notify Oracle ILOM of the removal of a component in the chassis, you need the Reset and Host Control (r) role enabled. To prepare a chassis component for removal, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. At the Oracle ILOM command prompt, type: —> set target prepare_to_remove_action=true For example: After you prepare the component for removal, you can verify that it is ready to be physically removed. 3. At the Oracle ILOM command prompt, type: —> show target prepare_to_remove_status For example: The Ready|NotReady statement in the example shows whether the device is ready to be removed. -> set /CH/RFM0 prepare_to_remove_action=true Set ’prepare_to_remove_action’ to ’true’ -> show /CH/RFM0 prepare_to_remove_status Properties: prepare_to_remove_status = Ready|NotReady Commands: cd set show start stop92 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Return a Component to Service (CLI) Before You Begin ¦ For you to notify Oracle ILOM of a component returning to service, you need the Reset and Host Control (r) role enabled. Note – If you have already prepared a component for removal, and you wish to undo the action, you can do so remotely. To return a chassis component to service, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. At the Oracle ILOM command prompt, type: —> set target return_to_service_action=true For example: ? Enable and Disable Component State (CLI) Before You Begin ¦ For you to manage the state of chassis components in Oracle ILOM, you need the Reset and Host Control (r) role enabled. To enable or disable the state of a chassis component, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. At the Oracle ILOM command prompt, type: -> set /CH/RFM0 return_to_service_action=true Set ’return_to_service_action’ to ’true’Managing Component Status and Service Actions (CLI) 93 —> set component_state=enabled|disabled For example: ? View and Clear Faults (CLI) Before You Begin ¦ For you to clear component faults reported in Oracle ILOM, the Admin (a) role must be enabled. ¦ The server SP or CMM must have Oracle ILOM firmware 3.0.3 or later installed To view and clear faults in Oracle ILOM, follow these steps: 1. Log in to the Oracle LOM SP or CMM. 2. To view a list of components that have been faulted: ¦ From a server, type: ->show /SP/faultmgmt ¦ From the CMM, type: ->show /CMM/faultmgmt 3. To display fault messages in the Oracle ILOM event log: ¦ From the server, type: ->show /SP/logs/event/list ¦ From the CMM, type: ->show /CMM/logs/event/list 4. Fix or replace the faulted component. 5. To clear a fault on a component, type the following command: where component_path is one of the following faulted components: ¦ Processor ¦ Memory ¦ Motherboard -> set /SYS/MB/CMP0/P0/C0 component_state=enabled Set ‘component_state’ to ‘enabled’ ->set component_path clear_fault_action=true Are you sure you want to clear component_path (y/n)? y Set ’clear_fault_action’ to ’true’94 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ Fan module ¦ Power supply ¦ CMM ¦ NEM ¦ PCI card For example, to clear a processor fault, you would type the following: -> set /SYS/MB/P0 clear_fault_action=true Are you sure you want to clear /SYS/MB/P0 (y/n)? y Set ’clear_fault_action’ to ’true’95 Monitoring System Sensors and Managing the Event Log (CLI) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, system monitoring and alert management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, monitoring system sensors, indicators, and event log ¦ Oracle ILOM 3.0 Protocol Management, inventory and component management Description Links Procedures for monitoring system sensors, indicators, and logs • “Monitoring System Sensors, Indicators, and Oracle ILOM Event Logs (CLI)” on page 96 Procedure for viewing and managing the SP console history log • “View and Manage SP Console Log Output (CLI)” on page 10396 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Monitoring System Sensors, Indicators, and Oracle ILOM Event Logs (CLI) ? View Sensor Readings (CLI) To view sensor readings, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To navigate to the sensor target and view the sensor properties, use the cd and show commands: ¦ From server SP, type: cd /SYS ¦ From CMM type: cd /CH Then type: Description Links Platform Feature Support View and configure LEDs and system indicators • “View Sensor Readings (CLI)” on page 96 • “Configure System Status Indicators (CLI)” on page 98 • x86 system server SP • SPARC system server SP • CMM Set the clock and timezone • “Configure Clock Properties (CLI)” on page 99 Filter, view, and clear event logs • “Filter Oracle ILOM Event Log List (CLI)” on page 100 • “Scroll, Dismiss, or Clear the Oracle ILOM Event Log List” on page 100 • “Configure Remote Syslog Receiver IP Addresses (CLI)” on page 102Monitoring System Sensors and Managing the Event Log (CLI) 97 ->show On some platform servers, for example, you can view the temperature reading for these ambient air intake by typing the following: ->cd /SYS/T_AMB ->show The properties describing the sensor target appear. For example: For specific details about the type of threshold sensor targets you can access, refer to the user documentation provided with the Oracle Sun system hardware. 3. To view a discrete sensor reading, use the cd command to navigate to the discrete sensor target, then use the show command to display the sensor readings, for example: -> cd /SP//target (or, cd /CH/target ) ->show On some Oracle Sun platform servers, for example, you can determine whether a hard drive is present in slot 0 by typing: ->cd /SYS/HDD0_PRSNT ->show For specific details about the type of discrete sensor targets you can manage, refer to the user documentation provided with the Oracle Sun system hardware. type = Temperature class = Threshold Sensor value = 27.000 degree C upper_nonrecov_threshold = 45.00 degree C upper_critical_threshold = 40.00 degree C upper_noncritical_threshold = 35.00 degree C lower_noncritical_threshold = 10.00 degree C lower_critical_threshold = 4.00 degree C lower_nonrecov_threshold = 0.00 degree C alarm_status = cleared Type = Entity Presence Class = Discrete Indicator Value = Present98 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Configure System Status Indicators (CLI) Before You Begin For you to configure the state of a system indicator using Oracle ILOM, you need the User Management (u) role enabled. To configure the state of a system indicator, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To determine whether the set command is available to change the state of a system indicator, perform one of the following ¦ From the server SP, type: ->cd /SYS ->show ¦ From the CMM, type: ->cd /CH -> show Example: server SP system indicator output. /SYS Targets: BIOS OK2RM SERVICE Properties: type = Host System chassis_name = SUN BLADE 8000 CHASSIS chassis_part_number = 602-3235-00 chassis_serial_number = 00:03:BA:CD:59:6F chassis_manufacturer = SUN MICROSYSTEMS fault_state = OK clear_fault_action = (none) power_state = Off Commands: cd reset set show start stopMonitoring System Sensors and Managing the Event Log (CLI) 99 3. To modify the state of the system indictor, type the following command: ->set property=state_name For more information about which system indicators are supported on your system, and the paths for accessing them, consult the user documentation provided with the Sun server platform. ? Configure Clock Properties (CLI) Before You Begin ¦ For you to configure the clock property values in Oracle ILOM, you need the Admin (a) role enabled. ¦ Refer to the Oracle Sun platform server documentation to determine whether: ¦ The current time in Oracle ILOM can persist across SP reboots. ¦ The current time in Oracle ILOM can be synchronized with the host at host boot time. ¦ The system supports a real-time clock element that stores the time. To configure clock property values using Oracle ILOM, follow these steps: 1. Log in to the Oracle ILOM CLI SP. Alternatively, you can log in to the Oracle ILOM CLI CMM and drill-down to the server SP target to configure the clock properties. 2. To view the clock property values currently set on the server SP, type: ->show /SP/clock 3. To manually set the Oracle ILOM clock property values, type: -> set target property_name=value For example: -> set /SP/clock datetime=MMDDhhmmYYYY 4. To synchronize the clock property values on the server SP with other servers on your network, perform the following: a. To set the NTP server IP address, type: ->set /SP/clients/ntp/server/1 address=ip_address b. To enable NTP synchronization in Oracle ILOM, type: ->set /SP/clock usentpserver=enabled100 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Filter Oracle ILOM Event Log List (CLI) To filter the Oracle ILOM event log list, follow these steps: 1. Log in to the Oracle ILOM CLI SP. Alternatively, you can log in to the Oracle ILOM CLI CMM and drill-down to the server SP target to filter the event log output. 2. At the command prompt, type: -> show /SP/logs/event/list Class==(value) Type==(value) Severity==(value) ? Scroll, Dismiss, or Clear the Oracle ILOM Event Log List Before You Begin For you to modify the Oracle ILOM event log list, you need the Admin (a) role enabled. To view or clear the Oracle ILOM event log, follow these steps: 1. Establish a local serial management connection to Oracle ILOM or a remote SSH connection to the server SP or CMM. 2. To set the working directory, type one of the following ¦ For a rackmounted server SP: cd /SP/logs/event ¦ For a blade server SP in chassis: cd /CH/BLn/SP/logs/event ¦ For a CMM: cd /CMM/logs/event 3. To display the event log output, type: ->show list The contents of the event log appear. For example: ID Date/Time Class Type Severity ----- ------------------------ -------- -------- -------- 578 Wed Jun 11 06:39:47 2008 Audit Log minor user1 : Open Session : object = /session/type : value = shell : success 577 Wed Jun 11 06:34:53 2008 Audit Log minorMonitoring System Sensors and Managing the Event Log (CLI) 101 4. In the event log, perform any of the following tasks: ¦ To scroll the list entries – Press any key except ‘q’. The following table provides descriptions about each column appearing in the log. user1 : Set : object = /clients/activedirectory/userdomains/3/domain : value = @joe.customer.example.sun.com : success 576 Wed Jun 11 06:25:06 2008 Audit Log minor user1 : Open Session : object = /session/type : value = www : success 575 Wed Jun 11 06:07:29 2008 Audit Log minor user1 : Close Session : object = /session/type : value = www : success 574 Wed Jun 11 06:02:01 2008 Audit Log minor root : Set : object = /clients/activedirectory/dnslocatorqueries/2/service : value = _ldap._tcp.pc._msdcs.. : success 573 Wed Jun 11 06:01:50 2008 Fault Fault critical Fault detected at time = Wed Jun 11 06:01:41 2008. The suspect component:/CH/PS3/EXTERNAL/AC_INPUT has fault.powersupply.no_ac with probability=100 Please consult the Sun Blade 8000 Fault Diagnosis Document (Document ID: 85878) at http://sunsolve.sun.com to determine the correct course of action. Column Label Description Event ID The number of the event, in sequence from number 1. Class/Type • Audit/ Log – Commands that result in a configuration change. Description includes user, command, command parameters, and success/fail. • IPMI/Log – Any event that is placed in the IPMI SEL is also put in the management log. • Chassis/State – For changes to the inventory and general system state. • Chassis/Action – Category for shutdown events for server module/chassis, hot insert/removal of FRU components, as well as Reset Parameters button when pushed. • Fault/Fault – For Fault Management faults. Description gives the time fault was detected and the suspect component. • Fault/Repair – For Fault Management repairs. Description gives component. Severity Debug, Down, Critical, Major, or Minor. Date/Time The day and time the event occurred. If the Network Time Protocol (NTP) server is enabled to set the Oracle ILOM time, the Oracle ILOM clock will use Universal Coordinated Time (UTC). Description A description of the event.102 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ To dismiss the event log (stop displaying the log), press the q key. ¦ To clear entries, type: set clear=true; then type: y to confirm action (or, to cancel action, type: n ). ? Configure Remote Syslog Receiver IP Addresses (CLI) Before You Begin For you to configure a destination IP address for the remote syslog receiver in Oracle ILOM, you need the Admin (a) role enabled. To configure a destination IP address, follow these steps: 1. Establish an SSH connection to the server SP or CMM. 2. To set the working directory, perform one of the following: ¦ For a rackmounted server SP, type: cd /SP/clients/syslog ¦ For a blade server SP in chassis, type: cd /CH/BLn/SP/clients/syslog ¦ For a CMM, type: cd /CMM/clients/syslog 3. To display the syslog receiver properties, type: show For example, if you are setting up the syslog receiver property on a server SP for the first time, the factory default property appears: 4. To identify a destination IP address for IP 1 (and, if applicable, IP 2) use the set command. For example, to set an IP destination to IP address 111.222.33.4, you would type: ->set destination_ip1=111.222.33.4 /SP/clients/syslog/1 Targets: Properties: address = 0.0.0.0 Commands: cd set showMonitoring System Sensors and Managing the Event Log (CLI) 103 5. For the destination IP address to take effect, press Enter. The results of setting the IP address appear. For example, if you set the destination IP address to 111.222.33.4, the following would appear: Set ‘destination_ip1’ to ‘111.222.33.4’ ? View and Manage SP Console Log Output (CLI) Before You Begin ¦ For you to modify the SP console output properties in Oracle ILOM, you must have the Console (c) role enabled. ¦ To view the SP console history log output on an x86 server, the server must be running Oracle ILOM firmware version 3.0.8 or later. The SP console history log, prior to firmware version 3.0.8, was only accessible in Oracle ILOM from a SPARC server SP. 1. Log in to the Oracle ILOM SP CLI. 2. To display the SP console log target, properties, and available commands, use the show command. For example: -> show /SP/console /SP/console Targets history Properties line_count = 0 pause_count = 0 start_from = end Commands cd show start stop ->104 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 3. To view details about the SP console target and property values, use the help command. For example: 4. To specify SP console history log file property values, use the set command. For example: ¦ set command usage: set [target] = [=...] ¦ At the prompt, you would type the SP console target and one or more display property values as follows: -> set /SP/console property=value -> set /SP/console property=value property=value -> set /SP/console property=value property=value property=value -> help /SP/console /SP/console: Redirection of console stream to SP Targets history: console history Properties line_count: total number of lines to display line_count: Possible values = 0-2048 where 0 means no limit line_count: User role required for set = c pause_count: number of lines to display before each pause pause_count: Possible values = 0-2048 where 0 means no limit pause_count: User role required for set = c start_from: from which end of the available history to list start_from: Possible values = beginning,end start_from: User role required for set = cMonitoring System Sensors and Managing the Event Log (CLI) 105 where property and value can be any of the following parameters specified in the following table. The UTC timestamps recorded in the SP console history log reflect the local time configured on the server. Property Values Example line_count Accepts a line value within the range of -0 to -2048, where -0 means no limit. Note - The default value for line_count is -0. To specify Oracle ILOM to display four lines of the SP console history log, you would type: -> set /SP/console line_count=4 pause_count Accepts a pause value within the range of -0 to -2048, where -0 means not to pause the display. Note - The default value for pause_count is -0. To specify Oracle ILOM to display four lines of the SP console history log and pause the display after displaying two lines, you would type: -> set /SP/console line_count=4 pause_count=2 start_from Values include: • -end – The last line (most recent) in the history log. • -beginning - The first line in the history log. Note - The default value for start_from is -end. To specify Oracle ILOM to display the first four lines of the SP console history log and pause the display after displaying two lines, you would type: -> set /SP/console line_count=4 pause_count=2 start_from=beginning106 Oracle ILOM 3.0 CLI Procedures Guide • May 2011107 Monitoring Storage Components and Zone Manager Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, storage monitoring ¦ Oracle ILOM 3.0 Daily Management Web Procedures, monitor storage components ¦ Oracle Server Hardware Management Pack User’s Guide, get software download ¦ Oracle ILOM 3.0 CMM Administration, zone manager Description Links Display storage details for hard drives and RAID controllers installed on an x86 Oracle Sun server platform. • “Monitor Storage Component Details on x86 Servers (CLI)” on page 108 Learn where to find information about the Oracle Sun Blade 6000 and 6048 zone manager features. • “Accessing Sun Blade Zone Manager Functions” on page 112108 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Monitor Storage Component Details on x86 Servers (CLI) Before You Begin Prior to performing this procedure to monitor hard drive and RAID controller storage components on an x86 Oracle Sun server platform, ensure that the following requirements are met: ¦ Ensure that the storage monitoring functions are supported on your x86 server platform. To determine whether your x86 server platform supports these features, see the Oracle ILOM supplement guide or platform administration guide for your server. ¦ Ensure that the x86 server is running Oracle ILOM firmware version 3.0.6 or a later version. ¦ Download and install the hardware management pack prior to using the Oracle ILOM storage monitoring features for the first time. For information about how to download the hardware management pack software, refer to Oracle Server Hardware Management Pack User’s Guide. To show property details for hard drive and RAID controller storage components, follow these steps: 1. Log in to the Oracle ILOM (x86) SP CLI. Alternatively, you can log in to the Oracle ILOM CMM CLI then navigate to the SP target, where you can display the hard drive details under /SYS or the RAID disk controller details under /STORAGE/raid. 2. Navigate to the /SYS or /STORAGE/raid target by using the cd command. For example: ¦ To monitor the hard drive storage components, type: ->cd /SYS or ¦ To monitor the RAID controller storage components, type: ->cd /STORAGE/raidMonitoring Storage Components and Zone Manager 109 3. To display the hard drive storage property details use the show command. For example: To view storage details for a specific hard drive storage component installed on the remote server, you might type: -> show /SYS/DBP/HDD0 where 0 is the slot location on the server where the hard drive is installed. Sample CLI output: 4. To display property details associated with a RAID controller and its associated disk IDs use the show command: For example: a. To list the RAID controller targets configured, you would type: -> show /STORAGE/raid110 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Sample CLI output: b. To show the property details associated with a controller, as well as to list the raid_id targets configured, you would type: -> show /STORAGE/raid/controller@od:00.0 where od:00.0 is the ID that corresponds to the PCI address of the controller. Sample CLI output:Monitoring Storage Components and Zone Manager 111 c. To list the available disk_id targets, as well as to view the properties associated with a controller raid_id, you would type: -> show /STORAGE/raid/controller@od:00.0/raid_id0 Sample CLI output: d. To view the property details for a disk_id that is associated with a raid_id on the controller, you would type: -> show /STORAGE/raid/controller@od:00.0/raid_id0/disk_id0 Where: Equals: od:00.0 The PCI address for the controller that was found installed on your server. raid_id0 The target RAID disk that is configured on the controller. Where: Equals: od:00.0 The PCI address for the controller that was found installed on your server raid_id0 The target RAID disk that is configured on the controller. disk_id0 The target disk that is associated with the raid_id.112 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Sample CLI output: 5. Type exit to exit the CLI. Accessing Sun Blade Zone Manager Functions If you are using Oracle Sun Blade 6000 or Sun Blade 6048 Modular Systems, a new zone management feature was added as of Oracle ILOM firmware version 3.0.10. The zone management feature is available for SAS-2 storage devices that are installed in Oracle Sun Blade 6000 or Sun Blade 6048 Modular Systems. For more information about how to manage SAS-2 chassis storage devices from Oracle ILOM, refer to Oracle ILOM 3.0 CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems.Monitoring Storage Components and Zone Manager 113114 Oracle ILOM 3.0 CLI Procedures Guide • May 2011Monitoring Storage Components and Zone Manager 115116 Oracle ILOM 3.0 CLI Procedures Guide • May 2011117 Managing System Alerts (CLI) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, system monitoring and alert management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage system alerts ¦ Oracle ILOM 3.0 Protocol Management, inventory and component management Description Links CLI procedures for managing alert rule configurations. • “Managing Alert Rule Configurations (CLI)” on page 118 Review CLI command examples for managing alert rules. • “CLI Commands: Alert Rules” on page 123 CLI procedure for configuring SMTP email server. • “Configure the SMTP Client (CLI)” on page 124118 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Managing Alert Rule Configurations (CLI) Requirements - Alert Rules (CLI) ¦ When defining an email notification alert, the outgoing email server must be configured in Oracle ILOM. If the outgoing email server is not configured, Oracle ILOM will not be able to successfully generate the email notification. For details, see “Configure the SMTP Client (CLI)” on page 124. ¦ When defining an SNMPv3 trap alert, the SNMP user name must be defined as an SNMP user. If the user is not defined as an SNMP user, the receiver of the SNMPv3 alert will not be able to decode the SNMP alert message. ¦ To manage Oracle ILOM alert rule configurations, you need the Admin (a) role enabled. ¦ To issue a test email alert from Oracle ILOM, the platform server or CMM must be running Oracle ILOM firmware version 3.0.4 or a later firmware version ¦ Review the “CLI Commands: Alert Rules” on page 123. Description Links Platform Feature Support Review the prerequisites • “Requirements - Alert Rules (CLI)” on page 118 • x86 system server SP • SPARC system server SP Configure alert • CMM configurations • “Create or Edit Alert Rules (CLI)” on page 119 • “Disable an Alert Rule (CLI)” on page 121 Generate test alerts to confirm alert configuration is working • “Enable Test Alerts (CLI)” on page 122 Notify recipient of system alerts via email • “Configure the SMTP Client (CLI)” on page 124Managing System Alerts (CLI) 119 ? Create or Edit Alert Rules (CLI) Before You Begin Review the “Requirements - Alert Rules (CLI)” on page 118 prior to performing the steps in the following procedure. To configure an alert rule using the Oracle ILOM CLI, follow these steps: 1. Log in to the Oracle ILOM CLI on the server SP or CMM. 2. Navigate to the alertmgmt working directory on the device by using the cd command. For example: 3. To view properties associated with an alert rule use the show command. For example: To view the properties for the first alert rule configured on a device, type one of the following: For: Type: Rackmounted server cd /SP/alertmgmt Blade server module cd /SP/alertmgmt CMM cd /CMM/alertmgmt For: Type: Rackmounted server show /SP/alertmgmt/rules/1 Blade server module show /CH/BLn/SP/alertmgmt/rules/1 CMM show /CMM/alertmgmt/CMM/rules/1120 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Sample CLI output for server SP alert rule 1: 4. To assign values to the alert properties (type, level, destination or snmp_version), use the set command. The alert level properties include: disable, down, crticial, major, and minor. The alert type properties include: ipmipet, snmptrap and email. ¦ If the alert type you specify is for ipmipet, you need to define an IPMI Pet destination address. ¦ If the alert type you specify is an snmptrap, you need to defina an SNPMP destination address and port, as well as the SNMP version and community name authenicating the receipt of the SNMP test alert. ¦ If the alert type you specify is email you need to define a destination email address. Note – You can specify one destination address for for each alert rule type. Examples: To set email as the alert type for rule 1, you would type the following command path: ->set /SP/alertmgmt/rules/1 type=email To send an email alert for alert rule 1to a specific email address, you would type the following command path: -> set /SP/alertmgmt/rules/1 destination=example@example.com where example@example.com is replaced by the destination email address. -> show /SP/alertmgmt/rules/1 /SP/alertmgmt/rules/1 Properties: community_or_username = public destination = 129.148.185.52 level = minor snmp_version = 1 type = snmptrapManaging System Alerts (CLI) 121 Note – The SMTP client must be configured for email destination notiications. For instructions, see “Configure the SMTP Client (CLI)” on page 124. For more information about the property values you can specify for an alert rule, refer to section about alert management in the Oracle ILOM 3.0 Daily Management Concepts Guide. ? Disable an Alert Rule (CLI) Before You Begin Review the “Requirements - Alert Rules (CLI)” on page 118 prior to performing the steps in the following procedure. Follow these steps to disable an alert rule: 1. Log in to Oracle ILOM CLI on the server SP or CMM. 2. Display the alertmgmt/rules/n properties on the device by using the show command. For example: 3. To disable the alert rule configuration, type the following command: ->set level=disable For: Type: Rackmounted server show /SP/alertmgmt/rules/n Blade server module show /CH/BLn/SP/alertmgmt/rules/n CMM show /CMM/alertmgmt/CMM/rules/n Where: Equals: /BLn The server module (blade) slot location in chassis. /n The specific alert rule configuration number, which can be 1 to 15.122 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Enable Test Alerts (CLI) Before You Begin Review the “Requirements - Alert Rules (CLI)” on page 118 prior to performing the steps in the following procedure. Follow these steps to enable test alerts: 1. Log in to the Oracle ILOM CLI on the server SP or CMM. 2. Navigate to the /alertmgmt/rules/n working directory on the device using the cd command. For example: 3. To enable a test alert for an alert rule configuration, type: ->set testalert=true For: Type: Rackmounted server cd /SP/alertmgmt/rules/n Blade server module cd /CH/BLn/SP/alertmgmt/rules/n CMM cd /CMM/alertmgmt/CMM/rules/n Where: Equals: /BLn The server module (blade) slot location in chassis. /n The specific alert rule configuration number, which can be 1 to 15.Managing System Alerts (CLI) 123 CLI Commands: Alert Rules The following table describes the CLI commands that you will need to use to manage alert rule configurations using the Oracle ILOM CLI. TABLE: CLI Commands for Managing Alert Rule Configurations CLI Command Description show The show command enables you to display any level of the alert management command tree by specifying either the full or relative path. Examples: • To display the properties for the first alert rule configuration (using the full path), type: -> show /SP/alertmgmt/rules/1 /SP/alertmgmt/rules/1 Properties: community_or_username = public destination = 129.148.185.52 level = minor snmp_version = 1 type = snmptrap Commands: cd set show • To display a single property for the first alert rule configuring (using the full path), type: -> show /SP/alertmgmt/rules/1 type /SP/alertmgmt/rules/1 Properties: type = snmptrap Commands: set show124 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Configure the SMTP Client (CLI) Before You Begin ¦ To enable SMTP clients in the Oracle ILOM CLI you need the Admin (a) role enabled. • To specify a relative path if the current tree location is /SP/alertmgmt/rules, type: -> show 1/ /SP/alertmgmt/rules/1 Targets: Properties: community_or_username = public destination = 129.148.185.52 level = minor snmp_version = 1 type = snmptrap Commands: cd set show cd The cd command enables you to set the working directory. To set alert management as a working directory on a server SP, you would type the following command at the command prompt: -> cd /SP/alertmgmt set The set command enables you to set values to properties from any place in the tree. You can specify either a full or relative path for the property depending on the location of the tree. For example: • For full paths, you would type the following at the command prompt: -> set /SP/alertmgmt/rules/1 type=ipmipet • For relative path (tree location is /SP/alertmgmt), you would type the following command path at the command prompt: -> set rules/1 type=ipmipet • For relative path (tree location is /SP/alertmgmt/rules/1), you would type the following command path at the command prompt: -> set type=ipmipet TABLE: CLI Commands for Managing Alert Rule Configurations (Continued) (Continued) CLI Command DescriptionManaging System Alerts (CLI) 125 ¦ The SMTP client function is accessible from the Oracle ILOM CLI on the following devices: x86 system server SP, SPARC system server SP, and Oracle Sun blade CMM. ¦ To generate configured email notification alerts, you must enable the Oracle ILOM client to act as an SMTP client to send the email alert messages. ¦ Prior to enabling the Oracle ILOM client as an SMTP client, determine the IP address and port number of the outgoing SMTP email server that will process the email notification. Follow these steps to enable the SMTP client: 1. Log in to the Oracle ILOM CLI on the server SP or CMM. 2. Navigate to the /clients/smtp working directory by using the cd command: For example: 3. To display the SMTP client properties use the show command. For example: To access the SMTP client properties for the first time on an SP the values for these properties would appear as follows: 4. To specify an IP address for the SMTP client or to change the port or state property value, use the set command. For example: To assign 222.333.44.5 to the IP address, you would type: For: Type: Rackmounted server cd /SP/clients/smtp Blade server module cd /CH/BLn/SP/clients/smtp CMM cd /CMM/alertmgmt/CMM/clients/smtp -> show /SP/clients/smtp Targets Properties address = 0. 0. 0. 0 port = 25 state = enabled Commands: cd set show126 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ->set address=222.333.44.5 5. Press Enter for the change to take effect. For example: The CLI output for set address=222.333.44.5 would appear as follows: Set ‘address=222.333.44.5’127 Power Monitoring and Managing of Hardware Interfaces Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, power consumption ¦ Oracle ILOM 3.0 Daily Management Web Procedures, monitor and manage power consumption ¦ Oracle ILOM 3.0 Protocol Management, monitor and manage power consumption Description Links Identify power monitoring and management feature updates per Oracle ILOM firmware point release • “Summary of Power Management Feature Updates (CLI)” on page 128 CLI procedures for power monitoring and management of hardware interfaces • “Monitoring System Power Consumption (CLI)” on page 130 • “Configuring the Power Policy and Notification Threshold Values (CLI)” on page 139 • “Monitoring Component Power Allocation Distributions (CLI)” on page 142 • “Configuring Power Limit Properties (CLI)” on page 148128 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Summary of Power Management Feature Updates (CLI) The following table identifies the common power management feature enhancements and documentation updates made since Oracle ILOM 3.0. TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release New or Enhanced Feature Firmware Point Release Documentation Updates For Updated CLI Procedures, see: Monitor power consumption metrics Oracle ILOM 3.0 • New terms and definitions for power management metrics • New System Monitoring --> Power Management consumption metric properties • New CLI and web procedures added for monitoring device power consumption • “Monitoring System Power Consumption (CLI)” on page 130 Configure power policy properties Oracle ILOM 3.0 • New power policy properties explained. • New CLI and web procedures added for configuring power policy settings • “Configuring the Power Policy and Notification Threshold Values (CLI)” on page 139 Monitor power consumption history Oracle ILOM 3.0.3 • New power consumption history metrics • New CLI and web procedures added for monitoring power consumption • “Monitor Power Consumption History (CLI)” on page 136 Configure power consumption notification thresholds Oracle ILOM 3.0.4 • New power consumption notification threshold settings • New CLI and web procedures added for configuring the power consumption thresholds • “Configuring the Power Policy and Notification Threshold Values (CLI)” on page 139 Monitor allocation power distribution metrics Oracle ILOM 3.0.6 • New component allocation distribution metrics • New CLI and web procedures added for monitoring power allocations • New CLI and web procedures added for configuring permitted power for blade slots • “Monitoring Component Power Allocation Distributions (CLI)” on page 142 Configure power budget properties Oracle ILOM 3.0.6 • New power budget properties • New CLI and web procedures added for configuring power budget properties • “Configuring Power Limit Properties (CLI)” on page 148Power Monitoring and Managing of Hardware Interfaces 129 Configure power supply redundancy properties for CMM systems Oracle ILOM 3.0.6 • New power supply redundancy properties for CMM system. • New CLI and web procedures added for configuring power supply redundancy properties on CMM systems • “Manage CMM Power Supply Redundancy Properties (CLI)” on page 153 CLI update for CMM power management Oracle ILOM 3.0.10 • New top-level tab added to Oracle ILOM web interface for power management • Revised CLI commands for CMM • Power Management Metrics tab removed from CMM Oracle ILOM web interface • Updated CLI procedure for configuring a grant limit for blade slots (previously known as allocatable power) • “View Blade Slots Granted Power or Reserved Power as of Oracle ILOM 3.0.10 (CLI)” on page 146 • “View Granted Power or Grant Limit for Blade as of Oracle ILOM 3.0.10 (CLI)” on page 147 • “Set CMM Grant Limit to Blade Server as of Oracle ILOM 3.0.10 (CLI)” on page 152 TABLE: Power Management Feature Updates per Oracle ILOM Firmware Point Release (Continued) New or Enhanced Feature Firmware Point Release Documentation Updates For Updated CLI Procedures, see:130 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Monitoring System Power Consumption (CLI) Requirements — Power Consumption Monitoring (CLI) Prior to performing the procedures described in this section, you should ensure that the following requirements are met: ¦ To determine whether the Oracle ILOM power consumption monitoring features are supported on your server or CMM, refer to the Oracle ILOM supplement or administration guide provided for your server or CMM. Description Links Platform Feature Support Review the prerequisites for monitoring system power consumption. • “Requirements — Power Consumption Monitoring (CLI)” on page 130 • x86 system server SP • SPARC system server SP • CMM CLI procedures for monitoring power consumption • “Monitor Total System Power Consumption (CLI)” on page 131 • “Monitor Actual Power Consumption (CLI)” on page 133 • “Monitor Individual Power Supply Consumption (CLI)” on page 133 • “Monitor Available Power (CLI)” on page 134 • “Monitor Server Hardware Maximum Power Consumption (CLI)” on page 135 • “Monitor Permitted Power Consumption (CLI)” on page 135 CLI procedure for monitoring power consumption history • “Monitor Power Consumption History (CLI)” on page 136Power Monitoring and Managing of Hardware Interfaces 131 ¦ To view the power consumption metrics provided in Oracle ILOM, the server must be running Oracle ILOM firmware version 3.0 or a later version. ¦ To access the power consumption history provided in Oracle ILOM, the server must be running Oracle ILOM firmware version 3.0.3 or a later version. Note – Power consumption history is available only through the Oracle ILOM CLI and web interface. ¦ Some platform servers might provide additional power metrics under the /SP/powermgmt/advanced node. To determine whether your system supports these additional power metrics, refer to the Oracle ILOM supplement guide or administration guide provided for your server. ¦ For definitions of the power monitoring terms used in the procedures, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. ? Monitor Total System Power Consumption (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor the total system power consumption, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display the total power consumption, use the show command. For example: ¦ On the server SP, type: -> show /SYS/VPS ¦ On the CMM, type: -> show /CH/VPS132 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Sample CMM CLI output: The following table lists and describes the properties of the total power consumption sensor for CLI. /CH/VPS Targets: history Properties: type = Power Unit ipmi_name = VPS class = Threshold Sensor value = 898.503 Watts upper_nonrecov_threshold = N/A upper_critical_threshold = N/A upper_noncritical_threshold = N/A lower_noncritical_threshold = N/A lower_critical_threshold = N/A lower_nonrecov_threshold = N/A alarm_status = cleared Commands: cd show Property Value type Threshold values are platform specific. Refer to your platform documentation for details. class value upper_nonrecov_threshold upper_critical_threshold upper_noncritical_threshold lower_noncritical_threshold lower_critical_threshold lower_nonrecov_thresholdPower Monitoring and Managing of Hardware Interfaces 133 ? Monitor Actual Power Consumption (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor the actual power consumption, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display the actual power consumption use the show command. For example: ¦ For the server SP, type: -> show /SP/powermgmt actual_power ¦ For the CMM, type: -> show /CMM/powermgmt actual_power Note – The actual_power is the same as /SYS/VPS (power consumption history). The actual_power is the value returned by the sensor. ? Monitor Individual Power Supply Consumption (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor individual power supply consumption, follow these steps: 1. Log in to the Oracle ILOM CLI server SP or CMM. 2. To display the individual power supply consumption use the show command. For example: ¦ On a rackmounted server, type: -> show /SYS/platform_path_to_powersupply/INPUT_POWER|OUTPUT_POWER ¦ On a CMM, type: -> show /CH/platform_path_to_powersupply/INPUT_POWER|OUTPUT_POWER134 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 The following table lists and describes the properties for the CLI sensors. Both sensors, INPUT_POWER and OUTPUT_POWER, have the same properties. Note – Power sensors are not supported on server modules (blades). ? Monitor Available Power (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor available power, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. To display the available power on the system use the show command. For example: ¦ On a rackmounted server, type: -> show /SP/powermgmt available_power ¦ On a CMM, type: -> show /CMM/powermgmt available_power Property Description type Power Unit class Threshold Sensor value upper_nonrecov_threshold N/A upper_critical_threshold N/A upper_noncritical_threshold N/A lower_noncritical_threshold N/A lower_critical_threshold N/A lower_nonrecov_threshold N/APower Monitoring and Managing of Hardware Interfaces 135 ? Monitor Server Hardware Maximum Power Consumption (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor the maximum power consumption for the server’s hardware, follow these steps: 1. Log in to the Oracle ILOM CLI SP. 2. To display the hardware configuration maximum power consumption on the server, use the show command. For example: -> show /SP/powermgmt hwconfig_power ? Monitor Permitted Power Consumption (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor the permitted power consumption, follow these steps: 1. Log in to the Oracle ILOM CLI server SP or CMM. 2. To display the permitted power consumption on the system, use the show command. For example: ¦ On a rackmounted server, type: -> show /SP/powermgmt permitted_power ¦ On a CMM, type: -> show /CMM/powermgmt permitted_power136 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Monitor Power Consumption History (CLI) Before You Begin Review the “Requirements — Power Consumption Monitoring (CLI)” on page 130 To monitor the power consumption history, follow these steps: 1. Log in to Oracle ILOM CLI server SP or CMM. 2. View actual power consumption using the show command. For example: ¦ From a server SP, type: ->show /SYS/VPS ¦ From the CMM to a blade server SP, type: ->show /CMM/BLn/VPS ¦ From the CMM, type: ->show /CH/VPS 3. To display the 15-, 30-, and 60-second rolling power usage averages, and to display a choice of targets for average consumption history, use the show command. ->show /CH/VPS /CH/VPS Targets: history Properties: type = Power Unit ipmi_name = VPS class = Threshold Sensor value = 1400.000 Watts upper_nonrecov_threshold = N/A upper_critical_threshold = N/A upper_noncritical_threshold = N/A lower_noncritical_threshold = N/A lower_critical_threshold = N/A lower_nonrecov_threshold = N/A alarm_status = cleared Commands: cd showPower Monitoring and Managing of Hardware Interfaces 137 For example: ¦ From the server SP, type: ->show /SYS/VPS/history ¦ From the CMM, type: ->show /CH/VPS/history 4. To display the average consumption history by the minute or hour, use the show command. For example: ¦ From the server SP, type: ->show /SYS/VPS/history/0 ¦ From the CMM: ->show /CH/VPS/history/0 ->show /CH/VPS/history /CH/VPS/history Targets: 0 (1 Minute Average, 1 Hour History) 1 (1 Hour Average, 14 Day History) Properties: 15sec_average = 1210.000 30sec_average = 1400.000 60sec_average = 1800.000 Commands: cd show ->show /CH/VPS/history/0 /CH/VPS/history/ Targets: list Properties: average = 1500.000 minimum = 1500.000 at Mar 4 08:51:24 maximum = 1500.000 at Mar 4 08:51:23 period = 1 Minute Average depth = 1 Hour History138 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 5. To display details about the history sample such as the time stamp and the power wattage consumed, use the show command. For example: ¦ From the server SP, type: ->show /SYS/VPS/history/0/list ¦ From the CMM, type: ->show /CH/VPS/history/0/list Commands: cd show ->show /CH/VPS/history/0/list /CH/VPS/history/0/list Targets: Properties: Mar 4 08:52:23 = 1500.000 Mar 4 08:51:24 = 1500.000 Mar 4 08:50:24 = 1500.000 Mar 4 08:49:24 = 1500.000 Mar 4 08:48:24 = 1500.000 Mar 4 08:47:23 = 1500.000 Commands: cd showPower Monitoring and Managing of Hardware Interfaces 139 Configuring the Power Policy and Notification Threshold Values (CLI) ? Configure Server SP Power Policy Value (CLI) Before You Begin ¦ The Oracle ILOM Power Policy properties are not supported on all Oracle Sun platform servers. To determine whether this feature is supported on your platform server, refer to the Oracle ILOM supplement or administration guide provided for your server. ¦ The admin (a) role must be enabled to modify the Power Policy properties in Oracle ILOM. ¦ For x86 platform servers, Oracle ILOM firmware version 3.0.3 or earlier must be running on the server. ¦ For SPARC platform servers, Oracle ILOM firmware version 3.0 or later must be running on the server. ¦ For definitions of the power monitoring terms used in this procedure, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. To define power policy settings to manage the server’s power usage, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. Description Links Platform Feature Support CLI procedure for configuring the power policy usage on a server. • “Configure Server SP Power Policy Value (CLI)” on page 139 • x86 system server SP (prior to Oracle ILOM 3.0.4) • SPARC system server SP CLI procedure for viewing or configuring the power consumption threshold values for notification. • “View and Configure the Power Wattage Notification Threshold Value (CLI)” on page 140 • x86 system server SP • SPARC system server SP • CMM140 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. To view the current power policy property value set on server use the show command. For example: -> show /SP/powermgmt policy 3. To modify the power policy property value set on the server use the set command. For example: -> set /SP/powermgmt policy=Performance|Elastic ? View and Configure the Power Wattage Notification Threshold Value (CLI) Before You Begin ¦ The platform server or CMM must be running Oracle ILOM firmware version 3.0.4 or later. ¦ You must have the admin (a) role enable in Oracle ILOM to modify the power wattage notification threshold value. ¦ For definitions of the power monitoring terms used in this procedure, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. To set a notification threshold based on the power wattage consumed by the system, follow these steps: 1. Log in to Oracle ILOM CLI server SP or CMM. 2. To view the current settings power management settings, use the show command. For example: ¦ From a CMM, type: -> show /CMM/powermgmt ¦ From a rackmounted server, type: Policy property value Description Performance Enables the system to use all of the power that is available Elastic Enables the system power usage to adapt to the current utilization level. For example, the system will power up or down just enough to keep relative utilization at 70% at all times, even if workload fluctuates.Power Monitoring and Managing of Hardware Interfaces 141 -> show /SP/powermgmt 3. To set the notification threshold value based on the power wattage the system consumed, type: -> set threshold1|2=n where n represents watts. Note – Setting the notification threshold value to 0 (zero) will disable the notification threshold option. -> show /SP/powermgmt /SP/powermgmt Targets: budget powerconf Properties: actual_power = 103 permitted_power = 497 allocated_power = 497 available_power = 1500 threshold1 = 0 threshold2 = 0 Commands: cd set show142 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Monitoring Component Power Allocation Distributions (CLI) Special Considerations for Power Allocation (CLI) Prior to performing the CLI power allocation procedures, consider the following: ¦ The platform server or CMM must be running Oracle ILOM firmware version 3.0.6. In addition, where noted, some power allocation procedures require the platform server or CMM to be running Oracle ILOM firmware version 3.0.10 or later. ¦ The following CMM and blade server power allocation properties were updated as of Oracle ILOM firmware version 3.0.10: ¦ allocated_power was renamed to granted_power. ¦ allocatable_power was renamed to grantable_power Description Links Platform Feature Support Review power allocation considerations • “Special Considerations for Power Allocation (CLI)” on page 142 • x86 system server SP • SPARC system server SP • CMM CLI procedures for viewing component allocation metrics on a server or CMM. • “View Server Power Allocations for All System Components (CLI)” on page 143 • “View Server Component Category Power Allocations (CLI)” on page 143 • “View CMM Power Allocations for All Chassis Components (CLI)” on page 145 • “View CMM Component Category Power Allocations (CLI)” on page 145 • “View Blade Slots Granted Power or Reserved Power as of Oracle ILOM 3.0.10 (CLI)” on page 146 • “View Granted Power or Grant Limit for Blade as of Oracle ILOM 3.0.10 (CLI)” on page 147Power Monitoring and Managing of Hardware Interfaces 143 ¦ permitted_power was renamed to grant_limit. ¦ For definitions of power monitoring terms used in the CLI procedures, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. ? View Server Power Allocations for All System Components (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the sum of power allocated to all server components, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. Alternatively, you can log in to the CMM and drill-down the server SP to view the sum of power allocated to all power-consuming components. 2. To view the sum of power allocated to all components in the system, type the following: -> show /SP/powermgmt allocated_power ? View Server Component Category Power Allocations (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the sum of power allocated to a server component category, follow these steps: Updated CLI property Description granted_power The sum of the maximum power consumed by either a single server component (such as, memory module), a category of server components (all memory modules), or all server power consuming components. grantable_power The total remaining power (watts) available to allocate from the CMM to the blade slots without exceeding the grant limit grant_limit The maximum power the CMM will grant to a blade slot.144 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 1. Log in to the Oracle ILOM CLI server SP. Alternatively, you can log in to the CMM and drill-down the server SP to view the sum of power that is allocated to a component category. 2. To view power allocated to a component category (fans, CPUs, and so forth), type the following: -> show /SP/powermgmt/powerconf/component_type where component_type is the name of the component category. For example, to view the power allocated to all CPUs (component category), you would type: -> show /SP/powermgmt/powerconf/CPUs Note – For each command, the read-only value for the maximum power consumed by the component is returned, measured in watts. 3. To view the power allocated to a specific component, type the following: -> show /SP/powermgmt/powerconf/component_type/component_name ¦ where component_type is the name of the component category. ¦ where component_name is the name of the component. Examples: To view the power allocated to a specific CPU, you would type: -> show /SP/powermgmt/powerconf/CPUs/CPUn where n is the installed location number of the CPU. To view power allocated to other rackmount server components, you could, for example, type: ¦ /SP/powermgmt/powerconf/Fans/FB0_FMn ¦ /SP/powermgmt/powerconf/PSUs/PSn ¦ /SP/powermgmt/powerconf/CPUs/MB_Pn ¦ /SP/powermgmt/powerconf/memory/MB_P0_Dn ¦ /SP/powermgmt/powerconf/IO/DBP_HDDn To view power allocated to other blade server components, you could, for example, type: ¦ /SP/powermgmt/powerconf/CPUs/MB_Pn ¦ /SP/powermgmt/powerconf/memory/MB_P0_Dn ¦ /SP/powermgmt/powerconf/IO/DBP_HDDnPower Monitoring and Managing of Hardware Interfaces 145 ? View CMM Power Allocations for All Chassis Components (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the sum of power allocated to all CMM chassis components, follow these steps: 1. Log in to the Oracle ILOM CLI CMM. 2. To view the sum of power allocated to all chassis system components, perform one of the following: ¦ If the CMM is running Oracle ILOM 3.0.8 or earlier, type the following: -> show /CMM/powermgmt allocated_power ¦ If the CMM is running Oracle ILOM 3.0.10 or later, type the following: -> show /CMM/powermgmt granted_power 3. To view the remaining power available to allocate to blade slots, type the following: -> show /CMM/powermgmt allocatable_power ? View CMM Component Category Power Allocations (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the sum of power allocated to a CMM component category, follow these steps: 1. Log in to the Oracle ILOM CLI CMM. 2. To view the sum of power allocated to a CMM component category (fans, blade slots, and so forth), type the following: -> show /CMM/powermgmt/powerconf/component_type where component_type is the name of the component category. For example, to view the power allocated to all blade slots (component category), you would type: -> show /CMM/powermgmt/powerconf/bladeslots146 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – For each command, the read-only value for the maximum power consumed by the component is returned, measured in watts. 3. To view the power allocated to a specific CMM chassis component, type the following: -> show /CMM/powermgmt/powerconf/component_type/component_name where component_type is the name of the component category. where component_name is the name of the component. Examples: To view the power allocated to a specific blade slot, you would type: -> show /CMM/powermgmt/powerconf/bladeslots/BLn where n is the location number of the blade slot. To view the power allocated to other CMM components (such as, NEMs, fans, power supply units), type one of the following: ¦ /CMM/powermgmt/powerconf/NEMs/NEMn ¦ /CMM/powermgmt/powerconf/Fans/FMn ¦ /CMM/powermgmt/powerconf/PSUs/PSn ? View Blade Slots Granted Power or Reserved Power as of Oracle ILOM 3.0.10 (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the sum of power allocated to chassis blade slots, follow these steps: 1. Log in to the Oracle ILOM CLI CMM. 2. To view the sum of power granted to all blade slots or the sum of power reserved for all auto-powered I/O blade slots, type the following: -> show /CMM/powermgmt/powerconf/bladeslots The granted_power value and reserved_power value allocated to all chassis blade slots appears, for example: -> show /CMM/powermgmt/powerconf/bladeslots /CMM/powermgmt/powerconf/bladeslots Targets: BL0 BL1Power Monitoring and Managing of Hardware Interfaces 147 ? View Granted Power or Grant Limit for Blade as of Oracle ILOM 3.0.10 (CLI) Before You Begin Review the “Special Considerations for Power Allocation (CLI)” on page 142. To view the granted power or the power grant limit for an individual blade server, follow these steps: 1. Log into the Oracle ILOM CLI CMM. 2. To view the sum of power granted to an individual blade or to the grant limit value set for a blade, type the following command: -> show /CMM/powermgmt/powerconf/bladeslot/BLn Where n represents the slot location for the blade. Example output: BL2 BL3 BL4 BL5 BL6 BL7 BL8 BL9 Properties: granted_power = 952 reserved_power = 876 Commands: cd show -> show /CMM/powermgmt/powerconf/bladeslots/BL1 /CMM/powermgmt/powerconf/bladeslots/BL1 Targets: Properties: granted_power = 0 grant_limit = 800 Commands:148 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring Power Limit Properties (CLI) Special Considerations for Setting Power Limits (CLI) Prior to modifying the power limit properties in Oracle ILOM, consider the following: ¦ The platform server or CMM must be running Oracle ILOM firmware version 3.0.6 or later. Where noted, some power limit procedures require the server or CMM to be running Oracle ILOM firmware version 3.0.10 or later. ¦ The following CMM and blade server power allocation properties were updated as of Oracle ILOM firmware version 3.0.10: ¦ allocated_power was renamed to granted_power. ¦ allocatable_power was renamed to grantable_power cd set show Description Links Platform Feature Support Review the special considerations when setting power limits. • x86 system server SP • SPARC system server SP CLI procedures for • CMM configuring server SP power limit properties. • “Set Permitted Power for Chassis Blade Slots (CLI)” on page 149 • “Set Server Power Budget Properties (CLI)” on page 150 • “Set CMM Grant Limit to Blade Server as of Oracle ILOM 3.0.10 (CLI)” on page 152Power Monitoring and Managing of Hardware Interfaces 149 ¦ permitted_power was renamed to grant_limit. ¦ To modify power management configuration properties, you must have the Admin (a) role enabled in Oracle ILOM. ¦ For definitions of power monitoring terms used in the procedures, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ For additional information describing the use of the server power limit (or the server power budget), refer to the power management section in the Oracle ILOM 3.0 Daily Management Concepts Guide. ? Set Permitted Power for Chassis Blade Slots (CLI) Before You Begin Review the “Special Considerations for Setting Power Limits (CLI)” on page 148 To configure the sum of permitted power allocated to a chassis blade slot, follow these steps: 1. Log in to the Oracle ILOM CLI CMM. 2. To set the permitted (maximum) power that the CMM will allocate to a blade slot, perform one of the following: ¦ If the system is running Oracle ILOM firmware version 3.0.8 or earlier, type the following: -> set /CMM/powermgmt/powerconf/bladeslots/bladeslotn permitted_power=watts where bladeslotn represents the blade slot that you want to configure. Updated CLI property Description granted_power The sum of the maximum power consumed by either a single server component (such as, memory module), a category of server components (all memory modules), or all server power consuming components. grantable_power The total remaining power (watts) available to allocate from the CMM to the blade slots without exceeding the grant limit grant_limit The maximum power the CMM will grant to a blade slot.150 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Example output: ¦ If the system is running Oracle ILOM firmware version 3.0.10 or later, type the following: -> set /CMM/powermgmt/powerconf/bladeslots/bladeslotn grant_limit=watts where bladeslotn represents the blade slot that you want to configure. Note – To prevent a blade server from powering-on, set the chassis blade slot permitted power value to 0. ? Set Server Power Budget Properties (CLI) Before You Begin Review the “Special Considerations for Setting Power Limits (CLI)” on page 148 To modify the server power budget property values, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. Alternatively, you can log in to the CMM and drill-down to the blade server SP to set the server power budget property values. 2. To view the current power budget settings, type the following command: -> show /SP/powermgmt/budget Example output: -> set /CMM/powermgmt/powerconf/bladeslots/bladeslot1 permitted_power=1200 Set 'permitted_power' to '1200' /SP/powermgmt/budget Targets: Properties: activation_state = enabled status = ok powerlimit = 600 (watts) timelimit = default (30 seconds) violation_actions = none min_powerlimit = 150 pendingpowerlimit = 600 (watts) pendingtimelimit = default pendingviolation_actions = nonePower Monitoring and Managing of Hardware Interfaces 151 3. To set the power budget properties, type the following: -> set /SP/powermgmt/budget property=value where property=value represents one of the following: ¦ activation_state=[enabled|disabled] ¦ pendingpowerlimit=[wattsw|percent%] ¦ pendingtimelimit=[default|none|seconds] ¦ pendingviolation_actions=[none|hardpoweroff] ¦ commitpending=true commitpending = (Cannot show property) Commands: cd show -> Power budget property Description Activation State Enable this property to enable the power budget configuration. Power Limit Set a Power Limit in watts or as a percentage of the range between minimum and maximum system power. Note - The minimum system power is viewable in the CLI under the target /SP/powermgmt/budget min_powerlimit. The maximum system power is viewable from the Allocated Power property in the web interface or from the CLI under the target /SP/powermgmt allocated_power. Time Limit Specify one of the following grace periods for capping the power usage to the limit: • Default – Platform selected optimum grace period. • None – No grace period. Power capping is permanently applied. • Custom – User-specified grace period. Violation Actions The actions that the system will take if the power limit cannot be achieved within the grace period. This option can be set to none or hardpoweroff. This setting, by default, is set to none.152 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Note – To set the powerlimit, timelimit and violation_action in the Oracle ILOM CLI, you must set the matching pending properties and then commit these three pending properties as a group. After these properties are committed by typing set /SP/powermgmt/budget commitpending=true, the new values will apply whenever the budget activation_state is set to enabled. For example: ? Set CMM Grant Limit to Blade Server as of Oracle ILOM 3.0.10 (CLI) Before You Begin Review the “Special Considerations for Setting Power Limits (CLI)” on page 148 To configure the permitted power allocated to a blade server, follow these steps: 1. Log in to the Oracle ILOM CMM CLI. 2. To configure the permitted (maximum) power that the CMM will allocate to a blade, type the following command: -> set /CMM/powermgmt/powerconf/bladeslots/BLn grant_limit= watts Note – To prevent a server module from powering-on, set the grant limit value for the blade to 0. Note – The grant_limit value cannot be less than any amount already granted (granted_power). -> set /SP/powermgmt/budget activation_state=enabled Set 'activation_state' to 'enabled'Power Monitoring and Managing of Hardware Interfaces 153 Manage CMM Power Supply Redundancy Properties (CLI) ? View or Set CMM Power Supply Redundancy Properties (CLI) Before You Begin ¦ For information about the usage of the power supply redundancy properties for CMM systems, see the power management section of the Oracle ILOM 3.0 Daily Management Concepts Guide. ¦ The CMM must be running Oracle ILOM firmware version 3.0.6 or later. ¦ To modify power supply redundancy properties, you must have admin (a) role privileges enabled in Oracle ILOM. ¦ For definitions of the power monitoring terms used in this procedure, refer to the power monitoring terminology section in the Oracle ILOM 3.0 Daily Management Concepts Guide. To display or modify the CMM power supply redundancy properties in Oracle ILOM, follow these steps: 1. Log in to the Oracle ILOM CLI CMM. 2. To view the current power management property values set on the CMM, type the following: -> show /CMM/powermgmt Description Links Platform Feature Support Monitor or configure the CMM power supply redundancy properties • “View or Set CMM Power Supply Redundancy Properties (CLI)” on page 153 • CMM154 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 3. To set the CMM power redundancy property, type the following: -> set /CMM/powermgmt property=value where property=value represents the redundancy [none|n+n] For example: Note – When you change the redundancy policy, this change affects the amount of power the CMM is permitted to allocate to server modules (blades). The chassis Permitted Power is set to the power that the available power supplies can provide minus the redundant power that is available. In addition, when there is no redundant power available to the system, a loss of a power supply will cause the system to reduce the -Permitted -Power. If the system reduces the -Permitted -Power below the power that had already been allocated, you should immediately take steps to turn off the server modules to reduce the allocated power. -> set /CMM/powermgmt redundancy=none Set 'redundancy' to 'none'155 Redirecting Storage Media and Locking the Oracle ILOM Remote Console Display Related Information ¦ Oracle ILOM 3.0 Remote Redirection Consoles, remote redirections console options ¦ Oracle ILOM 3.0 Remote Redirection Consoles, lock Oracle ILOM remote console display using the CLI or web interface Description Links Details for locating instructions for using the Oracle ILOM Storage Redirection CLI feature. • “CLI Procedures: Redirect Storage Media” on page 156 Details for locating CLI instructions for securing the Oracle ILOM Remote Console • “CLI Procedures: Redirect Storage Media” on page 156156 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 CLI Procedures: Redirect Storage Media The storage redirection CLI feature in Oracle ILOM 3.0 is supported on all of Oracle’s Sun x86 processor-based servers, as well as some SPARC processor-based servers. For instructions for using the Oracle ILOM Storage Redirection CLI, refer to: ¦ Oracle ILOM 3.0 Storage Redirection Consoles, initial set up tasks for redirecting storage media ¦ Oracle ILOM 3.0 Storage Redirection Consoles, redirect storage devices using the storage redirection CLI Note – The Oracle ILOM Storage Redirection feature is not supported on chassis monitoring modules (CMMs) or x86 processor-based servers running Oracle ILOM 2.0. CLI Procedures: Manage Oracle ILOM Remote Console Lock Options For CLI instructions for locking the Oracle ILOM Remote Console, refer to manage remote console lock options in the Oracle ILOM 3.0 Remote Redirection Consoles CLI and Web Guide.157 Managing Remote Host Power States, BIOS Boot Device, and Host Server Console Related Information ¦ Oracle ILOM 3.0 Remote Redirection Consoles, remote host management options ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing remote hosts power states Description Links Control the power state of a remote server module • “Issuing Remote Power State Commands From Server SP or CMM CLI” on page 158 Remote Host Control - Boot Device on x86 system SP • “Configure BIOS Host Boot Device Override (CLI)” on page 160 Learn how to start the Host Console, change the display properties, as well as view the console history or bootlog. • “Managing the SP Host Console” on page 162158 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Issuing Remote Power State Commands From Server SP or CMM CLI From a command window or terminal, you can issue the following commands that are described in TABLE: Server SP Remote Power State Commands on page 158 and TABLE: Chassis Monitoring Module (CMM) Remote Power State Commands on page 159 to remotely control the power state of a host server or CMM. TABLE: Server SP Remote Power State Commands Power State Command Description Command Syntax Example start Use the start command to turn on full power to the remote host server. To issue the start command: • From the server SP CLI, type: start /SYS • From CMM CLI for a blade server with a single dedicated SP, type: start /CH/BLn/SYS • From CMM CLI for a blade server with two dedicated SPs, type: start /CH/BLn/NODEn/SYS stop Use the stop command to shut down the OS gracefully prior to powering off the host server. To issue the stop command: • From the server SP CLI: stop /SYS • From the CMM CLI for a blade server with a single dedicated SP: stop /CH/BLn/SYS • For blade server with two dedicated SPs: stop /CH/BLn/NODEn/SYS stop -force Use the stop -force command to immediately turn off the power to the remote host server. To issue the stop -force command: • From the server SP CLI, type: stop -force /SYS • From CMM CLI for blade server with single dedicated SP, type: stop -force /CH/BLn/SYS • From CMM CLI for a blade server with two dedicated SPs, type: stop -force /CH/BLn/NODEn/SYSManaging Remote Host Power States, BIOS Boot Device, and Host Server Console 159 For information about connecting to a host server or issuing commands from the Oracle ILOM CLI, see “Configuring Network, Secure Shell, and Local Interconnect Settings” on page 27. reset Use the reset command to immediately reboot the remote host server. To issue the reset command: • From the server SP CLI, type: reset /SYS • From CMM CLI for a blade server with single a dedicated SP, type: reset /CH/BLn/SYS • From CMM CLI for a blade server with two dedicated SPs, type: reset /CH/BLn/NODEn/SYS TABLE: Chassis Monitoring Module (CMM) Remote Power State Commands Power State Command Description Command Syntax Example start Use the start command to turn on full power to the remote chassis. To issue the start command to the remote chassis from the CMM CLI, type: start /CH stop Use the stop command to shut down the power on the chassis and its components gracefully. To issue the stop command to the remote chassis from the CMM CLI, type: stop /CH stop -force Use the stop -force command to immediately turn off the power to the chassis and its components. To issue the stop -force command to the remote chassis from the CMM CLI, type: stop -force /CH TABLE: Server SP Remote Power State Commands (Continued) Power State Command Description Command Syntax Example160 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Configure BIOS Host Boot Device Override (CLI) Before You Begin ¦ The Reset and Host Control (r) role is required to change the host boot device configuration variable. Note – The Host Control BIOS boot device feature is supported on x86 system SPs. This feature is not supported on the CMM or on SPARC server SPs. For information about Oracle ILOM Host Control boot options on SPARC systems, consult the online Oracle ILOM Supplement guide or platform Administration guide provided for that system. To override the BIOS boot device from Oracle ILOM, follow these steps. 1. Log in to the Oracle ILOM SP CLI. 2. To navigate and display the host boot properties, use the cd and show commands. For example: ->cd /HOST /HOST ->show /HOST Targets: diag Properties: boot_device = default generate_host_nmi = (Cannot show property) Commands: cd set showManaging Remote Host Power States, BIOS Boot Device, and Host Server Console 161 3. To set the host boot device for the next time the system is powered on, type: ->set boot_device=value Possible values are: ¦ default – Setting the value to default means that there is no override to the BIOS settings. Setting to default will also clear any previously chosen selection. ¦ pxe – Setting the value to pxe means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the network, following the PXE boot specification. ¦ disk – Setting the value to disk means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the first disk as determined by BIOS. The specific disk chosen depends on configuration. Typically, hosts use this option by default and the host's behavior might not change by selecting this option. ¦ diagnostic – Setting the value to diagnostic means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot into the diagnostic partition, if configured. ¦ cdrom – Setting the value to cdrom means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot from the attached CD-ROM or DVD device. ¦ bios – Setting the value to bios means that at the next host boot, the BIOS boot order settings will be temporarily bypassed and instead the host will boot into the BIOS Setup screen.162 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Managing the SP Host Console ? View and Configure Host Console Properties Before You Begin ¦ To modify the host console properties in Oracle ILOM, you must have admin (a) role privileges enabled in Oracle ILOM. ¦ As of Oracle ILOM 3.0.12, host console properties (line_count, pause_count and start_from) are no longer persistent across all sessions. The values for these host console properties are valid for the length of the spsh session. 1. Log in to the Oracle ILOM SP CLI. 2. To navigate and display the host console properties use the show command. For example: Topic Descriptions Links Platform Feature Support View and set Host Console properties • “View and Configure Host Console Properties” on page 162 • x86 system server SP • SPARC system server SP Start Host Console and view Console History or Bootlog History • “Start Host Console and Display Console History and Bootlog” on page 164 -> show /HOST/console /HOST/console Targets: history Properties: line_count = 0 pause_count = 0 start_from = end Commands: cd show start stopManaging Remote Host Power States, BIOS Boot Device, and Host Server Console 163 Note – Each time an spsh session is started, it initializes these properties to their default values: line_count = 0, pause_count = 0, start_from = end. The values for these properties are valid only for the length of that particular spsh session. 3. To view descriptions about the Host Control properties use the help command. For example: 4. To configure the Host Console properties use the help command. For example: ¦ To set a value for the line_ count property, type -> set line_count=value where value can range from 1 to 2048 lines. ¦ To set a value for the pause_count property, type: -> set pause_count=value where value can range from 1 to any valid integer or for infinite number of lines. The default is not to pause. ¦ To set a value for the start_from property, type: -> set start_from=value -> help escapechars Properties: escapechars : set escape chars using the console connection escapechars : User role required for set = a -> help line_count Properties: line_count : total number of lines to display line_count : Possible values = 0-2048 where 0 means no limit line_count : User role required for set = c -> help pause_count Properties: pause_count : number of lines to display before each pause pause_count : Possible values = 0-2048 where 0 means no limit pause_count : User role required for set = c -> help start_from Properties: start_from : from which end of the available history to list start_from : Possible values = beginning,end start_from : User role required for set = c164 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Where the value can equal end or beginning. The end value is the last line (most recent) in the buffer (the default). The beginning value is the first line in the buffer. ¦ To set a value for escapechars, type: -> set escapechars=value where the value is limited to two characters. The default value is #. (Hash-Period). Note – The /SP/console escapechars property enables you to specify an escape character sequence to use when switching from a system console session back to Oracle ILOM. Changing the escape character does not take effect in a currently active console session. ? Start Host Console and Display Console History and Bootlog Before You Begin ¦ To change the Host Console properties in Oracle ILOM, you must have the admin (a) role privileges enable. ¦ As of Oracle ILOM 3.0.12, host console properties (line_count, pause_count and start_from) are no longer persistent across all sessions. The values for these host console properties are valid for the length of the spsh session. 1. Log in to the Oracle ILOM SP CLI. 2. Set the Host Console display properties, see “View and Configure Host Console Properties” on page 162. Note – As of Oracle ILOM 3.0.12, Host Console properties (line_count, pause_count and start_from) are no longer persistent across all sessions. The values for these properties are valid only for the length of that particular spsh session. 3. To start the host console, type: ->start /SP/consoleManaging Remote Host Power States, BIOS Boot Device, and Host Server Console 165 4. To display the Console History, type: -> show /SP/console/history The Console History buffer is a circular buffer that can contain up to 1 Mbyte of information. The buffer captures all POST and boot information as well as any OS information that is controlled through the Host Console. 5. To display the Bootlog type: ->show /SP/console/bootlog The Bootlog tracks the systems’s start-up progress and logs any problems that might occur.166 Oracle ILOM 3.0 CLI Procedures Guide • May 2011167 Managing TPM and LDom States on SPARC Servers (CLI) Related Information ¦ Oracle ILOM 3.0 Remote Redirection Consoles, remote host management options ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage TPM and LDom states on SPARC servers Description Links Control the TPM state on a SPARC server • “Control TPM State on a SPARC Server (CLI)” on page 168 Manage Logical Domain (LDom) configurations on SPARC servers • “Managing LDom Configurations on SPARC Servers (CLI)” on page 171168 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ? Control TPM State on a SPARC Server (CLI) Before You Begin ¦ The Trusted Platform Module (TPM) feature in Oracle ILOM is available for SPARC servers only. ¦ The SPARC server should be running a version of the Oracle Solaris Operating system that supports TPM. For more information about configuring TPM support in Oracle Solaris, refer to the Oracle Solaris documentation or the platform documentation shipped with your server. ¦ You must be using Oracle ILOM 3.0.8 or a later version on the SPARC server SP. ¦ You need to have the Reset and Host Control (r) user account to modify the TPM settings in Oracle ILOM. 1. Log in to the Oracle ILOM SP CLI. 2. Use the show command to display the TPM target, properties, and commands. For example: -> show /HOST/tpm /HOST/tpm Targets: Properties: activate = false enable = false forceclear = false Commands: cd set show ->Managing TPM and LDom States on SPARC Servers (CLI) 169 3. Use the help command to view details about the TPM target and properties. For example: 4. Use the set command to specify the TPM property values. For example: ¦ set command usage: set [target] = [=] ¦ At the prompt, you would type the TPM target and one or more property values as follows: -> set /host/tpm property=value -> set /host/tpm property=value property=value -> help /HOST/tpm /HOST/tpm : Host TPM (Trusted Platform Module) Knobs Targets: Properties: activate : TPM Activate Property. If set to TRUE, then TPM will be activated if the 'enable' property is also set to TRUE. activate : Possible values = true, false activate : User role required for set = r enable : TPM Enable Property. If not enabled, then TPM configuration changes can not be made. enable : Possible values = true, false enable : User role required for set = r forceclear : TPM Forceclear Property. If set to TRUE, then TPM state will be purged on the next power on event if and only if the 'enable' property is set to TRUE. forceclear : Possible values = true, false forceclear : User role required for set = r170 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 where property and value can be any of the following parameters specified in the following table: Property Values Example enable Accepts true or false. Note - The default value for enable is -false. To enable the TPM state, you would type: -> set /HOST/tpm enable=true Note - To apply the enabled TPM state on the SPARC server the next time the server powers on, you must activate it. For more details, see activate property. activate Accepts true or false. Note - The default value for activate is -false. To enable the TPM state and activate this enabled state on the SPARC server the next time the server powers on, you would type: -> set /HOST/tpm enable=true activate=true forceclear Accepts true or false. Note - The default value for forceclear is -false. To purge (disable) an enabled TPM state on the SPARC server the next time the server powers on, you would type: -> set /HOST/tpm forceclear=true Note - forceclear will set only to true, if property values for enable and activate are also set to true.Managing TPM and LDom States on SPARC Servers (CLI) 171 Managing LDom Configurations on SPARC Servers (CLI) Requirements — LDOM Configuration (CLI) In order for you to view and manage the Oracle ILOM settings for stored Logical Domain (LDom) configurations, the following requirements must be met: ¦ You must access Oracle ILOM on a SPARC server that has the appropriate Oracle ILOM point release firmware installed (see the following Note). Note – Oracle ILOM 3.0.12 or later is required for you to view the LDom targets and properties from a SPARC T3 Series server. Oracle ILOM 2.0.0 or later is required for you to: (1) specify which LDom configuration is used on the host SPARC server, and (2) to manage the boot property values for the control domain from the host SPARC server. ¦ You must have the Oracle VM Server for SPARC (Logical Domains Manager) 2.0 or later software installed on your host SPARC server. ¦ The host SPARC server must have saved LDom configurations. For instructions on how to create and save LDom configurations on a host SPARC server, refer to the Logical Domains 1.3 Administration Guide. Description Links Platform Feature Support Review the prerequisites • “Requirements — LDOM Configuration (CLI)” on page 171 • SPARC system server SP View and manage Oracle ILOM settings for stored LDom configurations • “View Targets and Properties for Stored LDom Configurations on SPARC T3 Series Server (CLI)” on page 172 • “Specify Host Power to a Stored LDom Configuration (CLI)” on page 173 • “Enable or Disable the Control Domain Property Values (CLI)” on page 173172 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 ¦ The Remote Host Reset and Host Control (r) privileges must be enabled in Oracle ILOM for you to set the: ¦ LDom bootmode target ¦ Primary or guests domain property values for the bootmode target. ? View Targets and Properties for Stored LDom Configurations on SPARC T3 Series Server (CLI) To view the CLI targets and properties for saved LDom configurations on SPARC T3 Series server, follow these steps: 1. Log in to the Oracle ILOM CLI on a SPARC T3 Series server. 2. To view the names of saved LDom host configurations, type: -> show /HOST/domain/configs 3. To view the property values for the creation date of the saved LDom configuration and the number of domains configured in the saved LDom configuration, you would type: -> show /HOST/domain/configs/ The following example shows a sample CLI output for viewing the property values associated with a fictitious stored LDom configuration named ONEDOMAIN. -> show /HOST/domain/configs Targets: trimmed ONEDOMAIN Properties: Commands: cd show -> show ONEDOMAIN /HOST/domain/configs/ONEDOMAIN Targets: Properties: date_created = 2010-08-17 17:09:34 domains = 1 Commands: cd showManaging TPM and LDom States on SPARC Servers (CLI) 173 Note – Oracle ILOM stores the read-only properties in non-volatile memory and updates them each time an LDom configuration in LDom Manager is updated ? Specify Host Power to a Stored LDom Configuration (CLI) To specify which stored LDom configuration is used when the host server is powered-on, follow these steps: 1. Log in to the Oracle ILOM CLI on a SPARC server. 2. To navigate the /Host/bootmode target use the cd command, then use the set config= command to specify the name of the stored LDom configuration. The following example shows a sample CLI output for setting a fictitious stored LDom configuration named ONEDOMAIN as the bootmode target. Note that changes made to the LDom configuration bootmode properties will take effect on the next host server reset or power-on. ? Enable or Disable the Control Domain Property Values (CLI) To enable or disable the LDom control domain boot property values in Oracle Oracle ILOM, follow these steps: 1. Log in to the Oracle ILOM CLI on a SPARC server. -> cd /HOST/bootmode /HOST/bootmode -> set config=ONEDOMAIN Set ’config’ to ’ONEDOMAIN’174 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 2. To navigate to the /Host/domain/control target use the cd command, then use the ls command to view the auto-boot properties for the host control domain and guest domains. For example: 3. Use the set command to specify the following auto-boot and boot-guests property values: -> cd /HOST/domain/control -> ls /HOST/domain/control Targets: Properties: auto-boot = enabled boot_guests = enabled Commands: cd reset set show Property Set Property Value Description auto-boot set auto-boot= Type the set auto-boot= command followed by one of the following property values: • enabled (default). Enabling the auto-boot property value will automatically reboot the control domain after the next power-on or reset. • disabled. Disabling the auto-boot property value on the control domain will prevent automatic reboots and stop the control domain at the OpenBoot ok prompt after the next power-on or reset. boot_guests set boot_guests= Type the set boot_guests= command followed by one of the following property values: • enabled (default). Enabling the boot_guests property enables the guest domain to boot after the next power-on or reset. • disabled. Disabling the boot_guests property value for the guest domains will prevent the guest domains from booting after the next power-on or reset.Managing TPM and LDom States on SPARC Servers (CLI) 175 4. Reset /HOST/domain/control then reset the power on the host. For example: ->reset /HOST/domain/control ->reset /SYS Changes to the boot_guests property will only take effect after both reset operations (/host/domain/control and /SYS) are performed.176 Oracle ILOM 3.0 CLI Procedures Guide • May 2011177 CLI Command Reference Syntax examples in this reference use a starting /SP/ target, which applies to most Oracle Sun servers. If you are performing these commands from a CMM, you can interchange the starting /SP/ target with /CMM/ since the sub-targets are common across all platforms. If you are performing these commands from a blade server chassis, you can the interchange the starting /SP/ target with /CH/BLn or CH/BLn/Noden depending the blade server platform. CLI commands described in this reference include: ¦ “cd Command” on page 178 ¦ “create Command” on page 179 ¦ “delete Command” on page 180 ¦ “dump Command” on page 181 ¦ “exit Command” on page 181 ¦ “help Command” on page 182 ¦ “load Command” on page 183 ¦ “reset Command” on page 184 ¦ “set Command” on page 185 ¦ “show Command” on page 193 ¦ “start Command” on page 202 ¦ “stop Command” on page 203 ¦ “version Command” on page 204178 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 cd Command Use the cd command to navigate the namespace. When you cd to a target location, that location then becomes the default target for all other commands. Using the -default option with no target returns you to the top of the namespace. Typing cd -default is the equivalent of typing cd /. Typing just cd displays your current location in the namespace. Typing help targets displays a list of all targets in the entire namespace. Syntax cd target Options [-default] [-h|help] Targets and Properties Any location in the namespace. Examples To create a user named emmett, cd to /SP/users, then execute the create command with /SP/users as the default target. -> cd /SP/users -> create emmett To find your location, type cd. -> cd /SP/usersCLI Command Reference 179 create Command Use the create command to set up an object in the namespace. Unless you specify properties with the create command, they are empty. Syntax create [options] target [propertyname=value] Options [-h|help] Targets, Properties, and Values Example -> create /SP/users/susan role=administrator TABLE: Targets, Properties and Values for create Command Valid Targets Properties Values Default /SP/users/username password role administrato r|operator|a |u|c|r|o|s (none) o /SP/services/snmp/communities /communityname permissions ro|rw ro /SP/services/snmp/user/ username authenticationprotocol authenticationpassword permissions privacyprotocol privacypassword MD5 ro|rw none|DES| AES MD5 (null string) ro DES (null string)180 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 delete Command Use the delete command to remove an object from the namespace. You will be prompted to confirm a delete command. Eliminate this prompt by using the -script option. Syntax delete [options] [-script] target Options [-h|help] [-script] Targets Examples -> delete /SP/users/susan -> delete /SP/services/snmp/communities/public TABLE: Targets for delete Command Valid Targets /SP/users/username /SP/services/snmp/communities/communityname /SP/services/snmp/user/usernameCLI Command Reference 181 dump Command Use the dump command to transfer a file from a target to a remote location specified by the URI. Syntax dump -destination target Options [-destination] exit Command Use the exit command to end a CLI session. Syntax exit [options] Options [-h|help]182 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 help Command Use the help command to display Help information about commands and targets. Using the -o|output terse option displays usage information only. The -o|output verbose option displays usage, description, and additional information including examples of command usage. If you do not use the -o|output option, usage information and a brief description of the command are displayed. Specifying command targets displays a complete list of valid targets for that command from the fixed targets in /SP and /SYS. Fixed targets are targets that cannot be created by a user. Specifying the legal command target displays the copyright information and product use rights. Syntax help [options] command target Options [-h|help] [-o|output terse|verbose] Commands cd, create, delete, exit, help, load, reset, set, show, start, stop, versionCLI Command Reference 183 Examples load Command Use the load command to transfer an image file from a source, indicated by a Uniform Resource Indicator (URI), to update Oracle ILOM firmware. The URI can specify a protocol and credentials used for the transfer. The load command supports multiple protocols (TFTP, SCP, FTP). If credentials are required and not specified, the command prompts you for a password. Using the -script option eliminates the prompt for a yes or no confirmation, and the command acts as if yes were specified. Note – Use this command to update your Oracle ILOM firmware and BIOS. Syntax load -source URI -> help load The load command transfers a file from a remote location specified by the URI and updates the given target. Usage: load [-script] -source [target] -source: Specify the location to get a file. -> help -output verbose reset The reset command is used to reset a target. Usage: reset [-script] [target] Available options for this command: -script: Do not prompt for yes/no confirmation and act as if yes were specified. TABLE: Targets, Properties, and Values for load Command Valid Targets Properties Values Default /SP/users/username password role administrator|operator |a|u|c|r|o|s (none) o184 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Options [-h|help] [-script] Example -> load -source tftp://ip_address/newmainimage Note – A firmware upgrade will cause the server and Oracle ILOM to be reset.You should perform a graceful shutdown of the server prior to the upgrade procedure. An upgrade takes about five minutes to complete. Oracle ILOM will enter a special mode to load new firmware. No other tasks can be performed in Oracle ILOM until the firmware upgrade is complete and Oracle ILOM is reset. reset Command Use the reset command to reset the state of the target. You will be prompted to confirm a reset operation. Eliminate this prompt by using the -script option. Note – The reset command does not affect the power state of hardware devices. Syntax reset [options] target -> load -source tftp://ip_address/newmainimage Are you sure you want to load the specified file (y/n)? y File upload is complete. Firmware image verification is complete. Do you want to preserve the configuration (y/n)? n Updating firmware in flash RAM: . Firmware update is complete. ILOM will not be restarted with the new firmware.CLI Command Reference 185 Options [-h|help] [-script] (The -f|force option is supported on SPARC-based systems.) Targets Examples -> reset /SP -> reset /SYS set Command Use the set command to specify the properties of the target. Syntax set [options] target [propertyname=value] Options [-h|help] TABLE: Targets for reset Command Valid Targets /SP /SYS186 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Targets, Properties, and Values TABLE: Targets, Properties, and Values for set Command Valid Targets Properties Values Default /HOST/tpm enable activate forceclear true | false true | false true | false false false false /SP/alertmgmt/rules testalert true (none) /SP/alertmgmt/rules/ rulename (rulename = 1 through 15) community_or_username destination destination_port event_class_filter event_type_filter level snmp_version type email_address “ “ | Log | Email | Internal | Captive Shell | Backup | Restore | Audit | IPMI | Chassis | Fault | System | ActDir “ “ | Developer | Connection | Send | Product | Chassis | Command Entered | State | Action | Fault | Repair | Warning disable|down|critical|major |minor 1|2c|3 email | ipmipet | snmptrap public (none) 0 (none) (none) (none) 3 (none) /SP/cli timeout (none) /SP/clock datetime timezone usentpserver current date and time EST | PST8PDT enabled|disabled GMT disabled /SP/console/history line_count pause_count start_from end | beginning 0 0 end /SP/services/http port secureredirect servicestate enabled|disabled enabled|disabled 80 enabled disabled /SP/services/https port servicestate enabled|disabled 443 disabledCLI Command Reference 187 /SP/services/ipmi servicestate enabled|disabled enabled /SP/services/kvms mousemode servicestate absolute|relative enabled|disabled absolute enabled /SP/services/snmp engineid mibs port sets v1 v2c v3 servicestate dump_uri enabled|disabled enabled|disabled enabled|disabled enabled|disabled enabled|disabled IP address (none) 161 disabled disabled disabled enabled enabled /SP/services/snmp/ communities/private permission ro |rw rw /SP/services/snmp/ communities/public permission ro|rw ro /SP/services/snmp/user /username authenticationprotocol authenticationpassword permissions privacyprotocol privacypassword MD5 ro|rw none|DES|AES MD5 (null string) ro DES (null string) /SP/services/ssh external_host generate_new_key_action generate_new_key_type restart_sshd_action state true rsa|dsa true enabled|disabled (none) (none) (none) enabled /SP/services/sso state enabled|disabled enabled /SP/users/username role password administrator|operator|a|u| c|r|o|s (none) (none) TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values Default188 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/clients/ activedirectory state defaultrole dnslocatormode expsearchmode address port strictcertmode timeout logdetail enabled | disabled administrator | operator | a| u | c| r | o | s enabled | disabled enabled | disabled or enabled | disabled none | high | medium | low | trace disabled (none) disabled disabled (none) 0 disabled 4 none /SP/clients/ activedirectory/ admingroups/n where n is 1-5 name (none) /SP/clients/ activedirectory/ opergroups/n where n is 1-5 name (none) /SP/clients/ activedirectory/ userdomains/n where n is 1-5 domain (none) /SP/clients/ activedirectory/ customgroups/n where n is 1-5 name roles a|u|c|r|o|s|administrator| operator (none) o /SP/clients/ activedirectory/ alternateservers/n where n is 1-5 address port or (none) 0 TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values DefaultCLI Command Reference 189 /SP/clients/ activedirectory/ alternateservers/n/cert where n is 1-5 certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version true tftp|ftp|scp certificate not present (none) (none) (none) (none) (none) (none) (none) (none) /SP/clients/ activedirectory/cert/ certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version true tftp|ftp|scp certificate not present (none) (none) (none) (none) (none) (none) (none) (none) /SP/clients/ activedirectory/ dnslocatorqueries/n where n is 1-5 service (none) /SP/clients/dns auto_dns nameserver retries searchpath timeout enabled|disabled disabled (none) (none) (none) (none) /SP/clients/ldap binddn bindpw defaultrole address port searchbase state administrator|operator|a|u| c|r|o|s |none enable|disabled (none) (none) o (none) 389 (none) disabled TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values Default190 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/clients/ldapssl state defaultrole dnslocatormode address port strictmode optionalUserMapping timeout logdetail enabled | disabled administrator | operator | a| u | c| r | o | s enabled | disabled or enabled | disabled enabled | disabled none | high | medium | low | trace disabled (none) disabled (none) 0 disabled disabled 4 none /SP/clients/ ldapssl/ admingroups/n where n is 1-5 name (none) /SP/clients/ ldapssl/ opergroups/n where n is 1-5 name (none) /SP/clients/ ldapssl/ userdomains/n where n is 1-5 domain (none) /SP/clients/ldapssl/ customgroups/n where n is 1-5 name roles administrator | operator | a | u| c | r | o | s (none) (none) /SP/clients/ldapssl/ alternateserver/n where n is 1-5 address port (none) 0 /SP/clients/ldapssl/ alternateservers/n/cert where n is 1-5 certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version true tftp|ftp|scp (none) (none) (none) (none) (none) (none) (none) (none) (none) TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values DefaultCLI Command Reference 191 /SP/clients/ldapssl/ cert/ certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version true tftp|ftp|scp certificate not present (none) (none) (none) (none) (none) (none) (none) (none) /SP/clients/ ldapssl/ cert/n where n is 1-5 domain (none) /SP/clients/ntp/server/ [1|2] address (none) /SP/clients/radius defaultrole address port secret state administrator|operator|a|u| c|r|o|s|none |none |none enable|disabled operator (none) 1812 (none) disabled /SP/clients/smtp address port state enabled | disabled IP address 25 enabled /SP/clients/syslog[1|2] address IP address /SP/config dump_uri load_uri passphrase tftp|ftp|sftp|scp|http|https tftp|ftp|sftp|scp|http|https (none) (none) (none) /SP/diag snapshot (none) (none) /SP/network commitpending pendingipaddress pendingdiscovery pendingipgateway pendingipnetmask state true |none dhcp|static |none enabled | disabled (none) (none) dhcp (none) 10.8.255.255 enabled TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values Default192 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Examples -> set /SP/users/susan role=administrator -> set /SP/clients/ldap state=enabled binddn=proxyuser bindpw=ez24get /SP/network/ipv6 state autoconfig pending_static_ipaddress commitpending enabled | disabled stateless | dhcpv6_stateless | dhcpv6_stateful | disable true enabled stateless (none) (none) /SP/network/test ping ping6 (none) (none) /SP/preferences/banner connect_message login_message login_message_acceptance enabled | disabled (none) (none) disabled /SP/serial/external commitpending flowcontrol pendingspeed speed true none (none) (none) 9600 9600 /SP/serial/host commitpending pendingspeed speed true (none) 9600 9600 /SP/ check_physical_presence hostname reset_to_defaults system_contact system_description system_identifier system_location true|false all|factory|none (none) (none) (none) (none) (none) (none) (none) TABLE: Targets, Properties, and Values for set Command (Continued) Valid Targets Properties Values DefaultCLI Command Reference 193 show Command Use the show command to display information about targets and properties. Using the -display option determines the type of information shown. If you specify -display targets, then all targets in the namespace below the current target are shown. If you specify -display properties, all property names and values for the target are shown. With this option you can specify certain property names, and only those values are shown. If you specify -display all, all targets in the namespace below the current target are shown, and the properties of the specified target are shown. If you do not specify a -display option, the show command acts as if -display all were specified. The -level option controls the depth of the show command, and it applies to all modes of the -display option. Specifying -level 1 displays the level of the namespace where the object exists. Values greater than 1 return information for the current target level in the namespace and the levels below. If the argument is -level all, it applies to the current level in the namespace and everything below. The -o|output option specifies the output and form of command output. Oracle ILOM supports only -o table, which displays targets and properties in tabular form. The alias, show components, is a shortcut for the following CLI command: -> show -o table -level all /SYS component state The show components alias produces the same output as the previous command. Thus, it enables you to restrict the table output to a single property below each target. Syntax show [options] [-display targets|properties|all] [-level value|all] target [propertyname] Options [-d|-display] [-l|level] [-o|output]194 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Targets and Properties TABLE: Targets and Properties for show Command Valid Targets Properties /HOST/tpm activate enable forceclear /SYS /SYS/DBP/HDDn where n is a valid HDD slot type ipmi_name fru_name fru_manufacturer fru_version fru_serial_number controller_id disk_id capacity device_name disk_type wwn raid_status raid_ids /STORAGE/raid/controller@od:00.0 where 00.0 is the ID for the controller fru_manufacturer fru_model pci_vendor_id pci_device_id pci_subvendor_id pci_subdevice_id raid_levels max_disks max_raids max_hot_spares max_global_hot_spares min_stripe_size max_stripe_size /STORAGE/raid/controller@od:00.0/ raid_id0 where 00.0 is the ID for the controller, and raid_id0 is the target RAID disk level status disk_capacity device_name mountedCLI Command Reference 195 /STORAGE/raid/controller@od:00.0/ raid_id0/disk_id0 where 00.0 is the ID for the controller, and raid_id0 is the target RAID disk, and disk_id0 is the target disk fru_manufacturer fru_serial_number fru_version status capacity device_name disk_type wwn raid_ids system_drive_slot /SP /SP/alertmgmt/rules/ rulename (rulename = 1 through 15) community|username destination destination_port event_class_filter event_type_filter level snmp_version type /SP/cli timeout /SP/clients/ activedirectory state certfilestatus defaultrole getcertfile address logdetail port strictcertmode timeout /SP/clients/ activedirectory/ admingroups/n where n is 1-5 name /SP/clients/ activedirectory/ alternateservers/n where n is 1-5 address port TABLE: Targets and Properties for show Command (Continued) Valid Targets Properties196 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/clients/ activedirectory/ alternateservers/n/cert where n is 1-5 clear_action issuer load_uri serial_number subject valid_from valid_until version /SP/clients/ activedirectory/cert certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version /SP/clients/ activedirectory/ customgroups/n where n is 1-5 name roles /SP/clients/ activedirectory/ opergroups/n where n is 1-5 name /SP/clients/ activedirectory/ userdomains/n where n is 1-5 domain /SP/clients/dns auto_dns nameserver searchpath /SP/clients/ldap binddn bindpw defaultrole address port searchbase state TABLE: Targets and Properties for show Command (Continued) Valid Targets PropertiesCLI Command Reference 197 /SP/clients/ldapssl defaultrole address logdetail port optionalUserMapping state strictcertmode timeout /SP/clients/ ldapssl/ admingroups/n where n is 1-5 name /SP/clients/ ldapssl/ alternateservers/n where n is 1-5 address port /SP/clients/ ldapssl/ alternateservers/n/cert where n is 1-5 cert_status clear_action issuer load_uri serial_number subject valid_from valid_until version /SP/clients/ldapssl/cert certstatus clear_action issuer load_uri serial_number subject valid_from valid_until version /SP/clients/ ldapssl/ customgroups/n where n is 1-5 name roles TABLE: Targets and Properties for show Command (Continued) Valid Targets Properties198 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/clients/ ldapssl/ opergroups/n where n is 1-5 name /SP/clients/ ldapssl/ userdomains/n where n is 1-5 domain /SP/clients/ntp/server/[1|2] address /SP/clients/radius address port secret state /SP/clients/smtp port state /SP/clock datetime usentpserver uptime timezone /SP/config dump_uri load_uri passphrase /SP/console escapechars /SP/console/history line_count pause_count start_from /SP/diag/snapshot dataset dump_uri result /SP/firmware load_uri /SP/logs/event clear TABLE: Targets and Properties for show Command (Continued) Valid Targets PropertiesCLI Command Reference 199 /SP/network commitpending dhcp_server_ip ipaddress ipdiscovery ipgateway ipnetmask macaddress pendingipaddress pendingdiscovery pendingipgateway pendingipnetmask state /SP/network/ipv6 state autoconfig dhcpv6_server_duid link_local_ipaddress static_ipaddress ipgateway pending_static_ipaddress dynamic_ipaddress_1 /SP/network/test ping ping6 /SP/powermgmt actual_power permitted_power available_power /SP/preferences/banner connect_message login_message login_message_acceptance /SP/serial/external flowcontrol speed /SP/serial/host commitpending pendingspeed speed /SP/services/http port secureredirect servicestate TABLE: Targets and Properties for show Command (Continued) Valid Targets Properties200 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 /SP/services/https cert_status servicestate /SP/services/https/ssl cert_status /SP/services/https/ssl/default_cert issuer subject valid_from valid_until /SP/services/https/ssl/custom_cert clear_action issuer load_uri subject valid_from valid_until /SP/services/https/ssl/custom_key key_present load_uri clear_action /SP/services/ipmi servicestate /SP/services/kvms mousemode servicestate /SP/services/servicetag passphrase product_urn state /SP/services/snmp engineid mibs port sets v1 v2c v3 servicestate /SP/services/snmp/communities/private permissions /SP/services/snmp/communities/public permissions /SP/services/snmp/users/username password role /SP/services/ssh state TABLE: Targets and Properties for show Command (Continued) Valid Targets PropertiesCLI Command Reference 201 Examples -> show /SP/users/user1 -> show /SP/clients -level2 -> show components /SP/services/ssh/keys/dsa fingerprint length privatekey publickey /SP/services/ssh/keys/rsa fingerprint length privatekey publickey /SP/services/sso state /SP/sessions/sessionid username starttime type mode /SP/users/username role password /SP/users/username/ssh/keys/1 fingerprint algorithm load_uri clear_action embedded_comment bit_length /SP/users/username/service service_password service_password_expires /SP/users/username/escalation escalation_password escalation_password_expires TABLE: Targets and Properties for show Command (Continued) Valid Targets Properties202 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 start Command Use the start command to turn on the target or to initiate a connection to the host console. Using the -script option eliminates the prompt for a yes or no confirmation and the command acts as if yes were specified. Syntax start [options] target Options [-h|help] [-script] Targets Examples -> start /SP/console -> start /SYS TABLE: Targets for start Command Valid Targets Description /SYS or /CH Starts (powers on) the system or chassis. /SP/console Starts an interactive session to the console stream.CLI Command Reference 203 stop Command Use the stop command to shut down the target or to terminate another user's connection to the host console. You will be prompted to confirm a stop command. Eliminate this prompt by using the -script option. The -f|force option specifies that the action will be performed immediately. Syntax stop [options] [-script] target Options [-f|force] [-h|help] Targets Examples -> stop /SP/console -> stop -force /SYS TABLE: Targets for stop Command Valid Targets Description /SYS or /CH Perform an orderly shutdown, followed by a power-off of the specified system or chassis. Use the -f|-force option to skip the orderly shutdown and force an immediate power-off. /SP/console Terminate another user's connection to the host console.204 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 version Command Use the version command to display Oracle ILOM version information. Syntax version Options [-h|help] Example -> version version SP firmware version: 3.0.0 SP firmware build number: 4415 SP firmware date: Mon Mar 28 10:39:46 EST 2008 SP filesystem version: 0.1.9205 Diagnosing IPv4 or IPv6 Oracle ILOM Connection Issues This section provides solutions to help resolve common problems when accessing Oracle ILOM using IPv6. For details, see: ¦ “Diagnosing Oracle ILOM Connection Issues” on page 206206 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Diagnosing Oracle ILOM Connection Issues If you are experiencing difficulties with connecting to Oracle ILOM when using IPv6, use the information provided in the following table to help resolve common problems when accessing Oracle ILOM using IPv6. TABLE: Common IPv6 Connection Problems and Suggested Resolutions IPv6 Common Connection Problem Suggested Resolution Unable to access the Oracle ILOM web interface using an IPv6 address. Ensure that the IPv6 address in the URL is enclosed by brackets, for example: (https://[fe80::221:28ff:fe77:1402]) Unable to download a file using an IPv6 address. Ensure that the IPv6 address in the URL is enabled by brackets, for example: load -source tftp://[fec0:a:8:b7:214:rfff:fe01:851d]desktop.pkg Unable to access Oracle ILOM using IPv6 from a network client. If on a separate subnet, try the following: • Verify that Oracle ILOM has a dynamic or static address (not just a Link-Local address). • Verify that the network client has an IPv6 address configured (not just a Link-Local address). If on the same or separate subnet, try the following • Ensure that the setting for IPv6 State is enabled on the Network Settings page in the Oracle ILOM web interface or under the /SP/network/ipv6 target in the Oracle ILOM CLI. • Run ping6 in a restricted shell. • Run traceroute in a restricted shell. Unable to access Oracle ILOM from a client within a dual-stack IPv4 and IPv6 network environment. Ensure that the following settings are enabled: • State – You can enable the setting for State on the Network Settings page in the Oracle ILOM web interface or under the /SP/network target in the CLI. • IPv6 State – You can enable the setting for IPv6 State on the Network Settings page in the Oracle ILOM web interface or under the /SP/network/ipv6 target. Unable to access Oracle ILOM using IPv4 from a network client. Ensure that the setting for State is enabled on the Network Settings page in the Oracle ILOM web interface or under the /SP/network target in the Oracle ILOM CLI.207 Manual Host OS Configuration Guidelines for Local Interconnect Interface The following topic provides guidelines for manually configuring a non-routable IPv4 address for the host OS connection point on the Local Interconnect Interface. ¦ “Configuring Internal USB Ethernet Device on Host OS” on page 208208 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Configuring Internal USB Ethernet Device on Host OS If you chose to manually configure a non-routable IPv4 address for the Oracle ILOM SP connection point on the Local Interconnect Interface, you will also need to manually configure a non-routable IPv4 address for the host OS connection point on the Local Interconnect Interface. General guidelines, per operating system, for configuring a static non-routable IPv4 address for the host OS connection point are provided in the following table. For additional information about configuring IP addresses on the host operating system, consult the vendor operating system documentation. Note – Oracle ILOM will present the internal USB Ethernet device installed on your server as an USB Ethernet interface to the host operating system. TABLE: General Guidelines for Configuring Internal USB Ethernet Device on Host OS Operating System General Guidelines Windows Server 2008 After Windows discovers the internal USB Ethernet device, you will most likely be prompted to identify a device driver for this device. Since no driver is actually required, identifying the .inf file should satisfy the communication stack for the internal USB Ethernet device. The .inf file is available from the Oracle Hardware Management Pack 2.1.0 software distribution. You can download this management pack software from the Oracle software product download page (www.oracle.com) as well as extract the .inf file from the Management Pack software. For additional information about extracting the .inf file from the Management Pack software, refer to the the Oracle Server Hardware Management Pack User’s Guide. After applying the .inf file from the Oracle Hardware Management Pack 2.1.0 software distribution, you can then proceed to configure a static IP address for the host OS connection point of the Local Interconnect Interface by using the Microsoft Windows Network configuration option located in the Control Panel (Start --> Control Panel). For more information about configuring an IPv4 address in Windows 2008, see the Microsoft Windows Operating System documentation or the Microsoft Tech Net site ((http://technet.microsoft.com/en-us/library/cc754203%28WS.10%29.a spx)).Manual Host OS Configuration Guidelines for Local Interconnect Interface 209 Linux Most supported Linux operating system installations on an Oracle Sun platform server include the installation of the device driver for an internal Ethernet device. Typically, the internal USB Ethernet device is automatically discovered by the Linux operating system. The internal Ethernet device typically appears as usb0. However, the name for the internal Ethernet device might be different based on the distribution of the Linux operating system. The following instructions demonstrate how to configure a static IP address corresponding to usb0, which typically represents an internal USB Ethernet device found on the server: \>lsusb usb0 \> ifconfig usb0 169.254.182.77 \> ifconfig usb0 netmask 255.255.255.0 \> ifconfig usb0 broadcast 169.254.182.255 \> ifconfig usb0 \> ip addr show usb0 Note - Rather than performing the typical ifconfig steps, it is possible to script the configuration of the interface. However, the exact network scripts vary among the Linux distributions. Typically, the operating version of Linux will have examples to model the network scripts. For more information about how to configure an IP address for device using a Linux operation system, refer to the Linux operating system documentation. TABLE: General Guidelines for Configuring Internal USB Ethernet Device on Host OS (Continued) Operating System General Guidelines210 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Oracle Solaris Most Oracle Solaris Operating System installations on an Oracle Sun platform server include the installation of the device driver for an internal USB Ethernet device. If this driver was not supported, you can extract this driver from the Oracle Hardware Management Pack 2.1.0 or later software. For information about how to extract the Solaris-specific OS driver for the Ethernet interface, refer to the Oracle Server Hardware Management Pack User’s Guide. Typically, the internal USB Ethernet device is automatically discovered by the Solaris Operating System. The internal Ethernet device typically appears as usbecm0. However, the name for the internal Ethernet device might be different based on the distribution of the Oracle Solaris Operating System. After the Oracle Solaris Operating System recognizes the local USB Ethernet device, the IP interface for the USB Ethernet device needs to be configured. The following instructions demonstrate how to configure a static IP address corresponding to usbecm0, which typically represents an internal USB Ethernet device found on the server. • Type the following command to plumb the IP interface or unplumb the IP interface: ifconfig usbecm0 plumb ifconfig usbecm0 unplumb • Type the following commands to set the address information: ifconfig usbecm0 netmask 255.255.255.0 broadcast 169.254.182.255 169.254.182.77 • To set up the interface, type: ifconfig usbecm0 up • To bring the interface down, type: ifconfig usbecm0 down • To show the active interfaces, type: ifconfig -a • To test connectivity, ping the Oracle Solaris host or the SP internal USB Ethernet device. ping ping Note - Rather than performing the typical ifconfig steps, it is possible to script the configuration of the interface. However, the exact network scripts can vary among the Oracle Solaris distributions. Typically, the operating version will have examples to model the network scripts. For more information about how to configure a static IP address for a device using the Oracle Solaris Operating System, refer to the Oracle Solaris Operating System documentation. TABLE: General Guidelines for Configuring Internal USB Ethernet Device on Host OS (Continued) Operating System General GuidelinesManual Host OS Configuration Guidelines for Local Interconnect Interface 211 Note – If the internal USB Ethernet device driver was not included in your operating system installation, you can obtain the device driver for the Ethernet device from the Oracle Hardware Management Pack 2.1.0 or later software. For more information about extracting this file from the Management Pack, refer to the Oracle Server Hardware Management Pack User’s Guide.212 Oracle ILOM 3.0 CLI Procedures Guide • May 2011213 Index A Active Directory certstatus, 65 removing certi?cate, 66 strictcertmode, 64 troubleshooting, 74 viewing and con?guring settings, 67 Admin (a) role, 58 alert rules CLI commands, 123 con?guring, 119 disabling, 121 alert tests generating, 122 alerts CLI commands for managing alerts, 123 email noti?cation con?guring the SMTP client, 124 generating email noti?cation, 124 B backup and restore, permissions (aucro), 59 C certi?cate authentication, 64 certi?cate state, 65 CLI command syntax, 10 cd command, 178 create command, 179 delete command, 180 dump command, 181 exit command, 181 help command, 182 load command, 183 reset command, 184 set command, 185 show command, 193 start command, 202 stop command, 203 version command, 204 CLI command types alert management commands, 13 clock settings commands, 14 general commands, 12 host system commands, 15 network and serial port commands, 13 SNMP commands, 15 system management access commands, 14 user commands, 12 CLI commands alert rules, 123 executing combined, 11 executing individually, 11 reference for, 177 CLI target types /CH, 5 /CMM, 5 /HOST, 5 /SP, 5 /SYS, 5 clock settings, 99 command properties for ILOM 2.x, 17 for ILOM 3.0, 17 command strings, 12 command-line interface (CLI) command syntax, 10 ?ltering output options for commands, 16 options for, 8 overview, 2 target tree, 8, 9 communication settings con?guring, 27 component information, 90214 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 components enabling and disabling, 92 managing, 89 monitoring, 95, 107 removing, 91 returning to service, 92 Console (c) role, 58 D defaultuser account using for password recovery, 23 Distributed Management Task Force Command-Line Protocol (DMTF CLP), 2 DMTF Command Line Protocol Commands, 7 Domain Name Service (DNS) locator service, 71 targets, properties, and values for, 40 DSA key viewing, 47 Dual stack network settings, 32 E event logs contents of, 101 ?ltering output, 100 viewing and clearing, 100 H HTTP or HTTPS settings enabling, 42 targets, properties, and values for, 42 I ILOM 2.x properties compared to ILOM 3.0, 17 updating 2.x scripts, 17 IP address assignment editing using the CLI, ?? to 32 for remote syslog receiver, 102 L LDAP server con?guring, 75 LDAP/SSL, 77 certstatus, 78 removing a certi?cate, 79 strictcertmode, 77 troubleshooting, 84 viewing and con?guring settings, 79 Lightweight Directory Access Protocol (LDAP), 75 con?guring, 76 overview, 75 log in ?rst time, 21 prerequisites for, 20 log out, 22 N network settings, 28 DNS, 40 editing IP address, 31 host name, 39 pending and active properties, 29 serial port, 41 system identi?er, 39 targets, properties, and values for, 30 viewing and con?guring, 30 P password changing, 57 lost password recovery, 23 permissions, user, 57 physical presence proving, 23 power consumption monitoring, 130 monitoring actual power, 133 monitoring available power, 134 monitoring individual power supply, 133 monitoring permitted power, 135 monitoring total system power, 131 power consumption management monitoring power show command, 135 power policy con?guring, 139 properties ILOM 3.0 versus ILOM 2.x, 17 R RADIUS con?guration prerequisites, 85 con?guring, 85Index 215 Read Only (o) role, 58 recover lost password, 23 remote host managing, 155 managing power states, 157 remote power control CLI commands, 158 remote syslog receiver, 102 Reset and Host Control (r) role, 58 roles, user, 57 RSA key viewing, 46 S Secure Shell (SSH) enabling or disabling, 46 establishing remote connection, 44 generating new key, 47 settings for, 44 viewing current key, 46 sensor readings, 96 sensors viewing readings, 96 serial port output switch using ILOM CLI, 43 serial port settings pending and active properties, 41 targets, properties, and values for, 42 viewing and con?guring, 41 Serverices (s) role, 58 Single Sign On, 56 SMTP client con?guring, 124 SNMP Trap alert, 118 SPARC servers managing TPM and LDom states, 167 ssh command (Solaris) connecting to a SP, 44 SSH connection, 44 enabling and disabling, 46 key encryption using the CLI, 46 new key, 47 restarting, 47 SSH key, 62 adding, 62 deleting, 63 Storage Redirection CLI initial setup, 156 strictcertmode, 64 system alerts commands for managing, 123 con?guration prerequisites, 118 con?guring, 119 con?guring SMTP client, 124 deleting, 121 generating, 122 system components viewing and managing, 89 system indicators con?guring, 98 viewing, 98 T target tree, 9 target types, 5 U user accounts adding, 56 con?guring, 56 deleting, 59 password, 57 roles, 57 viewing individual session, 61 viewing individual user account, 59 viewing list of user sessions, 60 User Management (u) role, 58216 Oracle ILOM 3.0 CLI Procedures Guide • May 2011 Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide Part No. E21449-01 May 2011, Revision 01Please Recycle Copyright © 2008, 2010, 2011 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011 Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation viii ? Download Product Software and Firmware x Maintenance Operations Overview 1 Firmware Updates Using Oracle ILOM 1 Service Processor (SP) Reset 3 Back Up, Restore, and Reset Oracle ILOM Configurations 3 Updating Firmware 7 Updating Firmware Using Oracle ILOM (Web) 8 Before You Begin - Update Firmware Image 8 ? Identify the Oracle ILOM Firmware Version 9 ? Update Firmware Image 9 ? Recover From a Network Failure During Firmware Update 11 Updating Firmware Using Oracle ILOM (CLI) 12 Before You Begin - Firmware Image (CLI) 12 ? Identify Oracle ILOM Firmware Version (CLI) 13 ? Update the Firmware Image (CLI) 13 ? Recover From a Network Failure During Firmware Update (CLI) 15 Resetting the Service Processor Using Oracle ILOM 17 ? Reset the SP Using the Oracle ILOM Web Interface 17 ? Reset the SP Using the Oracle ILOM CLI 18v Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Backing Up, Restoring, or Resetting Oracle ILOM Configurations 19 Backing Up Configurations 20 ? Back Up the Oracle ILOM Configuration (Web) 20 ? Back Up the Oracle ILOM Configuration (CLI) 23 ? Optionally Edit the Backup XML File 24 Restoring Configurations 28 ? Restore the Oracle ILOM Configuration (Web) 28 ? Restore the Oracle ILOM Configuration (CLI) 30 Resetting Oracle ILOM Configuration Settings to the Defaults 32 ? Reset the Oracle ILOM Configuration to Defaults (Web) 32 ? Reset the Oracle ILOM Configuration to Defaults (CLI) 33 Diagnostic Tools Overview 35 Server SP Diagnostic Tools 35 PC-Check (x86 Systems) 36 Generate NMI (x86 Systems) 37 SPARC System Diagnostic Configuration Settings 37 Oracle Service-Designated Diagnostic Tools 39 Collect SP Data to Diagnose System Problems 39 Fault Management Using the Restricted Shell 40 x86 Server SP Diagnostic Tools 41 Diagnosing x86 Systems Hardware Issues (Web) 41 ? Configure Pc-Check Diagnostics for x86 Systems 42 ? Generate an NMI 42 Diagnosing x86 Systems Hardware Issues (CLI) 43 ? Configure and Run Pc-Check Diagnostics (CLI) 43 ? Generate a Non-Maskable Interrupt (CLI) 44 SPARC Server SP Diagnostic Tools 47Contents vi Diagnosing SPARC Systems Hardware Issues (Web) 48 ? Configure Diagnostics Settings for SPARC Systems 48 Diagnosing SPARC Systems Hardware Issues (CLI) 49 ? Configure Diagnostics Mode (CLI) 49 ? Specify the Diagnostics Trigger (CLI) 50 ? Specify Level of Diagnostics (CLI) 50 ? Specify Verbosity of Diagnostics Output (CLI) 51 Oracle Services-Designated Diagnosic Tools 53 Collecting SP Data to Diagnose System Problems 54 ? Using the Oracle ILOM Snapshot Utility (Web) 54 ? Using the Oracle ILOM Snapshot Utility (CLI) 56 Using the Oracle ILOM Fault Management Shell 58 Fault Management Terms 58 ? Starting, Stopping, and Logging Fault Management Shell Sessions 59 Fault Management Shell Command Reference 60 fmadm – Fault Management Administration Tool 60 Syntax 60 Subcommands 61 Example 64 Exit Status 65 fmdump – Fault Management Log Viewer 65 Syntax 66 Options 66 Example 67 Exit Status 67 fmstat – Statistical Module Report Generator 67 Syntax 68 Example 69vii Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Exit Status 69 echo – Display Exit Code for Last Command 69 Syntax 69 help – Display Command Online Help 69 Syntax 69 Exit Status 70 Index 71viii Using This Documentation This guide describes maintenance and diagnostics features that are available in both the Oracle Integrated Lights Out Manager (ILOM) 3.0 web interface and CLI. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is intended for technicians, system administrators, and authorized Oracle service providers, and users who have experience managing system hardware. ¦ “Documentation and Feedback” on page ix ¦ “Product Downloads” on page x ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xi ¦ “Documentation, Support, and Training” on page xiix Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Interface Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation x Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the Oracle ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.xi Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme Oracle ILOM 3.0 uses a firmware version numbering scheme that helps you to identify the firmware version you are running on your server or CMM. This numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface. Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)1 Maintenance Operations Overview Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Description Links Learn about updating system firmware • “Firmware Updates Using Oracle ILOM” on page 2 Learn about resetting the service processor • “Service Processor (SP) Reset” on page 3 Learn about backing up, restoring and resetting the Oracle ILOM configuration • “Back Up, Restore, and Reset Oracle ILOM Configurations” on page 42 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Firmware Updates Using Oracle ILOM To ensure that your system has the latest features and product enhancements installed, you should update the Oracle ILOM firmware on your system with the latest Oracle ILOM firmware release that is available. The firmware for the following types of devices can be updated using Oracle ILOM: ¦ Blade or rackmount servers (x86 and SPARC) that contain a service processor (SP) ¦ Blade chassis network expansion modules (NEM) that include a service processor ¦ Blade chassis monitoring module (CMM) Note – In a Sun Blade Modular System chassis running Oracle ILOM 3.0, the CMM can act as the primary point for managing firmware updates for chassis components. When updating to a later firmware release, the Preserve Configuration option (when enabled) saves your existing Oracle ILOM configuration and restores the configuration after the update process is complete. Note – The term configuration here refers to the settings configured in Oracle ILOM by a user. These settings can include user management settings, SP network settings, serial port settings, alert management configurations, remote management configurations, and so on. If you are updating to a prior firmware release and Oracle ILOM detects a preserved configuration for that release, the Preserve Configuration option (when enabled) reverts to the configuration for the prior release after the update process completes. Generally, you should not update the firmware on your system to a prior release. However, if you determine that you need to run an earlier version of the firmware on your system, you can update the firmware to any prior firmware release that is available for download. Prior to updating the Oracle ILOM firmware, you should identify the Oracle ILOM firmware version that is running on the server SP, NEM SP, or CMM. For information about the firmware version numbering scheme used for Oracle ILOM 3.0, see “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xi. If you determine you are running Oracle ILOM 3.0 firmware on your server SP, NEM SP, or CMM, refer to any of the following Oracle ILOM 3.0 guides for instructions for updating the Oracle ILOM firmware.Maintenance Operations Overview 3 Related Information ¦ “Updating Firmware” on page 7 ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Guide ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems ¦ Oracle ILOM supplement guide or platform administration guide provided for your server Service Processor (SP) Reset On occasion, the SP for a server, NEM, or CMM will need to be reset for you to complete an upgrade, or to clear an error state. The reset operation is similar to resetting a PC where all active processes are terminated and the system reboots. If you need to reset your Oracle ILOM service processor (SP), you can do so without affecting the host OS. However, resetting an SP disconnects your current Oracle ILOM session and renders the SP unmanageable during reset. Related Information ¦ “Resetting the Service Processor Using Oracle ILOM” on page 17 ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Guide ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems ¦ Oracle ILOM supplement guide or platform administration guide provided for your server4 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Back Up, Restore, and Reset Oracle ILOM Configurations Oracle ILOM’s configuration management tasks enable you to: ¦ Back up the Oracle ILOM configuration to a XML file on a remote system. ¦ Use the backup file to restore Oracle ILOM to the backed-up configuration. ¦ Use the backup file to install the backed-up configuration on other Oracle ILOM SPs. ¦ Reset the Oracle ILOM configuration to the default settings. You can use the Backup and Restore and Reset to Defaults features together in the following ways: ¦ Save the Oracle ILOM configuration to a backup XML file, reset the Oracle ILOM configuration to the default settings, and use the command-line interface (CLI) or web interface to create a new Oracle ILOM configuration. The privileges assigned to the user account that is used to execute the Backup operation determine how much of the configuration is included in the backup XML file. The Admin (a), User Management (u), Console (c), Reset and Host Control (r), and Read Only (o) roles have full privileges and create the most complete configuration backup file. Note – For security reasons, if the user account used to execute the Restore operation has fewer privileges than the account used to create the backup file, some of the configurations might not be restored. For each configuration property that is not restored due to lack of privileges, a log entry is created. ¦ Use the CLI or web interface to create a new Oracle ILOM configuration, save the Oracle ILOM configuration to a backup XML file, edit the XML file to remove settings that are unique to a particular system, and perform restore operations to load the backup file to other systems. ¦ Reset the Oracle ILOM configuration to the default settings and restore it using a known good Oracle ILOM configuration backup file. Given the above capabilities, the following use cases describe how you might typically use these features: ¦ You changed your Oracle ILOM configuration but it no longer works and you want to recover Oracle ILOM by restoring it to a known good configuration. To do this, first reset the Oracle ILOM configuration to the default settings and then perform a Restore operation using the known good configuration.Maintenance Operations Overview 5 ¦ You want to use the Backup and Restore feature to replicate an Oracle ILOM configuration onto other systems. To do this, create a standard Oracle ILOM configuration, back up the configuration, edit the backed up XML file to remove settings that are unique to a particular system (for example, the IP address), then perform Restore operations to replicate the configuration onto the other systems. ¦ You created a minimum Oracle ILOM configuration but to make it complete you need to configure a number of users (Oracle ILOM supports a maximum of 10 active user sessions per service processor). If you have backed up a configuration previously that has the same users, you can edit the XML file so that it only includes the user information and then simply perform a Restore operation to overlay the minimum configuration with the configuration that has the user accounts. Reuse of large network configurations such as Active Directory is another use case for this approach. You can use either the web interface or the CLI to perform configuration management tasks in Oracle ILOM. For more information about these tasks, see: Related Information ¦ “Backing Up, Restoring, or Resetting Oracle ILOM Configurations” on page 19 ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Guide ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures Guide ¦ Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems6 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 20117 Updating Firmware The information in this section describes how to upgrade firmware on systems using Oracle ILOM. Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures ¦ Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Description Links Use the Oracle ILOM web interface to update a firmware image on the server or CMM • “Updating Firmware Using Oracle ILOM (Web)” on page 8 Use the Oracle ILOM command-line interface to update a firmware image on the server or CMM • “Updating Firmware Using Oracle ILOM (CLI)” on page 12 Use SNMP to get and set firmware management information (view version, set upgrade image locataion, initiate upgrade, etc.) • “Manage Oracle ILOM Firmware Updates (SNMP)” in Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Guide8 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Updating Firmware Using Oracle ILOM (Web) Before You Begin - Update Firmware Image Before you perform the procedures in this section, the following requirements must be met: ¦ Identify the version of Oracle ILOM that is currently running on your system. For details, see “Identify the Oracle ILOM Firmware Version” on page 9. ¦ Download the firmware image for your server or CMM from the Oracle download web site and place the image on your TFTP, FTP, or HTTP server. For download instructions, see “Product Downloads” on page x. ¦ If required by your platform, shut down your host operating system before changing the firmware on your server SP. ¦ Obtain an Oracle ILOM user name and password that has Admin (a) role account privileges. You must have Admin (a) privileges to update the firmware on the system. ¦ The firmware update process takes several minutes to complete. During this time, do not perform other Oracle ILOM tasks. When the firmware update is complete, the system will reboot. Description Links Platform Feature Support Identify requirements for updating firmware image • “Before You Begin - Update Firmware Image” on page 8 • x86 system server SP • SPARC system server SP • CMM Perform these procedures to update the Oracle ILOM firmware image on your server or CMM • “Identify the Oracle ILOM Firmware Version” on page 9 • “Update Firmware Image” on page 9 Troubleshoot network failure durng firmware update • “Recover From a Network Failure During Firmware Update” on page 11Updating Firmware 9 Note – As of Oracle ILOM 3.0.10, a new feature is available to manage firmware updates for Oracle Sun Modular System chassis components. For information and procedures for updating Oracle ILOM firmware on CMM chassis components, refer to the Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems. ? Identify the Oracle ILOM Firmware Version To identify the firmware version installed on your server or CMM, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface interface. 2. Click System Information --> Versions. The current firmware version information appears. ? Update Firmware Image Before You Begin ¦ Met the requirements listed in “Before You Begin - Update Firmware Image” on page 8. ¦ If required by your platform, shut down your host operating system before updating the firmware on your server SP. To gracefully shut down your host operating system from the Oracle ILOM web interface, select the Graceful Shutdown and Power off options in the Remote Control --> Remote Power Control tab. From the Oracle ILOM CLI, issue the stop /SYS command. To update the firmware image, follow these steps: 1. Log in to the Oracle ILOM SP or CMM web interface 2. Click Maintenance --> Firmware Upgrade. The Firmware Upgrade page appears. 3. In the Firmware Upgrade page, click Enter Upgrade Mode. An Upgrade Verification dialog box appears, indicating that other users who are logged in will lose their session when the update process is complete. 4. In the Upgrade verification dialog box, click OK to continue. The Firmware Upgrade page appears. 5. In the Firmware Upgrade page, perform the following actions:10 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 a. Specify the image location by performing one of the following: ¦ Click Browse to select the location of the firmware image you want to install. ¦ If supported on your system, click Specify URL. Then, in the text field, type the URL that will locate the firmware image. b. Click the Upload button to upload and validate the file. Wait for the file to upload and validate. The Firmware Verification page appears. 6. In the Firmware Verification page, enable any of the following options: ¦ Preserve Configuration. Enable this option if you want to save your existing configuration in Oracle ILOM and restore that existing configuration after the update process is complete. ¦ Delay BIOS upgrade until next server power-off. Enable this option if you want to postpone the BIOS upgrade until the next time the system reboots. Note – The “Delay BIOS upgrade” option appears only for firmware updates to Oracle ILOM 3.0 or later on x86 systems. Note – The BIOS default settings cannot be preserved when you update the SP firmware. After updating the SP firmware, the default settings are automatically loaded for the new BIOS image. 7. Click Start Upgrade to start the upgrade process, or click Exit to cancel the process. When you click Start Upgrade the upload process starts and a prompt to continue the process appears. 8. At the prompt, click OK to continue. The Update Status page appears providing details about the update progress. When the update indicates 100%, the firmware upload is complete. When the upload is complete, the system automatically reboots. Note – The Oracle ILOM web interface might not refresh properly after the update is complete. If the Oracle ILOM web page is missing information or displays an error message, you might be viewing a cached version of the page from the version previous to the update. Clear your browser cache and refresh your browser before continuing.Updating Firmware 11 9. Reconnect to the Oracle ILOM SP (or CMM) web interface. Click System Information --> Version to verify that the firmware version on the SP or CMM corresponds to the firmware image you installed. ? Recover From a Network Failure During Firmware Update If you were performing the firmware update process through the Oracle ILOM web interface using a local file and a network failure occurs, Oracle ILOM automatically times out and reboots the system. To recover from a network failure during firmware update, follow these steps: 1. Address and fix the network problem. 2. Reconnect to the Oracle ILOM SP. 3. Restart the firmware update process.12 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Updating Firmware Using Oracle ILOM (CLI) Before You Begin - Firmware Image (CLI) Before you perform the procedures in this section, the following requirements must be met: ¦ Identify the version of Oracle ILOM that is currently running on your system. For details, see “Identify Oracle ILOM Firmware Version (CLI)” on page 13. ¦ Download the firmware image for your server or CMM from the Oracle download web site and place the image on your TFTP, FTP, or HTTP server. For download instructions, see “Product Downloads” on page x. ¦ If required by your platform, shut down your host operating system before updating the firmware on your server SP. ¦ Obtain an Oracle ILOM user name and password that has Admin (a) role account privileges. You must have Admin (a) privileges to update the firmware on the system. ¦ The firmware update process takes several minutes to complete. During this time, do not perform other Oracle ILOM tasks. When the firmware update is complete, the system will reboot. Description Links Platform Feature Support Review the prerequisites • “Before You Begin - Firmware Image (CLI)” on page 12 • x86 system server SP • SPARC system server SP Identify the current • CMM Oracle ILOM firmware version • “Identify Oracle ILOM Firmware Version (CLI)” on page 13 Update the firmware image • “Update the Firmware Image (CLI)” on page 13 Troubleshoot network problem during firmware update • “Recover From a Network Failure During Firmware Update (CLI)” on page 15Updating Firmware 13 Note – As of Oracle ILOM 3.0.10, a new feature is available to manage firmware updates for Oracle Sun Modular System chassis components. For information and procedures for updating Oracle ILOM firmware on CMM chassis components, refer to the Oracle Integrated Lights Out Manager (ILOM) CMM Administration Guide for Sun Blade 6000 and Sun Blade 6048 Modular Systems. ? Identify Oracle ILOM Firmware Version (CLI) To identify the Oracle ILOM firmware version, follow these steps: 1. Log in to the Oracle ILOM CLI SP or CMM. 2. At the command prompt, type version. The following information appears: ? Update the Firmware Image (CLI) Before You Begin ¦ Met the requirements listed in “Before You Begin - Firmware Image (CLI)” on page 12. ¦ If required by your platform, shut down your host operating system before updating the firmware on your server SP. To gracefully shut down your host operating system from the Oracle ILOM web interface, click the Graceful Shutdown and Power off options in the Remote Control --> Remote Power Control tab. From the Oracle ILOM CLI, issue the stop /SYS command. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Verify that you have network connectivity to update the firmware. For example: ¦ To verify network connectivity on a server SP, type: -> show /SP/network ¦ To verify network connectivity on a CMM, type: -> show /CMM/network SP firmware 3.0.0.1 SP firmware build number: ##### SP firmware date: Fri Nov 28 14:03:21 EDT 2008 SP filesystem version: 0.1.2214 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 3. To load the Oracle ILOM firmware image, type the following command: -> load -source ://// A note about the firmware update process followed by message prompts to load the image are displayed. The text of the note depends on your server platform. 4. At the prompt for loading the specified file, type y for yes or n for no. The prompt to preserve the configuration appears. For example: Do you want to preserve the configuration (y/n)? 5. At the preserve configuration prompt, type y for yes or n for no. Type y to save your existing Oracle ILOM configuration and to restore that configuration when the update process completes. Note – Typing n at this prompt will advance you to another platform-specific prompt. 6. Perform one of the following actions: ¦ If you have a 2.x firmware release installed on your system, the system loads the specified firmware file, then automatically reboots to complete the firmware update. Proceed to Step 7. ¦ If you have a 3.x firmware release installed on a SPARC system, the system loads the specified firmware file then automatically reboots to complete the firmware update. Proceed to Step 7. ¦ If you have a 3.x firmware release installed on an x86 system, a prompt to postpone the BIOS update appears. For example: Do you want to force the server off if BIOS needs to be upgraded (y/n)? At the prompt to postpone the BIOS update, type y for yes or n for no. The system loads the specified firmware file then automatically reboots to complete the firmware update. Note – The BIOS prompt appears only on x86 systems currently running Oracle ILOM 3.x firmware release. If you answer yes (y) to the prompt, the system postpones the BIOS update until the next time the system reboots. If you answer no (n) to the prompt, the system automatically updates the BIOS, if necessary, when updating the firmware.Updating Firmware 15 Note – The BIOS default settings cannot be preserved when you are updating the SP firmware. After you update the SP firmware, the default settings are automatically loaded for the new BIOS image. 7. Reconnect to the Oracle ILOM server SP or CMM using an SSH connection and using the same user name and password that you provided in Step 1 of this procedure. Note – If you did not preserve the Oracle ILOM configuration before the firmware update, you will need to perform the initial Oracle ILOM setup procedures to reconnect to Oracle ILOM. 8. Verify that the proper firmware version was installed. At the CLI prompt, type: -> version The firmware version on the server SP or CMM should correspond with the firmware version you installed. ? Recover From a Network Failure During Firmware Update (CLI) Note – If you were performing the firmware update process and a network failure occurs, Oracle ILOM automatically times out and reboots the system. 1. Address and fix the network problem. 2. Reconnect to the Oracle ILOM SP. 3. Restart the firmware update process.16 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 201117 Resetting the Service Processor Using Oracle ILOM Related Information ¦ “Updating Firmware Using Oracle ILOM (Web)” on page 8 ¦ “Updating Firmware Using Oracle ILOM (CLI)” on page 12 ¦ Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Description Links Platform Feature Support Use the Oracle ILOM web interface to reset the SP • “Reset the SP Using the Oracle ILOM Web Interface” on page 18 • x86 system server SP • SPARC system server SP • CMM Use the Oracle ILOM command-line interface to reset the SP • “Reset the SP Using the Oracle ILOM CLI” on page 18 Use SNMP to reset the SP • ‘Manage ILOM Backup and Restore Configurations (SNMP)” in Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Guide18 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 ? Reset the SP Using the Oracle ILOM Web Interface Before You Begin ¦ If you need to reset your Oracle ILOM service processor (SP), you can do so without affecting the host OS. However, resetting an SP disconnects your current Oracle ILOM session and renders the SP unmanageable during reset. ¦ To reset the SP, you need the Reset and Host Control (r) role enabled. To reset the power on the Oracle ILOM SP, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click Maintenance --> Reset SP. The Reset Service Processor page appears. 3. Click the Reset SP button. Oracle ILOM reboots. The web interface is unavailable while Oracle ILOM reboots. ? Reset the SP Using the Oracle ILOM CLI Before You Begin ¦ Resetting the Oracle ILOM service processor (SP) does not affect the host OS. However, resetting the SP disconnects your current Oracle ILOM session and renders the SP unmanageable during the reset. ¦ To reset the SP, you need the Reset and Host Control (r) role enabled. ¦ After updating the Oracle ILOM/BIOS firmware, you must reset the Oracle ILOM SP or CMM. To reset the power on the Oracle ILOM SP, follow these steps: 1. Log in to the Oracle ILOM CLI server SP or CMM.Resetting the Service Processor Using Oracle ILOM 19 2. Use the reset command to boot the power on the server SP or CMM. For example: -> reset /SP or -> reset /CMM The SP or CMM resets and reboots.20 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 201119 Backing Up, Restoring, or Resetting Oracle ILOM Configurations Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures ¦ Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Description Links Back up the Oracle ILOM configuration • “Backing Up Configurations” on page 20 Optionally edit the backup XML file • “Optionally Edit the Backup XML File” on page 24 Restore the Oracle ILOM configuration • “Restoring Configurations” on page 28 Reset Oracle ILOM configuration to default settings • “Resetting Oracle ILOM Configuration Settings to the Defaults” on page 32 Use SNMP to get and set Oracle ILOM configuration backup, restore and reset management information • “Manage ILOM Backup and Restore Configurations (SNMP)” in Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Guide20 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Backing Up Configurations Related Information ¦ “Restoring Configurations” on page 28 ¦ “Optionally Edit the Backup XML File” on page 24 ¦ “Resetting Oracle ILOM Configuration Settings to the Defaults” on page 32 ? Back Up the Oracle ILOM Configuration (Web) Before You Begin ¦ To back up the Oracle ILOM configuration, you need the Admin (a), User Management (u), Console (c), Reset and Host Control (r), and Read Only (o) roles enabled. ¦ If you use a user account that does not have the roles listed here, the configuration backup file created might not include all of the Oracle ILOM SP configuration data. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Maintenance --> Backup/Restore. The Configuration Backup/Restore page appears. Description Links Platform Feature Support Use the Oracle ILOM web inteface to back up Oracle ILOM’s configuration parameters • “Back Up the Oracle ILOM Configuration (Web)” on page 20 • x86 system server SP • SPARC system server SP • CMM Use the Oracle ILOM command-line interface to back up Oracle ILOM’s configuration parameters • “Back Up the Oracle ILOM Configuration (CLI)” on page 23Backing Up, Restoring, or Resetting Oracle ILOM Configurations 21 3. From the Operation drop-down list, select Backup. 4. From the Transfer Method drop-down list, select a transfer method. The following transfer methods are available: ¦ Browser ¦ TFTP ¦ FTP ¦ SFTP ¦ SCP ¦ HTTP ¦ HTTPS 5. If you select the Browser transfer method, the backup file is saved according to your browser settings. 6. If you select the TFTP transfer method, the prompts shown in the following figure appear, and you must provide the following information: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to which to save the configuration backup file in the format: directoryPath/filename.22 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 7. If you select the SCP, FTP, SFTP, HTTP, or HTTPS transfer method, the prompts shown in the following figure appear, and you must provide the following information: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to which to save the configuration backup file in the format: directoryPath/filename. ¦ Username – Enter the user name of your account on the remote system. ¦ Password – Enter the password for your account on the remote system. 8. If you want sensitive data, such as passwords, SSH keys, certificates, and so forth, to be backed up, you must provide a passphrase. Type a passphrase in the Passphrase field and confirm the passphrase in the Confirm Passphrase field. If you do not type a passphrase, sensitive data will not be backed up. 9. To initiate the backup operation, click Run. The Backup operation is executed. Note – While the Backup operation is executing, sessions on the Oracle ILOM SP will be momentarily suspended. The sessions will resume normal operation once the Backup operation is complete. A Backup operation typically takes two to three minutes to complete.Backing Up, Restoring, or Resetting Oracle ILOM Configurations 23 ? Back Up the Oracle ILOM Configuration (CLI) Before You Begin ¦ Log in to the Oracle ILOM CLI as a user assigned the Admin, User Management, Console, Reset and Host Control, and Read Only (a,u,c,r,o) roles. These roles are required for you to perform a complete backup of the Oracle ILOM SP configuration. ¦ If you use a user account that does not have the roles listed here, the configuration backup file that is created might not include all of the Oracle ILOM SP configuration data. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Change to the /SP/config directory. Type: -> cd /SP/config 3. If you want sensitive data, such as user passwords, SSH keys, certificates, and so forth, to be backed up, you must provide a passphrase. Type: -> set passphrase=passphrase 4. To initiate the Backup operation, type the following command from within the /SP/config directory: -> set dump_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the configuration backup file. For example: -> set dump_uri= scp://adminuser:userpswd@1.2.3.4/Backup/Lab9/SP123.config The Backup operation executes, and you will be prompted when the operation is complete. A Backup operation typically takes two to three minutes to complete.24 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Note – While the Backup operation is executing, sessions on the Oracle ILOM SP will be momentarily suspended. The sessions will resume normal operation once the Backup operation is complete. ? Optionally Edit the Backup XML File Before You Begin ¦ You can restore an Oracle ILOM configuration backup to another system to duplicate configurations. Before you use an XML backup file on another system, you should edit the file to remove any information that is unique to a particular system, for example, the IP address.Backing Up, Restoring, or Resetting Oracle ILOM Configurations 25 The following is an example of a backed-up XML file. The content of the file is abbreviated for this procedure. /SP/check_physical_presence false /SP/hostname labysystem12 /SP/system_identifier SUN BLADE X8400 SERVER MODULE, ILOM v3.0.0.0, r32722 . . . /SP/clock/datetime Mon May 12 15:31:09 2010 . . . /SP/config/passphrase 89541176be7c . . . /SP/network/pendingipaddress 1.2.3.4 . . .26 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 1. Consider the following in the example XML file: ¦ The configuration settings, with exception of the password and the passphrase, are in clear text (unencrypted). ¦ The check_physical_presence property, which is the first configuration entry in the file, is set to false. The default setting is true so this setting represents a change to the default Oracle ILOM configuration. ¦ The configuration settings for pendingipaddress and commitpending are examples of settings that should be deleted before you use the backup XML file for a Restore operation because these settings are unique to each server. ¦ The user account john is configured with the a, u, c, r, o roles. The default Oracle ILOM configuration does not have any configured user accounts so this account represents a change to the default Oracle ILOM configuration. ¦ The SNMP sets property is set to enabled. The default setting is disabled. 2. To modify the configuration settings that are in clear text, change the values or add new configuration settings. For example: /SP/network/commitpending true . . . /SP/services/snmp/sets enabled . . . /SP/users/john/role aucro /SP/users/john/password c21f5a3df51db69fdf Backing Up, Restoring, or Resetting Oracle ILOM Configurations 27 ¦ To change the roles assigned to the user john, change the text as follows: ¦ To add a new user account and assign that account the a, u, c, r, o roles, add the following text directly below the entry for user john: ¦ To change a password, delete the encrypted=”true” setting and the encrypted password string and type in the new password. For example, to change the password for the user john, modify the XML as follows: Change: To: 3. After you have made the changes to the backup XML file, save the file so that you can use it for a Restore operation on the same system or a different system. Related Tasks ¦ “Backing Up Configurations” on page 20 ¦ “Restoring Configurations” on page 28 ¦ “Resetting Oracle ILOM Configuration Settings to the Defaults” on page 32 /SP/users/john/role auo /SP/users/bill/role aucro /SP/users/john/password c21f5a3df51db69fdf /SP/users/john/password newpassword 28 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Restoring Configurations Related Information ¦ “Backing Up Configurations” on page 20 ¦ “Optionally Edit the Backup XML File” on page 24 ¦ “Resetting Oracle ILOM Configuration Settings to the Defaults” on page 32 ? Restore the Oracle ILOM Configuration (Web) Before You Begin ¦ To restore the Oracle ILOM configuration you need the Admin (a), User Management (u), Console (c), Reset and Host Control (r), and Read Only (o) roles enabled. ¦ If you use a user account that does not have the roles listed here, some of the information in the configuration file might not be restored. When executing a Restore operation, use a user account that has the same or more privileges than the user account that was used to create the backup file; otherwise, some of the backed-up configuration data might not be restored. All configuration properties that are not restored appear in the event log. Therefore, you can verify whether all the configuration properties were restored by checking the event log. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Maintenance --> Backup/Restore. The Configuration Backup/Restore page appears. 3. From the Operation drop-down list, select Restore. The Configuration Backup/Restore page used for Restore operations appears. Description Links Platform Feature Support Use the Oracle ILOM web interface to restore Oracle ILOM configuration settings • “Restore the Oracle ILOM Configuration (Web)” on page 28 • x86 system server SP • SPARC system server SP • CMM Use the Oracle ILOM command-line interface to restore Oracle ILOM configuration settings • “Restore the Oracle ILOM Configuration (CLI)” on page 30Backing Up, Restoring, or Resetting Oracle ILOM Configurations 29 4. From the Transfer Method drop-down list, select the transfer method. The following transfer methods are available: ¦ Browser ¦ TFTP ¦ FTP ¦ SFTP ¦ SCP ¦ HTTP ¦ HTTPS 5. If you select the Browser transfer method, type the directory path and file name for the configuration backup file, or click the Browse button to determine the backup file location. 6. If you select the TFTP transfer method, the prompts shown in the following figure appear, and you must provide the following information: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to the configuration backup file in the format: directoryPath/filename. 7. If you select the SCP, FTP, SFTP, HTTP, or HTTPS transfer method, the prompts shown in the following figure appear, and you must provide the following information: ¦ Host – Enter the remote host IP address or, if you have DNS configured, the name of the remote host. ¦ Filepath – Enter the path to the configuration backup file in the format: directoryPath/filename. ¦ Username – Enter the user name of your account on the remote system. ¦ Password – Enter the password for your account on the remote system.30 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 8. If a passphrase was provided when the backup file was created, type the passphrase in the Passphrase field and confirm it in the Confirm Passphrase field. The passphrase must be the same passphrase that was used when the backup file was created. 9. To initiate the Restore operation, click Run. The Restore operation executes. Note – While the Restore operation is executing, sessions on the Oracle ILOM SP will be momentarily suspended. The sessions will resume normal operation once the Restore operation is complete. A Restore operation typically takes two to three minutes to complete. ? Restore the Oracle ILOM Configuration (CLI) Before You Begin ¦ Log in to the Oracle ILOM CLI as a user assigned the Admin, User Management, Console, Reset and Host Control, and Read Only (a,u,c,r,o) roles. These roles are required to perform a complete restore of the Oracle ILOM SP configuration. ¦ When executing a Restore operation, use a user account that has the same or more privileges than the user account that was used to create the backup file; otherwise, some of the backed up configuration data might not be restored. All configuration properties that are not restored appear in the event log. Therefore, one way to verify whether all the configuration properties were restored is to check the event log. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Change to the /SP/config directory. Type: -> cd /SP/configBacking Up, Restoring, or Resetting Oracle ILOM Configurations 31 3. If a passphrase was specified when the backup file was created, you must specify the same passphrase to perform the Restore operation. Type: -> set passphrase=passphrase The passphrase must be the same passphrase that was used when the backup file was created. 4. To initiate the Restore operation, type the following: -> set load_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the backup file. For example: -> set load_uri= scp://adminuser:userpswd@1.2.3.4/Backup/Lab9/SP123.config The Restore operation executes. The XML file is parsed. A Restore operation typically takes two to three minutes to complete. Note – While the Restore operation is executing, sessions on the Oracle ILOM SP will be momentarily suspended. The sessions will resume normal operation once the Restore operation is complete.32 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Resetting Oracle ILOM Configuration Settings to the Defaults Related Information ¦ “Backing Up Configurations” on page 20 ¦ “Optionally Edit the Backup XML File” on page 24 ¦ “Restoring Configurations” on page 28 ? Reset the Oracle ILOM Configuration to Defaults (Web) Before You Begin ¦ To reset the Oracle ILOM configuration to defaults, you need the Admin (a) role enabled. 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Maintenance --> Configuration Management. The Configuration Management page appears. Description Links Platform Feature Support Use the Oracle ILOM web interface to reset Oracle ILOM configuration properties to default settings • “Reset the Oracle ILOM Configuration to Defaults (Web)” on page 32 • x86 system server SP • SPARC system server SP • CMM Use the Oracle ILOM command-line interface to reset the Oracle ILOM configuration to the default settings • “Reset the Oracle ILOM Configuration to Defaults (CLI)” on page 33Backing Up, Restoring, or Resetting Oracle ILOM Configurations 33 3. In the Reset Defaults drop-down list, click Reset Defaults, and then select one of the following options: ¦ All - If you want to reset all of the Oracle ILOM configuration data to the default settings with the exception of the log files, select All and click Reset Defaults. The next time the Oracle ILOM SP reboots, the configuration will be restored to the default settings. ¦ Factory - If you want to reset all of the Oracle ILOM configuration data to the default settings and also erase the log files, select Factory and click Reset Defaults. The next time the Oracle ILOM SP reboots, the configuration will be restored to the default settings and the log files will be erased. ¦ None - If you want to cancel the reset to defaults operation just previously issues, select None and click Reset Defaults. The previously issued reset to defaults operation is canceled provided the None option is executed before the Oracle ILOM SP reboots. ? Reset the Oracle ILOM Configuration to Defaults (CLI) Before You Begin ¦ To reset the Oracle ILOM configuration to the default settings, you need the Admin (a) role enabled. 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Change to the /SP directory, type: -> cd /SP 3. Type one of the following commands, depending on the option you select to reset the default settings. ¦ If you want to reset the Oracle ILOM configuration using the all option, type: -> set reset_to_defaults=all On the next reboot of the Oracle ILOM SP, the Oracle ILOM configuration default settings will be restored.34 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 ¦ If you want to reset the Oracle ILOM configuration using the factory option, type: -> set reset_to_defaults=factory On the next reboot of the Oracle ILOM SP, the Oracle ILOM configuration default settings will be restored and the log files will be erased. ¦ If you want to cancel a reset operation just previously specified, type: -> set reset_to_defaults=none The previously issued reset_to_defaults command is canceled provided the reset_to_defaults=none command is issued before the Oracle ILOM SP reboots.35 Diagnostic Tools Overview Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Description Links Learn how to access diagnostic tools in Oracle ILOM. • “Server SP Diagnostic Tools” on page 36 Learn about available hardware diagnostic tools for x86 and SPARC servers that can be launched from Oracle ILOM • “PC-Check (x86 Systems)” on page 36 • “Generate NMI (x86 Systems)” on page 37 • “SPARC System Diagnostic Configuration Settings” on page 38 Learn about Oracle service-designated snapshot and fault management diagnostic tools available in Oracle ILOM • “Collect SP Data to Diagnose System Problems” on page 39 • “Fault Management Using the Restricted Shell” on page 4036 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Server SP Diagnostic Tools All diagnostics have the same goals: stimulate some component or components, observe the behavior of the components under test, and determine whether the behavior is expected. If the behavior is not expected, diagnostic tools can help to identify the likely cause of the error and send a clear message or notification to the user. Diagnostic configuration options in Oracle ILOM are accessible from the Remote Control --> Diagnostics tab in the Oracle ILOM web interface or by using the CLI. Refer to the following sections and your platform Oracle ILOM supplement guide or platform administration guide for information about all supported diagnostics. ¦ “PC-Check (x86 Systems)” on page 36 ¦ “Generate NMI (x86 Systems)” on page 37 ¦ “SPARC System Diagnostic Configuration Settings” on page 38 PC-Check (x86 Systems) Pc-Check is a DOS-based utility that is integrated into your system service processor (SP) firmware. This utility can be accessed from Oracle ILOM, or the utility can be accessed and executed from your server Tools and Drivers DVD. Pc-Check tests all motherboard components (CPU, memory, and I/O), ports, and slots. When enabled, this utility runs at host power-on. The Pc-Check utility is disabled by default in Oracle ILOM. Pc-Check has four operating modes that you can run either through the Oracle ILOM web interface or through the Oracle ILOM CLI. These modes are as follows: ¦ Enabled – If you want to run Pc-Check diagnostic tests upon start-up of the host, select this mode. It is recommended that you run this mode prior to a mission-critical application to ensure the quality of the system. This mode runs a predefined test suite without user intervention and, upon completion, will continue to boot the next device based on the BIOS Boot Priority List. Use this mode as a quick test for first-time field installation. These basic diagnostic tests typically take five minutes to complete. ¦ Extended – If you want to run extended Pc-Check diagnostic tests upon start-up of the host, select this mode. You should run this mode for first-time installation of the system. This mode runs a comprehensive test suite to ensure that the system was transported without physical damage. This mode should also be run any time you physically change the system configuration to ensure that newly addedDiagnostic Tools Overview 37 components are installed correctly prior to running production operating systems and applications. These extended diagnostic tests typically take 20 to 40 minutes to complete. ¦ Manual – If you want to run select Pc-Check diagnostic tests upon start-up of the host, select this mode. You can use this mode to select individual tests from the Pc-Check menus, or to select predefined test suites available through the Immediate Burn-in test menu. ¦ Disabled – If you do not want to run Pc-Check diagnostic tests upon start-up of the host, select this mode. This is the default mode when your system arrives. You should set up Pc-Check to Disabled mode when you have concluded running the diagnostic tests. For more information about specific test suites and in-depth instructions for running the Pc-Check diagnostics utility, refer to the Oracle x86 Servers Diagnostics Guide. Related Information ¦ “x86 Server SP Diagnostic Tools” on page 41 ¦ Oracle x86 Servers Diagnostics Guide ¦ Service and administration documentation for your server Generate NMI (x86 Systems) You can send a non-maskable interrupt (NMI) to the host operating system using either the CLI or the web interface. Note that sending an NMI to the host could cause the host to stop responding and wait for input from an external debugger. Therefore, you should use this feature only if prompted to do so by Oracle Services personnel. Related Information ¦ “x86 Server SP Diagnostic Tools” on page 41 ¦ Oracle x86 Servers Diagnostics Guide ¦ Service and administration documentation for your server SPARC System Diagnostic Configuration Settings On an Oracle SPARC system using Oracle ILOM, you can enable the diagnostic mode, specify triggers and the level of diagnostics, as well as the verbosity of the diagnostic output. For more information about SPARC platform diagnostics, see your platform- specific service manual.38 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Oracle ILOM web interface examples of x86 server and SPARC server Diagnostics pages are displayed in the following figures. FIGURE: Diagnostic Page for x86 Systems FIGURE: Diagnostics Page for SPARC Servers Related Information ¦ “SPARC Server SP Diagnostic Tools” on page 47 ¦ Service and administration documentation for your serverDiagnostic Tools Overview 39 Oracle Service-Designated Diagnostic Tools The topics in this section describe tools used by Oracle Services for troubleshooting system issues. ¦ “Collect SP Data to Diagnose System Problems” on page 39 ¦ “Fault Management Using the Restricted Shell” on page 40 Collect SP Data to Diagnose System Problems The Oracle ILOM Service Snapshot utility enables you to produce a snapshot of the server processor at any instant in time. You can run the utility from the Oracle ILOM CLI or the web interface. Caution – The purpose of the Oracle ILOM Service Snapshot utility is to collect data for use by Oracle Services personnel to diagnose system problems. Customers should not run this utility unless requested to do so by Oracle Services personnel. The Oracle ILOM Service Snapshot utility gathers SP state data. The utility collects log files, runs various commands and collects their output, and sends the data collection as a downloaded file to a user-defined location. As of Oracle ILOM 3.0.3, a FRUID data set option is available from the Snapshot utility. Specifically, this option enables Services personnel to analyze data in a binary format about field-replaceable hardware installed on a server. This FRUID option is not for customer use, unless an authorized Services representative instructs a customer to use the option. Related Information ¦ “Collecting SP Data to Diagnose System Problems” on page 54 ¦ Service and administration documentation for your server40 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Fault Management Using the Restricted Shell The Oracle ILOM Fault Management shell can be used by administrators and Oracle Services personnel to view and modify system fault management configuration parameters maintained by Oracle ILOM. Oracle ILOM receives information relating to problems detected by the system software, diagnoses those problems, and initiates proactive self-healing activities such as disabling faulty components. Most of these fault management activities are automated. If additional intervention is required by an administrator or Oracle Services personnel, Oracle ILOM produces a message indicating what's required. During a manual diagnostic process, utilities provided in the Fault Management shell can be used to gather more information or perform additional tasks. The Fault Management shell is a captive shell. It must be run as a separate shell from the Oracle ILOM CLI. Only Fault management commands are allowed in this shell. Note – Other platform specific fault management commands might be available for use, to determine if other platform fault management commands exist for your server, refer to the ILOM supplement, administration guide, or service manual for the server. Related Information ¦ “Using the Oracle ILOM Fault Management Shell” on page 58 ¦ Service and administration documentation for your server41 x86 Server SP Diagnostic Tools Related Information ¦ Oracle x86 Servers Diagnostics Guide ¦ Service and administration documentation for your server Description Links Learn how to diagnose x86 server hardware issues with Pc-Check and to generate a server non-maskable interrupt using Oracle ILOM • “Diagnosing x86 Systems Hardware Issues (Web)” on page 42 • “Diagnosing x86 Systems Hardware Issues (CLI)” on page 4442 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Diagnosing x86 Systems Hardware Issues (Web) Note – For additional information about common x86 diagnostic tools, refer to the Oracle x86 Servers Diagnostic Guide. ? Configure Pc-Check Diagnostics for x86 Systems Before You Begin ¦ To diagnose x86 systems hardware issues, you need the Reset and Host Control (r) role enabled. ¦ After you configure the Pc-Check diagnostics, you must reset the host to run diagnostic tests. To configure Pc-Check diagnostics, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control --> Diagnostics. The Diagnostics page appears. 3. From the Run Diagnostics on Boot drop-down list, select one of the following options: ¦ Disabled – If you do not want to run Pc-Check diagnostic tests upon startup of a remote host server, select Disabled. ¦ Enabled – If you want to run basic Pc-Check diagnostic tests upon start-up of the remote host server, select Enabled. These basic diagnostic tests typically take 5 minutes to complete. Description Links Platform Feature Support Use Oracle ILOM to launch x86 Pc-Check diagnostic software • “Configure Pc-Check Diagnostics for x86 Systems” on page 42 • x86 system server SP Use Oracle ILOM to generate a non-maskable interrupt on an x86 server • “Generate an NMI” on page 43x86 Server SP Diagnostic Tools 43 ¦ Extended – If you want to run extended Pc-Check diagnostic tests upon start-up of the remote host server, select Extended. These extended diagnostic tests typically take 20 to 40 minutes to complete. ¦ Manual – If you want to run select Pc-Check diagnostic tests upon start-up of the remote host server, select Manual. 4. Click Save for your settings to take effect. If you selected the Manual option, the graphical interface for Pc-Check diagnostics appears after the host is reset. From this interface, you can select which Pc-Check diagnostic tests to run. ? Generate an NMI Caution – Depending on the host operating system configuration, generating a non-maskable interrupt (NMI) might cause the operating system to crash, stop responding, or wait for external debugger input. To generate a NMI, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control --> Diagnostics. The Diagnostics page appears. 3. Click the Generate NMI button. A non-maskable interrupt (NMI) is generated to the host operating system.44 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Diagnosing x86 Systems Hardware Issues (CLI) ? Configure and Run Pc-Check Diagnostics (CLI) Before You Begin ¦ To diagnose x86 systems hardware issues, you need the Reset and Host Control (r) role enabled. ¦ After you configure the Pc-Check diagnostics, you must reset the host to run diagnostic tests. To configure Pc-Check diagnostics, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. 2. Type the following commands to enable the diagnostic tests: Description Links Platform Feature Support Configure and run Pc-Check diagnostic test • “Configure and Run Pc-Check Diagnostics (CLI)” on page 44 • x86 system server SP Generate an NMI to a host • “Generate a Non-Maskable Interrupt (CLI)” on page 45 Run other x86 system hardware diagnostic tests and tools • Oracle x86 Servers Diagnostics Guide -> cd /HOST/diag/ /HOST/diag -> show /HOST/diag Targets: Properties: state = disabled Commands: cd set showx86 Server SP Diagnostic Tools 45 3. Reset the power on the host to run the PC diagnostic tests. ? Generate a Non-Maskable Interrupt (CLI) Caution – Depending on the host OS configuration, generating a non-maskable interrupt (NMI) might cause the OS to crash, stop responding, or wait for external debugger input. 1. Log in to the Oracle ILOM CLI server SP. 2. Type the following commands: -> set state=extended This will enable Pc-Check to run a 20-40 minute test suite OR -> set state=enabled This will enable Pc-Check to run a 4-5 minute test suite OR -> set state=manual This will enable you to select specific Pc-Check tests to run -> show Targets: Properties: state = enabled Commands: cd set show -> cd /HOST /HOST -> show /HOST Targets: diag Properties: generate_host_nmi = (Cannot show property) Commands: cd set show46 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 -> set generate_host_nmi=true set ‘generate_host_nmi’ to ‘true’47 SPARC Server SP Diagnostic Tools Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures ¦ Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Description Links Learn how to diagnose SPARC server hardware issues using Oracle ILOM • “Diagnosing SPARC Systems Hardware Issues (Web)” on page 48 • “Diagnosing SPARC Systems Hardware Issues (CLI)” on page 49 Use SNMP to get and set SPARC host diagnostic properties • “Managing SPARC Diagnostic, POST, and Boot Mode Properties (SNMP)” in Oracle ILOM 3.0 Protocol Management – SNMP, IPMI, CIM, WS-Man Guide48 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Diagnosing SPARC Systems Hardware Issues (Web) ? Configure Diagnostics Settings for SPARC Systems Before You Begin ¦ To configure and run diagnostic tests on a SPARC processor-based system, you need the Reset and Host control (r) role enabled. To configure diagnostic settings for SPARC systems, follow these steps: 1. Log in to the Oracle ILOM SP web interface. 2. Click Remote Control > Diagnostics. The Diagnostics page appears. 3. Select a value for Trigger: ¦ Power On – Diagnostics will be run when power is applied. ¦ User Reset – Diagnostics will be run upon a user-invoked reset. ¦ Error Reset – Diagnostics will be run upon any error-invoked reset. 4. Select a value for Verbosity for each trigger type: ¦ None – Diagnostics do not print any output on the system console when running, unless a fault is detected. ¦ Min – Diagnostics print a limited amount of output on the system console (the default value). ¦ Normal – Diagnostics print a moderate amount of output on the system console, including the name and results of each test being run. ¦ Debug – Diagnostics print extensive debugging output on the system console, including devices being tested and debug output of each test. 5. Select a value for Level for each trigger type: Description Link Feature Platform Support Diagnose SPARC system hardware issue • “Configure Diagnostics Settings for SPARC Systems” on page 48 • SPARC system server SPSPARC Server SP Diagnostic Tools 49 ¦ Min – Run the minimum level of diagnostics to verify the system. ¦ Max – Run the maximum set of diagnostics to fully verify system health (the default value). 6. Select a value for Mode: ¦ Off – Do not run any diagnostics. ¦ Normal – Run diagnostics (the default value). 7. Click Save for your settings to take effect. Diagnosing SPARC Systems Hardware Issues (CLI) ? Configure Diagnostics Mode (CLI) Before You Begin ¦ To configure and run diagnostic tests on a SPARC processor-based system, you need the Reset and Host control (r) role enabled. ¦ Use the /HOST/diag host mode property to control whether diagnostics are enabled and to specify which diagnostic mode is enabled. To configure the diagnostic mode, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. Description Links Platform Feature Support Configure the system to run diagnostic tests • “Configure Diagnostics Mode (CLI)” on page 49 • SPARC system server SP Specify which diagnostic triggers to activate • “Specify the Diagnostics Trigger (CLI)” on page 50 Specify the level of diagnostics that you want to execute • “Specify Level of Diagnostics (CLI)” on page 50 Specify the verbosity output of the executed diagnostic tests • “Specify Verbosity of Diagnostics Output (CLI)” on page 5250 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 2. At the command prompt, type the following command: -> set /HOST/diag mode=value where value is one of the following: ¦ off – Do not run any diagnostics. ¦ normal – Run diagnostics (the default value). 3. Reset the power on the host to run the diagnostic tests. ? Specify the Diagnostics Trigger (CLI) Before You Begin ¦ To configure and run diagnostic tests on a SPARC processor-based system, you need the Reset and Host control (r) role enabled. ¦ You can select one or more triggers that will cause a power-on self-test (POST) to be run on the host. To set the trigger levels, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. 2. At the command prompt, type the following command -> set /HOST/diag trigger=value where value can be one of the following: ¦ none – Diagnostics will not be triggered to run. ¦ user-reset – Diagnostics will be run upon a user-invoked reset. ¦ power-on-reset – Diagnostics will be run when power is applied. ¦ error-reset – Diagnostics will be run upon any error-invoked reset. ¦ all-resets – Diagnostics will be run for any of the reset types. ? Specify Level of Diagnostics (CLI) Before You Begin ¦ To configure and run diagnostic tests on a SPARC processor-based system, you need the Reset and Host control (r) role enabled. ¦ Use the /HOST/diag level property to specify the level of diagnostic testing to be executed when diagnostics are enabled.SPARC Server SP Diagnostic Tools 51 There are separate Oracle ILOM CLI properties that enable you to specify the level of diagnostic testing to be executed, depending on how the diagnostics were triggered to run. This gives granular control of how much diagnostic testing is performed in different host reset situations. To specify the level of diagnostics to be executed, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. 2. Perform the one of the following commands, depending on how the host is reset: ¦ To specify the diagnostic level when the host is powered on, type the following command: > set /HOST/diag power_on_level=value ¦ To specify the diagnostic level when the host is reset by the user, type the following command: -> set /HOST/diag user_reset_level=value ¦ To specify the diagnostic level when the host is reset due to a system error, type the following command: -> set /HOST/diag error_reset_level=value where value is one of the following: ¦ min – Run the minimum level of diagnostics to verify the system. ¦ max – Run the maximum set of diagnostics to fully verify system health (the default value). Note – For backward compatibility with Oracle ILOM 2.x, the former property /HOST/diag level is still supported as a shortcut for specifying the same diagnostic level for all trigger types. Any value set to /HOST/diag level will be applied to all three trigger-specific properties: power_on_level, user_reset_level, and error_reset_level. 3. Reset the power on the host to run the diagnostic tests.52 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 ? Specify Verbosity of Diagnostics Output (CLI) Before You Begin ¦ To configure and run diagnostic tests on a SPARC processor-based system, you need the Reset and Host control (r) role enabled. ¦ Use the /HOST/diag level property to specify the level of diagnostic testing to be executed when diagnostics are enabled. There are separate Oracle ILOM CLI properties that enable you to specify the level of diagnostic testing to be executed, depending on how the diagnostics were triggered to run. This gives granular control of how much diagnostic testing is performed in different host reset situations. To specify the verbosity of the diagnostics output, follow these steps: 1. Log in to the Oracle ILOM CLI server SP. 2. Perform one of the following commands, depending on how the host was reset: ¦ To specify the output verbosity for diagnostics executed when the host is powered on, type the following command: -> set /HOST/diag power_on_verbosity=value ¦ To specify the output verbosity for diagnostics executed when the host is reset by the user, type the following command: -> set /HOST/diag user_reset_verbosity=value ¦ To specify the output verbosity for diagnostics executed when the host is reset due to a system error, type the following command: -> set /HOST/diag error_reset_verbosity=value Where value is one of the following: ¦ none – Diagnostics do not print any output on the system console when running, unless a fault is detected. ¦ min – Diagnostics print a limited amount of output on the system console. ¦ normal – Diagnostics print a moderate amount of output on the system console (the default value). ¦ max – Diagnostics print full output on the system console, including the name and results of each test being run. ¦ debug – Diagnostics print extensive debugging output on the system console, including devices being tested and debug output of each test.SPARC Server SP Diagnostic Tools 53 Note – For backward compatibility with Oracle ILOM 2.x, the former property /HOST/diag verbosity is still supported as a shortcut for specifying the same output verbosity for all trigger types. Any value set to /HOST/diag verbosity will be applied to all three trigger-specific verbosity properties: power_on_verbosity, user_reset_verbosity, and error_reset_verbosity. 3. Reset the power on the host to run the diagnostic tests.54 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 201153 Oracle Services-Designated Diagnosic Tools Related Information ¦ Oracle ILOM 3.0 Daily Management – CLI Procedures ¦ Oracle ILOM 3.0 Daily Management – Web Interface Procedures Descriptions Links Platform Feature Support Use the Oracle ILOM snapshot feature to collect SP data to diagnose server issues • “Collecting SP Data to Diagnose System Problems” on page 54 • Oracle Services personnel feature only Use the Oracle ILOM Fault Management Shell to diagnose server issues • “Using the Oracle ILOM Fault Management Shell” on page 5854 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Collecting SP Data to Diagnose System Problems ? Using the Oracle ILOM Snapshot Utility (Web) Before You Begin ¦ To collect SP data using the Service Snapshot utility, you need the Admin(a) role enabled. To override the BIOS boot device setting from Oracle ILOM by using the Host Control features, perform the following steps: Caution – The purpose of the Oracle ILOM Services Snapshot utility is to collect data for use by Oracle Services personnel to diagnose system problems. Customers should not run this utility unless requested to do so by Oracle Services. 1. Log in to the Oracle ILOM SP web interface. 2. Click Maintenance --> Snapshot. The Service Snapshot Utility page appears. Descriptions Links Platform Feature Support Use the Oracle ILOM snapshot feature to collect SP data to diagnose server issues • “Using the Oracle ILOM Snapshot Utility (Web)” on page 54 • “Using the Oracle ILOM Snapshot Utility (CLI)” on page 56 • Oracle Service personnel feature onlyOracle Services-Designated Diagnosic Tools 55 3. Select the data set: Normal, FRUID, Full, or Custom. ¦ Normal – Specifies that Oracle ILOM, operating system, and hardware information is to be collected. ¦ FRUID – Available as of Oracle ILOM 3.0.3, specifies that information about FRUs currently configured on your server in addition to the data collected by the Normal set option is to be collected. ¦ Full – Specifies that all data is to be collected. Selecting Full might reset the system. ¦ Custom – Allows you to choose one or more of the following data sets: ¦ Oracle ILOM data ¦ Hardware data ¦ Basic OS data ¦ Diagnostic data ¦ FRUID data 4. If you want to collect only log files from the data set, click the Enabled check box. 5. If you want to encrypt the output file, click the Enabled check box. 6. Select one of the following methods to transfer the output file: ¦ Browser ¦ SFTP56 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 ¦ FTP 7. Click Run. A Save As dialog box appears. 8. In the dialog box, specify the directory to which to save the file and the file name. 9. Click OK. The file is saved to the specified directory. ? Using the Oracle ILOM Snapshot Utility (CLI) Before You Begin ¦ To collect SP data using the Service Snapshot utility, you need the Admin(a) role enabled. To run the Service Snapshot utility, follow these steps: Caution – The purpose of the Oracle ILOM Service Snapshot utility is to collect data for use by Oracle Services personnel to diagnose system problems. Customers should not run this utility unless requested to do so by Oracle Services. 1. Log in to the Oracle ILOM CLI server SP. 2. Type the following commands:Oracle Services-Designated Diagnosic Tools 57 ->set /SP/diag/snapshot dataset=data ->set /SP/diag/snapshot dump_uri=URI where data and URI are one of the following: Variable Option Description data normal Specifies that Oracle ILOM, operating system, and hardware information is to be collected. FRUID Available as of Oracle ILOM 3.0.3, requests Oracle ILOM to collect information about FRUs currently configured on your server in addition to the data collected by the normal option. full Specifies that all data is to be collected (“full” collection). Note - Using this option might reset the running host. • normal-logonly • fruid-logonly • full-logonly Specifies that only log files are to be collected. URI Any valid target directory location Specifies the URI of the target directory. The URI format is as follows: protocol://username:password@host/directory where protocol can be one of these transfer methods: SFTP or FTP. For example, to store the snapshot information in the directory named data on the host, define the URI as follows: ftp://joe:mypasswd@host_ip_address/data The directory data is relative to the user’s login, so the directory would probably be /home/joe/data.58 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Using the Oracle ILOM Fault Management Shell Fault Management Terms The following fault management terms are defined. Descriptions Links Platform Feature Support Understand the terms used in Oracle ILOM fault management • “Fault Management Terms” on page 58 • Oracle Service personnel feature only Launch, exit, or view the log of Fault Management shell sessions • “Starting, Stopping, and Logging Fault Management Shell Sessions” on page 59 Learn how to use Fault Management shell commands and options • “Fault Management Shell Command Reference” on page 60 Term Description Fault A detected error condition in the hardware or software. A fault can be logged to the ILOM system event log. FMRI Fault Management Resource Identifier. This could be either the FRU name or UUID. FRU Field replaceable unit (such as a drive, memory DIMM, or printed circuit board). Proactive Self-Healing Proactive Self-Healing is an architecture and methodology for automatically diagnosing, reporting, and handling software and hardware fault conditions. This reduces the time required to debug a hardware or software problem and provides the administrator or Oracle support with detailed data about each fault. The architecture consists of an event management protocol, the fault manager, and the fault-handling software. Universal Unique Identifier (UUID) Used to uniquely identify a problem across any set of systems.Oracle Services-Designated Diagnosic Tools 59 ? Starting, Stopping, and Logging Fault Management Shell Sessions The Fault Management shell is launched as a separate shell through the Oracle ILOM CLI. Only fault management commands can be run from this shell. To run standard Oracle ILOM commands, you must first exit the Fault Management shell. Caution – The purpose of the Oracle ILOM Fault Management restricted shell is to help Oracle Services personnel diagnose system problems. Customers should not run commands in the shell unless requested to do so by Oracle Services. 1. To launch the shell, enter the following command when logged in to the command-line interface of the system’s Oracle ILOM service processor: -> start /SP/faultmgmt/shell The Fault Management shell command prompt is displayed: faultmgmtsh> 2. At the fault management shell prompt, enter a command. The Fault Management shell includes the following commands. 3. To exit the shell, enter the following command from the prompt: faultmgmtsh> exit 4. View an audit log of all commands executed during the session. An audit log will is saved to the SP event log at: /SP/logs/event Command Description fmadm Administers the fault management service. fmdump Displays contents of the fault and ereport/error logs. fmstat Displays statistics on fault management operations. echo Displays the exit code of the last command executed. help Displays a list of the fault management commands that you can run after starting the shell. exit Exits the Fault Management shell.60 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Fault Management Shell Command Reference fmadm – Fault Management Administration Tool The fmadm utility can be used by administrators and service personnel to view and modify system fault management configuration parameters maintained by ILOM. Use fmadm to: ¦ View the list of system components that have been diagnosed as faulty. ¦ Perform administrative tasks related to these entities. Note – The fmadm utility requires the user to be logged into ILOM with administrator privileges. Syntax fmadm [subcommand [arguments]] Descriptions Links Administering the fault management service using fmadm • “fmadm – Fault Management Administration Tool” on page 60 Displaying the contents of the fault and ereport/error logs using fmdump • “fmdump – Fault Management Log Viewer” on page 65 Displayings statistics on fault mangement operations using fmstat • “fmstat – Statistical Module Report Generator” on page 67 Displaying the exit code of the last command executed using echo • “echo – Display Exit Code for Last Command” on page 69 Displaying a list of the fault management commands that can run after entering the shell using help • “help – Display Command Online Help” on page 69Oracle Services-Designated Diagnosic Tools 61 Subcommands The fmadm utility accepts the following subcommands. Some of the subcommands accept or require additional options and operands Subcommand Description acquit fru Notify the Fault Manager that the specified fru is not to be considered to be a suspect in the fault event identified by uuid, or if no UUID is specified, then in any fault or faults that have been detected. The fmadm acquit subcommand should be used only at the direction of a documented Oracle repair procedure. Administrators might need to apply additional commands to re-enable a previously faulted resource. Example: fmadm acquit /SYS/hdd1 acquit uuid Notify Oracle ILOM that the fault event identified by uuid can be safely ignored. The fmadm acquit subcommand should be used only at the direction of a documented Oracle repair procedure. Administrators might need to apply additional commands to re-enable any previously faulted resources. Example: fmadm acquit 6d76a0f4-b5f5-623c-af8b-9d7b53812ea 162 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 faulty [-afrs] [-u uuid] Display status information for resources that Oracle ILOM has detected as faulty. The following arguments are supported: • -a Display all faults. (Default.) • -f Display faulty FRUs (Field Replaceable Units). • -r Display faulty FRUs and their fault management state (states are described below). • -s Display one line fault summary for each fault event. • -u uuid Only display faults for a given uuid. Oracle ILOM associates the following management states with every resource for which telemetry information has been received: • ok The resource is present and in use and has no known problems detected by Oracle ILOM. • unknown The resource is not present or not usable but has no known problems. This might indicate the resource has been disabled or deconfigured by an administrator. Consult the appropriate management tools for more information. • faulted The resource is present but is not usable because one or more problems have been diagnosed by Oracle ILOM. The resource has been disabled to prevent further damage to the system. • degraded The resource is present and usable, but one or more problems have been diagnosed in the resource by Oracle ILOM. If all affected resources are in the same state, this is reflected in the message at the end of the list. Otherwise the state is given after each affected resource. Subcommand DescriptionOracle Services-Designated Diagnosic Tools 63 repaired fru | uuid Notify Oracle ILOM that a repair procedure has been carried out on the specified fru or uuid. The fmadm repaired subcommand should be used only at the direction of a documented Oracle repair procedure. Administrators might need to apply additional commands to re-enable a previously faulted resource. An equivalent to this command is fmadm repair fru. replaced fru | uuid Notify Oracle ILOM that the specified fru or uuid resource has been replaced. This command should be used in those cases where Oracle ILOM is unable to automatically detect the replacement. The fmadm replaced subcommand should be used only at the direction of a documented Oracle repair procedure. Administrators might need to apply additional commands to re-enable a previously faulted resource. rotate errlog | fltlog The rotate subcommand causes the specified log file (the error log or fault log file) to be rotated. Up to ten files are maintained in the rotation with the most recent version ending with a .0. Example: fmadm rotate /SP/logs/event/errlog Subcommand Description64 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 Example This example displays the logged faults. faultmgmtsp> fmadm faulty -a ------------------- ------------------------------------ ------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------- ------- 2011-02-02/16:18:29 d3547797-014f-edff-cbb4-e9bef7dc3c9d SPX86-8000-33 Major Fault class : fault.chassis.device.fan.fail FRU : /SYS/FM0 (Part Number: unknown) (Serial Number: unknown) Description : Fan tachometer speed is below its normal operating range. Response : The service-required LED may be illuminated on the affected FRU and chassis. System will be powered down when the High Temperature threshold is reached. Impact : System may be powered down if redundant fan modules are not operational. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.Oracle Services-Designated Diagnosic Tools 65 Exit Status fmdump – Fault Management Log Viewer The fmdump utility can be used to display the contents of any of the log files associated with Oracle ILOM. Oracle ILOM receives telemetry information relating to problems detected by the system software, diagnoses these problems, and initiates proactive self-healing activities such as disabling faulty components. Oracle ILOM maintains two sets of log files for use by administrators and service personnel: By default, fmdump displays the contents of the fault log, which records the result of each diagnosis made by the fault manager or one of its component modules. Here is an example of a default fmdump display: Each problem recorded in the fault log is identified by: ¦ The time of its diagnosis. ¦ A Universal Unique Identifier (UUID) that can be used to uniquely identify a particular problem across any set of systems. ¦ A message identifier that can be used to access a corresponding knowledge article located on Oracle's support web site. If a problem requires action by a human administrator or service technician or affects system behavior, ILOM also issues a human-readable message to its Event Log. This message provides a summary of the problem and a reference to the knowledge article on the Oracle web site. Value Description 0 Successful completion. 1 An error occurred. Errors include a failure to communicate with ILOM or insufficient privileges to perform the requested operation. error log A log which records error telemetry; the symptoms of problems detected by the system. fault log A log which records fault diagnosis information; the problems possibly related to the symptoms. faultmgmtsp> fmdump TIMESTAMP UUID MSGID 2010-02-25/06:05:38 6d76a0f4-b5f5-623c-af8b-9d7b53812ea1 SPX86-8001-TS66 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 You can use the -v and -V options to expand the display from a single-line summary to increased levels of detail for each event recorded in the log. The -u option can be used to filter the output by selecting only those events that match the specified uuid. Syntax fmdump [options [argument]] Options The following options are supported: Option Description -e Display events from the fault management error log instead of the fault log. This option is shorthand for specifying the pathname of the error log file. The error log file contains Private telemetry information used by Oracle's automated diagnosis software. This information is recorded to facilitate post-mortem analysis of problems and event replay, and should not be parsed or relied upon for the development of scripts and other tools. -u uuid Select fault diagnosis events that exactly match the specified argument (uuid). Each diagnosis is associated with a Universal Unique Identifier (UUID) for identification purposes. The -u option can be combined with other options such as -v to show all of the details associated with a particular diagnosis. If the -e option and -u option are both present, the error events that are cross-referenced by the specified diagnosis are displayed. -v Display verbose event detail. The event display is enlarged to show additional common members of the selected events. -V Display very verbose event detail. The event display is enlarged to show every member of the name-value pair list associated with each event. In addition, for fault logs, the event display includes a list of crossreferences to the corresponding errors that were associated with the diagnosis.Oracle Services-Designated Diagnosic Tools 67 Example This example dumps the fault log for the designated FRU UUID. Exit Status fmstat – Statistical Module Report Generator The fmstat utility can be used by administrators and service personnel to report statistics associated with the Oracle ILOM Fault Manager and its associated set of modules. The Fault Manager runs in the background on each Oracle ILOM system. It receives telemetry information relating to problems detected by the system software, diagnoses these problems, and initiates proactive self-healing activities such as disabling faulty components. You can use fmstat to view statistics for diagnosis engines that are currently participating in fault management. faultmgmtsp> fmdump -V -u edddce14-bf6f-eca7-aff8-dd84e9be27dc 2010-10-05/12:02:18 edddce14-bf6f-eca7-aff8-dd84e9be27dc SPX86-8000-33 fault = fault.chassis.device.fan.fail@/sys/fm1 certainty = 100.0 % FRU = /sys/fm1 ASRU = /sys/fm1 chassis_serial_number = 0000000-0000000000 product_serial_number = 1234567890 detector = /SYS/FM1/ERR [skipped fruid update] Value Description 0 Successful completion. All records in the log file were examined successfully. 1 Invalid command-line options were specified.68 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 The fmstat utility reports the following statistics for each of the diagnosis engines: Syntax fmstat engine The name of the diagnosis engine. The engines execute rules for the fault diagnosis daemon based on ereport input. Oracle ILOM Fault Management engines include: • repair - Rule that indicates a fault should be considered repaired if a specified ereport is logged. For example, the fault “fault.chassis.power.inadequate@/sys” would be considered repaired if “ereport.chassis.boot.power-off-requested@/sys” was logged. • hysteresis - Rule to diagnose a fault if ereport A (initiation) is logged and ereport B (cancelation) is not logged within some specified time afterwards. For example, ereport A is "ereport.fan.speed-low-asserted" and ereport B is "ereport.fan.speed-low-deasserted". The time limit between the initiation/cancelation can be no greater than 10 seconds. • SERD - Soft Error Rate Discrimination (SERD) is used in tracking multiple occurences of an ereport. If more than N ereports show up within time period T, the fault is diagnosed. For example, if too many correctable memory error ereports are logged within a specific time frame, a DIMM fault will be diagnosed. • simple - Rule to allow one ereport to result in the diagnosis of multiple faults. For example, an ereport for an uncorrectable memory error can be diatnosed to the faults for two DIMMs in a DIMM pair. status The status of the engine, either uninit, empty, enqueued, busy, or exiting. evts_in The number of events received by the engine as relevant to a diagnosis. evts_out The number of events sent by the engine. errors The number of errors detected by the engine.Oracle Services-Designated Diagnosic Tools 69 Example Exit Status echo – Display Exit Code for Last Command The echo command is used to display the exit code for the last executed Fault Management command. Syntax echo $? help – Display Command Online Help The help command is used to display online help for the specified Fault Management command. Syntax help or command -h | -help or faultmgmtsp> fmstat fdd statistics 2011-02-03/19:12:51 engine status evts_in evts_out errors repair empty 8 0 0 hysteresis empty 0 0 0 SERD empty 0 0 0 simple empty 12 0 0 Value Description 0 Successful completion. 1 An error occurred.70 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 help command Exit Status Value Description 0 Successful completion. 1 An error occurred.71 Index B backing up ILOM con?guration, 20 passphrase, if not used, 22 sensitive data (CLI), 23 sensitive data (web), 22 supported transfer methods (CLI), 23 supported transfer methods (web), 21 time required (CLI), 23 time required (web), 22 use cases, 3 using the CLI, 23 using the web interface, 20 C collecting data for Oracle Services, 39 D defaults, resetting ILOM con?guration to, 32 diagnosing SPARC systems using CLI, 49 SPARC systems using web interface, 48 x86 systems using CLI, 43 x86 systems using web interface, 41 diagnostics Fault Management shell, 40 for SPARC systems, 37 for x86 systems, 36, 37 diagnostics overview, 1, 35 diagnostics, using the snapshot utility, 54 E editing the backup ILOM con?guration xml ?le, 24 F Fault Management shell, 58 commands, 60 starting, stopping, and logging sessions, 59 terms, 58 ?rmware about versions, 1 identifying version, 9, 13 prerequisites for updating, 12 recovery during update, 15 troubleshoot update session, 11, 15 update prerequisites, 13 update using the CLI, 12 updating image, 9, 13 updating using the web interface, 8 veri?cation, 10 I ILOM con?guration backing up, 19, 20 editing XML backup ?le, 4 replicate con?guration, 4 resetting to defaults, 32 restore to good con?guration, 4 restoring, 19, 28 restoring (CLI), 30 restoring (web), 28 M maintenance overview, 1, 35 N non-maskable interrupt (NMI) generating using CLI, 44 generating using web interface, 42 overview, 37 O Oracle Service-designated tools, 39 overview Fault Management shell, 4072 Oracle ILOM 3.0 Maintenance and Diagnostics Guide • May 2011 ?rmware updates, 1, 35 Oracle ILOM con?guration backup, restore and reset, 1, 35 Oracle ILOM service snapshot, 39 service processor reset, 3 x86 and SPARC diagnostic tools, 1, 35 P passphrase backing up ILOM con?guration, 23 restoring ILOM con?guration, 31 Pc-Check diagnostics for x86 systems, 36 con?guring (CLI), 43 con?guring (web interface), 42 preserve Con?guration option when to use, 2 R remote diagnostic con?guration about, 35 SPARC systems, 47 x86 systems, 41 resetting ILOM con?guration to defaults using CLI, 33 using web interface, 32 resetting the SP, 17 using the CLI, 18 using the web interface, 17 restoring ILOM con?guration, 28 checking the event log, 4 effect of user privileges, 4 passphrase requirements (CLI), 31 passphrase requirements (web), 30 sessions momentarily suspended (CLI), 31 sessions momentarily suspended (web), 30 suggested user roles, 28 supported transfer methods (web), 29 time required (CLI), 31 time required (web), 30 use cases, 3 user roles required (CLI), 30 using the CLI, 30 using the web interface, 28 verifying data restored, 4 S sensitive data, backing up with CLI, 23 sensitive data, backing up with web interface, 22 Service Processor (SP) collecting and diagnosing, 54 service processor, resetting, 17 Service Snapshot utility, 39, 54 snapshot utility, using (web), 54, 56 SNMP, using to manage ?rmware, 7 SPARC diagnostics con?guring (CLI), 49 con?guring (web interface), 48 T troubleshooting using the snapshot utility, 54 U updating ILOM ?rmware, 7 preserve con?guration option, 2 to a new release, 1 to a previous release, 2 using CLI, 12 using the web interface, 8 V version information identifying, 2 viewing, 13 X x86 systems diagnostics, 41 con?guring (CLI), 43 con?guring (web interface), 42 Oracle Integreted Lights Out Manager (ILOM) 3.0 SNMP, IPMI, CIM, WS-MAN Protocol Management Reference Part No. E21452-01 May 2011Please Recycle Copyright © 2008, 2009, 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © XXXX, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation xii ? Download Product Software and Firmware xiv SNMP Overview 1 About Simple Network Management Protocol 2 SNMP Components 2 Oracle ILOM SNMP MIBs 3 Configuring SNMP Settings in Oracle ILOM 7 Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (CLI) 8 ? Set SNMP Access and Authorization (CLI) 8 Managing SNMP User Accounts and Communities (CLI) 11 Before You Begin – SNMP User Accounts (CLI) 11 SNMP User Account Targets, Properties, and Values 12 ? View and Configure SNMP Community Properties (CLI) 13 ? Add an SNMP User Account (CLI) 15 ? Edit an SNMP User Account (CLI) 15 ? Delete an SNMP User Account (CLI) 15 ? Set SNMPv3 User Account Privacy Protocol Value (CLI) 15 ? Add or Edit an SNMP Community (CLI) 16 ? Delete an SNMP Community (CLI) 16 Managing SNMP Trap Alerts Using the Oracle ILOM CLI 16v Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Configure SNMP Trap Rule Destinations and Properties (CLI) 17 CLI Commands for Managing Alert Rule Configurations 19 Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (Web) 21 ? Set SNMP Read and Write Access and Authorization (Web) 21 Managing SNMP User Accounts and Communities (Web) 24 Before You Begin - SNMP User Accounts (Web) 24 ? Add or Edit an SNMP Community (Web) 24 ? Delete an SNMP Community (Web) 26 ? Add or Edit an SNMP User Account Using the Web Interface 26 ? Delete an SNMP User Account (Web) 28 ? Manage SNMP Trap Alerts (Web) 29 Downloading SNMP MIBs Using Oracle ILOM 31 Before You Begin - Download SNMP MIBs 31 ? Download SNMP MIBs (CLI) 31 ? Download SNMP MIBs (Web) 32 Manage User Accounts Using SNMP 33 Before You Begin - User Accounts (SNMP) 34 Configuring User Accounts (SNMP) 35 ? Configure User Accounts (SNMP) 35 ? Configure Single Sign On (SNMP) 37 Configuring Active Directory Settings 39 ? Manage Active Directory Settings (SNMP) 39 ? Manage Active Directory Administrator Groups (SNMP) 44 ? Manage Active Directory Operator Group (SNMP) 45 ? Manage Active Directory Custom Group (SNMP) 47 ? Manage Active Directory User Domains (SNMP) 49 ? Manage Active Directory Alternate Server (SNMP) 51Contents vi ? Manage Server Redundancy (SNMP) 54 ? Manage Active Directory DNS Locator (SNMP) 55 ? Manage DNS Name Server Settings (SNMP) 58 Configuring ILOM for LDAP (SNMP) 59 ? Configure LDAP Settings (SNMP) 59 Configuring ILOM for LDAP/SSL 63 ? Manage LDAP/SSL Certificate (SNMP) 63 ? Manage LDAP/SSL Administrator Group (SNMP) 64 ? Manage LDAP/SSL Operator Group (SNMP) 65 ? Manage LDAP/SSL Custom Group (SNMP) 67 ? Manage LDAP/SSL User Domain (SNMP) 68 ? Manage LDAP/SSL Alternate Server (SNMP) 70 Configuring RADIUS Settings (SNMP) 72 ? Configure RADIUS Settings (SNM)) 72 Manage Component Information and Email Alerts (SNMP) 75 Before You Begin - Component Information (SNMP) 76 Viewing Component Information 76 ? View Component Information 76 Managing Clock Settings, Event Log, Syslog Receiver, and Alert Rules 78 ? View and Set Clock Settings 78 ? View and Clear the ILOM Event Log 79 ? Configure Remote Syslog IP Destinations 81 ? Configure Severity Level Alert Rule 82 Configuring SMTP Client for Email Alert Notifications 84 ? Configure SMTP Client for Alert Notification (SNMP) 84 Configuring Email Alert Settings (SNMP) 86 ? Manage Email Alert Settings (SNMP) 86 Configuring Telemetry Harness Daemon (SNMP) 88vii Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Manage Telemetry Harness Daemon Settings (SNMP) 88 Monitor and Manage System Power (SNMP) 91 Before You Begin - Power Management (SNMP) 92 Monitoring the Power Consumption Interfaces (SNMP) 93 ? Monitor System Total Power Consumption (SNMP) 93 ? Monitor Actual Power Consumption (SNMP) 94 ? Monitor Individual Power Supply Consumption (SNMP) 95 ? Monitor Available Power (SNMP) 97 ? Monitor Hardware Configuration Maximum Power Consumption (SNMP) 97 ? Monitor Permitted Power Consumption (SNMP) 97 ? Monitor Power Management Properties (SNMP) 97 Maintaining System Power Policy (SNMP) 99 ? View and Set the Power Policy (SNMP) 99 Managing System Power Properties (SNMP) 100 ? Power On System (SNMP) 100 ? Reset System Power (SNMP) 100 Manage Oracle ILOM Firmware Updates (SNMP) 103 ? Update Oracle ILOM Firmware (SNMP) 104 Manage ILOM Backup and Restore Configurations (SNMP) 107 ? View and Configure Backup and Restore Properties (SNMP) 108 Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 111 Before You Begin - Manage SPARC Hosts (SNMP) 112 Managing SPARC Diagnostic, POST, and Boot Mode Properties (SNMP) 113 ? Manage SPARC Host Diagnostic Properties (SNMP) 113 ? Manage SPARC Host POST Operations (SNMP) 116 ? Manage SPARC Host Boot Mode Properties (SNMP) 119Contents viii ? Manage SPARC Host Keyswitch Property (SNMP) 121 Server Managment Using IPMI 123 Intelligent Platform Management Interface (IPMI) 124 About IPMI 124 IPMItool 125 IPMI Alerts 125 IPMI Administrator and Operator Roles 126 Configuring the IPMI State 127 ? Enable IPMI State (CLI) 127 ? Enable IPMI State (Web) 127 Using IPMItool to Run ILOM CLI Commands 128 Before You Begin - IPMItool and ILOM Requirements 128 ? Access the ILOM CLI From IPMItool 128 Scripting ILOM CLI Commands With IPMItool 129 Performing System Management Tasks (IPMItool) 130 Before You Begin - ILOM and IPMItool Requirements 130 ? Display Sensor List (IPMItool) 131 ? View Single Sensor Details (IPMItool) 132 ? Power On Host (IPMItool) 132 ? Power Off Host (IPMItool) 132 ? Power Cycle Host (IPMItool) 133 ? Shut Down Host Gracefully (IPMItool) 133 ? Manage ILOM Power Budget Interfaces (IPMItool) 133 ? Display FRU Manufacturing Details (IPMItool) 137 ? Display ILOM Event Log Using IPMItool 138 IPMItool Utility and Command Summary 139 Server Management Using WS-Management and CIM 143ix Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 WS-Management and CIM Overview 144 WS-Management 144 Common Information Model (CIM) 144 System Management Architecture for Server Management (SMASH) 145 Configuring Support for WS-Management in ILOM 145 Before You Begin - WS-Management Requirements 145 ? Edit the WS-Management Service State, Transport Mode, and Port Number (CLI) 145 ? Edit WS-Management State, Transport Mode, and Port Number (Web) 148 Supported DMTF SMASH Profiles, CIM Classes and CIM Indications 149 Supported DMTF SMASH Profiles and CIM Classes 150 Supported CIM Indications 152 Oracle’s Sun-Supported CIM Classes 155 Document Conventions For Oracle’s Sun-Supported CIM Classes 156 Oracle_AssociatedIndicatorLED 157 Oracle_AssociatedSensor 158 Oracle_Chassis 159 Oracle_ComputerSystem 165 Oracle_ComputerSystemPackage 172 Oracle_Container 173 Oracle_ElementCapabilities 174 Oracle_ElementConformsToProfile 175 Oracle_EnabledLogicalElementCapabilities 175 Oracle_HWCompErrorOkIndication 179 Oracle_IndicatorLED 181 Oracle_InstCreation 189Contents x Oracle_InstDeletion 190 Oracle_LogEntry 191 Oracle_LogManagesRecord 195 Oracle_Memory 196 Oracle_NumericSensor 201 Oracle_PhysicalAssetCapabilities 209 Oracle_PhysicalComponent 211 Oracle_PhysicalElementCapabilities 218 Oracle_PhysicalMemory 219 Oracle_PhysicalPackage 223 Oracle_Processor 230 Oracle_ProcessorChip 236 Oracle_Realizes 240 Oracle_RegisteredProfile 241 Oracle_RecordLog 244 Oracle_ReferencedProfile 249 Oracle_Sensor 250 Oracle_SpSystemComponent 256 Oracle_SystemDevice 257 Oracle_ThresholdIndication 258 Oracle_UseOfLog 263 SNMP Command Examples 265 snmpget Command 266 snmpwalk Command 266 snmpbulkwalk Command 268 snmptable Command 268 snmpset Command 271 snmptrapd Command 272xi Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Index 275xii Using This Documentation (G) This guide provides instructions for managing remote Oracle hardware devices using supported Oracle Integrated Lights Out Manager (ILOM) 3.0 management protocols. A list of the management protocols supported by Oracle ILOM are as follows: Simple Network Management Protocol (SNMP), Intelligent Platform Management Interface (IPMI), Web Service Management (WS-Man), and Common Information Model (CIM). Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is intended for technicians, system administrators, and authorized Oracle service providers, and users who have experience managing system hardware. ¦ “Documentation and Feedback” on page xiii ¦ “Product Downloads” on page xiv ¦ “Oracle ILOM 3.0 Firmware Version Numbering Scheme” on page xv ¦ “Documentation, Support, and Training” on page xvxiii Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Documentation and Feedback (R) You can download the Oracle ILOM 3.0 Documentation Libary at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Getting Started Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management — Web Interface Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management — CLI Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xiv Product Downloads (R) Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, then select the product of interest. 6. In the Release? Is pull down list, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the Oracle ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right-side pane that appears, click Download.xv Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle ILOM 3.0 Firmware Version Numbering Scheme (R) Oracle ILOM 3.0 has implemented a new version numbering scheme to help you identify which version of Oracle ILOM you are running on your system. The numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version ¦ Oracle ILOM 3.1 as a minor version ¦ Oracle ILOM 3.1.2 as the second update version ¦ Oracle ILOM 3.1.2.1 as a micro version ¦ Oracle ILOM 3.1.2.1.a as a nano version of 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface. Documentation, Support, and Training (R) These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)1 SNMP Overview (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, Oracle ILOM overview ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, CLI overview ¦ Oracle ILOM 3.0 Daily Management Web Procedures, web interface overivew Description Links Learn about Oracle ILOM support for SNMP • “About Simple Network Management Protocol” on page 2 Learn about management using SNMP • “SNMP Components” on page 2 Learn about the Oracle ILOM SNMP Management Information Base (MIB) files • “Oracle ILOM SNMP MIBs” on page 32 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 About Simple Network Management Protocol (C) Oracle ILOM supports the Simple Network Management Protocol (SNMP), which is used to exchange data about network activity. SNMP is an open, industry-standard protocol technology that enables the management of networks and devices, or nodes, that are connected to the network. When using SNMP, data travels between a managed device (node) and a management station with network access. A managed device can be any device that runs SNMP, such as hosts, routers, web servers, or other servers on the network. SNMP messages are sent over IP using the User Datagram Protocol (UDP). Any management application that supports SNMP can manage your server. For a more complete description of SNMP, see the five-part, introductory SNMP tutorial available at: (http://www.dpstele.com/layers/l2/snmp_l2_tut_part1.php) Oracle ILOM supports SNMP versions 1, 2c, and 3. Using SNMP v3 is strongly advised since SNMP v3 provides additional security, authentication, and privacy beyond SNMP v1 and v2c. SNMP is a protocol, not an application, so you need an application to utilize SNMP messages. Your SNMP management software might provide this functionality, or you can use an open-source tool like Net-SNMP, which is available at: (http://net-snmp.sourceforge.net/) Note – Oracle ILOM users reading this document are assumed to have a working knowledge of SNMP. SNMP client-side commands are used in this text as examples of using SNMP. Users who do not have a working knowledge of SNMP should complete the tutorial at ( http://net-snmp.sourceforge.net/wiki/index.php/Main_Page). This tutorial is more advanced than the introductory tutorial referred to above. SNMP Components (C) SNMP functionality requires the following two components:SNMP Overview 3 ¦ Network management station – A network management station hosts management applications, which monitor and control managed nodes. ¦ Managed node – A managed node is a device such as a server, router, or hub that hosts SNMP management agents that are responsible for carrying out requests from management stations, such as a service processor (SP) running Oracle ILOM. Managed nodes can also provide unsolicited status information to a management station in the form of a trap. SNMP is the protocol used to communicate management information between management stations and SNMP agents. The SNMP agent is preinstalled on your Oracle Sun server platform and runs on Oracle ILOM, so all SNMP management occurs through Oracle ILOM. To utilize this feature, your operating system must have an SNMP client application. Both management stations and agents use SNMP messages to communicate. Management stations can send and receive information. Agents can respond to requests and send unsolicited messages in the form of traps. Management stations and agents use the following functions: ¦ Get ¦ GetNext ¦ GetResponse ¦ Set ¦ Trap Oracle ILOM SNMP MIBs (R) The base component of an SNMP implementation is the Management Information Base (MIB). A MIB is a text file that describes a managed node’s available information. This tree-like, hierarchical system classifies information about resources in a network as a list of data objects, each with a unique identifier, or object ID. Thus, the MIB defines the data objects, or variables, that the SNMP agent can access. When a management station requests information from a managed node, the agent receives the request and retrieves the appropriate information from the MIBs. In Oracle ILOM, the MIB makes it possible to access the server’s network configuration, status, and statistics. As of Oracle ILOM 3.0.4, SNMP MIBs are a part of the Oracle ILOM firmware. You can download MIBs directly from Oracle ILOM. For more information about MIBs, and instructions for downloading MIBs from Oracle ILOM, see the following guides: ¦ Oracle ILOM 3.0 Daily Management Concepts Guide4 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ Oracle ILOM 3.0 Daily Management CLI Procedures Guide ¦ Oracle ILOM 3.0 Daily Management Web Interface Procedures Guide The following figure hows the standard MIB tree and the location of the Oracle ILOM MIB modules in that tree. The Oracle ILOM MIB modules are described in the table that follows. EXAMPLE: Location of Oracle ILOM MIB ModulesSNMP Overview 5 The following table provides a description of the Oracle ILOM MIB modules and lists the object ID for each MIB name. Portions of the standard MIBs listed in the following table are implemented by Oracle ILOM. TABLE: Description of Oracle ILOM MIB Modules, Object ID, and MIB Name MIB Name Description MIB Object ID ENTITY-MIB The MIB module for representing multiple physical entities supported by a single SNMP agent. Note - The entPhysicalTable is the only part of this MIB that is implemented. 1.3.6.1.2.1.47 SUN-HW-CTRLMIB This MIB allows controls for all Oracle Sun server platform devices using Oracle ILOM. Note - Only the power management portions of this MIB are implemented. 1.3.6.1.4.1.42.2.175. 104 SUN-HW-TRAPMIB This MIB describes the hardware-related notifications and traps that can be generated by Oracle Sun server platforms. 1.3.6.1.4.1.42.2.175. 103 SUN-ILOM-CON TROL-MIB This MIB provides objects for configuring and managing all Oracle ILOM functions. Configuration covered by this MIB includes functions such as authorization, authentication, logging, services, networking, and firmware management. 1.3.6.1.4.1.42.2.175. 102 SUN-PLATFOR M- MIB This MIB provides extensions to the ENTITY-MIB (RFC 2737) where each entity modeled in the system is represented by means of extensions to the entPhysicalTable. 1.3.6.1.4.1.42.2.70.1 01 TABLE: Standard MIBs Implemented by Oracle ILOM MIB Name Description MIB Object ID IF-MIB The MIB module for describing generic objects for network interface sub-layers. This MIB is an updated version of MIB-II’s ifTable, and incorporates the extensions defined in RFC 1229. 1.3.6.1.2.1.31 IP-MIB The MIB module for managing IP and ICMP implementations, but excluding their management of IP routes. 1.3.6.1.2.1.4. SNMP-FRAMEW ORK-MIB The SNMP Management Architecture MIB. 1.3.6.1.6.3.106 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 The following table describes MIBs that are used in support of the Oracle ILOM SNMP implementation. SNMPv2-MIB The MIB module for SNMP entities. Note - Only the system and SNMP groups from this MIB module apply to Oracle ILOM. 1.3.6.1.6.3.1 TCP-MIB The MIB module for managing TCP implementations. 1.3.6.1.2.1.49 UDP-MIB The MIB module for managing UDP implementations. 1.3.6.1.2.1.50 TABLE: MIBs Used in Support of the Oracle ILOM SNMP Implementation MIB Name Description MIB Object ID HOST-RESOURC ES-MIB This MIB is for use in managing host systems. The MIB supports attributes common to all Internet hosts including, for example, both personal computers and systems that run variants of UNIX. 1.3.6.1.2.1.25.1 IANAifType-MIB This MIB module defines the IANAifType Textual Convention, and thus the enumerated values of the ifType object defined in MIB-II’s ifTable. 1.3.6.1.2.1.30 NOTIFICATIONLOG-MIB This MIB module is used for logging SNMP notifications (traps). 1.3.6.2.1.92.1.1.3 SNMP-MPD-MIB This MIB module is used for message processing and dispatching. 1.3.6.1.6.3.11 SNMPv2-TM This MIB module is used for SNMP transport mappings. 1.3.6.1.6.3.19 SNMPv2-SMI This MIB module contains definitions for the structure of management information, version 2. 1.3.6.1.6 TABLE: Standard MIBs Implemented by Oracle ILOM (Continued) MIB Name Description MIB Object ID7 Configuring SNMP Settings in Oracle ILOM (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, managing user accounts Description Links Oracle ILOM CLI procedures for managing SNMP access, user accounts, and SNMP trap alerts • “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (CLI)” on page 8 • “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (Web)” on page 21 Download SNMP MIBs directly from Oracle ILOM • “Downloading SNMP MIBs Using Oracle ILOM” on page 318 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (CLI) (G) ? Set SNMP Access and Authorization (CLI) Before You Begin ¦ To modify SNMP properties in Oracle ILOM, you must have the Admin role (a) enabled. ¦ The SNMP servicestate property is, by default, shipped from the factory enabled. ¦ The SNMP sets write access property is, by default, shipped from the factory disabled. To allow SNMP write access to ILOM, you must enable the SNMP sets property. Note – When the “Set Requests” state is disabled in Oracle ILOM, all SNMP objects are read-only and no snmpset commands are processed. ¦ Oracle ILOM provides authenication properties for each of the following SNMP protocol versions: v1, v2c, and v3. ¦ For SNMP v1 and v2c, Oracle ILOM provides a communities property with values of public and private to manage user authentication. However, the communities property value for SNMPv1 and v2c are, by default, shipped from the factory disabled. Description Links Learn about the requirements for SNMP management using the Oracle ILOM CLI • “Before You Begin – SNMP User Accounts (CLI)” on page 11 Oracle ILOM CLI procedure to enable SNMP • “Set SNMP Access and Authorization (CLI)” on page 8 Oracle ILOM CLI procedures for managing SNMP user account properties • “Managing SNMP User Accounts and Communities (CLI)” on page 11 Oracle ILOM CLI procedures for managing SNMP traps • “Managing SNMP Trap Alerts Using the Oracle ILOM CLI” on page 16Configuring SNMP Settings in Oracle ILOM 9 ¦ For SNMP v3, Oracle ILOM provides a users property to manage user authentication. The users property is, by default, shipped from the factory enabled. The SNMPv3 users property is not shipped from the factory with pre-packaged values for users. To set the SNMP service state, properties, follow these steps: 1. Log in to the Oracle ILOM SP CLI. 2. To view the Oracle ILOM SNMP properties, type: -> show /SP/services/snmp The following SNMP output appears. -> show /SP/services/snmp /SP/services/snmp Targets: communities mibs users Properties: engineid = none port = 161 servicestate = (enabled) sets = disabled v1 = disabled v2c = disabled v3 = enabled Commands: cd set show10 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. Use the set command to change any of the SNMP properties, for example: For more information about SNMP user accounts and read and write access, see “Managing SNMP User Accounts and Communities (CLI)” on page 11. To enable: Type: SNMP with read-only access -> set /SP/services/snmp servicestate=enabled SNMP write access -> set /SP/services/snmp sets=enabled SNMP protocol version (v1, v2c, or v3) property ->set /SP/services/snmp v#=enabled where # = the SNMP protocol version you want to enable To create an SNMP v3 : Type: User account for authorizaiton and provide read and write access ->create /SP/services/snmp/users/ authenticationpassword=password permission=rw User account for authorizaiton and provide read only access ->create /SP/services/snmp/users/ authenticationpassword=passwordConfiguring SNMP Settings in Oracle ILOM 11 Managing SNMP User Accounts and Communities (CLI) (G) Before You Begin – SNMP User Accounts (CLI) (R) Prior to performing the procedures in this section, you must ensure that the following requirements are met: ¦ To set user account CLI properties in Oracle ILOM, you need the User Management (u) role enabled. ¦ Verify the proper SNMP settings are enabled in Oracle ILOM. For more details, see “Set SNMP Access and Authorization (CLI)” on page 8. Note – When you are working in the Oracle ILOM CLI, if the Sets parameter is disabled, all SNMP MIB objects are read-only. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user account with read-write (rw) privileges. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work as presented only if you have Net-SNMP and the Net-SNMP sample applications installed. Topic Description Links Identify requirements for managing SNMP user accounts. • “Before You Begin – SNMP User Accounts (CLI)” on page 11 Identify CLI targets and properties for SNMP user accounts • “SNMP User Account Targets, Properties, and Values” on page 12 Procedures for configuring SNMP user accounts using the Oracle ILOM CLI • “View and Configure SNMP Community Properties (CLI)” on page 13 • “Add an SNMP User Account (CLI)” on page 15 • “Edit an SNMP User Account (CLI)” on page 15 • “Set SNMPv3 User Account Privacy Protocol Value (CLI)” on page 15 • “Delete an SNMP User Account (CLI)” on page 15 • “Add or Edit an SNMP Community (CLI)” on page 16 • “Delete an SNMP Community (CLI)” on page 1612 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 SNMP User Account Targets, Properties, and Values (R) The SNMP user account targets, properties, and values are accessible under the /SP/services/snmp target. The following table identifies the targets, properties, and values that are valid for SNMP user accounts. For example, to change privacyprotocol for user a1 to DES, use the following syntax: Note that the changes would be invalid if the following syntax was specified: Note – You can change SNMP user permissions without resetting the privacy and authentication properties. TABLE: SNMP User Acccount Targets, Properties and Values Target Property Value Default /SP/services/snmp/ communities/ communityname permissions ro|rw ro /SP/services/snmp/users/ username authenticationprotocol authenticationpassword * permissions privacyprotocol privacypassword † * An authentication password must be provided when you create or modify users (SNMP v3 only). † If the privacyprotocol property has a value other than none, then a privacy password must be set. MD5|SHA ro|rw none|DES|AES ‡ ‡ AES (Advanced Encryption Standard) privacy protocol option is available for SNMPv 3 as of ILOM 3.0.16. MD5 (null string) ro none (null string) /SP/services/snmp engineid = none port = 161 servicestate = enabled sets = enabled v1 = disabled v2c = disabled v3 = disabled enable|disabled enabled|disabled enabled|disabled enabled|disabled enabled|disabled (null string) 161 enabled disabled disabled disabled enabled -> set /SP/services/snmp/users/al privacyprotocol=DES privacypassword=password authenticationprotocol=SHA authenticationpassword=password -> set /SP/services/snmp/users/al privacyprotocol=DESConfiguring SNMP Settings in Oracle ILOM 13 ? View and Configure SNMP Community Properties (CLI) 1. To go to the /SP/services/snmp directory, type: -> cd /SP/services/snmp 2. Within that directory, type the show command to view SNMP settings. The default settings are as follows: 3. To view the communities, type: -> show /SP/services/snmp/communities -> show /SP/services/snmp Targets: communities mibs users Properties: engineid = (none) port = 161 servicestate = enabled sets = disabled v1 = disabled v2c = disabled v3 = enabled Commands: cd set show -> show /SP/services/snmp/communities /SP/services/snmp/communities Targets: private public Properties: Commands: cd create delete show14 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 4. To create a community with read/write privileges, type: -> create /SP/services/snmp/communities/communityname permission=rw 5. View the public communities by typing: -> show /SP/services/snmp/communities/public -> create /SP/services/snmp/communities/communityname permission= rw Created /SP/services/snmp/communities/communityname -> show /SP/services/snmp/communities/public /SP/services/snmp/communities/public Targets: Properties: permission = ro Commands: cd set showConfiguring SNMP Settings in Oracle ILOM 15 ? Add an SNMP User Account (CLI) 1. Log in to the Oracle ILOM CLI. 2. To add an SNMP v3 read-only user account, type the following command: -> create /SP/services/snmp/users/username authenticationpassword=password ? Edit an SNMP User Account (CLI) 1. Log in to the Oracle ILOM CLI. 2. To edit an SNMP v3 user account, type the following command: -> set /SP/services/snmp/users/username authenticationpassword= password Note – When changing the parameters of SNMP users, you must provide a value for authenticationpassword, even if you are not changing the password. ? Delete an SNMP User Account (CLI) 1. Log in to the Oracle ILOM CLI. 2. To delete an SNMP v3 user account, type the following command: -> delete /SP/services/snmp/users/username ? Set SNMPv3 User Account Privacy Protocol Value (CLI) Before You Begin ¦ An SNMP user account must be created before you set a Privacy Protocol property value for the user account. For details, see “Add an SNMP User Account (CLI)” on page 15. 1. Log in to the Oracle ILOM CLI. 2. To modify the privacyprotocol property value assigned to an SNMP v3 user account, type the following command: -> set /SP/services/snmp/users/username privacyprotocol= 16 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Note – The SNMPv3 AES (Advanced Encryption Standard) option is available in Oracle ILOM as of 3.0.16. ? Add or Edit an SNMP Community (CLI) 1. Log in to the Oracle ILOM CLI. 2. To add an SNMP v1/v2c community, type the following command: -> create /SP/services/snmp/communities/communityname ? Delete an SNMP Community (CLI) 1. Log in to the Oracle ILOM CLI. 2. To delete an SNMP v1/v2c community, type the following command: -> delete /SP/services/snmp/communities/communityname Managing SNMP Trap Alerts Using the Oracle ILOM CLI(G) Topic Descriptions Links CLI SNMP trap procedure • “Configure SNMP Trap Rule Destinations and Properties (CLI)” on page 17 CLI alert rule commond reference • “CLI Commands for Managing Alert Rule Configurations” on page 19Configuring SNMP Settings in Oracle ILOM 17 ? Configure SNMP Trap Rule Destinations and Properties (CLI) Before You Begin ¦ To create or edit alert rules in Oracle ILOM, you need the Admin (a) role enabled. ¦ For you to define an SNMP v3 trap alert, the SNMPv3 user name must be defined in Oracle ILOM. If the SNMP v3 user name is not defined in Oracle ILOM, the SNMP v3 user receiving the SNMP alert will not be able to decode the SNMPv3 alert message. For more information about defining SNMPv3 authorization and SNMP v3 users in Oracle ILOM, see “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (CLI)” on page 8. ¦ Review “CLI Commands for Managing Alert Rule Configurations” on page 19. ¦ For additional information about configuring alert management settings in Oracle ILOM, refer to “Managing System Alerts” in the Oracle ILOM 3.0 Daily Management – CLI Procedures Guide or the Oracle ILOM 3.0 Daily Management – Concepts Guide. To configure the destinations to which the SNMP traps are sent, follow these steps: 1. Log in to the Oracle ILOM CLI. 2. To display the current settings of the alert rule, type the show command. For example: -> show /SP/alertmgmt/rules/1 /SP/alertmgmt/rules/1 Targets: Properties: community_or_username = public destination = 0.0.0.0 level = disable snmp_version = 1 type = snmptrap Commands: cd set show18 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. To show the /SP/alertmgmt/rules directory, type these commands: -> cd /SP/alertmgmt/rules -> show Choose a rule (from targets 1 through 15) for which you would like to configure a destination for SNMP traps, and go to that directory. For example: -> cd 4 4. To change the rule properties, within that rule directory, type the set command. For example: -> set type=snmptrap level=critical destination= IPaddress_of_snmp_management_station snmp_version=2c community_or_username=public -> cd /SP/alertmgmt/rules -> show /SP/alertmgmt/rules Targets: 1 2 . . . 15 Properties: testalert = (Cannot show property) Commands: cd set showConfiguring SNMP Settings in Oracle ILOM 19 CLI Commands for Managing Alert Rule Configurations (R) The following table describes the CLI commands that you will need to use to manage alert rule configurations in the Oracle ILOM CLI. TABLE: CLI Commands for Managing Alert Rule Configurations CLI Command Description show The show command enables you to display any level of the alert management command tree by specifying either the full or relative path. Examples: • To display an alert rule along with its properties using a full path, you would type the following at the command prompt: -> show /SP/alertmgmt/rules/1 /SP/alertmgmt/rules/1 Properties: community_or_username = public destination = 129.148.185.52 level = minor snmp_version = 1 type = snmptrap Commands: cd set show • To display a single property using the full path, you would type the following at the command prompt: -> show /SP/alertmgmt/rules/1 type /SP/alertmgmt/rules/1 Properties: type = snmptrap Commands: set show20 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 • To specify a relative path if the current tree location is /SP/alertmgmt/rules, you would type the following at the command prompt: -> show 1/ /SP/alertmgmt/rules/1 Targets: Properties: community_or_username = public destination = 129.148.185.52 level = minor snmp_version = 1 type = snmptrap Commands: cd set show cd The cd command enables you to set the working directory. To set alert management as a working directory on a server SP, you would type the following command at the command prompt: -> cd /SP/alertmgmt set The set command enables you to set values to properties from any place in the tree. You can specify either a full or relative path for the property depending on the location of the tree. For example: • For full paths, you would type the following at the command prompt: -> set /SP/alertmgmt/rules/1 type=snmptrap • For relative path (tree location is /SP/alertmgmt), you would type the following command path at the command prompt: -> set rules/1 type=snmptrap • For relative path (tree location is /SP/alertmgmt/rules/1), you would type the following command path at the command prompt: -> set type=snmptrap TABLE: CLI Commands for Managing Alert Rule Configurations (Continued) CLI Command DescriptionConfiguring SNMP Settings in Oracle ILOM 21 Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (Web) (G) ? Set SNMP Read and Write Access and Authorization (Web) Before You Begin ¦ To modify SNMP properties in Oracle ILOM, you must have the Admin role (a) enabled. ¦ The SNMP service state is, by default, shipped from the factory enabled. ¦ The SNMP set requests state is, by default, shipped from the factory disabled. To allow SNMP write access to ILOM, you must enable the set requests state. Note – When the set requests state is disabled in Oracle ILOM, all SNMP objects are read-only and no snmpset commands are processed. ¦ Oracle ILOM provides authenication properties for each of the following SNMP protocol versions: v1, v2c, and v3. ¦ For SNMP v1 and v2c, Oracle ILOM provides a communities property with values of public and private to manage user authentication. However, the property values for SNMP v1 and v2c communities are, by default, shipped from the factory disabled. Description Links Web procedure for setting the SNMP service state properties in Oracle ILOM • “Set SNMP Read and Write Access and Authorization (Web)” on page 21 Web procedure for managing SNMP user accounts and communities • “Managing SNMP User Accounts and Communities (Web)” on page 24 Web procedure to managing SNMP trap properties • “Manage SNMP Trap Alerts (Web)” on page 2922 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ For SNMP v3, Oracle ILOM provides a users property to manage user authentication. The users property is, by default, shipped from the factory enabled. The SNMP v3 users property is not shipped from the factory with pre-packaged values for users. To set the SNMP service state, properties, follow these steps: 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> System Management Access --> SNMP. The SNMP Settings page appears. 3. To enable the SNMP port, click the State check box. When State is disabled, the SNMP port is blocked, prohibiting all SNMP communication between Oracle ILOM and the network. 4. In the Port text field, type the port number.Configuring SNMP Settings in Oracle ILOM 23 5. Leave the Engine ID field blank. This allows the default setting to be used. The engine ID is automatically set by the SNMP agent. While you can use this field to set the engine ID, you should leave this field blank. The engine ID uniquely identifies the SNMP engine and enables users to query the SNMP agent. You should use this field to set the engine ID only if you are familiar with SNMP v3 security and how this setting is used. 6. To enable or disable the Set Requests option, select or clear the Set Requests check box. If the Set Requests option is disabled, all SNMP objects are read-only and no snmpset commands will be processed. 7. To enable SNMP v1, v2c, or v3, click a Protocols check box. SNMP v3 is enabled by default. You can enable or disable v1, v2c, and v3 protocol versions. 8. Click Save. At the bottom of the SNMP Settings page, you can also add, edit, or delete SNMP communities or users, as shown in the following figure.24 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Managing SNMP User Accounts and Communities (Web) (G) Before You Begin - SNMP User Accounts (Web) (R) Prior to performing the procedures in this section, you must ensure that the following requirements are met: ¦ To set user account CLI properties in Oracle ILOM, you need the User Management (u) role enabled. ¦ Verify that the proper SNMP settings are enabled in Oracle ILOM. For more details, see “Set SNMP Read and Write Access and Authorization (Web)” on page 21. Note – When you are working in the Oracle ILOM CLI, if the Sets parameter is disabled, all SNMP MIB objects are read-only. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user account with read-write (rw) privileges. ? Add or Edit an SNMP Community (Web) To add or edit an SNMP v1 or v2c community, follow these steps: 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> System Management Access --> SNMP. Scroll to the bottom half of the SNMP Settings page to find the SNMP Communities dialog box. Description Links Learn about what is required before managing SNMP user accounts • “Before You Begin – SNMP User Accounts (CLI)” on page 11 Web procedures for configuring SNMP user accounts and comunities • “Add or Edit an SNMP Community (Web)” on page 24 • “Delete an SNMP Community (Web)” on page 26 • “Add or Edit an SNMP Community (Web)” on page 24 • “Delete an SNMP User Account (Web)” on page 28Configuring SNMP Settings in Oracle ILOM 25 3. To add a community, click Add. The SNMP Community dialog box appears. 4. To edit a community, do the following: a. Click the appropriate community radio button b. Click Edit. The SNMP Community dialog box appears. 5. If you are adding a new community, type the name of the community in the Community Name field; otherwise, proceed to the next step. The community name can contain up to 35 characters. It must start with an alphabetic character and cannot contain a space. 6. In the Permissions drop-down list, select read-only (ro) or read-write (rw). 7. Click Save. ? Delete an SNMP Community (Web) To delete an SNMP v1 or v2c community, follow these steps:26 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> System Management Access --> SNMP. The SNMP settings page appears. 3. Click the Communities link or scroll down to the communities list. 4. Click the radio button of the SNMP community to delete. 5. Click Delete. A confirmation dialog box appears. 6. Click OK to delete the SNMP community. ? Add or Edit an SNMP User Account Using the Web Interface To add or edit an SNMP v3 user account, follow these steps: Note – User accounts are not applicable to SNMP v1 and v2c because communities are used to control access. 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> System Management Access --> SNMP. The SNMP Settings page appears. 3. Click the Users link to expand the SNMP Settings page and display SNMP Users. 4. To add an SNMP user, click Add. The Add or Edit SNMP User dialog box appears. 5. To edit an SNMP user, do the following: a. Click the appropriate user radio button b. Click Edit. The Edit SNMP User Information dialog box appears.Configuring SNMP Settings in Oracle ILOM 27 6. If you are adding a user, type a user name in the User Name text field; otherwise proceed to the next step. The user name can include up to 35 characters. It must start with an alphabetic character and cannot contain spaces. 7. In the Authentication Protocol drop-down list, select either Message Digest 5 (MD5) or Secure Hash Algorithm (SHA). 8. In the Authentication Password text field, type a password. The authentication password is case-sensitive and must contain 8 to 16 characters, with no colons or space characters. 9. In the Confirm Password text field, retype the authentication password. 10. In the Permissions drop-down list, select read-only (ro) or read-write (rw).28 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 11. (Optional) To specify a privacy protocol, perform the following steps: a. In the Privacy Protocol list box, select DES or AES. Note – The AES (Advanced Encryption Standard) privacy protocol option is available only for SNMPv3 as of ILOM 3.0.16. b. In the Privacy Password text box, type a password for the privacy algorithm specified in Step 11a. The privacy password is case-sensitive and must contain 8 to 16 characters, with no colons or space characters. Note – The privacy password is only required if you selected DES or AES in Step 11a. c. In the Confirm Password field, retype the privacy password to ensure that it matches the privacy password specified in Step 11b. 12. Click Save to apply the SNMP user account properties. ? Delete an SNMP User Account (Web) To delete an SNMP v3 user account, follow these steps: 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> System Management Access --> SNMP. The SNMP Settings page appears. 3. Click the Users link or scroll down to the SNMP Users list. 4. Click the radio button of the SNMP user account to delete. 5. Click Delete under the SNMP User’s List. A confirmation dialog box opens. 6. Click OK to delete the user account.Configuring SNMP Settings in Oracle ILOM 29 ? Manage SNMP Trap Alerts (Web) Before You Begin ¦ To create or edit SNMP trap alert rules in Oracle ILOM, you need the Admin (a) role enabled. ¦ To define an SNMP v3 trap alert, you must define the SNMP v3 user name must be defined in Oracle ILOM. If the SNMP v3 user name is not defined in Oracle ILOM, the SNMP v3 user receiving the SNMP alert will not be able to decode the SNMP v3 alert message. For more information about defining SNMP v3 authorization and SNMP v3 users in Oracle ILOM, see “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (Web)” on page 21. ¦ For additional information about configuring alert management settings in Oracle ILOM, refer to “Managing System Alerts” in the Oracle ILOM 3.0 Daily Management – Web Procedures Guide or the Oracle ILOM 3.0 Daily Management – Concepts Guide. To configure SNMP Trap Alert properties in Oracle ILOM, follow these steps: 1. Log in to the Oracle ILOM web interface. 2. Click Configuration --> Alert Management. The Alert Settings page appears. This page shows a table of the alerts that you can configure. You can configure up to 15 alerts. 3. To create or modify an alert, click the alert radio button.30 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 4. From the Actions drop-down list, select Edit. The Create or Modify Alert dialog appears. 5. In the Level drop-down list, select the level of the alert. 6. In the Type drop-down list, select the alert type. 7. In the IP Address field, specify the alert destination IP address. 8. Click Save for your changes to take effect.Configuring SNMP Settings in Oracle ILOM 31 Downloading SNMP MIBs Using Oracle ILOM (G) Before You Begin - Download SNMP MIBs (R) ¦ The Reset and Host Control (r) role is required for you to download SNMP MIBs from Oracle ILOM. ¦ You must be using Oracle ILOM 3.0.4 or a later version of Oracle ILOM. ? Download SNMP MIBs (CLI) 1. Log in to the Oracle ILOM CLI SP or CMM. 2. Use the show command to display the SNMP MIBs. For example: Description Links Platform Feature Support Identify requirements for dowloading SNMP MIBs from Oracle ILOM • “Before You Begin - Download SNMP MIBs” on page 31 • x86 system server SP • SPARC system server SP • CMM Download SNMP MIBs directly from Oracle ILOM CLI • “Download SNMP MIBs (CLI)” on page 31 Download SNMP MIBs directly from Oracle ILOM web interface • “Download SNMP MIBs (Web)” on page 32 -> show /SP/services/snmp/mibs /SP/services/snmp/mibs Targets: Properties: dump_uri = (Cannot show property) Commands: cd32 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. To download the files, type either of the following commands: -> dump -destination URI /SP/services/snmp/mibs or -> set /SP/services/snmp/mibs dump_uri=URI where URI specifies the target to which the files are downloaded. A zip file containing the MIBs are transferred to the destination server. ? Download SNMP MIBs (Web) 1. Log in to the Oracle ILOM SP or CMM web interface. 2. Click Configuration --> System Management Access --> SNMP. The SNMP Management page appears. 3. Click the MIBs jump link, or scroll down to the MIBs section. The MIBs section of the page appears. 4. Click Download, then click Save and enter the destination to save the file. A zip file containing the MIBs is transferred to the destination server. dump set show33 ManageUserAccountsUsingSNMP(G) Related Information ¦ “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (CLI)” on page 8 ¦ “Managing SNMP Read and Write Access, User Accounts, and SNMP Trap Alerts (Web)” on page 21 ¦ Oracle ILOM 3.0 Daily Management Concepts, user management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, manage user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, manage user accounts Description Links Review access requriements for managing user accounts using SNMP • “Before You Begin - User Accounts (SNMP)” on page 34 SNMP procedures for configuring user accounts • “Configuring User Accounts (SNMP)” on page 35 SNMP procedures for configuring Active Directory settings • “Configuring Active Directory Settings” on page 39 SNMP procedure for configuring DNS name server • “Manage DNS Name Server Settings (SNMP)” on page 58 SNMP procedure for configuring LDAP settings • “Configuring ILOM for LDAP (SNMP)” on page 59 SNMP procedures for configuring LDAP/SSL settings • “Configuring ILOM for LDAP/SSL” on page 63 SNMP procedures for configuring RADIUS settings • “Configuring RADIUS Settings (SNMP)” on page 7234 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Before You Begin - User Accounts (SNMP) (R) Prior to performing the procedures in this section, you must ensure that the following requirements are met: ¦ To use SNMP, ensure that all the SNMP properties are correctly set. For more details, see “Configuring SNMP Settings in Oracle ILOM” on page 7 To view user account information, you need the Read Only (o) role enabled. ¦ To configure user account information, you need the User Management (u) role enabled. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user account with read-write (rw) privileges. Note – For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will only work as presented if you have Net-SNMP and the Net-SNMP sample applications installed.Manage User Accounts Using SNMP 35 Configuring User Accounts (SNMP) (R) ? Configure User Accounts (SNMP) Note – You can use get and set commands to configure user account MIB object settings. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. Log in to a host that has an SNMP tool and the Oracle ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To create a new user account with a user role of Operator, type: Description Links SNMP procedure and valid MIB objects for configuring user accounts • “Configure User Accounts (SNMP)” on page 35 SNMP procedure and valid MIB objects for configuring Single Sign On • “Configure Single Sign On (SNMP)” on page 37 % snmpset -v2c -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLocalUserRowStatus.'user1' i 4 ilomCtrlLocalUserRoles.'user1' s "operator" ilomCtrlLocalUserPassword.'user1' s "password"36 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. To delete a user account, type: The following table describes the User Account SNMP MIB objects. % snmpset -v2c -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLocalUserRowStatus.'user1' i 6 MIB Object Description Allowed Values Type Default ilomCtrlLocal UserUsername A local user use rname. It must start with an alphabetical letter and can contain alphabetical letters, digits, hyphens, and underscores, but cannot contain spaces. It cannot be the same as the password. username String None ilomCtrlLocal UserPassword A local user password. password String NoneManage User Accounts Using SNMP 37 ? Configure Single Sign On (SNMP) Single Sign On is a convenient authentication service that reduces the number of times you need to enter a password to gain access to Oracle ILOM. Single Sign On is enabled by default. As with any authentication service, authentication credentials are passed over the network. If you do not want this, consider disabling the Single Sign On authentication service. ilomCtrlLocal UserRoles Specifies the role that is associated with a user. The roles can be assigned for the legacy roles of Administrator or Operator, or any of the individual role IDs of a, u, c, r, o and s. The role IDs can be joined together. For example, aucros, where a= admin, u=user, c= console, r=reset, o= read-only, s=service. administrator, operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s) String None ilomCtrlLocal UserRowStatus This object is used to create a new row or to delete an existing row in the table. This property can be set to either createAndWait(5) or destroy(6), to create and remove a user respectively. active(1), notInService(2), notReady(3), createAndGo(4), createAndWait(5), destroy(6) Integer None ilomCtrlLocal UserCLIMode An enumerated value that describes the possible CLI modes. The default mode corresponds to the Oracle ILOM DMTF CLP. The alom mode corresponds to the ALOM CMT. default(1), alom(2) Integer None MIB Object Description Allowed Values Type Default38 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Note – You can use the set command to configure Single Sign On MIB object settings. For a description of the MIB object used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To enable Single Sign On, type: ilomCtrlSingleSignonEnabled.0 i 1 For example: The following table describes the Single Sign On SNMP MIB object. % snmpset -v2c -cprivate -mALL SNMP_agent_ipaddress ilomCtrlSingleSignonEnabled.0 i 1 MIB Object Description Allowed Values Type Default ilomCtrlSingle SignonEnabled Specifies whether Single Sign On (SSO) authentication should be enabled on the device. SSO allows tokens to be passed so that it is not necessary to re-enter passwords between different applications. This allows SSO between the system controller (SC) web interface and the service processor (SP) web interface, between the SC command-line interface and the SP command-line interface, and between the SC and SP interfaces and the Java Remote Console application. true(1), false(2) Integer NoneManage User Accounts Using SNMP 39 Configuring Active Directory Settings (R) ? Manage Active Directory Settings (SNMP) Note – You can use the get and set commands to view and configure Active Directory settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the Active Directory state, type: Topic Descriptions Links SNMP procedures for configuring Active Directory properties • “Manage Active Directory Settings (SNMP)” on page 39 • “Manage Active Directory Administrator Groups (SNMP)” on page 44 • “Manage Active Directory Operator Group (SNMP)” on page 45 • “Manage Active Directory Custom Group (SNMP)” on page 47 • “Manage Active Directory User Domains (SNMP)” on page 49 • “Manage Active Directory Alternate Server (SNMP)” on page 51 • “Manage Server Redundancy (SNMP)” on page 54 • “Manage Active Directory DNS Locator (SNMP)” on page 55 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryEnabled.040 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To enable the Active Directory, type: ¦ To view the Active Directory port number, type: ¦ To set the Active Directory port number, type: ¦ To view the Active Directory default user roles, type: ¦ To set the Active Directory default user roles, type: ¦ To view the Active Directory certificate file URI, type: ¦ To set the Active Directory certificate file URI, type: ¦ To view the Active Directory time-out, type: ¦ To set the Active Directory time-out, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryEnabled.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryPortNumber.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryPortNumber.0 i portnumber % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryDefaultRoles.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryDefaultRoles.0 s acro % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertFileURI.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertFileURI.0 s URI % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryTimeout.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryTimeout.0 i 6Manage User Accounts Using SNMP 41 ¦ To view the Active Directory certificate validation mode, type: ¦ To set the Active Directory certificate validation mode, type: ¦ To view the Active Directory certificate file status, type: ¦ To view the event log setting for the number of messages sent to the event log, type: ¦ To configure the event log setting so that only the highest priority messages are sent to the event log, type: ¦ To view the role that user1 is to have when authenticated through Active Directory, type: ¦ To specify the Admin (a) role for user1 when authenticated via Active Directory, type: ¦ To view and clear the certificate information associated with the server when it is set to true, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryStrictCertEnabled.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryStrictCertEnabled.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertFileStatus.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryLogDetail.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryLogDetail.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryDefaultRoles.’user1’ % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryDefaultRoles.’user1’ s a % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertClear.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertClear.0 i 042 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To view the version of the certificate file, type: ¦ To view the serial number of the certificate file, type: ¦ To view the issuer of the certificate file, type: ¦ To view the subject of the certificate file, type: ¦ To view the valid start date of the certificate file, type: ¦ To view the valid end date of the certificate file, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertserialNo.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertIssuer.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertSubject.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertValidBegin.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirectoryCertValidEnd.0Manage User Accounts Using SNMP 43 The following table describes the Active Directory Certificates SNMP MIB objects. MIB Object Description Allowed Values Type Default ilomCtrlActive Directory Enabled Specifies whether the Active Directory client is enabled. true(1), false(2) Integer true ilomCtrlActive DirectoryIP The IP address of the Active Directory server used as a name service for user accounts. ipaddress String None ilomCtrlActive Directory PortNumbe Specifies the port number for the Active Directory client. Specifying 0 as the port means autoselect, while specifying 1 to 65535 configures the actual port. portnumber Range: 0 to 65535 Integer None ilomCtrl Active Directory DefaultRoles Specifies the role that a user authenticated through Active Directory should have. Setting this property to legacy roles of Administrator or Operator, or any of the individual role IDs of a, u, c, r, o and s will cause the Active Directory client to ignore the schema stored on the Active Directory server. Setting this to none clears the value and indicates that the native Active Directory schema should be used. The role IDs can be joined together. For example, aucros, where a= admin, u=user, c=console, r=reset, o=read-only, and s= service. administrator, operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s), none String None ilomCtrlActive Directory CertFileURI This is the URI of a certificate file needed when Strict Certificate Mode is enabled. Setting the URI causes the transfer of the file, making the certificate available immediately for certificate authentication. URI String None44 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Manage Active Directory Administrator Groups (SNMP) Note – If you were using the Net-SNMP sample applications, you could use the snmpget and snmpset commands to configure the Active Directory Administrator Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To view the name of Active Directory administrator group ID number 2, type: ilomCtrlActive Directory Timeout Specifies the number of seconds to wait before timing out if the Active Directory server is not responding. Range: 1 to 20 seconds Integer 4 ilomCtrlActive Directory StrictCert Enabled Specifies whether the Strict Certificate Mode is enabled for the Active Directory client. If enabled, the Active Directory certificate must be uploaded to the SP so that certificate validation can be performed when communicating with the Active Directory server. true(1), false(2) Integer true ilomCtrlActive DirectoryCert FileStatus A string indicating the status of the certificate file. This is useful in determining whether a certificate file is present or not. status String None % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAdminGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAdminGroupName.2 = STRING: CN=spAdmins,DC=spc,DC=north,DC=sun,DC=com MIB Object Description Allowed Values Type DefaultManage User Accounts Using SNMP 45 3. To set the name of Active Directory administrator group ID number 2 to CN= spAdmins,DC=spc,DC=south,DC=sun,DC=com, type: The following table describes the Active Directory Admistrator Groups SNMP MIB objects. ? Manage Active Directory Operator Group (SNMP) Note – You can use the get and set commands to configure the Active Directory Operator Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAdminGroupName.2 s CN=spAdmins,DC=spc,DC= south,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAdminGroupName.2 = STRING: CN=spAdmins,DC=spc,DC=south,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAdminGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAdminGroupName.2 = STRING: CN=spAdmins,DC=spc,DC=south,DC=sun,DC=com MIB Object Description Allowed Values Type Default ilomCtrlActive DirAdminGroupId An integer identifier of the Active Directory Administrator Groups entry. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlActive DirAdminGroup Name This string should contain a Distinguished Name that exactly matches one of the group names on the Active Directory server. Any user belonging to one of these groups in this table will be assigned the Oracle ILOM role of Administrator. name (maximum of 255 characters) String None46 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To view the name of Active Directory operator group ID number 2, type: 3. To set the name of Active Directory operator group ID number 2 to new-name-2, type: The following table describes the Active Directory Operator Group SNMP MIB objects. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirOperatorGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirOperatorGroupName.2 = STRING: ad-oper-group-ent-2 % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirOperatorGroupName.2 s new-name-2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirOperatorGroupName.2 = STRING: new-name-2 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirOperatorGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirOperatorGroupName.2 = STRING: new-name-2 MIB Object Description Allowed Values Type Default ilomCtrlActive DirOperator GroupId An integer identifier of the Active Directory Operator Groups entry. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlActive DirOperator GroupName This string should contain a Distinguished Name that exactly matches one of the group names on the Active Directory server. Any user belonging to one of these groups in this table will be assigned the Oracle ILOM role of Operator. name (maximum of 255 characters) String NoneManage User Accounts Using SNMP 47 ? Manage Active Directory Custom Group (SNMP) Note – You can use the get and set commands to configure the Active Directory Custom Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To view the name of Active Directory custom group ID number 2, type: 3. To set the name of Active Directory custom group ID number 2 to CN= SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com, type: 4. To view the roles of Active Directory custom group ID number 2, type: % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=johns,DC=sun,DC=com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupName.2 s CN=SpSuperCust,OU=Groups,DC= bills,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupRoles.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupRoles.2 = STRING: "aucro"48 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 5. To set the roles of Active Directory custom group ID number 2 to User Management and Read Only (u,o), type: The following table describes the Active Directory Custom Group SNMP MIB % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupRoles.2 s “uo" SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupRoles.2 = STRING: "uo" % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirCustomGroupRole.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirCustomGroupRoles.2 = STRING: "uo"Manage User Accounts Using SNMP 49 objects. ? Manage Active Directory User Domains (SNMP) Note – You can use the get and set commands to configure the Active Directory User Domain settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. MIB Object Description Allowed Values Type Default ilomCtrlActive DirCustomGroup Id An integer identifier of the Active Directory Custom Groups entry. 1 to 5 This object is not accessible for reading or writing. Integer None ilomCtrlActive DirCustomGroup Name This string should contain a Distinguished Name that exactly matches one of the group names on the Active Directory server. Any user belonging to one of these groups in this table will be assigned the Oracle ILOM role based on the entry’s configuration for roles. name (maximum of 255 characters) String None ilomCtrlActive DirCustom GroupRoles Specifies the role that a user authenticated via Active Directory should have. Setting this property to legacy roles of Administrator or Operator, or any of the individual role IDs of a, u, c, r, o and s will cause the Active Directory client to ignore the schema stored on the Active Directory server. Setting this object to none clears the value and indicates that the native Active Directory schema should be used. The role IDs can be joined together. For example, aucros, where a= admin, u=user, c=console, r= reset, o=read-only, and s= service. administrator , operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s), none String None50 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To view the name of Active Directory user domain ID number 2, type: 3. To set the name of Active Directory user domain ID number 2 to @johns.example.sun.com, type: The following table describes the Active Directory User Domains SNMP MIB objects. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirUserDomain.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirUserDomain.2 = STRING: @davidc.example.sun.com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirUserDomain.2 s “@johns.example.sun.com” SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirUserDomain.2 = STRING: @johns.example.sun.com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirUserDomain.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirUserDomain.2 = STRING: @johns.example.sun.com MIB Object Description Allowed Values Type Default ilomCtrlActive DirUserDomain Id An integer identifier of the Active Directory domain. 1 to 5 This object is not accessible for reading or writing. Integer None ilomCtrlActive DirUserDomain This string should exactly match with an authentication domain on the Active Directory server. This string should contain a substitution string (), which will be replaced with the user’s login name during authentication. Either the principle or Distinguished Name format is allowed. name (maximum of 255 characters) String NoneManage User Accounts Using SNMP 51 ? Manage Active Directory Alternate Server (SNMP) Note – You can use the get and set commands to set the values of MIB object properties to configure the Active Directory Alternate Server settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the IP address of Active Directory alternate server ID number 2, type: ¦ To set the IP address of Active Directory alternate server ID number 2 to 10.7.143.246, type: ¦ To view the port number of Active Directory alternate server ID number 2, type: % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerIp.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerIp.2 = IpAddress: 10.7.143.236 % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerIp.2 a 10.7.143.246 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerIp.2 = IpAddress: 10.7.143.246 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerIp.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerIp.2 = IpAddress: 10.7.143.246 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerPort.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerPort.2 = INTEGER: 63652 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To set the port number of Active Directory alternate server ID number 2 to 639, type: ¦ To view the certificate status of Active Directory alternate server ID number 2, type: ¦ To view the certificate URI of Active Directory alternate server ID number 2, type: ¦ To clear the certificate information associated with the server when it is set to true, type: ¦ To view the certificate version of the alternate server certificate file, type: ¦ To view the serial number of the alternate server certificate file, type: % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerPort.2 i 639 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerPort.2 = INTEGER: 639 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerIp.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerPort.2 = INTEGER: 639 % snmpget -v2c -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertStatus.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerCertStatus. 2 = STRING: certificate not present % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertURI.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirAlternateServerCertURI.2 = STRING: none % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertClear.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertSerialNo.0Manage User Accounts Using SNMP 53 ¦ To view the issuer of the alternate server certificate file, type: ¦ To view the subject of the alternate server certificate file, type: ¦ To view the valid start date of the alternate server certificate file, type: ¦ To view the valid end date of the alternate server certificate file, type: The following table describes the Active Directory Alternate Server SNMP MIB objects. % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertIssuer.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertSubject.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertValidBegin.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlActiveDirAlternateServerCertValidEnd.0 MIB Object Description Allowed Values Type Default ilomCtrlActive DirAlternate ServerId An integer identifier of the Active Directory alternate server table. 1 to 5 This object is not accessible for reading or writing. Integer None ilomCtrlActive DirAlternate ServerIP The IP address of the Active Directory alternate server used as a name service for user accounts. ipaddress String None54 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Manage Server Redundancy (SNMP) Note – You can use the get and set commands to view and configure redundancy settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ilomCtrlActive DirAlternate ServerPort Specifies the port number for the Active Directory alternate server. Specifying 0 as the port indicates that autoselect will use the well known port number. Specifying 1-65535 explicitly sets the port number. portnumber (range: 0 to 65535) Integer None ilomCtrlActive DirAlternate ServerCert Status A string indicating the status of the certificate file. This is useful in determining whether a certificate file is present or not. status (maximum size: 255 characters) String None ilomCtrlActive DirAlternate ServerCertURI This is the URI of a certificate file needed when Strict Certificate Mode is enabled. Setting the URI causes the transfer of the file, making the certificate available immediately for certificate authentication. Additionally, either remove or restore are supported for direct certificate manipulation. URI String None MIB Object Description Allowed Values Type DefaultManage User Accounts Using SNMP 55 ¦ To view the status of the server in a redundant configuration, type: ¦ To view the property that controls whether the server is to be promoted or demoted from active or standby status, type: ¦ To promote a redundant server from standby to active status, type: ¦ To view the FRU name of the chassis monitoring module (CMM) on which this agent is running, type: ? Manage Active Directory DNS Locator (SNMP) Note – You can use the get and set commands to configure the Active Directory DNS Locator settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To view the state of Active Directory DNS locator, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRedundancyStatus.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRedundancyAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRedundancyAction.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRedundancyFRUName.0 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorEnabled.0 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorEnabled.0 = INTEGER: false(2)56 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. To set the state of Active Directory DNS locator ID number 2 to enabled, type: 4. To view the service name of Active Directory DNS locator ID number 2, type: % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorEnabled.0 i 1 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorEnabled.0 = INTEGER: true(1) % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorEnabled.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorEnabled.2 = INTEGER: true(1) % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorQueryService.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorQueryService.2 = STRING: _ldap._tcp.dc._msdcs..Manage User Accounts Using SNMP 57 5. To set the service name and port number of Active Directory DNS locator ID number 2, type: The following table describes the Active Directory DNS Locator SNMP MIB objects. % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorQueryService.2 s “_ldap._tcp.pdc._msdcs..” SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorQueryService.2 = STRING: _ldap._tcp.pdc._msdcs.. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlActiveDirDnsLocatorQueryService.2 SUN-ILOM-CONTROL-MIB::ilomCtrlActiveDirDnsLocatorQueryService.2 = STRING: _ldap._tcp.pdc._msdcs.. MIB Object Description Allowed Values Type Default ilomCtrlActive DirDnsLocator Enabled Specifies whether or not the Active Directory DNS locator functionality is enabled. true(1), false(2) Integer false ilomCtrlActive DirDnsLocator QueryId An integer identifier of the Active Directory DNS Locator Query entry. 1 to 5 This object is not accessible for reading or writing. Integer None ilomCtrlActive DirDnsLocator QueryService The service name that is used to perform the DNS query. The name can contain as a substitution marker, being replaced by the domain information associated for the user at the time of authentication. The service name can also contain , which can be used to override any learned port information, if necessary. For example, can be specified for the standard LDAP/SSL port 636. name (maximum of 255 characters) String None58 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Manage DNS Name Server Settings (SNMP) Note – You can use the get and set commands to view and configure DNS name server settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view and specify the name server for DNS, type: ¦ To view and specify the search path for DNS, type: ¦ To view state of DHCP autodns for DNS, type: ¦ To set the state of DHCP autodns for DNS to enabled, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSNameServers.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSNameServers.0 s ‘nameservername’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSSearchPath.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSSearchPath.0 s ‘searchpath’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSdhcpAutoDns.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSdhcpAutoDns.0 i 1Manage User Accounts Using SNMP 59 ¦ To view the number of seconds to wait before timing out if the server does not respond, type: ¦ To set the number of seconds to wait before timing out if the server does not respond to 5, type: ¦ To view the number of times a request is attempted again after a time-out, type: ¦ To set the number of times a request is attempted again after a time-out to 5, type: Configuring ILOM for LDAP (SNMP) (R) ? Configure LDAP Settings (SNMP) Note – You can use the get and set commands to configure ILOM for LDAP. For a description of the MIB objects used in this procedure, see the table that follows the procedure. % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSTimeout.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSTimeout.0 i 5 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSRetries.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlDNSRetries.0 i 5 Topic Descriptions Links SNMP procedure for configuring ILOM LDAP properties • “Configure LDAP Settings (SNMP)” on page 5960 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view whether the LDAP server is enabled to authenticate LDAP users, type: ¦ To set the LDAP server state to enabled to authenticate LDAP users, type: ¦ To view the LDAP server IP address, type: ¦ To set the LDAP server IP address, type: ¦ To view the LDAP server port number, type: ¦ To set the LDAP server port number, type: ¦ To view the LDAP server Distinguished Name, type: ¦ To set the LDAP server Distinguished Name, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapEnabled.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapEnabled.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapServerIP.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapServerIP.0 a ipaddress % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapPortNumber.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapPortNumber.0 i 389 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapBindDn.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapBindDn.0 s ou=people,ou=sales,dc=sun,dc=comManage User Accounts Using SNMP 61 ¦ To view the LDAP server password, type: ¦ To set the LDAP server password, type: ¦ To view the branch of your LDAP server on which user searches are made, type: ¦ To set the branch of your LDAP server on which to search for users, type: ¦ To view the LDAP server default role, type: ¦ To set the LDAP server default role to Administrator, type: The following table describes the LDAP Settings SNMP MIB objects. % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapBindPassword.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapBindPassword.0 s password % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSearchBase.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSearchBase.0 s ldap_server_branch % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapDefaultRoles.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapDefaultRoles.0 s administrator MIB Object Description Allowed Values Type Default ilomCtrlLdap Enabled Specifies whether the LDAP client is enabled. true(1), false(2) Integer false ilomCtrlLdap ServerIP The IP address of the LDAP server used as a name service for user accounts. ipaddress String None ilomCtrlLdap PortNumber Specifies the port number for the LDAP client. Range: 0..65535 Integer 38962 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ilomCtrlLdap BindDn The Distinguished Name (DN) for the read-only proxy user used to bind to the LDAP server. For example: “cn= proxyuser,ou=people,dc=sun,dc=com" distinguished_name String None ilomCtrlLdap BindPassword The password of a read-only proxy user that is used to bind to the LDAP server. This property is essentially write-only. The write-only access level is no longer supported as of SNMP v2. This property must return a null value when read. password String None ilomCtrlLdap SearchBase A search base in the LDAP database below which to find users. For example: “ou= people,dc=sun,dc=com" The branch of your LDAP server on which to search for users String None ilomCtrlLdap DefaultRoles Specifies the role that a user authenticated via LDAP should have. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of a, u, c, r, o and s. For example, aucros, where a=admin, u=user, c=console, r=reset, o=read-only, and s=service. administrator, operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s) String None MIB Object Description Allowed Values Type DefaultManage User Accounts Using SNMP 63 Configuring ILOM for LDAP/SSL (R) ? Manage LDAP/SSL Certificate (SNMP) Note – You can use the get and set commands to view and configure LDAP/SSL certificate settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To clear the certificate information associated with the server when it is set to true, type: ¦ To view the certificate version of the certificate file, type: Topic Descriptions Links SNMP procedures for configuring LDAP/SSL settings • “Manage LDAP/SSL Certificate (SNMP)” on page 63 • “Manage LDAP/SSL Administrator Group (SNMP)” on page 64 • “Manage LDAP/SSL Operator Group (SNMP)” on page 65 • “Manage LDAP/SSL Custom Group (SNMP)” on page 67 • “Manage LDAP/SSL User Domain (SNMP)” on page 68 • “Manage LDAP/SSL Alternate Server (SNMP)” on page 70 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileClear.0 i 0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileVersion.064 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To view the serial number of the certificate file, type: ¦ To view the issuer of the certificate file, type: ¦ To view the subject of the certificate file, type: ¦ To view the valid start date of the certificate file, type: ¦ To view the valid end date of the certificate file, type: ? Manage LDAP/SSL Administrator Group (SNMP) Note – You can use the get and set commands to configure the LDAP/SSL Administrator Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileSerialNo.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileIssuer.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileSubject.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileValidBegin.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslCertFileValidEnd.0Manage User Accounts Using SNMP 65 ¦ To view the name of LDAP/SSL administrator group ID number 3, type: ¦ To set the name of LDAP/SSL administrator group ID number 3 to CN= SpSuperAdmin,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com, type: The following table describes the LDAP/SSL Administrator Group SNMP MIB objects. ? Manage LDAP/SSL Operator Group (SNMP) Note – You can use the get and set commands to configure the LDAP/SSL Operator Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAdminGroupName.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAdminGroupName.3 = STRING: CN=SpSuperAdmin,OU=Groups,DC=davidc,DC=example,DC=sun,DC=com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAdminGroupName.3 s CN=SpSuperAdmin,OU=Groups,DC= tomp,DC=example,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAdminGroupName.3 = STRING: CN=SpSuperAdmin,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAdminGroupName.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAdminGroupName.3 = STRING: CN=SpSuperAdmin,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com MIB Object Description Allowed Values Type Default ilomCtrlLdap SslAdminGroup Id An integer identifier of the LDAP/SSL AdminGroup entry. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlLdap SslAdminGroup Name This string should contain a Distinguished Name that exactly matches one of the group names on the LDAP/SSL server. Any user belonging to one of these groups in this table will be assigned the ILOM role of Administrator. name (maximum of 255 characters) String None66 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the name of LDAP/SSL operator group ID number 3, type: ¦ To set the name of Active Directory operator group ID number 3 to CN= SpSuperAdmin,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com, type: The following table describes the LDAP/SSL Operator Group SNMP MIB objects. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslOperatorGroupName.3SUN-ILOM-CONTROL-MIB::ilomCtrlL dapSslOperatorGroupName.3 = STRING: CN=SpSuperOper,OU=Groups,DC= davidc,DC=example,DC=sun,DC=com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslOperatorGroupName.3 s CN=SpSuperOper,OU=Groups,DC= tomp,DC=example,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslOperatorGroupName.3 = STRING: CN=SpSuperOper,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslOperatorGroupName.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslOperatorGroupName.3 = STRING: CN=SpSuperOper,OU=Groups,DC=tomp,DC=example,DC=sun,DC=com MIB Object Description Allowed Values Type Default ilomCtrlLdapSslOpe ratorGroupId An integer identifier of the LDAP/SSL Operator Group entry. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlLdapSslOpe ratorGroup Name This string should contain a Distinguished Name that exactly matches one of the group names on the LDAP/SSL server. Any user belonging to one of these groups in this table will be assigned the ILOM role of Operator. name (maximum of 255 characters) String NoneManage User Accounts Using SNMP 67 ? Manage LDAP/SSL Custom Group (SNMP) Note – You can use the get and set commands to configure the LDAP/SSL Custom Groups settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the name of LDAP/SSL custom group ID number 2, type: ¦ To set the name of LDAP/SSL custom group ID number 2 to CN= SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com, type: ¦ To view the roles of LDAP/SSL custom group ID number 2, type: % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=johns,DC=sun,DC=com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupName.2 s CN=SpSuperCust,OU=Groups,DC= bills,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupName.2 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupName.2 = STRING: CN=SpSuperCust,OU=Groups,DC=bills,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupRoles.2 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupRoles.2 = STRING: “aucro"68 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To set the roles of LDAP/SSL custom group ID number 2 to User Management and Read Only (u,o), type: The following table describes the LDAP/SSL Custom Group SNMP MIB objects. ? Manage LDAP/SSL User Domain (SNMP) Note – You can use the get and set commands to configure the LDAP/SSL User Domain settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupRoles.2 s “uo" SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupRoles.2 = STRING: "uo" % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslCustomGroupRoles.2 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslCustomGroupRoles.2 = STRING: "uo" MIB Object Description Allowed Values Type Default ilomCtrlLdapSsl CustomGroupId An integer identifier of the LDAP/SSL custom group entry. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlLdap SslCustomGroup Name This string should contain a Distinguished Name that exactly matches one of the group names on the LDAP/SSL server. Any user belonging to one of these groups in this table will be assigned the ILOM role based on the entry’s configuration for roles. name (maximum of 255 characters) String None ilomCtrlLdap SslCustomGroup Roles Specifies the role that a user authenticated through LDAP/SSL should have. Setting this property to legacy roles of Administrator or Operator, or any of the individual role IDs of a, u, c, r, o and s will cause the LDAP/SSL client to ignore the schema stored on the LDAP/SSL server. Setting this object to none clears the value and indicates that the native LDAP/SSL schema should be used. The role IDs can be joined together. For example, aucros, where a=admin, u=user, c=console, r=reset, o= read-only, and s=service. administrator, operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s), none String NoneManage User Accounts Using SNMP 69 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the name of LDAP/SSL user domain ID number 3, type: ¦ To set the name of LDAP/SSL user domain ID number 3 to CN=, CN=Users,DC=tomp,DC=example,DC=sun,DC=com, type: The following table describes the LDAP/SSL User Domain SNMP MIB objects. % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslUserDomain.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslUserDomain.3 = STRING: CN= ,CN=Users,DC=davidc,DC=example,DC=sun,DC=com % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslUserDomain.3 s CN=,CN=Users,DC=tomp,DC= example,DC=sun,DC=com SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslUserDomain.3 = STRING: CN= ,CN=Users,DC=tomp,DC=example,DC=sun,DC=com % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslUserDomain.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslUserDomain.3 = STRING: CN= ,CN=Users,DC=tomp,DC=example,DC=sun,DC=com MIB Object Description Allowed Values Type Default ilomCtrlLdapSslUs erDomainId An integer identifier of the LDAP/SSL domain. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlLdapSslUs erDomain This string should exactly match with an authentication domain on the LDAP/SSL server. This string should contain a substitution string (), which will be replaced with the user’s login name during authentication. Either the principle or Distinguished Name format is allowed. name (maximum of 255 characters) String None70 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Manage LDAP/SSL Alternate Server (SNMP) Note – You can use the get and set commands to configure the LDAP/SSL Alternate Server settings. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the IP address of LDAP/SSL alternate server ID number 3, type: ¦ To set the IP address of LDAP/SSL alternate server ID number 3 to 10.7.143.246, type: ¦ To view and clear the certificate information associated with the alternate server when it is set to true, type: ¦ To view the alternate server certificate version of the certificate file, type: % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerIp.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAlternateServerIp.3 = IpAddress: 10.7.143.236 % snmpset -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerIp.3 a 10.7.143.246 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAlternateServerIp.3 = IpAddress: 10.7.143.246 % snmpget -v1 -cprivate -mALL SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerIp.3 SUN-ILOM-CONTROL-MIB::ilomCtrlLdapSslAlternateServerIp.3 = IpAddress: 10.7.143.246 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertClear.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertClear.0 i 0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertVersion.0Manage User Accounts Using SNMP 71 ¦ To view the serial number of the alternate server certificate file, type: ¦ To view the issuer of the alternate server certificate file, type: ¦ To view the subject of the alternate server certificate file, type: ¦ To view the valid start date of the alternate server certificate file, type: ¦ To view the valid end date of the alternate server certificate file, type: The following table describes the LDAP/SSL Alternate Server SNMP MIB objects. % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertSerialNo.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertIssuer.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertSubject.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertValidBegin.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlLdapSslAlternateServerCertValidEnd.0 MIB Object Description Allowed Values Type Default ilomCtrlLdap SslAlternate ServerId An integer identifier of the LDAP/SSL alternate server table. 1 to 5 Note - This object is not accessible for reading or writing. Integer None ilomCtrlLdap SslAlternate ServerIP The IP address of the LDAP/SSL alternate server used as directory server for user accounts. ipaddress String None72 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Configuring RADIUS Settings (SNMP) (R) ? Configure RADIUS Settings (SNM)) Note – Before completing this procedure, collect the appropriate information about your RADIUS environment. You can use the get and set commands to configure RADIUS. For a description of the MIB objects used in this procedure, see the table that follows the procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ilomCtrlLdap SslAlternate ServerPort Specifies the port number for the LDAP/SSL alternate server. Specifying 0 as the port indicates that auto-select will use the well-known port number. Specifying 1-65535 explicitly sets the port number. portnumber (range: 0 to 65535) Integer None ilomCtrlLdap SslAlternate ServerCert Status A string indicating the status of the certificate file. This is useful in determining whether a certificate file is present or not. status (maximum size: 255 characters) String None ilomCtrlLdap SslAlternate ServerCert URI This is the URI of a certificate file needed when Strict Certificate Mode is enabled. Setting the URI causes the transfer of the file, making the certificate available immediately for certificate authentication. Additionally, either remove or restore are supported for direct certificate manipulation. URI String None Topic Descriptions Links SNMP procedure for configuring ILOM RADIUS properties • “Configure RADIUS Settings (SNM))” on page 72 MIB Object Description Allowed Values Type DefaultManage User Accounts Using SNMP 73 ¦ To view whether the RADIUS server is enabled to authenticate RADIUS users, type: ¦ To set the RADIUS server state to enabled to authenticate RADIUS users, type: ¦ To view the RADIUS server IP address, type: ¦ To set the RADIUS server IP address, type: ¦ To view the RADIUS server port number, type: ¦ To set the RADIUS server port number, type: ¦ To view the RADIUS server shared secret, type: ¦ To set the RADIUS server shared secret, type: ¦ To view the RADIUS server default user roles, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusEnabled.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusEnabled.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusServerIP.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusServerIP.0 a ipaddress % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusPortNumber.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusPortNumber.0 i portnumber % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusSecret.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusSecret.0 s secret % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusDefaultRoles.074 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To set the RADIUS server default user roles to console, type: The following table describes the RADIUS SNMP MIB objects. % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlRadiusDefaultRoles.0 s c MIB Object Description Allowed Values Type Default ilomCtrlRadiusE nabled Specifies whether or not the RADIUS client is enabled. true(1), false(2) Integer false ilomCtrlRadiusS erverIP The IP address of the RADIUS server used as a name service for user accounts. ipaddress String None ilomCtrlRadius PortNumber Specifies the port number for the RADIUS client. portnumber (range: 0 to 65535) Integer 1812 ilomCtrlRadius Secret The shared secret encryption key that is used to encypt traffic between the RADIUS client and server. secret (maximum length: 255 characters) Sting None ilomCtrlRadius DefaultRoles Specifies the role that a user authenticated through RADIUS should have. This property supports the legacy roles of Administrator or Operator, or any of the individual role ID combinations of a, u, c, r, o and s. For example, aucros, where a=admin, u=user, c=console, r=reset, o=read-only, and s= service. administrator, operator, admin(a), user(u), console(c), reset(r), read-only(o), service(s) String None75 Manage Component Information and Email Alerts (SNMP) (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, system monitoring and alert management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, managing alerts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing alerts Description Links Review ILOM requirements for managing component information and email alerts using SNMP • “Before You Begin - Component Information (SNMP)” on page 76 SNMP view component procedures • “Viewing Component Information” on page 76 SNMP configuration procedure for manging clock settings, syslog and alert rules • “Managing Clock Settings, Event Log, Syslog Receiver, and Alert Rules” on page 78 SNMP configuration procedure for SMTP client for Email notification alerts • “Configuring SMTP Client for Email Alert Notifications” on page 84 SNMP configuration procedure for alerts • “Configuring Email Alert Settings (SNMP)” on page 86 SNMP configuration procedure for Telemetry Harness Daemon • “Configuring Telemetry Harness Daemon (SNMP)” on page 8876 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Before You Begin - Component Information (SNMP) (R) ¦ Before you can use SNMP to view and configure ILOM settings, you must configure SNMP. For more information, see “Configuring SNMP Settings in Oracle ILOM” on page 7. ¦ When executing the snmpset command, you need to use a v1/v2c community or a v3 user with read/write (rw) privileges. Note – For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work only as presented if you have Net-SNMP and the Net-SNMP sample applications installed. Viewing Component Information (R) ? View Component Information Note – You can use get commands to view component information. For a description of valid MIB objects for this procedure, see the table following this procedure. Topic Descriptions Links SNMP procedure for vieiwng ILOM component information • “View Component Information” on page 76Manage Component Information and Email Alerts (SNMP) 77 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password 2. To view the firmware revision, type: The following table describes the Component Information SNMP MIB objects. % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address entPhysicalFirmwareRev.1 MIB Object Description Values Type Default entPhysical Name The textual name of the physical entity. Size: 0..255 String Zerolength string entPhysical Descr A textual description of the physical entity. Size: 0..255 String None entPhysical ContainedIn The value of entPhysicalIndex for the physical entity that contains this physical entity. A value of 0 indicates this physical entity is not contained in any other physical entity. Range: 0..2147483647 Integer None entPhysical Class An indication of the general hardware type of the physical entity. other(1), unknown(2), chassis(3), backplane(4), container(5), powerSupply(6), fan(7), sensor(8), module(9), port(10), stack(11) Integer None entPhysical FirmwareRev The vendor-specific firmware revision string for the physical entity. Size: 0..255 String Zerolength string78 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Managing Clock Settings, Event Log, Syslog Receiver, and Alert Rules (R) ? View and Set Clock Settings Note – You can use the get and set commands to view and set clock settings with respect to Network Time Protocol (NTP) synchronization. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password 2. Refer to the following SNMP commands for examples: ¦ To view the NTP server state, type: Description Links SNMP procedure and valid MIB objects to view and set clock settings • “View and Set Clock Settings” on page 78 SNMP procedure and valid MIB objects to view and clear the ILOM event log • “View and Clear the ILOM Event Log” on page 79 SNMP procedure and valid MIB objects to configure remote syslog receiver IP addresses • “Configure Remote Syslog IP Destinations” on page 81 SNMP procedure and valid MIB objects to configure alert rules • “Configure Severity Level Alert Rule” on page 82 % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlNTPEnabled.0Manage Component Information and Email Alerts (SNMP) 79 ¦ To set the NTP server state to enabled, type: ¦ To view the date and time of the device, type: ¦ To set the date and time of the device, type: The following table describes the valid SNMP MIB objects for Oracle ILOM clock properties. ? View and Clear the ILOM Event Log Note – You can use the get command to view the ILOM event log and the set command to configure the ILOM event log. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlNTPEnabled.0 i 1 % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlDateAndTime.0 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlDateAndTime.0 s 2008-3-24,4:59:47.0 MIB Object Description Allowed Values Type Default ilomCtrlDateAnd Time The date and time of the device. date/time String None ilomCtrlNTP Enabled Specifies whether the Network Time Protocol is enabled. true(1), false(2) Integer false ilomCtrlTimezone The configured time zone string. Size: 0..255 String None80 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 2. To view the ILOM event log type for an event log with a record ID of 2, type: 3. To clear the ILOM event log, type: The following table describes the ILOM Event Logs SNMP MIB objects. % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlEventLogType.2 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlEventLogClear.0 i 1 MIB Object Description Allowed Values Type Default ilomCtrlEvent Log RecordID The record number for a given event log entry. Note - This object is not accessible. Range: 1..10000 Integer None ilomCtrlEvent Log Type An integer representing the type of event. Note - This object is read-only. log(1), action2), fault(3), state(4), repair(5) Integer None ilomCtrlEvent LogTimestamp The date and time that the event log entry was recorded. Note - This object is read-only. date/time String None ilomCtrlEvent LogClass An integer representing the class of event. Note - This object is read-only. audit(1), ipmi(2), chassis(3 ), fma(4), system(5) pcm(6) Integer None ilomCtrlEvent Log Severity The event severity corresponding to the given log entry. Note - This object is read-only. disable(1 ), critical( 2), major(3), minor(4), down(5 Integer None ilomCtrlEvent Log Description A textual description of the event. Note - This object is read-only. description String NoneManage Component Information and Email Alerts (SNMP) 81 ? Configure Remote Syslog IP Destinations Note – You can use the get and set commands to view and set IP addresses for a remote syslog receiver. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password 2. To view a remote syslog destination IP address, type: 3. To set a remote syslog destination IP address, type: The following table describes the Syslog IP Destinations SNMP MIB objects. ilomCtrlEvent Log Clear Setting this object to true clears the event log. true(1), false(2) Integer None % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlRemoteSyslogDest1.0 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlRemoteSyslogDest1.0 s ip_address MIB Object Description Values Type Default ilomCtrlRemote SyslogDest1 The IP address of the first remote syslog destination (log host). ip_address String None ilomCtrlRemote SyslogDest2 The IP address of the second remote syslog destination (log host). ip_address String None MIB Object Description Allowed Values Type Default82 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Configure Severity Level Alert Rule Note – You can use the get and set commands to view and configure alert rule configurations. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password 2. To view the severity level for the alert rule with an alert ID of 2, type: 3. To set the severity level to critical for the alert rule with an alert ID of 2, type: The following table describes the Alert Rule Severity Level SNMP MIB objects. Note – Oracle ILOM does not support alert level filtering for SNMP traps. To enable the sending of an SNMP trap (but not filter the SNMP trap by alert level) you can choose one of the following severity levels: Minor, Major, Critical, or Down. To disable the sending of an SNMP trap, you must choose the Disabled option. % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlAlertSeverity.2 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlAlertSeverity.2 i 2 MIB Object Description Allowed Values Type Default ilomCtrlAlert ID An integer ID associated with a given alert rule. Note - This object is not accessible. Range: 0..65535 Integer None ilomCtrlAlert Severity Specifies the minimum event severity that should trigger an alert for a given class. disable(1), critical(2), major(3), minor(4), down(5) Integer NoneManage Component Information and Email Alerts (SNMP) 83 ilomCtrlAlert Type Specifies the type of notification for a given alert. If the type is snmptrap(2) or ipmipet(3), the ilomCtrlAlertDestination ip must be specified. If the type is email(1), the ilomCtrlAlert DestinationEmail must be specified. email(1) snmptrap(2) ipmipet(3) remotesyslog (4) Integer None ilomCtrlAlert Destinationip Specifies the IP address to send alert notifications to when the alert type is snmptrap(2), ipmipet(3), or remotesyslog(4). ip_address String None ilomCtrlAlert Destination Email Specifies the email address to send alert notifications to when the alert type is email(1). email address, size: 0..255 String None ilomCtrlAlert SNMPVersion Specifies the version of SNMP trap that should be used for the given alert rule. v1(1), v2c(2), v3(3) Integer None ilomCtrlAlert SNMPCommunity OrUsername Specifies the community string to be used when the ilomCtrlAlertSNMPVersion property is set to v1(1) or v2c(2). Specifies the SNMP user name to use when the ilomCtrlAlertSNMPVersion is set to v3(3). Size: 0..255 String None ilomCtrlAlert EmailEvent ClassFilter A class name or all to filter emailed alerts on. Size: 0..255 String None ilomCtrlAlert EmailEventType Filter A class name or all to filter emailed alerts on. Size 0..255 String None MIB Object Description Allowed Values Type Default84 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Configuring SMTP Client for Email Alert Notifications (R) ? Configure SMTP Client for Alert Notification (SNMP) Before You Begin ¦ To generate configured email notification alerts, you must enable the ILOM client to act as an SMTP client to send the email alert messages. To enable the ILOM client as an SMTP client, you must specify the IP address and port number of an outgoing SMTP email server that will process the email notifications. ¦ Prior to enabling the ILOM client as an SMTP client, gather the IP address and port number of the outgoing SMTP email server. ¦ You can use the get and set commands to configure the SMTP client. For a description of the MIB objects used in this procedure, see Valid SMTP Client MIB Objects and the SUN-ILOM-CONTROL-MIB. Note – For a description of valid MIB objects for this procedure, see the table following this procedure. To configure SMTP Client properties in Oracle ILOM, follow these steps: 1. Log in to a host that has an SNMP tool and the Oracle ILOM MIBs installed. For example, type: ssh username@snmp_manager_ip_address Password: password 2. Refer to the following SNMP commands for examples: ¦ To view a SMTP client state, type: Description Links Procedure for configuring SMTP email alert notification • “Configure SMTP Client for Alert Notification (SNMP)” on page 84 % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPEnabled.0Manage Component Information and Email Alerts (SNMP) 85 ¦ To set a SMTP client state to enabled, type: ¦ To view a SMTP server IP address, type: ¦ To set a SMTP server IP address, type: ¦ To view a SMTP client port number, type: ¦ To set a SMTP client port number, type: ¦ To view an optional format to identify the sender or the “from” address, type: ¦ To configure an optional format to identify the sender or the “from” address, type: % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPEnabled.0 i 1 % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPServerip.0 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPServerip.0 s ip_address % snmpget -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPPortNumber.0 % snmpset -v2c -cprivate -mALL SNMP_agent_ip_address ilomCtrlSMTPPortNumber.0 i 25 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSMTPCustomSender.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSMTPCustomSender.0 s ‘ilom-alert@HOSTNAME.abc.com’86 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 The following table describes the SMTP Email Alert Notification SNMP MIB objects. Configuring Email Alert Settings (SNMP) (R) ? Manage Email Alert Settings (SNMP) Note – You can use the get and set commands to view and configure email alert settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: MIB Object Property Allowed Values Type Default ilomCtrlSMTP Enabled Specifies whether or not the SMTP client is enabled. true(1), false(2) Integer false ilomCtrlSMTP Serverip The IP address of the SMTP server used as a name service for user accounts. ip_address String None ilomCtrlSMTP PortNumber Specifies the port number for the SMTP client. Range: 0..65535 Integer None Description Links SNMP procedure to view or configure email alert settings in ILOM • “Manage Email Alert Settings (SNMP)” on page 86Manage Component Information and Email Alerts (SNMP) 87 ¦ To view the optional format used to identify the sender or the “from” address, type: ¦ To set the optional format used to identify the sender or the “from” address, type: ¦ To view an optional string that can be added to the beginning of the message body, type: ¦ To define an optional string (for example: BeginMessage) that can be added to the beginning of the message body, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlAlertEmailCustomSender.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlAlertEmailCustomSender.0 s ‘ilom-alert@HOSTNAME.abc.com’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlAlertEmailMessagePrefix.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlAlertEmailMessagePrefix.0 s ‘BeginMessage’88 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Configuring Telemetry Harness Daemon (SNMP) (R) ? Manage Telemetry Harness Daemon Settings (SNMP) Note – You can use the get and set commands to view and configure Telemetry Harness Daemon (THD) settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the state of the THD daemon, type: ¦ To view the control action for THD daemon, type: ¦ To set the control action for THD daemon to suspend, type: Description Links SNMP procedure for configuring telemetry harness daemon settings • “Manage Telemetry Harness Daemon Settings (SNMP)” on page 88 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdState.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdAction.0 i 1Manage Component Information and Email Alerts (SNMP) 89 ¦ To view the description of the THD module named THDMod1, type: ¦ To view the state of the THD module named THDMod1, type: ¦ To view the control action for the THD module named THDMod1, type: ¦ To set the control action for the THD module named THDMod1 to suspend, type: ¦ To view the state of the THD instance named myTHDinstance that is in the THD class named myTHDclase, type: ¦ To view the action of the THD instance named myTHDinstance that is in the THD class named myTHDclase, type: ¦ To set the action of the THD instance named myTHDinstance that is in the THD class named myTHDclase to resume, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdModuleDesc.’THDMod1’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdModuleState.’THDMod1’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdModuleAction.’THDMod1’ % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdModuleAction.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdInstanceState.’myTHDclass.myTHDinstance’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdInstanceAction.’myTHDclass.myTHDinstance’ % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlThdInstanceAction.’myTHDclass.myTHDinstance’ i 290 Oracle ILOM 3.0 Protocol Management Reference Guide • May 201191 Monitor and Manage System Power (SNMP) (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, power management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, power management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, power management Description Links Review SNMP requirements for managing system power properties • “Before You Begin - Power Management (SNMP)” on page 92 SMP procedures for monitoring the power consumption interfaces • “Monitoring the Power Consumption Interfaces (SNMP)” on page 93 SNMP procedure for maintaining the system power policy • “Maintaining System Power Policy (SNMP)” on page 99 SNMP procedures for applying power to the system • “Managing System Power Properties (SNMP)” on page 10092 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Before You Begin - Power Management (SNMP) (R) Prior to performing the procedures in this section, you should ensure that the following requirements are met. ¦ Before you can use SNMP to view and configure ILOM settings, you must configure SNMP. For more information, see “Configuring SNMP Settings in Oracle ILOM” on page 7. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user with read-write (rw) privileges. Note – For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work as presented only if you have Net-SNMP and the Net-SNMP sample applications installed.Monitor and Manage System Power (SNMP) 93 Monitoring the Power Consumption Interfaces (SNMP) (R) Note – The power consumption interfaces described in this section might or might not be implemented on the platform that you are using. See the platform-specific ILOM supplement, platform administration guide, or product notes included with your system for implementation details. Note – The ability to view and set the power policy is not available on SPARC platforms using ILOM 3.0 or ILOM 3.0.2. The power policy setting is available on some SPARC platforms starting with ILOM 3.0.3. ? Monitor System Total Power Consumption (SNMP) ? To view total system power consumption using SNMP, type: entPhysicalName.indexnumber For example: Description Links SNMP procedures for monitoring the power consumption interfaces • “Monitor System Total Power Consumption (SNMP)” on page 93 • “Monitor Actual Power Consumption (SNMP)” on page 94 • “Monitor Individual Power Supply Consumption (SNMP)” on page 95 • “Monitor Available Power (SNMP)” on page 97 • “Monitor Hardware Configuration Maximum Power Consumption (SNMP)” on page 97 • “Monitor Permitted Power Consumption (SNMP)” on page 97 % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress entPhysicalName.30894 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Monitor Actual Power Consumption (SNMP) ? To view actual power consumption using SNMP, type: sunHwCTrlPowerMgmtActual.o For example: % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtActual.0Monitor and Manage System Power (SNMP) 95 ? Monitor Individual Power Supply Consumption (SNMP) ? To view the power consumption of an individual power supply, type entPhysicalName followed by the power input or power output index numbers. For example, if you know that the entPhysicalIndex of /SYS/VPS is 303, you can view total output power consumption by typing the following command: The following table provides a brief description of each of the MIB objects included in the Power Supply Power Consumption SNMP MIB Objects command example. For more information, see the ENTITY-MIB and the SUN-PLATFORM-MIB. % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress \ entPhysicalName.303 \ entPhysicalClass.303 \ entPhysicalDescr.303 \ sunPlatNumericSensorBaseUnits.303 \ sunPlatNumericSensorExponent.303 \ sunPlatNumericSensorCurrent.303 \ sunPlatNumericSensorLowerThresholdNonCritical.303 \ sunPlatNumericSensorUpperThresholdNonCritical.303 \ sunPlatNumericSensorLowerThresholdCritical.303 \ sunPlatNumericSensorUpperThresholdCritical.303 \ sunPlatNumericSensorLowerThresholdFatal.303 \ sunPlatNumericSensorUpperThresholdFatal.303 MIB Object MIB Name Description entPhysicalName ENTITY-MIB The textual name of the physical entity. entPhysicalClass ENTITY-MIB The general hardware type of the physical entity. entPhysicalDescr ENTITY-MIB A textual description of physical entity. sunPlatNumeric SensorBaseUnits SUN-PLATFORM-MIB The base unit of the values returned by this sensor as per CIM_NumericSensor.BaseUnits. sunPlatNumeric SensorExponent SUN-PLATFORM-MIB The exponent to be applied to the units returned by this sensor as for CIM_NumericSensor.UnitModifier.96 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 sunPlatNumeric SensorCurrent SUN-PLATFORM-MIB The sunPlatDiscreteSensorStatesIndex of a row in the sunPlatDiscreteSensorStatesTab le that corresponds to the current reading of the sensor. sunPlatNumeric SensorLower ThresholdNon Critical SUN-PLATFORM-MIB The lower threshold at which a non-critical condition occurs as defined for CIM_NumericSensor.LowerThresho ld NonCritical. sunPlatNumeric SensorUpper ThresholdNon Critical SUN-PLATFORM-MIB The upper threshold at which a non-critical condition occurs as defined for CIM_NumericSensor.UpperThresho ld NonCritical. sunPlatNumeric SensorLower ThresholdCritical SUN-PLATFORM-MIB The lower threshold at which a critical condition occurs as defined for CIM_NumericSensor.LowerThresho ld Critical. sunPlatNumeric SensorUpper ThresholdCritical SUN-PLATFORM-MIB The upper threshold at which a critical condition occurs as defined for CIM_NumericSensor.UpperThresho ld Critical. sunPlatNumeric SensorLower ThresholdFatal SUN-PLATFORM-MIB The lower threshold at which a fatal condition occurs as defined for CIM_NumericSensor.LowerThresho ld Fatal. sunPlatNumeric SensorUpper ThresholdFatal SUN-PLATFORM-MIB The upper threshold at which a fatal condition occurs as defined for CIM_NumericSensor.UpperThresho ld Fatal. MIB Object MIB Name DescriptionMonitor and Manage System Power (SNMP) 97 ? Monitor Available Power (SNMP) ? To view total available power using SNMP, type: sunHwCTrlPowerMgmtAvailablePower.0 For example: ? Monitor Hardware Configuration Maximum Power Consumption (SNMP) ? To view the hardware configuration maximum power consumption using SNMP, type: sunHwCtrlPowerMgmtHWConfigPower.0 For example: ? Monitor Permitted Power Consumption (SNMP) ? To view permitted power consumption using SNMP, type: sunHwCtrlPowerMgmtPermittedPower.0 For example: ? Monitor Power Management Properties (SNMP) Note – You can use the get command to view power management settings. For a description of the MIB objects used in these commands, see the SUN-HW-CTRL-MIB. % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtAvailablePower.0 % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtHWConfigPower.0 % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtPermittedPower.098 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To monitor various power consumption properties on a managed device, see the following SNMP command examples. ¦ To view the name of the power management policy for PowerMgmtTable index number 5, type: sunHwCtrlPowerMgmtName.5 ¦ To view the units for the value of the power management policy for PowerMgmtTable index number 5, type: sunHwCtrlPowerMgmtUnits.5 ¦ To view the value of the power management policy for PowerMgmtTable index number 5, type: sunHwCtrlPowerMgmtValue.5 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress sunHwCtrlPowerMgmtName.5 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress sunHwCtrlPowerMgmtUnits.5 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress sunHwCtrlPowerMgmtValue.5Monitor and Manage System Power (SNMP) 99 Maintaining System Power Policy (SNMP) (R) ? View and Set the Power Policy (SNMP) Note – You can use the get and set commands to view and set power policy. For a description of valid MIB objects for this procedure, see the table following this procedure. 1. To view the power policy using SNMP, type: sunHwCtrlPowerMgmtPolicy.0 2. To set the power policy, use the snmpset command. For example, to set this MIB object property to performance, type: sunHwCtrlPowerMgmtPolicy.0 i 3 The following table describes the System Power Policy SNMP MIB object. Description Links SNMP procedure for managing ILOM’s system power policy • “View and Set the Power Policy (SNMP)” on page 99 % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtPolicy.0 % snmpset -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtPolicy.0 i 3 MIB Object Values Type Default sunHwCtrlPowerMgmtPolicy notsupported(1), unknown(2), performance(3), elastic(4) Integer None100 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Managing System Power Properties (SNMP) (TT) ? Power On System (SNMP) Note – You can use the set command to configure the power setting. For a description of the MIB object used in this command, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To power on the power control target named ‘/SYS’, type the following SNMP command ilomCtrlPowerAction .’/SYS’ i 1 ? Reset System Power (SNMP) Note – You can use the set command to configure the reset setting. For a description of the MIB objects used in this command, see the SUN-ILOM-CONTROL-MIB. Description Links SNMP procedure to power on the managed interface • “Power On System (SNMP)” on page 100 SNMP procedure to reset the power on the managed interface • “Reset System Power (SNMP)” on page 100 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlPowerAction.’/SYS’ i 1Monitor and Manage System Power (SNMP) 101 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. To reset the control target named ‘/SP’, type: ilomCtrlResetAction.’/SP’ i 1 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlResetAction.’/SP’ i 1102 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011103 Manage Oracle ILOM Firmware Updates (SNMP) (G) Related Information ¦ Oracle ILOM 3.0 Maintenace and Diagnostics, Oracle ILOM firmware operations ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, updating Oracle ILOM firmware Description Links Maintain Oracle ILOM firmware updates using SNMP. • “Update Oracle ILOM Firmware (SNMP)” on page 104104 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Update Oracle ILOM Firmware (SNMP) Before You Begin ¦ Before you can use SNMP to view and configure ILOM settings, you must configure SNMP. For more information, see “Configuring SNMP Settings in Oracle ILOM” on page 7. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user with read-write (rw) privileges. ¦ For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – You can use the get and set commands to view and configure ILOM firmware settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work as presented only if you have Net-SNMP and the Net-SNMP sample applications installed. To update the Oracle ILOM firmware using SNMP, follow these steps: 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the version of the current firmware image, type: ¦ To view the build number of the current firmware image, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtBuildNumber.0Manage Oracle ILOM Firmware Updates (SNMP) 105 ¦ To view the build date and time of the current firmware image, type: ¦ To view the IP address of the TFTP server that will be used to download the firmware image, type: ¦ To set the IP address of the TFTP server that will be used to download the firmware image, type: ¦ To view the relative path of the new firmware image file on the TFTP server, type: ¦ To set the relative path of the new firmware image file on the TFTP server, type: ¦ To view the property that determines whether the previous configuration of the server should be preserved after a firmware update, type: ¦ To set the PreservConfig property to true so that the previous configuration of the server is preserved after a firmware update, type: ¦ To view the property that indicates the status of a firmware update, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtBuildDate.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareTFTPServerIP.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareTFTPServerIP.0 s ipaddress % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareTFTPFileName.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareTFTPFileName.0 s ‘tftpfilename’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwarePreserveConfig.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwarePreserveConfig.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtStatus.0106 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To view the property that is used to initiate a firmware update using the values of the other firmware management properties as parameters, type: ¦ To set the property so as to initiate a firmware update using the values of the other firmware management properties as parameters, type: ¦ To clear the values of the other firmware management properties used if and when a firmware update is initiated, type: ¦ To view the version of the current firmware management file system, type: ¦ To view the property that is used to postpone the BIOS upgrade until the next server power off, type: ¦ To set the DelayBIOS property to postpone the BIOS upgrade until the next server power off, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtAction.0 i 2 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtAction.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareMgmtFilesystemVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareDelayBIOS.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlFirmwareDelayBIOS.0 i 1107 Manage ILOM Backup and Restore Configurations (SNMP) (G) Related Information ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, configuration management overview ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, backing up and restoring the Oracle ILOM configuration Description Links SNMP procedure for maintaining ILOM backup and restore properties. • “View and Configure Backup and Restore Properties (SNMP)” on page 108108 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? View and Configure Backup and Restore Properties (SNMP) Before You Begin ¦ Before you can use SNMP to view and configure ILOM settings, you must configure SNMP. For more information, see “Configuring SNMP Settings in Oracle ILOM” on page 7. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user with read-write (rw) privileges. Note – You can use the get and set commands to view and configure backup and restore settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. Note – For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work as presented only if you have Net-SNMP and the Net-SNMP sample applications installed. To set the Oracle ILOM backup and restore properties using SNMP, follow these steps: 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the power policy using SNMP, type: % snmpget -v2c -cprivate -mALL snmp_agent_ipaddress sunHwCtrlPowerMgmtPolicy.0Manage ILOM Backup and Restore Configurations (SNMP) 109 ¦ To configure the power property and apply it to the power control target named ‘/SYS’, type: ¦ To restore the configuration on the SP to the original factory default state, type: ¦ To view the target destination of the configuration XML file during the backup and restore operation, type: ¦ To set the target destination of the configuration XML file during the backup and restore operation to tftp://10.8.136.154/remotedir/config_backup.xml, type: ¦ To set the passphrase to encrypt or decrypt sensitive data during the backup and restore operation, type: ¦ To view the property used to issue an action, either backup or restore, type: ¦ To issue a restore action using the ilomCtrlBackupAndRestoreAction MIB object, type: ¦ To monitor the current status of the backup or restore operation, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlPowerAction.’/SYS’ i 1 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlResetToDefaultsAction.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress lomCtrlBackupAndRestoreTargetURI.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlBackupAndRestoreTargetURI.0 s ‘tftp://10.8.136.154/remotedir/config_backup.xml’ % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlBackupAndRestorePassphrase.0 s ‘passphrase’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlBackupAndRestoreAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlBackupAndRestoreAction.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlBackupAndRestoreActionStatus.0110 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To specify the reset action and apply it to the reset control target named ‘/SP’, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlResetAction.’/SP’ i 1111 Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP)(G) Related Information ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, system diagnostics overview ¦ Oracle ILOM 3.0 Maintenance and Diagnostics, SPARC diagnostics tools ¦ Oracle’s Sun SPARC Enterprise Server, diagonostic tools overview ¦ Oracle’s Sun SPARC Enterprise Server, POST overview and examples ¦ Oracl’s Sun SPARC Enterprise Server, boot mode overview Description Links Review requirements for managing SPARC cconfiguration management interfaces • “Before You Begin - Manage SPARC Hosts (SNMP)” on page 112 SNMP procedures for managing SPARC management interface properties • “Managing SPARC Diagnostic, POST, and Boot Mode Properties (SNMP)” on page 113112 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Before You Begin - Manage SPARC Hosts (SNMP) (R) Prior to performing the SNMP procedures for managing SPARC diagnostics, POST, and boot mode properties, you should ensure that the following requirements are met. ¦ Before you can use SNMP to view and configure ILOM settings, you must configure SNMP. For more information, see “Configuring SNMP Settings in Oracle ILOM” on page 7. ¦ To execute the snmpset command, you need to use an SNMP v1 or v2c community or an SNMP v3 user with read-write (rw) privileges. ¦ For examples of SNMP commands, see “SNMP Command Examples” on page 265. Note – The example SNMP commands presented in this section are based on the Net-SNMP sample applications and, therefore, will work as presented only if you have Net-SNMP and the Net-SNMP sample applications installed.Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 113 Managing SPARC Diagnostic, POST, and Boot Mode Properties (SNMP) (TT) ? Manage SPARC Host Diagnostic Properties (SNMP) Note – You can use the get and set commands to view and configure SPARC diagnostic settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the triggers of embedded diagnostics for the host, type: Description Links SNMP procedures for configuring SPARC remote host diagnostic properties • “Manage SPARC Host Diagnostic Properties (SNMP)” on page 113 SNMP procedures for configuring SPARC remote host control properties • “Manage SPARC Host POST Operations (SNMP)” on page 116 SNMP procedures for configuring SPARC remote host boot properties • “Manage SPARC Host Boot Mode Properties (SNMP)” on page 119 SNMP procedurefor configuring SPARC remote host keysitch properties • “Manage SPARC Host Keyswitch Property (SNMP)” on page 121 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsTrigger.0114 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To set the triggers of embedded diagnostics for the host to power-on-reset, type: ¦ To view the modes for POST, type: ¦ To set the POST mode to service, type: ¦ To view the level of embedded diagnostics that should be run on the host during a boot for the power-on-reset trigger, type: ¦ To set the level of embedded diagnostics that should be run on the host during a boot for the power-on-reset trigger to normal, type: ¦ To view the level of embedded diagnostics that should be run on the host during a boot for the user-reset trigger, type: ¦ To set the level of embedded diagnostics that should be run on the host during a boot for the user-reset trigger to normal, type: ¦ To view the level of embedded diagnostics that should be run on the host during a boot for the error-reset trigger, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsTrigger.0 i 4 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsMode.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsMode.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsPowerOnLevel.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsPowerOnLevel.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsUserResetLevel.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsUserResetLevel.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsErrorResetLevel.0Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 115 ¦ To set the level of embedded diagnostics that should be run on the host during a boot for the error-reset trigger to normal, type: ¦ To view the verbosity level of embedded diagnostics that should be run on the host during a boot, type: ¦ To set the verbosity level of embedded diagnostics that should be run on the host during a boot to maximum, type: ¦ To view the verbosity level of embedded diagnostics that should be run on the host during a boot for user-reset trigger, type: ¦ To set the verbosity level of embedded diagnostics that should be run on the host during a boot for user-reset trigger to maximum, type: ¦ To view the verbosity level of embedded diagnostics that should be run on the host during a boot for error-reset trigger, type: ¦ To set the verbosity level of embedded diagnostics that should be run on the host during a boot for error-reset trigger to maximum, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsErrorResetLevel.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsPowerOnVerbosity.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsPowerOnVerbosity.0 i 4 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsUserResetVerbosity.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsUserResetVerbosity.0 i 4 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsErrorResetVerbosity.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsErrorResetVerbosity.0 i 4116 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To view the progress of POST diagnostics on the host, expressed as a percentage, type: ¦ To view the property that shows the action to control the POST diagnostics on the host, type: ¦ To set the property to take control of the POST diagnostics running on the host to start, type: ? Manage SPARC Host POST Operations (SNMP) Note – You can use the get and set commands to view and configure SPARC host settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the starting MAC address for the host, type: ¦ To view the version string for OpenBoot PROM (OBP), type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsStatus.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCDiagsAction.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostMACAddress.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostOBPVersion.0Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 117 ¦ To view the version string for POST, type: ¦ To view the option that determines whether the host should continue to boot in the event of a non-fatal POST error, type: ¦ To configure the host to continue to boot in the event of a non-fatal POST error, type: ¦ To view the string that describes the status of POST, type: ¦ To view the option that determines what action the SP will take when it discovers that the host is hung, type: ¦ To configure the SP to reset when it discovers that the host is hung, type: ¦ To view the string that describes the boot status of host operating system, type: ¦ To view the boot timer time-out value, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostPOSTVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostAutoRunOnError.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostAutoRunOnError.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostPOSTStatus.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostAutoRestartPolicy.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostAutoRestartPolicy.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostOSBootStatus.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootTimeout.0118 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To set the boot timer time-out value to 30 seconds, type: ¦ To view the property that determines what action the SP will take when the boot timer expires, type: ¦ To configure the SP to reset when the boot timer expires, type: ¦ To view the maximum number of boot failures allowed by the SP, type: ¦ To set the maximum number of boot failures allowed by the SP to 10, type: ¦ To view the property that determines what action the SP will take when the maximum number of boot failures is reached, type: ¦ To configure the SP to power cycle the host when the maximum number of boot failures is reached, type: ¦ To view the version string for the Hypervisor, type: % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootTimeout.0 i 30 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootRestart.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootRestart.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostMaxBootFail.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostMaxBootFail.0 i 10 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootFailRecovery.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostBootFailRecovery.0 i 2 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostHypervisorVersion.0Manage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 119 ¦ To view the version string for the system firmware (SysFw), type: ¦ To view the property that determines the break action that SP will send, type: ¦ To configure the SP to send a dumpcore break action, type: ¦ To view the property that determines the host I/O reconfiguration policy to apply on next host power-on, type: ¦ To configure the SP to execute the host I/O reconfiguration policy on the next power-on, type: ? Manage SPARC Host Boot Mode Properties (SNMP) Note – You can use the get and set commands to view and configure SPARC boot mode settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostSysFwVersion.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostSendBreakAction.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostSendBreakAction.0 i 3 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostIoReconfigurePolicy.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCHostIoReconfigurePolicy.0 i 3120 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ¦ To view the boot mode state for the host, type: ¦ To configure the host to retain current NVRAM variable settings, type: ¦ To view the boot script to use when the boot mode state is set to script, type: ¦ To specify the boot script to use when the boot mode state is set to ‘setenv diag-switch’, type: ¦ To view date and time when the boot mode configuration will expire, type: ¦ To view the string that refers to the LDOM configuration name, type: ¦ To set the LDOM configuration name to default, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeState.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeState.0 i 1 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeScript.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeScript.0 s ‘setenv diag-switch’ % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeExpires.0 % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeLDOMConfig.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCBootModeLDOMConfig.0 s defaultManage SPARC Diagnostics, POST, and Boot Mode Operations (SNMP) 121 ? Manage SPARC Host Keyswitch Property (SNMP) Note – You can use the get and set commands to view and configure SPARC key switch settings. For a description of the MIB objects used in these commands, see the SUN-ILOM-CONTROL-MIB. 1. Log in to a host that has an SNMP tool and the ILOM MIBs installed. For example, type: ssh username@snmp_manager_ipaddress Password: password 2. Refer to the following SNMP command examples: ¦ To view the current state of the virtual key switch, type: ¦ To set the state of the virtual key switch to standby, type: % snmpget -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCKeySwitchState.0 % snmpset -mALL -v2c -cprivate SNMP_agent_ipaddress ilomCtrlSPARCKeySwitchState.0 i 2122 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011123 Server Managment Using IPMI (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, user management ¦ Oracle ILOM 3.0 Daily Management Concepts, alert management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, user management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, CLI overview ¦ Oracle ILOM 3.0 Daily Management Web Procedures, user management Description Links Learn about using IPMItool to manage Oracle servers • “Intelligent Platform Management Interface (IPMI)” on page 124 • “About IPMI” on page 124 • “IPMItool” on page 125 • “IPMI Alerts” on page 125 • “IPMI Administrator and Operator Roles” on page 126 Learn how to configure the IPMI state and perform various mangement functions using the IPMItool • “Configuring the IPMI State” on page 127 • “Using IPMItool to Run ILOM CLI Commands” on page 128 • “Performing System Management Tasks (IPMItool)” on page 130 Learn about the IPMI commands • “IPMItool Utility and Command Summary” on page 139124 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Intelligent Platform Management Interface (IPMI) (G) ¦ “About IPMI” on page 124 ¦ “IPMItool” on page 125 ¦ “IPMI Alerts” on page 125 ¦ “IPMI Administrator and Operator Roles” on page 126 About IPMI (C) ILOM supports the Intelligent Platform Management Interface (IPMI), which enables you to monitor and control your server platform, as well as to retrieve information about your server platform. IPMI is an open, industry-standard interface that was designed for the management of server systems over a number of different types of networks. IPMI functionality includes field-replaceable unit (FRU) inventory reporting, system monitoring, logging of system events, system recovery (including system resets and power-on and power-off capabilities), and alerting. The monitoring, logging, system recovery, and alerting functions available through IPMI provide access to the manageability that is built into the platform hardware. ILOM is compliant with IPMI v1.5 and v2.0. An Oracle-provided Windows port of IPMItool is available at: (http://www.sun.com/system-management/tools.jsp) Additional information, including detailed specifications about IPMI, is available at the following sites: ¦ (http://www.intel.com/design/servers/ipmi/spec.htm) ¦ (http://openipmi.sourceforge.net) The service processors (SPs) on your servers and server modules (blades) are IPMI v2.0 compliant. You can access IPMI functionality through the command line using the IPMItool utility either in-band (using the host operating system running on the server) or out-of-band (using a remote system). Additionally, you can generate IPMI-specific traps from the ILOM web interface, or manage the SP’s IPMI functions from any external management solution that is IPMI v1.5 or v2.0 compliant.Server Managment Using IPMI 125 IPMItool (C) IPMItool is an open-source, simple command-line interface (CLI) utility for managing and configuring IPMI-enabled devices. IPMItool can be used to manage the IPMI functions of either the local system or a remote system. You can use the IPMItool utility to perform IPMI functions with a kernel device driver or over a LAN interface. You can download IPMItool from this site: (http://ipmitool.sourceforge.net/) You can do the following with IPMItool: ¦ Read the Sensor Data Record (SDR) repository. ¦ Print sensor values. ¦ Display the contents of the system event log (SEL). ¦ Print field-replaceable unit (FRU) inventory information. ¦ Read and set LAN configuration parameters. ¦ Perform remote chassis power control. Detailed information about IPMItool is provided in a man page that is available from this site: (http://ipmitool.sourceforge.net/manpage.html) IPMItool supports a feature that enables you to enter ILOM command-line interface (CLI) commands just as though you were using the ILOM CLI directly. CLI commands can be scripted, and then the script can be run on multiple service processor (SP) instances. IPMI Alerts (C) ILOM supports alerts in the form of IPMI Platform Event Trap (PET) alerts. Alerts provide advance warning of possible system failures. Alert configuration is available from the ILOM SP on your server or server module .IPMI PET alerts are supported on all Oracle Sun server platforms and modules, with the exception of the chassis monitoring module (CMM). For more information about the types of IPMI alerts, refer to “Alert Management” in the Oracle ILOM 3.0 Daily Management Concepts Guide.126 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 IPMI Administrator and Operator Roles (R) The IPMI Administrator role maps to these user roles in ILOM: aucro. The IPMI Operator role maps to these user roles in ILOM: cro. A brief explanation of these ILOM roles appears in the following table. For more information about ILOM roles and privileges, refer to “User Management” in the Oracle ILOM 3.0 Daily Management Concepts Guide. TABLE: IPMI Administrator and Operator Roles in ILOM IPMI Role Enabled ILOM Role Privileges Description Administrator • Admin (a) • User Management (u) • Console (c) • Reset and Host Console (r) • Read-Only (o) These user roles enable read and write privileges to these management features in ILOM: system management configuration properties, user account properties, remote console management properties, remote power management properties, and reset and host control management properties. Operator • Console (c) • Reset and Host Console (r) • Read-Only (o) These user roles enable read and write privileges to these management features in ILOM: remote console management properties, remote power management properties, and reset and host control management properties. The Read-Only role also provides read access to system management configuration properties and user management properties.Server Managment Using IPMI 127 Configuring the IPMI State (R) ? Enable IPMI State (CLI) 1. Log in to the ILOM CLI. using an account with IPMI Admistrator privileges. For more information about enabling IPMi adminstrator privileges, see “IPMI Administrator and Operator Roles” on page 126. 2. At the command prompt, type: -> set /SP/services/ipmi servicestate=enabled For example: ? Enable IPMI State (Web) 1. Log in to the ILOM web interface using an account with IPMI adminstrator privileges. For more information about enabling IPMi adminstrator privileges, see “IPMI Administrator and Operator Roles” on page 126. 2. Click Configuration --> System Management Access --> IPMI. The IPMI Settings page appears. 3. Click the check box to enable or disable the IPMI state. Description Links ILOM CLI procedure to enable the IPMI state “Enable IPMI State (CLI)” on page 127 ILOM web interface procedure to enable the IPMI state “Enable IPMI State (Web)” on page 127 -> set /SP/services/ipmi servicestate=enabled Set ‘servicestate’ to ‘enabled’128 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Using IPMItool to Run ILOM CLI Commands (G) The IPMItool CLI is a convenient alternative method to executing ILOM CLI commands. It enables you to enter ILOM CLI commands just as if you were using the ILOM CLI directly. Most ILOM CLI commands are supported. Before You Begin - IPMItool and ILOM Requirements (R) ¦ To use the ILOM CLI through IPMItool, you must be using IPMItool version 1.8.9.4 or later. To check the version number of IPMItool, type: ipmitool -V ¦ Ensure that you have the proper user roles assigned in ILOM when using the IPMItool CLI to execute ILOM commands. For more information, see “IPMI Administrator and Operator Roles” on page 126. ? Access the ILOM CLI From IPMItool 1. To enable the ILOM CLI using IPMItool, type: # ipmitool -H hostname -U username -P userpassword sunoem cli The ILOM CLI prompt appears as follows: Description LInks Requirements for using IPMItool to run ILOM CLI commands “Before You Begin - IPMItool and ILOM Requirements” on page 128 Procedure for enableing you to use the IPMItool to run CLI commands “Access the ILOM CLI From IPMItool” on page 128 Create and run ILOM CLI command scripts “Scripting ILOM CLI Commands With IPMItool” on page 129 Connected. Use ^D to exit. ->Server Managment Using IPMI 129 2. To use the CLI, type CLI commands. To script ILOM CLI commands, see “Scripting ILOM CLI Commands With IPMItool” on page 129. Scripting ILOM CLI Commands With IPMItool (R) A key benefit of using ILOM CLI from IPMItool is that the CLI commands can be scripted and then the script can be run on multiple SP instances. Scripting is possible because the CLI commands can be included on the IPMItool command line where each argument on the command line is treated as a separate ILOM CLI command. Command separation is archived by including quotation marks at the beginning and end of each ILOM CLI command. The following example shows how to include two CLI commands on the IPMItool command line. In the example, notice that each ILOM CLI command begins and ends with quotation marks. # ipmitool -H hostname -U username -P userpassword sunoem cli “show /SP/services” “show /SP/logs” Connected. Use ^D to exit. -> show /SP/services /SP/services Targets: -> show /SP/logs http /SP/logs Targets: event Properties: Commands: cd show https ->Session closed servicetag Disconnected snmp ssh sso Properties: Commands: cd show130 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Performing System Management Tasks (IPMItool) (G) Before You Begin - ILOM and IPMItool Requirements (R) Ensure that you have the proper user roles assigned in ILOM when using the IPMItool CLI to execute ILOM commands. For more information, see “IPMI Administrator and Operator Roles” on page 126. Description Links Review ILOM user access requirements • “Before You Begin - ILOM and IPMItool Requirements” on page 130 Monitor sensors and values using IPMItool • “Display Sensor List (IPMItool)” on page 131 • “View Single Sensor Details (IPMItool)” on page 132 Remotely mangage host power using IPMItool • “Power On Host (IPMItool)” on page 132 • “Power Off Host (IPMItool)” on page 132 • “Power Cycle Host (IPMItool)” on page 133 • “Shut Down Host Gracefully (IPMItool)” on page 133 Manage power usage using IPMItool • “Manage ILOM Power Budget Interfaces (IPMItool)” on page 133 Identify field replacement unit manufacturing information • “Display FRU Manufacturing Details (IPMItool)” on page 137 Monitor the system event log using IPMItool • “Display ILOM Event Log Using IPMItool” on page 138Server Managment Using IPMI 131 ? Display Sensor List (IPMItool) ? To view a list of sensors on a managed device, type: sdr list For example: Note – If bimetal is not configured to support the -P option, which enables the password to be entered in the command line, you will be prompted to enter the password. Note – The example sensor output shown in the preceding example was shortened. The actual output displays 163 sensors. $ ipmitool -H 1.2.3.4 -I lanplus -U username -P userpassword sdr list /SYS/T_AMB | 24 degrees C | ok /RFM0/FAN1_SPEED | 7110 RPM | ok /RFM0/FAN2_SPEED | 5880 RPM | ok /RFM1/FAN1_SPEED | 5880 RPM | ok /RFM1/FAN2_SPEED | 6360 RPM | ok /RFM2/FAN1_SPEED | 5610 RPM | ok /RFM2/FAN2_SPEED | 6510 RPM | ok /RFM3/FAN1_SPEED | 6000 RPM | ok /RFM3/FAN2_SPEED | 7110 RPM | ok /RFM4/FAN1_SPEED | 6360 RPM | ok /RFM4/FAN2_SPEED | 5610 RPM | ok /RFM5/FAN1_SPEED | 5640 RPM | ok /RFM5/FAN2_SPEED | 6510 RPM | ok /RFM6/FAN1_SPEED | 6180 RPM | ok /RFM6/FAN2_SPEED | 6000 RPM | ok /RFM7/FAN1_SPEED | 6330 RPM | ok /RFM7/FAN2_SPEED | 6330 RPM | ok /RFM8/FAN1_SPEED | 6510 RPM | ok /RFM8/FAN2_SPEED | 5610 RPM | ok132 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? View Single Sensor Details (IPMItool) ? To view details about a single sensor on a managed device, type: sensor get /target/sensor_name For example, to view sensor details about the system temperature (/SYS/T_AMB), you would type: sensor get /SYS/T_AMB /SYS/T_AMB example output: ? Power On Host (IPMItool) ? To power on the host on a managed device, type: chassis power on For example: $ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword chassis power on ? Power Off Host (IPMItool) ? To power off the host on a managed device, type: chassis power off For example: $ ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword sensor get /SYS/T_AMB Locating sensor record... Sensor ID : /SYS/T_AMB (0x8) Entity ID : 41.0 Sensor Type (Analog) : Temperature Sensor Reading : 24 (+/- 0) degrees C Status : ok Lower Non-Recoverable : 0.000 Lower Critical : 4.000 Lower Non-Critical : 10.000 Upper Non-Critical : 35.000 Upper Critical : 40.000 Upper Non-Recoverable : 45.000 Assertions Enabled : lnc- lcr- lnr- unc+ ucr+ unr+ Deassertions Enabled : lnc- lcr- lnr- unc+ ucr+ unr+Server Managment Using IPMI 133 $ ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword chassis power off ? Power Cycle Host (IPMItool) ? To power cycle the host on a managed device, type: chassis power cycle For example: $ ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword chassis power cycle ? Shut Down Host Gracefully (IPMItool) ? To shut down the host on a managed device gracefully, type: chassis power soft For example: $ ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword chassis power soft ? Manage ILOM Power Budget Interfaces (IPMItool) 1. To set the Power Limit Activation State on a managed device, use one of the following commands: ¦ To activate: $ ipmitool -H -U -P raw 0x2e 0x49 0x00 0x01 0xFF 0xFF Upon command completion: dc ¦ To deactivate: $ ipmitool -H -U -P raw 0x2e 0x49 0x00 0x00 0xFF 0xFF Upon command completion:134 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 dc The following table describes the Power Limit Activation State (IPMItool) input and outpt fields: 2. To get Power Limit budget properties, use the following command: Note – You should use a Get Power Limit Budget Wattage command prior to setting the power-limit budget wattage property. $ ipmitool -H -U -P raw 0x2e 0x4A 0x00 0x00 0x00 Upon command completion: Fields Byte Description Input Data 1 Sun OEM command group number “0x2e”. 2 Command code “0x49” sets the power limit activation state. 3 Group extension identification “0x00”. The value for this field is ignored. 4 Sub-commands for power-limit activation: 0x00 - Deactivate power limit 0x01 - Activate power limit 5-6 Reserved fields: 0xFF. The values for this field are ignored. Output Data 1 Completion code consumed by IPMItool. The system does not display a status for successful completion code. However, if the result of the completion code is anything other than 'successful', a failure message appears. 2 Group extension identification “-dc” appears upon command completion.Server Managment Using IPMI 135 dc 01 b3 00 02 fa 00 00 00 00 01 e9 00 00 The following table describes the Get Power Limit (IMPItool) input and output fields: Field Byte Description Input Data 1 SUN OEM command group number 0x2e. 2 Command code 0x4A gets Power Budget settings 3 Group extension identification: 0x00. The value for this field is ignored. 4-5 Reserved fields: -0x00. Values for this field are ignored. Output Data 1 Completion Code, consumed by IPMItool. Not displayed upon command completion. However if completion code is anything other than success, then a failure message is displayed upon command completion. 2 Group Extension Identification. Displayed as dc in the preceding example. 3 Activation State: 00 - deactivated;01 - activated. 4 Reserved field. Note that the value b3 in the preceding example can be ignored. 5 Exception action, taken if power limit is exceeded and cannot be controlled within the correction time limit. Return values: 00 - none; 01 - hard power-off. 6-7 Power limit in watts. 02 fa in the preceding example. 8-11 Correction timelimit in milliseconds. 00 00 00 00 in the preceding example. 12 Flag indicating whether the correction time limit is the system default timelimit. (00 - not default; 01 - default) 13 Reserved field. Note that the value shown (e9) in the preceding example can be ignored. 14-15 Reserved fields. Note that the value shown (00 00) in the preceding example can be ignored.136 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. To set the Power Limit, use the following command: Note – The set power limit commands sets the power budget limit for the system. Use this command to set the maximum system power usage. The power limit should always be persistent across AC and DC cycles. $ ipmitool -H -U -P raw 0x2e 0x4B 0xdc 0xff 0xff 0xff 0x01 0x02 0xaa 0x00 0x00 0x1b 0x58 0x00 0xff 0x00 0x00 Upon command completion: dc The following table describes Set Power Limit (IPMItool) input and output fields: Fields Byte Description Input Data 1 SUNOEM command group number: 0x2e. 2 Command code 0x4B sets power budget settings. 3 Group extension identification: 0xdc. The value for this field is ignored. 4-6 Reserved fields: 0xff 0xff 0xff. The values for this field are ignored. 7 Exception action taken: 00 - none 01 - hard power-off 8-9 Power limit in watts. For example: 0x2a 0xaaServer Managment Using IPMI 137 ? Display FRU Manufacturing Details (IPMItool) ? To display FRU manufacturing details on a managed device, use the fru print command. For example: 10-13 Correction time limit in milliseconds. For example: 0x00 0x00 0x1b 0x58. This value is ignored if the time limit is set to default; see next byte. 14 A flag indicating whether to use the system default time limit. Correction time limit in bytes 10-13 will be ignored. 0x00 - not default 0x01 - default 15 Reserved field: 0xff. The value for this field is ignored. 16-17 Reserved field: 0x00 0x00. The value for this field is ignored. Output Data 1 Completion code that is consumed by IPMItool. The system does not display a status for successful completion code. However, if the result of the completion code is anything other than successful, a failure message appears. 2 Group extension identification dc appears upon command completion. $ ipmitool -H 1.2.3.4 -v -I lanplus -U username -P userpassword fru print FRU Device Description : Builtin FRU Device (ID 0) Board Product : ASSY,ANDY,4SKT_PCI-E,BLADE Board Serial : 0000000-7001 Board Part Number : 501-7738-01 Board Extra : AXX_RevE_Blade Product Manufacturer : ORACLE Product Name : ILOM FRU Device Description : /SYS (ID 4) Chassis Type : Rack Mount Chassis Chassis Part Number : 541-0251-05 Chassis Serial : 00:03:BA:CD:59:6F Board Product : ASSY,ANDY,4SKT_PCI-E,BLADE Board Serial : 0000000-7001 Board Part Number : 501-7738-01 Fields Byte Description138 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ? Display ILOM Event Log Using IPMItool ? To view the ILOM event log on a managed device, use the sel list command. For example: Board Extra : AXX_RevE_Blade Product Manufacturer : ORACLE Product Name : SUN BLADE X8400 SERVER MODULE Product Part Number : 602-0000-00 Product Serial : 0000000000 Product Extra : 080020ffffffffffffff0003baf15c5a FRU Device Description : /P0 (ID 5) Product Manufacturer : ADVANCED MICRO DEVICES Product Part Number : 0F21 Product Version : 2 FRU Device Description : /P0/D0 (ID 6) Product Manufacturer : MICRON TECHNOLOGY Product Name : 1024MB DDR 400 (PC3200) ECC Product Part Number : 18VDDF12872Y-40BD3 Product Version : 0300 Product Serial : D50209DA Product Extra : 0190 Product Extra : 0400 FRU Device Description : /P0/D1 (ID 7) Product Manufacturer : MICRON TECHNOLOGY Product Name : 1024MB DDR 400 (PC3200) ECC Product Part Number : 18VDDF12872Y-40BD3 Product Version : 0300 Product Serial : D50209DE Product Extra : 0190 Product Extra : 0400 $ ipmitool -H 1.2.3.4 -I lanplus -U username -P userpassword sel list 100 | Pre-Init Time-stamp | Power Unit #0x78 | State Deasserted 200 | Pre-Init Time-stamp | Power Supply #0xa2 | Predictive Failure Asserted 300 | Pre-Init Time-stamp | Power Supply #0xba | Predictive Failure Asserted 400 | Pre-Init Time-stamp | Power Supply #0xc0 | Predictive Failure Asserted 500 | Pre-Init Time-stamp | Power Supply #0xb4 | Predictive Failure Asserted 600 | 04/05/2007 | 12:03:24 | Power Supply #0xa3 | Predictive Failure Deasserted 700 | 04/05/2007 | 12:03:25 | Power Supply #0xaa | Predictive Failure Deasserted 800 | 04/05/2007 | 12:03:25 | Power Supply #0xbc | Predictive Failure Deasserted 900 | 04/05/2007 | 12:03:26 | Power Supply #0xa2 | Predictive Failure Asserted a00 | 04/05/2007 | 12:03:26 | Power Supply #0xa8 | Predictive Failure DeassertedServer Managment Using IPMI 139 IPMItool Utility and Command Summary (R) You can download the IPMItool utility at: (http://ipmitool.sourceforge.net/) After you install the IPMItool package, you can access detailed information about command usage and syntax from the man page that is installed. The following table summarizes available IPMItool commands. b00 | 04/05/2007 | 12:03:26 | Power Supply #0xb6 | Predictive Failure Deasserted c00 | 04/05/2007 | 12:03:26 | Power Supply #0xbb | Predictive Failure Deasserted d00 | 04/05/2007 | 12:03:26 | Power Supply #0xc2 | Predictive Failure Deasserted e00 | 04/05/2007 | 12:03:27 | Power Supply #0xb0 | Predictive Failure Deasserted f00 | 04/05/2007 | 12:03:27 | Power Supply #0xb5 | Predictive Failure Deasserted 1000 | 04/05/2007 | 12:03:27 | Power Supply #0xba | Predictive Failure Asserted 1100 | 04/05/2007 | 12:03:27 | Power Supply #0xc0 | Predictive Failure Asserted 1200 | 04/05/2007 | 12:03:28 | Power Supply #0xa9 | Predictive Failure Deasserted 1300 | 04/05/2007 | 12:03:28 | Power Supply #0xae | Predictive Failure Deasserted 1400 | 04/05/2007 | 12:03:28 | Power Supply #0xb4 | Predictive Failure Asserted 1500 | 04/05/2007 | 12:03:28 | Power Supply #0xbe | Predictive Failure Deasserted TABLE: IPMItool commands IPMI Command Function sunoem sshkey set Configure an SSH key for a remote shell user. ipmitool sunoem sshkey del Remove an SSH key from a remote shell user. ipmitool sunoem led get Read LED status. ipmitool sunoem led set Set LED status. ipmitool sunoem cli Enter ILOM CLI commands as if you were using the ILOM CLI directly. The LAN/LANplus interface should be used. ipmitool sunoem CLI force Available as of ILOM 3.0.10, a force option can be invoked as an argument to the sunoem CLI command. ipmitool raw Execute raw IPMI commands. ipmitool lan print Print the current configuration for the given channel. ipmitool lan set (1) (2) Set the given parameter on the given channel.140 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ipmitool chassis status Display information regarding the high-level status of the system chassis and main power subsystem. ipmitool chassis power Perform a chassis control command to view and change the power state. ipmitool chassis identify Control the front panel identify light. Default is 15. Use 0 to turn off. ipmitool chassis restart_cause Query the chassis for the cause of the last system restart. ipmitool chassis bootdev (1) Request the system to boot from an alternate boot device on next reboot. ipmitool chassis bootparam (1) Set the host boot parameters. ipmitool chassis selftest Display the BMC self-test results. ipmitool power Return the BMC self-test results. ipmitool event Send a predefined event to the system event log. ipmitool mc (1) (2) Instruct the BMC to perform a warm or cold reset. ipmitool sdr Query the BMC for sensor data records (SDR) and extract sensor information of a given type, then query each sensor and print its name, reading, and status. ipmitool sensor List sensors and thresholds in a wide table format. ipmitool fru print Read all field-replaceable unit (FRU) inventory data and extract such information as serial number, part number, asset tags, and short strings describing the chassis, board, or product. ipmitool sel View the ILOM SP system event log (SEL). ipmitool pef info Query the BMC and print information about the PEFsupported features. ipmitool pef status Print the current PEF status (the last SEL entry processed by the BMC, and so on). ipmitool pef list Print the current PEF status (the last SEL entry processed by the BMC, and so on). ipmitool user Display a summary of user ID information, including maximum number of user IDs, the number of enabled users, and the number of fixed names defined. TABLE: IPMItool commands (Continued) IPMI Command FunctionServer Managment Using IPMI 141 ipmitool session Get information about the specified sessions. You can identify sessions by their ID, by their handle number, by their active status, or by using the keyword “all” to specify all sessions. ipmitool firewall (1) Enable or disable individual command and command sub-functions; determine which commands and command sub-functions can be configured on a given implementation. ipmitool set (1) Set the runtime options including session host name, user name, password, and privilege level. ipmitool exec Execute IPMItool commands from file name. Each line is a complete command. TABLE: IPMItool commands (Continued) IPMI Command Function142 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011143 Server Management Using WS-Management and CIM (G) Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, Oracle ILOM overview Description Links Learn about support for WS-Management and CIM • “WS-Management and CIM Overview” on page 144 Learn how to configure the state for WS-Management • “Configuring Support for WS-Management in ILOM” on page 145 Learn about the supported CIM profiles and Oracle’s Sun specific classes • “Supported DMTF SMASH Profiles, CIM Classes and CIM Indications” on page 149144 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 WS-Management and CIM Overview (G) As of version 3.0.8, ILOM supports the use of the Distributed Management Task Force (DMTF) Web Services for Management (WS-Management) protocol and Common Information Model (CIM). The support for these DMTF standards in ILOM enables developers to build and deploy network management applications to monitor and manage information about Oracle’s Sun system hardware. Topics described in this section, include: ¦ “WS-Management” on page 144 ¦ “Common Information Model (CIM)” on page 144 WS-Management (C) WS-Management is based on the Simple Object Access Protocol (SOAP) specification that promotes interoperability between managed applications and managed resources. It enables you to: ¦ Discover the presence of management resources, as well as provide navigation among them. ¦ View and write to individual management resources, such as settings and dynamic values. ¦ Obtain a list for contents of containers and collections, such as system components and log entries. ¦ Run management methods. For further details about implementing and deploying a WS-Management environment to remotely manage system hardware across your IT infrastructure, see: (http://www.dmtf.org/standards/wsman) For more information about how to configure support for WS-Management in ILOM, see “Configuring Support for WS-Management in ILOM” on page 145. Common Information Model (CIM) (C) CIM is an object-oriented information model that provides a common definition for managing system hardware data. These common definitions enable you to exchange semantically rich management information among systems on your network.Server Management Using WS-Management and CIM 145 CIM supplies a set of classes that provide a framework to organize the information about the managed environment. Specifically, these classes enable you to create or use another application other than ILOM to monitor and manage Oracle’s Sun hardware. System Management Architecture for Server Management (SMASH) Oracle’s Sun hardware supports a relevant subset of SMASH profiles. For more information about DMTF SMASH profiles, consult the specification for this standard at: (http://www.dmtf.org/standards/mgmt/smash) For more information about support SMASH profiles and CIM classes, see “Supported DMTF SMASH Profiles, CIM Classes and CIM Indications” on page 149. Configuring Support for WS-Management in ILOM (G) The following sections describe the prerequisites and procedures for configuring support for WS-Management in ILOM. ¦ “Before You Begin - WS-Management Requirements” on page 145 ¦ “Edit the WS-Management Service State, Transport Mode, and Port Number (CLI)” on page 145 ¦ “Edit WS-Management State, Transport Mode, and Port Number (Web)” on page 148 BeforeYouBegin- WS-Management Requirements(R) To edit the configuration properties for WS-Management in ILOM, you must have Admin (a) role privileges. ? Edit the WS-Management Service State, Transport Mode, and Port Number (CLI) 1. Log in to the ILOM SP CLI.146 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Note – Alternatively, you can log in to the ILOM CMM CLI then navigate to the SP target where you want to enable or disable the KVMS lock option for the ILOM Remote Console. 2. To view all the properties associated with the management of the SP WS-Management service, type: -> help /SP/services/wsman The following help output appears for the WS-Management service: /SP/services/wsman : Management of the WSMAN service Targets: Properties: http_port : WSMAN http port http_port : User role required for set = a https_port : WSMAN https port https_port : User role required for set = a mode : WSMAN mode mode : User role required for set = a state : WSMAN state state : User role required for set = aServer Management Using WS-Management and CIM 147 3. To navigate and manage the SP WS-Management target properties, perform the tasks described in the following table. Task Instructions Navigate to the WS-Management service target. To navigate to the WS-Management service target, type the following command: -> cd /SP/services/wsman Note - You must navigate to the wsman target prior to viewing or configuring the properties associated with the WS-Management service. View the WS-Management CLI properties and commands. To view the WS-Management properties and commands, type the following command: -> show Show output example: -> cd /SP/services/wsman /SP/services/wsman -> show /SP/services/wsman Targets: Properties: http_port = 7783 https_port = 7782 mode = http state = enabled Commands: cd set show148 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 4. Type exit to exit the ILOM CLI. ? Edit WS-Management State, Transport Mode, and Port Number (Web) 1. Log in to the ILOM SP web interface. 2. In the ILOM SP web interface, click Configuration --> System Management Access --> WS-Man. Set the WS-Management service state. To enable or disable support for the WS-Management service in ILOM, type the following command to set the service state: -> set state=enabled or -> set state=disabled Note - The service state for WS-Management in ILOM 3.0.8 is, by default, disabled. For all other ILOM versions, the service state is, by default, enabled. Set the WS-Management transport mode (HTTP or HTTPS). To set the transport mode (HTTP or HTTPS) for the WS-Management service in ILOM, type one of the following commands: -> set mode=http or -> set mode=https Set the WS-Management transport mode port number. To set the transport mode port number for the WS-Management, service in ILOM, type one of the following commands: -> set http_port=#### or -> set https_port=#### where #### equals the port number to be assigned to the specified transport mode (HTTP or HTTPS). For example, to set the default port number for HTTP or HTTPS, you would type: For HTTP: set http_port=8889 For HTTPS: set https_port=8888 Task InstructionsServer Management Using WS-Management and CIM 149 3. In the WS-Man page, configure the following WS-Man settings: 4. Click Save to apply the changes made to the WS-Man settings. Supported DMTF SMASH Profiles, CIM Classes and CIM Indications (G) Oracle-supported CIM classes provide a common information model interface for developers building management applications. With Oracle-specific CIM class properties, developers can use standards-based CIM-compliant applications to manage Oracle’s Sun hardware. Note – Oracle supports CIM schema version 2.18.1. For DMTF CIM schema details, see (http://www.dmtf.org/standards/cim/cim_schema_v2181). Note – Use name space (http://schemas.oracle.com/wbem/wscim/1/cim-schema/2)when using Oracle-specific CIM class. For example: (http://schemas.oracle.com/wbem/wscim/1/cim-schema/2/Oracle_Comp uterSystem) Settings Instructions Enable or disable the WS-Management service state. • Click to select (enable) or clear (disable) the State Enabled check box. By default, this setting is disabled in ILOM. Select a WS-Management transport mode (HTTP or HTTPS). • Click to select HTTP or HTTPS in the Mode list box. By default, this setting is set to HTTP. Set the WS-Management transport mode port number. • In the HTTP or HTTPS text field, specify the transport mode port number for the WS-Management service. The default port number settings for HTTP or HTTPS are as follows: • HTTP: 8889 • HTTPS: 8888150 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Note – As of ILOM 3.0.14, the Oracle Sun-supported CIM classes have been renamed from Sun_xxx to Oracle_xxx. Prior to ILOM 3.0.14, the Oracle Sun CIM classes should be referenced as Sun_xxxx and not Oracle_xxx as described in this guide. For further details about Oracle-supported CIM classes, see “Oracle’s Sun-Supported CIM Classes” on page 155. For a list of the supported DMTF profiles, Oracle-specific CIM classes, and the supported CIM indications in ILOM, see these sections: ¦ “Supported DMTF SMASH Profiles and CIM Classes” on page 150 ¦ “Supported CIM Indications” on page 152 Supported DMTF SMASH Profiles and CIM Classes (R) As of ILOM 3.0.8, Oracle ILOM supports the following DMTF SMASH profiles and CIM classes.Server Management Using WS-Management and CIM 151 Note – For viewing the published documentation on a supported DMTF profile, go to the DMTF Standards Publicaiton site (http://www.dmtf.org/standards/published_documents)and look for the DSP# listed in the following table. TABLE: Supported SMASH Profiles and CIM Classes Supported DMTF Profiles Oracle-Supported CIM Classes Oracle-Derived Classes Base Server (DSP1004) • CIM_ComputerSystem • CIM_EnabledLogicalElementCapabilit ies • CIM_ElementCapabilities • CIM_ComputerSystemPackage • CIM_ElementConformsToProfile • CIM_SystemDevice • CIM_UseOfLog • Oracle_ComputerSystem • Oracle_EnabledLogicalElementCapabi lites • Oracle_ElementCapabilities • Oracle_ComputerSystemPackage • Oracle_ElementConformsToProfile • Oracle_SystemDevice • Oracle_UseOfLog Service Processor • CIM_ComputerSystem • CIM_EnabledLogicalElementCapabilit ies • CIM_ElementCapabilities • CIM_SystemComponent • Oracle_ComputerSystem • Oracle_EnabledLogicalElementCapabi lities • Oracle_ElementCapabilities • Oracle_SystemComponent Physical Asset (DSP1011) • CIM_Chip • CIM_PhysicalMemory • CIM_Chassis • CIM_PhysicalPackage • CIM_PhysicalAssetCapabilities • CIM_Container • CIM_Realizes • CIM_ComputerSystemPackage • CIM_ElementCapabilities • Oracle_Chip • Oracle_PhysicalMemory • Oracle_Chassis • Oracle_PhysicalPackage • Oracle_PhysicalAssetCapabilities • Oracle_Container • Oracle_Realizes • Oracle_ComputerSystemPackage • Oracle_ElementCapabilities Sensors (DSP1009) • CIM_Sensor • CIM_NumericSensor • CIM_AssociatedSensor • CIM_SystemDevice • Oracle_Sensor • Oracle_NumericSensor • Oracle_AssociatedSensor • Oracle_SystemDevice CPU (DSP1022) • CIM_Processor • CIM_Realizes • CIM_SystemDevice • Oracle_Processor • Oracle_Realizes • Oracle_SystemDevice System Memory (DSP1026) • CIM_Memory • CIM_Realizes • CIM_SystemDevice • Oracle_Memory • Oracle_Realizes • Oracle_SystemDevice152 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Supported CIM Indications (R) As of ILOM 3.0.8, ILOM can generate CIM indications for the following conditions: ¦ Sensor crosses a threshold (CIM_ThresholdIndication). ¦ Hardware component changes operational state or health state (CIM_InstModification). ¦ Hardware component is inserted into the chassis (CIM_InstCreation). ¦ Hardware component is removed from the chassis (CIM_InstDeletion). The following table identifies the CIM classes supported in ILOM for CIM indications. Indicator LED (DSP0835) • CIM_SystemDevice • Not Applicable* • Not Applicable* Note - *The CIM schema version 1.18.1 does not have the CIM_IndicatorLED and CIM_AssociatedIndicatorLED defined. The CIM_IndicatorLED and CIM_AssociatedIndicatorLED are required by the Indicator LED profile. • Oracle_SystemDevice • Oracle_IndicatorLED* • Oracle_AssociatedIndicatorLED* Note - *Use the CIM_IndicatorLED and CIM_AssociatedIndicatorLED from the experimental schema for CIM schema version 2.18.1 and rename them Oracle_IndicatorLED and Oracle_AssociatedIndicatorLED. Record Log (DSP0810) • CIM_RecordLog • CIM_LogEntry • CIM_LogManagesRecord • CIM_UseOfLog • Oracle_RecordLog • Oracle_LogEntry • Oracle_LogManagesRecord • Oracle_UseOfLog Profile Registration (DSP1033) • CIM_RegisteredProfile • CIM_ElementConformsToProfile • CIM_ReferenceProfile • Oracle_RegisteredProfile • Oracle_ElementConformsToProfile • Oracle_ReferenceProfile TABLE: Oracle’s Sun-Supported CIM Classes for Sensor Indications Oracle’s Sun-Supported CIM Classes for Sensor Indications Oracle’ Derived Classes for Sensor Indications • CIM_InstCreation • Oracle_InstCreation • CIM_InstDeletion • Oracle_InstDeletion • CIM_InstModification • Oracle_HWCompErrorOkIndication • CIM_ThresholdIndication • Oracle_ThresholdIndication TABLE: Supported SMASH Profiles and CIM Classes (Continued) Supported DMTF Profiles Oracle-Supported CIM Classes Oracle-Derived ClassesServer Management Using WS-Management and CIM 153 In addition, ILOM defines two static instances of CIM_IndicationFilter, in /root/interop namespace that a client can subscribe to in order to receive indication for when a threshold is crossed or for when a hardware component health state changes. The following table identifies the key properties and ILOM values supported for these conditions. TABLE: Key Properties and Values for Static CIM_IndicationFilter Instances Key Property ILOM Value Subscription for sensor crossing threshold • CreationClassName • CIM_IndicationFilter • Name • ORCL:ILOM:SensorCrossingThresholdFilter (as of ILOM 3.0.14) • JAVA:ILOM:SensorCrossingThresholdFilter (prior to ILOM 3.0.14) • SystemCreationClassName • CIM_ComputerSystem • SystemName • localhost Subscription for hardware component changes health state • CreationClassName • CIM_IndicationFilter • Name • ORCL:ILOM:HWComponentErrorFilter (as of ILOM 3.0.14) • JAVA:ILOM:HWComponentErrorFilter (prior to ILOM 3.0.14) • SystemCreationClassName • CIM_ComputerSystem • SystemName • localhost154 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011155 Oracle’s Sun-Supported CIM Classes (G) Related Information ¦ “Server Management Using WS-Management and CIM” on page 143 • “Document Conventions For Oracle’s Sun-Supported CIM Classes” on page 156 • “Oracle_NumericSensor” on page 201 • “Oracle_AssociatedIndicatorLED” on page 157 • “Oracle_PhysicalAssetCapabilities” on page 209 • “Oracle_AssociatedSensor” on page 158 • “Oracle_PhysicalComponent” on page 211 • “Oracle_Chassis” on page 159 • “Oracle_PhysicalElementCapabilities” on page 218 • “Oracle_ComputerSystem” on page 165 • “Oracle_PhysicalMemory” on page 219 • “Oracle_ComputerSystemPackage” on page 172 • “Oracle_PhysicalPackage” on page 223 • “Oracle_Container” on page 173 • “Oracle_Processor” on page 230 • “Oracle_ElementCapabilities” on page 174 • “Oracle_ProcessorChip” on page 236 • “Oracle_ElementConformsToProfile” on page 175 • “Oracle_Realizes” on page 240 • “Oracle_EnabledLogicalElementCapabilities” on page 175 • “Oracle_RegisteredProfile” on page 241 • “Oracle_HWCompErrorOkIndication” on page 179 • “Oracle_RecordLog” on page 244 • “Oracle_IndicatorLED” on page 181 • “Oracle_ReferencedProfile” on page 249 • “Oracle_InstCreation” on page 189 • “Oracle_Sensor” on page 250 • “Oracle_InstDeletion” on page 190 • “Oracle_SpSystemComponent” on page 256 • “Oracle_LogEntry” on page 191 • “Oracle_SystemDevice” on page 257 • “Oracle_LogManagesRecord” on page 195 • “Oracle_ThresholdIndication” on page 258 • “Oracle_Memory” on page 196 • “Oracle_UseOfLog” on page 263156 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Document Conventions For Oracle’s Sun-Supported CIM Classes (R) The following document conventions apply to Oracle Sun CIM classes presented in this section: ¦ Each class table within this section describes only the properties supported by ILOM. For all possible properties of a class, see the DMTF CIM Schema 2.18.1 at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) ¦ An Oracle Sun-specific property (added by Oracle Sun-derived classes) will have the word Sun-specific. ¦ Key-property rows are shown first in each class table, in alpha-numerical ascending order. ¦ Non-key-property rows are after key-property rows, in alpha-numerical ascending order. ¦ The term controller refers to the hardware entity on which management software resides, for example, the service processor (SP) or chassis monitoring module (CMM). The term controllee refers to the hardware entity that is controlled by the controller, for example, the host system (SYS) or the chassis (CH). ¦ As of ILOM 3.0.14, the Oracle Sun CIM classes have been renamed from Sun_xxx to Oracle_xxx. Prior to ILOM 3.0.14, the Oracle Sun CIM classes should be referenced as Sun_xxxx and not Oracle_xxx as described in this guide.Oracle’s Sun-Supported CIM Classes 157 Oracle_AssociatedIndicatorLED (R) Note – The Indicator LED profile specifies the CIM_AssociatedIndicatorLED class. However, the CIM_AssociatedIndicatorLED class does not exist in version 2.1.8.1 of the CIM Schema. Therefore, Oracle uses the CIM_AssociatedIndicatorLED class that is identified in the Experimental CIM Schema 2.18.1 and renamed it to Oracle_AssociatedIndicatorLED. Description: The Oracle_AssociatedIndicatorLED class associates an LED to a physical element. Inheritance: CIM_Dependency Properties: For a description of the supported properties for the Oracle_AssociatedIndicatorLED class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181 ) Profile: Indicator LED TABLE: Properties for Oracle_AssociatedSensor Property Data Type Description ILOM Value Antecedent CIM_ManagedSystem REF The Antecedent property is a mandatory key property. Indicates the ManagedSystemElement that has an associated LED. Object path to an instance of CIM_ManagedSystemE lement. Dependent Oracle_IndicatorL ED REF The -Dependent property is a mandatory key property. Represents the indicator LED of the managed element. Object path to an instance of Oracle_IndicatorLE D.158 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_AssociatedSensor (R) Description: The Oracle_AssociatedSensor class associates a sensor to the physical element. Inheritance: CIM_AssociatedSensor Properties: For a description of the supported properties for the Oracle_AssociatedSensor class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181 ) Profile: Sensor TABLE: Properties for Oracle_AssociatedSensor Property Data Type Description ILOM Value Antecedent CIM_Sensor REF The Antecedent property is a mandatory key property. Represents the sensor for the managed element. Object path to an instance of CIM_Sensor. Dependent CIM_PhysicalEleme nt REF The Dependent property is a mandatory key property. The ManagedSystemElement for which information is measured by the sensor. Object path to an instance of the CIM_PhysicalElemen t that the sensor belongs.Oracle’s Sun-Supported CIM Classes 159 Oracle_Chassis (R) Description: The Oracle_Chassis class represents the physical elements that enclose other elements. Inheritance: CIM_Chassis Properties: For a description of the supported properties for the Oracle_Chassis class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181 ) Profile: Physical Asset160 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_Chassis Property Data Type Description ILOM Value CreationClassName string The CreationClassName property is a mandatory key property CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Chassis Tag string The Tag property is a mandatory key property. The Tag property is an arbitrary string that uniquely identifies the physical element and serves as the key of the element. The Tag property can contain information such as asset tag or serial number data. The key for PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware or entity, regardless of physical placement in or on cabinets, adapters, and so on. For example, a hot-swappable or removable component can be taken from its containing (scoping) Package and be temporarily unused. The object still continues to exist and can be inserted into a different scoping container. Therefore, the key for PhysicalElement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Set to component NAC name CanBeFRUed boolean The CanBeFRUed property is a boolean that indicates whether this PhysicalElement can be FRUed (TRUE) or not (FALSE). Will be set to TRUE or FALSE depending on whether the component is considered to be a FRU by the platform.Oracle’s Sun-Supported CIM Classes 161 ChassisPackageType uint16[] The ChassisPackageType property indicates the physical form factor for the type of chassis. This property may have a value when the PackageType property contains the value 3 Chassis Frame. A value of 28 Blade Enclosure indicates the Chassis is designed to contain one or more PhysicalPackage(s) of PackageType 16 "Blade" or PackageType 17 "Blade Expansion". Definition type values include any of the following: {Unknown, Other, SMBIOS Reserved, Desktop, Low Profile Desktop, Pizza Box, Mini Tower, Tower, Portable, LapTop, Notebook, Hand Held, Docking Station, All in One, Sub Notebook, Space-Saving, Lunch Box, Main System Chassis, Expansion Chassis, SubChassis, Bus Expansion Chassis, Peripheral Chassis, Storage Chassis, SMBIOS Reseved, Sealed-Case PC, SMBIOS Reserved, CompactPCI, AdvancedTCA, Blade Enclosure, DMTF Reserved, Vendor Reserved} Values for the definition types are: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, .., 0x8000..0xFFFF} Will be set to 17 (Main System Chassis) ChassisTypeDescrip tion string The ChassisTypeDescription is a string providing more information about the ChassisPackageType. Will have appropriate description. Description string Textual description of the object. Will have appropriate description. TABLE: Properties for Oracle_Chassis (Continued) Property Data Type Description ILOM Value162 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Set to component NAC name. TABLE: Properties for Oracle_Chassis (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 163 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Will have appropriate value depending on whether the component is in error state or not. Manufacturer string The Manufacturer property is the name of the organization responsible for producing the PhysicalElement. This organization might be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the vendor property of CIM_Product. Will have appropriate value if the chassis is considered a FRU by the platform. TABLE: Properties for Oracle_Chassis (Continued) Property Data Type Description ILOM Value164 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Model string The Model property is the name by which the PhysicalElement is generally known. Will have appropriate value if the chassis is considered a FRU by the platform. OperationalStatus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. Enumeration definitions can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for these definitions are as follows: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} OperationalStatus[ 0] will have appropriate value depending on whether the component is in error state or not. PartNumber string Part number assigned by the organization that is responsible for producing or manufacturing the PhysicalElement Will have appropriate value if the chassis is considered a FRU by the platform. SKU string The SKU property is the stock-keeping unit number for this PhysicalElement. Will have appropriate value if the chassis is considered a FRU by the platform. SerialNumber string The SerialNumber property is a manufacturer-allocated number used to identify the physical element. Will have appropriate value if the chassis is considered a FRU by the platform. StatusDescriptions string That StatusDescriptions property describes the various OperationalStatus array values. For example, if -Stopping is the value assigned to OperationalStatus, then this property may contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus. StatusDescriptions[ 0] will have appropriate description on the reason for the value of OperationalStatus[ 0] TABLE: Properties for Oracle_Chassis (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 165 Oracle_ComputerSystem (R) Description: The Oracle_ComputerSystem class represents a special collection of Sun system managed elements. This collection provides computer capabilities and serves as an aggregation point to associate one or more of the following elements: file system, operating system, processor and memory (volatile and non-volatile storage). Inheritance: CIM_ComputerSystem Properties For a description of the supported properties for the Oracle_ComputerSystem class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181 ) Profiles • Base Server • Service Processor166 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Attributes for Oracle_ComputerSystem Property Data Type Description ILOM Value CreationClassN ame string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set value to: Oracle_ComputerSystem. Name string The Name attribute is a mandatory key CIM property. The inherited Name serves as the key of a system instance in an enterprise environment. Implementation-dependent value representing unique ID of the ComputerSystem. Dedicated[] string The Dedicated[] property enumerates the purposes to which the ComputerSystem is dedicated, if any, and what functionality is provided. Functionality definitions can include any of the following: {Not Dedicated, Unknown, Other, Storage, Router, Switch, Layer 3 Switch, Central Office Switch, Hub, Access Server, Firewall, Print, I/O, Web Caching, Management, Block Server, File Server, Mobile User Device, Repeater, Bridge/Extender, Gateway, Storage Virtualizer, Media Library, ExtenderNode, NAS Head, Self-contained NAS, UPS, IP Phone, Management Controller, Chassis Manager, Host-based RAID controller, Storage Device Enclosure, Desktop, Laptop, Virtual Tape Library, Virtual Library System, DMTF Reserved, Vendor Reserved} Values for these functionality definitions are as follows: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36..32567, 32568..65535} For ComputerSystem instance representing the controller, the Dedicated[0] value will be set to -28 (Management Controller). For ComputerSystem instance representing the controllee, Dedicated[0] to 0 (Not Dedicated).Oracle’s Sun-Supported CIM Classes 167 ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. For ComputerSystem instance representing the controller, the ElementName will be set to the controller or host name. For ComputerSystem instance representing the controllee, the ElementName will be set to the host product name. EnabledDefault string The EnabledDefault property is an enumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is Enabled (value=2). Element definitions include any of the following: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Values for the element definitions are as follows: {2, 3, 5, 6, 7, 9, .., 32768..65535} EnabledDefault will be set to default value 2 (Enabled). TABLE: Attributes for Oracle_ComputerSystem (Continued) Property Data Type Description ILOM Value168 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledState uint16[] EnabledState is an integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, Shutting Down (value=4) and Starting (value=10) are transient states between enabled and disabled. The following text briefly summarizes the various enabled and disabled states: • Enabled (2) indicates that the element is or could be executing commands, will process any queued commands, and queues new requests. • Disabled (3) indicates that the element will not execute commands and will drop any new requests. • Shutting Down (4) indicates that the element is in the process of going to a disabled state. • Not Applicable (5) indicates the element does not support being enabled or disabled. • Enabled but Offline (6) indicates that the element might be completing commands, and will drop any new requests. • Test (7) indicates that the element is in a test state. • Deferred (8) indicates that the element might be completing commands, but will queue any new requests. • Quiesce (9) indicates that the element is enabled but in a restricted mode. • Starting (10) indicates that the element is in the process of going to an enabled state. New requests are queued. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11..32767, 32768..65535} Value definitions include: {Unknown, Other, Enabled, Disabled, Shutting Down, Not Applicable, Enabled but Offline, In Test, Deferred, Quiesce, Starting, DMTF Reserved, Vendor Reserved} For ComputerSystem instance representing the controller, the EnabledState value will be set to 2 (Enabled). For ComputerSystem instance representing the controllee, the EnabledState value will be set to appropriate value depending on the power state of the controllee. TABLE: Attributes for Oracle_ComputerSystem (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 169 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. For ComputerSystem instance representing the controller EnabledState will be set to 5 (OK). For ComputerSystem instance representing the controllee HealthState will be set to appropriate value depending on the value of OperationalStatus property. IdentifyingDes criptions string The IdentifyingDescriptions property is an array of free-form strings providing explanations and details behind the entries in the OtherIdentifyingInfo array. Note - Each entry of this array is related to the entry in OtherIdentifyingInfo that is located at the same index. For ComputerSystem instance representing the controller, the IdentifyingDescription s will not be set. For ComputerSystem instance representing the controllee, the IdentifyingDescription s will be set to the following value: "-CIM:Model:SerialNumb er". TABLE: Attributes for Oracle_ComputerSystem (Continued) Property Data Type Description ILOM Value170 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 OperationalSta tus uint16[] The OperationalStatus indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. However, a few are not and are described here in more detail in the CIM_ComputerSystem.mof described in the DMTF CIM schema v2.18.1. Element definitions include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for the above definitions are: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} For ComputerSystem instance representing the controller, the OperationalStatus[0] will be set to 2 (OK). For ComputerSystem instance representing the controllee, the OperationalStatus[0] will be set to appropriate value depending on the power status (starting, stopping) or whether the host has incurred an error or is unknown. OtherEnabledSt ate string The OtherEnabledState property is a string that describes the enabled or disabled state of the element when the EnabledState property is set to 1 (Other). This property must be set to null when EnabledState is any value other than 1. Will be set to empty string. TABLE: Attributes for Oracle_ComputerSystem (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 171 OtherIdentifyi ngInfo String[] The OtherIdentifyingInfo property captures additional data, beyond system name information, that could be used to identify a ComputerSystem. One example would be to hold the Fibre Channel World-Wide Name (WWN) of a node. Note that if only the Fibre Channel name is available and is unique (able to be used as the system key), then this property would be NULL and the WWN would become the system key, its data placed in the Name property. For ComputerSystem instance representing the controller, the OtherIdentifyingInfo will not be set. For ComputerSystem instance representing the controllee, the OtherIdentifyingInfo[0 ] will be set to the following value: : For more details, refer to the DMTF Base Server Profile. RequestedState uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for these definitions are as follows: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Will set to -Not -Applicable if there has not been any invocation of RequestStateChange() method. Will be set to the correct value of the incoming argument of RequestStateChange(). RequestStateCh ange() UInt32 Method for client to request state change. The following state change operations are as follows: {2 , 3, 4, 6, 7, 8, 9, 10, 11, .., 32768..65535"} Definitions for the above values are as follows: {Enabled, Disabled, Shut Down, Offline,Test, Defer, Quiesce, eboot, Reset, DMTF Reserved, Vendor Reserved"} For ComputerSystem instance representing the controller, will support 11 (Reset). For ComputerSystem instance representing the controllee, will support 2 (Enabled), 3 (Disabled), 4 (Shut Down). This operation is supported only if the user has Admin role. TABLE: Attributes for Oracle_ComputerSystem (Continued) Property Data Type Description ILOM Value172 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_ComputerSystemPackage (R) Description: The Oracle_ComputerSystemPackage class is used to associate the instance of Oracle_ComputerSystem representing the controllee to the physical package chassis, Oracle_Chassis, which realizes the Oracle_ComputerSystem. Inheritance: CIM_ComputerSystemPackage Properties: For a description of the supported properties for the Oracle_ComputerSystemPackage class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: • Physical Asset • Base Server TABLE: Properties for Oracle_ComputerSystemPackage Property Data Type Description ILOM Value Antecedent Oracle_Chassis REF The Antecedent property is a mandatory key property. The chassis that realizes a Oracle_ComputerSystem. Object path to an instance of Oracle_Chassis. Dependent Oracle_ComputerSyst em REF The Dependent property is a mandatory key property. Represents the Oracle_ComputerSystem. Object path to the instance of Oracle_ComputerSystem representing the controllee.Oracle’s Sun-Supported CIM Classes 173 Oracle_Container (R) Description: Oracle_Container is used to associate a physical package (CIM_PhysicalPackage) and a physical element (CIM_PhyscalElement) contained in the physical package. Inheritance: CIM_Container Properties: For a description of the supported properties for the Oracle_Container class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset TABLE: Properties for Oracle_Container Property Data Type Description ILOM Value GroupCompon ent CIM_PhysicalPackage REF The GroupComponent property is a mandatory key property. The PhysicalPackage that contains other physical elements, including other packages. Object path to an instance of CIM_PhysicalPackage. PartCompone nt CIM_PhysicalElement REF The PartComponent property is a mandatory key property. The PhysicalElement that is contained in the package. Object path to an instance of CIM_ PhysicalElement.174 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_ElementCapabilities (R) Description: The Oracle_ElementCapabilities class is used to associate an instance of ManagedElements and its capabilities. Inheritance: CIM_ElementCapabilities Properties: For a description of the supported properties for the Oracle_ElementCapabilities class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Base Server TABLE: Properties for Oracle_ElementCapabilities Property Data Type Description ILOM Value Capabilitie s CIM_Capabilities REF The Capabilities property is a mandatory key property. The Capabilities object that is associated with the element. Object path to an instance of Oracle_EnabledLogicalEle mentCapabilities. ManagedElem ent CIM_ManagedElement REF The ManagedElement property is a mandatory key property. Identifies the managed element. Object path to an instance of Oracle_ComputerSystem.Oracle’s Sun-Supported CIM Classes 175 Oracle_ElementConformsToProfile (R) Oracle_EnabledLogicalElementCapabilit Description: Oracle_ElementConformsToProfile associates the instance of Oracle_ComputerSystem representing the controllee to the instance of Oracle_RegisteredProfile representing the Base Server Profile. Inheritance: CIM_ElementConformsToProfile Properties: For a description of the supported properties for the Oracle_ElementConformsToProfile class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Profile Registration Base Server TABLE: Properties for Oracle_ElementConformsToProfile Property Data Type Description ILOM Value ElementConf ormsToProfi le Oracle_RegisteredPr ofile REF The ElementconformsToProfile property is a mandatory key property. The RegisteredProfile to which the ManagedElement conforms. Object path to the instance of Oracle_RegisteredProfile . ManagedElem ent ) Oracle_ComputerSyst em REF The ManagedElement property is a mandatory key property. The Oracle_ComputerSystem. Object path to the instance of Oracle_ComputerSystem representing the controllee.176 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ies (R) Description: EnabledLogicalElementCapabilities describes the capabilities supported for changing the state of the associated EnabledLogicalElement. Inheritance: CIM_EnabledLogicalElementCapabilities Properties: For a description of the supported properties for the Oracle_EnabledLogicalElementCapabilities class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Base ServerOracle’s Sun-Supported CIM Classes 177 TABLE: Properties for Oracle_EnabledLogicalElementCapabilities Property Data Type Description ILOM Value Instance ID string The InstanceID property is a mandatory key property. Within the scope of the instantiating Namespace, the InstanceID property uniquely identifies an instance of this class. The value of InstanceID should be constructed using the following preferred algorithm: : Where: • and are separated by a colon (:) • must include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating or defining InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of schema class names.) • must not contain a colon (:). The first colon to appear in InstanceID must appear between and . • is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. • For DMTF defined instances, the must be set to CIM. If this preferred algorithm is not used, the defining entity must ensure that the resultant InstanceID is not re-used across any instance IDs produced by this or other providers for this instance’s NameSpace. Represents the unique ID of the EnabledLogicalElemen tCapabilities. Descript ion string Textual description of the object. Appropriate descriptions.178 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ElementN ame string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Appropriate value. ElementN ameEditS upported boolean The boolean indicates whether the ElementName can be modified. Set to False. Requeste dStatesS upported uint16[] Indicates the possible states that can be requested when using the method RequestStateChange on the EnabledLogicalElement. The following values apply: {2, 3, 4, 6, 7, 8, 9, 10, 11} Definitions for these values are as follows: {Enabled, Disabled, Shut Down, Offline, Test, Defer, Quiesce, Reboot, Reset} For the EnabledLogicalElemen tCapabilities instance representing the controller, RequestedStatesSuppo rted[0] will be set to 11 (Reset). For the EnabledLogicalElemen tCapabilities instance representing the controllee, RequestedStatesSuppo rted[] will be set to 2 (Enabled), 3 (Disabled), or 4 (Shut Down). TABLE: Properties for Oracle_EnabledLogicalElementCapabilities (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 179 Oracle_HWCompErrorOkIndication (R) Description: When a client creates an indication subscription in which the filter indicates that it looks for CIM_InstModification in which the modified object is a PhysicalElement (that is the query statement is SourceInstance ISA CIM_PhysicalElement), and it looks for changes in SourceInstance.OperationalStatus or SourceInstance.HealthState then ILOM CIM-subsystem will generate Oracle_HWCompErrorOkIndication indication when a hardware component changes from good to bad, or vice versa. Inheritance: CIM_InstModification Properties: For a description of the supported properties for the Oracle_HWCompErrorOkIndication class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: None TABLE: Properties for Oracle_HWCompErrorOkIndication Property Data Type Description ILOM Value PreviousInstance string A copy of the previous instance whose change generated the indication. PreviousInstance contains older values of an instance’s properties (as compared to SourceInstance), selected by the IndicationFilter’s query. String representation of the previous instance of CIM_PhysicalElement that is affected. SensorObjectPath (SUN-specific) string Object path of the sensor that causes the hardware component to change operational state. Appropriate value.180 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 SourceInstance string A copy of the instance that changed to generate the Indication. SourceInstance contains the current values of the properties selected by the indication filter’s query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. String representation of the instance of CIM_PhysicalElement that is affected. SourceInstanceHos t string The host name or IP address of the SourceInstance. Will have the value Oracle_ComputerSystem.N ame of the instance of Oracle_ComputerSystem representating the controllee. SourceInstanceMod elPath string The model path of the SourceInstance. The following format must be used to encode the model path: :.

=, =\ ”, .. String representation of the object path of the SourceInstance. TABLE: Properties for Oracle_HWCompErrorOkIndication (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 181 Oracle_IndicatorLED (R) Note – The Indicator LED profile specifies the CIM_IndicatorLED class. However, the CIM_IndicatorLED class does not exist in version 2.18.1 of the CIM Schema. Therefore, Oracle uses the CIM_IndicatorLED class that is identified in the Experimental CIM Schema version 2.18.1 and re-named it to Oracle_IndicatorLED. Description: The Oracle_IndicatorLED class models the logical aspects of an indicator LED. Inheritance: CIM_IndicatorLED Properties: For a description of the supported properties for the Oracle_IndicatorLED class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Indicator LED TABLE: Properties for Oracle_IndicatorLED Property Data Type Description ILOM Value CreationClassName string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Indica torLED. DeviceID string The DeviceID property is a mandatory key property. An address or other identifying information used to uniquely name the LogicalDevice. Set to the NAC name of the of the LED. SystemCreationClas sName string The SystemCreationClassName property is a mandatory key property. The SystemCreationClassName of the scoping system. Set to Oracle_Comput erSystem.182 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 SystemName string The system name of the scoping system. Will be set to Oracle_Comput erSystem.Name of the instance of Oracle_Comput erSystem that represents the controllee. ActivationState uint16[] Indicates the current activity of an LED. An LED can exhibit behaviors that vary greatly in complexity. If the behavior of the LED is simple or a detailed depiction of the behavior is unnecessary to convey to client applications, values other than 5 (ControlPattern) can be used to indicate the behavior. If the behavior is complex and detailed information about the behavior is meaningful to a client, the value 5 (ControlPattern) can be used to indicate the ControlPattern property that describes the behavior. 2 (Lit) shall indicate that the LED is continuously illuminated without variation in color or intensity. 3 (Blinking) shall indicate that the LED is alternating between illuminated and not illuminated in a regular pattern without variation in color or intensity. The pattern is not indicated. 4 (Off) shall indicate that the LED is not illuminated. 5 (ControlPattern) shall indicate that the LED is exhibiting behavior that is described using the ControlPattern property. The following values apply: {2, 3, 4, 5, .., 32768..65535} Definitions for these values are as follows: {Lit, Blinking, Off, Control Pattern, DMTF Reserved, Vendor Reserved} Appropriate value. Color uint16[] Indicates the current color of the LED. If the value of the ActivationState property is 4 (Off), this property will indicate the color of the LED the last time it was lit, or it will have the value 2 (Not Applicable). Appropriate value. TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 183 ControlMode uint16[] Indicates the current control mode for the LED. 2 (Automatic) shall indicate that the state of the LED is being controlled by the management infrastructure. 3 (Manual) shall indicate that the state of the LED is being controlled by a management client. 4 (Test) shall indicate that the LED is in a test mode. The following values apply: {2, 3, 4, .., 32768..65535} Definitions for these values are as follows: {Automatic, Manual, Test, DMTF Reserved, Vendor Reserved} Appropriate value. ControlPattern string An LED can exhibit a range of behavior from very simple (for example, solid on) to very complicated (for example, a series of blinks of alternating color and duration). ControlPattern specifies the vendor or standard behavior exhibited by the LED if it cannot be described using one of the standard behaviors listed for the ActivationState property. If ActivationState has the value 5 (ControlPattern), the ControlPattern property shall not be NULL. The value of ControlPattern should be constructed using the following preferred algorithm: :: where: • and are separated by two colons (::) • includes a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the ControlPattern or that is a registered ID assigned to the business entity by a recognized global authority • If the definition of the value is specified by the DMTF, the value of must be DMTF. • is chosen by the business entity and should not be reused to identify different underlying (real-world) behaviors. If the behavior specified for the LED adheres to a standard or proprietary specification, should be a uniquely assigned value identifying the behavior. If the behavior for the LED is described using a standard or proprietary grammar, should be prefixed with a uniquely assigned identifier for the grammar. Appropriate value. TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM Value184 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 ElementName string Specifies an identifier for the LED. The value of ElementName should be constructed using the following preferred algorithm: :: where: • and are separated by two colons (::) • includes a copyrighted, trademarked, or otherwise unique name that is owned by the business entity that is creating or defining the ControlPattern or that is a registered ID assigned to the business entity by a recognized global authority. • is chosen by the business entity and should not be reused to identify different underlying (real-world) elements. Set to the NAC name of the LED. EnabledDefault uint16[] An enumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is Enabled (value= 2). Valid values are as follows: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions for the valid values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Set to default value 2 (Enabled). TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 185 EnabledState uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, -Shutting -Down (value=4) and -Starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests. • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65539 (Vendor Reserved) Appropriate value. TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM Value186 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional HealthStates in the future. Appropriate value. TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 187 IndicatedCondition s uint16[] The condition indicated by the LED. The following values apply: • 2 (Not Applicable) - The LED is currently not assigned an interpretation. • 3 (Location) - The LED is used to indicate that the location of associated managed elements. • 4 (Attention) - The LED is used to indicate that the associated managed elements requires the attention of service personnel. • 5 (Activity) -The LED is used to indicate that activity is occurring for the associated managed elements. The type of activity indicated is specific to the associated managed elements. • 6 (Powered On) - The LED is used to indicate if the associated managed elements are receiving power. • 7 (Fault) - The LED is used to indicate if the associated managed elements are in a fault, error, or otherwise degraded state. Appropriate value. TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM Value188 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 OperationalStatus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. Enumeration values can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} A list of valid values for the enumeration values include: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Appropriate value. OtherIndicatedCond itionDescription string This property will have a value if IndicatedCondition contains the value 1 (Other). Will have appropriate value if IndicatedCond ition contains the value 1 (Other). RequestedState uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for the above definitions include: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Set to 12 (Not Applicable). TABLE: Properties for Oracle_IndicatorLED (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 189 Oracle_InstCreation (R) Description: When a client creates an indication subscription in which the filter indicates that it looks for CIM_InstCreation and SourceInstance is a PhysicalElement (for example, the query statement contains SourceInstance ISA CIM_PhysicalElement) then the Oracle ILOM CIM subsystem will generate an Oracle_InstCreation indication when it detects that a hardware component is hot inserted into the chassis. Inheritance: CIM_InstCreation Properties: For a description of the supported properties for the Oracle_InstCreation, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: None TABLE: Properties for Oracle_InstCreation Property Data Type Description ILOM Value SourceInstance string A copy of the instance that changed to generate the indication. SourceInstance contains the current values of the properties selected by the indication filter’s query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. String representation of the instance of CIM_PhysicalElement that is hot-inserted. SourceInstanceH ost string The host name or IP address of the SourceInstance. Will have the value Oracle_ComputerSystem.N ame of the instance of Oracle_ComputerSystem representing the controllee. SourceInstanceM odelPath string The model path of the SourceInstance. The following format must be used to encode the model path: :.=, =\”, ... String representation of the object path of the SourceInstance.190 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_InstDeletion (R) Description: When a client creates an indication subscription in which the filter indicates that it looks for CIM_InstDeletion and SourceInstance is a PhysicalElement (for example, the query statement contains SourceInstance ISA CIM_PhysicalElement), then the Oracle ILOM CIM subsystem will generate an Oracle_InsDeletion indication when it detects that a hardware component is hot-removed from the chassis. Inheritance: CIM_InstDeletion Properties: For a description of the supported properties for the Oracle_InstDeletion class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: None TABLE: Properties for Oracle_InstDeletion Property Data Type Description ILOM Value SourceInstance string A copy of the instance that changed to generate the indication. SourceInstance contains the current values of the properties selected by the indication filter’s query. In the case of CIM_InstDeletion, the property values are copied before the instance is deleted. String representation of the instance of CIM_PhysicalElement that is hot-removed. SourceInstance Host string The host name or IP address of the SourceInstance. Will have the value Oracle_ComputerSystem.Nam e of the instance of Oracle_ComputerSystem representing the controllee. SourceInstance ModelPath string The model path of the SourceInstance. The following format must be used to encode the model path: :.=, =\”, ... String representation of the object path of the SourceInstance.Oracle’s Sun-Supported CIM Classes 191 Oracle_LogEntry (R) Description: Oracle_LogEntry is used to represent individual log records of IPMI SEL log. Inheritance: CIM_LogEntry Properties: For a description of the supported properties for the Oracle_LogEntry class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Record Log192 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_LogEntry Property Data Type Description ILOM Value InstanceID string The InstanceID property is a mandatory key property. Within the scope of the instantiating Namespace, InstanceID uniquely identifies an instance of this class. In order to ensure uniqueness within the NameSpace, the value of InstanceID should be constructed using the following preferred algorithm: : where: • and are separated by a colon (:) • You must include a copyrighted, trademarked, or otherwise the unique name that is owned by the business entity creating or defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of Schema class names.) • must not contain a colon (:). When you use this algorithm, the first colon to appear in InstanceID must appear between and . • is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. • For DMTF defined instances, the preferred algorithm must be used with the set to CIM. If this preferred algorithm is not used, the defining entity must ensure that the resultant InstanceID is not re-used across any InstanceIDs produced by this or other providers for this instance’s NameSpace. Implementation dependent value representing unique ID. CreationTim eStamp datetime A LogEntry can include a time stamp for the entry. Appropriate value. Description string Textual description of the object. SEL event description.Oracle’s Sun-Supported CIM Classes 193 ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. SEL event record ID. LogInstance ID string The string containing the log’s InstanceID. Implementation dependent value representing unique ID of the associated Oracle_RecordLog. LogName string The string containing the log’s Name. This property is available for backwards continuity with CIM_LogRecord. Will have the value SEL Log. TABLE: Properties for Oracle_LogEntry (Continued) Property Data Type Description ILOM Value194 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 RecordData string A string containing LogRecord data. If the corresponding RecordFormat property is , or cannot be parsed according to the recommended format, RecordData should be interpreted as a free-form string. If the RecordFormat property contains parseable format information (as recommended in the RecordFormat Description qualifier), the RecordData string should be parsed in accordance with this format. In this case, RecordData should begin with the delimiter character, and this character should be used to separate substrings in the manner described. The RecordData string can then be parsed by the data consumer and appropriately typed. Contents of the SEL event data. RecordForma t string A string describing the data structure of the information in the property, RecordData. If the RecordFormat string is , RecordData should be interpreted as a free-form string. To describe the data structure of RecordData, the RecordFormat string should be constructed as follows: • The first character is a delimiter character and is used to parse the remainder of the string into sub-strings. • Each substring is separated by the delimiter character and should be in the form of a CIM property declaration (for example, data type and property name). This set of declarations can be used to interpret the similarly delimited RecordData property. For example, using a * delimiter: RecordFormat = "*string ThisDay*uint32 ThisYear*datetime SomeTime" can be used to interpret: RecordData = "*This is Friday*2002*20020807141000.000000-300". Will have the format used for interpreting the RecordData property. RecordID string Provides a representation of log entry ordering or pointers and handles for log entries. SEL event record ID. TABLE: Properties for Oracle_LogEntry (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 195 Oracle_LogManagesRecord (R) Description: Oracle_LogManagesRecord is used to associate the instance of Oracle_RecordLog representing the IPMI SEL log to an instance of the SEL log record. Inheritance: CIM_LogManagesRecord Properties: For a description of the supported properties for the Oracle_LogManagesRecord class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Record log TABLE: Properties for Oracle_LogManagesRecord Property Data Type Description ILOM Value Log Oracle_RecordLog REF The Log property is a mandatory key property. Indicates the Oracle_RecordLog. Object path to the instance of Oracle_RecordLog representing the IPMI SEL log. Record Oracle_LogEntry REF The Record property is a mandatory key property. Indicates the Oracle_LogEntry. Object path to an instance of Oracle_LogEntry.196 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_Memory (R) Description: Provides capabilities and management of memory-related LogicalDevices. Inheritance: CIM_Memory Properties: For a description of the supported properties for the Oracle_Memory class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: System Memory TABLE: Properties for Oracle_Memory Property Data Type Description ILOM Value CreationClas sName string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Memory. DeviceID string The DeviceID property is a mandatory key property. An address or other identifying information used to uniquely name the LogicalDevice. Implementation dependent value representing unique ID. SystemCreati onClassName string The SystemCreationClassName property is a mandatory key property. Indicates the SystemCreationClassName of the scoping system. Set to Oracle_ComputerSyst em. SystemName string The SystemName property is a mandatory key property. Indicates the SystemName of the scoping system. Will be set to Oracle_ComputerSyst em.Name of the instance of Oracle_ComputerSyst em that represents the controllee.Oracle’s Sun-Supported CIM Classes 197 Access uint16[] The Access property describes whether the media is readable (value=1), writeable (value=2), or both (value= 3). Unknown (0) and Write Once (4) can also be defined. The following values apply: {0, 1, 2, 3, 4} Definitions for these values are: {Unknown, Readable, Writeable, Read/Write Supported, Write Once} Set to 3 (Read/Write Supported). BlockSize uint16[] Size in bytes of the blocks that form this StorageExtent. If the block size is variable, then the maximum block size in bytes should be specified. If the block size is unknown or if a block concept is not valid (for example, for AggregateExtents, Memory or LogicalDisks), enter a 1. Set to appropriate value if memory size can be computed. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Appropriate value. EnabledDefau lt uint16[] Enumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is 2 (Enabled). The following values apply: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions for these values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Set to default value 2 (Enabled). TABLE: Properties for Oracle_Memory (Continued) Property Data Type Description ILOM Value198 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledState uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, -Shutting -Down (value=4) and -Starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests. • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests. • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65539 (Vendor Reserved) Appropriate value. TABLE: Properties for Oracle_Memory (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 199 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Appropriate value. TABLE: Properties for Oracle_Memory (Continued) Property Data Type Description ILOM Value200 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 NumberOfBloc ks uint16[] Total number of logically contiguous blocks, of size BlockSize, which form this extent. The total size of the extent can be calculated by multiplying BlockSize by NumberOfBlocks. If the BlockSize is 1, this property is the total size of the extent. Will have appropriate value if memory size can be computed. OperationalS tatus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. Enumeration values can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Possible values for the enumeration values include: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Appropriate value. RequestedSta te uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for these definitions include: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Set to 12 (Not Applicable). TABLE: Properties for Oracle_Memory (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 201 Oracle_NumericSensor (R) Description: A numeric sensor that returns numeric readings and optionally supports thresholds settings. Inheritance: CIM_NumericSensor Properties: For a description of the supported properties for the Oracle_NumericSensor class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Sensor TABLE: Properties for Oracle_NumericSensor Property Data Type Description ILOM Value CreationCla ssName string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Numeric Sensor. DeviceID string The DeviceID property is a mandatory key property. An address or other identifying information used to uniquely name the LogicalDevice. Set to the NAC name of the sensor. SystemCreat ionClassNam e string The SystemCreationClassName property is a mandatory key property. Indicates the CreationClassName for the scoping system. Will be set to Oracle_Compute rSystem.Name of the instance of Oracle_Compute rSystem that represents the controllee. SystemName string The SystemName property is a mandatory key property. Indicates the SystemName of the scoping system. Set to Oracle_Compute rSystem.Name of the instance of Oracle_Compute rSystem that represents the controllee.202 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 BaseUnits uint16[] The base unit of the values returned by this sensor. All the values returned by this sensor are represented in the units obtained by BaseUnits * 10 raised to the power of the UnitModifier. For example, if BaseUnits is Volts and the UnitModifier is -6, then the units of the values returned are microvolts. However, if the RateUnits property is set to a value other than None, then the units are further qualified as rate units. In this example, if RateUnits is set to Per Second, then the values returned by the sensor are in microvolts/second. The units apply to all numeric properties of the sensor, unless explicitly overridden by the units qualifier. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66} Definitions of these values are: {Unknown, Other, Degrees C, Degrees F, Degrees K, Volts, Amps, Watts, Joules, Coulombs, VA, Nits, Lumens, Lux, Candelas, kPa, PSI, Newtons, CFM, RPM, Hertz, Seconds, Minutes, Hours, Days, Weeks, Mils, Inches, Feet, Cubic Inches, Cubic Feet, Meters, Cubic Centimeters, Cubic Meters, Liters, Fluid Ounces, Radians, Steradians, Revolutions, Cycles, Gravities, Ounces, Pounds, Foot-Pounds, Ounce-Inches, Gauss, Gilberts, Henries, Farads, Ohms, Siemens, Moles, Becquerels, PPM (parts/million), Decibels, DbA, DbC, Grays, Sieverts, Color Temperature Degrees K, Bits, Bytes, Words (data), DoubleWords, QuadWords, Percentage, Pascals} Appropriate value depending on sensor type. CurrentRead ing sint32 The current value indicated by the sensor. Appropriate value. CurrentStat e string The current state indicated by the sensor. This is always one of the PossibleStates. Appropriate value representing current state of the sensor. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 203 ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Set to the NAC name of the sensor. EnabledDefa ult uint16[] An enumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is Enabled (value=2). The following values apply: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions of these values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Set to default value 2 (Enabled). TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM Value204 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledStat e uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests. • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests. • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an Enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65539 (Vendor Reserved) Will have appropriate value depending on whether the sensor is enabled, disabled, or unknown. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 205 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Appropriate value. LowerThresh oldCritical sint32 The sensor’s threshold values specify the ranges (min and max values) for determining whether the sensor is operating under Normal, NonCritical, Critical, or Fatal conditions. If the CurrentReading is between LowerThresholdCritical and Lower ThresholdFatal, then the CurrentState is Critical. Will have appropriate value if sensor supports this threshold. If sensor does not support this threshold, this property will not be set. LowerThresh oldFatal sint32 The sensor’s threshold values specify the ranges (min and max values) for determining whether the sensor is operating under Normal, NonCritical, Critical, or Fatal conditions. If the CurrentReading is below LowerThresholdFatal, then the current state is Fatal. Will have appropriate value if sensor supports this threshold. If sensor does not support this threshold, this property will not be set. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM Value206 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Operational Status uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. Enumeration definitions can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for the enumeration definitions are as follows: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Will have appropriate value. PossibleSta tes string PossibleStates enumerates the string outputs of the sensor. For example, a switch sensor can output the states On, or Off. Another implementation of the switch might output the states Open and Close. Another example is a NumericSensor supporting thresholds. This sensor can report the states like Normal, Upper Fatal, Lower Non-Critical, and so on. A NumericSensor that does not publish readings and thresholds, but can store the data internally and still report its states. Will have appropriate values depending on the type of the sensor. RateUnits uint16[] Specifies if the units returned by this sensor are rate units. All the values returned by this sensor are represented in the units obtained by (BaseUnits * 10 raised to the power of the UnitModifier). This is true unless this property (RateUnits) has a value different from None. For example, if BaseUnits is Volts and the UnitModifier is -6, then the units of the values returned are microvolts. But, if the RateUnits property is set to a value other than "None", then the units are further qualified as rate units. In this example, if RateUnits is set to "Per Second", then the values returned by the Sensor are in microvolts/second. The units apply to all numeric properties of the sensor, unless explicitly overridden by the Units qualifier. Any implementation of CurrentReading should be qualified with either a Counter or a Gauge qualifier, depending on the characteristics of the sensor being modeled. Will be set to 0. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 207 RequestedSt ate uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for the above definitions are as follows {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Set to 12 (Not Applicable). SensorType uint16[] Identifies the type of the sensor, for example, voltage sensor or temperature sensor. If the type is set to Other, then the OtherSensorType description can be used to further identify the type, or if the sensor has numeric readings, then the type of the sensor can be implicitly determined by the Units. A description of the different sensor types is as follows: • A temperature sensor measures the environmental temperature. • Voltage and current sensors measure electrical voltage and current readings. • A tachometer measures speed/revolutions of a device. For example, a fan device can have an associated tachometer that measures its speed. • A counter is a general purpose sensor that measures some numerical property of a device. • A counter value can be cleared, but it never decreases. • A switch sensor has states like Open or Close, On or Off, or Up or Down. • A Lock has states of Locked or Unlocked. Humidity, smoke detection, and air flow sensors measure the equivalent environmental characteristics. • A presence sensor detects the presence of a PhysicalElement. • A power consumption sensor measures the instantaneous power consumed by a managed element. • A power production sensor measures the instantaneous power produced by a managed element such as a power supply or a voltage regulator. • A pressure sensor is used to report pressure. Appropriate value. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM Value208 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, .., 32768..65535} Definitions of these values are: {Unknown, Other, Temperature, Voltage, Current, Tachometer, Counter, Switch, Lock, Humidity, Smoke Detection, Presence, Air Flow, Power Consumption, Power Production, Pressure, DMTF Reserved, Vendor Reserved} SupportedTh resholds uint16[] An array representing the thresholds supported by this sensor. The following values apply: {0, 1, 2, 3, 4, 5} Definitions of these values are: {LowerThresholdNonCritical, UpperThresholdNonCritical, LowerThresholdCritical, UpperThresholdCritical, LowerThresholdFatal, UpperThresholdFatal} String values of supported thresholds. UpperThresh oldCritical sint32 The sensor’s threshold values specify the ranges (min and max values) for determining whether the sensor is operating under Normal, NonCritical, Critical, or Fatal conditions. If the CurrentReading is above UpperThresholdFatal, then the current state is Fatal. Will have appropriate value if sensor supports this threshold. If sensor does not support this threshold, then this property will not be set. UpperThresh oldNonCriti cal sint32 The sensor’s threshold values specify the ranges (min and max values) for determining whether the sensor is operating under Normal, NonCritical, Critical, or Fatal conditions. If the CurrentReading is between LowerThresholdNonCritical and UpperThresholdNonCritical, then the sensor is reporting a normal value. If the CurrentReading is between UpperThreshold NonCritical and UpperThresholdCritical, then the current state is NonCritical. Will have appropriate value if sensor supports this threshold. If sensor does not support this threshold, then this property will not be set. TABLE: Properties for Oracle_NumericSensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 209 Oracle_PhysicalAssetCapabilities (R) Description: Provides the capabilities for representing FRU-related information for an associated instance of the CIM_PhysicalElement subclass. Inheritance: CIM_PhysicalAssetCapabilities Properties: For a description of the supported properties for the Oracle_PhysicalAssetCapabilities class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset210 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_PhysicalAssetCapabilities Property Data Type Description ILOM Value InstanceID string The InstanceID property is a mandatory key property. Within the scope of the instantiating NameSpace, the InstanceID property uniquely identifies an instance of this class. The value of InstanceID should be constructed using the following preferred algorithm: : where: • and are separated by a colon (:). • must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity creating or defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of schema class names.) • must not contain a colon (:). The first colon to appear in InstanceID must appear between and . • is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. • For DMTF defined instances, the must be set to CIM. If this preferred algorithm is not used, the defining entity must ensure that the resultant InstanceID is not re-used across any instance IDs produced by this or other providers for this instance’s NameSpace. Implementation dependent value representing unique ID of PhysicalAssetCapabilit ies. FRUInfoSupp orted boolean A boolean that indicates whether the PartNumber, Serial Number, Model, Manufacturer, and SKU properties of PhysicalElement are non-null, non-blank values, and the availability of the complete FRU information. Will be set to TRUE or FALSE depending on whether the associated instance of CIM_PhysicalElement is considered to be a FRU by the platform.Oracle’s Sun-Supported CIM Classes 211 Oracle_PhysicalComponent (R) Description: The PhysicalComponent class represents any low-level or basic component within a package. A component object either can not or does not need to be decomposed into its constituent parts. Inheritance: CIM_PhysicalComponent Properties: For a description of the supported properties for the Oracle_PhysicalComponent class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset212 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_PhysicalComponent Property Data Type Description ILOM Value CreationClassN ame string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_PhysicalCompon ent Tag string The Tag property is a mandatory key property. An arbitrary string that uniquely identifies the physical element and serves as the key of the element. The Tag property can contain information such as asset tag or serial number data. The key for the physical element is placed very high in the object hierarchy in order to independently identify the hardware or entity, regardless of physical placement in or on cabinets, adapters, and so on. For example, a hot-swappable or removable component can be taken from its containing (scoping) package and be temporarily unused. The object still continues to exist and can even be inserted into a different scoping container. Therefore, the key for physical element is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Set to component NAC name. -CanBeFRUed boolean A boolean that indicates whether this physical element can be a FRU (TRUE) or not (FALSE). Will be set to TRUE or FALSE depending on whether the component is considered to be a FRU by the platform. Description string The Description property provides a textual description of the object. Will have appropriate description.Oracle’s Sun-Supported CIM Classes 213 ElementName string User-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Set to component NAC name. HealthState uint16 Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The possible values are 0 to 30, where 5 means the element is entirely healthy and 30 means the element is completely non-functional. The following continuum is defined: • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. • 25 (Critical Failure) - The element is nonfunctional and recovery might not be possible. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. Will have the appropriate value depending on whether the component is in error state or not. TABLE: Properties for Oracle_PhysicalComponent (Continued) Property Data Type Description ILOM Value214 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 • 0 (Unknown) - The implementation cannot report on HealthState at this time. DMTF has reserved the unused portion of the continuum for additional health states in the future. Possible values are: {0, 5, 10, 15, 20, 25, 30, ..} Definitions for these values are: {Unknown, OK, Degraded/Warning, Minor failure, Major failure, Critical failure, Non-recoverable error, DMTF Reserved} Manufacturer string The name of the organization responsible for producing the PhysicalElement. This organization might be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product. Will have the appropriate value if the component is considered as a FRU by the platform. Model string The name by which the PhysicalElement is generally known. Will have the appropriate value if the component is considered a FRU by the platform. TABLE: Properties for Oracle_PhysicalComponent (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 215 OperationalSta tus Uint16 [] Indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. However, a few are not and are described here in more detail. • Stressed - indicates that the element is functioning, but needs attention. Examples of stressed states are overload, overheated, and so on. • Predictive Failure - indicates that an element is functioning nominally but predicting a failure in the near future. • In Service - describes an element being configured, maintained, cleaned, or otherwise administered. • No Contact - indicates that the monitoring system has knowledge of this element, but has never been able to establish communications with it. • Lost Communication - indicates that the ManagedSystemElement is known to exist and has been contacted successfully in the past, but is currently unreachable. • Stopped and Aborted - are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the element might need to be updated. • Dormant - indicates that the element is inactive or quiesced. • Supporting Entity in Error - indicates that this element might be OK but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems. OperationalStatus[0] will have appropriate value depending on whether the component is in error state or not. TABLE: Properties for Oracle_PhysicalComponent (Continued) Property Data Type Description ILOM Value216 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 • Completed - indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded so that a client can tell if the complete operation Completed with OK (passed), Completed with Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error). • Power Mode - indicates that the element has additional power mode information contained in the PowerManagementService association. OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today’s environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, providers or instrumentation should provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element. Possible values are: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Definitions of these values are: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non- Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} PartNumber string The part number assigned by the organization that is responsible for producing or manufacturing the PhysicalElement. Will have the appropriate value if the component is considered a FRU by the platform. TABLE: Properties for Oracle_PhysicalComponent (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 217 SKU string The stock-keeping unit number for this PhysicalElement. Will have the appropriate value if the component is considered a FRU by the platform. SerialNumber string A manufacturer-allocated number used to identify the PhysicalElement. Will have the appropriate value if the component is considered a FRU by the platform. StatusDescript ions string[] Strings describing the various OperationalStatus array values. For example, if Stopping is the value assigned to OperationalStatus, then this property can contain an explanation as to why an object is being stopped. Note - Entries in this array are correlated with those at the same array index in OperationalStatus. StatusDescriptions[0] will have appropriate description on the reason for the value of OperationalStatus[0]. TABLE: Properties for Oracle_PhysicalComponent (Continued) Property Data Type Description ILOM Value218 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_PhysicalElementCapabilities (R) Description: Oracle_PhysicalElementCapabilities is used to associate an instance of CIM_PhysicalElement to its capabilities, Oracle_PhysicalAssetCapabilities. Inheritance: CIM_ElementCapabilities Properties: For a description of the supported properties for the Oracle_PhysicalElementCapabilities class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset TABLE: Properties for Oracle_PhysicalElementCapabilities Property Data Type Description ILOM Value Capabilities Oracle_PhysicalAs setCapabilities REF The Capabilities property is a mandatory key property. The Capabilities object associated with the element. Object path to an instance of Oracle_PhysicalAssetCapa bilities. ManagedElement CIM_PhysicalEleme nt REF The ManagedElement property is a mandatory key property. Identifies the managed element. Object path to an instance of Oracle_PhysicalElement.Oracle’s Sun-Supported CIM Classes 219 Oracle_PhysicalMemory (R) Description: The Oracle_PhysicalMemory is used to represent low-level memory devices such as SIMMs, DIMMs, raw memory chips, and so forth. Inheritance: CIM_PhysicalMemory Properties: For a description of the supported properties for the Oracle_PhysicalMemory class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset220 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_PhysicalMemory Property Data Type Description ILOM Value CreationCla ssName string The CreationClassName property is a mandatory key property CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_PhysicalMemo ry. Tag string The Tag property is a mandatory key property. The Tag property is an arbitrary string that uniquely identifies the physical element and serves as the key of the element. The Tag property can contain information such as asset tag or serial number data. The key for PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware or entity, regardless of physical placement in or on cabinets, adapters, and so on. For example, a hot-swappable or removable component can be taken from its containing (scoping) package and be temporarily unused. The object still continues to exist and can even be inserted into a different scoping container. Therefore, the key for PhysicalElement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Set to component NAC name. CanBeFRUed boolean The boolean that indicates whether this PhysicalElement is a FRU (TRUE) or not (FALSE). Set to TRUE or FALSE depending on whether the component is considered to be a FRU by the platform. Description string Textual description of the object. Appropriate description. FormFactor uint16[] The implementation form factor for the chip. For example, values such as SIMM (7), TSOP (9) or PGA (10) can be specified. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23} Definitions for these values are: {Unknown, Other, SIP, DIP, ZIP, SOJ, Proprietary, SIMM, DIMM, TSOP, PGA, RIMM, SODIMM, SRIMM, SMD, SSMP, QFP, TQFP, SOIC, LCC, PLCC, BGA, FPBGA, LGA} Set to value 8 (DIMM).Oracle’s Sun-Supported CIM Classes 221 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Will have appropriate value depending on whether the component is in error state or not. MemoryType uint16[] The type of PhysicalMemory. Synchronous DRAM is also known as SDRAM. Cache DRAM is also known as CDRAM. CDRAM is also known as Cache DRAM. SDRAM is also known as Synchronous DRAM. BRAM is also known as Block RAM. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26..32567, 32568..65535} Definitions for these values are: {Unknown, Other, DRAM, Synchronous DRAM, Cache DRAM, EDO, EDRAM, VRAM, SRAM, RAM, ROM, Flash, EEPROM, FEPROM, EPROM, CDRAM, 3DRAM, SDRAM, SGRAM, RDRAM, DDR, DDR-2, BRAM, FB-DIMM, DDR3, FBD2, DMTF Reserved,Vendor Reserved} Appropriate value. TABLE: Properties for Oracle_PhysicalMemory (Continued) Property Data Type Description ILOM Value222 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Manufacture r string The name of the organization responsible for producing the PhysicalElement. This organization might be the entity from whom the Element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product. Will have appropriate value if the processor chip is considered a FRU by the platform. Model string The name by which the PhysicalElement is generally known. Will have appropriate value if the processor chip is considered a FRU by the platform. Operational Status uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. Enumeration values can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Possible values for the enumeration values include: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} OperationalStatus[0 ] will have appropriate value depending on whether the component is in error state or not. PartNumber string Part number assigned by the organization that is responsible for producing or manufacturing the physical element. Will have appropriate value if the processor chip is considered a FRU by the platform. SKU string The stock-keeping unit number for this physical element. Will have appropriate value if the processor chip is considered a FRU by the platform. SerialNumbe r string A manufacturer-allocated number used to identify the physical element. Will have appropriate value if the processor chip is considered a FRU by the platform. StatusDescr iptions string[] Strings describing the various OperationalStatus array values. For example, if Stopping is the value assigned to OperationalStatus, then this property might contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus. StatusDescriptions [0] will have appropriate description on the reason for the value of OperationalStatus[0]. TABLE: Properties for Oracle_PhysicalMemory (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 223 Oracle_PhysicalPackage (R) Description: The Oracle_PhysicalPackage class represents physical elements that contain or host other components. Inheritance: CIM_PhysicalPackage Properties: For a description of the supported properties for the Oracle_PhysicalPackage class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical Asset224 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_PhysicalPackage Property Data Type Description ILOM Value CreationCla ssName string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_PhysicalPacka ge. Tag string The Tag property is a mandatory key property. The Tag property is an arbitrary string that uniquely identifies the physical element and serves as the key of the element. The Tag property can contain information such as asset tag or serial number data. The key for PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware or entity, regardless of physical placement in or on cabinets, adapters, and so on. For example, a hot-swappable or removable component can be taken from its containing (scoping) package and be temporarily unused. The object still continues to exist and can even be inserted into a different scoping container. Therefore, the key for PhysicalElement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Set to component NAC name. CanBeFRUed boolean A boolean that indicates whether this PhysicalElement is a FRU (TRUE) or not (FALSE). Will be set to TRUE or FALSE depending on whether the component is considered to be a FRU by the platform. Description string Textual description of the object. Appropriate description. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Set to component NAC name.Oracle’s Sun-Supported CIM Classes 225 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply. • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Will have appropriate value depending on whether the component is in error state or not. Manufacture r string The name of the organization responsible for producing the PhysicalElement. This organization might be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product. Will have appropriate value if the processor chip is considered as a FRU by the platform. Model string The name by which the PhysicalElement is generally known. Will have appropriate value if the component is considered as a FRU by the platform. TABLE: Properties for Oracle_PhysicalPackage (Continued) Property Data Type Description ILOM Value226 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Operational Status Uint16 [] Indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. However, a few are not and are described here in more detail. • Stressed - indicates that the element is functioning, but needs attention. Examples of stressed states are overload, overheated, and so on. • Predictive Failure - indicates that an element is functioning nominally but predicting a failure in the near future. • In Service - describes an element being configured, maintained, cleaned, or otherwise administered. • No Contact - indicates that the monitoring system has knowledge of this element, but has never been able to establish communications with it. • Lost Communication - indicates that the ManagedSystemElement is known to exist and has been contacted successfully in the past, but is currently unreachable. • Stopped and Aborted - are similar, although the former implies a clean and orderly stop, while the latter implies an abrupt stop where the state and configuration of the element might need to be updated. • Dormant - indicates that the element is inactive or quiesced. • Supporting Entity in Error - indicates that this element might be OK but that another element, on which it is dependent, is in error. An example is a network service or endpoint that cannot function due to lower-layer networking problems. • Completed - indicates that the element has completed its operation. This value should be combined with either OK, Error, or Degraded so that a client can tell if the complete operation Completed with OK (passed), Completed with Error (failed), or Completed with Degraded (the operation finished, but it did not complete OK or did not report an error). OperationalStatus[0] will have appropriate value depending on whether the component is in error state or not. TABLE: Properties for Oracle_PhysicalPackage (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 227 • Power Mode - indicates that the element has additional power mode information contained in the PowerManagementService association. OperationalStatus replaces the Status property on ManagedSystemElement to provide a consistent approach to enumerations, to address implementation needs for an array property, and to provide a migration path from today's environment to the future. This change was not made earlier because it required the deprecated qualifier. Due to the widespread use of the existing Status property in management applications, providers or instrumentation should provide both the Status and OperationalStatus properties. Further, the first value of OperationalStatus should contain the primary status for the element. When instrumented, Status (because it is single-valued) should also provide the primary status of the element. Possible values are: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Definitions of these values are: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non- Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} TABLE: Properties for Oracle_PhysicalPackage (Continued) Property Data Type Description ILOM Value228 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 PackageType uint16[] Enumeration defining the type of the PhysicalPackage. Note that this enumeration expands on the list in the Entity MIB (the attribute, entPhysicalClass). The numeric values are consistent with the CIM enumeration numbering guidelines, but are slightly different from the MIB values. • Unknown - indicates that the package type is not known. • Other - indicates that the package type does not correspond to an existing enumerated value. The value is specified using the OtherPackageType property. • Rack through Port or Connector - these values are defined per the Entity-MIB (where the semantics of rack are equivalent to the MIB’s stack value). • The other values (for battery, processor, memory, power source or generator and storage media package) are self-explanatory. A value of the blade server should be used when the PhysicalPackage contains the operational hardware aspects of a ComputerSystem, without the supporting mechanicals such as power and cooling. For example, a blade server (server module) includes processors and memory, and relies on the containing chassis to supply power and cooling. In many respects, a blade can be considered a module or card. However, it is tracked differently by inventory systems and differs in terms of service philosophy. For example, a blade server is intended to be hot-plugged into a hosting enclosure without requiring additional cabling, and does not require a cover to be removed from the enclosure for installation. Appropriate value. TABLE: Properties for Oracle_PhysicalPackage (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 229 Similarly, a blade expansion module has characteristics of a blade server and a module or card. However, it is distinct from both due to inventory tracking and service philosophy, and because of its hardware dependence on a blade. A blade expansion module (or card) must be attached to a blade before you insert the resultant assembly into an enclosure. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17} Definitions for these values are: {Unknown, Other, Rack, Chassis/Frame, Cross Connect/Backplane, Container/Frame Slot, Power Supply, Fan, Sensor, Module/Card, Port/Connector, Battery, Processor, Memory, Power Source/Generator, Storage Media Package (for example, Disk or Tape Drive), Blade, Blade Expansion} PartNumber string Part number assigned by the organization that is responsible for producing or manufacturing the PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. SKU string The SKU property is a manufacturer-allocated number used to identify the PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. SerialNumbe r string A manufacturer-allocated number used to identify the PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. StatusDescr iptions string[] Strings describing the various OperationalStatus array values. For example, if Stopping is the value assigned to OperationalStatus, then this property can contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus. StatusDescriptions[0] will have appropriate description on the reason for the value of OperationalStatus[0]. TABLE: Properties for Oracle_PhysicalPackage (Continued) Property Data Type Description ILOM Value230 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_Processor (R) Description: Identifies capabilities and management of the processor logical device. Inheritance: CIM_Processor Properties: For a description of the supported properties for the Oracle_Processor class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: CPU TABLE: Properties for Oracle_Processor Property Data Type Description ILOM Value CreationClass Name string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Processor. DeviceID string The DeviceID property is a mandatory key property. The Device ID indicates an address or other identifying information used to uniquely name the LogicalDevice. Will be set to the NAC name of the sensor. SystemCreatio nClassName string The SystemCreationName property is a mandatory key property. Indicates the CreationClassName of the scoping system. Set to Oracle_ComputerSyste m. SystemName string The SystemName property is a mandatory key property. Indicates the SystemName of the scoping system. Set to Oracle_ComputerSyste m.Name of the instance of Oracle_ComputerSyste m that represents the controllee.Oracle’s Sun-Supported CIM Classes 231 CPUStatus uint16[] Indicates the current status of the processor. For example, the processor might be disabled by the user (value=2), or disabled due to a POST error (value=3). Information in this property can be obtained from SMBIOS, the type 4 structure, and the status attribute. The following values are apply: {0, 1, 2, 3, 4, 7} Definitions of these values are: {Unknown, CPU Enabled, CPU Disabled by User, CPU Disabled By BIOS (POST Error), CPU Is Idle, Other} Appropriate value. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Will be set to the NAC name of the sensor. EnabledDefaul t uint16[] Eumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is Enabled (value=2). The following values apply: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions for these values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Set to default value 2 (Enabled). TABLE: Properties for Oracle_Processor (Continued) Property Data Type Description ILOM Value232 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledState uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests. • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests. • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65535 (Vendor Reserved) Appropriate value. TABLE: Properties for Oracle_Processor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 233 Family uint16[] The Processor family type. For example, values include Pentium(R) processor with MMX(TM) technology (value=14) and 68040 (value=96). The following values apply: {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 48, 49, 50, 51, 52, 53, 54, 55, 64, 65, 66, 67, 68, 69, 80, 81, 82, 83, 84, 85, 86, 87, 88, 96, 97, 98, 99, 100, 101, 112, 120, 121, 122, 128, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 160, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 200, 201, 202, 203, 204, 210, 211, 212, 213, 230, 250, 251, 254, 255, 260, 261, 280, 281, 300, 301, 302, 320, 350, 500, 65534, 65535} Appropriate value. TABLE: Properties for Oracle_Processor (Continued) Property Data Type Description ILOM Value234 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Appropriate value. TABLE: Properties for Oracle_Processor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 235 OperationalSt atus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration's values are self-explanatory. Enumeration definitions can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for the enumeration definition are as follows: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Appropriate value. RequestedStat e uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for these definitions are: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Set to 12 (Not Applicable). TABLE: Properties for Oracle_Processor (Continued) Property Data Type Description ILOM Value236 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_ProcessorChip (R) Description: Identifies the integrated circuit hardware for the processor. Inheritance: CIM_Chip Properties: For a description of the supported properties for the Oracle_ProcessorChip class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Physical AssetOracle’s Sun-Supported CIM Classes 237 TABLE: Properties for Oracle_ProcessorChip Property Data Type Description ILOM Value CreationCla ssName string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_ProcessorChip. Tag string The Tag property is a mandatory key property. The Tag property is an arbitrary string that uniquely identifies the physical element and serves as the key of the element. The Tag property can contain information such as asset tag or serial number data. The key for PhysicalElement is placed very high in the object hierarchy in order to independently identify the hardware or entity, regardless of physical placement in or on cabinets, adapters, and so on. For example, a hot-swappable or removable component can be taken from its containing (scoping) package and be temporarily unused. The object still continues to exist and can even be inserted into a different scoping container. Therefore, the key for PhysicalElement is an arbitrary string and is defined independently of any placement or location-oriented hierarchy. Set to component NAC name. CanBeFRUed boolean The boolean indicates whether this PhysicalElement can be a FRU (TRUE) or not (FALSE). Set to TRUE or FALSE depending on whether the component is considered to be a FRU by the platform. Description string Textual description of the object. Appropriate description. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Set to component NAC name.238 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Will have appropriate value depending on whether the component is in error state or not. Manufacture r string The name of the organization responsible for producing the physical element. This organization might be the entity from whom the element is purchased, but this is not necessarily true. The latter information is contained in the Vendor property of CIM_Product. Will have appropriate value if the processor chip is considered a FRU by the platform. Model string The name by which the physical element is generally known. Will have appropriate value if the processor chip is considered a FRU by the platform. TABLE: Properties for Oracle_ProcessorChip (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 239 Operational Status uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. Enumeration definitions can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for these definitions: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} OperationalStatus[0] will have appropriate value depending on whether the component is in error state or not. PartNumber string Part number assigned by the organization that is responsible for producing or manufacturing the PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. SKU string The stock-keeping unit number for this PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. SerialNumbe r string A manufacturer-allocated number used to identify this PhysicalElement. Will have appropriate value if the processor chip is considered a FRU by the platform. StatusDescr iptions string[] Strings describing the various OperationalStatus array values. For example, if Stopping is the value assigned to OperationalStatus, then this property can contain an explanation as to why an object is being stopped. Note that entries in this array are correlated with those at the same array index in OperationalStatus. StatusDescriptions[0] will have appropriate description on the reason for the value of OperationalStatus[0]. TABLE: Properties for Oracle_ProcessorChip (Continued) Property Data Type Description ILOM Value240 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_Realizes (R) Description: Oracle_Realizes is the association that defines the mapping between LogicalDevices and the PhysicalElements that implement them. Inheritance: CIM_Realizes Properties: For a description of the supported properties for the Oracle_Realizes class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: • Physical Asset • CPU • System Memory TABLE: Properties for Oracle_Realizes Property Data Type Description ILOM Value Antecedent CIM_PhysicalElement REF The Antecedent property is a mandatory key property. The physical component that implements the device. Object path to an instance of CIM_PhysicalElement. Dependent CIM_LogicalDevice REF The Dependent property is a mandatory key property. The LogicalDevice. Object path to an instance of CIM_LogicalDevice.Oracle’s Sun-Supported CIM Classes 241 Oracle_RegisteredProfile (R) Description: Provides implementation conformance to a CIM profile. Inheritance: CIM_RegisteredProfile Properties: For a description of the supported properties for the Oracle_RegisteredProfile class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Profile Registration242 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 TABLE: Properties for Oracle_RegisteredProfile Property Data Type Description ILOM Value InstanceID string The InstanceID property is a key mandatory property. Within the scope of the instantiating NameSpace, the InstanceID property uniquely identifies an instance of this class. The value of InstanceID should be constructed using the following preferred algorithm: : where: • and are separated by a colon (:). • must include a copyrighted, trademarked, or otherwise unique name that is owned by the business entity creating or defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of schema class names.) • must not contain a colon (:). The first colon to appear in InstanceID must appear between and . • is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements • For DMTF defined instances, the must be set to CIM. If this preferred algorithm is not used, the defining entity must ensure that the resultant InstanceID is not re-used across any instance IDs produced by this or other providers for this instance’s NameSpace. Implementation dependent value representing unique ID. AdvertiseTypes uint16[] Signifies the advertisement for the profile information. It is used by the advertising services of the WBEM infrastructure to determine what should be advertised, using what mechanisms. The property is an array so that the profile might be advertised using several mechanisms. Note - If this property is null/uninitialized, this is equivalent to specifying the value 2 (Not Advertised). Will have the value 2 (Not Advertised). RegisteredName string The name of this registered profile. Since multiple versions can exist for the same RegisteredName, the combination of RegisteredName, RegisteredOrganization, and RegisteredVersion must uniquely identify the registered profile within the scope of the organization. Value of supported profile name.Oracle’s Sun-Supported CIM Classes 243 RegisteredOrgan ization uint16[] The organization that defines this profile. The values for this property include: {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, ..} Definitions for these values are as follows: {Other, DMTF, CompTIA, Consortium for Service Innovation, FAST, GGF, INTAP, itSMF, NAC, Northwest Energy Efficiency Alliance, SNIA, TM Forum, The Open Group, ANSI, IEEE, IETF, INCITS, ISO, W3C, OGF, DMTF Reserved} Will have the value 2 (DMTF). RegisteredVersi on string The version of this profile. The string representing the version must be in the form: M + . + N + . + U where: • M - The major version (in numeric form) describing the profile’s creation or last modification. • N - The minor version (in numeric form) describing the profile’s creation or last modification. • U - The update (for example, errata, patch, and so forth, in numeric form) describing the profile’s creation or last modification. Will have, for example, 1.0.0 as the value. TABLE: Properties for Oracle_RegisteredProfile (Continued) Property Data Type Description ILOM Value244 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_RecordLog (R) Description: Oracle_RecordLog serves as an aggregation point for log entry objects. It is used to represent the IPMI SEL log. Properties of Oracle_RecordLog follow guidelines in IPMI CIM Mapping Guideline. Inheritance: CIM_RecordLog Properties: For a description of the supported properties for the Oracle_RecordLog class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Record LogOracle’s Sun-Supported CIM Classes 245 TABLE: Properties for Oracle_RecordLog Property Data Type Description ILOM Value InstanceID string The InstanceID property is a key manadatory property. Within the scope of the instantiating NameSpace, the InstanceID property uniquely identifies an instance of this class. The value of InstanceID should be constructed using the following preferred algorithm: : where: • and are separated by a colon (:). • must include a copyrighted, trademarked or otherwise unique name that is owned by the business entity creating or defining the InstanceID, or is a registered ID that is assigned to the business entity by a recognized global authority. (This is similar to the _ structure of schema class names.) • must not contain a colon (:). The first colon to appear in InstanceID must appear between and . • is chosen by the business entity and should not be re-used to identify different underlying (real-world) elements. • For DMTF defined instances, the must be set to CIM. If this preferred algorithm is not used, the defining entity must ensure that the resultant InstanceID is not re-used across any instance IDs produced by this or other providers for this instance’s NameSpace. Implementationdependent value representing unique ID. CurrentNumberO fRecords UInt64 Current number of records in the log. Appropriate value. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note - The Name property of ManagedSystemElement is also defined as a user-friendly name. But, it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Will hve the value SEL Log.246 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledDefault uint16[] An enumerated value indicating an administrator’s default or startup configuration for the EnabledState of an element. By default, the element is Enabled (value=2). The following values apply: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions of these values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved} Will be set to default value 2 (Enabled). EnabledState uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests. • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65539 (Vendor Reserved) Appropriate value. TABLE: Properties for Oracle_RecordLog (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 247 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Appropriate value. LogState uint16[] LogState is an integer enumeration that indicates the current state of a log represented by CIM_Log subclasses. LogState is to be used in conjunction with the EnabledState property to fully describe the current state of the log. The following text briefly summarizes the various log states: Unknown (0) indicates the state of the log is unknown. Normal (2) indicates that the log is or could be executing logging commands, will process any queued log entries, and will queue new logging requests. Erasing (3) indicates that the log is being erased. Not Applicable (4) indicates the log does not support representing a log state. The following values apply: {0, 2, 3, 4, .., 32768..65535} Definitions for these values are: {Unknown, Normal, Erasing, Not Applicable, DMTF Reserved, Vendor Reserved} Appropriate value. MaxNumberOfRec ords UInt64 Maximum number of records that can be captured in the log. If undefined, a value of 0 should be specified. Appropriate value. TABLE: Properties for Oracle_RecordLog (Continued) Property Data Type Description ILOM Value248 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 OperationalStatus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. Enumeration definitions can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Values for the enumeration definitions include: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Appropriate value. OverwritePolicy uint16[] Integer enumeration that indicates whether the log, represented by the CIM_Log subclasses, can overwrite its entries. Unknown (0) indicates that the log’s overwrite policy is unknown. Wraps When Full (2) indicates that the log overwrites its entries with new entries when the log has reached its maximum capacity. Never Overwrites (7) indicates that the log never overwrites its entries by the new entries. The following values apply: {0, 2, 7, .., 32768..65535} Definitions for these values are: {Unknown, Wraps When Full, Never Overwrites, DMTF Reserved, Vendor Reserved} Will have value 2 (Wraps When Full). RequestedState uint16[] The RequestedState proprety is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for these definitions are as follows: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Will bet set to 12 (Not Applicable). TABLE: Properties for Oracle_RecordLog (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 249 Oracle_ReferencedProfile (R) Description: Oracle_ReferencedProfile is used to associate an instance of Oracle_RegisteredProfile to the instance of Oracle_RegisteredProfile representing the Base Server profile. ILOM uses Scoping Class advertisement methodology. See the Profile Registration profile in “Supported DMTF SMASH Profiles and CIM Classes” on page 150 for details. Inheritance: CIM_ReferencedProfile Properties: For a description of the supported properties for the Oracle_ReferencedProfile class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Profile Registration TABLE: Properties for Oracle_ReferencedProfile Property Data Type Description ILOM Value Antecedent Oracle_Register edProfile REF The Antecedent property is a mandatory key property. Instance of Oracle_RegisteredProfile. Object path to an instance of Oracle_RegisteredProfile . Dependent Oracle_Register edProfile REF The Dependent property is a mandatory key property. Indicates the Oracle_RegisteredProfile. Object path to the instance of Oracle_RegisteredProfile representing the Base Server profile.250 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_Sensor (R) Description: Represents a hardware component capable of measuring the characteristics of a physical property (for example, the temperature or voltage characteristics of a computer system). Inheritance: CIM_Sensor Properties: For a description of the supported properties for the Oracle_Sensor class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Sensor TABLE: Properties for Oracle_Sensor Property Data Type Description ILOM Value CreationClassN ame string The CreationClassName property is a mandatory key property. CreationClassName indicates the name of the class or the subclass used in the creation of an instance. When used with the other key properties of this class, this property allows all instances of this class and its subclasses to be uniquely identified. Set to Oracle_Sensor. DeviceID string The DeviceID property is a mandatory key property. The DeviceID property indicates an address or other identifying information used to uniquely name the LogicalDevice. Set to the NAC name of the sensor. SystemCreation ClassName string The SystemCreationClassName property is a mandatory key property. Indicates the SystemCreationClassName for the scoping system. Set to Oracle_Computer System. SystemName string The SystemName property is a mandatory key property. Indicates the SystemName of the scoping system. Set to Oracle_Computer System.Name of the instance of Oracle_Computer System that represents the controllee.Oracle’s Sun-Supported CIM Classes 251 CurrentState string The current state indicated by the sensor. This is always one of the PossibleStates. Value representing current state of the sensor. ElementName string The ElementName property is a user-friendly name. This property allows each instance to define a user-friendly name in addition to its key properties, identity data, and description information. Note that the Name property of ManagedSystemElement is also defined as a user-friendly name. But it is often subclassed to be a key. It is not reasonable that the same property can convey both identity and a user-friendly name, without inconsistencies. Where Name exists and is not a key (such as for instances of LogicalDevice), the same information can be present in both the Name and ElementName properties. Will be set to the NAC name of the sensor. EnabledDefault uint16[] An enumerated value indicating an administrator’s default or startup configuration for the enabled state of an element. By default, the element is Enabled (value=2). The following values apply: {2, 3, 5, 6, 7, 9, .., 32768..65535} Definitions for these values are: {Enabled, Disabled, Not Applicable, Enabled but Offline, No Default, Quiesce, DMTF Reserved, Vendor Reserved}. Set to default value 2 (Enabled). TABLE: Properties for Oracle_Sensor (Continued) Property Data Type Description ILOM Value252 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 EnabledState uint16[] Integer enumeration that indicates the enabled and disabled states of an element. It can also indicate the transitions between these requested states. For example, shutting down (value=4) and starting (value=10) are transient states between enabled and disabled. The following values apply: • 0 (Unknown) • 1 (Other) • 2 (Enabled) - The element is or could be executing commands, will process any queued commands, and queues new requests. • 3 (Disabled) - The element will not execute commands and will drop any new requests. • 4 (Shutting Down) - The element is in the process of going to a disabled state. • 5 (Not Applicable) - The element does not support being enabled or disabled. • 6 (Enabled but Offline) - The element might be completing commands, and will drop any new requests. • 7 (Test) - The element is in a test state. • 8 (Deferred) - The element might be completing commands, but will queue any new requests. • 9 (Quiesce) - The element is enabled but in a restricted mode. • 10 (Starting) - The element is in the process of going to an enabled state. New requests are queued. • 11..32767 (DMTF Reserved) • 32768..65535 (Vendor Reserved) Will have appropriate value depending on whether the sensor is enabled, disabled, or unknown. TABLE: Properties for Oracle_Sensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 253 HealthState uint16[] Indicates the current health of the element. This attribute expresses the health of this element but not necessarily that of its subcomponents. The following values apply: • 0 (Unknown) - The implementation cannot report on HealthState at this time. • 5 (OK) - The element is fully functional and is operating within normal operational parameters and without error. • 10 (Degraded/Warning) - The element is in working order and all functionality is provided. However, the element is not working to the best of its abilities. For example, the element might not be operating at optimal performance or it might be reporting recoverable errors. • 15 (Minor Failure) - All functionality is available but some might be degraded. • 20 (Major Failure) - The element is failing. It is possible that some or all of the functionality of this component is degraded or not working. • 25 (Critical Failure) - The element is non-functional and recovery might not be possible. • 30 (Non-Recoverable Error) - The element has completely failed, and recovery is not possible. All functionality provided by this element has been lost. DMTF has reserved the unused portion of the continuum for additional health states in the future. Appropriate value. OperationalSta tus uint16[] The OperationalStatus property indicates the current statuses of the element. Various operational statuses are defined. Many of the enumeration’s values are self-explanatory. Enumeration values can include any of the following: {Unknown, Other, OK, Degraded, Stressed, Predictive Failure, Error, Non-Recoverable Error, Starting, Stopping, Stopped, In Service, No Contact, Lost Communication, Aborted, Dormant, Supporting Entity in Error, Completed, Power Mode, DMTF Reserved, Vendor Reserved} Possible values for the enumeration values include: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, .., 0x8000..} Appropriate value. TABLE: Properties for Oracle_Sensor (Continued) Property Data Type Description ILOM Value254 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 PossibleStates string Enumerates the string outputs of the sensor. For example, a switch sensor can output the states On or Off. Another implementation of the switch may output the states Open, and Close. Another example is a NumericSensor supporting thresholds. This sensor can report the states like Normal, Upper Fatal, Lower Non-Critical, and so forth. A NumericSensor that does not publish readings and thresholds, but can store this data internally and still report its states. Appropriate values depending on the type of the sensor. RequestedState uint16[] The RequestedState property is an integer enumeration that indicates the last requested or desired state for the element, irrespective of the mechanism through which it was requested. The actual state of the element is represented by EnabledState. This property is provided to compare the last requested and current enabled or disabled states. Element definitions include any of the following: {Unknown, Enabled, Disabled, Shut Down, No Change, Offline, Test, Deferred, Quiesce, Reboot, Reset, Not Applicable, DMTF Reserved, Vendor Reserved} Values for these definitions include: {0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, .., 32768..65535} Note - When EnabledState is set to 5 (Not Applicable), then this property has no meaning. Refer to the DMTF CIM EnabledState property description for explanations of the values in the RequestedState enumeration. Set to 12 (Not Applicable). TABLE: Properties for Oracle_Sensor (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 255 SensorType uint16[] The type of the sensor, for example, voltage or temperature sensor. If the type is set to Other, then the OtherSensorType description can be used to further identify the type, or if the sensor has numeric readings, then the type of the sensor can be implicitly determined by the units. A description of the different sensor types is as follows: • A temperature sensor measures the environmental temperature. • Voltage and current sensors measure electrical voltage and current readings. • A tachometer measures speed/revolutions of a device. For example, a fan device can have an associated tachometer which measures its speed. • A counter is a general purpose sensor that measures some numerical property of a device. A counter value can be cleared, but it never decreases. • A switch sensor has states like Open or Close, On or Off, or, Up or Down. • A lock has states of Locked or Unlocked. • Humidity, smoke detection, and air flow sensors measure the equivalent environmental characteristics. • A presence sensor detects the presence of a PhysicalElement. • A power consumption sensor measures the instantaneous power consumed by a managed element. • A power production sensor measures the instantaneous power produced by a managed element such as a power supply or a voltage regulator. • A pressure sensor is used to report pressure. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, .., 32768..65535} Definitions of these values are: {Unknown, Other, Temperature, Voltage, Current, Tachometer, Counter, Switch, Lock, Humidity, Smoke Detection, Presence, Air Flow, Power Consumption, Power Production, Pressure, DMTF Reserved, Vendor Reserved} Will have appropriate value. TABLE: Properties for Oracle_Sensor (Continued) Property Data Type Description ILOM Value256 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_SpSystemComponent (R) Description: Oracle_SpSystemComponent is used to associate the instance of Oracle_ComputerSystem representing the controllee and the instance of Oracle_ComputerSystem representing the controller. Inheritance: CIM_SystemComponent Properties: For a description of the supported properties for the Oracle_SpSystemComponent class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Service Processor TABLE: Properties for Oracle_SpSystemComponent Property Data Type Description ILOM Value GroupComponent CIM_ComputerSystem REF The GroupComponent property is a key mandatory property. Indicates the parent system in the association. Object path to the instance of Oracle_ComputerSystem representing the controllee. PartComponent CIM_ComputerSystem REF The PartComponent property is a key mandatory property. Indicates the child element of a system component. Object path to the instance of Oracle_ComputerSystem representing the controller.Oracle’s Sun-Supported CIM Classes 257 Oracle_SystemDevice (R) Description: Association that represents an explicit relationship in which logical devices are aggregated by a ComputerSystem. Inheritance: CIM_SystemDevice Properties: For a description of the supported properties for the Oracle_SystemDevice class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: • Base Server • System Memory • Sensors • CPU • Indicator LED TABLE: Properties for Oracle_SystemDevices Property Data Type Description ILOM Value GroupComponent Oracle_ComputerSyste m REF The GroupComponent property is a key mandatory property. Indicates the Oracle_ComputerSystem. Object path to an instance of Oracle_ComputerSystem representing the controllee. PartComponent CIM_LogicalDevice REF The PartComponent property is a key mandatory property. The PartComponent is the LogicalDevice that is a component of a system. Object path to an instance of CIM_LogicalDevice.258 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Oracle_ThresholdIndication (R) Description: When the client creates an indication subscription in which the filter indicates one of the following: • CIM_AlertIndication and CIM_AlertIndication.ProbalbleCause is 52 (Threshold Crossed) • CIM_ThresholdIndication The ILOM CIM sub-system will generate an instance of the Oracle_ThresholdIndication class when it notices a sensor crossing a threshold. Inheritance: CIM_ThresholdIndication Properties: For a description of the supported properties for the Oracle_ThresholdIndication class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: NoneOracle’s Sun-Supported CIM Classes 259 TABLE: Properties for Oracle_ThresholdIndication Property Data Type Description ILOM Value AlertingEl ementForma t uint16[] The format of the AlertingManagedElement property is interpretable based upon the value of this property. Values are defined as: • 0 (Unknown) - The format is unknown or not meaningfully interpretable by a CIM client application. • 1 (Other) - The format is defined by the value of the OtherAlertingElementFormat property. • 2 (CIMObjectPath) - The format is a CIMObjectPath, with format :.= "", ="", and so forth, specifying an instance in the CIM schema. The following values apply: {0, 1, 2} Definitions for these values are: {Unknown, Other, CIMObjectPath} Will have the value 2 (CIMObjectPath). AlertingMa nagedEleme nt string The identifying information of the entity (that is, the instance) for which this indication is generated. The property contains the path of an instance, encoded as a string parameter, if the instance is modeled in the CIM schema. If not a CIM instance, the property contains some identifying string that names the entity for which the alert is generated. The path or identifying string is formatted per the AlertingElementFormat property. Will have the string representation of the object path of the sensor that crosses the threshold.260 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 AlertType uint16[] Primary classification of the indication. The following values are defined: • 1 (Other) - Current indication does not fit into the categories described by this enumeration. • 2 (Communications Alert) - Associated with the procedures and/or processes required to convey information from one point to another. • 3 (Quality of Service Alert) - A degradation or errors in the performance or function of an entity have occurred. • 4 (Processing Error) - A software or processing fault has occurred. • 5 (Device Alert) - An equipment or hardware fault has occurred. • 6 (Environmental Alert) - Refers to an enclosure in which the hardware resides, or other environmental considerations. • 7 (Model Change) - Addresses changes in the information model. For example, it might embed a lifecycle indication to convey the specific model change being alerted. • 8 (Security Alert) - Security violations, detection of viruses, or similar issues have occurred. Will have the value 6 (Environmental Alert). Descriptio ns string Short description for the instance. Appropriate value describing why the indication is generated. HwComponen tObjectPat h (Sun-specific) string Object path of the associated hardware component. The object path of an instance of CIM_PhysicalElem ent. ObservedVa lue string A string holding the current reading value that exceeds the threshold. This is modeled as a string for universal mapping, similar to the CIM_Sensor properties in the device model. Appropriate value. TABLE: Properties for Oracle_ThresholdIndication (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 261 ProbableCa use uint16[] Enumerated value that describes the probable cause of the situation that resulted in the AlertIndication. The following values apply: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130} Definitions for these values are: {Unknown, Other, Adapter/Card Error, Application Subsystem Failure, Bandwidth Reduced, Connection Establishment Error, Communications Protocol Error, Communications Subsystem Failure, Configuration/Customization Error, Congestion, Corrupt Data, CPU Cycles Limit Exceeded, Dataset/Modem Error, Degraded Signal, DTE-DCE Interface Error, Enclosure Door Open, Equipment Malfunction, Excessive Vibration, File Format Error, Fire Detected, Flood Detected, Framing Error, HVAC Problem, Humidity Unacceptable, I/O Device Error, Input Device Error, LAN Error, Non-Toxic Leak Detected, Local Node Transmission Error, Loss of Frame, Loss of Signal, Material Supply Exhausted, Multiplexer Problem, Out of Memory, Output Device Error, Performance Degraded, Power Problem, Pressure Unacceptable, Processor Problem (Internal Machine Error), Pump Failure, Queue SizeExceeded, Receive Failure, Receiver Failure, Remote NodeTransmission Error, Resource at or Nearing Capacity, ResponseTime Excessive, RetransmissionRate Excessive, Software Error, Software Program AbnormallyTerminated, Software Program Error (Incorrect Results), Storage Capacity Problem, Temperature Unacceptable, Threshold Crossed, Timing Problem, Toxic Leak Detected, Transmit Failure, Transmitter Failure, Underlying Resource Unavailable, Version MisMatch, Previous AlertCleared, Login Attempts Failed, Software Virus Detected, Hardware Security Breached, Denial of Service Detected, Security Credential MisMatch, Set to 52 (Threshold Crossed). TABLE: Properties for Oracle_ThresholdIndication (Continued) Property Data Type Description ILOM Value262 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Unauthorized Access, Alarm Received, Loss of Pointer, Payload Mismatch, Transmission Error, Excessive Error Rate, Trace Problem, Element Unavailable, Element Missing, Loss of MultiFrame, Broadcast Channel Failure, Invalid Message Received, Routing Failure, Backplane Failure, Identifier Duplication, Protection Path Failure, Sync Lossor Mismatch, Terminal Problem, Real Time Clock Failure, Antenna Failure, Battery Charging Failure, Disk Failure, Frequency Hopping Failure, Loss of Redundancy, Power Supply Failure, Signal Quality Problem, Battery Discharging, Battery Failure, Commercial Power Problem, Fan Failure, Engine Failure, Sensor Failure, Fuse Failure, Generator Failure, Low Battery, Low Fuel, Low Water, Explosive Gas, High Winds, Ice Buildup, Smoke, Memory Mismatch, Out of CPU Cycles, Software Environment Problem, Software Download Failure, Element Reinitialized, Timeout, Logging Problems, Leak Detected, Protection Mechanism Failure, Protecting Resource Failure, Database Inconsistency, Authentication Failure, Breach of Confidentiality, Cable Tamper, Delayed Information, Duplicate Information, Information Missing, Information Modification, Information Out of Sequence, Key Expired, Non-Repudiation Failure, Out of Hours Activity, Out of Service, Procedural Error, Unexpected Information} ProviderNa me string The name of the provider generating this indication. Appropriate value. SystemCrea tionClassN ame string The SystemCreationClassName of the scoping system (provider generating this indication). Will have the value Oracle_ComputerS ystem. SystemName string Indicates the SystemName for the scoping system (name for the provider generating this indication). Will have the value Oracle_ComputerS ystem.Name of the instance of Oracle_ComputerS ystem representing the controllee. ThresholdI dentifier string Describes the threshold or names the property that represents the threshold, if modeled in the CIM hierarchy. In the latter case, the value should be written as: _ .. Appropriate value. ThresholdV alue string Current value of the threshold. This is modeled as a string for universal mapping, similar to the CIM_Sensor properties in the device model. Appropriate value. TABLE: Properties for Oracle_ThresholdIndication (Continued) Property Data Type Description ILOM ValueOracle’s Sun-Supported CIM Classes 263 Oracle_UseOfLog (R) Description: The Oracle_UseOfLog is used to associate an instance of a Oracle_RecordLog to an instance of the Oracle_ComputerSystem, which represents the controllee. Inheritance: CIM_UseOfLog Properties: For a description of the supported properties for the Oracle_UseOfLog class, see the following table. Note - For more details about Oracle’s Sun-supported properties (described in the following table), see the DMTF CIM schema, version 2.18.1, at: (http://www.dmtf.org/standards/cim/cim_schema_v2181) Profile: Record Log Base Server TABLE: Properties for Oracle_UseOfLog Property Data Type Description ILOM Value Antecedent Oracle_RecordLog REF The Antecedent property is a mandatory key property. Instance of Oracle_RecordLog Object path to the instance of Oracle_RecordLog representing the IPMI SEL log. Dependent Oracle_ComputerSy stem REF The Dependent property is a mandatory key property. The Oracle_ComputerSystem. Object path to the instance of Oracle_ComputerSystem representing the controllee.264 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011265 SNMP Command Examples (G) Related Information ¦ “SNMP Overview” on page 1 Description Links Example SNMP Commands • “snmpget Command” on page 266 • “snmpwalk Command” on page 266 • “snmpbulkwalk Command” on page 268 • “snmptable Command” on page 268 • “snmpset Command” on page 271 • “snmptrapd Command” on page 272266 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 snmpget Command (R) snmpget -mALL -v1 -cpublic snmp_agent_Ip_address sysName.0 As stated in the description of the sysName.0 MIB object in the SNMPv2-MIB, this command returns an administratively assigned name for this managed node. By convention, this is the node’s fully qualified domain name. If the name is unknown, the value returned is the zero-length string. For example: In addition to the sysName.0 object, this command displays the content of the sysObjectID.0 and the ilomCtrlDateAndTime.0 MIB objects. Notice that the MIB file name is given for each MIB object as part of the reply. The following descriptions of the MIB objects are taken from the MIB files. ¦ sysName – An administratively assigned name for this managed node. By convention, this is the node’s fully-qualified domain name. If the name is unknown, the value is the zero-length string. ¦ sysObjectID – The vendor’s authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises sub-tree (1.3.6.1.4.1) and provides an easy and unambiguous means for determining ‘what kind of box’ is being managed. ¦ ilomCtrlDataAndTime – The date and time of the device. snmpwalk Command (R) The snmpwalk command performs a sequence of chained GETNEXT requests automatically. It is a work saving command. Rather than having to issue a series of snmpgetnext requests, one for each object ID, or node, in a sub-tree, you can simply issue one snmpwalk request on the root node of the sub-tree and the command gets the value of every node in the sub-tree. % snmpget -v2c -cprivate -mALL snmp_agent_Ip_address sysName.0 sysObjectID.0 ilomCtrlDateAndTime.0 SNMPv2-MIB::sysName.0 = STRING: SUNSPHOSTNAME SNMPv2-MIB::sysObjectID.0 = OID: SUN-ILOM-SMI-MIB::sunILOMSystems SUN-ILOM-CONTROL-MIB::ilomCtrlDateAndTime.0 = STRING: 2007-12-10,20:33:32.0SNMP Command Examples 267 For example: % snmpwalk -mALL -v1 -cpublic snmp_agent_Ip_address system SNMPv2-MIB::sysDescr.0 = STRING: ILOM machine custom description SNMPv2-MIB::sysObjectID.0 = OID: SUN-ILOM-SMI-MIB::sunILOMSystems DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (16439826) 1 day, 21:39:58.26 SNMPv2-MIB::sysContact.0 = STRING: set via snmp test SNMPv2-MIB::sysName.0 = STRING: SUNSPHOSTNAME SNMPv2-MIB::sysLocation.0 = STRING: SNMPv2-MIB::sysServices.0 = INTEGER: 72 SNMPv2-MIB::sysORLastChange.0 = Timeticks: (14) 0:00:00.14 SNMPv2-MIB::sysORID.1 = OID: IF-MIB::ifMIB SNMPv2-MIB::sysORID.2 = OID: SNMPv2-MIB::snmpMIB SNMPv2-MIB::sysORID.3 = OID: TCP-MIB::tcpMIB SNMPv2-MIB::sysORID.4 = OID: RFC1213-MIB::ip SNMPv2-MIB::sysORID.5 = OID: UDP-MIB::udpMIB SNMPv2-MIB::sysORID.6 = OID: SNMP-VIEW-BASED-ACM-MIB::vacmBasicGroup SNMPv2-MIB::sysORID.7 = OID: SNMP-FRAMEWORK-MIB::snmpFrameworkMIBCompliance SNMPv2-MIB::sysORID.8 = OID: SNMP-MPD-MIB::snmpMPDCompliance SNMPv2-MIB::sysORID.9 = OID: SNMP-USER-BASED-SM-MIB::usmMIBCompliance SNMPv2-MIB::sysORDescr.1 = STRING: The MIB module to describe generic objects for network interface sub-layers SNMPv2-MIB::sysORDescr.2 = STRING: The MIB module for SNMPv2 entities SNMPv2-MIB::sysORDescr.3 = STRING: The MIB module for managing TCP implementations SNMPv2-MIB::sysORDescr.4 = STRING: The MIB module for managing IP and ICMP implementations SNMPv2-MIB::sysORDescr.5 = STRING: The MIB module for managing UDP implementations SNMPv2-MIB::sysORDescr.6 = STRING: View-based Access Control Model for SNMP. SNMPv2-MIB::sysORDescr.7 = STRING: The SNMP Management Architecture MIB. SNMPv2-MIB::sysORDescr.8 = STRING: The MIB for Message Processing and Dispatching. SNMPv2-MIB::sysORDescr.9 = STRING: The management information definitions for the SNMP User-based Security Model. SNMPv2-MIB::sysORUpTime.1 = Timeticks: (1) 0:00:00.01 SNMPv2-MIB::sysORUpTime.2 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.3 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.4 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.5 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.6 = Timeticks: (2) 0:00:00.02 SNMPv2-MIB::sysORUpTime.7 = Timeticks: (14) 0:00:00.14 SNMPv2-MIB::sysORUpTime.8 = Timeticks: (14) 0:00:00.14 SNMPv2-MIB::sysORUpTime.9 = Timeticks: (14) 0:00:00.14268 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 snmpbulkwalk Command (R) The snmpbulkwalk command uses the GETBULK SNMP protocol feature to query for an entire tree of information about a network entity. This command can pack more objects into the packets by specifying “repeaters.” As a result, the snmpbulkwalk command is faster than the snmpwalk command. Here is example of an snmpwalk command with approximate start and end time stamps. Here is example of an snmpbulkwalk command performing the same operation. Notice that the snmpbulkwalk command is faster than the snmpwalk command. snmptable Command (R) The snmptable command retrieves the contents of an SNMP table and displays the contents in a tabular format, that is, one table row at a time, such that the resulting output resembles the table being retrieved. This is contrasted with the snmpwalk command, which displays the contents of the table one column at a time. Here is an example of the snmptable command: % date Fri Dec 14 12:21:44 EST 2007 % snmpwalk -mALL -v2c -cprivate snmp_agent_Ip_address entPhysicalTable>time3 % date Fri Dec 14 12:21:53 EST 2007 % date Fri Dec 14 12:40:57 EST 2007 % snmpbulkwalk -mALL -v2c -cprivate snmp_agent_Ip_address entPhysicalTable>time7 % date Fri Dec 14 12:41:03 EST 2007 % snmptable -mALL -v2c -cprivate snmp_agent_Ip_address sysORTable SNMP table: SNMPv2-MIB::sysORTable sysORID sysORDescr sysORUpTimeSNMP Command Examples 269 Note – While the snmpget, snmpgetnext, and snmpwalk command can be used on any type of MIB object, the snmptable command can be used only on MIB table objects. If this command is given any other type of object ID, it will be rejected. This restriction applies to a table entry object, a table column object, and any object that represents information within a table. Only a MIB table object ID can be used with the snmptable command. In the examples of the snmptable command, the -Ci and -Cb options are used. For example, here is an snmptable command with the -Ci option: IF-MIB::ifMIB The MIB module to 0:0:00:00.01 describe generic objects for network interface sub-layers. SNMPv2-MIB::snmpMIB The MIB module for SNMPv2 0:0:00:00.02 entities. TCP-MIB::tcpMIB The MIB module for 0:0:00:00.02 managing TCP implementations. RFC1213-MIB::ip The MIB module for managing 0:0:00:00.02 IP and ICMP implementations. UDP-MIB::udpMIB The MIB module for managing 0:0:00:00.02 UDP implementations. SNMP-VIEW-BASED-ACM- View-based Access Control 0:0:00:00.02 MIB::vacmBasicGroup Model for SNMP. SNMP-FRAMEWORK-MIB:: The SNMP Management 0:0:00:00.14 snmpFrameworkMIB Architecture MIB. Compliance SNMP-MPD-MIB::snmp The MIB for Message 0:0:00:00.14 MPDCompliance Processing and Dispatching. SNMP-USER-BASED-SM- The management information 0:0:00:00.14 MIB::usmMIBCompliance definitions for the SNMP User-based Security Model. % snmptable -Ci -mALL -v2c -cprivate snmp_agent_IP_address sunPlatFanTable SNMP table: SUN-PLATFORM-MIB::sunPlatFanTable index sunPlatFanClass 10 fan 11 fan 17 fan 23 fan 29 fan 30 fan 36 fan 42 fan270 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 Here is an example of an snmptable command without the -Ci option. Notice that the index column is not displayed: Here is an example of an snmptable command with the -Ci and -Cb options. The output is abbreviated. Here is an example of the same snmptable command with the -Ci option but without the -Cb option. Again the output is abbreviated. Notice that the name of the MIB object is repeated on each heading. Here is another example of an snmptable command with both the -Ci and -Cb options. Notice that the MIB object is not repeated on each heading. % snmptable -mALL -v2c -cprivate snmp_agent_Ip_address sunPlatFanTable SNMP table: SUN-PLATFORM-MIB::sunPlatFanTable sunPlatFanClass fan fan fan fan fan % snmptable -Ci -Cb -mALL -v2c -cprivatesnmp_agent_IP_addressentPhysicalTable index Descr VendorType ContainedIn SNMP table: ENTITY ?SNMPv2- 0 chassis -MIB::entPhysical SMI:zeroDotZero Table 1 % snmptable -Ci -mALL -v2c -cprivate index entPhysicalDescr entPhysical entPhysical VendorType ContainedIn SNMP table: ENTITY ?SNMPv2- 0 chassis -MIB::entPhysical SMI:zeroDotZero 1 % snmptable -Cb -Ci -mALL -v2c -cprivate snmp_agent_IP_address ilomCtrlAlertsTable SNMP table: SUN-ILOM-CONTROL-MIB::ilomCtrlAlertsTableSNMP Command Examples 271 Thus, when you used the -Cb option with the snmptable command, the table output is easier to read. Here is an example of an snmptable command using version 3 of the SNMP protocol: The following snmptable command returns an empty table. snmpset Command (R) While the syntax of the snmpset command is similar to that of the snmpget command, the commands are quite different. The snmpget command merely reads the value of the specified object ID, while the snmpset command writes the value specified to the object ID. Further, along with the value to be written to the object ID, you must also specify the data type of the object ID in the snmpset command because SNMP objects support more than one data type. The following example shows how use of the snmpget and snmpset commands together. The sequence of steps is as follows: 1. Use the snmpget command to check to current value of the MIB object. 2. Use the snmpset command to change the value of the MIB object. in- Sever- Type Destin- Destin- SNMPVer- SNMP-Comm- Email Email dex ity ation- ation- sion unityOr- Event Event IP Email Username Class Type Filter Filter 1 criti- email ? 0.0.0.0 v1 public none none cal 2-15 dis- ipmi- 0.0.0.0 ? v1 public ? ? able pet % snmptable -Cb -Ci -mALL -v3 -aMD5 -utestuser -Apassword -lauthNoPriv snmp_agent_Ip_address sunPlatPowerSupplyTable SNMP table: SUN-PLATFORM-MIB::sunPlatPowerSupplyTable index sunPlatPowerSupplyClass 90 powerSupply 92 powerSupply 96 powerSupply % snmptable -Cb -Ci -mALL -v2c -cprivate snmp_agent_Ip_address sunPlatBatteryTable SUN-PLATFORM-MIB::sunPlatBatteryTable: No entries272 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 3. Use the snmpget command to verify that the MIB object was in fact changed to the requested value. Note that if you try to execute this snmpset command using a public community, instead of private, it will not work. This is because the private community has write permission, but the public community does not. The reason code returned by the command does not make this clear because it simply states that the object is not writable. Here is an example: snmptrapd Command (R) snmptrapd is an SNMP application that receives and logs SNMP trap and inform messages. Before your system can receive such messages, you must configure the trap daemon to listen for these messages. To configure a trap daemon, perform these actions: 1. Configure an SNMP trap destination. The following example shows how to use the snmpset command to configure an snmptrapd daemon: 2. Start the trap receiver application, snmptrapd. % snmpget -mALL -v2c -cprivate snmp_agent_Ip_address ilomCtrlHttpEnabled.0 SUN-ILOM-CONTROL-MIB::ilomCtrlHttpEnabled.0 = INTEGER: false(2) % snmpset -mALL -v2c -cprivate snmp_agent_Ip_address ilomCtrlHttpEnabled.0 i 1 SUN-ILOM-CONTROL-MIB::ilomCtrlHttpEnabled.0 = INTEGER: true(1) % snmpget -mALL -v2c -cprivate snmp_agent_Ip_address ilomCtrlHttpEnabled.0 SUN-ILOM-CONTROL-MIB::ilomCtrlHttpEnabled.0 = INTEGER: true(1) % snmpset -mALL -v2c -cpublic snmp_agent_Ip_address ilomCtrlHttpEnabled.0 i 1 Error in packet. Reason: notWritable (That object does not support modification) % snmpset -mALL -v2c -cprivate snmp_agent_Ip_address ilomCtrlAlertSeverity.1 i 2 ilomCtrlAlertType.1 i 2 ilomCtrlAlertDestinationIP.1 a dest_Ip_address SUN-ILOM-CONTROL-MIB::ilomCtrlAlertSeverity.1 = INTEGER: critical(2) SUN-ILOM-CONTROL-MIB::ilomCtrlAlertType.1 = INTEGER: snmptrap(2) SUN-ILOM-CONTROL-MIB::ilomCtrlAlertDestinationIP.1 = IpAddress: dest_Ip_addressSNMP Command Examples 273 3. Generate a test trap to verify that traps are being sent by the agent (on the managed node) and received by the trap receiver (the management station). While the daemon is running, log in to the Oracle ILOM CLI on the host that is running the SNMP agent and type the following command: Note – It is important to test the trap daemon to make sure it is configured properly. The following screen shows a sample output when a testalert trap is received at the management station: -> set /SP/alertmgmt/rules testalert=true SUN-ILOM-CONTROL-MIB::ilom.103.2.1.20.0 = STRING: "This is a test trap"274 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011275 Index A Active Directory, 39 Administrator Groups viewing and con?guring, 44 Alternate Server viewing and con?guring, 51 Custom Groups viewing and con?guring, 47 DNS Locator settings viewing and con?guring, 55 Operator Groups view and con?gure, 45 User Domain viewing and con?guring, 49 alert rules CLI commands, 19 con?guring, 82 alerts CLI commands for managing alerts, 19 generating email noti?cation, 84 C clock settings con?guring network time protocol (NTP), 78 setting, 78 component information view, 76 E email alert settings con?guring, 86 event log con?guring, 79 F ?rmware viewing and con?guring, 104 I IPMI detailed speci?cations location of, 124 functionality, 124 generating IPMI-speci?c traps, 124 IPMI Platform Event Trap (PET) alerts, 125 overview, 124 versions supported by ILOM, 124 IPMItool capabilities, 125 download site location of, 125 functions of, 125 man page location, 125 references for, 125 running CLI commands with, 128 using IPMItool, 125 L LDAP, 59 con?guring, 59 LDAP/SSL, 63 Administrator Groups MIB objects, 65 viewing and con?guring, 64 Alternate Server viewing and con?guring, 70 certi?cate settings, 63 Custom Groups viewing and con?guring, 67 Operator Groups viewing and con?guring, 65 User Domain viewing and con?guring, 68276 Oracle ILOM 3.0 Protocol Management Reference Guide • May 2011 M Management Information Base (MIB) de?nition, 3 MIB tree, 4 standard MIBs supported by ILOM, 5 N Net-SNMP web site, 2 P power consumption management entPhysicalName MIB object, 95 monitoring individual power supply consumption using an snmpget command, 95 monitoring permitted power snmpget command, 97 monitoring power snmpget command, 94 power monitoring snmpget command, 93 sunPlatNumericSensor MIB objects, 95 view and set power policy SNMP commands, 99, 108 R RADIUS con?guring, 72 redundancy settings view and con?gure, 54 remote Syslog receiver IP addresses con?guring, 81 S Single Sign On con?guring, 37 enabling, 38 single sign on overview, 37 SMTP clients con?guring, 84 MIB objects, 86 SNMP functions supported, 3 managed node, 3 management station monitoring, 3 MIBs used to support ILOM, 6 Net-SNMP web site, 2 network management station, 3 tutorial web sites, 2 versions supported, 2 SNMP traps con?guring destinations using the web interface, 29 SNMP user accounts managing with the CLI, ?? to 18 targets, properties, and values of, 12 SPARC boot mode, 119 SPARC diagnostics, 113 SPARC host settings, 116 SPARC key switch, 121 system alerts commands for managing, 19 T Telemetry Harness Daemon (THD) con?guring, 88 U user accounts, 35 Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration for Sun Blade 6000 and Sun Blade 6048 Modular Systems Part No. E21451-01 May 2011, Revision 01Please Recycle Copyright © 2008, 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation x ? Download Product Software and Firmware xii Oracle ILOM CMM Overview 1 About the Modular System Chassis 2 Oracle ILOM CMM Function Overview 2 Oracle ILOM Versions 3 Oracle ILOM CMM Documentation 3 About This Document 4 Oracle ILOM CMM Initial Setup 5 Connecting to the Oracle ILOM CMM 6 Before You Begin 6 ? Connect to the Oracle ILOM CMM Using a Serial Connection 8 ? View and Set IPv4 Network Address 9 ? View and Set Dual-Stack IPv4 and IPv6 Network Address 11 ? Test IPv4 or IPv6 Network Configuration 16 Log In to the Oracle ILOM CMM Using a Network Connection 18 ? Log In to Oracle ILOM 3.0 Using the Web Interface 18 ? Log In to Oracle ILOM 3.0 Using the CLI 19 Activating CMM Ethernet Ports 20 ? Enable Ethernet Ports Using the Web Interface 20 ? Enable Ethernet Ports Using the CLI 21v Oracle ILOM CMM Admistration Guide • May 2011 Changing the Blade SP CLI Prompt 23 About the Blade SP CLI Prompt 23 ? Set the Blade SP CLI Prompt 23 ? Reset the Blade SP CLI Prompt to the Default 24 Firmware Update Procedures 25 Updating the Oracle ILOM CMM Firmware 26 Additional Information About Updating the Oracle ILOM CMM Firmware 26 Obtaining the CMM IP Address 27 Determining Your Current Firmware Version 27 ? Determine the Firmware Version Using the Web Interface 28 ? Determine the Firmware Version Using the Management Ethernet Port CLI 29 ? Determine the Firmware Version Using the Serial Management Port CLI 29 Downloading Firmware Files 30 ? Download Firmware Files 30 Updating Oracle ILOM Firmware 31 ? Update Oracle ILOM Firmware Using the Web Interface 31 ? Update Oracle ILOM Firmware Using the CLI 33 Updating the NEM Firmware 34 About NEM Firmware Updates 34 Before You Begin 35 ? Update NEM Firmware Using the CLI 35 ? Update NEM Firmware Using the Web Interface 37 Updating Chassis Component Firmware Using the CMM 40 About Chassis Component Firmware 40 ? Update Firmware Using the Web Interface 41 ? Update Firmware Using the CLI 43Contents vi Resetting the Oracle ILOM CMM 45 ? Reset Oracle ILOM Using the Web Interface 45 ? Reset Oracle ILOM CMM Using the CLI 46 CMM Power Management 47 Light Load Efficiency Mode (LLEM) 48 About LLEM 48 ? Enable or Disable LLEM Using the Web Interface 49 ? Enable or Disable Redundant Mode Using the Web Interface 50 ? Enable or Disable LLEM Using the CLI 50 ? Enable Redundant Mode Using the CLI 51 ? Enable Non-Redundant Mode Using the CLI 51 Force Power Supply Fan Speed 52 About Power Supply Fan Speed 52 ? Set the Power Supply Fan Speed Using the Web Interface 52 ? Set the Power Supply Fan Speed Using the CLI 53 Disabling the Power Management Policy 54 About the Power Management Policy 54 ? Disable Power Management Policy Using the Web Interface 54 ? Disable Power Management Policy Using the CLI 55 Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases 56 Oracle ILOM Behavior With Two Power Cord Configuration 56 ? Configure the CMM for Two Power Cords 56 Oracle ILOM 3.0 Readings for Specific Power Supply States 57 AC Cables Are Disconnected 57 AC Cables Are Disconnected, Then Are Reconnected 58 stop /CH Command 59 start /CH Command 59 One PSU Is Removed 60vii Oracle ILOM CMM Admistration Guide • May 2011 PSU Is Reinserted 60 Sun Blade Zone Manager 63 Introduction to the Sun Blade Zone Manager 64 Supported Oracle ILOM User Interfaces 64 Accessing Zone Manager Using the Web Interface 64 Accessing Zone Manager Using the CLI 67 Zoning Configuration Overview 68 Zoning Commands 68 Assigning Storage to a Server Blade 69 Assigning a Server Blade to Storage 69 Supported Hardware and Firmware Configurations 71 SAS-2 Capable Hardware 71 Additional System Requirements 71 Accessing the Sun Blade Zone Manager 72 ? Access and Enable the Sun Blade Zone Manager Using the Web Interface 72 ? Access and Enable the Sun Blade Zone Manager Using the CLI 76 Creating the Chassis Storage Access Configuration 78 About Creating Chassis Storage Access 78 Creating the Chassis Storage Access Configuration Using Quick Setup 78 Option 1: Assign per Individual Disks 79 Option 2: Assign per Adjacent Individual Disks 80 Option 3: Assign per Storage Blade 81 Option 4: Assign per Adjacent Storage Blade 82 ? Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface 83 Creating the Chassis Storage Access Configuration Using Detailed Setup 85Contents viii ? Use Detailed Setup to Create the Chassis Storage Configuration Using the Web Interface 85 Creating a Chassis Storage Configuration Using the CLI 88 ? Create a Chassis Storage Configuration Using the CLI 88 Viewing or Modifying the Chassis Storage Access Configuration 91 ? View and Modify the Chassis Storage Configuration Using the Web Interface 91 ? View and Modify the Chassis Storage Configuration Using the CLI 97 ? Assign Multiple Server Blades to a Storage Device Using the Web Interface 99 ? View the Storage Access Configuration Table Using the Web Interface 102 Saving the Chassis Storage Access Configuration 105 Important Considerations About Saving the Zoning Configuration 105 Saving a New or Modified Storage Access Configuration 105 Backing Up the Storage Access Configuration 107 ? Save the Zoning Configuration to a Backup File Using the Web Interface 107 ? Save the Zoning Configuration to a Backup File Using the CLI 108 Recovering Zoning Configurations 109 ? Recover Zoning Configurations Using the Web Interface 109 ? Recover Zoning Configurations Using the CLI 111 Resetting the Zoning Configuration 113 ? Reset the Zoning Configuration Using the Web Interface 113 ? Reset the Zoning Configuration Using the CLI 114 Resetting the Zoning Password 115 ? Reset the Zoning Password Using the Web Interface 115 ? Reset the Zoning Password Using the CLI 116 Index 117ix Oracle ILOM CMM Admistration Guide • May 2011x Using This Documentation This administration guide provides Oracle ILOM 3.0 instructions for managing the chassis components in a Sun Blade 6000 or a Sun Blade 6048 Modular System Chassis. System management is provided through the Sun Blade Chassis Monitoring Modules (CMM), which is referred to in this guide as the Oracle ILOM CMM. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is written for technicians, system administrators, authorized service providers, and users who have experience managing system hardware. This preface contains the following topics: ¦ “Documentation and Feedback” on page xi ¦ “Product Downloads” on page xii ¦ “Oracle ILOM 3.0 Version Numbers” on page xiii ¦ “Documentation, Support, and Training” on page xivxi Oracle ILOM CMM Admistration Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Collection at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xii Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, and then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right pane that appears, click Download.xiii Oracle ILOM CMM Admistration Guide • May 2011 Oracle ILOM 3.0 Version Numbers Oracle ILOM 3.0 has implemented a new version numbering scheme to help you identify which version of Oracle ILOM you are running on your system. The numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version of Oracle ILOM ¦ Oracle ILOM 3.1 as a minor version of Oracle ILOM 3 ¦ Oracle ILOM 3.1.2 as the second update version of Oracle ILOM 3.1 ¦ Oracle ILOM 3.1.2.1 as a micro version of Oracle ILOM 3.1.2 ¦ Oracle ILOM 3.1.2.1.a as a nano version of Oracle ILOM 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface.Using This Documentation xiv Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)xv Oracle ILOM CMM Admistration Guide • May 20111 Oracle ILOM CMM Overview Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, managing user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, managing user accounts Description Links Introduction • “About the Modular System Chassis” on page 2 CMM functional overview • “Oracle ILOM CMM Function Overview” on page 2 Oracle ILOM versions • “Oracle ILOM Versions” on page 3 Oracle ILOM CMM documentation • “Oracle ILOM CMM Documentation” on page 3 Topics covered in this guide. • “About This Document” on page 42 Oracle ILOM CMM Admistration Guide • May 2011 About the Modular System Chassis The Sun Blade 6000 Modular System chassis holds up to 10 blades and the Sun Blade 6048 Modular System holds up to 48 blades. Supported blades include Sun Blade server modules and storage modules. Each server module has its own Oracle ILOM service processor (SP) which is separate from the chassis monitoring module (CMM) Oracle ILOM . The Oracle ILOM CMM manages the Sun Blade 6000 and 6048 Modular System chassis. It provides management of chassis components, and a method of accessing the service processors in individual server modules. Users interact with the Oracle ILOM CMM through a command-line interface (CLI) or web interface. Oracle ILOM CMM Function Overview Oracle ILOM on the CMM offers a tiered management architecture that enables system management of individual components or aggregated management of components at the chassis level. A summary of the management functions include: ¦ Implementation of an IPMI satellite controller, making the chassis environmental sensors visible to the server module’s BMC functions ¦ Direct environmental and inventory management using CLI, web, SNMP, and IPMI interfaces ¦ Firmware management of CMM, network express module (NEM), and server module SPs ¦ Pass-through management of server modules and HTTP links along with command-line interface (CLI) SSH contexts ¦ Chassis power control ¦ Access to the following components: ¦ Chassis ¦ Power supplies ¦ Fans ¦ Network express modules (NEMs) ¦ Server module SPsOracle ILOM CMM Overview 3 ¦ Assignment of storage devices from SAS-2 capable storage modules to SAS-2 capable server blades in the chassis, using the Sun Blade Zone Manager. This is only available for the Sun Blade 6000 chassis. Oracle ILOM Versions The Oracle ILOM information in this document refers to 3.x.x versions of Oracle ILOM (Oracle ILOM 3.0.3 and later). For information on Oracle ILOM 2.x, refer to the following documentation: Oracle ILOM 2.0 Documentation Set: (http://docs.sun.com/app/docs/coll/ilom2.0) Oracle ILOM CMM Documentation The following documentation provides information on the functionality and use of the Oracle ILOM CMM : ¦ Oracle Integrated Lights Out Manager (ILOM ) 3.0 Documentation Library: Comprehensive documentation on features and use of Oracle ILOM 3.0 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration for Sun Blade 6000 and Sun Blade 6048 Modular Systems (this document): Provides information on Oracle ILOM functionality that is specific to the Oracle ILOM CMM . ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Supplement for Sun Blade 6000 and Sun Blade 6048 Modular Systems: Supplementary information specific to the Oracle ILOM 3.x version of the Oracle ILOM CMM . Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation Collection is available at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) Sun Blade 6000 and 6048 modular system documentation is available at: Sun Blade 6000: (http://download.oracle.com/docs/cd/E19938-01/index.html)4 Oracle ILOM CMM Admistration Guide • May 2011 Sun Blade 6048: (http://download.oracle.com/docs/cd/E19926-01/index.html) About This Document This document covers administration tasks specific to the Sun Blade 6000 and 6048 Modular Systems. The topics covered are shown in the following table. Description Chapter Perform initial set up of the Oracle ILOM CMM • “Oracle ILOM CMM Initial Setup” on page 5 Update chassis and component firmware • “Firmware Update Procedures” on page 25 Use Oracle ILOM power management features • “CMM Power Management” on page 47 View or modify the storage zoning configuration • “Sun Blade Zone Manager” on page 635 Oracle ILOM CMM Initial Setup Related Information ¦ Oracle ILOM 3.0 Quick Start, mandatory set up tasks ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Concepts Daily Management CLI Procedures, managing user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, managing user accounts Description Links Connect to the CMM and configure CMM IP address • “Connecting to the Oracle ILOM CMM” on page 6 Log in to the Oracle ILOM CMM for the first time • “Log In to the Oracle ILOM CMM Using a Network Connection” on page 18 Activating CMM Ethernet ports • “Activating CMM Ethernet Ports” on page 20 Change the CLI blade prompt • “Changing the Blade SP CLI Prompt” on page 236 Oracle ILOM CMM Admistration Guide • May 2011 Connecting to the Oracle ILOM CMM Before You Begin To set up the CMM with initial network configuration information, you must establish a connection through Oracle ILOM to the CMM. You can establish a local connection to Oracle ILOM through the serial management port (SER MGT) on the CMM or a remote connection to Oracle ILOM through the network management (NET MGT) port on the CMM (see the following figure). Description Links Platform Feature Support Connecting to the Oracle ILOM CMM • “Before You Begin” on page 6 • “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8 • “View and Set IPv4 Network Address” on page 9 • “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 11 • “Test IPv4 or IPv6 Network Configuration” on page 16 • CMMOracle ILOM CMM Initial Setup 7 FIGURE: Network and serial ports on CMM When you establish a connection to Oracle ILOM through the network management port, Oracle ILOM will, by default, automatically learn the IP address of the CMM using DHCP for IPv4 and stateless for IPv6. If a network management connection has not been established to the NET MGT port on the CMM, Oracle ILOM is unable to learn the IP address of the CMM therefore, you will need to connect to Oracle ILOM through a serial connection. After you have established a connection to Oracle ILOM, you can view and, if necessary, modify the IP address assigned to the CMM. Next Steps: ¦ If you do not know the IP address assigned to the CMM, see “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. - or- ¦ If you do know the IP address assigned to the CMM and you have an established network management connection to the CMM, see one of the following sections to view or modify the CMM IP address. ¦ “View and Set IPv4 Network Address” on page 9 ¦ “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 118 Oracle ILOM CMM Admistration Guide • May 2011 ? Connect to the Oracle ILOM CMM Using a Serial Connection You can access the Oracle ILOM CMM at any time by connecting a terminal or a PC running terminal emulation software to the serial connector on the chassis. 1. Verify that your terminal, laptop, or terminal server is operational. 2. Configure that terminal device or the terminal emulation software to use the following settings: ¦ 8N1: eight data bits, no parity, one stop bit ¦ 9600 baud ¦ Disable software flow control (XON/XOFF) 3. Connect a serial cable from the serial port (SER MGT) on the chassis panel to a terminal device. Note – The serial port requires that the serial cable connected to it use the pin assignments shown in the following table. 4. Press Enter on the terminal device. This establishes the connection between the terminal device and the Oracle ILOM CMM. Pin Signal Description 1 Request To Send (RTS) 2 Data Terminal Ready (DTR) 3 Transmit Data (TXD) 4 Ground 5 Ground 6 Receive Data (RXD) 7 Data Carrier Detect (DCD) 8 Clear To Send (CTS)Oracle ILOM CMM Initial Setup 9 Note – If you connect a terminal or emulator to the serial port before the Oracle ILOM CMM has been powered on or during its power on sequence, you will see boot messages. When the system has booted, the Oracle ILOM CMM displays its login prompt: login: 5. Log in to the CLI: a. Type the default user name, root. b. Type the default password, changeme. When you have successfully logged in, the Oracle ILOM CMM displays the default command prompt: -> The Oracle ILOM CMM is running the CLI. You can now run CLI commands. Next Steps: View or set a Oracle ILOM CMM IP address using one of the following procedures: ¦ “View and Set IPv4 Network Address” on page 9 ¦ “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 11 ? View and Set IPv4 Network Address 1. Log in to the Oracle ILOM CMM using either a remote SSH connection or a local serial connection. For more information, see one of the following sections: ¦ “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. ¦ “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 2. Type one of the following commands to set the working directory: ¦ For a chassis CMM: cd /CMM/network ¦ For a chassis server blade server module: cd /SP/network 3. Type the show command to view the IP address network properties. 4. To set IPv4 network settings for DHCP or static, perform one of the following:10 Oracle ILOM CMM Admistration Guide • May 2011 ¦ To configure DHCP IPv4 network settings, set values for the following properties: ¦ To configure static IPv4 network settings, set values for the following properties: Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=dhcp The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the state and ipdiscovery property values. Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=static To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4. pendingipaddress pendingipnetmask pendingipgateway set pendingipaddress= pendingipnetmask= pendingipgateway= To assign multiple static network settings, type the set command followed by the pending command for the each property value (IP address, netmask, and gateway), then type the static value that you want to assign. commitpending= set commitpending=true Type set commitpending=true to commit the changes madeto the IPv4 network properties.Oracle ILOM CMM Initial Setup 11 Note – If you connected to Oracle ILOM through a remote SSH connection, the connection made to Oracle ILOM using the former IP address will time-out. Use the newly assigned settings to connect to Oracle ILOM. 5. Test the IPv4 network configuration from Oracle ILOM use the Network Test Tools (Ping). For details, see “Test IPv4 or IPv6 Network Configuration” on page 16 ? View and Set Dual-Stack IPv4 and IPv6 Network Address Note – This procedure provides instructions for configuring Oracle ILOM to operate in a dual-stack IPv4 and IPv6 network environment. Dual-stack IPv4 and IPv6 network settings are only in Oracle ILOM for the A90-D model chassis. For more information about dual-stack IPv4 and IPv6 support in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide. 1. Log in to the Oracle ILOM CMM using either a remote SSH connection or a local serial connection. For more information, see one of the following sections: ¦ “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. ¦ “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 2. Perform the network configuration instructions that apply to your network environment: ¦ To configure IPv4 network settings, perform Step 3 to Step 5 in this procedure. ¦ To configure IPv6 network settings, perform Step 6 to Step 10 in this procedure. 3. For IPv4 network configurations, use the cd command to navigate to the /x/network working directory for the device. For example: ¦ For a chassis CMM type: cd /CMM/network ¦ For a chassis blade server SP type: cd /CH/BLn/network ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network 4. Type the show command to view the configured IPv4 network settings configured on the device. 5. To set IPv4 network settings for DHCP or static, perform one of the following:12 Oracle ILOM CMM Admistration Guide • May 2011 ¦ To configure DHCP IPv4 network settings, set values for the following properties: ¦ To configure static IPv4 network settings, set values for the following properties: Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=dhcp The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the state and ipdiscovery property values. Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=static To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4. pendingipaddress pendingipnetmask pendingipgateway set pendingipaddress= pendingipnetmask= pendingipgateway= To assign multiple static network settings, type the set command followed by the pending command for the each property value (IP address, netmask, and gateway), then type the static value that you want to assign. commitpending= set commitpending=true Type set commitpending=true to commit the changes madeto the IPv4 network properties.Oracle ILOM CMM Initial Setup 13 6. For IPv6 network configurations, use the cd command to navigate to the /x/network/ipv6 working directory for the device. For example: ¦ For a chassis CMM type: cd /CMM/network/ipv6 ¦ For a chassis blade server SP type: cd /CH/BLn/network/ipv6 ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/ipv6 7. Type the show command to view the configured IPv6 network settings configured on the device. For example, see the following sample output values for the IPv6 properties on a server SP device. Note – When the autoconfig= property is set to dhcpv6_stateful or dhcpv6_stateless, the read-only property for dhcpv6_server_duid will identify the DHCP Unique ID of the DHCPv6 server that was last used by Oracle ILOM to retrieve the DHCP information. Note – The default IPv6 autoconfig property value provided in Oracle ILOM 3.0.14 (and later) is autoconfig=stateless. However, if you have Oracle ILOM 3.0.12 installed on your CMM or server module, the default property value for autoconfig appears as autoconfig=stateless_only. -> show /SP/network/ipv6 Targets: Properties: state = enabled autoconfig = stateless dhcpv6_server_duid = (none) link_local_ipaddress = fe80::214:4fff:feca:5f7e/64 static_ipaddress = ::/128 ipgateway = fe80::211:5dff:febe:5000/128 pending_static_ipaddress = ::/128 dynamic_ipaddress_1 = fec0:a:8:b7:214:4fff:feca:5f7e/64 Commands: cd show14 Oracle ILOM CMM Admistration Guide • May 2011 8. To configure an IPv6 auto-configuration option, use the set command to specify the following auto-configuration property values. Note – The IPv6 configuration options take affect after they are set. You do not need to commit these changes under the /network target. Note – IPv6 auto-configuration addresses learned for the device will not affect any of the active Oracle ILOM sessions to the device. You can verify the newly learned auto-configured addresses under the /network/ipv6 target. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. To enable an IPv6 auto-configuration option this state must be set to enabled. autoconfig set autoconfig= Specify this command followed by the autoconf value you want to set. Options include: • stateless (default setting provided in Oracle ILOM 3.0.14 or later) or stateless_only (default setting provided in Oracle ILOM 3.0.12) Automatically assigns IP address learned from the IPv6 network router. • dhcpv6_stateless Automatically assigns DNS information learned from the DHCP server. The dhcpv6_stateless property value is available in Oracle ILOM as of 3.0.14. • dhcpv6_stateful Automatically assigns the IPv6 address learned from the DHCPv6 server. The dhcpv6_stateful property value is available in Oracle ILOM as of 3.0.14. • disable Disables all auto-configuration property values and sets the read-only property value for link local address.Oracle ILOM CMM Initial Setup 15 Note – As of Oracle ILOM 3.0.14 or later, you can enable the stateless auto-configuration option to run at the same time as when the option for dhcpv6_stateless is enabled or as when the option for dhcpv6_stateful is enabled. However, the auto-configuration options for dhcpv6_stateless and dhcpv6_stateful should not be enabled to run at the same time. 9. Perform the following steps to set a static IPv6 address: a. To set a pending static IPv6 address, specify the following property values b. To commit (save) the pending IPv6 static network parameters, perform the steps in the following table: Note – Assigning a new static IP address to the device (SP or CMM) will end all active Oracle ILOM sessions to the device. To log back in to Oracle ILOM, you will need to create a new browser session using the newly assigned IP address. 10. To test the IPv4 or IPv6 network configuration from Oracle ILOM use the Network Test Tools (Ping and Ping6). For details, see “Test IPv4 or IPv6 Network Configuration” on page 16. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. To enable a static IP address this state must be set to enabled. pendingipaddress set pending_static_ipaddress= / Type this command followed by the property value for the static IPv6 address and net mask that you want to assign to the device. IPv6 address example: fec0:a:8:b7:214:4fff:feca:5f7e/64 Step Description 1 Use the cd command to change the directory to the device network target. For example: • For chassis CMM type: cd /CMM/network • For chassis blade server SP type: cd /CH/BLn/network • For chassis blade server SP with multiple nodes type: cd /CH/BLn/Noden/network 2 Type the following command to commit the changed property values for IPv6: set commitpending=true16 Oracle ILOM CMM Admistration Guide • May 2011 ? Test IPv4 or IPv6 Network Configuration 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. Establish a local serial console connection or SSH connection to the server SP or CMM 2. Use the cd command to navigate to the /x/network/test working directory for the device, for example: ¦ For a chassis CMM type: cd /CMM/network/test ¦ For a chassis blade server SP type: cd /CH/BLn/network/test ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/test 3. Type the show command to view the network test targets and properties. For example, see the following output the shows the test target properties on a CMM device. -> show /CMM/network/test Targets: Properties: ping = (Cannot show property) ping6 = (Cannot show property) Commands: cd set showOracle ILOM CMM Initial Setup 17 4. Use the set ping or set ping6 command to send a network test from the device to a specified network destination. Next Steps: ¦ If you have not already used the network management connection to log in to Oracle ILOM, see “Log In to the Oracle ILOM CMM Using a Network Connection” on page 18. ¦ Perform CMM administration tasks as described in this document or the Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation Collection Property Set Property Value Description ping set ping= Type the set ping= command at the command prompt followed by the IPv4 test destination address. For example: -> set ping=10.8.183.106 Ping of 10.8.183.106 succeeded ping6 set ping6= Type the set ping6= command followed by the IPv6 test destination address. For example: -> set ping6=fe80::211:5dff:febe:5000 Ping of fe80::211:5dff:febe:5000 succeeded18 Oracle ILOM CMM Admistration Guide • May 2011 Log In to the Oracle ILOM CMM Using a Network Connection Note – For further information on setting up Oracle ILOM, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide. ? Log In to Oracle ILOM 3.0 Using the Web Interface Follow these steps to log in to the Oracle ILOM web interface for the first time using the root user account: 1. Connect an Ethernet cable to the NET0 Ethernet port. 2. Type http://system_ipaddress into a web browser. The web interface Login page appears. Description Links Platform Feature Support Log in to Oracle ILOM CMM using a network connection • “Log In to Oracle ILOM 3.0 Using the Web Interface” on page 18 • “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 • CMMOracle ILOM CMM Initial Setup 19 3. Type the user name and password for the root user account: User Name: root Password: changeme 4. Click Log In. The Version page in the web interface appears. ? Log In to Oracle ILOM 3.0 Using the CLI To log in to the Oracle ILOM CLI for the first time, use SSH and the root user account. 1. Connect an Ethernet cable to the NET0 Ethernet port. 2. To log in to the Oracle ILOM CLI using the root user account, type: $ ssh root@system_ipaddress Password: changeme The Oracle ILOM CLI prompt appears (->).20 Oracle ILOM CMM Admistration Guide • May 2011 Activating CMM Ethernet Ports Note – By default, Ethernet port 0 is enabled on the CMM. You can enable port 1 or enable both ports through the CLI or the web interface. Caution – You can cause Ethernet networking problems and bring down the external network if you activate both Ethernet ports on the CMM. Before you activate both ports, ensure that the external switch supports trunk mode. The upstream Ethernet switch needs to be configured correctly, so that no Ethernet traffic loop is created. This is done usually by the spanning tree algorithm. ? Enable Ethernet Ports Using the Web Interface To enable an Ethernet port using the web interface: 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the left panel. 3. Navigate to Configuration --> Network. Description Links Platform Feature Support Activating CMM Ethernet ports • “Enable Ethernet Ports Using the Web Interface” on page 20 • “Enable Ethernet Ports Using the CLI” on page 21 • CMMOracle ILOM CMM Initial Setup 21 4. In the CMM Management Network Switch drop-down list, select one of the following: ¦ Port 0 Active: To activate port 0 only ¦ Port 1 Active: To activate port 1 only ¦ Trunking (Link Aggregation) to activate both ports 5. Click Save. 6. Remove the CMM and reinstall it into the chassis. See the chassis Service Manual for instructions on removing and replacing the CMM in the chassis. The active port is now updated. ? Enable Ethernet Ports Using the CLI To enable port 1 using the CLI: 1. Log in to the Oracle ILOM CLI. 2. Type: -> cd /CMM/network22 Oracle ILOM CMM Admistration Guide • May 2011 3. Type show to view the -switchconf variable setting. For example: In this example, the -switchconf variable is set to port 0. ¦ To activate port 1 and disable port 0, type: set switchconf=port1 ¦ To activate port 1 and keep port 0 active, type: set switchconf=trunk 4. Remove the CMM and reinstall it into the chassis. See the chassis Service Manual for instructions on removing and replacing the CMM in the chassis. The active port is now NET MGT port 1 or both NET MGT ports. -> show /CMM/network Targets: Properties: commitpending = (Cannot show property) ipaddress = 10.6.153.71 ipdiscovery = dhcp ipgateway = 10.6.152.1 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:6B:6F:C1 pendingipaddress = 10.6.153.71 pendingipdiscovery = dhcp pendingipgateway = 10.6.152.1 pendingipnetmask = 255.255.252.0 switchconf = port0 Commands: cd set showOracle ILOM CMM Initial Setup 23 Changing the Blade SP CLI Prompt About the Blade SP CLI Prompt Starting with CMM software 3.2 (Oracle ILOM 3.0.10), you can change the default CLI prompt for a server blade SP through the CMM. This prompt is used when you execute the following command to navigate to a server blade SP from the CMM: -> start /CH/BLn/SP/cli Instead of seeing the -> prompt, you will see one of the following default prompts: ¦ [BLn/SP] -> for single node blades ¦ [BLn/NODEn/SP] -> for blades with multiple nodes Note – A node is an independent computer that resides on the server blade. The Sun Blade X6275 server module is an example of a blade with two nodes per blade. This feature requires that the server blade SP is running Oracle ILOM 3.0.9 or later. ? Set the Blade SP CLI Prompt 1. Log in to the Oracle ILOM CLI. 2. Use one of the following commands to change the server blade default CLI prompt: ¦ For single-node blades: set /CH/BLn/SP/cli prompt="newprompt" Description Links Platform Feature Support Changing the blade SP CLI prompt • “About the Blade SP CLI Prompt” on page 23 • “Set the Blade SP CLI Prompt” on page 23 • “Reset the Blade SP CLI Prompt to the Default” on page 24 • CMM24 Oracle ILOM CMM Admistration Guide • May 2011 ¦ For two-node blades: set /CH/BLn/NODEn/SP/cli prompt="newprompt" Where newprompt is the value that you want to set for the new prompt. For example, if you want to set the blade SP prompt to “blade SP”, on BL0, you would use the following command: -> set /CH/BL0/SP/cli prompt="blade SP" ? Reset the Blade SP CLI Prompt to the Default ? If you have changed the blade SP CLI prompt from the default, and want to return to the default, use the following command: -> set /CH/BLn/SP/cli prompt=""25 Firmware Update Procedures Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, firmware management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, firmware updates ¦ Oracle ILOM 3.0 Daily Management Web Procedures, firmware updates ¦ Oracle ILOM 3.0 Protocols Management Reference, firmware updates Description Links Update the Oracle ILOM CMM firmware • “Updating the Oracle ILOM CMM Firmware” on page 26 Update the NEM firmware • “Updating the NEM Firmware” on page 34 Update chassis component firmware • “Updating Chassis Component Firmware Using the CMM” on page 40 Reset the power on the Oracle ILOM CMM • “Resetting the Oracle ILOM CMM” on page 4526 Oracle ILOM CMM Admistration Guide • May 2011 Updating the Oracle ILOM CMM Firmware Additional Information About Updating the Oracle ILOM CMM Firmware This information is covered in more detail in the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) Use the following sections, in order: Description Links Platform Feature Support Updating the Oracle ILOM CMM firmware • “Additional Information About Updating the Oracle ILOM CMM Firmware” on page 26 • “Obtaining the CMM IP Address” on page 27 • “Determining Your Current Firmware Version” on page 27 • “Determine the Firmware Version Using the Web Interface” on page 28 • “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29 • “Download Firmware Files” on page 30 • “Update Oracle ILOM Firmware Using the Web Interface” on page 31 • “Update Oracle ILOM Firmware Using the CLI” on page 33 • CMMFirmware Update Procedures 27 1. Obtain the IP address of the CMM. See “Obtaining the CMM IP Address” on page 27. 2. Log on to the CMM to check the versions of firmware you have. See “Determining Your Current Firmware Version” on page 27. 3. Use Oracle ILOM to download the new versions of firmware. See “Downloading Firmware Files” on page 30. 4. Use Oracle ILOM to install the new firmware. See “Updating Oracle ILOM Firmware” on page 31. 5. Reset the CMM. See “Resetting the Oracle ILOM CMM” on page 45. Note – For information on backing up and restoring the Oracle ILOM configuration, refer to the Oracle ILOM 3.0 Daily Management Web Procedures or the Oracle ILOM 3.0 Daily Management CLI Procedures. Obtaining the CMM IP Address You must use the CMM IP address to access the Oracle ILOM CMM. If you do not already know the CMM IP address, you must determine it. Refer to“Before You Begin” on page 6 for instructions on how to determine the IP address of the CMM. Determining Your Current Firmware Version Three procedures are provided in this section for determining your current firmware version: ¦ “Determine the Firmware Version Using the Web Interface” on page 28 ¦ “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29 ¦ “Determine the Firmware Version Using the Serial Management Port CLI” on page 2928 Oracle ILOM CMM Admistration Guide • May 2011 ? Determine the Firmware Version Using the Web Interface 1. Connect to the Oracle ILOM web interface by entering the IP address of the server’s CMM in your browser’s address field. For example: https://129.146.53.150 2. Log in to the Oracle ILOM web interface. 3. Click on the CMM in the left corner of the chassis navigation pane. 4. Navigate to System Information --> Versions. The Versions page is displayed, which includes the firmware version and build number.Firmware Update Procedures 29 ? Determine the Firmware Version Using the Management Ethernet Port CLI See the Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide for more detailed information on this procedure. 1. Log in to the Oracle ILOM CLI. 2. Type the version command, which returns output similar to the following: -> version CMM firmware 3.0.10.15 CMM firmware build number: 55335 CMM firmware date: Thu Apr 22 19:41:07 EDT 2010 CMM filesystem version: 0.1.22 The Oracle ILOM (CMM) firmware version and build number are listed in the output. ? Determine the Firmware Version Using the Serial Management Port CLI 1. Configure your terminal device or the terminal emulation software running on a laptop or PC to the following settings: ¦ 8N1: eight data bits, no parity, one stop bit ¦ 9600 baud ¦ Disable hardware flow control (CTS/RTS) ¦ Disable software flow control (XON/XOFF)30 Oracle ILOM CMM Admistration Guide • May 2011 2. Connect a serial cable from the RJ-45 SER MGT port on the CMM to your terminal device or PC. 3. Press Enter on the terminal device to establish a connection between that terminal device and the CMM. The CMM displays a login prompt. login: Where hostname could be SUNCMM followed by the product serial number, or if you have enabled hostnames in DHCP, it will be the assigned host name. 4. Log in to the Oracle ILOM CMM and type the default user name (root) with the default password (changeme). After you have successfully logged in, the CMM displays its default command prompt: -> 5. Type the version command, which returns output similar to the following: -> version CMM firmware version: 3.0.3.32 CMM firmware build number: 42331 CMM firmware date: Wed Feb 18 11:46:55 PST 2009 CMM filesystem version: 0.1.22 The Oracle ILOM firmware version and build number are listed in the output. Downloading Firmware Files The following procedure explains how to download the Oracle ILOM firmware from the web. ? Download Firmware Files Download the flash image .ima file using these steps: 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search).Firmware Update Procedures 31 5. In the Product? Is text field, type a full or partial product name, for example Sun Fire X6275, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, and then select the release of interest. 8. In the Patches search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example:. ¦ Patch 10266805 for the Oracle ILOM and BIOS portion of the Sun Blade X6275 M@ SW 1.1 release. ¦ Patch 10266804 for the Oracle ILOM portion of the Sun Blade 6000 CMM SW 1.1 release ¦ Patch 10266803 for the Sun Blade 6000 NEM SW 1.1 release 10. In the right pane that appears, click Download. Updating Oracle ILOM Firmware Caution – Oracle ILOM enters a special mode to load new firmware. No other tasks can be performed in Oracle ILOM until the firmware upgrade is complete and the Oracle ILOM is reset. This is the procedure that actually updates the firmware, replacing the existing images with the new images from the .ima file you downloaded previously. This section describes two methods of updating the Oracle ILOM /BIOS firmware: ¦ “Update Oracle ILOM Firmware Using the Web Interface” on page 31 ¦ “Update Oracle ILOM Firmware Using the CLI” on page 33 ? Update Oracle ILOM Firmware Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Navigate to Maintenance --> Firmware Upgrade.32 Oracle ILOM CMM Admistration Guide • May 2011 3. Click the Enter Upgrade Mode button. An Upgrade Verification dialog appears, indicating that other users who are logged in will lose their session when the update process completes. 4. In the Upgrade verification dialog, click OK to continue. The Firmware Upgrade page appears. 5. Browse for the flash image file. 6. Click the Upload button. Wait for the file to upload and validate. The Firmware Verification page appears. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. 7. (Optional) In the Firmware Verification page, enable the Preserve Configuration. Enable this option if you want to save your existing configuration in Oracle ILOM and restore that existing configuration after the update process completes. 8. Click Start Upgrade to start the upgrade process or click Exit to cancel the process. When you click Start Upgrade the upload process will start and a prompt to continue the process appears.Firmware Update Procedures 33 9. At the prompt, click OK to continue. The Update Status page appears providing details about the update progress. When the update indicates 100%, the firmware update is complete. When the update completes, the system automatically reboots. Note – The Oracle ILOM web interface might not refresh properly after the update completes. If the Oracle ILOM web is missing information or displays an error message, you might be viewing a cached version of the page from the version previous to the update. Clear your browser cache and refresh your browser before continuing. 10. Reconnect to the Oracle ILOM CMM web interface. 11. Navigate to System Information --> Version to verify that the firmware version on the CMM corresponds to the firmware image you installed. Note – If you did not preserve the Oracle ILOM configuration before the firmware update, you will need to perform the initial Oracle ILOM setup procedures to reconnect to Oracle ILOM. ? Update Oracle ILOM Firmware Using the CLI 1. Log in to the Oracle ILOM CLI through the Management Ethernet port or the Serial Management port. For the Management Ethernet port: See “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29. For the Serial Management Port: See“Determine the Firmware Version Using the Serial Management Port CLI” on page 29. 2. From the Oracle ILOM CLI, use the following command: -> load -source tftp://tftpserver/ILOM-version-Sun_Blade_60x0.ima Where tftpserver is the trivial file-transfer protocol (TFTP) server that contains the update and ILOM-version-Sun_Blade_60x0.ima is the firmware image file, for example: For Sun Blade 6000: ILOM-3_0_10_15-Sun_Blade_6000.ima or For Sun Blade 6048: ILOM-3_0_10_15-Sun_Blade_6048.ima34 Oracle ILOM CMM Admistration Guide • May 2011 Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. Updating the NEM Firmware About NEM Firmware Updates As of Oracle ILOM 3.0.9, the update firmware capability in Oracle ILOM was enhanced on some Oracle modular chassis systems to support firmware updates for Network Express Modules (NEMs). Prior to Oracle ILOM 3.0.9, NEM firmware updates were not supported from Oracle ILOM. You can perform a NEM firmware update directly from the Oracle ILOM CLI or web interface. Supported file transfer methods for uploading the firmware package to the NEM include: TFTP, HTTPS, FTP, SFTP, SCP, HTTP, and browser-based. Note – The browser-based local file transfer option is only available from the Oracle ILOM web interface. Before You Begin ¦ From the NEM’s vendor product download web site, download the NEM firmware update package to a system on your network where you can later gain access to it from Oracle ILOM. Description Links Platform Feature Support Updating the Oracle ILOM CMM firmware • “About NEM Firmware Updates” on page 34 • “Before You Begin” on page 35 • “Update NEM Firmware Using the CLI” on page 35 • “Update NEM Firmware Using the Web Interface” on page 37 • CMMFirmware Update Procedures 35 ¦ To update the NEM firmware in Oracle ILOM, you need the Admin (a) role enabled. ? Update NEM Firmware Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Use the cd command to navigate to the NEM requiring the firmware update. For example: cd /CH/NEM# Where # is the slot location where the NEM is installed in the chassis. If your chassis system does not support multiple NEMs and one NEM is supported, the NEM location would equal 0. For this example, you would type: cd /CH/NEM0 3. Type the show command to view the NEM properties and the firmware version presently installed on the NEM. For example, see the NEM show property output below for the Sun Blade 6000 Virtualized Multi-Fabric 10GE NEM M2. Note – The fru_extra_1= property field identifies the firmware version presently installed on the NEM. -> show /CH/NEM0 /CH/NEM0 Targets: MB SAS SP PRSNT STATE ERR OK SERVICE OK2RM LOCATE Properties: type = Network Express Module ipmi_name = NEM0 system_identifier = SUNSP-000000000036 Oracle ILOM CMM Admistration Guide • May 2011 4. Use the load command to upload and install the firmware update package on the NEM. For example, you would type: load_uri=uri Where uri equals the URI transfer method and location of the firmware package. See the following CLI load examples for each supported file transfer method Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. Where: ¦ password is the login password to the system where the file is stored. fru_name = SUN BLADE 6000 VIRTUALIZED MULTI-FABRIC 10GE NEM M2 fru_version = FW 3.0.10.16, SAS 5.3.4.0 fru_part_number = 540-7961-02 fru_extra_1 = FW 3.0.10.16, SAS 5.3.4.0 fault_state = OK load_uri = (none) clear_fault_action = (none) prepare_to_remove_status = NotReady prepare_to_remove_action = (none) return_to_service_action = (none) Commands: cd load reset set show Transfer Method CLI load Command Examples TFTP load_uri=tftp://ip_address/rom_nem.pkg FTP load_uri=ftp://username:password@ip_address/rom_nem.pkg SCP load_uri=scp://username:password@ip_address/rom_nem.pkg HTTP load_uri=http://username:password@ip_address/rom_nem.pkg HTTPS load_uri=https://username:password@ip_address/rom_nem.pkg SFTP load_uri=sftp://username:password@ip_address/rom_nem.pkgFirmware Update Procedures 37 ¦ username is the login user name to the system where the file is stored. ¦ rom_nem.pkg is the name of the firmware update package. ¦ ip_address is the IP address of the system where the file is stored. The user name and password for HTTP and HTTPS are optional. Note – Alternatively, you can use the set and load commands in the Oracle ILOM CLI to specify the path of the NEM location, as well as the location of the firmware update package to upload. For example: set /CH/NEM#/load_uri=uri 5. Wait a few moments for Oracle ILOM to confirm the completion of the firmware update process. A success or failure status appears. 6. Use the show command to view and confirm the firmware version that is installed on the NEM. ? Update NEM Firmware Using the Web Interface 1. Log in to the Oracle ILOM CMM web interface. 2. In the Oracle ILOM web interface, click CMM from the left pane. 3. Click the System Information --> Components tab. The Components page appears. 4. In the Component Status table, do the following: a. Select the radio button for the NEM that you want to update.38 Oracle ILOM CMM Admistration Guide • May 2011 b. Click the NEM name appearing in the Component Name column to view the firmware version presently installed on the NEM, then click Close to dismiss the dialog. c. In the Actions drop-down list box, select Update Firmware to initiate the firmware update process for the NEM. The Upload Firmware dialog appears. 5. In the Upload Firmware dialog, do the following: a. Select the Upload Transfer Method from the drop-down list box. b. Specify the required fields for the selected transfer method as follows:Firmware Update Procedures 39 Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. 6. Wait a few moments for Oracle ILOM to confirm the completion of the firmware update process. A success or failure status appears in the Upload Firmware dialog. Transfer Method Option Required Field Instructions Browser Select File Use the Browse button to specify the location of the NEM firmware update package. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Host Specify the IP address of the host system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Filepath Specify the complete path to where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Username Specify the login user name to the system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Password Specify the login password to the system where the NEM firmware update package is stored.40 Oracle ILOM CMM Admistration Guide • May 2011 Updating Chassis Component Firmware Using the CMM About Chassis Component Firmware As of Oracle ILOM 3.0.10, the Oracle ILOM CMM offers a centralized user interface for viewing the firmware version installed and initiating firmware updates on the following chassis components: ¦ Storage blades ¦ CPU blades ¦ Network Express Modules (NEMs): Not all NEMs have firmware. Check your NEM documentation to determine NEM firmware availability. For a detailed procedure for updating NEM firmware, see “Updating the NEM Firmware” on page 34. You must have Oracle ILOM CMM version 3.0.10 (available on the Oracle download site with Sun Blade 6000 Modular System Software release 3.2) installed on the CMM before using this firmware update tool. Server modules (blades) must be running Oracle ILOM 2.x or later. ? Update Firmware Using the Web Interface 1. Download the firmware that you need from the Oracle software download site: (http://www.oracle.com/us/products/servers-storage/servers/bla des/index.html) a. Search the page for the blade or NEM that you want to update. Description Links Platform Feature Support Updating the Chassis component firmware • “About Chassis Component Firmware” on page 40 • “Update Firmware Using the Web Interface” on page 41 • “Update Firmware Using the CLI” on page 43 • CMM • NEM • Sun blade serverFirmware Update Procedures 41 b. Download the latest firmware package and extract it to an accessible folder on the network. 2. Log in to the Oracle ILOM CMM as any user with Administrator privileges. 3. In the Chassis navigation pane, click on CMM. 4. Select System Information --> Components. 5. Select the component for which you want to upgrade the firmware. For example: -/CH/BL0. 6. Select Update Firmware from the Actions drop-down menu. A dialog box appears.42 Oracle ILOM CMM Admistration Guide • May 2011 7. Fill in the required fields for the selected transfer method. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. 8. Click Update. The firmware update process can take several minutes. A success or failure status appears in the Upload Firmware dialog. ? Update Firmware Using the CLI 1. Download the firmware that you need from the Oracle software download site: (http://www.oracle.com/us/products/servers-storage/servers/bla des/index.html) 2. Search the page for the blade or NEM that you want to update. 3. Download the latest firmware package and extract it to an accessible folder on the network. Transfer Method Option Required Field Instructions Browser Select File Use the Browse button to specify the location of the NEM firmware update package. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Host Specify the IP address of the host system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Filepath Specify the complete path where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Username Specify the login user name to the system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Password Specify the login password to the system where the NEM firmware update package is stored.Firmware Update Procedures 43 4. From a network connected terminal, log in to the Oracle ILOM CMM CLI using the root user account by entering the following command: $ ssh root@cmm_ipaddress Where cmm_ipaddress is the IP address of the Oracle ILOM CMM. 5. Enter the password (the default is changeme). The Oracle ILOM CLI prompt appears: -> 6. Change directories to the blade slot containing the blade or NEM to be upgraded: -> cd /CH/BLn or -> cd /CH/NEMn Where BLn is the chassis blade slot number of the blade to be upgraded and NEMn is the NEM to be upgraded. 7. Enter the following command: -> load -source transfer_method://transfer_server_ipaddress/firmware-version.pkg Where ¦ transfer_method is one of the following: FTP, SCP, HTTP, HTTPS, TFTP, SFTP ¦ transfer_server_ipaddress is the domain name or IP address of your transfer server where you copied the image file ¦ firmware-version is the name of the .pkg file. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. 8. When the process completes, ensure that the proper firmware version was installed. Enter the following command: -> version /CH/BLn or -> version /CH/NEMn Where BLn is the chassis slot number of the blade that was upgraded and NEMn is the NEM that was upgraded.44 Oracle ILOM CMM Admistration Guide • May 2011 Resetting the Oracle ILOM CMM Note – If neither of the Oracle ILOM procedures in this section are available, you can remove the CMM from the chassis and reinstall it to reset the power on the CMM. Note – Refer to the Sun Blade 6000 Modular System Service Manual or the Sun Blade 6048 Modular System Service Manual for information on how to remove and install the CMM. ? Reset Oracle ILOM Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Navigate to Maintenance --> Reset Components. 3. Select /CH/CMM, then click Reset. Description Links Platform Feature Support Resetting power to the CMM • “Reset Oracle ILOM Using the Web Interface” on page 45 • “Reset Oracle ILOM CMM Using the CLI” on page 46 • CMMFirmware Update Procedures 45 ? Reset Oracle ILOM CMM Using the CLI 1. Log in to the Oracle ILOM CLI. 2. From the Oracle ILOM CLI, type the following command: -> reset /CMM46 Oracle ILOM CMM Admistration Guide • May 201147 CMM Power Management Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, power management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, power management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, power management ¦ Oracle ILOM 3.0 Protocol Management Reference, manage system power Description Links Enable or disable Light Load Efficiency Mode (LLEM) • “Light Load Efficiency Mode (LLEM)” on page 48 Force power supply fans to low speed • “Force Power Supply Fan Speed” on page 52 Disable the power management • “Disabling the Power Management Policy” on page 54 Learn about Oracle ILOM readings for Specific Sun Blade 6048 Modular System Cases • “Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases” on page 5648 Oracle ILOM CMM Admistration Guide • May 2011 Light Load Efficiency Mode (LLEM) About LLEM The Light Load Efficiency Mode (LLEM) is a new feature of Oracle ILOM CMM 3.0.6.11. Under the LLEM, the CMM monitors the power being used and automatically shuts down the power supply unit (PSU) sides to achieve higher efficiency. While enabled, LLEM runs in both redundant and non-redundant mode. The CMM always disables PSU sides in descending order. When the power load level increases, the CMM renewably those disabled sides to cover the demand. If a new blade is inserted into the chassis, it can be powered on even if its power budget exceeds the power available from the sides currently turned on. When an unexpected AC fault occurs, LLEM is suspended and all sides will become enabled, verified by the sensor value of I_V12 and V_OUT_OK. If the fault is cleared, configured LLEM policy automatically goes back into effect. When the LLEM is disabled, all PSU sides, including those previously disabled, become enabled. This can be verified by the sensor value of I_V12 and V_OUT_OK. For further information on Oracle ILOM power management features, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide. Description Links Platform Feature Support Light Load Efficiency Mode • “About LLEM” on page 48 • “Enable or Disable LLEM Using the Web Interface” on page 49 • “Enable or Disable Redundant Mode Using the Web Interface” on page 50 • “Enable or Disable LLEM Using the CLI” on page 50 • “Enable Redundant Mode Using the CLI” on page 51 • “Enable Redundant Mode Using the CLI” on page 51 • CMMCMM Power Management 49 ? Enable or Disable LLEM Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Configuration --> Policy page. 4. Select Light Load Efficiency Mode. 5. Select Enable or Disable from the Actions drop-down list. 6. To turn power supplies on or off in the Policy page: a. Select Monitor Power Supply x Side y for power. In the following example, Monitor Power Supply 0 Side 0 is selected. b. Select Enable or Disable from the Actions menu.50 Oracle ILOM CMM Admistration Guide • May 2011 ? Enable or Disable Redundant Mode Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Power Management --> Redundancy page. 4. Select one of the following from the drop-down menu: ¦ None: To set non-redundant mode. ¦ N+N: To set redundant mode. 5. Click Save. ? Enable or Disable LLEM Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. To enable or disable LLEM, use the command: -> set /CMM/policy LIGHT_LOAD_EFFICIENCY_MODE= [enabled|disabled] 3. When LLEM is disabled, you can turn the PSU sides on or off with this command: -> set /CMM/policy MONITOR_PSn_SIDEn=[enabled|disabled]CMM Power Management 51 Note – It is advisable to disable any PSU side first before unplugging the power cord. You can check the sensor value of /CH/PSn/Sn/I_12V or /CH/PSn/Sn/V_OUT_OK, where the value of I_12V being 0 or V_OUT_OK deasserted indicates the corresponding side is disabled. You can disable any PSU sides monitoring. In both redundant and non-redundant modes, LLEM works on those sides that are under monitoring. ? Enable Redundant Mode Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Set redundant mode using this command: -> set /CMM/powermgmt redundancy=n+n All MONITOR_PSn_SIDEn are set to enabled, and any attempt to disable any PSU side’s monitoring is not allowed. ? Enable Non-Redundant Mode Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Set non-redundant mode using this command: -> set /CMM/powermgmt redundancy=none52 Oracle ILOM CMM Admistration Guide • May 2011 Force Power Supply Fan Speed About Power Supply Fan Speed A new feature, introduced in Oracle ILOM 3.0.6.11, allows the adjustment of power supply fan speed. The high and low speed settings are defined as follows: ¦ High speed refers to the fans running at 100% capacity. ¦ Low speed refers to the fans running at 80% capacity. Note – Only force power supply unit (PSU) fans to low speed if half the PEM slots or fewer are in use. ? Set the Power Supply Fan Speed Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Configuration --> Policy. Description Links Platform Feature Support Force power supply fan speed • “About Power Supply Fan Speed” on page 52 • “Set the Power Supply Fan Speed Using the Web Interface” on page 52 • “Set the Power Supply Fan Speed Using the CLI” on page 53 • CMMCMM Power Management 53 4. Choose one of the following options: ¦ Force Power Supply fans to low speed ¦ Force Power Supply fans to high speed 5. Select Enable or Disable from the Actions drop-down menu. As the power supply fans cool the power supplies, the power supply fans also cool the PEM slots. Note – If you enable both fan speed policies, high speed policy dominates. ? Set the Power Supply Fan Speed Using the CLI 1. Log in to the Oracle ILOM CLI interface. 2. Execute the following command: -> set /CMM/policy PS_FANS_HIGH=[enabled|disabled] -> set /CMM/policy PS_FANS_LOW=[enabled|disabled] As the power supply fans cool the power supplies, the power supply fans also cool the PEM slots. Note – If you enable both fan speed policies, high speed policy dominates.54 Oracle ILOM CMM Admistration Guide • May 2011 Disabling the Power Management Policy About the Power Management Policy A new power management option has been added to Oracle ILOM CMM 3.0.6.11c (Software Version 3.1.13) that enables the user to disable power management so that blades in the chassis attempt to power on even if power allocation has been exceeded. Caution – Chassis shutdown can occur. Do not disable power management unless you are advised to by Oracle Services personnel. ? Disable Power Management Policy Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Select CMM from the Chassis navigation pane. 3. Navigate to the Configuration --> Policy. 4. Select Manage Chassis Power. 5. Select Disable from the Actions drop-down list. The following Oracle ILOM screen graphic shows the Manage Chassis Power option at the bottom of the Policy Configuration page. Description Links Platform Feature Support Disabling the power management policy • “About the Power Management Policy” on page 54 • “Disable Power Management Policy Using the Web Interface” on page 54 • “Disable Power Management Policy Using the CLI” on page 55 • CMMCMM Power Management 55 ? Disable Power Management Policy Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Type the following command: -> set /CMM/policy POWER_MANAGEMENT=disabled56 Oracle ILOM CMM Admistration Guide • May 2011 Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases Oracle ILOM Behavior With Two Power Cord Configuration This section specifies how CMM and server module firmware behave when only two of the three power plugs are connected to an A231 power supply unit (PSU). There are three plugs on the back of each A231 PSU. These plugs are named AC0, AC1, and AC2. Each plug allows connection of a 220V power cord. When only two of the available three plugs are connected to the A231 PSUs, this provides 5600 watts to the entire chassis. If you connect only two of the total three plugs, connect them to AC0 and AC1. AC2 should not be connected. For further information on Sun Blade 6048 Modular System sensors, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Supplement for Sun Blade 6000 and Sun Blade 6048 Modular Systems (820-7603). ? Configure the CMM for Two Power Cords 1. To set up a two power cord configuration, disable the power supply side in the Oracle ILOM CMM with the following commands: -> set /CMM/policy MONITOR_PS0_SIDE2=disabled -> set /CMM/policy MONITOR_PS1_SIDE2=disabled Description Links Platform Feature Support Oracle ILOM 3.0 for specific Sun Blade 6048 cases • “Oracle ILOM Behavior With Two Power Cord Configuration” on page 56 • “Configure the CMM for Two Power Cords” on page 56 • “Oracle ILOM 3.0 Readings for Specific Power Supply States” on page 57 • CMMCMM Power Management 57 2. To view the disabled power cord side 2 configuration, type: Oracle ILOM 3.0 Readings for Specific Power Supply States This section provides some of the sensor readings for the system event log (SEL) in cases that are specific to the Sun Blade 6048 Modular System. To view the SEL using IPMItool, use the following command: ipmitool -H SPIPaddress -U root -P changeme sel list AC Cables Are Disconnected When an AC cable gets disconnected, the SEL displays the readings as shown in the example for power supply module 0, side 0 in TABLE: AC Cable Disconnect SEL Readings on page 58. -> show /CMM/policy/ /CMM/policy Targets: Properties: COOLING_DOOR_INSTALLED = disabled MONITOR_PS0_SIDE0 = enabled MONITOR_PS0_SIDE1 = enabled MONITOR_PS0_SIDE2 = disabled MONITOR_PS1_SIDE0 = enabled MONITOR_PS1_SIDE1 = enabled MONITOR_PS1_SIDE2 = disabled PS_FANS_HIGH = disabled Commands: cd set show58 Oracle ILOM CMM Admistration Guide • May 2011 Note – The order of the events might not match the real time event exactly, because that is based on how the sensors are being scanned. AC Cables Are Disconnected, Then Are Reconnected When an AC cable gets disconnected, then plugged back in, the SEL displays the readings as shown for power supply module 0, side 0 in TABLE: AC Cables Reconnected SEL Readings on page 58. TABLE: AC Cable Disconnect SEL Readings Event ID Device State Description 8 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC output is out (because AC is unplugged). 9 Voltage PS0/S0/V_IN_ERR Predictive Failure Asserted PSU 0 side 1 AC is disconnected. TABLE: AC Cables Reconnected SEL Readings Event ID Device State Description 8 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC output is out (because AC is unplugged). 9 Voltage PS0/S0/V_IN_ERR Predictive Failure Asserted PSU 0 side 0 AC is disconnected. a Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 DC output is OK (because AC is plugged in). b Voltage PS0/S0/V_IN_ERR Predictive Failure Deasserted PSU 0 side 0 is connected.CMM Power Management 59 stop /CH Command When the stop /CH command is applied, the SEL displays the readings as shown in the example in TABLE: stop /CH SEL Readings on page 59. This example describes a two power cord configuration. start /CH Command When the start /CH command is applied, the SEL displays the readings as shown in the example in TABLE: start /CH SEL Readings on page 59. This example describes a two power cord configuration. TABLE: stop /CH SEL Readings Event ID Device State Description 29 Module/Board NEM1/STATE Transition to Power Off Not enough power for the NEM 1, since the PSU shuts off. 2a Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 is out. 2b Voltage PS0/S1/V_OUT_OK State Deasserted PSU 0 side 1 is out. 2c Module/Board NEM0/STATE Transition to Power Off Not enough power for the NEM 0, since the PSU shuts off. 2d Voltage PS1/S0/V_OUT_OK State Deasserted PSU 1 side 0 is out. 2e Voltage PS1/S1/V_OUT_OK State Deasserted PSU 1 side 0 is out. TABLE: start /CH SEL Readings Event ID Device State Description 2f Module/Board NEM1/STATE Transition to Running NEM 1 is powering on. 30 OEM BL7/ERR Predictive Failure Deasserted Blade module does not have an error. 31 Module/Board NEM0/STATE Transition to Running NEM 0 is powering on. 32 Voltage PS1/S0/V_OUT_OK State Asserted PSU 1 side 0 is on. 33 Voltage PS1/S1/V_OUT_OK State Asserted PSU 1 side 1 is on.60 Oracle ILOM CMM Admistration Guide • May 2011 One PSU Is Removed When one PSU is removed, and there is too much power consumption in the chassis to support PSU redundancy, the SEL displays the readings shown in TABLE: PSU Removed SEL Readings on page 60. PSU Is Reinserted TABLE: PSU Reinserted SEL Readings on page 60 shows the SEL readings as a PSU is reinserted into the system and the system recognizes that power has been reapplied. 34 OEM BL1/ERR Predictive Failure Deasserted Blade module does not have an error. 35 Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 is on. 36 Voltage PS0/S1/V_OUT_OK State Asserted PSU 0 side 1 is on. TABLE: PSU Removed SEL Readings Event ID Device State Description 1 Entity Presence PS0/PRSNT Device Absent PS0 is absent from the system. 2 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC power is out. 3 Voltage PS0/S1/V_OUT_OK State Deasserted PSU 0 side 1 DC power is out. 4 Voltage PS0/S2/V_OUT_OK State Deasserted PSU 0 side 2 DC power is out. TABLE: PSU Reinserted SEL Readings Event ID Device State Description 5 Entity Presence PS0/PRSNT Device Present PS0 is present in the system. TABLE: start /CH SEL Readings (Continued) (Continued) Event ID Device State DescriptionCMM Power Management 61 6 Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 DC power is on. 7 Voltage PS0/S1/V_OUT_OK State Asserted PSU 0 side 1 DC power is on. 8 Voltage PS0/S2/V_OUT_OK State Asserted PSU 0 side 2 DC power is on. TABLE: PSU Reinserted SEL Readings (Continued) (Continued) Event ID Device State Description62 Oracle ILOM CMM Admistration Guide • May 201163 Sun Blade Zone Manager Description Links Learn about the features of the Sun Blade Zone Manager and prerequisites for use of the application • “Introduction to the Sun Blade Zone Manager” on page 64 Access and enable Sun Blade Zone Manager • “Accessing the Sun Blade Zone Manager” on page 72 Create a storage zoning configuration • “Creating the Chassis Storage Access Configuration” on page 78 View and modify the storage zoning configuration • “Viewing or Modifying the Chassis Storage Access Configuration” on page 91 Save the storage zoning configuration • “Saving the Chassis Storage Access Configuration” on page 105 Back up the storage zoning configuration • “Backing Up the Storage Access Configuration” on page 107 Recover the storage zoning configuration • “Recovering Zoning Configurations” on page 109 Reset the zoning configuration • “Resetting the Zoning Configuration” on page 113 Reset the zoning password • “Resetting the Zoning Password” on page 11564 Oracle ILOM CMM Admistration Guide • May 2011 Introduction to the Sun Blade Zone Manager Supported Oracle ILOM User Interfaces Note – The Sun Blade Zone Manager is available in the Sun Blade 6000 Modular System CMM SW 3.0.10 or later, which includes Oracle ILOM 3.0.10 and later. Note – You can access the Zone Manager through either the Oracle ILOM web interface or command-line interface (CLI). The web interface and the CLI are functionally equivalent, but the web interface has some additional ease-of-use features. Accessing Zone Manager Using the Web Interface The Sun Blade Zone Manager is accessible through the Oracle ILOM CMM Storage tab. It provides two options for setting up the storage configuration: Description Links Platform Feature Support Introduction to the Sun Blade Zone Manager • “Supported Oracle ILOM User Interfaces” on page 64 • “Zoning Configuration Overview” on page 68 • “Supported Hardware and Firmware Configurations” on page 71 • CMM Topic Descriptions Links Platform Feature Support Supported Oracle ILOM User Interfaces • “Accessing Zone Manager Using the Web Interface” on page 64 • “Accessing Zone Manager Using the CLI” on page 67 • CMMSun Blade Zone Manager 65 ¦ Quick Setup enables you to choose from four different zoning configurations to set up the initial zoning. ¦ Detailed Setup enables you to create or change the zoning configuration by individually selecting blades and storage devices. The following example shows one of the configurations available through Quick Setup. Note – Empty slots mean that there is nothing installed. When viewed in the Sun Blade Zone Manager, the Sun Blade Storage Module M2 shows 8 HDD slots which are configurable when a supported drive is installed, it also shows 24 empty slots below the HDD slots that are not used and cannot be configured. Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time.66 Oracle ILOM CMM Admistration Guide • May 2011 See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for more information on Quick Setup. Detailed Setup enables you to make changes to the zoning configuration that you set up in Quick Setup or to make individual assignments of storage devices to server blades. The following example shows drives being selected for removal from the server blade assignment. Drives HDD4-HDD7 are selected and highlighted in blue. When the configuration is saved, these storage devices will no longer be associated with the server blade in Slot 1. For more information on changing a zoning configuration using Detailed Setup, see “View and Modify the Chassis Storage Configuration Using the Web Interface” on page 91.Sun Blade Zone Manager 67 Accessing Zone Manager Using the CLI The command-line interface (CLI) provides access to the zoning for blades and storage devices through the /STORAGE/sas_zoning namespace. When zoning is enabled, blades and NEMs that are SAS-2 capable will be displayed as targets under /STORAGE/sas_zoning. For example: Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. Storage devices installed on a storage blade are shown as targets of the storage blade. For example, if BL9 is a storage blade installed in Slot 9, the storage devices installed on this blade are shown as follows: -> show /STORAGE/sas_zoning Targets BL0 BL6 BL7 BL8 BL9 NEM0 NEM1 Properties zone_management_state = enabled reset_password_action = (Cannot show property) reset_access_action = (Cannot show property) Commands: cd set show -> show /STORAGE/sas_zoning/BL9 Targets: HDD0 HDD2 HDD3 HDD568 Oracle ILOM CMM Admistration Guide • May 2011 You can access and modify the zoning configurations either through the server blade or the storage blade. Either method has the same result. Zoning Configuration Overview Zoning Commands You can assign storage to a server blade or a server blade to a storage device. Either method produces the same result. When you are assigning storage devices to a server blade, use the following command: -> set add_storage_access=/CH/BLn/HDDn Where BLn is the storage blade, HDDn is a hard disk drive installed on the storage blade. Optionally, you can assign multiple storage devices to a blade in the same command line by separating storage devices with a comma. For example: -> set add_storage_access=/CH/BLn/HDD0,/CH/BLn/HDD1 When you are assigning a server blade to a storage device, use the following command: -> set add_host_access=/CH/BLn Where BLn is the server blade that you are assigning the storage device to. Topic Descriptions Links Platform Feature Support Zoning configuration overview • “Zoning Commands” on page 68 • “Assigning Storage to a Server Blade” on page 69 • “Assigning a Server Blade to Storage” on page 69 • CMMSun Blade Zone Manager 69 Assigning Storage to a Server Blade Before a server blade has a storage device assigned to it, no targets are displayed under the blade. In the following example, BL0 is a server blade in Slot 0. The following command assigns the HDD0 installed on the storage blade in chassis Slot 9 to the server blade installed in Slot 0. -> set add_storage_access=/CH/BL9/HDD0 After a storage device is assigned to a server blade, the storage device appears as a target under the server blade. For example: Assigning a Server Blade to Storage Before a storage device has a blade assigned to it, no targets are displayed under the storage device. In the following example, HDD0 is a storage device installed on a storage blade installed in Slot 9 of the chassis. -> cd /STORAGE/sas_zoning/BL0 -> show /STORAGE/sas_zoning/BL0 Targets: Properties: add_storage_access = (Cannot show property) remove_storage_access = (Cannot show property) -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL9/HDD0) Properties: add_storage_access = (Cannot show property) remove_storage_access = (Cannot show property) -> cd /STORAGE/sas_zoning/BL9/HDD0 -> show /STORAGE/sas_zoning/BL9/HDD0 Targets:70 Oracle ILOM CMM Admistration Guide • May 2011 The following command assigns server blade in Slot 0 to HDD0 on storage blade 9: -> set add_host_access=/CH/BL0 After a server blade is assigned to the storage device, the server blade appears as a target under the storage device. For example: For detailed instructions on creating and modifying zoning, see the following procedures: ¦ “Creating the Chassis Storage Access Configuration” on page 78 ¦ “Viewing or Modifying the Chassis Storage Access Configuration” on page 91 Properties: type = Hard Disk disk_type = SAS wwn = 0x5000c50003d3a765, 0x5000c50003d3a766 sas_speed = 6.0 Gbps add_host_access = (Cannot show property) remove_host_access = (Cannot show property) -> show /STORAGE/sas_zoning/BL9/HDD0 Targets: 0 (/CH/BL0) Properties: type = Hard Disk disk_type = SAS wwn = 0x5000c50003d3a765, 0x5000c50003d3a766 sas_speed = 6.0 Gbps add_host_access = (Cannot show property) remove_host_access = (Cannot show property)Sun Blade Zone Manager 71 Supported Hardware and Firmware Configurations SAS-2 Capable Hardware All of the following hardware in the chassis must be SAS-2 capable in order to be recognized by the Sun Blade Zone Manager: ¦ Server blades with SAS-2 REMs ¦ Network express modules (NEMs) ¦ Storage blades If a storage module or server blade is not SAS-2 capable, it is not included in the Zone Manager configuration. The web interface acknowledges the presence of the blade, but it is labeled as a “non SAS-2” device. The blade is not displayed at all in the CLI if it is not SAS-2 enabled. SAS-2 devices, except for CPU blades, must be powered on to be recognized by the Zone Manager. In addition, SAS-2 devices in a failed state might not be recognized by Zone Manager. Refer to your platform Oracle ILOM supplement documentation or platform administration guide for information on detecting component faults. Additional System Requirements ¦ Your Sun Blade 6000 Modular System must have a PCIe 2.0 compliant midplane. For more information on determining this, refer to the Sun Blade 6000 Modular System Product Notes. ¦ Your Sun Blade 6000 Modular System must have software release 3.2.1 installed. This release includes the minimum Oracle ILOM CMM firmware version (3.0.10.15a), which supports SAS-2 and includes the Sun Blade Zone Manager. ¦ You must have already installed your SAS-2 supported components (server module with SAS-2 REM, SAS-2 NEMs, and SAS-2 storage modules). ¦ Your SAS-2 NEM must be at a firmware version level that supports zoning. Check your NEM Product Notes for version information and available updates. Description Links Platform Feature Support Supported hardware and firmware configurations • “SAS-2 Capable Hardware” on page 71 • “Additional System Requirements” on page 71 • CMM72 Oracle ILOM CMM Admistration Guide • May 2011 ¦ You must have already performed initial setup and configuration of your Oracle ILOM CMM and planned your connection method (web browser or CLI) as described in LINK “Chapter 2” of this document. Accessing the Sun Blade Zone Manager ? Access and Enable the Sun Blade Zone Manager Using the Web Interface Before You Begin: Ensure that your chassis configurations meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. Follow these steps to access and enable the Zone Manager using the web interface: 1. Open a web browser and log in to the CMM by entering the following URL: http://chassis_sp_ipaddress/ Where chassis_sp_ipaddress is the IP address of your chassis service processor. The Oracle ILOM login page appears. 2. Log in as the root user account. The Oracle ILOM CMM main page is displayed. Description Links Platform Feature Support Accessing the Sun Blade Zone Manager • “Access and Enable the Sun Blade Zone Manager Using the Web Interface” on page 72 • “Access and Enable the Sun Blade Zone Manager Using the CLI” on page 76 • CMMSun Blade Zone Manager 73 Note – In the left pane, installed server blades are listed, but not installed storage modules. This is because the Oracle ILOM CMM controls storage module Integrated Lights Out Management functions. 3. Click on CMM in the left Chassis navigation pane and then click the Storage tab. The Zone Manager Settings sub-page is displayed.74 Oracle ILOM CMM Admistration Guide • May 2011 4. Enable CMM zoning by clicking the Enable check box, and then clicking the Save button. This enables you to create, view, and manage zoning settings through the CMM.Sun Blade Zone Manager 75 You might get the following message if the Oracle ILOM CMM services are still initializing: If you get this message, wait an additional five minutes and then try again. You need to close and reopen, or refresh the page.76 Oracle ILOM CMM Admistration Guide • May 2011 5. Use the procedures in “Creating the Chassis Storage Access Configuration” on page 78 to set up the storage zoning. ? Access and Enable the Sun Blade Zone Manager Using the CLI Before You Begin: Ensure that your chassis configurations meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. Follow these steps to access and enable Zone Manager using the CLI: 1. Open a terminal window and establish an SSH connection to the CMM by entering the following command: # ssh -l root cmm_ipaddress Where cmm_ipaddress is the IP address of the CMM. The login prompt is displayed. 2. Log in as root and enter the root password: /hostname/login: root password: xxxxxxxx After you have successfully logged in, the CLI prompt is displayed: -> 3. Confirm that you have the minimum CMM firmware version required for zoning by entering the command: -> version You need Oracle ILOM firmware 3.0.10 at a minimum. If you have an earlier version, you need to download Oracle ILOM CMM software version 3.2.1 (or later). See LINK “Chapter 3” for firmware download and upgrade procedures. Then you need to upgrade your Oracle ILOM CMM firmware. 4. Change directories to sas_zoning by entering the command: -> cd /STORAGE/sas_zoning/Sun Blade Zone Manager 77 5. Check whether -sas_zoning is enabled by entering the show command. For example: If the -zone_management_state = disabled, then there are no saved SAS-2 zone configurations. 6. If necessary, enable zoning by entering: -> set zone_management_state=enabled ¦ If the zone manager is ready to be enabled, you get the following message: ¦ Enabling the Sun Blade Zone Manager will result in the clearing of all zoning configuration in the installed chassis SAS hardware, and any SAS disk I/O in progress will be interrupted. ¦ Are you sure you want to enable the Sun Blade Zone Manager (y/n)? y ¦ Set ’zone_management_state’ to ’enabled’ ¦ If the Oracle ILOM CMM has not initialized, you will get the following message: ¦ set: The Sun Blade Zone Manager is initializing and not ready for operation. Please wait several minutes and try again. ¦ If you get this message, wait five minutes and retry the command. 7. Use the procedures in “Creating the Chassis Storage Access Configuration” on page 78 to set up the storage zoning. -> show /STORAGE/sas_zoning Targets: Properties: zone_management_state = disabled reset_password_action = (Cannot show property) reset_access_action = (Cannot show property) Commands: cd set show78 Oracle ILOM CMM Admistration Guide • May 2011 Creating the Chassis Storage Access Configuration About Creating Chassis Storage Access There are three options for creating chassis storage access: the web interface using Quick Setup, the web interface using Detailed Setup, and the CLI. You can also use a backup zoned configuration by recovering the configuration as shown in “Recovering Zoning Configurations” on page 109. Quick Setup is a wizard for automating the process of creating an initial chassis storage access configuration for SAS-2 compliant CPU blades. Quick Setup is only available through the Oracle ILOM web interface. There is no Quick Setup equivalent for the CLI. Creating the Chassis Storage Access Configuration Using Quick Setup The Quick Setup option through the Oracle ILOM web interface enables you to choose from four different configuration options to zone the blades and storage devices in the chassis. Description Links Platform Feature Support Creating the Chassis Storage Access Configuration • “About Creating Chassis Storage Access” on page 78 • “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 • “Creating the Chassis Storage Access Configuration Using Detailed Setup” on page 85 • “Creating a Chassis Storage Configuration Using the CLI” on page 88 • CMMSun Blade Zone Manager 79 Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. There are four options available for Quick Setup described in the following topics: ¦ “Option 1: Assign per Individual Disks” on page 79 ¦ “Option 2: Assign per Adjacent Individual Disks” on page 80 ¦ “Option 3: Assign per Storage Blade” on page 81 ¦ “Option 4: Assign per Adjacent Storage Blade” on page 82 Additionally, this section covers the following topic: ¦ “Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface” on page 83 Option 1: Assign per Individual Disks This option uses a round-robin algorithm to assign disks to hosts. Ownership of disks is spread evenly across available storage modules. This option is best for fault tolerance where the failure or removal of a single storage module will not bring down an array.80 Oracle ILOM CMM Admistration Guide • May 2011 Option 2: Assign per Adjacent Individual Disks This option equally divides the number of storage devices among the server blades. All servers are assigned as close to the same number of disks as possible. Instead of assigning the storage in a round-robin fashion among all available storage blades, the storage is assigned from storage blades that are adjacent to the server blades. If there are no storage blades adjacent to the server blade, then the nearest possible storage blade is used. This is a good option to use if you have more server blades than storage blades, and want to have an equal number of storage devices assigned to each storage blade.Sun Blade Zone Manager 81 Option 3: Assign per Storage Blade This option looks for servers (starting at Slot 0) and assigns the closest available storage module. If there are seven servers and three storage modules, only the first three servers will be assigned a storage module. This option is best to use when there are an equal number of storage blades and modules or more storage blades than modules. Otherwise, some server blades will not be assigned to any storage device.82 Oracle ILOM CMM Admistration Guide • May 2011 Option 4: Assign per Adjacent Storage Blade This option looks for servers with storage modules in adjacent slots and one per server. If the server does not have a storage module in an adjacent slot, it is not assigned any storage. This option works best when there are an equal number of storage blades and server blades, and each server blade has a unique storage blade installed adjacent to it.Sun Blade Zone Manager 83 ? Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Quick Setup button. A warning message appears.84 Oracle ILOM CMM Admistration Guide • May 2011 3. Click OK if you are willing to overwrite any existing zoning. The Quick Setup screen appears. Note that any HDD slots that do not have a storage device installed are labeled “empty.” These slots are not included in the Quick Setup configuration.Sun Blade Zone Manager 85 4. Choose one of the Quick Setup options. See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for explanation of each option. After you make the selection, the screen shows the color-coded zoning assignments between the CPU blades and storage devices (HDDs). Although the Sun Blade Zone Manager assigns the NEM0 and NEM1 External SAS connections, these connections are not officially supported. Note – Until you click the Save button, the configuration is not saved. 5. Click the Save button to save the configuration. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration. 6. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. Creating the Chassis Storage Access Configuration Using Detailed Setup You can use the New Assignments option in Detailed Setup to manually create the chassis storage access configuration. Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. ? Use Detailed Setup to Create the Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The following message appears if you do not have a chassis storage configuration set up.86 Oracle ILOM CMM Admistration Guide • May 2011 3. Do one of the following: ¦ If you want to continue with the Detailed Setup setup, click Cancel. Clicking Cancel will open the Detailed Setup page. ¦ If you want to set up the original configuration in Quick Setup, click OK. Clicking OK will open the Quick Setup page. See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for more information on Quick Setup. 4. Click the New Assignments button.Sun Blade Zone Manager 87 5. Click on a server blade and then click on the HDDs to be assigned to the server blade. Alternatively, select more than one server blade for the assignment. Note that any HDD slots that do not have a storage device installed are labeled “empty.” These slots cannot be assigned to a server blade. Caution – If you assign an HDD to more than one server blade, ensure that the server blade is enabled for multipathing. For more information see “Assign Multiple Server Blades to a Storage Device Using the Web Interface” on page 99. Although the Sun Blade Zone Manager can assign them, NEM0 and NEM1 External SAS connections are not supported at this time. 6. Click Save to save the configuration. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration.88 Oracle ILOM CMM Admistration Guide • May 2011 7. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. Creating a Chassis Storage Configuration Using the CLI You can create a chassis storage configuration either by assigning storage to a server blade or assigning a server blade to a storage device. Either method provides the same results. ? Create a Chassis Storage Configuration Using the CLI Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71.Sun Blade Zone Manager 89 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Use one of the following methods to create a chassis storage configuration: ¦ Method 1: To assign a storage module device to a server blade, use the following commands: -> cd /STORAGE/sas_zoning/BLn -> set add_storage_access=path_to_storage_device Where BLn is a server blade and path_to_storage_device is the path to the storage device that you want to assign to the blade. For example, /CH/BL1/HDD0. ¦ Method 2: To assign a server blade to a storage device, use the following command: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set add_host_access=path_to_blade_server Where BLn is a storage blade, HDDn is a storage device installed on the storage blade, and path_to_blade_server is the path to the server that you want to assign to the storage device. For example, /CH/BL0. The following examples show how to use these commands to set up zoning between storage devices on a storage blade in Slot 1 and a server blade in Slot 0. ¦ Method 1 - Command examples for assigning storage module devices to a server blade: Command Description -> cd /STORAGE/sas_zoning/BL0 Use the cd command to access the host server blade that will be assigned storage.90 Oracle ILOM CMM Admistration Guide • May 2011 ¦ Method 2 - Command examples for assigning a server blade (BL0) to storage module devices (BL1/HDD0). 3. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. -> set add_storage_access=/CH/BL1/HDD0 Assign HDD0 of the storage module in blade Slot 1 to the current host. -> set add_storage_access= /CH/BL1/HDD0,/CH/BL1/HDD1 Assign multiple devices in a single command line. Use the full path to the device and separate each device with a comma (no space). -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL1/HDD0) 1 (/CH/BL1/HDD1) Use the show command to confirm assigned devices to the current host. Command Description -> cd /STORAGE/sas_zoning/BL1/HDD0 Use the cd command to access the storage module device (in this case BL1/HDD0). -> set add_host_access=/CH/BL0 Assign the current device (HDD0) of the storage module to the host in blade Slot 0. -> show /STORAGE/sas_zoning/BL1/HDD0 Targets: 0 (/CH/BL0) Use the show command to confirm assignment of the current device. Command DescriptionSun Blade Zone Manager 91 Viewing or Modifying the Chassis Storage Access Configuration You can use the Detailed Setup through the web interface or the CLI to view or modify the current chassis storage access configuration. Use one of the procedures in the following table to view or modify the current storage configuration. ? View and Modify the Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The current chassis zoning configuration is displayed, as shown in the following example. Description Links View and modify the current storage configuration using the web interface. “View and Modify the Chassis Storage Configuration Using the Web Interface” on page 91 View and modify the current storage configuration using the CLI. “View and Modify the Chassis Storage Configuration Using the CLI” on page 97 Assign multiple server blades to a storage device. “Assign Multiple Server Blades to a Storage Device Using the Web Interface” on page 99 View the storage configuration in table format. “View the Storage Access Configuration Table Using the Web Interface” on page 10292 Oracle ILOM CMM Admistration Guide • May 2011 Note – Any HDD slots that do not have a storage device installed are labeled “empty.” These slots cannot be assigned to a server blade. 3. To modify a blade/storage group, select a blade that is part of the group. The storage that is assigned to the group will be highlighted.Sun Blade Zone Manager 93 4. Click the Modify Group button. The group that you selected is still highlighted. 5. To remove a storage device that is in the group, click on it. The following illustration shows HDD 4-7 selected to be unassigned from the processor blade in Slot 1.94 Oracle ILOM CMM Admistration Guide • May 2011 6. Click Save to remove the modules from the group. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration. 7. If you do not plan to make additional storage assignments, back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. 8. To make a new storage group assignment, click the New Assignments button.Sun Blade Zone Manager 95 9. Click on the server blade and storage devices that you want to include in the group. In the following example, the selected storage group is highlighted in green.96 Oracle ILOM CMM Admistration Guide • May 2011 10. Click Save. HDD 4-7 are now assigned to Slot 0.Sun Blade Zone Manager 97 11. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. ? View and Modify the Chassis Storage Configuration Using the CLI Before You Begin: Set up the initial chassis zoning configuration using Quick Setup or Detailed Setup. See “Creating the Chassis Storage Access Configuration” on page 78. 1. Access Zone Manager using the CLI. See “Accessing the Sun Blade Zone Manager” on page 72.98 Oracle ILOM CMM Admistration Guide • May 2011 2. To view storage device assignments to a server blade, you can either view the assignments per server blade or per storage module. In the following examples, HDD0 and HDD1 from a storage blade in Slot 2 are assigned to server blade in Slot 0. ¦ To view storage assignments per server blade, use the show command with the host blade SAS zoning directory. For example: In this example, HDD0 and HDD1 from a storage blade in Slot 2 are assigned to server blade in Slot 0. ¦ To view storage assignments per storage device, use the show command with the storage blade SAS zoning directory for the storage device. For example: 3. Modify storage assignments. You can modify storage device assignments to server blades or modify server blade assignments to storage devices. Either method provides the same result. Method 1: Add or remove storage access to the server blade. ¦ To assign a storage module to a server blade: -> cd /STORAGE/sas_zoning/BLn -> set add_storage_access=path_to_storage_device ¦ To remove a storage module from a server blade: -> cd /STORAGE/sas_zoning/BLn -> set remove_storage_access=path_to_storage_device Where BLn is a server blade and path_to_storage_device is the path to the storage device that you want to assign to the blade. For example, /CH/BL1/HDD0. Method 2: Add or remove server blade access to storage blades. ¦ To assign a server blade to a storage device: -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL2/HDD0) 1 (/CH/BL2/HDD1) -> show /STORAGE/BL2/HDD0 Targets: 0 (/CH/BL0) -> show /STORAGE/BL2/HDD1 Targets: 0 (/CH/BL0)Sun Blade Zone Manager 99 Use one of the following commands: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set add_host_access=path_to_blade_server ¦ To remove a server blade from a storage device: Use one of the following commands: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set remove_host_access=path_to_blade_server Where BLn is a storage blade, and HDDn is storage device in the storage blade, and path_to_blade_server is the path to the server that you want to assign to the storage device. For example, /CH/BL0. Note – You can also add or remove multiple devices in a single command line. Use the full path to the device and separate each device with a comma (no space). For example: -> set add_storage_access=/CH/BL1/HDD0,/CH/BL1/HDD1. 4. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. ? Assign Multiple Server Blades to a Storage Device Using the Web Interface The Sun Blade Zone Manager enables you to assign more than one server blade to a single storage device. This option should only be used with an Oracle-supported clustering solution. See the Sun Blade Storage Module Administration Guide for more information. Note – Check your server blade documentation for information on whether the server module is enabled for sharing storage with another server. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. In the following example, HDD6 in storage module Slot 2 is assigned only to the server blade in Slot 0.100 Oracle ILOM CMM Admistration Guide • May 2011 3. Click New Assignments. 4. To assign HDD6 to both the server blade in Slot 0 and the server blade in Slot 1, click Slot 1 and click HDD6 in Slot 2.Sun Blade Zone Manager 101 5. Click Save. The following message appears. 6. Click OK to continue. The following example shows the HDD6 in Slot 2 colored pink to indicate that it is shared by more than one server blade.102 Oracle ILOM CMM Admistration Guide • May 2011 7. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107 ? View the Storage Access Configuration Table Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The following is an example storage access configuration.Sun Blade Zone Manager 103 3. Select one of the server blade slots. In this example, Slot 0 is selected. 4. Scroll down to the Current Assignments table. All of the storage device assignments for the selected server blade are shown in table format.104 Oracle ILOM CMM Admistration Guide • May 2011 5. To detach the table from the rest of the screen, click Detach Table. Saving the Chassis Storage Access Configuration Important Considerations About Saving the Zoning Configuration When you save a storage access configuration, keep the following in mind: ¦ The configuration information is saved with the SAS-2 NEMs and storage blades. Changes in zoning hardware configurations can result in loss of the zoning configuration. Back up the configuration immediately after saving it. See “Backing Up the Storage Access Configuration” on page 107. Description Links Platform Feature Support Saving the Chassis Storage Access Configuration • “Important Considerations About Saving the Zoning Configuration” on page 105 • “Saving a New or Modified Storage Access Configuration” on page 105 • CMMSun Blade Zone Manager 105 Refer to the storage blade or NEM documentation for further information on the effect of hot-plugging these components. ¦ The Zone Manager windows must remain open during the entire Save operation. If the Zone Manager window is closed while the Save operation is in progress, only the portion of the configuration that was processed before the window was closed will be preserved. ¦ Do not remove or power cycle any of the components included in a zoning assignment while a Save operation is in progress. The zoning configuration will not save properly. Saving a New or Modified Storage Access Configuration You can save a new or modified storage access configuration using either the Oracle ILOM web interface or the CLI. ¦ From the web interface: Press the Save button after making the storage access assignments in the Quick Setup or Detailed Setup screens. ¦ From the CLI: As soon as you execute the set command for the storage assignment, the configuration is saved. While the new configuration is being saved, the following takes place: ¦ In Quick Setup, the existing configuration is overridden. ¦ All storage controls are disabled while the configuration is being saved. ¦ For the web interface, check marks indicate where the new configuration is applied.106 Oracle ILOM CMM Admistration Guide • May 2011 ¦ In the web interface, a Setup Complete message is displayed when the storage configuration has been saved.Sun Blade Zone Manager 107 Backing Up the Storage Access Configuration ? Save the Zoning Configuration to a Backup File Using the Web Interface 1. After saving a configuration in the Quick Setup or Detailed Setup screen, Click the Maintenance tab for the CMM. The CMM maintenance sub-tabs are displayed. 2. Click the Backup/Restore tab. The Configuration Backup/Restore page is displayed. 3. Select Backup from the Operation drop-down list. Description Links Platform Feature Support Backing up the Storage Access Configuration • “Save the Zoning Configuration to a Backup File Using the Web Interface” on page 107 • “Save the Zoning Configuration to a Backup File Using the CLI” on page 108 • CMM108 Oracle ILOM CMM Admistration Guide • May 2011 4. Fill out the information on the page to create your backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. ? Save the Zoning Configuration to a Backup File Using the CLI 1. After setting the storage access configuration, change to the /SP/config directory. -> cd /SP/config 2. If you want sensitive data, such as user passwords, SSH keys, certificates, and so forth, to be backed up, you must provide a passphrase. -> set passphrase=passphrase 3. To initiate the Backup operation, enter the command: -> set dump_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename. config Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.Sun Blade Zone Manager 109 Recovering Zoning Configurations ? Recover Zoning Configurations Using the Web Interface You must have previously created a backup Oracle ILOM CMM configuration file that contains the zoning configurations you want to restore. Note – For advanced users or Oracle technicians: The Oracle ILOM CMM configuration backup file is an XML file. If you have multiple Oracle ILOM CMM configuration backup files and the latest version does not have the zoning configurations you need, you have the option of copying the storage assignments section of one file and pasting it into another. For this to work, your storage modules and server blades must be in the same physical slots for the zoning configurations you want to restore. For more information on performing this procedure, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. 1. Open a web browser and log in to the CMM by entering the following URL: http://chassis_sp_ipaddress/ Where chassis_sp_ipaddress is the IP address of your chassis service processor. The Oracle ILOM login page appears. 2. Log in as root. The Oracle ILOM CMM main page is displayed. Description Links Platform Feature Support Recovering Zoning Configurations • “Recover Zoning Configurations Using the Web Interface” on page 109 • “Recover Zoning Configurations Using the CLI” on page 111 • CMM110 Oracle ILOM CMM Admistration Guide • May 2011 3. With CMM selected in the Chassis navigation pane, click the Maintenance tab for the CMM. The CMM maintenance sub-tabs are displayed. 4. Click the Backup/Restore tab. The Configuration Backup/Restore page is displayed.Sun Blade Zone Manager 111 5. Select Restore from the Operation drop-down list. Fill out the information on the page to restore your backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. 6. To initiate the Restore operation, click Run. The Restore operation executes. Note – While the Restore operation is executing, sessions on the Oracle ILOM SP are momentarily suspended. The sessions will resume normal operation once the Restore operation is complete. A Restore operation typically takes two to three minutes to complete. ? Recover Zoning Configurations Using the CLI You must have previously created a backup Oracle ILOM CMM configuration file that contains the zoning configurations you want to restore. Note – For advanced users or Oracle technicians: The Oracle ILOM CMM configuration backup file is an XML file. If you have multiple Oracle ILOM CMM configuration backup files and the latest version does not have the zoning configurations you need, you have the option of copying the storage assignments section of one file and pasting it into another. For this to work, your storage modules and server blades must be in the same physical slots for the zoning configurations you want to restore. For more information on performing this procedure, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. 1. Open a terminal window and establish an SSH connection to the CMM by entering the following command: # ssh -l root cmm_ipaddress Where cmm_ipaddress is the IP address of the CMM. The login prompt is displayed. 2. Log in as root and enter the root password: /hostname/login: root password:xxxxxxxx After you have successfully logged in, the CLI prompt is displayed: ->112 Oracle ILOM CMM Admistration Guide • May 2011 3. Change to the /SP/config directory: -> cd /SP/config 4. To initiate the Restore operation, enter the command: -> set load_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename.co nfig Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the backup file. The Restore operation executes.Sun Blade Zone Manager 113 Resetting the Zoning Configuration ? Reset the Zoning Configuration Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to Storage --> Zoning. If Zoning is enabled, a Reset All button is available on the Zone Manager Settings page. 3. Click the Reset All button to reset the current zoning assignments. Description Links Platform Feature Support Resetting the Zoning Configurations • “Reset the Zoning Configuration Using the Web Interface” on page 113 • “Reset the Zoning Configuration Using the CLI” on page 114 • CMM114 Oracle ILOM CMM Admistration Guide • May 2011 ? Reset the Zoning Configuration Using the CLI 1. Access the Sun Blade Zone Manager using the CMM CLI. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to -/STORAGE/sas_zoning using the following command: -> cd /STORAGE/sas_zoning 3. Reset the current zoning assignments using the following command: -> set reset_access_action=true If the Zone Manager is disabled, you will get the following warning: set: The CMM is not the SAS Zone Manager If you receive this message, enable Zone Manager and re-issue the reset command. Resetting the Zoning Password Note – The zoning password is only required by in-band zoning management applications running on a Host OS. If you use such applications and this password is lost or forgotten, restore the password to the default value (all-zeroes). The Sun Blade Zone Manager must be disabled to reset this password. ? Reset the Zoning Password Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. Description Links Platform Feature Support Resetting the Zoning Password • “Reset the Zoning Password Using the Web Interface” on page 115 • “Reset the Zoning Password Using the CLI” on page 116 • CMMSun Blade Zone Manager 115 2. Navigate to Storage --> Zoning. If Zoning is disabled, a Reset Password button is available on the Zoning page. 3. Click the Reset Password button to reset the password to the default (all zeros). ? Reset the Zoning Password Using the CLI 1. Access the Sun Blade Zone Manager using the CMM CLI. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to -/STORAGE/sas_zoning using the following command: -> cd /STORAGE/sas_zoning 3. Reset the current zoning assignments using the following command: -> set reset_password_action=true The password is set to the default (all zeros).116 Oracle ILOM CMM Admistration Guide • May 2011117 Index B blade SP CLI prompt changing, 23 C CLI accessing and enabling Sun Blade Zone Manager, 76 backing up a storage zoning con?guration, 108 changing the blade SP prompt, 23 enabling Ethernet ports, 21 Ethernet management port CLI using to determine ?rmware version, 29 logging in, 18, 19 recovering a storage zoning con?guration, 111 resetting a storage zoning con?guration, 114 resetting CMM, 46 resetting the zoning password, 116 serial management port CLI using to determine ?rmware version, 29 Sun Blade Zone Manager, 67 updating component ?rmware, 43 using to create Sun Blade Zone Manager chassis storage con?guration, 88 using to update CMM ILOM ?rmware, 33 using to view and modify storage con?guration, 97 CMM Ethernet ports, enabling, 20 connecting to CMM ILOM con?guring static IP address, 9, 11 DHCP, 11 serial connection, 8 D Detailed Setup for Sun Blade Zone Manager, 85 DHCP accessing CMM IP address, 11 E Ethernet ports enabling through CLI, 21 enabling through web interface, 20 F ?rmware determining current CMM version using Ethernet management port CLI, 29 using serial management port CLI, 29 using web interface, 28 downloading, 30 Sun Blade Zone Manager requirements, 71 updating CMM ILOM, 26 using CLI, 33 using web interface, 31 updating component ?rmware, 40 using the CLI, 43 using the web interface, 41 I ILOM CLI interface logging in, 19 ILOM version numbers, xiii initial login to CMM ILOM, 18 IP address assignment editing using the CLI, 11 L logging in to CMM ILOM using CLI, 19 using web interface, 18 M multiple blades assigned to storage device, 99118 Oracle ILOM CMM Admistration Guide • May 2011 O overview of CMM ILOM, 2 Q Quick Setup for Sun Blade Zone Manager, 78, 83 R resetting CMM using CLI, 46 using web interface, 45 S saving a storage access con?guration, 105 static IP address con?guring, 9, 11 storage access con?guration table in Sun Blade Zone Manager, 102 Sun Blade Zone Manager accessing using CLI, 76 accessing using web interface, 72 assigning multiple server blades to a storage device, 99 backing up a zoning con?guration using CLI, 108 using web interface, 107 CLI, 67 creating the chassis storage access con?guration using CLI, 88 using detailed setup, 85 using quick setup, 78, 83 enabling using CLI, 76 enabling using web interface, 72 recovering a zoning con?guration using CLI, 111 using web interface, 109 resetting a zoning con?guration using CLI, 114 using web interface, 113 resetting the zoning password using CLI, 116 using web interface, 115 saving a storage access con?guration, 105 storage access con?guration table, 102 supported hardware and ?rmware con?gurations, 71 supported ILOM interfaces, 64 view and modify storage con?guration using the CLI, 97 using the web interface, 91 T topic guidelines, 1, 5, 25, 47, 63 V version of CMM ILOM, 3 W web interface accessing and enabling Sun Blade Zone Manager, 72 backing up a storage zoning con?guration, 107 enabling Ethernet ports, 20 logging in, 18 recovering a storage zoning con?guration, 109, 113 resetting CMM, 45 resetting the zoning password, 115 updating component ?rmware, 41 using to determine ?rmware version, 28 using to update CMM ILOM ?rmware, 31 using to view and modify storage con?guration, 91 Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration for Sun Blade 6000 and Sun Blade 6048 Modular Systems Part No. E21451-01 May 2011, Revision 01Please Recycle Copyright © 2008, 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2008, 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iv Contents Using This Documentation x ? Download Product Software and Firmware xii Oracle ILOM CMM Overview 1 About the Modular System Chassis 2 Oracle ILOM CMM Function Overview 2 Oracle ILOM Versions 3 Oracle ILOM CMM Documentation 3 About This Document 4 Oracle ILOM CMM Initial Setup 5 Connecting to the Oracle ILOM CMM 6 Before You Begin 6 ? Connect to the Oracle ILOM CMM Using a Serial Connection 8 ? View and Set IPv4 Network Address 9 ? View and Set Dual-Stack IPv4 and IPv6 Network Address 11 ? Test IPv4 or IPv6 Network Configuration 16 Log In to the Oracle ILOM CMM Using a Network Connection 18 ? Log In to Oracle ILOM 3.0 Using the Web Interface 18 ? Log In to Oracle ILOM 3.0 Using the CLI 19 Activating CMM Ethernet Ports 20 ? Enable Ethernet Ports Using the Web Interface 20 ? Enable Ethernet Ports Using the CLI 21v Oracle ILOM CMM Admistration Guide • May 2011 Changing the Blade SP CLI Prompt 23 About the Blade SP CLI Prompt 23 ? Set the Blade SP CLI Prompt 23 ? Reset the Blade SP CLI Prompt to the Default 24 Firmware Update Procedures 25 Updating the Oracle ILOM CMM Firmware 26 Additional Information About Updating the Oracle ILOM CMM Firmware 26 Obtaining the CMM IP Address 27 Determining Your Current Firmware Version 27 ? Determine the Firmware Version Using the Web Interface 28 ? Determine the Firmware Version Using the Management Ethernet Port CLI 29 ? Determine the Firmware Version Using the Serial Management Port CLI 29 Downloading Firmware Files 30 ? Download Firmware Files 30 Updating Oracle ILOM Firmware 31 ? Update Oracle ILOM Firmware Using the Web Interface 31 ? Update Oracle ILOM Firmware Using the CLI 33 Updating the NEM Firmware 34 About NEM Firmware Updates 34 Before You Begin 35 ? Update NEM Firmware Using the CLI 35 ? Update NEM Firmware Using the Web Interface 37 Updating Chassis Component Firmware Using the CMM 40 About Chassis Component Firmware 40 ? Update Firmware Using the Web Interface 41 ? Update Firmware Using the CLI 43Contents vi Resetting the Oracle ILOM CMM 45 ? Reset Oracle ILOM Using the Web Interface 45 ? Reset Oracle ILOM CMM Using the CLI 46 CMM Power Management 47 Light Load Efficiency Mode (LLEM) 48 About LLEM 48 ? Enable or Disable LLEM Using the Web Interface 49 ? Enable or Disable Redundant Mode Using the Web Interface 50 ? Enable or Disable LLEM Using the CLI 50 ? Enable Redundant Mode Using the CLI 51 ? Enable Non-Redundant Mode Using the CLI 51 Force Power Supply Fan Speed 52 About Power Supply Fan Speed 52 ? Set the Power Supply Fan Speed Using the Web Interface 52 ? Set the Power Supply Fan Speed Using the CLI 53 Disabling the Power Management Policy 54 About the Power Management Policy 54 ? Disable Power Management Policy Using the Web Interface 54 ? Disable Power Management Policy Using the CLI 55 Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases 56 Oracle ILOM Behavior With Two Power Cord Configuration 56 ? Configure the CMM for Two Power Cords 56 Oracle ILOM 3.0 Readings for Specific Power Supply States 57 AC Cables Are Disconnected 57 AC Cables Are Disconnected, Then Are Reconnected 58 stop /CH Command 59 start /CH Command 59 One PSU Is Removed 60vii Oracle ILOM CMM Admistration Guide • May 2011 PSU Is Reinserted 60 Sun Blade Zone Manager 63 Introduction to the Sun Blade Zone Manager 64 Supported Oracle ILOM User Interfaces 64 Accessing Zone Manager Using the Web Interface 64 Accessing Zone Manager Using the CLI 67 Zoning Configuration Overview 68 Zoning Commands 68 Assigning Storage to a Server Blade 69 Assigning a Server Blade to Storage 69 Supported Hardware and Firmware Configurations 71 SAS-2 Capable Hardware 71 Additional System Requirements 71 Accessing the Sun Blade Zone Manager 72 ? Access and Enable the Sun Blade Zone Manager Using the Web Interface 72 ? Access and Enable the Sun Blade Zone Manager Using the CLI 76 Creating the Chassis Storage Access Configuration 78 About Creating Chassis Storage Access 78 Creating the Chassis Storage Access Configuration Using Quick Setup 78 Option 1: Assign per Individual Disks 79 Option 2: Assign per Adjacent Individual Disks 80 Option 3: Assign per Storage Blade 81 Option 4: Assign per Adjacent Storage Blade 82 ? Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface 83 Creating the Chassis Storage Access Configuration Using Detailed Setup 85Contents viii ? Use Detailed Setup to Create the Chassis Storage Configuration Using the Web Interface 85 Creating a Chassis Storage Configuration Using the CLI 88 ? Create a Chassis Storage Configuration Using the CLI 88 Viewing or Modifying the Chassis Storage Access Configuration 91 ? View and Modify the Chassis Storage Configuration Using the Web Interface 91 ? View and Modify the Chassis Storage Configuration Using the CLI 97 ? Assign Multiple Server Blades to a Storage Device Using the Web Interface 99 ? View the Storage Access Configuration Table Using the Web Interface 102 Saving the Chassis Storage Access Configuration 105 Important Considerations About Saving the Zoning Configuration 105 Saving a New or Modified Storage Access Configuration 105 Backing Up the Storage Access Configuration 107 ? Save the Zoning Configuration to a Backup File Using the Web Interface 107 ? Save the Zoning Configuration to a Backup File Using the CLI 108 Recovering Zoning Configurations 109 ? Recover Zoning Configurations Using the Web Interface 109 ? Recover Zoning Configurations Using the CLI 111 Resetting the Zoning Configuration 113 ? Reset the Zoning Configuration Using the Web Interface 113 ? Reset the Zoning Configuration Using the CLI 114 Resetting the Zoning Password 115 ? Reset the Zoning Password Using the Web Interface 115 ? Reset the Zoning Password Using the CLI 116 Index 117ix Oracle ILOM CMM Admistration Guide • May 2011x Using This Documentation This administration guide provides Oracle ILOM 3.0 instructions for managing the chassis components in a Sun Blade 6000 or a Sun Blade 6048 Modular System Chassis. System management is provided through the Sun Blade Chassis Monitoring Modules (CMM), which is referred to in this guide as the Oracle ILOM CMM. Use this guide in conjunction with other guides in the Oracle ILOM 3.0 Documentation Library. This guide is written for technicians, system administrators, authorized service providers, and users who have experience managing system hardware. This preface contains the following topics: ¦ “Documentation and Feedback” on page xi ¦ “Product Downloads” on page xii ¦ “Oracle ILOM 3.0 Version Numbers” on page xiii ¦ “Documentation, Support, and Training” on page xivxi Oracle ILOM CMM Admistration Guide • May 2011 Documentation and Feedback You can download the Oracle ILOM 3.0 Documentation Collection at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) You can provide feedback on this documentation at: (http://www.oraclesurveys.com/se.ashx?s=25113745587BE578) Application Title Format Online Documentation Set Oracle Integrated Lights Out Manager (ILOM) 3.0 HTML Documentation Collection HTML Quick Start Oracle Integrated Lights Out Manager (ILOM) 3.0 Quick Start Guide PDF Remote KVMS Oracle Integrated Lights Out Manager (ILOM) 3.0 Remote Redirection Consoles — CLI and Web Guide PDF Daily Management Features Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Concepts Guide PDF Daily Management Web Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — Web Procedures Guide PDF Daily Management CLI Procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Daily Management — CLI Procedures Guide PDF Protocol Management Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocol Management — SNMP, IPMI, CIM, WS-MAN Guide PDF CMM Administration Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular Systems PDF Maintenance and Diagnostics Oracle Integrated Lights Out Manager (ILOM) 3.0 Maintenance and Diagnostics — CLI and Web Guide PDF Late Breaking Information Oracle Integrated Lights Out Manager (ILOM) 3.0 Feature Updates and Release Notes PDFUsing This Documentation xii Product Downloads Updates to the Oracle ILOM 3.0 firmware are available through standalone software updates that you can download from the My Oracle Support (MOS) web site for each Sun server or Sun blade chassis system. To download these software updates from the MOS web site, see the instructions that follow. ? Download Product Software and Firmware 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search). 5. In the Product? Is field, type a full or partial product name, for example Sun Fire X4470, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, and then select the release of interest. 8. In the Patches Search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example Patch 10266805 for the ILOM and BIOS portion of the Sun Fire X4470 SW 1.1 release. 10. In the right pane that appears, click Download.xiii Oracle ILOM CMM Admistration Guide • May 2011 Oracle ILOM 3.0 Version Numbers Oracle ILOM 3.0 has implemented a new version numbering scheme to help you identify which version of Oracle ILOM you are running on your system. The numbering scheme includes a five-field string, for example, a.b.c.d.e, where: ¦ a - Represents the major version of Oracle ILOM. ¦ b - Represents a minor version of Oracle ILOM. ¦ c - Represents the update version of Oracle ILOM. ¦ d - Represents a micro version of Oracle ILOM. Micro versions are managed per platform or group of platforms. See your platform Product Notes for details. ¦ e - Represents a nano version of Oracle ILOM. Nano versions are incremental iterations of a micro version. For example, Oracle ILOM 3.1.2.1.a would designate: ¦ Oracle ILOM 3 as the major version of Oracle ILOM ¦ Oracle ILOM 3.1 as a minor version of Oracle ILOM 3 ¦ Oracle ILOM 3.1.2 as the second update version of Oracle ILOM 3.1 ¦ Oracle ILOM 3.1.2.1 as a micro version of Oracle ILOM 3.1.2 ¦ Oracle ILOM 3.1.2.1.a as a nano version of Oracle ILOM 3.1.2.1 Tip – To identify the Oracle ILOM firmware version installed on your Sun server or CMM, click System Information --> Versions in the web interface, or type version in the command-line interface.Using This Documentation xiv Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com)xv Oracle ILOM CMM Admistration Guide • May 20111 Oracle ILOM CMM Overview Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, managing user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, managing user accounts Description Links Introduction • “About the Modular System Chassis” on page 2 CMM functional overview • “Oracle ILOM CMM Function Overview” on page 2 Oracle ILOM versions • “Oracle ILOM Versions” on page 3 Oracle ILOM CMM documentation • “Oracle ILOM CMM Documentation” on page 3 Topics covered in this guide. • “About This Document” on page 42 Oracle ILOM CMM Admistration Guide • May 2011 About the Modular System Chassis The Sun Blade 6000 Modular System chassis holds up to 10 blades and the Sun Blade 6048 Modular System holds up to 48 blades. Supported blades include Sun Blade server modules and storage modules. Each server module has its own Oracle ILOM service processor (SP) which is separate from the chassis monitoring module (CMM) Oracle ILOM . The Oracle ILOM CMM manages the Sun Blade 6000 and 6048 Modular System chassis. It provides management of chassis components, and a method of accessing the service processors in individual server modules. Users interact with the Oracle ILOM CMM through a command-line interface (CLI) or web interface. Oracle ILOM CMM Function Overview Oracle ILOM on the CMM offers a tiered management architecture that enables system management of individual components or aggregated management of components at the chassis level. A summary of the management functions include: ¦ Implementation of an IPMI satellite controller, making the chassis environmental sensors visible to the server module’s BMC functions ¦ Direct environmental and inventory management using CLI, web, SNMP, and IPMI interfaces ¦ Firmware management of CMM, network express module (NEM), and server module SPs ¦ Pass-through management of server modules and HTTP links along with command-line interface (CLI) SSH contexts ¦ Chassis power control ¦ Access to the following components: ¦ Chassis ¦ Power supplies ¦ Fans ¦ Network express modules (NEMs) ¦ Server module SPsOracle ILOM CMM Overview 3 ¦ Assignment of storage devices from SAS-2 capable storage modules to SAS-2 capable server blades in the chassis, using the Sun Blade Zone Manager. This is only available for the Sun Blade 6000 chassis. Oracle ILOM Versions The Oracle ILOM information in this document refers to 3.x.x versions of Oracle ILOM (Oracle ILOM 3.0.3 and later). For information on Oracle ILOM 2.x, refer to the following documentation: Oracle ILOM 2.0 Documentation Set: (http://docs.sun.com/app/docs/coll/ilom2.0) Oracle ILOM CMM Documentation The following documentation provides information on the functionality and use of the Oracle ILOM CMM : ¦ Oracle Integrated Lights Out Manager (ILOM ) 3.0 Documentation Library: Comprehensive documentation on features and use of Oracle ILOM 3.0 ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration for Sun Blade 6000 and Sun Blade 6048 Modular Systems (this document): Provides information on Oracle ILOM functionality that is specific to the Oracle ILOM CMM . ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Supplement for Sun Blade 6000 and Sun Blade 6048 Modular Systems: Supplementary information specific to the Oracle ILOM 3.x version of the Oracle ILOM CMM . Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation Collection is available at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) Sun Blade 6000 and 6048 modular system documentation is available at: Sun Blade 6000: (http://download.oracle.com/docs/cd/E19938-01/index.html)4 Oracle ILOM CMM Admistration Guide • May 2011 Sun Blade 6048: (http://download.oracle.com/docs/cd/E19926-01/index.html) About This Document This document covers administration tasks specific to the Sun Blade 6000 and 6048 Modular Systems. The topics covered are shown in the following table. Description Chapter Perform initial set up of the Oracle ILOM CMM • “Oracle ILOM CMM Initial Setup” on page 5 Update chassis and component firmware • “Firmware Update Procedures” on page 25 Use Oracle ILOM power management features • “CMM Power Management” on page 47 View or modify the storage zoning configuration • “Sun Blade Zone Manager” on page 635 Oracle ILOM CMM Initial Setup Related Information ¦ Oracle ILOM 3.0 Quick Start, mandatory set up tasks ¦ Oracle ILOM 3.0 Daily Management Concepts, user account management ¦ Oracle ILOM 3.0 Concepts Daily Management CLI Procedures, managing user accounts ¦ Oracle ILOM 3.0 Daily Management Web Procedures, managing user accounts ¦ Oracle ILOM 3.0 Protocol Management Reference, managing user accounts Description Links Connect to the CMM and configure CMM IP address • “Connecting to the Oracle ILOM CMM” on page 6 Log in to the Oracle ILOM CMM for the first time • “Log In to the Oracle ILOM CMM Using a Network Connection” on page 18 Activating CMM Ethernet ports • “Activating CMM Ethernet Ports” on page 20 Change the CLI blade prompt • “Changing the Blade SP CLI Prompt” on page 236 Oracle ILOM CMM Admistration Guide • May 2011 Connecting to the Oracle ILOM CMM Before You Begin To set up the CMM with initial network configuration information, you must establish a connection through Oracle ILOM to the CMM. You can establish a local connection to Oracle ILOM through the serial management port (SER MGT) on the CMM or a remote connection to Oracle ILOM through the network management (NET MGT) port on the CMM (see the following figure). Description Links Platform Feature Support Connecting to the Oracle ILOM CMM • “Before You Begin” on page 6 • “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8 • “View and Set IPv4 Network Address” on page 9 • “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 11 • “Test IPv4 or IPv6 Network Configuration” on page 16 • CMMOracle ILOM CMM Initial Setup 7 FIGURE: Network and serial ports on CMM When you establish a connection to Oracle ILOM through the network management port, Oracle ILOM will, by default, automatically learn the IP address of the CMM using DHCP for IPv4 and stateless for IPv6. If a network management connection has not been established to the NET MGT port on the CMM, Oracle ILOM is unable to learn the IP address of the CMM therefore, you will need to connect to Oracle ILOM through a serial connection. After you have established a connection to Oracle ILOM, you can view and, if necessary, modify the IP address assigned to the CMM. Next Steps: ¦ If you do not know the IP address assigned to the CMM, see “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. - or- ¦ If you do know the IP address assigned to the CMM and you have an established network management connection to the CMM, see one of the following sections to view or modify the CMM IP address. ¦ “View and Set IPv4 Network Address” on page 9 ¦ “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 118 Oracle ILOM CMM Admistration Guide • May 2011 ? Connect to the Oracle ILOM CMM Using a Serial Connection You can access the Oracle ILOM CMM at any time by connecting a terminal or a PC running terminal emulation software to the serial connector on the chassis. 1. Verify that your terminal, laptop, or terminal server is operational. 2. Configure that terminal device or the terminal emulation software to use the following settings: ¦ 8N1: eight data bits, no parity, one stop bit ¦ 9600 baud ¦ Disable software flow control (XON/XOFF) 3. Connect a serial cable from the serial port (SER MGT) on the chassis panel to a terminal device. Note – The serial port requires that the serial cable connected to it use the pin assignments shown in the following table. 4. Press Enter on the terminal device. This establishes the connection between the terminal device and the Oracle ILOM CMM. Pin Signal Description 1 Request To Send (RTS) 2 Data Terminal Ready (DTR) 3 Transmit Data (TXD) 4 Ground 5 Ground 6 Receive Data (RXD) 7 Data Carrier Detect (DCD) 8 Clear To Send (CTS)Oracle ILOM CMM Initial Setup 9 Note – If you connect a terminal or emulator to the serial port before the Oracle ILOM CMM has been powered on or during its power on sequence, you will see boot messages. When the system has booted, the Oracle ILOM CMM displays its login prompt: login: 5. Log in to the CLI: a. Type the default user name, root. b. Type the default password, changeme. When you have successfully logged in, the Oracle ILOM CMM displays the default command prompt: -> The Oracle ILOM CMM is running the CLI. You can now run CLI commands. Next Steps: View or set a Oracle ILOM CMM IP address using one of the following procedures: ¦ “View and Set IPv4 Network Address” on page 9 ¦ “View and Set Dual-Stack IPv4 and IPv6 Network Address” on page 11 ? View and Set IPv4 Network Address 1. Log in to the Oracle ILOM CMM using either a remote SSH connection or a local serial connection. For more information, see one of the following sections: ¦ “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. ¦ “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 2. Type one of the following commands to set the working directory: ¦ For a chassis CMM: cd /CMM/network ¦ For a chassis server blade server module: cd /SP/network 3. Type the show command to view the IP address network properties. 4. To set IPv4 network settings for DHCP or static, perform one of the following:10 Oracle ILOM CMM Admistration Guide • May 2011 ¦ To configure DHCP IPv4 network settings, set values for the following properties: ¦ To configure static IPv4 network settings, set values for the following properties: Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=dhcp The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the state and ipdiscovery property values. Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=static To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4. pendingipaddress pendingipnetmask pendingipgateway set pendingipaddress= pendingipnetmask= pendingipgateway= To assign multiple static network settings, type the set command followed by the pending command for the each property value (IP address, netmask, and gateway), then type the static value that you want to assign. commitpending= set commitpending=true Type set commitpending=true to commit the changes madeto the IPv4 network properties.Oracle ILOM CMM Initial Setup 11 Note – If you connected to Oracle ILOM through a remote SSH connection, the connection made to Oracle ILOM using the former IP address will time-out. Use the newly assigned settings to connect to Oracle ILOM. 5. Test the IPv4 network configuration from Oracle ILOM use the Network Test Tools (Ping). For details, see “Test IPv4 or IPv6 Network Configuration” on page 16 ? View and Set Dual-Stack IPv4 and IPv6 Network Address Note – This procedure provides instructions for configuring Oracle ILOM to operate in a dual-stack IPv4 and IPv6 network environment. Dual-stack IPv4 and IPv6 network settings are only in Oracle ILOM for the A90-D model chassis. For more information about dual-stack IPv4 and IPv6 support in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide. 1. Log in to the Oracle ILOM CMM using either a remote SSH connection or a local serial connection. For more information, see one of the following sections: ¦ “Connect to the Oracle ILOM CMM Using a Serial Connection” on page 8. ¦ “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 2. Perform the network configuration instructions that apply to your network environment: ¦ To configure IPv4 network settings, perform Step 3 to Step 5 in this procedure. ¦ To configure IPv6 network settings, perform Step 6 to Step 10 in this procedure. 3. For IPv4 network configurations, use the cd command to navigate to the /x/network working directory for the device. For example: ¦ For a chassis CMM type: cd /CMM/network ¦ For a chassis blade server SP type: cd /CH/BLn/network ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network 4. Type the show command to view the configured IPv4 network settings configured on the device. 5. To set IPv4 network settings for DHCP or static, perform one of the following:12 Oracle ILOM CMM Admistration Guide • May 2011 ¦ To configure DHCP IPv4 network settings, set values for the following properties: ¦ To configure static IPv4 network settings, set values for the following properties: Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the DHCP network option for IPv4 the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=dhcp The property value for ipdiscovery is set to dhcp by default for IPv4. Note - If the dhcp default property value was changed to static, you will need to set the property value to dhcp. commitpending= set commitpending=true Type set commitpending=true to commit the changes made to the state and ipdiscovery property values. Property Set Property Value Description state set state=enabled The network state is enabled by default for IPv4. Note - To enable the static IPv4 network option the state must be set to enabled. pendingipdiscovery set pendingipdiscovery=static To enable a static IPv4 network configuration, you need to set the pendingipdiscovery property value to static. Note - The property value for ipdiscovery is set to dhcp by default for IPv4. pendingipaddress pendingipnetmask pendingipgateway set pendingipaddress= pendingipnetmask= pendingipgateway= To assign multiple static network settings, type the set command followed by the pending command for the each property value (IP address, netmask, and gateway), then type the static value that you want to assign. commitpending= set commitpending=true Type set commitpending=true to commit the changes madeto the IPv4 network properties.Oracle ILOM CMM Initial Setup 13 6. For IPv6 network configurations, use the cd command to navigate to the /x/network/ipv6 working directory for the device. For example: ¦ For a chassis CMM type: cd /CMM/network/ipv6 ¦ For a chassis blade server SP type: cd /CH/BLn/network/ipv6 ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/ipv6 7. Type the show command to view the configured IPv6 network settings configured on the device. For example, see the following sample output values for the IPv6 properties on a server SP device. Note – When the autoconfig= property is set to dhcpv6_stateful or dhcpv6_stateless, the read-only property for dhcpv6_server_duid will identify the DHCP Unique ID of the DHCPv6 server that was last used by Oracle ILOM to retrieve the DHCP information. Note – The default IPv6 autoconfig property value provided in Oracle ILOM 3.0.14 (and later) is autoconfig=stateless. However, if you have Oracle ILOM 3.0.12 installed on your CMM or server module, the default property value for autoconfig appears as autoconfig=stateless_only. -> show /SP/network/ipv6 Targets: Properties: state = enabled autoconfig = stateless dhcpv6_server_duid = (none) link_local_ipaddress = fe80::214:4fff:feca:5f7e/64 static_ipaddress = ::/128 ipgateway = fe80::211:5dff:febe:5000/128 pending_static_ipaddress = ::/128 dynamic_ipaddress_1 = fec0:a:8:b7:214:4fff:feca:5f7e/64 Commands: cd show14 Oracle ILOM CMM Admistration Guide • May 2011 8. To configure an IPv6 auto-configuration option, use the set command to specify the following auto-configuration property values. Note – The IPv6 configuration options take affect after they are set. You do not need to commit these changes under the /network target. Note – IPv6 auto-configuration addresses learned for the device will not affect any of the active Oracle ILOM sessions to the device. You can verify the newly learned auto-configured addresses under the /network/ipv6 target. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. To enable an IPv6 auto-configuration option this state must be set to enabled. autoconfig set autoconfig= Specify this command followed by the autoconf value you want to set. Options include: • stateless (default setting provided in Oracle ILOM 3.0.14 or later) or stateless_only (default setting provided in Oracle ILOM 3.0.12) Automatically assigns IP address learned from the IPv6 network router. • dhcpv6_stateless Automatically assigns DNS information learned from the DHCP server. The dhcpv6_stateless property value is available in Oracle ILOM as of 3.0.14. • dhcpv6_stateful Automatically assigns the IPv6 address learned from the DHCPv6 server. The dhcpv6_stateful property value is available in Oracle ILOM as of 3.0.14. • disable Disables all auto-configuration property values and sets the read-only property value for link local address.Oracle ILOM CMM Initial Setup 15 Note – As of Oracle ILOM 3.0.14 or later, you can enable the stateless auto-configuration option to run at the same time as when the option for dhcpv6_stateless is enabled or as when the option for dhcpv6_stateful is enabled. However, the auto-configuration options for dhcpv6_stateless and dhcpv6_stateful should not be enabled to run at the same time. 9. Perform the following steps to set a static IPv6 address: a. To set a pending static IPv6 address, specify the following property values b. To commit (save) the pending IPv6 static network parameters, perform the steps in the following table: Note – Assigning a new static IP address to the device (SP or CMM) will end all active Oracle ILOM sessions to the device. To log back in to Oracle ILOM, you will need to create a new browser session using the newly assigned IP address. 10. To test the IPv4 or IPv6 network configuration from Oracle ILOM use the Network Test Tools (Ping and Ping6). For details, see “Test IPv4 or IPv6 Network Configuration” on page 16. Property Set Property Value Description state set state=enabled The IPv6 network state is enabled by default. To enable a static IP address this state must be set to enabled. pendingipaddress set pending_static_ipaddress= / Type this command followed by the property value for the static IPv6 address and net mask that you want to assign to the device. IPv6 address example: fec0:a:8:b7:214:4fff:feca:5f7e/64 Step Description 1 Use the cd command to change the directory to the device network target. For example: • For chassis CMM type: cd /CMM/network • For chassis blade server SP type: cd /CH/BLn/network • For chassis blade server SP with multiple nodes type: cd /CH/BLn/Noden/network 2 Type the following command to commit the changed property values for IPv6: set commitpending=true16 Oracle ILOM CMM Admistration Guide • May 2011 ? Test IPv4 or IPv6 Network Configuration 1. Log in to the Oracle ILOM SP CLI or the CMM CLI. Establish a local serial console connection or SSH connection to the server SP or CMM 2. Use the cd command to navigate to the /x/network/test working directory for the device, for example: ¦ For a chassis CMM type: cd /CMM/network/test ¦ For a chassis blade server SP type: cd /CH/BLn/network/test ¦ For a chassis blade server with multiple SP nodes type: cd /CH/BLn/Noden/network/test 3. Type the show command to view the network test targets and properties. For example, see the following output the shows the test target properties on a CMM device. -> show /CMM/network/test Targets: Properties: ping = (Cannot show property) ping6 = (Cannot show property) Commands: cd set showOracle ILOM CMM Initial Setup 17 4. Use the set ping or set ping6 command to send a network test from the device to a specified network destination. Next Steps: ¦ If you have not already used the network management connection to log in to Oracle ILOM, see “Log In to the Oracle ILOM CMM Using a Network Connection” on page 18. ¦ Perform CMM administration tasks as described in this document or the Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation Collection Property Set Property Value Description ping set ping= Type the set ping= command at the command prompt followed by the IPv4 test destination address. For example: -> set ping=10.8.183.106 Ping of 10.8.183.106 succeeded ping6 set ping6= Type the set ping6= command followed by the IPv6 test destination address. For example: -> set ping6=fe80::211:5dff:febe:5000 Ping of fe80::211:5dff:febe:5000 succeeded18 Oracle ILOM CMM Admistration Guide • May 2011 Log In to the Oracle ILOM CMM Using a Network Connection Note – For further information on setting up Oracle ILOM, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide. ? Log In to Oracle ILOM 3.0 Using the Web Interface Follow these steps to log in to the Oracle ILOM web interface for the first time using the root user account: 1. Connect an Ethernet cable to the NET0 Ethernet port. 2. Type http://system_ipaddress into a web browser. The web interface Login page appears. Description Links Platform Feature Support Log in to Oracle ILOM CMM using a network connection • “Log In to Oracle ILOM 3.0 Using the Web Interface” on page 18 • “Log In to Oracle ILOM 3.0 Using the CLI” on page 19 • CMMOracle ILOM CMM Initial Setup 19 3. Type the user name and password for the root user account: User Name: root Password: changeme 4. Click Log In. The Version page in the web interface appears. ? Log In to Oracle ILOM 3.0 Using the CLI To log in to the Oracle ILOM CLI for the first time, use SSH and the root user account. 1. Connect an Ethernet cable to the NET0 Ethernet port. 2. To log in to the Oracle ILOM CLI using the root user account, type: $ ssh root@system_ipaddress Password: changeme The Oracle ILOM CLI prompt appears (->).20 Oracle ILOM CMM Admistration Guide • May 2011 Activating CMM Ethernet Ports Note – By default, Ethernet port 0 is enabled on the CMM. You can enable port 1 or enable both ports through the CLI or the web interface. Caution – You can cause Ethernet networking problems and bring down the external network if you activate both Ethernet ports on the CMM. Before you activate both ports, ensure that the external switch supports trunk mode. The upstream Ethernet switch needs to be configured correctly, so that no Ethernet traffic loop is created. This is done usually by the spanning tree algorithm. ? Enable Ethernet Ports Using the Web Interface To enable an Ethernet port using the web interface: 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the left panel. 3. Navigate to Configuration --> Network. Description Links Platform Feature Support Activating CMM Ethernet ports • “Enable Ethernet Ports Using the Web Interface” on page 20 • “Enable Ethernet Ports Using the CLI” on page 21 • CMMOracle ILOM CMM Initial Setup 21 4. In the CMM Management Network Switch drop-down list, select one of the following: ¦ Port 0 Active: To activate port 0 only ¦ Port 1 Active: To activate port 1 only ¦ Trunking (Link Aggregation) to activate both ports 5. Click Save. 6. Remove the CMM and reinstall it into the chassis. See the chassis Service Manual for instructions on removing and replacing the CMM in the chassis. The active port is now updated. ? Enable Ethernet Ports Using the CLI To enable port 1 using the CLI: 1. Log in to the Oracle ILOM CLI. 2. Type: -> cd /CMM/network22 Oracle ILOM CMM Admistration Guide • May 2011 3. Type show to view the -switchconf variable setting. For example: In this example, the -switchconf variable is set to port 0. ¦ To activate port 1 and disable port 0, type: set switchconf=port1 ¦ To activate port 1 and keep port 0 active, type: set switchconf=trunk 4. Remove the CMM and reinstall it into the chassis. See the chassis Service Manual for instructions on removing and replacing the CMM in the chassis. The active port is now NET MGT port 1 or both NET MGT ports. -> show /CMM/network Targets: Properties: commitpending = (Cannot show property) ipaddress = 10.6.153.71 ipdiscovery = dhcp ipgateway = 10.6.152.1 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:6B:6F:C1 pendingipaddress = 10.6.153.71 pendingipdiscovery = dhcp pendingipgateway = 10.6.152.1 pendingipnetmask = 255.255.252.0 switchconf = port0 Commands: cd set showOracle ILOM CMM Initial Setup 23 Changing the Blade SP CLI Prompt About the Blade SP CLI Prompt Starting with CMM software 3.2 (Oracle ILOM 3.0.10), you can change the default CLI prompt for a server blade SP through the CMM. This prompt is used when you execute the following command to navigate to a server blade SP from the CMM: -> start /CH/BLn/SP/cli Instead of seeing the -> prompt, you will see one of the following default prompts: ¦ [BLn/SP] -> for single node blades ¦ [BLn/NODEn/SP] -> for blades with multiple nodes Note – A node is an independent computer that resides on the server blade. The Sun Blade X6275 server module is an example of a blade with two nodes per blade. This feature requires that the server blade SP is running Oracle ILOM 3.0.9 or later. ? Set the Blade SP CLI Prompt 1. Log in to the Oracle ILOM CLI. 2. Use one of the following commands to change the server blade default CLI prompt: ¦ For single-node blades: set /CH/BLn/SP/cli prompt="newprompt" Description Links Platform Feature Support Changing the blade SP CLI prompt • “About the Blade SP CLI Prompt” on page 23 • “Set the Blade SP CLI Prompt” on page 23 • “Reset the Blade SP CLI Prompt to the Default” on page 24 • CMM24 Oracle ILOM CMM Admistration Guide • May 2011 ¦ For two-node blades: set /CH/BLn/NODEn/SP/cli prompt="newprompt" Where newprompt is the value that you want to set for the new prompt. For example, if you want to set the blade SP prompt to “blade SP”, on BL0, you would use the following command: -> set /CH/BL0/SP/cli prompt="blade SP" ? Reset the Blade SP CLI Prompt to the Default ? If you have changed the blade SP CLI prompt from the default, and want to return to the default, use the following command: -> set /CH/BLn/SP/cli prompt=""25 Firmware Update Procedures Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, firmware management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, firmware updates ¦ Oracle ILOM 3.0 Daily Management Web Procedures, firmware updates ¦ Oracle ILOM 3.0 Protocols Management Reference, firmware updates Description Links Update the Oracle ILOM CMM firmware • “Updating the Oracle ILOM CMM Firmware” on page 26 Update the NEM firmware • “Updating the NEM Firmware” on page 34 Update chassis component firmware • “Updating Chassis Component Firmware Using the CMM” on page 40 Reset the power on the Oracle ILOM CMM • “Resetting the Oracle ILOM CMM” on page 4526 Oracle ILOM CMM Admistration Guide • May 2011 Updating the Oracle ILOM CMM Firmware Additional Information About Updating the Oracle ILOM CMM Firmware This information is covered in more detail in the Oracle ILOM 3.0 Documentation Library at: (http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepage) Use the following sections, in order: Description Links Platform Feature Support Updating the Oracle ILOM CMM firmware • “Additional Information About Updating the Oracle ILOM CMM Firmware” on page 26 • “Obtaining the CMM IP Address” on page 27 • “Determining Your Current Firmware Version” on page 27 • “Determine the Firmware Version Using the Web Interface” on page 28 • “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29 • “Download Firmware Files” on page 30 • “Update Oracle ILOM Firmware Using the Web Interface” on page 31 • “Update Oracle ILOM Firmware Using the CLI” on page 33 • CMMFirmware Update Procedures 27 1. Obtain the IP address of the CMM. See “Obtaining the CMM IP Address” on page 27. 2. Log on to the CMM to check the versions of firmware you have. See “Determining Your Current Firmware Version” on page 27. 3. Use Oracle ILOM to download the new versions of firmware. See “Downloading Firmware Files” on page 30. 4. Use Oracle ILOM to install the new firmware. See “Updating Oracle ILOM Firmware” on page 31. 5. Reset the CMM. See “Resetting the Oracle ILOM CMM” on page 45. Note – For information on backing up and restoring the Oracle ILOM configuration, refer to the Oracle ILOM 3.0 Daily Management Web Procedures or the Oracle ILOM 3.0 Daily Management CLI Procedures. Obtaining the CMM IP Address You must use the CMM IP address to access the Oracle ILOM CMM. If you do not already know the CMM IP address, you must determine it. Refer to“Before You Begin” on page 6 for instructions on how to determine the IP address of the CMM. Determining Your Current Firmware Version Three procedures are provided in this section for determining your current firmware version: ¦ “Determine the Firmware Version Using the Web Interface” on page 28 ¦ “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29 ¦ “Determine the Firmware Version Using the Serial Management Port CLI” on page 2928 Oracle ILOM CMM Admistration Guide • May 2011 ? Determine the Firmware Version Using the Web Interface 1. Connect to the Oracle ILOM web interface by entering the IP address of the server’s CMM in your browser’s address field. For example: https://129.146.53.150 2. Log in to the Oracle ILOM web interface. 3. Click on the CMM in the left corner of the chassis navigation pane. 4. Navigate to System Information --> Versions. The Versions page is displayed, which includes the firmware version and build number.Firmware Update Procedures 29 ? Determine the Firmware Version Using the Management Ethernet Port CLI See the Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide for more detailed information on this procedure. 1. Log in to the Oracle ILOM CLI. 2. Type the version command, which returns output similar to the following: -> version CMM firmware 3.0.10.15 CMM firmware build number: 55335 CMM firmware date: Thu Apr 22 19:41:07 EDT 2010 CMM filesystem version: 0.1.22 The Oracle ILOM (CMM) firmware version and build number are listed in the output. ? Determine the Firmware Version Using the Serial Management Port CLI 1. Configure your terminal device or the terminal emulation software running on a laptop or PC to the following settings: ¦ 8N1: eight data bits, no parity, one stop bit ¦ 9600 baud ¦ Disable hardware flow control (CTS/RTS) ¦ Disable software flow control (XON/XOFF)30 Oracle ILOM CMM Admistration Guide • May 2011 2. Connect a serial cable from the RJ-45 SER MGT port on the CMM to your terminal device or PC. 3. Press Enter on the terminal device to establish a connection between that terminal device and the CMM. The CMM displays a login prompt. login: Where hostname could be SUNCMM followed by the product serial number, or if you have enabled hostnames in DHCP, it will be the assigned host name. 4. Log in to the Oracle ILOM CMM and type the default user name (root) with the default password (changeme). After you have successfully logged in, the CMM displays its default command prompt: -> 5. Type the version command, which returns output similar to the following: -> version CMM firmware version: 3.0.3.32 CMM firmware build number: 42331 CMM firmware date: Wed Feb 18 11:46:55 PST 2009 CMM filesystem version: 0.1.22 The Oracle ILOM firmware version and build number are listed in the output. Downloading Firmware Files The following procedure explains how to download the Oracle ILOM firmware from the web. ? Download Firmware Files Download the flash image .ima file using these steps: 1. Go to (http://support.oracle.com). 2. Sign in to My Oracle Support. 3. At the top of the page, click the Patches and Updates tab. 4. In the Patches Search box, select Product or Family (Advanced Search).Firmware Update Procedures 31 5. In the Product? Is text field, type a full or partial product name, for example Sun Fire X6275, until a list of matches appears, and then select the product of interest. 6. In the Release? Is list box, click the Down arrow. 7. In the window that appears, click the triangle (>) by the product folder icon to display the choices, and then select the release of interest. 8. In the Patches search box, click Search. A list of product downloads (listed as patches) appears. 9. Select the patch name of interest, for example:. ¦ Patch 10266805 for the Oracle ILOM and BIOS portion of the Sun Blade X6275 M@ SW 1.1 release. ¦ Patch 10266804 for the Oracle ILOM portion of the Sun Blade 6000 CMM SW 1.1 release ¦ Patch 10266803 for the Sun Blade 6000 NEM SW 1.1 release 10. In the right pane that appears, click Download. Updating Oracle ILOM Firmware Caution – Oracle ILOM enters a special mode to load new firmware. No other tasks can be performed in Oracle ILOM until the firmware upgrade is complete and the Oracle ILOM is reset. This is the procedure that actually updates the firmware, replacing the existing images with the new images from the .ima file you downloaded previously. This section describes two methods of updating the Oracle ILOM /BIOS firmware: ¦ “Update Oracle ILOM Firmware Using the Web Interface” on page 31 ¦ “Update Oracle ILOM Firmware Using the CLI” on page 33 ? Update Oracle ILOM Firmware Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Navigate to Maintenance --> Firmware Upgrade.32 Oracle ILOM CMM Admistration Guide • May 2011 3. Click the Enter Upgrade Mode button. An Upgrade Verification dialog appears, indicating that other users who are logged in will lose their session when the update process completes. 4. In the Upgrade verification dialog, click OK to continue. The Firmware Upgrade page appears. 5. Browse for the flash image file. 6. Click the Upload button. Wait for the file to upload and validate. The Firmware Verification page appears. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. 7. (Optional) In the Firmware Verification page, enable the Preserve Configuration. Enable this option if you want to save your existing configuration in Oracle ILOM and restore that existing configuration after the update process completes. 8. Click Start Upgrade to start the upgrade process or click Exit to cancel the process. When you click Start Upgrade the upload process will start and a prompt to continue the process appears.Firmware Update Procedures 33 9. At the prompt, click OK to continue. The Update Status page appears providing details about the update progress. When the update indicates 100%, the firmware update is complete. When the update completes, the system automatically reboots. Note – The Oracle ILOM web interface might not refresh properly after the update completes. If the Oracle ILOM web is missing information or displays an error message, you might be viewing a cached version of the page from the version previous to the update. Clear your browser cache and refresh your browser before continuing. 10. Reconnect to the Oracle ILOM CMM web interface. 11. Navigate to System Information --> Version to verify that the firmware version on the CMM corresponds to the firmware image you installed. Note – If you did not preserve the Oracle ILOM configuration before the firmware update, you will need to perform the initial Oracle ILOM setup procedures to reconnect to Oracle ILOM. ? Update Oracle ILOM Firmware Using the CLI 1. Log in to the Oracle ILOM CLI through the Management Ethernet port or the Serial Management port. For the Management Ethernet port: See “Determine the Firmware Version Using the Management Ethernet Port CLI” on page 29. For the Serial Management Port: See“Determine the Firmware Version Using the Serial Management Port CLI” on page 29. 2. From the Oracle ILOM CLI, use the following command: -> load -source tftp://tftpserver/ILOM-version-Sun_Blade_60x0.ima Where tftpserver is the trivial file-transfer protocol (TFTP) server that contains the update and ILOM-version-Sun_Blade_60x0.ima is the firmware image file, for example: For Sun Blade 6000: ILOM-3_0_10_15-Sun_Blade_6000.ima or For Sun Blade 6048: ILOM-3_0_10_15-Sun_Blade_6048.ima34 Oracle ILOM CMM Admistration Guide • May 2011 Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. Updating the NEM Firmware About NEM Firmware Updates As of Oracle ILOM 3.0.9, the update firmware capability in Oracle ILOM was enhanced on some Oracle modular chassis systems to support firmware updates for Network Express Modules (NEMs). Prior to Oracle ILOM 3.0.9, NEM firmware updates were not supported from Oracle ILOM. You can perform a NEM firmware update directly from the Oracle ILOM CLI or web interface. Supported file transfer methods for uploading the firmware package to the NEM include: TFTP, HTTPS, FTP, SFTP, SCP, HTTP, and browser-based. Note – The browser-based local file transfer option is only available from the Oracle ILOM web interface. Before You Begin ¦ From the NEM’s vendor product download web site, download the NEM firmware update package to a system on your network where you can later gain access to it from Oracle ILOM. Description Links Platform Feature Support Updating the Oracle ILOM CMM firmware • “About NEM Firmware Updates” on page 34 • “Before You Begin” on page 35 • “Update NEM Firmware Using the CLI” on page 35 • “Update NEM Firmware Using the Web Interface” on page 37 • CMMFirmware Update Procedures 35 ¦ To update the NEM firmware in Oracle ILOM, you need the Admin (a) role enabled. ? Update NEM Firmware Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Use the cd command to navigate to the NEM requiring the firmware update. For example: cd /CH/NEM# Where # is the slot location where the NEM is installed in the chassis. If your chassis system does not support multiple NEMs and one NEM is supported, the NEM location would equal 0. For this example, you would type: cd /CH/NEM0 3. Type the show command to view the NEM properties and the firmware version presently installed on the NEM. For example, see the NEM show property output below for the Sun Blade 6000 Virtualized Multi-Fabric 10GE NEM M2. Note – The fru_extra_1= property field identifies the firmware version presently installed on the NEM. -> show /CH/NEM0 /CH/NEM0 Targets: MB SAS SP PRSNT STATE ERR OK SERVICE OK2RM LOCATE Properties: type = Network Express Module ipmi_name = NEM0 system_identifier = SUNSP-000000000036 Oracle ILOM CMM Admistration Guide • May 2011 4. Use the load command to upload and install the firmware update package on the NEM. For example, you would type: load_uri=uri Where uri equals the URI transfer method and location of the firmware package. See the following CLI load examples for each supported file transfer method Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. Where: ¦ password is the login password to the system where the file is stored. fru_name = SUN BLADE 6000 VIRTUALIZED MULTI-FABRIC 10GE NEM M2 fru_version = FW 3.0.10.16, SAS 5.3.4.0 fru_part_number = 540-7961-02 fru_extra_1 = FW 3.0.10.16, SAS 5.3.4.0 fault_state = OK load_uri = (none) clear_fault_action = (none) prepare_to_remove_status = NotReady prepare_to_remove_action = (none) return_to_service_action = (none) Commands: cd load reset set show Transfer Method CLI load Command Examples TFTP load_uri=tftp://ip_address/rom_nem.pkg FTP load_uri=ftp://username:password@ip_address/rom_nem.pkg SCP load_uri=scp://username:password@ip_address/rom_nem.pkg HTTP load_uri=http://username:password@ip_address/rom_nem.pkg HTTPS load_uri=https://username:password@ip_address/rom_nem.pkg SFTP load_uri=sftp://username:password@ip_address/rom_nem.pkgFirmware Update Procedures 37 ¦ username is the login user name to the system where the file is stored. ¦ rom_nem.pkg is the name of the firmware update package. ¦ ip_address is the IP address of the system where the file is stored. The user name and password for HTTP and HTTPS are optional. Note – Alternatively, you can use the set and load commands in the Oracle ILOM CLI to specify the path of the NEM location, as well as the location of the firmware update package to upload. For example: set /CH/NEM#/load_uri=uri 5. Wait a few moments for Oracle ILOM to confirm the completion of the firmware update process. A success or failure status appears. 6. Use the show command to view and confirm the firmware version that is installed on the NEM. ? Update NEM Firmware Using the Web Interface 1. Log in to the Oracle ILOM CMM web interface. 2. In the Oracle ILOM web interface, click CMM from the left pane. 3. Click the System Information --> Components tab. The Components page appears. 4. In the Component Status table, do the following: a. Select the radio button for the NEM that you want to update.38 Oracle ILOM CMM Admistration Guide • May 2011 b. Click the NEM name appearing in the Component Name column to view the firmware version presently installed on the NEM, then click Close to dismiss the dialog. c. In the Actions drop-down list box, select Update Firmware to initiate the firmware update process for the NEM. The Upload Firmware dialog appears. 5. In the Upload Firmware dialog, do the following: a. Select the Upload Transfer Method from the drop-down list box. b. Specify the required fields for the selected transfer method as follows:Firmware Update Procedures 39 Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, or SFTP. 6. Wait a few moments for Oracle ILOM to confirm the completion of the firmware update process. A success or failure status appears in the Upload Firmware dialog. Transfer Method Option Required Field Instructions Browser Select File Use the Browse button to specify the location of the NEM firmware update package. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Host Specify the IP address of the host system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Filepath Specify the complete path to where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Username Specify the login user name to the system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Password Specify the login password to the system where the NEM firmware update package is stored.40 Oracle ILOM CMM Admistration Guide • May 2011 Updating Chassis Component Firmware Using the CMM About Chassis Component Firmware As of Oracle ILOM 3.0.10, the Oracle ILOM CMM offers a centralized user interface for viewing the firmware version installed and initiating firmware updates on the following chassis components: ¦ Storage blades ¦ CPU blades ¦ Network Express Modules (NEMs): Not all NEMs have firmware. Check your NEM documentation to determine NEM firmware availability. For a detailed procedure for updating NEM firmware, see “Updating the NEM Firmware” on page 34. You must have Oracle ILOM CMM version 3.0.10 (available on the Oracle download site with Sun Blade 6000 Modular System Software release 3.2) installed on the CMM before using this firmware update tool. Server modules (blades) must be running Oracle ILOM 2.x or later. ? Update Firmware Using the Web Interface 1. Download the firmware that you need from the Oracle software download site: (http://www.oracle.com/us/products/servers-storage/servers/bla des/index.html) a. Search the page for the blade or NEM that you want to update. Description Links Platform Feature Support Updating the Chassis component firmware • “About Chassis Component Firmware” on page 40 • “Update Firmware Using the Web Interface” on page 41 • “Update Firmware Using the CLI” on page 43 • CMM • NEM • Sun blade serverFirmware Update Procedures 41 b. Download the latest firmware package and extract it to an accessible folder on the network. 2. Log in to the Oracle ILOM CMM as any user with Administrator privileges. 3. In the Chassis navigation pane, click on CMM. 4. Select System Information --> Components. 5. Select the component for which you want to upgrade the firmware. For example: -/CH/BL0. 6. Select Update Firmware from the Actions drop-down menu. A dialog box appears.42 Oracle ILOM CMM Admistration Guide • May 2011 7. Fill in the required fields for the selected transfer method. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. 8. Click Update. The firmware update process can take several minutes. A success or failure status appears in the Upload Firmware dialog. ? Update Firmware Using the CLI 1. Download the firmware that you need from the Oracle software download site: (http://www.oracle.com/us/products/servers-storage/servers/bla des/index.html) 2. Search the page for the blade or NEM that you want to update. 3. Download the latest firmware package and extract it to an accessible folder on the network. Transfer Method Option Required Field Instructions Browser Select File Use the Browse button to specify the location of the NEM firmware update package. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Host Specify the IP address of the host system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, TFTP, SFTP Filepath Specify the complete path where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Username Specify the login user name to the system where the NEM firmware update package is stored. FTP, SCP, HTTP, HTTPS, SFTP Password Specify the login password to the system where the NEM firmware update package is stored.Firmware Update Procedures 43 4. From a network connected terminal, log in to the Oracle ILOM CMM CLI using the root user account by entering the following command: $ ssh root@cmm_ipaddress Where cmm_ipaddress is the IP address of the Oracle ILOM CMM. 5. Enter the password (the default is changeme). The Oracle ILOM CLI prompt appears: -> 6. Change directories to the blade slot containing the blade or NEM to be upgraded: -> cd /CH/BLn or -> cd /CH/NEMn Where BLn is the chassis blade slot number of the blade to be upgraded and NEMn is the NEM to be upgraded. 7. Enter the following command: -> load -source transfer_method://transfer_server_ipaddress/firmware-version.pkg Where ¦ transfer_method is one of the following: FTP, SCP, HTTP, HTTPS, TFTP, SFTP ¦ transfer_server_ipaddress is the domain name or IP address of your transfer server where you copied the image file ¦ firmware-version is the name of the .pkg file. Note – Recommended file transfer protocols to use for uploading the firmware image are: HTTP, FTP, and SFTP. 8. When the process completes, ensure that the proper firmware version was installed. Enter the following command: -> version /CH/BLn or -> version /CH/NEMn Where BLn is the chassis slot number of the blade that was upgraded and NEMn is the NEM that was upgraded.44 Oracle ILOM CMM Admistration Guide • May 2011 Resetting the Oracle ILOM CMM Note – If neither of the Oracle ILOM procedures in this section are available, you can remove the CMM from the chassis and reinstall it to reset the power on the CMM. Note – Refer to the Sun Blade 6000 Modular System Service Manual or the Sun Blade 6048 Modular System Service Manual for information on how to remove and install the CMM. ? Reset Oracle ILOM Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Navigate to Maintenance --> Reset Components. 3. Select /CH/CMM, then click Reset. Description Links Platform Feature Support Resetting power to the CMM • “Reset Oracle ILOM Using the Web Interface” on page 45 • “Reset Oracle ILOM CMM Using the CLI” on page 46 • CMMFirmware Update Procedures 45 ? Reset Oracle ILOM CMM Using the CLI 1. Log in to the Oracle ILOM CLI. 2. From the Oracle ILOM CLI, type the following command: -> reset /CMM46 Oracle ILOM CMM Admistration Guide • May 201147 CMM Power Management Related Information ¦ Oracle ILOM 3.0 Daily Management Concepts, power management ¦ Oracle ILOM 3.0 Daily Management CLI Procedures, power management ¦ Oracle ILOM 3.0 Daily Management Web Procedures, power management ¦ Oracle ILOM 3.0 Protocol Management Reference, manage system power Description Links Enable or disable Light Load Efficiency Mode (LLEM) • “Light Load Efficiency Mode (LLEM)” on page 48 Force power supply fans to low speed • “Force Power Supply Fan Speed” on page 52 Disable the power management • “Disabling the Power Management Policy” on page 54 Learn about Oracle ILOM readings for Specific Sun Blade 6048 Modular System Cases • “Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases” on page 5648 Oracle ILOM CMM Admistration Guide • May 2011 Light Load Efficiency Mode (LLEM) About LLEM The Light Load Efficiency Mode (LLEM) is a new feature of Oracle ILOM CMM 3.0.6.11. Under the LLEM, the CMM monitors the power being used and automatically shuts down the power supply unit (PSU) sides to achieve higher efficiency. While enabled, LLEM runs in both redundant and non-redundant mode. The CMM always disables PSU sides in descending order. When the power load level increases, the CMM renewably those disabled sides to cover the demand. If a new blade is inserted into the chassis, it can be powered on even if its power budget exceeds the power available from the sides currently turned on. When an unexpected AC fault occurs, LLEM is suspended and all sides will become enabled, verified by the sensor value of I_V12 and V_OUT_OK. If the fault is cleared, configured LLEM policy automatically goes back into effect. When the LLEM is disabled, all PSU sides, including those previously disabled, become enabled. This can be verified by the sensor value of I_V12 and V_OUT_OK. For further information on Oracle ILOM power management features, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide. Description Links Platform Feature Support Light Load Efficiency Mode • “About LLEM” on page 48 • “Enable or Disable LLEM Using the Web Interface” on page 49 • “Enable or Disable Redundant Mode Using the Web Interface” on page 50 • “Enable or Disable LLEM Using the CLI” on page 50 • “Enable Redundant Mode Using the CLI” on page 51 • “Enable Redundant Mode Using the CLI” on page 51 • CMMCMM Power Management 49 ? Enable or Disable LLEM Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Configuration --> Policy page. 4. Select Light Load Efficiency Mode. 5. Select Enable or Disable from the Actions drop-down list. 6. To turn power supplies on or off in the Policy page: a. Select Monitor Power Supply x Side y for power. In the following example, Monitor Power Supply 0 Side 0 is selected. b. Select Enable or Disable from the Actions menu.50 Oracle ILOM CMM Admistration Guide • May 2011 ? Enable or Disable Redundant Mode Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Power Management --> Redundancy page. 4. Select one of the following from the drop-down menu: ¦ None: To set non-redundant mode. ¦ N+N: To set redundant mode. 5. Click Save. ? Enable or Disable LLEM Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. To enable or disable LLEM, use the command: -> set /CMM/policy LIGHT_LOAD_EFFICIENCY_MODE= [enabled|disabled] 3. When LLEM is disabled, you can turn the PSU sides on or off with this command: -> set /CMM/policy MONITOR_PSn_SIDEn=[enabled|disabled]CMM Power Management 51 Note – It is advisable to disable any PSU side first before unplugging the power cord. You can check the sensor value of /CH/PSn/Sn/I_12V or /CH/PSn/Sn/V_OUT_OK, where the value of I_12V being 0 or V_OUT_OK deasserted indicates the corresponding side is disabled. You can disable any PSU sides monitoring. In both redundant and non-redundant modes, LLEM works on those sides that are under monitoring. ? Enable Redundant Mode Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Set redundant mode using this command: -> set /CMM/powermgmt redundancy=n+n All MONITOR_PSn_SIDEn are set to enabled, and any attempt to disable any PSU side’s monitoring is not allowed. ? Enable Non-Redundant Mode Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Set non-redundant mode using this command: -> set /CMM/powermgmt redundancy=none52 Oracle ILOM CMM Admistration Guide • May 2011 Force Power Supply Fan Speed About Power Supply Fan Speed A new feature, introduced in Oracle ILOM 3.0.6.11, allows the adjustment of power supply fan speed. The high and low speed settings are defined as follows: ¦ High speed refers to the fans running at 100% capacity. ¦ Low speed refers to the fans running at 80% capacity. Note – Only force power supply unit (PSU) fans to low speed if half the PEM slots or fewer are in use. ? Set the Power Supply Fan Speed Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Click on CMM in the Chassis navigation pane. 3. Navigate to the Configuration --> Policy. Description Links Platform Feature Support Force power supply fan speed • “About Power Supply Fan Speed” on page 52 • “Set the Power Supply Fan Speed Using the Web Interface” on page 52 • “Set the Power Supply Fan Speed Using the CLI” on page 53 • CMMCMM Power Management 53 4. Choose one of the following options: ¦ Force Power Supply fans to low speed ¦ Force Power Supply fans to high speed 5. Select Enable or Disable from the Actions drop-down menu. As the power supply fans cool the power supplies, the power supply fans also cool the PEM slots. Note – If you enable both fan speed policies, high speed policy dominates. ? Set the Power Supply Fan Speed Using the CLI 1. Log in to the Oracle ILOM CLI interface. 2. Execute the following command: -> set /CMM/policy PS_FANS_HIGH=[enabled|disabled] -> set /CMM/policy PS_FANS_LOW=[enabled|disabled] As the power supply fans cool the power supplies, the power supply fans also cool the PEM slots. Note – If you enable both fan speed policies, high speed policy dominates.54 Oracle ILOM CMM Admistration Guide • May 2011 Disabling the Power Management Policy About the Power Management Policy A new power management option has been added to Oracle ILOM CMM 3.0.6.11c (Software Version 3.1.13) that enables the user to disable power management so that blades in the chassis attempt to power on even if power allocation has been exceeded. Caution – Chassis shutdown can occur. Do not disable power management unless you are advised to by Oracle Services personnel. ? Disable Power Management Policy Using the Web Interface 1. Log in to the Oracle ILOM web interface. 2. Select CMM from the Chassis navigation pane. 3. Navigate to the Configuration --> Policy. 4. Select Manage Chassis Power. 5. Select Disable from the Actions drop-down list. The following Oracle ILOM screen graphic shows the Manage Chassis Power option at the bottom of the Policy Configuration page. Description Links Platform Feature Support Disabling the power management policy • “About the Power Management Policy” on page 54 • “Disable Power Management Policy Using the Web Interface” on page 54 • “Disable Power Management Policy Using the CLI” on page 55 • CMMCMM Power Management 55 ? Disable Power Management Policy Using the CLI 1. Log in to the Oracle ILOM CMM CLI. 2. Type the following command: -> set /CMM/policy POWER_MANAGEMENT=disabled56 Oracle ILOM CMM Admistration Guide • May 2011 Oracle ILOM 3.0 for Specific Sun Blade 6048 Cases Oracle ILOM Behavior With Two Power Cord Configuration This section specifies how CMM and server module firmware behave when only two of the three power plugs are connected to an A231 power supply unit (PSU). There are three plugs on the back of each A231 PSU. These plugs are named AC0, AC1, and AC2. Each plug allows connection of a 220V power cord. When only two of the available three plugs are connected to the A231 PSUs, this provides 5600 watts to the entire chassis. If you connect only two of the total three plugs, connect them to AC0 and AC1. AC2 should not be connected. For further information on Sun Blade 6048 Modular System sensors, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Supplement for Sun Blade 6000 and Sun Blade 6048 Modular Systems (820-7603). ? Configure the CMM for Two Power Cords 1. To set up a two power cord configuration, disable the power supply side in the Oracle ILOM CMM with the following commands: -> set /CMM/policy MONITOR_PS0_SIDE2=disabled -> set /CMM/policy MONITOR_PS1_SIDE2=disabled Description Links Platform Feature Support Oracle ILOM 3.0 for specific Sun Blade 6048 cases • “Oracle ILOM Behavior With Two Power Cord Configuration” on page 56 • “Configure the CMM for Two Power Cords” on page 56 • “Oracle ILOM 3.0 Readings for Specific Power Supply States” on page 57 • CMMCMM Power Management 57 2. To view the disabled power cord side 2 configuration, type: Oracle ILOM 3.0 Readings for Specific Power Supply States This section provides some of the sensor readings for the system event log (SEL) in cases that are specific to the Sun Blade 6048 Modular System. To view the SEL using IPMItool, use the following command: ipmitool -H SPIPaddress -U root -P changeme sel list AC Cables Are Disconnected When an AC cable gets disconnected, the SEL displays the readings as shown in the example for power supply module 0, side 0 in TABLE: AC Cable Disconnect SEL Readings on page 58. -> show /CMM/policy/ /CMM/policy Targets: Properties: COOLING_DOOR_INSTALLED = disabled MONITOR_PS0_SIDE0 = enabled MONITOR_PS0_SIDE1 = enabled MONITOR_PS0_SIDE2 = disabled MONITOR_PS1_SIDE0 = enabled MONITOR_PS1_SIDE1 = enabled MONITOR_PS1_SIDE2 = disabled PS_FANS_HIGH = disabled Commands: cd set show58 Oracle ILOM CMM Admistration Guide • May 2011 Note – The order of the events might not match the real time event exactly, because that is based on how the sensors are being scanned. AC Cables Are Disconnected, Then Are Reconnected When an AC cable gets disconnected, then plugged back in, the SEL displays the readings as shown for power supply module 0, side 0 in TABLE: AC Cables Reconnected SEL Readings on page 58. TABLE: AC Cable Disconnect SEL Readings Event ID Device State Description 8 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC output is out (because AC is unplugged). 9 Voltage PS0/S0/V_IN_ERR Predictive Failure Asserted PSU 0 side 1 AC is disconnected. TABLE: AC Cables Reconnected SEL Readings Event ID Device State Description 8 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC output is out (because AC is unplugged). 9 Voltage PS0/S0/V_IN_ERR Predictive Failure Asserted PSU 0 side 0 AC is disconnected. a Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 DC output is OK (because AC is plugged in). b Voltage PS0/S0/V_IN_ERR Predictive Failure Deasserted PSU 0 side 0 is connected.CMM Power Management 59 stop /CH Command When the stop /CH command is applied, the SEL displays the readings as shown in the example in TABLE: stop /CH SEL Readings on page 59. This example describes a two power cord configuration. start /CH Command When the start /CH command is applied, the SEL displays the readings as shown in the example in TABLE: start /CH SEL Readings on page 59. This example describes a two power cord configuration. TABLE: stop /CH SEL Readings Event ID Device State Description 29 Module/Board NEM1/STATE Transition to Power Off Not enough power for the NEM 1, since the PSU shuts off. 2a Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 is out. 2b Voltage PS0/S1/V_OUT_OK State Deasserted PSU 0 side 1 is out. 2c Module/Board NEM0/STATE Transition to Power Off Not enough power for the NEM 0, since the PSU shuts off. 2d Voltage PS1/S0/V_OUT_OK State Deasserted PSU 1 side 0 is out. 2e Voltage PS1/S1/V_OUT_OK State Deasserted PSU 1 side 0 is out. TABLE: start /CH SEL Readings Event ID Device State Description 2f Module/Board NEM1/STATE Transition to Running NEM 1 is powering on. 30 OEM BL7/ERR Predictive Failure Deasserted Blade module does not have an error. 31 Module/Board NEM0/STATE Transition to Running NEM 0 is powering on. 32 Voltage PS1/S0/V_OUT_OK State Asserted PSU 1 side 0 is on. 33 Voltage PS1/S1/V_OUT_OK State Asserted PSU 1 side 1 is on.60 Oracle ILOM CMM Admistration Guide • May 2011 One PSU Is Removed When one PSU is removed, and there is too much power consumption in the chassis to support PSU redundancy, the SEL displays the readings shown in TABLE: PSU Removed SEL Readings on page 60. PSU Is Reinserted TABLE: PSU Reinserted SEL Readings on page 60 shows the SEL readings as a PSU is reinserted into the system and the system recognizes that power has been reapplied. 34 OEM BL1/ERR Predictive Failure Deasserted Blade module does not have an error. 35 Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 is on. 36 Voltage PS0/S1/V_OUT_OK State Asserted PSU 0 side 1 is on. TABLE: PSU Removed SEL Readings Event ID Device State Description 1 Entity Presence PS0/PRSNT Device Absent PS0 is absent from the system. 2 Voltage PS0/S0/V_OUT_OK State Deasserted PSU 0 side 0 DC power is out. 3 Voltage PS0/S1/V_OUT_OK State Deasserted PSU 0 side 1 DC power is out. 4 Voltage PS0/S2/V_OUT_OK State Deasserted PSU 0 side 2 DC power is out. TABLE: PSU Reinserted SEL Readings Event ID Device State Description 5 Entity Presence PS0/PRSNT Device Present PS0 is present in the system. TABLE: start /CH SEL Readings (Continued) (Continued) Event ID Device State DescriptionCMM Power Management 61 6 Voltage PS0/S0/V_OUT_OK State Asserted PSU 0 side 0 DC power is on. 7 Voltage PS0/S1/V_OUT_OK State Asserted PSU 0 side 1 DC power is on. 8 Voltage PS0/S2/V_OUT_OK State Asserted PSU 0 side 2 DC power is on. TABLE: PSU Reinserted SEL Readings (Continued) (Continued) Event ID Device State Description62 Oracle ILOM CMM Admistration Guide • May 201163 Sun Blade Zone Manager Description Links Learn about the features of the Sun Blade Zone Manager and prerequisites for use of the application • “Introduction to the Sun Blade Zone Manager” on page 64 Access and enable Sun Blade Zone Manager • “Accessing the Sun Blade Zone Manager” on page 72 Create a storage zoning configuration • “Creating the Chassis Storage Access Configuration” on page 78 View and modify the storage zoning configuration • “Viewing or Modifying the Chassis Storage Access Configuration” on page 91 Save the storage zoning configuration • “Saving the Chassis Storage Access Configuration” on page 105 Back up the storage zoning configuration • “Backing Up the Storage Access Configuration” on page 107 Recover the storage zoning configuration • “Recovering Zoning Configurations” on page 109 Reset the zoning configuration • “Resetting the Zoning Configuration” on page 113 Reset the zoning password • “Resetting the Zoning Password” on page 11564 Oracle ILOM CMM Admistration Guide • May 2011 Introduction to the Sun Blade Zone Manager Supported Oracle ILOM User Interfaces Note – The Sun Blade Zone Manager is available in the Sun Blade 6000 Modular System CMM SW 3.0.10 or later, which includes Oracle ILOM 3.0.10 and later. Note – You can access the Zone Manager through either the Oracle ILOM web interface or command-line interface (CLI). The web interface and the CLI are functionally equivalent, but the web interface has some additional ease-of-use features. Accessing Zone Manager Using the Web Interface The Sun Blade Zone Manager is accessible through the Oracle ILOM CMM Storage tab. It provides two options for setting up the storage configuration: Description Links Platform Feature Support Introduction to the Sun Blade Zone Manager • “Supported Oracle ILOM User Interfaces” on page 64 • “Zoning Configuration Overview” on page 68 • “Supported Hardware and Firmware Configurations” on page 71 • CMM Topic Descriptions Links Platform Feature Support Supported Oracle ILOM User Interfaces • “Accessing Zone Manager Using the Web Interface” on page 64 • “Accessing Zone Manager Using the CLI” on page 67 • CMMSun Blade Zone Manager 65 ¦ Quick Setup enables you to choose from four different zoning configurations to set up the initial zoning. ¦ Detailed Setup enables you to create or change the zoning configuration by individually selecting blades and storage devices. The following example shows one of the configurations available through Quick Setup. Note – Empty slots mean that there is nothing installed. When viewed in the Sun Blade Zone Manager, the Sun Blade Storage Module M2 shows 8 HDD slots which are configurable when a supported drive is installed, it also shows 24 empty slots below the HDD slots that are not used and cannot be configured. Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time.66 Oracle ILOM CMM Admistration Guide • May 2011 See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for more information on Quick Setup. Detailed Setup enables you to make changes to the zoning configuration that you set up in Quick Setup or to make individual assignments of storage devices to server blades. The following example shows drives being selected for removal from the server blade assignment. Drives HDD4-HDD7 are selected and highlighted in blue. When the configuration is saved, these storage devices will no longer be associated with the server blade in Slot 1. For more information on changing a zoning configuration using Detailed Setup, see “View and Modify the Chassis Storage Configuration Using the Web Interface” on page 91.Sun Blade Zone Manager 67 Accessing Zone Manager Using the CLI The command-line interface (CLI) provides access to the zoning for blades and storage devices through the /STORAGE/sas_zoning namespace. When zoning is enabled, blades and NEMs that are SAS-2 capable will be displayed as targets under /STORAGE/sas_zoning. For example: Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. Storage devices installed on a storage blade are shown as targets of the storage blade. For example, if BL9 is a storage blade installed in Slot 9, the storage devices installed on this blade are shown as follows: -> show /STORAGE/sas_zoning Targets BL0 BL6 BL7 BL8 BL9 NEM0 NEM1 Properties zone_management_state = enabled reset_password_action = (Cannot show property) reset_access_action = (Cannot show property) Commands: cd set show -> show /STORAGE/sas_zoning/BL9 Targets: HDD0 HDD2 HDD3 HDD568 Oracle ILOM CMM Admistration Guide • May 2011 You can access and modify the zoning configurations either through the server blade or the storage blade. Either method has the same result. Zoning Configuration Overview Zoning Commands You can assign storage to a server blade or a server blade to a storage device. Either method produces the same result. When you are assigning storage devices to a server blade, use the following command: -> set add_storage_access=/CH/BLn/HDDn Where BLn is the storage blade, HDDn is a hard disk drive installed on the storage blade. Optionally, you can assign multiple storage devices to a blade in the same command line by separating storage devices with a comma. For example: -> set add_storage_access=/CH/BLn/HDD0,/CH/BLn/HDD1 When you are assigning a server blade to a storage device, use the following command: -> set add_host_access=/CH/BLn Where BLn is the server blade that you are assigning the storage device to. Topic Descriptions Links Platform Feature Support Zoning configuration overview • “Zoning Commands” on page 68 • “Assigning Storage to a Server Blade” on page 69 • “Assigning a Server Blade to Storage” on page 69 • CMMSun Blade Zone Manager 69 Assigning Storage to a Server Blade Before a server blade has a storage device assigned to it, no targets are displayed under the blade. In the following example, BL0 is a server blade in Slot 0. The following command assigns the HDD0 installed on the storage blade in chassis Slot 9 to the server blade installed in Slot 0. -> set add_storage_access=/CH/BL9/HDD0 After a storage device is assigned to a server blade, the storage device appears as a target under the server blade. For example: Assigning a Server Blade to Storage Before a storage device has a blade assigned to it, no targets are displayed under the storage device. In the following example, HDD0 is a storage device installed on a storage blade installed in Slot 9 of the chassis. -> cd /STORAGE/sas_zoning/BL0 -> show /STORAGE/sas_zoning/BL0 Targets: Properties: add_storage_access = (Cannot show property) remove_storage_access = (Cannot show property) -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL9/HDD0) Properties: add_storage_access = (Cannot show property) remove_storage_access = (Cannot show property) -> cd /STORAGE/sas_zoning/BL9/HDD0 -> show /STORAGE/sas_zoning/BL9/HDD0 Targets:70 Oracle ILOM CMM Admistration Guide • May 2011 The following command assigns server blade in Slot 0 to HDD0 on storage blade 9: -> set add_host_access=/CH/BL0 After a server blade is assigned to the storage device, the server blade appears as a target under the storage device. For example: For detailed instructions on creating and modifying zoning, see the following procedures: ¦ “Creating the Chassis Storage Access Configuration” on page 78 ¦ “Viewing or Modifying the Chassis Storage Access Configuration” on page 91 Properties: type = Hard Disk disk_type = SAS wwn = 0x5000c50003d3a765, 0x5000c50003d3a766 sas_speed = 6.0 Gbps add_host_access = (Cannot show property) remove_host_access = (Cannot show property) -> show /STORAGE/sas_zoning/BL9/HDD0 Targets: 0 (/CH/BL0) Properties: type = Hard Disk disk_type = SAS wwn = 0x5000c50003d3a765, 0x5000c50003d3a766 sas_speed = 6.0 Gbps add_host_access = (Cannot show property) remove_host_access = (Cannot show property)Sun Blade Zone Manager 71 Supported Hardware and Firmware Configurations SAS-2 Capable Hardware All of the following hardware in the chassis must be SAS-2 capable in order to be recognized by the Sun Blade Zone Manager: ¦ Server blades with SAS-2 REMs ¦ Network express modules (NEMs) ¦ Storage blades If a storage module or server blade is not SAS-2 capable, it is not included in the Zone Manager configuration. The web interface acknowledges the presence of the blade, but it is labeled as a “non SAS-2” device. The blade is not displayed at all in the CLI if it is not SAS-2 enabled. SAS-2 devices, except for CPU blades, must be powered on to be recognized by the Zone Manager. In addition, SAS-2 devices in a failed state might not be recognized by Zone Manager. Refer to your platform Oracle ILOM supplement documentation or platform administration guide for information on detecting component faults. Additional System Requirements ¦ Your Sun Blade 6000 Modular System must have a PCIe 2.0 compliant midplane. For more information on determining this, refer to the Sun Blade 6000 Modular System Product Notes. ¦ Your Sun Blade 6000 Modular System must have software release 3.2.1 installed. This release includes the minimum Oracle ILOM CMM firmware version (3.0.10.15a), which supports SAS-2 and includes the Sun Blade Zone Manager. ¦ You must have already installed your SAS-2 supported components (server module with SAS-2 REM, SAS-2 NEMs, and SAS-2 storage modules). ¦ Your SAS-2 NEM must be at a firmware version level that supports zoning. Check your NEM Product Notes for version information and available updates. Description Links Platform Feature Support Supported hardware and firmware configurations • “SAS-2 Capable Hardware” on page 71 • “Additional System Requirements” on page 71 • CMM72 Oracle ILOM CMM Admistration Guide • May 2011 ¦ You must have already performed initial setup and configuration of your Oracle ILOM CMM and planned your connection method (web browser or CLI) as described in LINK “Chapter 2” of this document. Accessing the Sun Blade Zone Manager ? Access and Enable the Sun Blade Zone Manager Using the Web Interface Before You Begin: Ensure that your chassis configurations meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. Follow these steps to access and enable the Zone Manager using the web interface: 1. Open a web browser and log in to the CMM by entering the following URL: http://chassis_sp_ipaddress/ Where chassis_sp_ipaddress is the IP address of your chassis service processor. The Oracle ILOM login page appears. 2. Log in as the root user account. The Oracle ILOM CMM main page is displayed. Description Links Platform Feature Support Accessing the Sun Blade Zone Manager • “Access and Enable the Sun Blade Zone Manager Using the Web Interface” on page 72 • “Access and Enable the Sun Blade Zone Manager Using the CLI” on page 76 • CMMSun Blade Zone Manager 73 Note – In the left pane, installed server blades are listed, but not installed storage modules. This is because the Oracle ILOM CMM controls storage module Integrated Lights Out Management functions. 3. Click on CMM in the left Chassis navigation pane and then click the Storage tab. The Zone Manager Settings sub-page is displayed.74 Oracle ILOM CMM Admistration Guide • May 2011 4. Enable CMM zoning by clicking the Enable check box, and then clicking the Save button. This enables you to create, view, and manage zoning settings through the CMM.Sun Blade Zone Manager 75 You might get the following message if the Oracle ILOM CMM services are still initializing: If you get this message, wait an additional five minutes and then try again. You need to close and reopen, or refresh the page.76 Oracle ILOM CMM Admistration Guide • May 2011 5. Use the procedures in “Creating the Chassis Storage Access Configuration” on page 78 to set up the storage zoning. ? Access and Enable the Sun Blade Zone Manager Using the CLI Before You Begin: Ensure that your chassis configurations meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. Follow these steps to access and enable Zone Manager using the CLI: 1. Open a terminal window and establish an SSH connection to the CMM by entering the following command: # ssh -l root cmm_ipaddress Where cmm_ipaddress is the IP address of the CMM. The login prompt is displayed. 2. Log in as root and enter the root password: /hostname/login: root password: xxxxxxxx After you have successfully logged in, the CLI prompt is displayed: -> 3. Confirm that you have the minimum CMM firmware version required for zoning by entering the command: -> version You need Oracle ILOM firmware 3.0.10 at a minimum. If you have an earlier version, you need to download Oracle ILOM CMM software version 3.2.1 (or later). See LINK “Chapter 3” for firmware download and upgrade procedures. Then you need to upgrade your Oracle ILOM CMM firmware. 4. Change directories to sas_zoning by entering the command: -> cd /STORAGE/sas_zoning/Sun Blade Zone Manager 77 5. Check whether -sas_zoning is enabled by entering the show command. For example: If the -zone_management_state = disabled, then there are no saved SAS-2 zone configurations. 6. If necessary, enable zoning by entering: -> set zone_management_state=enabled ¦ If the zone manager is ready to be enabled, you get the following message: ¦ Enabling the Sun Blade Zone Manager will result in the clearing of all zoning configuration in the installed chassis SAS hardware, and any SAS disk I/O in progress will be interrupted. ¦ Are you sure you want to enable the Sun Blade Zone Manager (y/n)? y ¦ Set ’zone_management_state’ to ’enabled’ ¦ If the Oracle ILOM CMM has not initialized, you will get the following message: ¦ set: The Sun Blade Zone Manager is initializing and not ready for operation. Please wait several minutes and try again. ¦ If you get this message, wait five minutes and retry the command. 7. Use the procedures in “Creating the Chassis Storage Access Configuration” on page 78 to set up the storage zoning. -> show /STORAGE/sas_zoning Targets: Properties: zone_management_state = disabled reset_password_action = (Cannot show property) reset_access_action = (Cannot show property) Commands: cd set show78 Oracle ILOM CMM Admistration Guide • May 2011 Creating the Chassis Storage Access Configuration About Creating Chassis Storage Access There are three options for creating chassis storage access: the web interface using Quick Setup, the web interface using Detailed Setup, and the CLI. You can also use a backup zoned configuration by recovering the configuration as shown in “Recovering Zoning Configurations” on page 109. Quick Setup is a wizard for automating the process of creating an initial chassis storage access configuration for SAS-2 compliant CPU blades. Quick Setup is only available through the Oracle ILOM web interface. There is no Quick Setup equivalent for the CLI. Creating the Chassis Storage Access Configuration Using Quick Setup The Quick Setup option through the Oracle ILOM web interface enables you to choose from four different configuration options to zone the blades and storage devices in the chassis. Description Links Platform Feature Support Creating the Chassis Storage Access Configuration • “About Creating Chassis Storage Access” on page 78 • “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 • “Creating the Chassis Storage Access Configuration Using Detailed Setup” on page 85 • “Creating a Chassis Storage Configuration Using the CLI” on page 88 • CMMSun Blade Zone Manager 79 Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. There are four options available for Quick Setup described in the following topics: ¦ “Option 1: Assign per Individual Disks” on page 79 ¦ “Option 2: Assign per Adjacent Individual Disks” on page 80 ¦ “Option 3: Assign per Storage Blade” on page 81 ¦ “Option 4: Assign per Adjacent Storage Blade” on page 82 Additionally, this section covers the following topic: ¦ “Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface” on page 83 Option 1: Assign per Individual Disks This option uses a round-robin algorithm to assign disks to hosts. Ownership of disks is spread evenly across available storage modules. This option is best for fault tolerance where the failure or removal of a single storage module will not bring down an array.80 Oracle ILOM CMM Admistration Guide • May 2011 Option 2: Assign per Adjacent Individual Disks This option equally divides the number of storage devices among the server blades. All servers are assigned as close to the same number of disks as possible. Instead of assigning the storage in a round-robin fashion among all available storage blades, the storage is assigned from storage blades that are adjacent to the server blades. If there are no storage blades adjacent to the server blade, then the nearest possible storage blade is used. This is a good option to use if you have more server blades than storage blades, and want to have an equal number of storage devices assigned to each storage blade.Sun Blade Zone Manager 81 Option 3: Assign per Storage Blade This option looks for servers (starting at Slot 0) and assigns the closest available storage module. If there are seven servers and three storage modules, only the first three servers will be assigned a storage module. This option is best to use when there are an equal number of storage blades and modules or more storage blades than modules. Otherwise, some server blades will not be assigned to any storage device.82 Oracle ILOM CMM Admistration Guide • May 2011 Option 4: Assign per Adjacent Storage Blade This option looks for servers with storage modules in adjacent slots and one per server. If the server does not have a storage module in an adjacent slot, it is not assigned any storage. This option works best when there are an equal number of storage blades and server blades, and each server blade has a unique storage blade installed adjacent to it.Sun Blade Zone Manager 83 ? Use Quick Setup to Create an Initial Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Quick Setup button. A warning message appears.84 Oracle ILOM CMM Admistration Guide • May 2011 3. Click OK if you are willing to overwrite any existing zoning. The Quick Setup screen appears. Note that any HDD slots that do not have a storage device installed are labeled “empty.” These slots are not included in the Quick Setup configuration.Sun Blade Zone Manager 85 4. Choose one of the Quick Setup options. See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for explanation of each option. After you make the selection, the screen shows the color-coded zoning assignments between the CPU blades and storage devices (HDDs). Although the Sun Blade Zone Manager assigns the NEM0 and NEM1 External SAS connections, these connections are not officially supported. Note – Until you click the Save button, the configuration is not saved. 5. Click the Save button to save the configuration. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration. 6. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. Creating the Chassis Storage Access Configuration Using Detailed Setup You can use the New Assignments option in Detailed Setup to manually create the chassis storage access configuration. Note – NEM0 and NEM1 targets appear in the Zone Manager when these NEMs are installed; however, external SAS connections in the Sun Blade Zone Manager are not supported at this time. ? Use Detailed Setup to Create the Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The following message appears if you do not have a chassis storage configuration set up.86 Oracle ILOM CMM Admistration Guide • May 2011 3. Do one of the following: ¦ If you want to continue with the Detailed Setup setup, click Cancel. Clicking Cancel will open the Detailed Setup page. ¦ If you want to set up the original configuration in Quick Setup, click OK. Clicking OK will open the Quick Setup page. See “Creating the Chassis Storage Access Configuration Using Quick Setup” on page 78 for more information on Quick Setup. 4. Click the New Assignments button.Sun Blade Zone Manager 87 5. Click on a server blade and then click on the HDDs to be assigned to the server blade. Alternatively, select more than one server blade for the assignment. Note that any HDD slots that do not have a storage device installed are labeled “empty.” These slots cannot be assigned to a server blade. Caution – If you assign an HDD to more than one server blade, ensure that the server blade is enabled for multipathing. For more information see “Assign Multiple Server Blades to a Storage Device Using the Web Interface” on page 99. Although the Sun Blade Zone Manager can assign them, NEM0 and NEM1 External SAS connections are not supported at this time. 6. Click Save to save the configuration. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration.88 Oracle ILOM CMM Admistration Guide • May 2011 7. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. Creating a Chassis Storage Configuration Using the CLI You can create a chassis storage configuration either by assigning storage to a server blade or assigning a server blade to a storage device. Either method provides the same results. ? Create a Chassis Storage Configuration Using the CLI Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71.Sun Blade Zone Manager 89 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Use one of the following methods to create a chassis storage configuration: ¦ Method 1: To assign a storage module device to a server blade, use the following commands: -> cd /STORAGE/sas_zoning/BLn -> set add_storage_access=path_to_storage_device Where BLn is a server blade and path_to_storage_device is the path to the storage device that you want to assign to the blade. For example, /CH/BL1/HDD0. ¦ Method 2: To assign a server blade to a storage device, use the following command: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set add_host_access=path_to_blade_server Where BLn is a storage blade, HDDn is a storage device installed on the storage blade, and path_to_blade_server is the path to the server that you want to assign to the storage device. For example, /CH/BL0. The following examples show how to use these commands to set up zoning between storage devices on a storage blade in Slot 1 and a server blade in Slot 0. ¦ Method 1 - Command examples for assigning storage module devices to a server blade: Command Description -> cd /STORAGE/sas_zoning/BL0 Use the cd command to access the host server blade that will be assigned storage.90 Oracle ILOM CMM Admistration Guide • May 2011 ¦ Method 2 - Command examples for assigning a server blade (BL0) to storage module devices (BL1/HDD0). 3. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. -> set add_storage_access=/CH/BL1/HDD0 Assign HDD0 of the storage module in blade Slot 1 to the current host. -> set add_storage_access= /CH/BL1/HDD0,/CH/BL1/HDD1 Assign multiple devices in a single command line. Use the full path to the device and separate each device with a comma (no space). -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL1/HDD0) 1 (/CH/BL1/HDD1) Use the show command to confirm assigned devices to the current host. Command Description -> cd /STORAGE/sas_zoning/BL1/HDD0 Use the cd command to access the storage module device (in this case BL1/HDD0). -> set add_host_access=/CH/BL0 Assign the current device (HDD0) of the storage module to the host in blade Slot 0. -> show /STORAGE/sas_zoning/BL1/HDD0 Targets: 0 (/CH/BL0) Use the show command to confirm assignment of the current device. Command DescriptionSun Blade Zone Manager 91 Viewing or Modifying the Chassis Storage Access Configuration You can use the Detailed Setup through the web interface or the CLI to view or modify the current chassis storage access configuration. Use one of the procedures in the following table to view or modify the current storage configuration. ? View and Modify the Chassis Storage Configuration Using the Web Interface Before You Begin: Ensure that your chassis configuration meets the requirements in “Supported Hardware and Firmware Configurations” on page 71. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The current chassis zoning configuration is displayed, as shown in the following example. Description Links View and modify the current storage configuration using the web interface. “View and Modify the Chassis Storage Configuration Using the Web Interface” on page 91 View and modify the current storage configuration using the CLI. “View and Modify the Chassis Storage Configuration Using the CLI” on page 97 Assign multiple server blades to a storage device. “Assign Multiple Server Blades to a Storage Device Using the Web Interface” on page 99 View the storage configuration in table format. “View the Storage Access Configuration Table Using the Web Interface” on page 10292 Oracle ILOM CMM Admistration Guide • May 2011 Note – Any HDD slots that do not have a storage device installed are labeled “empty.” These slots cannot be assigned to a server blade. 3. To modify a blade/storage group, select a blade that is part of the group. The storage that is assigned to the group will be highlighted.Sun Blade Zone Manager 93 4. Click the Modify Group button. The group that you selected is still highlighted. 5. To remove a storage device that is in the group, click on it. The following illustration shows HDD 4-7 selected to be unassigned from the processor blade in Slot 1.94 Oracle ILOM CMM Admistration Guide • May 2011 6. Click Save to remove the modules from the group. See “Saving the Chassis Storage Access Configuration” on page 105 for more information on what happens when you save the configuration. 7. If you do not plan to make additional storage assignments, back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. 8. To make a new storage group assignment, click the New Assignments button.Sun Blade Zone Manager 95 9. Click on the server blade and storage devices that you want to include in the group. In the following example, the selected storage group is highlighted in green.96 Oracle ILOM CMM Admistration Guide • May 2011 10. Click Save. HDD 4-7 are now assigned to Slot 0.Sun Blade Zone Manager 97 11. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. ? View and Modify the Chassis Storage Configuration Using the CLI Before You Begin: Set up the initial chassis zoning configuration using Quick Setup or Detailed Setup. See “Creating the Chassis Storage Access Configuration” on page 78. 1. Access Zone Manager using the CLI. See “Accessing the Sun Blade Zone Manager” on page 72.98 Oracle ILOM CMM Admistration Guide • May 2011 2. To view storage device assignments to a server blade, you can either view the assignments per server blade or per storage module. In the following examples, HDD0 and HDD1 from a storage blade in Slot 2 are assigned to server blade in Slot 0. ¦ To view storage assignments per server blade, use the show command with the host blade SAS zoning directory. For example: In this example, HDD0 and HDD1 from a storage blade in Slot 2 are assigned to server blade in Slot 0. ¦ To view storage assignments per storage device, use the show command with the storage blade SAS zoning directory for the storage device. For example: 3. Modify storage assignments. You can modify storage device assignments to server blades or modify server blade assignments to storage devices. Either method provides the same result. Method 1: Add or remove storage access to the server blade. ¦ To assign a storage module to a server blade: -> cd /STORAGE/sas_zoning/BLn -> set add_storage_access=path_to_storage_device ¦ To remove a storage module from a server blade: -> cd /STORAGE/sas_zoning/BLn -> set remove_storage_access=path_to_storage_device Where BLn is a server blade and path_to_storage_device is the path to the storage device that you want to assign to the blade. For example, /CH/BL1/HDD0. Method 2: Add or remove server blade access to storage blades. ¦ To assign a server blade to a storage device: -> show /STORAGE/sas_zoning/BL0 Targets: 0 (/CH/BL2/HDD0) 1 (/CH/BL2/HDD1) -> show /STORAGE/BL2/HDD0 Targets: 0 (/CH/BL0) -> show /STORAGE/BL2/HDD1 Targets: 0 (/CH/BL0)Sun Blade Zone Manager 99 Use one of the following commands: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set add_host_access=path_to_blade_server ¦ To remove a server blade from a storage device: Use one of the following commands: -> cd /STORAGE/sas_zoning/BLn/HDDn Followed by: -> set remove_host_access=path_to_blade_server Where BLn is a storage blade, and HDDn is storage device in the storage blade, and path_to_blade_server is the path to the server that you want to assign to the storage device. For example, /CH/BL0. Note – You can also add or remove multiple devices in a single command line. Use the full path to the device and separate each device with a comma (no space). For example: -> set add_storage_access=/CH/BL1/HDD0,/CH/BL1/HDD1. 4. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107. ? Assign Multiple Server Blades to a Storage Device Using the Web Interface The Sun Blade Zone Manager enables you to assign more than one server blade to a single storage device. This option should only be used with an Oracle-supported clustering solution. See the Sun Blade Storage Module Administration Guide for more information. Note – Check your server blade documentation for information on whether the server module is enabled for sharing storage with another server. 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. In the following example, HDD6 in storage module Slot 2 is assigned only to the server blade in Slot 0.100 Oracle ILOM CMM Admistration Guide • May 2011 3. Click New Assignments. 4. To assign HDD6 to both the server blade in Slot 0 and the server blade in Slot 1, click Slot 1 and click HDD6 in Slot 2.Sun Blade Zone Manager 101 5. Click Save. The following message appears. 6. Click OK to continue. The following example shows the HDD6 in Slot 2 colored pink to indicate that it is shared by more than one server blade.102 Oracle ILOM CMM Admistration Guide • May 2011 7. Back up the configuration. See “Backing Up the Storage Access Configuration” on page 107 ? View the Storage Access Configuration Table Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. In the Sun Blade Zone Manager section, click the Detailed Setup button. The following is an example storage access configuration.Sun Blade Zone Manager 103 3. Select one of the server blade slots. In this example, Slot 0 is selected. 4. Scroll down to the Current Assignments table. All of the storage device assignments for the selected server blade are shown in table format.104 Oracle ILOM CMM Admistration Guide • May 2011 5. To detach the table from the rest of the screen, click Detach Table. Saving the Chassis Storage Access Configuration Important Considerations About Saving the Zoning Configuration When you save a storage access configuration, keep the following in mind: ¦ The configuration information is saved with the SAS-2 NEMs and storage blades. Changes in zoning hardware configurations can result in loss of the zoning configuration. Back up the configuration immediately after saving it. See “Backing Up the Storage Access Configuration” on page 107. Description Links Platform Feature Support Saving the Chassis Storage Access Configuration • “Important Considerations About Saving the Zoning Configuration” on page 105 • “Saving a New or Modified Storage Access Configuration” on page 105 • CMMSun Blade Zone Manager 105 Refer to the storage blade or NEM documentation for further information on the effect of hot-plugging these components. ¦ The Zone Manager windows must remain open during the entire Save operation. If the Zone Manager window is closed while the Save operation is in progress, only the portion of the configuration that was processed before the window was closed will be preserved. ¦ Do not remove or power cycle any of the components included in a zoning assignment while a Save operation is in progress. The zoning configuration will not save properly. Saving a New or Modified Storage Access Configuration You can save a new or modified storage access configuration using either the Oracle ILOM web interface or the CLI. ¦ From the web interface: Press the Save button after making the storage access assignments in the Quick Setup or Detailed Setup screens. ¦ From the CLI: As soon as you execute the set command for the storage assignment, the configuration is saved. While the new configuration is being saved, the following takes place: ¦ In Quick Setup, the existing configuration is overridden. ¦ All storage controls are disabled while the configuration is being saved. ¦ For the web interface, check marks indicate where the new configuration is applied.106 Oracle ILOM CMM Admistration Guide • May 2011 ¦ In the web interface, a Setup Complete message is displayed when the storage configuration has been saved.Sun Blade Zone Manager 107 Backing Up the Storage Access Configuration ? Save the Zoning Configuration to a Backup File Using the Web Interface 1. After saving a configuration in the Quick Setup or Detailed Setup screen, Click the Maintenance tab for the CMM. The CMM maintenance sub-tabs are displayed. 2. Click the Backup/Restore tab. The Configuration Backup/Restore page is displayed. 3. Select Backup from the Operation drop-down list. Description Links Platform Feature Support Backing up the Storage Access Configuration • “Save the Zoning Configuration to a Backup File Using the Web Interface” on page 107 • “Save the Zoning Configuration to a Backup File Using the CLI” on page 108 • CMM108 Oracle ILOM CMM Admistration Guide • May 2011 4. Fill out the information on the page to create your backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. ? Save the Zoning Configuration to a Backup File Using the CLI 1. After setting the storage access configuration, change to the /SP/config directory. -> cd /SP/config 2. If you want sensitive data, such as user passwords, SSH keys, certificates, and so forth, to be backed up, you must provide a passphrase. -> set passphrase=passphrase 3. To initiate the Backup operation, enter the command: -> set dump_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename. config Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide.Sun Blade Zone Manager 109 Recovering Zoning Configurations ? Recover Zoning Configurations Using the Web Interface You must have previously created a backup Oracle ILOM CMM configuration file that contains the zoning configurations you want to restore. Note – For advanced users or Oracle technicians: The Oracle ILOM CMM configuration backup file is an XML file. If you have multiple Oracle ILOM CMM configuration backup files and the latest version does not have the zoning configurations you need, you have the option of copying the storage assignments section of one file and pasting it into another. For this to work, your storage modules and server blades must be in the same physical slots for the zoning configurations you want to restore. For more information on performing this procedure, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. 1. Open a web browser and log in to the CMM by entering the following URL: http://chassis_sp_ipaddress/ Where chassis_sp_ipaddress is the IP address of your chassis service processor. The Oracle ILOM login page appears. 2. Log in as root. The Oracle ILOM CMM main page is displayed. Description Links Platform Feature Support Recovering Zoning Configurations • “Recover Zoning Configurations Using the Web Interface” on page 109 • “Recover Zoning Configurations Using the CLI” on page 111 • CMM110 Oracle ILOM CMM Admistration Guide • May 2011 3. With CMM selected in the Chassis navigation pane, click the Maintenance tab for the CMM. The CMM maintenance sub-tabs are displayed. 4. Click the Backup/Restore tab. The Configuration Backup/Restore page is displayed.Sun Blade Zone Manager 111 5. Select Restore from the Operation drop-down list. Fill out the information on the page to restore your backup file. For complete instructions on using Oracle ILOM Backup/Restore, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide. 6. To initiate the Restore operation, click Run. The Restore operation executes. Note – While the Restore operation is executing, sessions on the Oracle ILOM SP are momentarily suspended. The sessions will resume normal operation once the Restore operation is complete. A Restore operation typically takes two to three minutes to complete. ? Recover Zoning Configurations Using the CLI You must have previously created a backup Oracle ILOM CMM configuration file that contains the zoning configurations you want to restore. Note – For advanced users or Oracle technicians: The Oracle ILOM CMM configuration backup file is an XML file. If you have multiple Oracle ILOM CMM configuration backup files and the latest version does not have the zoning configurations you need, you have the option of copying the storage assignments section of one file and pasting it into another. For this to work, your storage modules and server blades must be in the same physical slots for the zoning configurations you want to restore. For more information on performing this procedure, refer to the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. 1. Open a terminal window and establish an SSH connection to the CMM by entering the following command: # ssh -l root cmm_ipaddress Where cmm_ipaddress is the IP address of the CMM. The login prompt is displayed. 2. Log in as root and enter the root password: /hostname/login: root password:xxxxxxxx After you have successfully logged in, the CLI prompt is displayed: ->112 Oracle ILOM CMM Admistration Guide • May 2011 3. Change to the /SP/config directory: -> cd /SP/config 4. To initiate the Restore operation, enter the command: -> set load_uri= transfer_method://username:password@ipaddress_or_hostname/directorypath/filename.co nfig Where: ¦ transfer_method can be tftp, ftp, sftp, scp, http, or https. ¦ username is the name of the user account on the remote system. (username is required for scp, sftp, and ftp. username is not used for tftp, and it is optional for http and https.) ¦ password is the password for the user account on the remote system. (password is required for scp, sftp, and ftp. password is not used for tftp, and it is optional for http and https.) ¦ ipaddress_or_hostname is the IP address or the host name of the remote system. ¦ directorypath is the storage location on the remote system. ¦ filename is the name assigned to the backup file. The Restore operation executes.Sun Blade Zone Manager 113 Resetting the Zoning Configuration ? Reset the Zoning Configuration Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to Storage --> Zoning. If Zoning is enabled, a Reset All button is available on the Zone Manager Settings page. 3. Click the Reset All button to reset the current zoning assignments. Description Links Platform Feature Support Resetting the Zoning Configurations • “Reset the Zoning Configuration Using the Web Interface” on page 113 • “Reset the Zoning Configuration Using the CLI” on page 114 • CMM114 Oracle ILOM CMM Admistration Guide • May 2011 ? Reset the Zoning Configuration Using the CLI 1. Access the Sun Blade Zone Manager using the CMM CLI. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to -/STORAGE/sas_zoning using the following command: -> cd /STORAGE/sas_zoning 3. Reset the current zoning assignments using the following command: -> set reset_access_action=true If the Zone Manager is disabled, you will get the following warning: set: The CMM is not the SAS Zone Manager If you receive this message, enable Zone Manager and re-issue the reset command. Resetting the Zoning Password Note – The zoning password is only required by in-band zoning management applications running on a Host OS. If you use such applications and this password is lost or forgotten, restore the password to the default value (all-zeroes). The Sun Blade Zone Manager must be disabled to reset this password. ? Reset the Zoning Password Using the Web Interface 1. Access the Sun Blade Zone Manager. See “Accessing the Sun Blade Zone Manager” on page 72. Description Links Platform Feature Support Resetting the Zoning Password • “Reset the Zoning Password Using the Web Interface” on page 115 • “Reset the Zoning Password Using the CLI” on page 116 • CMMSun Blade Zone Manager 115 2. Navigate to Storage --> Zoning. If Zoning is disabled, a Reset Password button is available on the Zoning page. 3. Click the Reset Password button to reset the password to the default (all zeros). ? Reset the Zoning Password Using the CLI 1. Access the Sun Blade Zone Manager using the CMM CLI. See “Accessing the Sun Blade Zone Manager” on page 72. 2. Navigate to -/STORAGE/sas_zoning using the following command: -> cd /STORAGE/sas_zoning 3. Reset the current zoning assignments using the following command: -> set reset_password_action=true The password is set to the default (all zeros).116 Oracle ILOM CMM Admistration Guide • May 2011117 Index B blade SP CLI prompt changing, 23 C CLI accessing and enabling Sun Blade Zone Manager, 76 backing up a storage zoning con?guration, 108 changing the blade SP prompt, 23 enabling Ethernet ports, 21 Ethernet management port CLI using to determine ?rmware version, 29 logging in, 18, 19 recovering a storage zoning con?guration, 111 resetting a storage zoning con?guration, 114 resetting CMM, 46 resetting the zoning password, 116 serial management port CLI using to determine ?rmware version, 29 Sun Blade Zone Manager, 67 updating component ?rmware, 43 using to create Sun Blade Zone Manager chassis storage con?guration, 88 using to update CMM ILOM ?rmware, 33 using to view and modify storage con?guration, 97 CMM Ethernet ports, enabling, 20 connecting to CMM ILOM con?guring static IP address, 9, 11 DHCP, 11 serial connection, 8 D Detailed Setup for Sun Blade Zone Manager, 85 DHCP accessing CMM IP address, 11 E Ethernet ports enabling through CLI, 21 enabling through web interface, 20 F ?rmware determining current CMM version using Ethernet management port CLI, 29 using serial management port CLI, 29 using web interface, 28 downloading, 30 Sun Blade Zone Manager requirements, 71 updating CMM ILOM, 26 using CLI, 33 using web interface, 31 updating component ?rmware, 40 using the CLI, 43 using the web interface, 41 I ILOM CLI interface logging in, 19 ILOM version numbers, xiii initial login to CMM ILOM, 18 IP address assignment editing using the CLI, 11 L logging in to CMM ILOM using CLI, 19 using web interface, 18 M multiple blades assigned to storage device, 99118 Oracle ILOM CMM Admistration Guide • May 2011 O overview of CMM ILOM, 2 Q Quick Setup for Sun Blade Zone Manager, 78, 83 R resetting CMM using CLI, 46 using web interface, 45 S saving a storage access con?guration, 105 static IP address con?guring, 9, 11 storage access con?guration table in Sun Blade Zone Manager, 102 Sun Blade Zone Manager accessing using CLI, 76 accessing using web interface, 72 assigning multiple server blades to a storage device, 99 backing up a zoning con?guration using CLI, 108 using web interface, 107 CLI, 67 creating the chassis storage access con?guration using CLI, 88 using detailed setup, 85 using quick setup, 78, 83 enabling using CLI, 76 enabling using web interface, 72 recovering a zoning con?guration using CLI, 111 using web interface, 109 resetting a zoning con?guration using CLI, 114 using web interface, 113 resetting the zoning password using CLI, 116 using web interface, 115 saving a storage access con?guration, 105 storage access con?guration table, 102 supported hardware and ?rmware con?gurations, 71 supported ILOM interfaces, 64 view and modify storage con?guration using the CLI, 97 using the web interface, 91 T topic guidelines, 1, 5, 25, 47, 63 V version of CMM ILOM, 3 W web interface accessing and enabling Sun Blade Zone Manager, 72 backing up a storage zoning con?guration, 107 enabling Ethernet ports, 20 logging in, 18 recovering a storage zoning con?guration, 109, 113 resetting CMM, 45 resetting the zoning password, 115 updating component ?rmware, 41 using to determine ?rmware version, 28 using to update CMM ILOM ?rmware, 31 using to view and modify storage con?guration, 91 1 TABLE 1 System Information and Management – CLI Commands Task CLI Command Show system information show /SYS product_name product_part_number product_serial_number product_manufacturer Show Oracle ILOM version version Show x86 BIOS version Show SPARC host equivalent show /SYS/MB/BIOS fru-version show /HOST sysfw_version Show network settings show /SP/network ipaddress ipnetmask ipgateway Show SP MAC address show /SP/network macaddress Show x86 host MAC address Show SPARC host MAC address show /SYS/MB/NET0 fru_serial_number show /HOST macaddress Turn on the Locator LED set /SYS/LOCATE value=Fast_Blink Turn off the Locator LED set /SYS/LOCATE value=Off TABLE 2 Host and System Control – CLI Commands Task CLI Command Power on the server start /SYS Power off the server stop [-force] /SYS Power cycle the server reset /SYS Redirect host console stream to Oracle ILOM start /HOST/console Force PXE boot on next boot (x86 only) set /HOST boot_device=pxe Force boot to CDROM or DVD on the next boot (x86 only ) set /HOST boot_device=cdrom Enable additional x86 diagnostics on next boot Enable SPARC diagnostic state (default value) set /HOST/diag state=enabled set /SYS keyswitch_state=diag TABLE 3 Oracle ILOM Initial Setup – CLI Commands Task CLI Command Show network configuration show /SP/network/ Configure static IPv4 address set /SP/network pendingipdiscovery=static pendingipaddress= address pendingipnetmask=netmask pendingipgateway=address commitpending=true Configure static IPv6 address set /SP/network/ipv6 state=enabled pending_static_ipaddress=ipv6address set /SP/network commitpending=true Configure Oracle ILOM to use DHCP set /SP/network pendingipdiscovery=dynamic commitpending=true Set the Oracle ILOM host name set /SP hostname=hostname Set the system identifier set /SP system_identifier=identifier Create user account with all privileges create /SP/users/newusername role=aucro [password=password] Create user account with operator privileges create /SP/users/newusername role=cro [password=password] Create read-only user account create /SP/users/newusername role=o [password=password] Delete user account delete /SP/users/username Basic CLI Command Reference Oracle Integrated Lights Out Manager (ILOM) 3.02 Override DNS servers retrieved from DHCP set /SP/clients/dns auto_dns=disabled nameserver=nameserver1,nameserver2 searchpath=searchpath1,searchpath2 Set the Oracle ILOM date and time set /SP/clock datetime=MMDDhhmmYYYY.ss Configure an NTP server set /SP/clients/ntp/server/1 address=address set /SP/clock usentpserver=enabled Change the external serial port speed set /SP/serial/external pendingspeed=9600|19200|38400|57600|115200 commitpending=true TABLE 4 System Monitoring and Status – CLI Commands Task CLI Command Show the Oracle ILOM Event Log show /SP/logs/event/list Configure an SNMP trap destination set /SP/alertmgmt/rules/1 type=snmptrap snmp_version=1 destination=ipaddress destination_port=port community_or_username=community Check the service indicator show /SYS/SERVICE value List all hardware faults show -level all -output table /SP/faultmgmt List all temperature sensor readings show -level all -output table /SYS type==Temperature value Show actual system power consumption show /SP/VPS value TABLE 5 System Inventory – CLI Commands Task CLI Command List all DIMMs show -level all -output table /SYS type==DIMM Lista all CPUs show -level all -output table /SYS type=='Host Processor' List all power supplies show -level all -output table /SYS type=='Power Supply' fru_name==* List all hard disks show -l all /SYS type=='Hard Disk' TABLE 6 Oracle ILOM Maintenance – CLI Commands Task CLI Command Update Oracle ILOM firmware load -source URI /SP/firmware Reset Oracle ILOM SP reset /SP TABLE 7 Oracle ILOM Configuration Management – CLI Commands Task CLI Command Reset Oracle ILOM configuration to factory defaults set /SP reset_to_defaults=all Backup Oracle ILOM configuration to a file dump -destination URI /SP/config Restore Oracle ILOM configuration from a file load -source URI /SP/config TABLE 3 Oracle ILOM Initial Setup – CLI Commands (Continued) Task CLI Command Copyright © 2011, Oracle and/or its affiliates. All rights reserved. Copyright © 2011, Oracle et/ou ses affiliés. Tous droits réservés. Part No.: E25241-01 August 2011 Module serveur SPARC T3-1B Notes de produit N° de référence : E21520-01, Décembre 2010, révision AProduit recyclable Copyright © 2010, Oracle et/ou ses sociétés af?liées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des États-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. En tant que tels, leurs utilisation, duplication, divulgation, modi?cation et adaptation doivent être soumises aux restrictions et conditions de licence énoncées dans le contrat du Gouvernement applicable et, dans la mesure autorisée par ce contrat du Gouvernement, aux droits supplémentaires énoncés dans le FAR 52.227-19, Commercial Computer Software License (déc. 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, États-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés af?liées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Table des matières 1. Informations générales 1 Châssis pris en charge 2 ? Pour identifier la version du midplane du châssis 3 Composants modulaires pris en charge 4 Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 6 Versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge 7 Informations sur les patchs 8 ? Accès aux mises à jour du système d’exploitation, des patchs et du microprogramme 8 Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris 9 Exemple de profil Oracle Solaris Jumpstart 10 Exemple d’installation interactive 11 2. Informations de dernière minute 13 Problèmes liés au matériel 13 Risque d’erreur grave du module serveur lors de l’enfichage à chaud du module Express SFP+ à deux ports 10GbE (CR 6974235) 13 Remplacement rapide conseillé des modules DIMM défectueux présentant des erreurs incorrigibles (CR 6996144) 14iv Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Problèmes liés au microprogramme du système 14 Link Width x8 Link Speed GEN1 : avertissement affiché lors de la mise sous tension (CR 6958263) 14 Dysfonctionnement de la désactivation de /SYS/MB/FEM0 au niveau du SP pour certains modules FEM (CR 6980646) 15 Problèmes liés à ILOM 15 Impossibilité pour ILOM d’afficher les propriétés (CR 6992917) 15 picld : messages consignés (CR 6992903) 16 Problèmes liés à Solaris 16 prtdiag : numéro de série du module serveur étiqueté comme numéro de série de châssis (CR 6669159) 16 Risque d’échec de la commande disktest d’Oracle VTS pour les périphériques USB (CR 6873719) 17 Messages d’avertissement nxge erronés (CR 6938085) 17 fault.memory.memlink-uc : erreur d’interconnexion n’ayant pas causé d’erreur grave contrairement à ce qui est affirmé dans un article de la base de connaissances (CR 6940599) 18 Dégradation des performances réseau avec les modules EM PCIe 10GbE Sun Dual (CR 6943558) 18 unsupported port mode : messages consignés dans le journal (CR 6962912) 19 Message d’interruption parasite affiché sur la console système (CR 6963563) 19 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) 20 Erreurs de type devfasadmd pouvant survenir suite au retrait à chaud de modules EM PCIe (CR 6973637) 20 Événement de rapport d’erreur (ereport) non généré pour un processeur de service endommagé (CR 6978171) 21 Génération d’événements de rapport d’erreur (ereport) erronés suite à l’initialisation du système alors que le processeur de service est endommagé (CR 6981297) 21 Génération possible d’une erreur suite à l’initialisation ou à l’enfichage à chaud d’un module Express Connect X-2 QDR IB HCA (CR 6986528) 22Table des matières v Blocage sans fin du processus Oracle Enterprise Manager (CR 6994300) 22 nxge : pilote non chargé (CR 6995458) 23 Problèmes identifiés dans la documentation 23 Guide de démarrage du module serveur SPARC T3-1B 23vi Notes de produit du module serveur SPARC T3-1B • Décembre 20101 C H A P I T R E 1 Informations générales Ces notes de produit présentent des informations de dernière minute importantes relatives au module serveur SPARC T3-1B d’Oracle. Ce document est destiné aux administrateurs système, aux techniciens, aux prestataires de service et aux utilisateurs possédant de l’expérience dans l’administration de systèmes informatiques. Ce chapitre présente les informations générales suivantes concernant le module serveur SPARC T3-1B : ¦ « Châssis pris en charge », page 2 ¦ « Composants modulaires pris en charge », page 4 ¦ « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 6 ¦ « Versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge », page 7 ¦ « Informations sur les patchs », page 8 ¦ « Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris », page 92 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Châssis pris en charge Le module serveur est pris en charge par les modèles de châssis de système modulaire indiqués dans le tableau ci-dessous. Châssis de système modulaire Fonctions prises en charge Système modulaire Sun Blade 6000 avec midplane PCIe 2.x * * Reportez-vous à la section « Pour identifier la version du midplane du châssis », page 3. Le module serveur prend en charge les composants modulaires SAS-1 et SAS-2. Les modules NEM et PCIe EM Gen2 connectés au module serveur SPARC T3-1B fonctionnent à des vitesses Gen2. Les périphériques compatibles Gen1 atteignent des vitesses Gen1. Remarque - Reportez-vous à la section « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 6. Système modulaire Sun Blade 6000 avec midplane PCIe 1.x * Le module serveur présente les conditions et les restrictions suivantes : • Les modules NEM et PCIe EM connectés au module serveur SPARC T3-1B fonctionnent à des vitesses Gen1 qu’ils disposent de fonctionnalités Gen1 ou Gen2. • Les modules NEM SAS-1 installés dans le châssis nécessitent une mise à niveau du microprogramme. Reportez-vous à la section « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 6. • Les périphériques de stockage du module serveur qui sont connectés à un module REM SAS-2 intégré sont pris en charge et fonctionnent selon des capacités SAS-2. • Il n’est pas possible de connecter des modules REM SAS-2 intégrés à des modules de stockage ou de disque SAS-1.Chapitre 1 Informations générales 3 ? Pour identifier la version du midplane du châssis 1. Connectez-vous au logiciel ILOM sur le CMM. 2. Tapez : 3. Examinez le champ numéro_référence_fru. ¦ 511-1298-xx désigne un midplane de type PCIe 2.x. ¦ 511-1487-xx désigne un midplane de type PCIe 2.x. ¦ 501-7376-xx désigne un midplane de type PCIe 1.x. Pour plus d’informations, reportez-vous au document Sun Blade 6000 Modular System Product Notes. -> show /CH/MIDPLANE4 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Composants modulaires pris en charge Le tableau suivant répertorie les composants modulaires pris en charge par le serveur modulaire. Remarque – Pour obtenir les informations les plus récentes sur les composants matériels requis, reportez-vous aux notes de produit du composant concerné. Numéro de modèle et nom du produit Conditions requises Modules NEM (Network Express Module) NEM X4338A-N – Module NEM (Network Express Module) 10GbE M2 Multi-Fabric virtualisé Sun Blade 6000 Conditions requises par ce module NEM : • Pour bénéficier de la fonctionnalité SAS-2, le module serveur et le module NEM X4338A-N doivent être installés dans un châssis équipé d’un midplane PCIe 2.x. Reportez-vous à la section « Châssis pris en charge », page 2. • Pour bénéficier d’une connectivité réseau 10GbE : FEM X4263A-N. • Pour bénéficier d’une connectivité de stockage : SG-SAS6-REM-Z. NEM X2073A-N – Module NEM commuté Ethernet 10GbE 24 ports Sun Blade 6000 Conditions requises par ce module NEM : • Pour bénéficier de la fonctionnalité SAS-2, le module serveur et le module NEM X2073A-N doivent être installés dans un châssis équipé d’un midplane PCIe 2.x. Reportez-vous à la section « Châssis pris en charge », page 2. • Pour bénéficier d’une connectivité réseau : FEM X5735A ou FEM 4871A-Z-N. • Pour bénéficier d’une connectivité de stockage : SG-SAS6-REM-Z. NEM X4238A-N – Module NEM (Network Express Module) 10 GbE Multi-Fabric virtualisé Sun Blade 6000 Conditions requises par ce module NEM : • Pour bénéficier d’une connectivité réseau 10GbE : FEM X4263A-N. • Pour bénéficier d’une connectivité de stockage : SG-SAS6-REM-Z. NEM X4236A-N – Module NEM (Network Express Module) MultiFabric 10GbE Sun Blade 6000 Conditions requises par ce module NEM : • Pour bénéficier d’une connectivité réseau : FEM X5735A ou FEM X4871A-Z-N. • Pour bénéficier d’une connectivité de stockage : SG-SAS6-REM-Z.Chapitre 1 Informations générales 5 X4250A-N – Module NEM (Network Express Module) d’intercommunication GbE 10 ports Sun Blade 6000 Conditions requises par ce module NEM : • Pour bénéficier d’une connectivité de stockage interne : SG-SAS6-REM-Z. Remarque - Aucun module FEM n’est requis pour les connexions réseau. Modules REM (RAID Express Module) SG-SAS6-REM-Z – Module REM HBA SAS2 RAID 0/1 Sun Blade 6000 Conditions requises par ce module REM : • Avant de procéder à l’installation, mettez à jour le microprogramme sur les composants SAS-1. Reportez-vous à la section « Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 », page 6. Modules FEM (Fabric Expansion Module) X5735A – Module FEM d’intercommunication XAUI 10GbE Doit être inséré dans les connecteurs de carte mère FEM X et FEM 0. X4871A-Z – Module FEM PCIe 2.0 10GbE à double accès (Intel) Doit être inséré dans le connecteur de carte mère FEM 0. X4263A-N – Module FEM d’intercommunication 10GbE à double accès Doit être inséré dans les connecteurs de carte mère FEM 0 et FEM 1. Modules d’extension PCIe (PCIe EM) SGX-SAS6-EM-Z – Module Express SAS2 à deux ports SG-XPCIEFCGBE-Q8-Z – Module Express Combo 2 x 8Gb FC et 2 x GbE Doivent disposer du numéro de référence 375-4522-02 ou supérieur après le tiret. X7283A-Z-N – Module Express 1GbE à deux ports, fibre X7284A-Z-N – Module Express 1GbE à quatre ports, cuivre X1110A-Z – Module Express SFP+ 10GbE à deux ports X4243A – QDR IB HCA Connect X-2 Numéro de modèle et nom du produit Conditions requises6 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Importante mise à niveau du microprogramme requise avant de combiner des composants SAS-1 et SAS-2 Vous devez mettre à niveau le microprogramme de tous les composants SAS-1 (modules NEM SAS-1 et modules de disque) vers une version prenant en charge la coexistence de modules SAS-1 et SAS-2. Vous devez effectuer cette mise à niveau avant d’insérer un composant SAS-2 tel que ce module serveur dans le châssis. Il faut au moins mettre à niveau tous les expandeurs SAS vers les modules NEM SAS-1 et les modules de disque Sun Blade 6000 vers la révision de microprogramme 5.04.03 (ou version ultérieure). Cette révision du microprogramme permet de faire coexister les périphériques SAS-1/SAS-2 dans le châssis du système modulaire Sun Blade 6000. Si vous utilisez des versions antérieures du microprogramme, vous risquez d’entraîner le blocage des périphériques SAS-2. Pour plus d’informations concernant les périphériques nécessitant une mise à niveau, la méthode d’obtention du microprogramme et la procédure de mise à niveau proprement dite, reportez -vous au document SAS-1/SAS-2 Compatibility Upgrade Guide. Ce document est disponible sur le site suivant : http://docs.sun.com/app/docs/prod/sparc.t3.1b#hicChapitre 1 Informations générales 7 Versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge Le système d’exploitation et le microprogramme sont préinstallés en usine. Le tableau suivant dresse la liste des versions du SE Oracle Solaris, du microprogramme et des logiciels prises en charge. Logiciel Versions prises en charge SE Oracle Solaris sur l’hôte du module serveur • 10 9/10 • (Minimum) SE 10 10/09 avec le bundle de patchs pour Oracle Solaris 10 9/10 Electronic Prognostics sur l’hôte du module serveur • 1.1 Remarque - Ce logiciel génère des avertissements précoces concernant des pannes de FRU potentielles. Microprogramme du système sur le module serveur (ID du patch qui offre cette version) Version minimale : 8.0.1.c (ILOM 3.0 inclus) (ID de patch 145666-01 ou version ultérieure) Oracle VM Server pour SPARC (LDoms) 2.0 Logiciel CMM (module d’administration châssis du châssis) Logiciel version 3.3 ou ultérieure8 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Informations sur les patchs Les patchs requis au moment où le module serveur était prêt à être expédié ont été installés en usine. Toutefois, en cas de réinstallation du système d’exploitation, consultez la liste ci-dessous afin d’identifier les patchs que vous aurez besoin d’installer. Patchs requis par le SE Oracle Solaris 10 9/10 : ¦ 143647-08 ou ultérieur ¦ 144488-03 ou ultérieur ¦ 144567-01 ou ultérieur ¦ 145868-01 ou ultérieur ¦ 145961-01 ou ultérieur Patchs requis par le SE Oracle Solaris 10 10/09 : ¦ Bundle de patchs pour Oracle Solaris 10 9/10 ¦ Tous les patchs requis pour Oracle Solaris 10 9/10 (voir la liste ci-dessus) ? Accès aux mises à jour du système d’exploitation, des patchs et du microprogramme 1. Accédez aux dernières informations concernant le SE, les patchs et le microprogramme à partir du portail d’administration système : http://www.oracle.com/technetwork/systems/softwarestacks/stacks/index.html 2. Sous l’en-tête Blade Servers (Serveurs lames), sélectionnez le lien SPARC T3-1B Server Module (Module serveur SPARC T3-1B).Chapitre 1 Informations générales 9 Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris Le SE Oracle Solaris utilise à présent les ID universels (WWID) au lieu du champ tn (ID cible) dans les noms de périphériques logiques pour tous les contrôleurs de stockage SAS 2.0, y compris les modules REM HBA SAS-2 RAID 0/1 Sun Blade 6000 (SG-SAS6-REM-Z) lors de l’installation dans le module serveur. Ce changement a un impact sur la méthode d’identification du disque cible lors du téléchargement du SE via le réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement : ¦ Lors du téléchargement du SE via un réseau, vous devez spécifier le disque inséré dans l’emplacement de disque dur (HDD) 0 comme destination. OBP utilise ce disque en tant que périphérique d’initialisation par défaut. ¦ Avant le passage aux noms WWID, ce disque était reconnu par le SE d’après son nom logique c0t0d0. Depuis ce changement, l’identificateur de périphérique du périphérique d’initialisation par défaut est désigné sous le nom c0tWWIDd0, où WWID correspond à une valeur hexadécimale. Or, cette valeur WWID n’est pas mappée de manière prévisible à l’ID physique du disque situé dans l’emplacement de disque dur HDD 0. Pour spécifier de manière fiable l’emplacement HDD 0 dans le cadre de l’opération de téléchargement du SE, vous devez déterminer la correspondance entre la valeur WWID de ce disque et son emplacement physique. Pour ce faire, exécutez probescsi-all et consultez la sortie de la commande. Dans la sortie de probe-scsi-all, recherchez les identi?cateurs de disque suivants : ¦ SASDeviceName : il s’agit du WWID reconnu par le SE Oracle Solaris. ¦ SASAddress : il s’agit du WWID auquel l’OpenBoot PROM fait référence. ¦ PhyNum : il s’agit de l’emplacement de disque dur (HDD) physique occupé par le disque. Ce nombre est également exprimé sous forme de valeur hexadécimale. Le module serveur est équipé d’un contrôleur SAS intégré, qui contrôle les quatre disques connectés. L’exemple suivant illustre la sortie de la commande probescsi-all pour un module serveur SPARC T3-1B doté de deux unités de disque.10 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Remarque – Dans l’exemple, le disque installé dans l’emplacement HDD 0 est doté d’une valeur PhyNum égale à 0, d’une valeur SASDeviceName égale à 5000c500231694cf et d’un nombre de cibles égal à 9. Exemple de profil Oracle Solaris Jumpstart L’exemple de profil Oracle Solaris Jumpstart suivant illustre l’utilisation de la syntaxe WWID dans le cadre de l’installation du SE sur une unité de disque précise. Le nom de périphérique SAS SASDeviceName provient de la précédente liste de configurations. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques. {0} ok probe-scsi-all /pci@400/pci@1/pci@0/pci@7/pci@0/usb@0,2/hub@5/storage@3 Unit 0 Removable Disk smiUnigen PSA4000 1100 /pci@400/pci@1/pci@0/pci@7/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@2/LSI,sas@0 <===== SAS Controller MPT Version 2.00, Firmware Version 4.05.52.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G0868 585937500 Blocks, 300 GB SASDeviceName 5000c500231694cf SASAddress 5000c500231694cd PhyNum 0 Target a Unit 0 Disk SEAGATE ST973402SSUN72G 0603 143374738 Blocks, 73 GB SASDeviceName 5000c50003d37fcb SASAddress 5000c50003d37fc9 PhyNum 1 # install_type flash_install boot_device c0t5000C500231694CFd0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapChapitre 1 Informations générales 11 Exemple d’installation interactive Dans une installation interactive, un message vous invite à spécifier un ou plusieurs disques comme cibles de l’installation du SE. Cette étape a pour objectif de s’assurer que l’installation dispose de suffisamment d’espace disque. Dans le cadre de cette étape, spécifiez le disque dont la valeur WWID correspond à l’unité de disque sur laquelle vous souhaitez installer le logiciel. Ces valeurs WWID sont illustrées dans l’exemple interactif suivant. L’unité de disque sélectionnée comme cible d’installation se trouve à l’emplacement HDD 0, l’emplacement OBP par défaut. Remarque – Si vous préférez utiliser un autre disque, vous pouvez le définir à la place de l’emplacement HDD 0. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000C50003D37FCBd0 286090 MB [X] c0t5000C500231694CFd0 286090 MB (F4 to edit) Total Selected: 286090 MB Suggested Minimum: 5032 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_Help12 Notes de produit du module serveur SPARC T3-1B • Décembre 201013 C H A P I T R E 2 Informations de dernière minute Ce chapitre présente les informations de dernière minute suivantes concernant le module serveur SPARC T3-1B : ¦ « Problèmes liés au matériel », page 13 ¦ « Problèmes liés au microprogramme du système », page 14 ¦ « Problèmes liés à ILOM », page 15 ¦ « Problèmes liés à Solaris », page 16 ¦ « Problèmes identifiés dans la documentation », page 23 Problèmes liés au matériel Risque d’erreur grave du module serveur lors de l’enfichage à chaud du module Express SFP+ à deux ports 10GbE (CR 6974235) Le retrait à chaud d’un module Express SFP+ à deux ports 10GbE connecté à un module serveur SPARC T3-1B via l’utilisation du bouton ATTN du module Express peut entraîner une erreur grave de la part du SE Oracle Solaris exécuté sur le module serveur. Vous pouvez utiliser en toute sécurité le bouton ATTN pour une installation à chaud du même module Express dans un emplacement connecté à un module serveur SPARC T3-1B. Solution : n’utilisez pas le bouton ATTN PCIe EM. Au lieu de cela, exécutez la commande cfgadm(1M) d’Oracle Solaris pour retirer à chaud un module Express SFP+ à deux ports 10GbE connecté à un module serveur SPARC T3-1B.14 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Par exemple, pour retirer à chaud un module Express installé dans l’emplacement PCI-EM1 à l’aide de la commande cfgadm, exécutez les commandes suivantes dans l’instance d’Oracle Solaris connectée au module Express : Remplacement rapide conseillé des modules DIMM défectueux présentant des erreurs incorrigibles (CR 6996144) Si un module DIMM présente une erreur incorrigible, le serveur générera une erreur de type fault.memory.bank, qui signale un module DIMM défectueux. Vous pouvez afficher cette erreur à l’aide de la commande show faulty ou la commande fmdump -v d’Oracle ILOM. Si un module DIMM du système contient une erreur incorrigible persistante (c.-à-d., qui se produit constamment, même après plusieurs redémarrages), remplacez-le dès que possible afin d’éviter toute indisponibilité du serveur. Solution : remplacez les modules DIMM défectueux dès que possible. Problèmes liés au microprogramme du système Link Width x8 Link Speed GEN1 : avertissement affiché lors de la mise sous tension (CR 6958263) Dans de rares occasions lors de la mise sous tension d’un module serveur SPARC T3-1B, le message d’erreur suivant peut s’afficher immédiatement avant que le système n’atteigne l’invite d’OBP : Solution : réinitialisez le système à l’invite d’OBP de la manière suivante : # cfgadm -c unconfigure PCI-EM1 # cfgadm -c disconnect PCI-EM1 WARNING: ios0, peun Link Width x8 Link Speed GEN1. ok reset-allChapitre 2 Informations de dernière minute 15 Dysfonctionnement de la désactivation de /SYS/MB/FEM0 au niveau du SP pour certains modules FEM (CR 6980646) Pour désactiver les ports NIU 10GbE SPARC T3-1B connectés via un module FEM d’intercommunication XAUI 10GbE, n’utilisez pas le nom NAC /SYS/MB/FEM0à partir de la CLI DMTF du logiciel ILOM. Solution : utilisez plutôt /SYS/MB/CMP0/NIUx. Par exemple, pour désactiver le port NIU 0, exécutez la commande suivante à partir du processeur de service : Problèmes liés à ILOM Impossibilité pour ILOM d’afficher les propriétés (CR 6992917) Il peut arriver (très rarement) que la CLI d’ILOM affichée sur le processeur de service du module serveur ne parvienne pas à afficher la propriété power_state et d’autres propriétés de ce type comme indiqué dans l’exemple suivant : Solution : utilisez l’une des méthodes suivantes : ¦ Si vous accédez à la CLI d’ILOM via la console série, réexécutez la commande. ¦ Si vous accédez à la CLI d’ILOM via une connexion ssh, réétablissez la connexion et réexécutez la commande. ¦ Dans les rares cas où les solutions susmentionnées ne résolvent pas le problème, réinitialisez le processeur de service de la manière suivante : -> set /SYS/MB/CMP0/NIU0 component_state=Disabled Set ’component_state’ to ’Disabled’ -> show -display properties /SYS power_state show: No matching properties found. -> reset /SP Are you sure you want to reset /SP (y/n)? y16 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 picld : messages consignés (CR 6992903) Occasionnellement, les messages d’avertissement suivants peuvent être consignés dans le fichier /var/adm/messages : Solution : ces messages ne présentent aucun danger et peuvent être ignorés en toute sécurité. Problèmes liés à Solaris prtdiag : numéro de série du module serveur étiqueté comme numéro de série de châssis (CR 6669159) Les dernières lignes de la sortie de la commande prtdiag -v affichent le numéro de série du module serveur sous la mention Chassis Serial Number (Numéro de série du châssis). Ce libellé est trompeur, car il peut être interprété comme le numéro de série du châssis du système modulaire. Solution : souvenez-vous que la commande prtdiag utilise l’appellation Chassis Serial Number pour faire référence au numéro de série du module serveur. picld[177]: [ID 629468 daemon.warning] PICL snmpplugin: cannot get entPhysicalName (row=xxx)Chapitre 2 Informations de dernière minute 17 Risque d’échec de la commande disktest d’Oracle VTS pour les périphériques USB (CR 6873719) Remarque – Oracle VTS s’appelait SunVTS. Les disques USB connectés au câble de dongle avant ou au port USB interne peuvent présenter une panne après l’exécution de la commande disktest d’Oracle VTS pendant plus de 5 heures. Solution : arrêtez les applications utilisant le port USB. Réinitialisez ensuite le port USB à l’aide de la commande cfgadm -x usb_reset [...]. Messages d’avertissement nxge erronés (CR 6938085) Pendant le fonctionnement normal de votre serveur, les messages d’avertissement suivants peuvent s’afficher sur la console système ou dans le fichier /var/adm/messages d’Oracle Solaris : Solution : ces messages ne présentent aucun danger et vous pouvez les ignorer en toute sécurité. date/heure nom_machine nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.018 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 fault.memory.memlink-uc : erreur d’interconnexion n’ayant pas causé d’erreur grave contrairement à ce qui est affirmé dans un article de la base de connaissances (CR 6940599) Lorsqu’une erreur d’interconnexion de type fault.memory.memlink-uc est détectée, le système devrait s’arrêter afin de protéger l’intégrité de la mémoire. De manière intermittente, cette panne a été signalée lors d’opérations d’initialisation sans que le système ne s’arrête. Même s’il est possible que ce comportement irrégulier indique la récupération effective du système suite à l’erreur de liaison de mémoire, et la restauration d’un état d’initialisation normal, la mesure à prendre la plus sûre consiste à effectuer une séquence de mise hors puis sous tension. Récupération : mettez progressivement sous tension le module serveur. Dégradation des performances réseau avec les modules EM PCIe 10GbE Sun Dual (CR 6943558) Une perte excessive de paquets a été observée suite à l’utilisation d’au moins deux ports sur plusieurs cartes EM PCIe 2.0 10GbE Sun Dual. De ce fait, les performances de transmission et de réception ont été considérablement dégradées. Solution : activez le contrôle de flux dans l’unité de disque ixgbe en procédant de la manière suivante. Cette action a pour effet de réduire considérablement la perte de paquets et d’améliorer les performances. En tant que superutilisateur, insérez la ligne suivante dans le fichier de configuration /kernel/drv/ixgbe.conf suivant : flow_control = 3; Redémarrez ensuite le module serveur.Chapitre 2 Informations de dernière minute 19 unsupported port mode : messages consignés dans le journal (CR 6962912) Lorsque vous utilisez un module FEM d’intercommunication XAUI 10GbE avec un module NEM incompatible (dans le cadre d’une combinaison NEM/FEM ne figurant pas sous « Composants modulaires pris en charge », page 4, par exemple), les messages suivants peuvent être consignés dans le fichier journal /var/adm/messages : Solution : assurez-vous que le module serveur est configuré selon la bonne combinaison NEM/FEM. Ces messages ne signalent pas la défaillance de composants matériels ou logiciels et peuvent être ignorés. Message d’interruption parasite affiché sur la console système (CR 6963563) Dans le cadre d’un fonctionnement normal ou de l’exécution du testeur de système Oracle VTS, vous pouvez voir le message suivant sur la console système ou dans le fichier /var/adm/messages : Solution : vous pouvez ignorer ces messages en toute sécurité. nxge: [ID 752849 kern.warning] WARNING: nxge1 : nxge_n2_kt_serdes_init:port<0> - unsupported port mode 8 nxge: [ID 752849 kern.warning] WARNING: nxge1 : nxge_n2_kt_serdes_init:port<1> - unsupported port mode 8 nxge: [ID 752849 kern.warning] WARNING: nxge1 : nxge_n2_serdes_init: Failed to initialize N2 serdes for port<0> nxge: [ID 752849 kern.warning] WARNING: nxge1 : nxge_n2_serdes_init: Failed to initialize N2 serdes for port<1> date / heure nom_hôte px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0xn date / heure nom_hôte px: [ID 548919 kern.info] ehci-0#0 date / heure nom_hôte px: [ID 100033 kern.info]20 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) Ce problème se produit uniquement lorsque vous êtes en train d’effectuer une installation à l’aide d’un clavier, d’une souris et d’un écran. Le système miniroot est un système de fichiers root initialisable comprenant la version minimale du SE Oracle Solaris requise pour démarrer le module serveur et configurer le système d’exploitation. Le système miniroot s’exécute uniquement pendant le processus d’installation. Lorsque le module serveur l’initialise au cours de la configuration initiale, les messages suivants peuvent s’afficher sur la console système : Le messages indique que le serveur Xsun sous le système miniroot Oracle Solaris ne parvient pas à détecter un pilote pris en charge par le périphérique graphique AST dans le processeur de service. Ces messages sont légitimes, car le système miniroot contient uniquement l’environnement Xsun alors que le tampon de mémoire AST (astfb) est uniquement pris en charge par l’environnement Xorg. L’environnement Xorg est inclus dans le système d’exploitation installé. Par conséquent, vous pouvez utiliser le périphérique graphique lorsque vous exécutez le SE installé. Solution : vous pouvez ignorer ces messages en toute sécurité. Erreurs de type devfasadmd pouvant survenir suite au retrait à chaud de modules EM PCIe (CR 6973637) L’utilisation du bouton ATTN pour préparer le retrait à chaud d’un module EM PCIe connecté à ce module serveur peut générer le l’erreur suivante : Solution : vous pouvez ignorer ces erreurs en toute sécurité. Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error. devfsadmd[202]: failed to lookup dev name for /pci@400/pci@2/pci@0/pci@1/.....Chapitre 2 Informations de dernière minute 21 Événement de rapport d’erreur (ereport) non généré pour un processeur de service endommagé (CR 6978171) Le rapport d’erreur (ereport) d’événement incorrect suivant est généré lorsque le processeur de service fonctionne dans un état endommagé : ereport.fm.fmd.module Toutefois, un processeur de service endommagé devrait générer le rapport ereport suivant : ereport.chassis.sp.unavailable Pour afficher les événements ereport, exécutez la commande fmdump -eV. Pour des instructions, reportez-vous à la page de manuel fmdump(1M). Solution : effacez toutes les erreurs du processeur de service afin de vous assurer que ce dernier fonctionne normalement. Génération d’événements de rapport d’erreur (ereport) erronés suite à l’initialisation du système alors que le processeur de service est endommagé (CR 6981297) Si le système démarre avec un processeur de service endommagé, le système génère un événement de rapport d’erreur (ereport) qui définit mal le problème. L’ereport devrait indiquer qu’il est impossible d’établir une connexion avec le processeur de service au lieu d’afficher le message suivant : msg = error: bad conn open during ver negot: errno 5 Pour afficher les événements ereport, exécutez la commande fmdump -eV. Pour des instructions, reportez-vous à la page de manuel fmdump(1M). Solution : effacez toutes les erreurs du processeur de service afin de vous assurer que ce dernier fonctionne normalement.22 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 Génération possible d’une erreur suite à l’initialisation ou à l’enfichage à chaud d’un module Express Connect X-2 QDR IB HCA (CR 6986528) La technologie d’autorétablissement prédictif d’Oracle Solaris détecte un événement d’erreur corrigible unique lorsque vous démarrez sous le SE Oracle Solaris avec un module Express Connect X-2 QDR IB HCA (X4243A) installé ou que vous enfichez à chaud ce périphérique. Cet événement d’erreur n’est pas important et vous pouvez l’ignorer en toute sécurité. Remarque – Si vous effectuez six opérations d’initialisation ou d’en?chage à chaud (ou plus) en moins de deux heures, les multiples événements d’erreur générés dans ce court laps de temps entraînent une erreur d’autorétablissement prédictif dans Oracle Solaris. Pour réparer cette erreur, reportez-vous à la section de la documentation d’Oracle Solaris portant sur la fonction d’autorétablissement prédictif. Solution : contactez votre fournisseur de services agréé pour obtenir une version du microprogramme résolvant ce problème. Blocage sans fin du processus Oracle Enterprise Manager (CR 6994300) Le processus Java Oracle Enterprise Manager peut se bloquer et devenir impossible à terminer sur le module serveur. Lorsque le processus Enterprise Manager se bloque, il continue à écouter sur son port d’interface graphique Web, vous empêchant d’y mettre un terme. Ce problème a été observé sur des serveurs exécutant à la fois Java SE 5.0 (livré avec le logiciel Oracle Database) et la dernière version téléchargeable de Java SE 6 Update 22. Solution : redémarrez le système. Si le problème se répète, contactez votre fournisseur de services agréé.Chapitre 2 Informations de dernière minute 23 nxge : pilote non chargé (CR 6995458) Si la version 10 10/09 d’Oracle Solaris est installée sur un module serveur SPARC T3-1B ainsi que le bundle de patchs pour Oracle Solaris 10 9/10, les ports NIU SPARC T3 risquent d’être inutilisables sous Oracle Solaris. Solution : ajoutez l’entrée suivante au fichier /etc/driver_aliases, puis redémarrez Oracle Solaris. nxge "SUNW,niusl-kt" Problèmes identifiés dans la documentation Guide de démarrage du module serveur SPARC T3-1B La procédure « Accès au logiciel ILOM installé sur le SP du module serveur » (page 4) du Guide de démarrage du module serveur SPARC T3-1B (réf. E21525-01) n’est peut-être pas suffisamment détaillée pour mener à bien cette tâche. Solution : reportez-vous à une version plus récente du Guide de démarrage du module serveur SPARC T3-1B. Autre possibilité, consultez la procédure « Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) » du Guide d’installation du module serveur SPARC T3-1B. Enfin, vous pouvez vous référer à ce manuel pour obtenir plus d’informations sur l’utilisation d’autres méthodes de connexion dans le cadre de l’installation.24 Notes de produit du module serveur SPARC T3-1B • Décembre 2010 SPARC T3-1B Server Module Product Notes Part Number: E23584-02 November 2011Please Recycle Review late-breaking information about the server module. Copyright © 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents 1. General Information 1 Supported Chassis 2 ? Identify the Chassis Midplane Version 2 Supported Modular Components 3 Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components 5 Supported Versions of Oracle Solaris OS, Firmware, and Software 6 Required Patches and Package Updates 6 ? Access OS, Patch, and Firmware Updates 6 Oracle Solaris 10 OS Patches 7 Oracle Solaris 11 OS Package Updates 7 Oracle Solaris OS Has Changed how It Specifies Logical Device Names 7 Oracle Solaris Jumpstart Example 9 Interactive Installation Example 10 2. Late-Breaking Information 11 Hardware Issues 11 Server Module Might Hang or Power Off When Hot-Plug Inserting a Drive Into HDD0-3 While a Storage Drive Is Being Accessed Through the Front USB Device Connection (CR 7078120) 11 Direct I/O Support 12iv SPARC T3-1B Server Module Product Notes • November 2011 Server Module Might Panic During Hot-Plugging of the 10GbE Dual Port SFP+ ExpressModule (CR 6974235) 12 Replace Faulty DIMMs With Uncorrectable Errors as Soon as Possible (CR 6996144) 13 Not Oracle Certified DIMM Warning Message (CR 7034912) 13 System Firmware Issues 14 Link Width x8 Link Speed GEN1 Warning Displayed During Power Up (CR 6958263) 14 Disabling /SYS/MB/FEM0 From the SP Level Does Not Work Correctly for Certain FEMs (CR 6980646) 14 ILOM Issues 15 ILOM Fails to Display Properties (CR 6992917) 15 picld Messages Logged (CR 6992903) 15 Solaris Issues 16 prtdiag Labels the Server Module Serial Number as the Chassis Serial Number (CR 6669159) 16 Oracle VTS disktest Might Fail on USB Devices (CR 6873719) 16 False nxge Warning Messages (CR 6938085) 16 fault.memory.memlink-uc Interconnect Fault Did Not Cause Panic as Stated by Knowledge Article (CR 6940599) 17 Degraded Network Performance When Using Sun Dual 10GbE PCIe EMs (CR 6943558) 17 Spurious Interrupt Message in System Console (CR 6963563) 17 Spurious Error Message During Initial Oracle Solaris OS Installation (CR 6971896) 18 Hot-Plug Removal of PCIe EMs Might Generate devfsadmd Errors (CR 6973637) 18 Error Report Event (ereport) Not Generated for a Degraded Service Processor (CR 6978171) 19 False Error Report Events (ereport) Generated When System Is Booted With a Degraded Service Processor (CR 6981297) 19Contents v Oracle Enterprise Manager Process Hangs and Becomes Unkillable (CR 6994300) 19 nxge Driver Not Loaded (CR 6995458) 20 Documentation Issues 20 Hardware RAID Guidelines are Missing from Administration Guide 20 SPARC T3-1B Server Module Getting Started Guide 21vi SPARC T3-1B Server Module Product Notes • November 20111 C H A P T E R 1 General Information These product notes provide important and late-breaking information about Oracle’s SPARC T3-1B server module. This document is for system administrators, technicians, service providers, and users who have experience administering computer systems. Documentation for the SPARC T3-1B server module is available online: http://www.oracle.com/pls/topic/lookup?ctx=E19332-01 This chapter provides the following general information about the SPARC T3-1B server module: ¦ “Supported Chassis” on page 2 ¦ “Supported Modular Components” on page 3 ¦ “Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components” on page 5 ¦ “Supported Versions of Oracle Solaris OS, Firmware, and Software” on page 6 ¦ “Required Patches and Package Updates” on page 6 ¦ “Oracle Solaris OS Has Changed how It Specifies Logical Device Names” on page 72 SPARC T3-1B Server Module Product Notes • November 2011 Supported Chassis The server module is supported in the modular system chassis listed in the following table. ? Identify the Chassis Midplane Version 1. Log into CMM ILOM. 2. Type: 3. View the fru_part_number field. ¦ 511-1298-xx identifies a PCIe 2.x type midplane. ¦ 511-1487-xx identifies a PCIe 2.x type midplane. ¦ 501-7376-xx identifies a PCIe 1.x type midplane. For further details, refer to the Sun Blade 6000 Modular System Product Notes. Modular System Chassis Supported Features Sun Blade 6000 modular system with PCIe 2.x midplane * * See “Identify the Chassis Midplane Version” on page 2. The server module supports SAS-1 and SAS-2 modular components. Gen2-capable PCIe EMs and NEMs connected to the SPARC T3-1B server module run at Gen2 speeds. Gen1-capable devices run at Gen1 speeds. Note - See “Important Firmware Upgrade Required Prior to Mixing SAS- 1 and SAS-2 Components” on page 5. Sun Blade 6000 modular system with PCIe 1.x midplane * The server module functions with the following requirements and limitations: • PCIe EMs and NEMs connected to the SPARC T3-1B server module run at Gen1 speeds regardless of their Gen1 or Gen2 capabilities. • Any SAS-1 NEMs installed in the chassis require a firmware upgrade. See “Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components” on page 5. • Storage devices on the server module that are connected to an onboard SAS-2 REM are supported and operate at SAS-2. • On-board SAS-2 REMs cannot be connected to SAS-1 disk or storage modules. -> show /CH/MIDPLANEChapter 1 General Information 3 Supported Modular Components The following table lists the modular components that are supported with the modular server. Note – For the latest information on hardware component requirements, refer to the product notes for your component. Product Model Number and Name Requirements Network Express Modules (NEMs) 7100091 (ATO) / 7100090 (PTO) – Sun Blade 6000 Virtualized 40 GbE Network Express Module This NEM requires the following: • For chassis requirements, refer to the Sun Blade 6000 Virtualized 40 GbE Network Express Module Product Notes. • The server module must use system firmware 8.0.4.c (minimum), which is provided by patch 145666-04. • For network connectivity – FEM 7100283 (ATO) / 7100633 (PTO). • For storage connectivity – SG-SAS6-REM-Z. NEM X4338A-N – Sun Blade 6000 Virtualized Multi-Fabric 10GbE M2 Network Express Module This NEM requires the following: • For SAS-2 functionality, the server module and NEM X4338A-N must be installed in a chassis with a PCIe 2.x midplane. See “Supported Chassis” on page 2. • For 10GbE network connectivity – FEM X4263A-N. • For storage connectivity – SG-SAS6-REM-Z. NEM X2073A-N – Sun Blade 6000 Ethernet Switched NEM 24p 10GbE This NEM requires the following: • For SAS-2 functionality, the server module and NEM X2073A-N must be installed in a chassis with a PCIe 2.x midplane. See “Supported Chassis” on page 2. • For 10GbE network connectivity – FEM X5735A or FEM 4871A-Z-N. • For storage connectivity – SG-SAS6-REM-Z. NEM X4238A-N – Sun Blade 6000 Virtualized Multi-Fabric 10GbE Network Express Module This NEM requires the following: • For 10GbE network connectivity – FEM X4263A-N. • For storage connectivity – SG-SAS6-REM-Z. NEM X4236A-N – Sun Blade 6000 10GbE Multi-Fabric Network Express Module This NEM requires the following: • For 10GbE network connectivity – FEM X5735A or FEM X4871A-Z-N. • For storage connectivity – SG-SAS6-REM-Z.4 SPARC T3-1B Server Module Product Notes • November 2011 X4250A-N – Sun Blade 6000 Network Express Module 10- port GbE pass through NEM This NEM requires the following: • For internal storage connectivity – SG-SAS6-REM-Z. Note - No FEM is required for network connectivity. RAID Express Modules (REMs) SG-SAS6-REM-Z – Sun Blade 6000 RAID 0/1 SAS2 HBA REM This REM requires the following: • Prior to installation, update firmware on SAS-1 components. See “Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components” on page 5. Fabric Expansion Modules (FEMs) 7100283 (ATO) / 7100633 (PTO) – PCIe-2 Pass-Through FEM This FEM requires the following: • Must be installed in FEM 0 and FEM 1 motherboard connectors. • The server module must use system firmware 8.0.4.c (minimum), which is provided by patch 145666-04. • The server module must be part number 7027112 or 7027109. If you have an earlier model of the server module (part number 541-4243 or 541-4197), contact your Oracle Service Provider before installing this FEM inside the server module. To see the server module’s part number, type: ->show /SYS/MB fru_part_number X5735A – 10GbE XAUI Pass-Through FEM Must be installed in FEM X and FEM 0 motherboard connectors. X4871A-Z – Dual 10GbE PCIe 2.0 FEM (Intel) Must be installed in the FEM 0 motherboard connector. X4263A-N – Dual 10GbE Pass-Through FEM Must be installed in FEM 0 and FEM 1 motherboard connectors. PCIe Expansion Modules (PCIe EMs) SGX-SAS6-EM-Z – SAS2 Dual Port Express Module SG-XPCIEFCGBE-Q8-Z – 2x8Gb FC and 2xGbE Combo Express Module Must have part number 371-4522-02 or a higher dash level. X7283A-Z-N – 1GbE Dual Port ExpressModule, Fiber Product Model Number and Name RequirementsChapter 1 General Information 5 Important Firmware Upgrade Required Prior to Mixing SAS-1 and SAS-2 Components You must upgrade the firmware of your SAS-1 components (SAS-1 NEMs and disk modules) to a firmware version that supports SAS-1/SAS-2 coexistence. You must perform this upgrade before you insert a SAS-2 component such as this server module into the chassis. At a minimum, you must upgrade all SAS expanders for SAS-1 NEMs and Sun Blade 6000 disk modules to firmware revision 5.04.03 (or later). This firmware revision enables SAS-1/SAS-2 devices to coexist in the Sun Blade 6000 modular system chassis. Using older firmware revisions might result in SAS-2 devices hanging. Refer to the SAS-1/SAS-2 Compatibility Upgrade Guide for details on which devices require the upgrade, how to obtain the firmware, and perform the upgrade. This guide is available at: http://www.oracle.com/pls/topic/lookup?ctx=E19332-01&id=homepage X7284A-Z-N – 1GbE Quad Port ExpressModule, Copper X1110A-Z – 10GbE Dual Port SFP+ Express Module X4243A – QDR IB HCA Connect X-2 Product Model Number and Name Requirements6 SPARC T3-1B Server Module Product Notes • November 2011 Supported Versions of Oracle Solaris OS, Firmware, and Software The OS and firmware are preinstalled at the factory. The following table lists the supported versions of Oracle Solaris OS, firmware, and software. Required Patches and Package Updates Note – Oracle Solaris 11 OS uses package updates rather than patches. ? Access OS, Patch, and Firmware Updates ? Access the latest OS, patches, and firmware information from: http://support.oracle.com Software Supported Versions Oracle Solaris OS on the server module host • 11 • 10 8/11 • 10 9/10 • (Minimum) 10 10/09 OS with Oracle Solaris 10 9/10 Patch Bundle Electronic Prognostics on the server module host • 1.1 Note - This software provides early warning of the potential for specific FRU faults. System firmware on server module (patch ID that provides this version) Minimum version: 8.0.1.c (includes ILOM 3.0) (patch ID 145666-01 or later) Oracle VM Server for SPARC (logical domains)) Minimum version: 2.0 Chassis management module (CMM) Software Software release 3.3 or laterChapter 1 General Information 7 Oracle Solaris 10 OS Patches Any patches that were known to be needed at the time your server module was prepared for shipment were installed at the factory. However, if you reinstall the OS, see the following lists to understand which patches you need to install. Required patches for Oracle Solaris 10 9/10 OS: ¦ 143647-08 or later ¦ 144488-03 or later ¦ 144567-01 or later ¦ 145868-01 or later ¦ 145961-01 or later Required patches for Oracle Solaris 10 10/09 OS: ¦ Oracle Solaris 10 9/10 Patch Bundle ¦ All required patches for Oracle Solaris 10 9/10 OS (listed above) Oracle Solaris 11 OS Package Updates INo package updates are required at this time to use Oracle Solaris 11 OS with this server module. You should install an Oracle Solaris 11 Support Repository Update (SRU), if available. Use the pkg command or the package manager GUI to download any available SRU from: https://pkg.oracle.com/solaris/support Oracle Solaris OS Has Changed how It Specifies Logical Device Names The Oracle Solaris OS now uses world wide ID (WWID) in place of the tn (target ID) field in logical device names for all SAS 2.0 storage controllers including the Sun Blade 6000 RAID 0/1 SAS2 HBA REM (SG-SAS6-REM-Z) when installed in this server module. Note – Refer to the SPARC T3 Series Server Administration Guide for more information about device IDs.8 SPARC T3-1B Server Module Product Notes • November 2011 This change affects how you identify the target disk when downloading the OS over a network. The following points are key to understanding the impact of this change: ¦ When downloading the OS over a network, specify the disk in HDD slot 0 as the download destination. OBP uses this disk as the default boot device. ¦ Before the change to using WWIDs, this disk was known to the OS by the logical name c0t0d0. With the change, the device identifier for the default boot device is now referred to as c0tWWIDd0, where WWID is a hexadecimal value. This WWID value does not map in a predictable way to the physical ID of the disk in HDD slot 0. To reliably specify HDD slot 0 for the OS download operation, you must determine the correspondence between the WWID value for that drive and its physical location. Oracle Solaris 10 8/11 OS includes a diskinfo (1M) command that is the easiest way of finding the WWID for the device at a physical location. For example, If you are using a release of Oracle Solaris that does not provide the diskinfo command, or if you need this information when you are not at the Oracle Solaris level, you also can determine the WWID value for a disk at a physicial location by running probe-scsi-all and reading the output. In the probe-scsi-all output, look for the following disk identifiers: ¦ SASDeviceName – This is the WWID that the Oracle Solaris OS recognizes. ¦ SASAddress – This is the WWID that the OpenBoot PROM references. ¦ PhyNum – This is the physical HDD slot that the disk occupies. This number is also expressed as a hexadecimal value. Your server module has one on-board SAS controller, which controls all four connected drives. The following example shows probe-scsi-all output for a SPARC T3-1B server module with two drives. # diskinfo -a Enclosure path: 0703NNY01U-physical-hba-1 Chassis Serial Number: 0703NNY01U-physical-hba-1 Chassis Model: ORCL,SPARC-T3-1B Label Disk name Vendor Product Vers ---------- ---------------------- -------- ---------------- ---- /SYS/HDD0 c0t5000CCA0150CA5F0d0 HITACHI H103030SCSUN300G A2A8 /SYS/HDD1 c0t5000CCA0150C9D58d0 HITACHI H103030SCSUN300G A2A8 #Chapter 1 General Information 9 Note – In the example, the disk installed in HDD slot 0 has a PhyNum value of 0, the SASDeviceName is 5000c500231694cf, and the Target number is 9. Oracle Solaris Jumpstart Example The following Oracle Solaris Jumpstart profile example shows how to use the WWID syntax when installing the OS on a specific disk drive. The SASDeviceName is taken from the previous configuration listing. Note – The Oracle Solaris syntax rules require all alpha characters to be capitalized. {0} ok probe-scsi-all /pci@400/pci@1/pci@0/pci@7/pci@0/usb@0,2/hub@5/storage@3 Unit 0 Removable Disk smiUnigen PSA4000 1100 /pci@400/pci@1/pci@0/pci@7/pci@0/usb@0,2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@2/LSI,sas@0 <===== SAS Controller MPT Version 2.00, Firmware Version 4.05.52.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G0868 585937500 Blocks, 300 GB SASDeviceName 5000c500231694cf SASAddress 5000c500231694cd PhyNum 0 Target a Unit 0 Disk SEAGATE ST973402SSUN72G 0603 143374738 Blocks, 73 GB SASDeviceName 5000c50003d37fcb SASAddress 5000c50003d37fc9 PhyNum 1 # install_type flash_install boot_device c0t5000C500231694CFd0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap10 SPARC T3-1B Server Module Product Notes • November 2011 Interactive Installation Example In an interactive installation, you are asked to specify one or more disks as the targets for the OS installation. The purpose of this step is to ensure that enough disk capacity is provided for the installation. For this step, specify the disk with the WWID value corresponding to the drive on which you want to install the software. These WWID values are illustrated in the following interactive example,. The drive selected as the install target is located in HDD slot 0, the default OBP location. Note – If some other disk is preferred, you can specify it instead of the one in HDD slot 0. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000C50003D37FCBd0 286090 MB [X] c0t5000C500231694CFd0 286090 MB (F4 to edit) Total Selected: 286090 MB Suggested Minimum: 5032 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_Help11 C H A P T E R 2 Late-Breaking Information This chapter provides the following late-breaking information for the SPARC T3-1B server module: ¦ “Hardware Issues” on page 11 ¦ “System Firmware Issues” on page 14 ¦ “ILOM Issues” on page 15 ¦ “Solaris Issues” on page 16 ¦ “Documentation Issues” on page 20 Hardware Issues Server Module Might Hang or Power Off When Hot-Plug Inserting a Drive Into HDD0-3 While a Storage Drive Is Being Accessed Through the Front USB Device Connection (CR 7078120) Workaround: Do not hot-plug insert a drive in slots HDD0 through HDD3 while a device is connected to the USB connector on the dongle cable. In certain other situations, when you hot-plug a drive, warning messages are displayed that are similar to these: tvt-230 scsi: WARNING: /scsi_vhci/disk@g5000cca00a603b38 (sd0): tvt-230 Error for Command: write(10) Error Level: Retryable tvt-230 scsi: Requested Block: 26998912 Error Block: 2699891212 SPARC T3-1B Server Module Product Notes • November 2011 If a device was not connected to the USB connector on the dongle cable, these messages are harmless and can be safely ignored. Direct I/O Support Only certain PCIe cards can be used as direct I/O endpointdevices on an I/O domain. You can still use other cards in your Oracle VM Server for SPARC environment, but they cannot be used with the Direct I/O feature. Instead, they can be used for service domains and for I/O domains that have entire root complexes assigned to them. For the most up-to-date list of supported PCIe cards, refer to: https://support.oracle.com/CSP/main/article?cmd+show&type= NOT&doctype+REFERENCE&id+1325454.1 Server Module Might Panic During Hot-Plugging of the 10GbE Dual Port SFP+ ExpressModule (CR 6974235) Initiation of a hot-plug removal of a 10GbE Dual Port SFP+ Express Module connected to a SPARC T3-1B server module by using the Express Module’s ATTN button might cause the Oracle Solaris OS that is running on the server module to panic. You can safely use the ATTN button to hot-plug insert the same Express Module into a slot that connects to a SPARC T3-1B server module. tvt-230 scsi: Vendor: HITACHI Serial Number: 1005GPXMUE tvt-230 scsi: Sense Key: Unit Attention tvt-230 scsi: ASC: 0x29 (power on occurred), ASCQ: 0x1, FRU: 0x16 tvt-230 scsi: WARNING: /scsi_vhci/disk@g5000cca00a603b38 (sd0): tvt-230 Error for Command: write(10) Error Level: Retryable tvt-230 scsi: Requested Block: 26998912 Error Block: 26998912 tvt-230 scsi: Vendor: HITACHI tvt-230 scsi: Sense Key: Not Ready tvt-230 scsi: ASC: 0x4 (LUN is becoming ready), ASCQ: 0x1, FRU: 0x2 tvt-230 scsi: WARNING: /scsi_vhci/disk@g5000cca00a603b38 (sd0): tvt-230 Error for Command: write(10) Error Level: Retryable tvt-230 scsi: Requested Block: 26998912 Error Block: 26998912 tvt-230 scsi: Vendor: HITACHI Serial Number: 1005GPXMUE tvt-230 scsi: Sense Key: Not Ready tvt-230 scsi: ASC: 0x4 (LUN is becoming ready), ASCQ: 0x1, FRU: 0x2Chapter 2 Late-Breaking Information 13 Workaround: Do not use the PCIe EM ATTN button. Instead, use the Oracle Solaris cfgadm(1M)command to hot-plug remove a 10GbE Dual Port SFP+ Express Module connected to a SPARC T3-1B server module. For example, to hot-plug remove an express module in slot PCI-EM1 using cfgadm, perform the following commands in the Oracle Solaris instance connected to the Express Module: Replace Faulty DIMMs With Uncorrectable Errors as Soon as Possible (CR 6996144) This issue is fixed in the Oracle Solaris 10 8/11 OS. If a DIMM has an uncorrectable error (UE), the server will generate a fault.memory.bank error that labels a DIMM as faulty. You can view this error using the Oracle ILOM show faulty command or using the fmdump -v command. If a DIMM in your system contains a persistent uncorrectable error (an error that continually occurs even after multiple reboots), replace this DIMM as soon as possible to avoid any server downtime. Workaround: Replace faulty DIMMs as soon as possible. Not Oracle Certified DIMM Warning Message (CR 7034912) After installing supported optional component DIMMs shipped from Oracle Corporation or from a certified Oracle reseller, or after replacing a failed DIMM with a field-replaceable unit (FRU) DIMM, you might see warning messages similar to the following: The system displays these messages because optional component and FRU DIMMs have not been marked as certified. Oracle certifies only DIMMs that ship installed in a system from the factory. Although Oracle has not certified these DIMMs, they are still supported. You can safely ignore these warning messages. # cfgadm -c unconfigure PCI-EM1 # cfgadm -c disconnect PCI-EM1 [CPU 0:0:0:] WARNING: /SYS/MB/CMP0/BOB0//CH0/D0: Not Oracle Certified14 SPARC T3-1B Server Module Product Notes • November 2011 System Firmware Issues Link Width x8 Link Speed GEN1 Warning Displayed During Power Up (CR 6958263) This is fixed in SysFW 8.0.4.c and higher. On rare occasions while powering up a SPARC T3-1B server module, the following error message might be displayed just before the system reaches the OBP prompt: Workaround: Reset the system at the OBP prompt as follows: Disabling /SYS/MB/FEM0 From the SP Level Does Not Work Correctly for Certain FEMs (CR 6980646) To disable SPARC T3-1B NIU 10GbE ports connected through a 10GbE XAUI PassThrough FEM, do not use the /SYS/MB/FEM0 NAC name from the ILOM DMTF CLI. Workaround: Instead use /SYS/MB/CMP0/NIUx. For example, to disable NIU port 0, use the following command from the SP: WARNING: ios0, peun Link Width x8 Link Speed GEN1. ok reset-all -> set /SYS/MB/CMP0/NIU0 component_state=Disabled Set ’component_state’ to ’Disabled’Chapter 2 Late-Breaking Information 15 ILOM Issues ILOM Fails to Display Properties (CR 6992917) On rare occasions, the ILOM CLI on the server module’s service processor might be unable to display the power_state and other such properties as shown in the following example: Workaround: Perform one of the following workarounds: ¦ If you are accessing the ILOM CLI through the serial console, retry the command. ¦ If you are accessing the ILOM CLI through an ssh connection, re-establish the connection and retype the command. ¦ In the rare case where the above workarounds do not mitigate the issue, reset the service processor as follows: picld Messages Logged (CR 6992903) Occasionally, the following warning messages might be logged in the /var/adm/messages file: Workaround: These messages are harmless and can be safely ignored. -> show -display properties /SYS power_state show: No matching properties found. -> reset /SP Are you sure you want to reset /SP (y/n)? y picld[177]: [ID 629468 daemon.warning] PICL snmpplugin: cannot get entPhysicalName (row=xxx)16 SPARC T3-1B Server Module Product Notes • November 2011 Solaris Issues prtdiag Labels the Server Module Serial Number as the Chassis Serial Number (CR 6669159) The last few lines of the prtdiag -v output display the server module serial number as the Chassis Serial Number. This label is misleading because it might be interpreted as the modular system chassis serial number. Workaround: Be aware that the prtdiag Chassis Serial Number is the server module serial number. Oracle VTS disktest Might Fail on USB Devices (CR 6873719) Note – Oracle VTS was formerly known as SunVTS. USB disks connected to the front dongle cable or the internal USB port might fail after running the Oracle VTS disktest for over 5 hours. Workaround: Stop any application that is using the USB. Then reset the USB port with the cfgadm -x usb_reset [...] command. False nxge Warning Messages (CR 6938085) This issue is fixed in the Oracle Solaris 10 8/11 OS. During the normal operation of your server, you might see the following warning messages in the system console or in the Oracle Solaris /var/adm/messages file: Workaround: These messages are harmless, and you can ignore them. date/time machinename nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.0Chapter 2 Late-Breaking Information 17 fault.memory.memlink-uc Interconnect Fault Did Not Cause Panic as Stated by Knowledge Article (CR 6940599) When a fault.memory.memlink-uc interconnect fault is detected, the system should shut down to protect memory integrity. On intermittent occasions, this fault has been reported during boot operations without the system shutting down. Although it is possible that this irregular behavior indicates that the system was able to recover from the memory link error and restore a healthy boot-up state, the safest action is to perform a power-down and power-up sequence. Recovery: Power cycle the server module. Degraded Network Performance When Using Sun Dual 10GbE PCIe EMs (CR 6943558) Excessive packet loss can occur when two or more ports are used across multiple Sun Dual 10GbE PCIe 2.0 PCIe EMs. As a result, transmit and receive performance is significantly degraded. Workaround: Enable flow control in the ixgbe driver by performing the following procedure. This action greatly reduces packet loss and improves performance. As superuser, add the following line in the /kernel/drv/ixgbe.conf file: flow_control = 3; Then reboot the server module. Spurious Interrupt Message in System Console (CR 6963563) During normal operation and when running the Oracle VTS system exerciser, you might see the following message in the system console or in the /var/adm/messages file: date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0xn date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info]18 SPARC T3-1B Server Module Product Notes • November 2011 Workaround: You can safely ignore these messages. Spurious Error Message During Initial Oracle Solaris OS Installation (CR 6971896) This issue only occurs when you are performing an installation using a keyboard, mouse, and monitor. The miniroot is a bootable root file system that includes the minimum Oracle Solaris OS software required to boot the server module and configure the OS. The miniroot runs only during the installation process.When the server module boots the miniroot for the initial configuration, you might see the following messages in the system console: The messages indicate that the Xsun server in the Oracle Solaris OS miniroot cannot find a supported driver for the AST graphics device in the service processor. These messages are expected because the miniroot contains only the Xsun environment, and the AST frame buffer (astfb) is supported only in the Xorg environment. The Xorg environment is included in the installed OS. Therefore, you can use the graphics device when running the installed OS. Workaround: You can safely ignore these messages. Hot-Plug Removal of PCIe EMs Might Generate devfsadmd Errors (CR 6973637) For PCIe EMs connected to this server module, using the ATTN button to prepare a PCIe EM for hot-plug removal might generate the following error: Workaround: You can safely ignore these errors. Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error. devfsadmd[202]: failed to lookup dev name for /pci@400/pci@2/pci@0/pci@1/.....Chapter 2 Late-Breaking Information 19 Error Report Event (ereport) Not Generated for a Degraded Service Processor (CR 6978171) This issue is fixed in the Oracle Solaris 10 8/11 OS. The following incorrect event error report (ereport) is generated if the service processor is operating in a degraded state: ereport.fm.fmd.module However, a degraded service processor should generate the following ereport: ereport.chassis.sp.unavailable To view ereport events, use the fmdump -eV command. Refer to the fmdump(1M) man page for instructions. Workaround: Clear all service processor faults to ensure that the service processor operates in a normal state. False Error Report Events (ereport) Generated When System Is Booted With a Degraded Service Processor (CR 6981297) This issue is fixed in the Oracle Solaris 10 8/11 OS. If the system boots with a degraded service processor, the system generates an error report event (ereport) that does not accurately state the problem. The ereport should state that it cannot make a connection to the service processor instead of the following false ereport: msg = error: bad conn open during ver negot: errno 5 To view ereport events, use the fmdump -eV command. Refer to the fmdump(1M) man page for instructions. Workaround: Clear all service processor faults to ensure that the service processor operates in a normal state. Oracle Enterprise Manager Process Hangs and Becomes Unkillable (CR 6994300) This issue is fixed in the Oracle Solaris 10 8/11 OS.20 SPARC T3-1B Server Module Product Notes • November 2011 The Oracle Enterprise Manager Java process can hang and become unkillable on the server module. When the Enterprise Manager process hangs, it continues to listen on its web UI port, which makes the process unkillable. This problem has been seen on servers running both the Java SE 5.0 version that is bundled with Oracle Database software and with the most recent downloadable Java SE 6 Update 22 version. Workaround: Reboot the system. If the problem repeats, contact your authorized service provider. nxge Driver Not Loaded (CR 6995458) If Oracle Solaris 10 10/09 is installed on a SPARC T3-1B server module along with Oracle Solaris 10 9/10 Patch Bundle, the SPARC T3 NIU ports might be unusable on Oracle Solaris. Workaround: Add the following entry to the /etc/driver_aliases file and then reboot Oracle Solaris. nxge "SUNW,niusl-kt" Documentation Issues Hardware RAID Guidelines are Missing from Administration Guide The following points are important to understand when configuring RAID volumes on a SPARC T3-1B server module: ¦ Before configuring and using RAID disk volumes on a SPARC T3-1B server module, ensure that you have installed the latest patches for your operating system from here: https://pkg.oracle.com/solaris/support ¦ Volume migration (relocating all RAID volume disk members from one SPARC T3-1B server module to another) is not supported. If you must perform this operation, contact your authorized Oracle service provider. Caution – Creating RAID volumes using on-board disk controllers destroys all data on member disks.Chapter 2 Late-Breaking Information 21 This information is not provided in the current version of the SPARC T3 Series Servers Administration Guide. SPARC T3-1B Server Module Getting Started Guide The procedure “Access ILOM on the Server Module SP” on page 4 of the SPARC T3- 1B Server Module Getting Started Guide (821-1923-10) might not provide sufficient detail for successful completion of this task. Workaround: Refer to a more recent release of the SPARC T3-1B Server Module Getting Started Guide. Or refer to the “Connect Through the Ethernet Port of the Modular System CMM (Web Interface)” procedure in the SPARC T3-1B Server Module Installation Guide. Also refer to that manual for details on using other connection methods for installation.22 SPARC T3-1B Server Module Product Notes • November 2011 1 Ce guide décrit la procédure minimale requise pour installer et mettre sous tension pour la première fois le module serveur SPARC T3-1B d’Oracle. Pour plus d’informations sur l’installation, reportez-vous au Guide d’installation du module serveur SPARC T3-1B ainsi qu’au guide d’installation de votre système modulaire Sun Blade 6000. Les URL de la documentation en ligne sont indiquées à la section « Accès à des informations complémentaires », page 6. Remarque – Avant d’installer ce module serveur, lisez la version la plus récente des Notes de produit du module serveur SPARC T3-1B afin de découvrir si des problèmes de dernière minute ont une incidence sur la configuration d’installation requise. Contenu du kit de livraison ?Installation de composants optionnels ? Avant d’installer le module serveur dans le châssis du système modulaire, installez (le cas échéant) les composants optionnels que vous avez commandés à des fins d’utilisation avec le module serveur. Il se peut que les composants optionnels soient déjà installés dans le module serveur que vous avez reçu. Pour plus de détails, consultez la fiche d’informations client. Pour obtenir des instructions sur l’installation des composants optionnels, reportez-vous à la documentation relative à chaque composant ainsi qu’au SPARC T3-1B Server Module Service Manual. Légende de la figure 1 Documentation imprimée 2 Module serveur 3 Carton d’emballage 4 Fiche d’informations client (à conserver pour les adresses MAC et autres données utiles) Module serveur SPARC T3-1B Guide de démarrage 1 This guide describes the minimum steps required to install and power on Oracle’s SPARC T3-1B server module for the first time. Before performing the procedures in this guide, consider reviewing the following documents ¦ Sun Blade 6000 Modular System Installation Guide - You must install the Sun Blade 6000 modular system chassis before you can install the server module. ¦ SPARC T3-1B Server Module Product Notes - Find out if any late-breaking issues impact installation requirements. ¦ SPARC T3-1B Server Module Installation Guide - Use this guide if you want more detailed installation information. For information about obtaining these documents, see “Related Documentation” on page 6. Shipping Kit Contents Figure Legend 1 Printed documentation 2 Server module 3 Shipping carton 4 Customer information sheet (save this for MAC addresses and other information) SPARC T3-1B Server Module Getting Started Guide2 ?Install Optional Components ? Before installing the server module into the modular system chassis, install any optional components that you ordered for the server module. Optional components might already be installed in the server module you received. Refer to the customer information sheet for details. For instructions on installing optional components, refer to the documentation for each component and the SPARC T3-1B Server Module Service Manual. ?Install the Server Module Into the Chassis The server module is hot-pluggable in the chassis. The instructions in this guide assume that the Sun Blade 6000 modular system is installed, and is up and running. 1. Remove the filler panel from the desired server module slot in the chassis. Be ready to insert the server module or a filler panel in the empty slot within 60 seconds. 2. Insert the server module in the chassis (pane 1) until it is about 1.5 cm (.5 in.) from the front of the chassis. The side of the server module with the service label faces to your right. 3. Extend the ejector levers (pane 2), then push the ejector levers in simultaneously until they lock in place (pane 3).3 4. Verify the server module insertion by checking the green OK LED on the server module (pane 4). When the server module is plugged in, standby power is supplied to the service processor (SP). The front panel LEDs blink three times, then the green OK LED on the front panel blinks for a few minutes. The server module SP generates diagnostic messages as soon as the server module is connected to a powered modular system. Caution – For proper cooling, ensure that all slots are filled with a server module or a filler panel. Fill all slots within 60 seconds after the modular system is connected to power. ?Determine Your Connection Method You can start, boot, and manage the server module using the Oracle Integrated Lights Out Manager (ILOM) software that runs on the server module SP. You can also control the server module from Oracle ILOM running on the chassis management module (CMM) of the modular system. There are several ways that you can connect to the server module SP. ? Connect to the server module using one of the methods shown in the following figure and table. This guide uses method 1, but you can use the other methods as described in the SPARC T3-1B Server Module Installation Guide.4 ?Access Oracle ILOM on the Server Module SP (Web Interface) This procedure is for method 1 in “Determine Your Connection Method” that uses a web interface through the CMM to access the server module Oracle ILOM CLI. You must know the CMM IP address to perform this procedure. This procedure also assumes you have a DHCP environment. For other environments, refer to instructions in the SPARC T3-1B Server Module Installation Guide. 1. Ensure that the CMM NET MGT port is connected and configured to communicate on your network. Refer to the Sun Blade 6000 modular system documentation for details. 2. In a browser on the same network as the modular system, enter the IP address of the CMM. For example, if your CMM has the IP address 129.99.99.99, direct your browser to that address. A login window for Oracle ILOM will appear. 3. Log in to Oracle ILOM on the CMM by typing your user name and password. The factory default Oracle ILOM root password is changeme. You are now logged in to the CMM Oracle ILOM web interface. 4. Navigate to the server module SP. a. Select the chassis view for the modular system. b. Click on the image of the server module that you have installed in the modular system. The slots in the modular system are numbered from 0 to 9. Method Connection Description 1 Ethernet From: CMM NET MGT port To: Your network Ensure that the CMM NET MGT port is connected to your network. From your network, log into Oracle ILOM on the CMM using the IP address of the CMM. Use the Oracle ILOM proxy to navigate to the server module SP Oracle ILOM interface. You can use the Oracle ILOM command-line interface (CLI) or use the CMM Oracle ILOM web interface. See “Access Oracle ILOM on the Server Module SP (Web Interface)” for details on this method. 2 Serial From: CMM SER MGT port To: Terminal device Connect a terminal device to the CMM SER MGT RJ-45 port and use Oracle ILOM to navigate to the server module SP Oracle ILOM interface. This method only supports the Oracle ILOM CLI. Refer to the SPARC T3-1B Server Module Installation Guide for details on this connection method. After you have established this connection, see “Power On the Server Module Host” . 3 Serial From: Server module SP UCP port (dongle required) To: Terminal device Connect a UCP-3 dongle cable to the server module. Connect a terminal device to the RJ-45 connector on the dongle cable. Communicate with Oracle ILOM on the server module SP using the Oracle ILOM CLI. Refer to the SPARC T3-1B Server Module Installation Guide for details on this connection method. After you have established this connection, see “Power On the Server Module Host”5 5. Start the Remote Console. a. Select Remote Control on the top menu. b. Select the Redirection tab. c. Click on Use serial redirection. d. Click on Launch Remote Console. 6. Power on the server module. a. Select the Remote Power Control tab. b. Click on the menu in that tab and select Power On. c. Select Save. d. Select OK when you see this prompt: Are you sure you want to perform a Power On of the server. The server module host is powered on for the first time. The server module hardware installation is complete and the server module is ready to be configured to suit your needs. For details on the Oracle Solaris OS configuration process, refer to the SPARC T3-1B Installation Guide and the installation guides for your version of Oracle Solaris OS. ?Power On the Server Module Host If you used a command line method to access the server module SP, rather than use the procedure in “Access Oracle ILOM on the Server Module SP (Web Interface)” , you need to use this procedure to power on the server module host. 1. Power on the server module host. The server module initializes. 2. Switch communication to the server module host. The server module might take several minutes to complete POST. If a boot device installed with the Oracle Solaris OS is accessible locally, the server module boots. Otherwise, the system uses the boot net command to seek a boot device on the network. You are now connected to the server module host. The server module hardware installation is complete, and you can configure the server module to suit your needs. For details on the Oracle Solaris OS configuration process, refer to the SPARC T3-1B Server Module Installation Guide and the installation guides for your version of Oracle Solaris OS. -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS . . . -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.6 ?Check for the Latest OS, Patches, and Firmware Later versions of OS, patches, and firmware might be available for your server module. Some features can only be enabled when certain patches or firmware are installed. Install the latest available versions for the best performance, security, and stability. 1. Review the SPARC T3-1B Server Module Product Notes at: http://download.oracle.com/docs/cd/E19332-01 This document describes important product dependencies and late-breaking information. 2. Access the latest OS, patches, and firmware information from the system administration portal: http://www.oracle.com/technetwork/systems/software-stacks/stacks Under the Blade Servers heading, click the SPARC T3-1B Server Module link. Related Documentation Support and Accessibility Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T3-1B server module http://download.oracle.com/docs/cd/E19332-01 Sun Blade 6000 modular system http://download.oracle.com/docs/cd/E19938-01 Oracle Integrated Lights Out Manager (ILOM) http://download.oracle.com/docs/cd/E19860-01 Description Links Access electronic support through My Oracle Support. https://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility. http://www.oracle.com/us/corporate/accessibility Copyright © 2010, 2011 Oracle and/or its affiliates. All rights reserved. Copyright © 2010, 2011 Oracle et/ou ses affiliés. Tous droits réservés. Part No: E23442-01, Mfg. No. 7020934 July 2011 Module serveur SPARC T3-1B Guide d’installation N° de référence : E21531-01 Décembre 2010, révision AProduit recyclable Copyright © 2010 Oracle et/ou ses sociétés af?liées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modi?ées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des États-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modi?cation et l’adaptation sont soumises aux restrictions et conditions de licence dé?nies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, États-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés af?liées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Table des matières Utilisation de cette documentation v Planification de l’installation 1 Inventaire du kit de livraison 2 Fonctions 4 Spécifications 5 Spécifications physiques 5 Spécifications électriques 5 Planification du site 6 Logiciels préinstallés 6 Composants des panneaux avant et arrière 7 Câblage du module serveur 8 ? Planification des communications avec le module serveur lors de l’installation 11 Installation du module serveur 15 Précautions de manipulation 15 Précautions contre les décharges électrostatiques 16 Outils nécessaires lors de l’installation 16 Installation des composants optionnels 17 Préparation du châssis de système modulaire 18 ? Pour installer le module serveur dans le châssis 19iv Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Communication avec le module serveur lors du démarrage 21 ? Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) 22 ? Pour se connecter via le port Ethernet du CMM du système modulaire (CLI) 23 ? Pour se connecter via le port série CMM du système modulaire 25 ? Pour se connecter via le port UCP du panneau avant du serveur 27 ? Pour contrôler les messages de diagnostic 28 Mise sous tension initiale du module serveur 29 Présentation des tâches de mise sous tension initiale 30 ? Pour mettre le système sous tension pour la première fois 30 ? Pour configurer le système 31 ? Pour installer le logiciel Oracle Solaris à partir du réseau 32 Paramètres de configuration d’Oracle Solaris 32 ? Pour assigner une adresse IP statique au processeur de service 34 Glossaire 37 Index 43v Utilisation de cette documentation Ce document contient des instructions, des informations de base et des documents de référence destinés à faciliter l’installation du module serveur SPARC T3-1B d’Oracle dans le système modulaire Sun Blade 6000 d’Oracle. ¦ « Documentation connexe », page v ¦ « Documentation, support et formation », page vi Documentation connexe Les documents mis en ligne sont disponibles à l’adresse suivante : (http://docs.sun.com/app/docs/prod/sparc.t3.1b#hic) Application Titre Format Emplacement Notes de produit Notes de produit du module serveur SPARC T3-1B PDF En ligne Guide de démarrage Guide de démarrage du module serveur SPARC T3-1B Imprimé Livré avec le système Installation, administration et maintenance SPARC T3-1B Server Module Topic Set HTML En ligne Installation Guide d’installation du module serveur SPARC T3-1B PDF HTML En ligne Administration Guide d’administration des serveurs de la série SPARC T3 PDF HTML En ligne Mode maintenance SPARC T3-1B Server Module Service Manual PDF HTML En ligne Sécurité SPARC T3-1B Server Module Safety and Compliance Manual PDF En ligne Mises à jour du microprogramme du système modulaire SAS-1/SAS-2 Compatibility Upgrade Guide PDF En lignevi Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Remarque – Le Guide d’administration des serveurs de la série SPARC T3 s’applique à plusieurs serveurs et modules serveur. Certains exemples utilisés dans ce document font référence à des produits autres que ce modèle de module serveur. Documentation, support et formation Ces sites proposent des ressources supplémentaires : ¦ Documentation (http://docs.sun.com) ¦ Support (http://www.sun.com/support) ¦ Formation (http://www.sun.com/training)1 Planification de l’installation Ces rubriques sont destinées à faciliter la planification de l’installation du module serveur. ¦ « Inventaire du kit de livraison », page 2 ¦ « Fonctions », page 4 ¦ « Spécifications », page 5 ¦ « Planification du site », page 6 ¦ « Logiciels préinstallés », page 6 ¦ « Composants des panneaux avant et arrière », page 7 ¦ « Câblage du module serveur », page 8 ¦ « Planification des communications avec le module serveur lors de l’installation », page 11 Informations connexes ¦ « Installation du module serveur », page 152 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Inventaire du kit de livraison FIGURE : Contenu du kit de livraison La fiche d’informations client comprend des informations complémentaires sur le matériel et les logiciels optionnels déjà installés sur le module serveur. Légende de la figure 1 Documentation imprimée, y compris le Guide de démarrage 2 Module serveur 3 Carton d’emballage 4 Fiche d’informations client (à l’extérieur du carton d’emballage). À conserver, car elle contient l’adresse MAC et d’autres informations relatives au matériel et aux logiciels installés.Planification de l’installation 3 Informations connexes ¦ « Fonctions », page 4 ¦ « Spécifications », page 5 ¦ « Planification du site », page 64 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Fonctions Informations connexes ¦ « Spécifications », page 5 ¦ « Planification du site », page 6 Fonction Description Processeur Processeur multinoyau SPARC T3. Mémoire 16 emplacements de modules DIMM DDR3. Unités de disque dur internes Jusqu’à quatre disques durs SAS-2 enfichables à chaud de 2,5 pouces. REM Module d’extension RAID (gestion des disques durs) avec contrôleur RAID. Pour plus d’informations sur les modules REM pris en charge, reportez-vous aux Notes de produit du module serveur SPARC T3-1B. UCP Port UCP situé sur le panneau avant. Un câble universel (UCP-3 ou UCP-4) est fourni avec le système modulaire et est vendu séparément. Les connexions suivantes sont prises en charge : • USB 2.0 (deux connexions) • Port série • Vidéo VGA • Prise en charge KVMS locale Architecture SPARC V9, avec protection ECC Groupe de plates-formes : sun4v Nom de la plate-forme : ORCL,module serveur SPARC-T3-1B Ports Ethernet Deux ports Intel 82576EB 10/100/1 Gb. E/S PCI Deux emplacements PCI Express ExpressModule de capacité Gen2. FEM Pour plus d’informations sur les modules FEM pris en charge, reportez-vous aux Notes de produit du module serveur SPARC T3-1B. Microprogramme système 8.0.1.c (minimum). Système d’exploitation SE Oracle Solaris 10 9/10 ou version ultérieure. SE Oracle Solaris 10 10/09 avec mise à jour Maintenance Update 9. Remarque - Pour plus d’informations sur les patchs requis par les versions prises en charge du SE Oracle Solaris, reportez-vous aux Notes de produit du module serveur SPARC T 3-1B. Alimentation Le châssis du système modulaire assure l’alimentation. Refroidissement Le châssis du système modulaire assure les contrôles environnementaux.Planification de l’installation 5 Spécifications Les spécifications physiques et électriques suivantes s’appliquent au module serveur. Spécifications physiques Spécifications électriques Informations connexes ¦ « Fonctions », page 4 ¦ « Planification du site », page 6 Mesure Système anglo-saxon Système métrique Largeur 13 po 330 mm Profondeur 19,5 po 495 mm Hauteur 1,75 po 45 mm Poids 17 livres 8 kg Mesure Valeur Tension (nominale) 12 V principale à partir du backplane du châssis 3,3 V auxiliaire à partir du backplane du châssis Puissance (maximale) 380 W (estimation)6 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Planification du site Les informations de planification du site sont incluses dans la documentation relative au système modulaire Sun Blade 6000. Reportez-vous au manuel Site Planning Guide for Sun Blade 6000 and Sun Blade 6048 Modular System. Les conditions environnementales requises suivantes sont spécifiques au module serveur. Informations connexes ¦ « Fonctions », page 4 ¦ « Spécifications », page 5 Logiciels préinstallés Vous pouvez commander le module serveur équipé d’une à quatre unités de disque assemblées à la commande. Dans ce cas, le SE Oracle Solaris et d’autres logiciels sont préinstallés sur l’unité de disque dur root (HDD0). Pour plus d’informations sur les logiciels préinstallés sur ce module serveur, reportez-vous aux Notes de produit du module serveur SPARC T3-1B. Les logiciels préinstallés sont indiqués sur la fiche d’informations client fixée sur l’emballage du module serveur. Pour plus d’informations sur les logiciels préinstallés sur le système, reportez-vous au site suivant : (http://www.sun.com/software/preinstall) Condition Configuration requise Température en service 5 °C (41 °F) à 35 °C (95 °F) sans condensation Température hors service -40 °C (-40 °F) à 65 °C (149 °F) Taux d’humidité en service 10 à 90 % sans condensation, 27 °C (80 °F) max. avec thermomètre humide Taux d’humidité hors service 93 % sans condensation, 38 °C (100 °F) max. avec thermomètre humide Altitude en service 3 048 m (10 000 pieds) à 35 °C (95 °F) Altitude hors service 12 000 m ( à 40 000 pieds)Planification de l’installation 7 Informations connexes ¦ « Paramètres de configuration d’Oracle Solaris », page 32 ¦ « Pour installer le logiciel Oracle Solaris à partir du réseau », page 32 ¦ « Inventaire du kit de livraison », page 2 Composants des panneaux avant et arrière FIGURE : Composants avant et arrière Légende de la figure 1 DEL blanche : localisation (fonctionne comme interrupteur de présence physique) 2 DEL bleue : composant prêt pour le retrait 3 DEL orange : opération de maintenance requise 4 DEL verte : OK 5 Bouton de marche/arrêt8 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Informations connexes ¦ « Câblage du module serveur », page 8 Câblage du module serveur Aucun câble n’est connecté au module serveur pendant le fonctionnement normal du système. Pour les besoins de configuration, de test ou de maintenance, vous pouvez connecter directement les câbles au module serveur en commençant par relier un câble de dongle au port UCP situé sur le panneau avant du module serveur. Attention – L’utilisation des câbles de dongle doit se limiter à la configuration, aux tests et à la maintenance. Vous devez les retirer lorsque vous ne vous en servez pas. Leur conformité CEM (compatibilité électromagnétique) n’a pas été attestée ; ils ne doivent pas être utilisés lors du fonctionnement normal du système. Vous pouvez utiliser le câble de dongle fourni avec le châssis du système modulaire ou commander un câble de dongle optionnel avec le module serveur. Il existe deux types de câbles de dongle : à trois ou quatre connecteurs. Dans la mesure du possible, utilisez le câble de dongle à trois connecteurs (UCP-3) au lieu de la version à quatre connecteurs (UCP-4). 6 Bouton de réinitialisation : NMI (réservé aux opérations de maintenance) 7 DEL verte : unité de disque OK 8 DEL orange : opération de maintenance requise sur l’unité de disque 9 DEL bleue : unité de disque prête pour le retrait 10 RFID (étiquette indiquant le numéro de série du module serveur) 11 Port de connecteur universel (UCP) 12 Connecteur d’alimentation du châssis 13 Connecteur de données du châssis Légende de la figure (suite)Planification de l’installation 9 FIGURE : Câble de dongle à trois connecteurs UCP-3 Légende de la figure 1 Connecteur de dongle relié au port UCP du module serveur 2 Connecteur série RJ-45 3 USB 2.0 (deux connecteurs) 4 Connecteur femelle à 15 broches VGA 5 Boutons de dégagement et d’insertion10 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 FIGURE : Câble de dongle à quatre connecteurs UCP-4 Légende de la figure 1 Connecteur de dongle relié au port UCP du module serveur 2 Connecteur série RJ-45 (à ne pas utiliser avec le modèle UCP-4) 3 Connecteur mâle série DB-9 (TTYA) 4 USB 2.0 (deux connecteurs) 5 Connecteur femelle à 15 broches VGA 6 Boutons de dégagement et d’insertionPlanification de l’installation 11 Les deux câbles de dongle UCP-3 et UCP-4 assurent une connexion USB 2.0 (avec deux connecteurs) et un connecteur femelle HD-15. Les connecteurs série sont différents sur les deux types de câbles de dongle : ¦ Le câble de dongle UCP-3 est doté d’un connecteur RJ-45. ¦ Le câble de dongle UCP-4 est doté d’un connecteur RJ-45 non pris en charge par ce module serveur. Utilisez à la place le connecteur DB-9 disponible sur le modèle UCP-4. Pour une connexion RJ-45, reliez un adaptateur DB-9/RJ-45 (disponible en option) au connecteur DB-9. Informations connexes ¦ « Composants des panneaux avant et arrière », page 7 ¦ « Planification des communications avec le module serveur lors de l’installation », page 11 ¦ « Pour se connecter via le port UCP du panneau avant du serveur », page 27 ? Planification des communications avec le module serveur lors de l’installation Il existe plusieurs méthodes permettant de communiquer avec le module serveur au cours de l’installation initiale. Planifiez la méthode que vous comptez utiliser. Avant de procéder à l’installation, prévoyez les équipements, les informations et les droits d’accès requis par cette méthode. ? Choisissez une méthode de connexion pour communiquer avec le SP du module serveur. Les méthodes de connexion sont illustrées par la figure et décrites dans le tableau. Procurez-vous les câbles, les périphériques de contrôle, les adresses et les mots de passe requis par la méthode choisie.12 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Méthode Description de la connexion Conditions requises pour la connexion Interfaces prises en charge 1 Ethernet Du port NET MGT du module CMM Au réseau Le port NET MGT du CMM doit être connecté au réseau. Vous devez connaître les adresses IP du CMM et du SP du module serveur. À partir de votre réseau, vous devez être capable de vous connecter à ILOM sur le CMM à l’aide de l’adresse IP du CMM. Utilisez ensuite le proxy ILOM pour accéder à l’interface d’ILOM sur le SP du module serveur. CLI d’ILOM ou interface Web d’ILOM sur le CMM 2 Série Du port SER MGT du module CMM Au périphérique terminal Périphérique terminal connecté au port RJ-45 SER MGT du CMM. À partir de cette connexion, vous pouvez utiliser ILOM pour accéder à l’interface d’ILOM sur le SP du module serveur. CLI ILOM 3 Série Du port UCP du SP du module serveur (dongle requis) Au périphérique terminal Câble de dongle UCP-3 connecté directement au module serveur et périphérique terminal relié au connecteur RJ-45 du câble de dongle. CLI ILOMPlanification de l’installation 13 Informations connexes ¦ « Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) », page 22 ¦ « Pour se connecter via le port série CMM du système modulaire », page 25 ¦ « Pour se connecter via le port UCP du panneau avant du serveur », page 27 ¦ « Composants des panneaux avant et arrière », page 7 ¦ « Câblage du module serveur », page 814 Guide d’installation du module serveur SPARC T3-1B • Décembre 201015 Installation du module serveur Les rubriques suivantes traitent de l’installation du module serveur dans le système modulaire, jusqu’à l’étape de sa mise sous tension initiale. ¦ « Précautions de manipulation », page 15 ¦ « Précautions contre les décharges électrostatiques », page 16 ¦ « Outils nécessaires lors de l’installation », page 16 ¦ « Installation des composants optionnels », page 17 ¦ « Préparation du châssis de système modulaire », page 18 ¦ « Pour installer le module serveur dans le châssis », page 19 ¦ « Communication avec le module serveur lors du démarrage », page 21 ¦ « Pour contrôler les messages de diagnostic », page 28 Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 Précautions de manipulation ¦ Transportez le module serveur en vous servant des deux mains. ¦ Étendez uniquement les bras d’éjection du panneau avant lorsque cela s’avère nécessaire dans le cadre d’une étape de l’installation. Informations connexes ¦ « Précautions contre les décharges électrostatiques », page 1616 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Précautions contre les décharges électrostatiques L’électricité statique peut endommager les équipements électroniques. Munissez-vous d’un bracelet antistatique mis à la terre (poignet ou cheville) ou d’un dispositif de sécurité équivalent afin d’éviter de provoquer des dommages électrostatiques lors de l’installation ou de l’entretien du module serveur. Attention – Pour protéger les composants électriques des dommages liés aux décharges électrostatiques, qui peuvent irrémédiablement endommager le système ou nécessiter des réparations effectuées par des techniciens de maintenance, placez les composants sur une surface antistatique (telle qu’un tapis de décharge antistatique, un sachet antistatique ou un tapis antistatique jetable). Portez un bracelet de mise à la terre antistatique raccordé à une surface métallique du châssis lorsque vous travaillez sur les composants du système. Informations connexes ¦ « Précautions de manipulation », page 15 ¦ « Outils nécessaires lors de l’installation », page 16 Outils nécessaires lors de l’installation Les outils suivants sont suffisants pour installer le module serveur, que vous deviez ou non installer des composants à l’intérieur de ce dernier : ¦ Tapis antistatique ¦ Bracelet antistatique ¦ Câble de dongle UCP-3 ou UCP-4 ¦ Terminal ou émulateur de terminal ¦ Stylet (pour appuyer sur le bouton de marche/arrêt)Installation du module serveur 17 Informations connexes ¦ « Installation des composants optionnels », page 17 ¦ « Câblage du module serveur », page 8 ¦ « Précautions de manipulation », page 15 ¦ « Précautions contre les décharges électrostatiques », page 16 Installation des composants optionnels Les composants optionnels que vous commandez dans le cadre de la configuration initiale du module serveur sont installés dans le module serveur avant son expédition. Ces composants sont clairement indiqués sur la fiche d’informations client incluse dans le coffret du module serveur. Toutefois, si vous avez passé une commande séparée pour des composants optionnels, vous devez installer ces derniers dans le module serveur avant de placer celui-ci dans le châssis du système modulaire. Pour installer des composants optionnels, reportez-vous au SPARC T3-1B Server Module Service Manual. Après avoir vérifié que les composants optionnels sont installés et fermé le module serveur, passez à la section « Installation du module serveur », page 15. Informations connexes ¦ « Outils nécessaires lors de l’installation », page 1618 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Préparation du châssis de système modulaire Vous devez installer et configurer le système modulaire Sun Blade 6000 avant d’installer le module serveur. Le système modulaire est parfois appelé châssis. Cette étape préparatoire inclut la configuration du CMM du système modulaire et celle du microprogramme ILOM préinstallé sur le CMM. Pour plus d’informations sur la préparation du système modulaire et sur le logiciel ILOM du CMM, reportez-vous au document Sun Blade 6000 Modular System Installation Guide. Remarque – Ce module serveur est un composant SAS-2. Vous devez mettre à niveau le microprogramme de tous les composants SAS-1 (modules NEM SAS-1 et modules de disque, par exemple) vers une version prenant en charge la coexistence de modules SAS-1 et SAS-2. Vous devez effectuer cette mise à niveau du microprogramme avant d’insérer le module serveur ou tout autre composant SAS-2 dans le châssis du système modulaire. Pour plus d’informations sur la mise à niveau du microprogramme, reportez-vous aux Notes de produit du module serveur SPARC T3-1B. Informations connexes ¦ « Pour installer le module serveur dans le châssis », page 19Installation du module serveur 19 ? Pour installer le module serveur dans le châssis 1. Soyez prêt à communiquer avec le module serveur aussi rapidement que possible après avoir terminé l’installation physique. Dès que vous insérez le module serveur dans un système modulaire sous tension, il est alimenté en courant et le processeur de service se met à générer des messages. Préparez-vous à établir des connexions à l’aide de l’une des méthodes décrites à la section « Communication avec le module serveur lors du démarrage », page 21. 2. Assurez-vous de disposer de l’adresse MAC et du numéro de série du module serveur. Ces informations se trouvent sur la fiche d’informations client fixée au carton d’expédition. Le numéro de série figure également sur une étiquette attachée au RFID placé sur le panneau avant du module serveur. L’adresse MAC est également visible dans la bannière de l’OBP. 3. Vérifiez que le châssis du système modulaire est sous tension. Reportez-vous à la documentation du système modulaire Sun Blade 6000. 4. Retirez le cache de protection du connecteur arrière du module serveur. 5. Localisez l’emplacement où vous prévoyez d’installer le module serveur dans le châssis. Un panneau de remplissage doit occuper cet emplacement jusqu’au moment précédant immédiatement l’insertion du module serveur. En effet, tous les emplacements doivent être occupés par les modules serveur ou par des panneaux de remplissage afin d’assurer une circulation d’air adéquate, une quantité de chaleur appropriée et des interférences électromagnétiques acceptables dans le système modulaire. 6. (Facultatif) Connectez les câbles au module serveur ou au CMM du châssis afin de pouvoir visualiser les messages émis par le module serveur. Le module serveur génère des messages de diagnostic dès que vous l’insérez dans un châssis sous tension. Reportez-vous à la section « Planification des communications avec le module serveur lors de l’installation », page 11.20 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 7. Retirez le panneau de remplissage de l’emplacement de châssis sélectionné. Abaissez le bras d’éjection du panneau de remplissage, puis retirez le panneau hors du châssis. Attention – Préparez-vous à insérer le module serveur dans un délai de 60 secondes suivant le retrait du panneau de remplissage. 8. Servez-vous des deux mains pour placer le module serveur à la verticale, le bras d’éjection côté droit. Observez l’encadré 1 dans l’illustration. 9. Enfoncez le module serveur dans l’emplacement vide jusqu’à ce qu’il se trouve à environ 1,5 cm (0,5 po) de l’avant du châssis. Observez l’encadré 2 dans l’illustration. 10. Abaissez les bras d’éjection jusqu’à ce qu’ils soient bien en place. Consultez les encadrés 2 et 3 de l’illustration.Installation du module serveur 21 11. Contrôlez les messages de diagnostic lorsque le module serveur est mis sous tension. Dès que vous insérez le module serveur dans un châssis alimenté en courant, il passe en mode veille et son processeur de service ILOM s’initialise. Les DEL du panneau avant clignotent trois fois, puis la DEL OK verte située sur le panneau avant clignote pendant plusieurs minutes. Observez l’encadré 4 dans l’illustration. Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 ¦ « Composants des panneaux avant et arrière », page 7 Communication avec le module serveur lors du démarrage Effectuez l’une des procédures suivantes selon la méthode de connexion que vous avez sélectionnée à la section « Planification des communications avec le module serveur lors de l’installation », page 11. ¦ « Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) », page 22 ¦ « Pour se connecter via le port Ethernet du CMM du système modulaire (CLI) », page 23 ¦ « Pour se connecter via le port série CMM du système modulaire », page 25 ¦ « Pour se connecter via le port UCP du panneau avant du serveur », page 27 Informations connexes ¦ « Planification des communications avec le module serveur lors de l’installation », page 11 ¦ « Composants des panneaux avant et arrière », page 7 ¦ « Câblage du module serveur », page 822 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 ? Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) Vous pouvez établir la connexion avec le CMM par le biais du port Ethernet RJ-45 NET MGT 0. Bien que cette connexion Ethernet prenne en charge à la fois la CLI et l’interface Web pour le SP du CMM, cette procédure d’installation applique la seconde méthode. 1. Prenez note des adresses IP du CMM et du SP du module serveur que vous comptez utiliser pour la connexion. 2. Assurez-vous que le CMM est connecté au réseau utilisé. La connexion réseau s’effectue via le connecteur RJ-45 étiqueté NET MGT 0 sur le CMM. 3. Dans un navigateur situé sur le même réseau que le système modulaire, saisissez l’adresse IP du CMM. Par exemple, si l’adresse IP du CMM est 129.99.99.99, saisissez cette adresse. Une fenêtre de connexion à ILOM s’affiche. 4. Connectez-vous à ILOM sur le CMM en indiquant votre nom d’utilisateur et votre mot de passe. Le mot de passe root par défaut d’ILOM défini en usine est changeme. Vous êtes à présent connecté à l’interface Web d’ILOM sur le CMM. 5. Parcourez l’arborescence jusqu’au SP du module serveur. a. Sélectionnez la vue du châssis du système modulaire. b. Cliquez sur l’image du module serveur que vous avez installé dans le système modulaire. Les emplacements situés dans le système modulaire sont numérotés de 0 à 9. 6. Sélectionnez Remote Control (Contrôle à distance) dans le menu en haut de la fenêtre. Deux choix s’offrent à vous : la redirection vidéo ou la redirection série. 7. Démarrez la console distante. a. Cliquez sur l’onglet Redirection. b. Cliquez sur Use serial redirection (Utiliser la redirection série). c. Cliquez sur Launch Remote Console (Lancer la console distante).Installation du module serveur 23 8. Mettez le module serveur sous tension. a. Cliquez sur l’onglet Remote Power Control (Contrôle à distance de l’alimentation). b. À partir du menu accessible sous cet onglet, sélectionnez Power On (Mettre sous tension). c. Sélectionnez Save (Enregistrer). d. Cliquez sur OK lorsque l’invite « Are you sure you want to perform a Power On of the server ? » (Voulez-vous vraiment mettre le serveur sous tension) s’affiche. L’hôte du module serveur est mis sous tension pour la première fois. 9. Vous pouvez à présent configurer le SE Oracle Solaris en fonction de vos besoins. Reportez-vous à la section « Pour configurer le système », page 31. Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 ¦ « Pour se connecter via le port Ethernet du CMM du système modulaire (CLI) », page 23 ? Pour se connecter via le port Ethernet du CMM du système modulaire (CLI) Vous pouvez établir la connexion avec le CMM par le biais du port Ethernet RJ-45 NET MGT 0. Bien que cette connexion Ethernet prenne en charge à la fois la CLI et l’CLI pour le SP CMM, cette procédure d’installation applique la première méthode. 1. Prenez note des adresses IP du CMM et du SP du module serveur que vous comptez utiliser pour la connexion. 2. Assurez-vous que le CMM est connecté au réseau utilisé. La connexion réseau s’effectue via le connecteur RJ-45 étiqueté NET MGT 0 sur le CMM. 3. Connectez-vous au CMM à l’aide du client SSH. Remplacez adresse-ip par l’adresse IP du CMM. $ ssh root@adresse-ip24 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 4. Saisissez votre mot de passe de compte root ILOM CMM lorsque vous y êtes invité. Le mot de passe root par défaut d’ILOM défini en usine est changeme. Vous êtes à présent connecté à la CLI d’ILOM sur le CMM. Remarque – Lorsque vous souhaitez vous déconnecter d’ILOM sur le CMM, tapez exit. 5. Parcourez l’arborescence jusqu’au SP du module serveur. Remplacez n par un numéro permettant d’identifier l’emplacement du châssis dans le système modulaire contenant le module serveur cible. 6. Accédez au SP du module serveur. Si vous êtes invité à saisir un mot de passe pour l’utilisateur root sur le SP du module serveur, tapez changeme (le mot de passe par défaut défini en usine). Vous êtes à présent connecté à ILOM sur le SP du module serveur. 7. Poursuivez la mise sous tension initiale de l’hôte du module serveur. « Mise sous tension initiale du module serveur », page 29 Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 ¦ « Pour se connecter via le port Ethernet du CMM du système modulaire (interface Web) », page 22 Password: CMM_ILOM_mot-de-passe Oracle(TM) Integrated Lights Out Manager Version 3.x.x ... Warning: password is set to factory default. -> -> cd /CH/BLn/SP/cli -> start Are you sure you want to start /CH/BLn/SP/cli (y/n)? y start: Connecting to /CH/BLn/SP/cli as user rootInstallation du module serveur 25 ? Pour se connecter via le port série CMM du système modulaire Pour accéder au SP du module serveur, commencez par ouvrir l’interface ILOM du CMM du châssis par le biais d’un terminal ou d’un émulateur de terminal connecté au port série RJ-45 du châssis. Vous pouvez ensuite vous connecter au SP du module serveur via la CLI du logiciel ILOM du CMM. 1. Assurez-vous que le terminal, le portable ou le serveur de terminal qui devra se conencter au châssis est opérationnel. 2. Configurez le logiciel du terminal ou de l’émulateur de terminal en utilisant les paramètres suivants : ¦ 8N1 (8 bits de données, sans parité, un bit d’arrêt) ¦ 9 600 bauds (par défaut, peut être défini sur n’importe quel débit standard inférieur ou égal à 57 600 bauds) ¦ Contrôle de flux matériel désactivé (CTS/RTS) 3. Connectez le port série du châssis au périphérique terminal au moyen d’un câble série. Pour connaître l’emplacement du port série, consultez la documentation relative au châssis du système modulaire. Le port série nécessite un câble doté du brochage suivant. Broche Description du signal 1 RTS (Request To Send, demande d’émission) 2 DTR (Data Terminal Ready, terminal de données prêt) 3 TXD (Transmit Data, transmission de données) 4 Terre 5 Terre 6 RXD (Receive Data, réception de données) 7 DCD (Data Carrier Detect, détection de porteuse de données) 8 CTS (Clear To Send, prêt pour l’émission)26 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 4. Appuyez sur Entrée sur le périphérique de terminal. La connexion entre le périphérique terminal et le CMM est établie. Si vous vous connectez au port série avant sa mise sous tension ou au cours de sa séquence de mise sous tension, des messages d’initialisation s’affichent. Une fois le système initialisé, le logiciel ILOM du CMM affiche l’invite de connexion suivante : La première chaîne de l’invite est le nom d’hôte par défaut, composé du préfixe SUNCMM suivi de l’adresse MAC d’ILOM sur le CMM. L’adresse MAC de chaque processeur de service est unique. 5. Connectez-vous à ILOM sur le CMM en indiquant votre nom d’utilisateur et votre mot de passe. Le mot de passe root par défaut d’ILOM défini en usine est changeme. Vous êtes à présent connecté à l’interface Web d’ILOM sur le CMM. Une fois la connexion établie, le CMM affiche l’invite de commande ILOM par défaut suivante : 6. Accédez à l’interface ILOM du module serveur : Dans cette commande, BL est suivie par le numéro d’identificateur d’emplacement (le plus bas étant 0) qui représente ce module serveur dans le châssis. 7. Tapez la commande start. Une invite s’affiche. 8. Tapez y pour continuer. Le logiciel ILOM vous invite à saisir le mot de passe spécifique au SP du module serveur sur lequel il est exécuté. Remarque – Le logiciel ILOM du CMM se connecte à ILOM sur le module serveur à l’aide du nom d’utilisateur figurant dans la cible user figurant sous /CH/BLn/SP/cli (où n correspond à l’emplacement d’installation du module serveur). SUNCMMnnnnnnnnnn login: -> -> cd /CH/BLn/SP/cli -> startInstallation du module serveur 27 9. À l’invite, tapez le mot de passe. Le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM sur le SP du module serveur. Vous pouvez poursuivre la mise sous tension initiale de l’hôte du module serveur. Reportez-vous à la section « Mise sous tension initiale du module serveur », page 29. Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 ? Pour se connecter via le port UCP du panneau avant du serveur Vous pouvez accéder directement au SP du module serveur en connectant un câble de dongle au port UCP situé à l’avant du module serveur. Attention – L’utilisation des câbles de dongle doit se limiter à la configuration, aux tests et à la maintenance. Vous devez les retirer lorsque vous ne vous en servez pas. Leur conformité CEM (compatibilité électromagnétique) n’a pas été attestée ; ils ne doivent pas être utilisés lors du fonctionnement normal du système. 1. Configurez le logiciel du terminal ou de l’émulateur de terminal en utilisant les paramètres suivants : ¦ 8N1 (8 bits de données, sans parité, un bit d’arrêt) ¦ 9 600 bauds (par défaut, peut être défini sur n’importe quel débit standard inférieur ou égal à 57 600 bauds) ¦ Contrôle de flux matériel désactivé (CTS/RTS) 2. Connectez le câble de dongle au port de connecteur universel (UCP) situé à l’avant du module serveur. Dans la mesure du possible, optez pour un câble de dongle UCP-3 à 3 connecteurs plutôt que d’utiliser un câble UCP-4 (à 4 connecteurs). Pour plus d’informations sur le port UCP et les câbles de dongle, reportez-vous à la section « Câblage du module serveur », page 8.28 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 3. Connectez un terminal ou un émulateur de terminal au câble de dongle. ¦ Avec un câble de dongle UCP-3, utilisez le connecteur RJ-45. ¦ Avec un câble de dongle UCP-4, utilisez le connecteur série DB-9 (TTYA). Si vous devez établir une connexion RJ-45 avec un port UCP-4, utilisez un adaptateur DB-9/RJ-45 relié au connecteur DB-9. L’invite de connexion d’ILOM s’affiche sur le terminal ou l’émulateur de terminal. 4. Tapez le nom d’utilisateur et le mot de passe lorsque vous y êtes invité. Le nom d’utilisateur par défaut est root. Le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM sur le SP du module serveur. Vous pouvez poursuivre la mise sous tension initiale de l’hôte du module serveur. Reportez-vous à la section « Mise sous tension initiale du module serveur », page 29. Informations connexes ¦ « Mise sous tension initiale du module serveur », page 29 ¦ « Pour contrôler les messages de diagnostic », page 28 ? Pour contrôler les messages de diagnostic Si le système modulaire est connecté à l’alimentation électrique, le module serveur passe en mode veille dès que vous l’installez dans le châssis. Le processeur de service ILOM s’initialise et les messages de diagnostic commencent à s’afficher immédiatement. ? Vérifiez les messages affichés sur la connexion établie avec le processeur de service du module serveur. Pour vous aider à déterminer la partie du module serveur mentionnée dans un message, reportez-vous au SPARC T3-1B Server Module Service Manual. Informations connexes ¦ « Mise sous tension initiale du module serveur », page 2929 Mise sous tension initiale du module serveur Une fois que vous avez installé le module serveur dans le système modulaire, vous pouvez mettre sous tension le serveur pour la première fois et commencer la configuration. ¦ « Présentation des tâches de mise sous tension initiale », page 30 ¦ « Pour mettre le système sous tension pour la première fois », page 30 ¦ « Pour configurer le système », page 31 ¦ « Pour installer le logiciel Oracle Solaris à partir du réseau », page 32 ¦ « Paramètres de configuration d’Oracle Solaris », page 32 ¦ « Pour assigner une adresse IP statique au processeur de service », page 34 Informations connexes ¦ « Planification de l’installation », page 1 ¦ « Installation du module serveur », page 1530 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 Présentation des tâches de mise sous tension initiale Dès que le module serveur est inséré dans un système modulaire connecté à l’alimentation électrique, le déroulement des étapes est le suivant : 1. Le SP du module serveur est fourni avec une alimentation et devient actif. 2. Le SP exécute des diagnostics et initialise le microprogramme ILOM. Des messages de diagnostic et de statut sont immédiatement générés par le SP. 3. Le SP affiche une invite de connexion. Vous pouvez alors saisir des commandes à l’invite ->. 4. Vous exécutez une commande d’ILOM entraînant la mise sous tension du module serveur, qui commence l’initialisation et la configuration du SE Oracle Solaris. Informations connexes ¦ « Pour mettre le système sous tension pour la première fois », page 30 ¦ « Pour configurer le système », page 31 ? Pour mettre le système sous tension pour la première fois 1. À l’invite d’ILOM sur le module serveur, tapez : Le module serveur s’initialise. -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS. . .Mise sous tension initiale du module serveur 31 2. Permutez la communication sur l’hôte du module serveur. Lorsque l’invite d’ILOM s’affiche, tapez : Le module serveur peut prendre plusieurs minutes pour effectuer l’autotest de démarrage (le POST). Si un périphérique d’initialisation installé à l’aide du SE Oracle Solaris est accessible localement, le module serveur démarre. Sinon, le système recherche un périphérique d’initialisation sur le réseau à l’aide de la commande boot net. Vous êtes maintenant connecté à l’hôte du module serveur. 3. L’installation du matériel du module serveur est maintenant terminée. Vous pouvez à présent configurer le SE Oracle Solaris en fonction de vos besoins. Informations connexes ¦ « Pour configurer le système », page 31 ? Pour configurer le système Cette procédure suppose que vous utilisez le logiciel du SE Oracle Solaris préinstallé sur le disque dur, dans l’emplacement HDD0 du module serveur. Si vous installez le SE Oracle Solaris d’une autre manière, terminez l’installation du système d’exploitation avant de reprendre cette procédure. ? Répondez aux questions de configuration indiquées dans le processus d’installation d’Oracle Solaris. Examinez les choix de configuration envisagés en vous référant à la section « Paramètres de configuration d’Oracle Solaris », page 32. Informations connexes ¦ « Pour installer le logiciel Oracle Solaris à partir du réseau », page 32 ¦ « Pour assigner une adresse IP statique au processeur de service », page 34 -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #. ...32 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 ? Pour installer le logiciel Oracle Solaris à partir du réseau Si vous choisissez d’utiliser une version du logiciel du SE Oracle Solaris autre que la version préinstallée, vous pouvez installer le système d’exploitation à partir du réseau. ? Pour des informations sur la version du SE Oracle Solaris que vous envisagez d’utiliser, reportez-vous au Guide d’installation de Solaris : Installations réseau. Ce guide est disponible à l’adresse suivante : (http://docs.sun.com) Ce guide contient des informations sur l’utilisation d’un serveur JumpStart sur votre réseau en vue d’installer le système d’exploitation. Informations connexes ¦ « Paramètres de configuration d’Oracle Solaris », page 32 Paramètres de configuration d’Oracle Solaris Les paramètres de configuration suivants sont à indiquer lors de la configuration du SE Oracle Solaris sur le module serveur SPARC T3-1B d’Oracle. Paramètre Description Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui). Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. En cas de doute, sélectionnez la première interface de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur.Mise sous tension initiale du module serveur 33 Informations connexes ¦ « Pour configurer le système », page 31 ¦ « Pour installer le logiciel Oracle Solaris à partir du réseau », page 32 ¦ « Pour assigner une adresse IP statique au processeur de service », page 34 IP Address (Adresse IP) Saisissez l’adresse IP de cette interface Ethernet. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Subnet Netmask (Masque de sous-réseau) (Avec une réponse affirmative pour le sous-réseau) Indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. Si vous avez des doutes, sélectionnez Use the NFSv4 domain derived by the system (Utiliser le domaine NFSv4 dérivé par le système). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Saisissez deux fois le mot de passe root. Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP.34 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 ? Pour assigner une adresse IP statique au processeur de service Si le réseau auquel le module serveur est connecté ne prend pas en charge le protocole DHCP pour l’adressage IP, effectuez la procédure ci-dessous. 1. Définissez le SP pour qu’il accepte une adresse IP statique. 2. Définissez l’adresse IP du SP. 3. Définissez l’adresse IP de la passerelle du SP. 4. Définissez le masque de réseau du SP. Cet exemple utilise 255.255.255.0 pour définir le masque de réseau. Le sous-réseau de votre environnement réseau peut exiger un masque de réseau différent. Utilisez un numéro de masque de réseau approprié à votre environnement. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=adresse-IP-processeur-service Set 'pendingipaddress' to 'adresse-IP-processeur-service' -> set /SP/network pendingipgateway=adresse-IP-passerelle Set 'pendingipgateway' to 'adresse-IP-passerelle' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0'Mise sous tension initiale du module serveur 35 5. Utilisez la commande show /SP/network pour vérifier que les paramètres ont été configurés correctement. 6. Validez les modifications apportées aux paramètres réseau du SP. Remarque – Vous pouvez réexécuter la commande show /SP/network (après la commande set /SP/network commitpending=true) afin de vérifier que les paramètres ont bien été mis à jour. 7. Définissez l’adresse IP statique lorsque vous configurez le SE Oracle Solaris. Reportez-vous à la section « Pour configurer le système », page 31. Informations connexes ¦ « Pour mettre le système sous tension pour la première fois », page 30 ¦ « Pour configurer le système », page 31 ¦ « Paramètres de configuration d’Oracle Solaris », page 32 -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'36 Guide d’installation du module serveur SPARC T3-1B • Décembre 201037 Glossaire A ANSI SIS American National Standards Institute Status Indicator Standard, norme d’indication de statut de l’Institut de normalisation national des États-Unis. ASR Automatic System Recovery, fonction de récupération automatique du système. C Châssis Boîtier de système modulaire. CLI Command-line interface, interface de ligne de commande. CMM Chassis Monitoring Module, module de contrôle de châssis. ILOM s’exécute sur le CMM, assurant la gestion LOM (Lights Out Management) des composants dans le châssis du système modulaire. Voir ILOM. D DHCP Dynamic Host Configuration Protocol, protocole de configuration dynamique de l’hôte. DTE Data Terminal Equipment,équipement terminal de traitement des données.38 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 E ESD Electrostatic discharge, décharge électrostatique. Espace de nom Cible ILOM CMM de niveau supérieur. F FEM Fabric Expansion Module, module d’extension de structure. Les modules FEM permettent aux modules serveur d’utiliser les connexions 10GbE fournies par certains modules NEM. Voir NEM. FRU Field-Replaceable Unit, unité remplaçable sur site. H HBA Host Bus Adapter, adaptateur de bus hôte. Voir REM. I ID PROM Puce contenant des informations système relatives au module serveur. ILOM Oracle Integrated Lights Out Manager. Le microprogramme ILOM est préinstallé sur différents systèmes Oracle. ILOM vous permet de gérer à distance vos serveurs Oracle indépendamment de l’état du système hôte. ILOM du CMM ILOM s’exécutant sur le module CMM. Voir ILOM. IP Internet Protocol, protocole Internet.Glossaire 39 K KVM Keyboard, video, mouse, clavier-écran-souris. Fait référence à l’utilisation d’un commutateur permettant d’activer le partage d’un clavier, d’un écran et d’une souris à partir de plusieurs ordinateurs. L Lame Terme générique désignant les modules serveur et les modules de stockage. M MAC ou adresse MAC Adresse du contrôleur d’accès multimédia. Module de disque ou lame de disque Termes interchangeables désignant un module de stockage. Module de stockage Composant modulaire fournissant les modules serveur en espace de stockage informatique. Module serveur Composant modulaire fournissant les principales ressources de calcul (CPU et mémoire) d’un système modulaire. Les modules serveur peuvent également être équipés d’un système de stockage intégré et de connecteurs contenant des modules REM et FEM. MSGID ID du message. N NEM Network Express Module. Les modules NEM fournissent des ports 10/100/1000 Ethernet et 10GbE Ethernet ainsi que des connexions SAS aux modules de stockage. NET MGT Network management port, port de gestion réseau. Port Ethernet équipant le CMM et les processeurs de service de module serveur. NMI Non-Maskable Interrupt, interruption non masquable.40 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 O OBP OpenBoot PROM. P PCI EM PCIe ExpressModule. Composant modulaire basé sur le facteur de forme PCI Express standard du secteur et offrant des fonctions d’E/S (Gigabit Ethernet et Fibre Channel, par exemple). POST Power-On Self-Test, autotest de l’allumage. PSH Predictive Self-Healing, autorétablissement prédictif R REM RAID Expansion Module, module d’extension RAID. Quelquefois appelé HBA Voir HBA. Prend en charge la création de volumes RAID sur les unités de disque. S SAS Serial attached SCSI. SCC System Configuration Chip, puce de configuration système. SER MGT Serial Management Port, port de gestion série. Port série équipant le CMM et les processeurs de service des modules serveur. Serveur lame Module serveur. SP Service Processor, processeur de service. SSH Secure Shell, shell sécurisé.Glossaire 41 U UCP Universal connector port, port de connecteur universel. IU Interface utilisateur. UTC Universal Time Coordinated, temps universel. UUID Universal unique identifier, identifiant universel unique. W WWID World-wide identifier, dentificateur universel. Numéro unique permettant d’identifier une cible SAS.42 Guide d’installation du module serveur SPARC T3-1B • Décembre 201043 Index A Adresse IP du CMM, 22 Adresse MAC, 19 Altitude, spéci?cations, 6 Architecture, processeur, 4 B Balise RFID, 19 Bouton de marche/arrêt, 7 Bouton de réinitialisation, 7 Bras d’éjection, 19 Brochage des câbles série, 25 C Câblage, 8 Câble de dongle, 8, 11, 27 Carte graphique intégrée, 4 Châssis Insertion du module serveur, 19 Préparation, 18 CLI comme méthode d’installation, 23 Communication Démarrage, 21 Module serveur, 11 Composants du panneau arrière, 7 Composants du panneau avant, 7 composants optionnels à installer, 17 Con?guration, paramètres pour le SE Oracle Solaris, 32 Connecteur d’alimentation, 7 Connecteur de données, 7 Connexion au serveur Port NET MGT CMM (interface Web), 22 Port NET MGT du CMM (CLI), 23 Port SER MGT du CMM (CLI), 25 Port UCP, 27 Connexion du port série, 11 Console distante, 22 Contrôle des messages de diagnostic, 28 D DEL, panneau avant, 7 Démarrage du module serveur, 25 Diagnostic, messages, 28 Dimensions, 5 E Environnement, spéci?cations, 6 ESD, précautions, 16 F FEM, 4 Fiche d’informations client, 2 Fonctions, module serveur, 4 H Hauteur, 5 Humidité, spéci?cations, 6 I ILOM, mot de passe root, par défaut, 22 Installation Composants optionnels, 17 Module serveur, 15 Outils nécessaires, 16 Plani?cation, 1 Préparation du châssis, 18 Interface Web, 22 Inventaire du kit de livraison, 244 Guide d’installation du module serveur SPARC T3-1B • Décembre 2010 K Kit de livraison, inventaire, 2 KVMS, 4 L Largeur, 5 Logiciels préinstallés, 6 M Mémoire, 4 Messages de diagnostic, 28 Méthodes de connexion, 11 Microprogramme système, 4 Mise sous tension initiale, 30 Présentation des tâches, 30 Module serveur Communications au démarrage, 21 Con?guration du SE, 31 Démarrage, 25 Fonctions, 4 Installation, 15 Installation dans le châssis, 19 Installation du SE à partir du réseau, 32 Mise sous tension initiale, 30 Modules REM, 4 Mot de passe root, par défaut, 22 O optionnels (installation des composants), 17 Oracle Solaris, Paramètres de con?guration, 32 Outils requis pour l’installation, 16 P Panneaux de remplissage, 19 PCIe EM, 4 Périphétique terminal, 16 Plani?cation de l’installation, 1 Poids, 5 Port NET MGT du CMM, 11 Port SER MGT du CMM, 11 Utilisation pour l’installation, 25 Port UCP, 27 Port UCP (Universal Connector Port), 4, 7 Ports Ethernet, 4 Précautions ESD, 16 Gestion, 15 Précautions de manipulation, 15 Préinstallation de logiciels, 6 Préparation du châssis de système modulaire, 18 Profondeur, 5 Protections des connecteurs, 19 R Redirection série, 22 Refroidissement, 4 S SE Installation à partir du réseau, 32 Paramètres de con?guration d’Oracle Solaris, 32 SE Solaris Paramètres de con?guration de Solaris, 32 Site, spéci?cations de plani?cation, 6 Spéci?cations Électriques, 5 Environnementales, 6 Physiques, 5 Spéci?cations électriques, 5 Spéci?cations physiques, 5 ssh, commande, 23 start /SYS, commande, 30 start, commande, 23 T Tapis antistatique et bracelet (installation), 16 Température, spéci?cations, 6 Tension, 5 Types de modules DIMM, 4 SPARC T3-1B Server Module Installation Guide Part No. 821-1916-10 December 2010, Revision APlease Recycle Copyright © 2010 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation v Planning the Installation 1 Shipping Kit Inventory List 2 Features 4 Specifications 5 Physical Specifications 5 Electrical Specifications 5 Site Planning 5 Preinstalled Software 6 Front and Rear Panel Components 7 Server Module Cabling 8 ? Plan Communication With the Server Module During Installation 11 Installing the Server Module 15 Handling Precautions 15 ESD Precautions 16 Tools Needed for Installation 16 Optional Component Installation 17 Modular System Chassis Preparation 17 ? Insert the Server Module Into the Chassis 18 Communicating With the Server Module During Startup 20iv SPARC T3-1B Server Module Installation Guide • December 2010 ? Connect Through the Ethernet Port of the Modular System CMM (Web Interface) 20 ? Connect Through the Ethernet Port of the Modular System CMM (CLI) 22 ? Connect Through the Modular System CMM Serial Port 23 ? Connect Through the Server Module Front Panel UCP 25 ? Monitor the Diagnostic Messages 26 Powering On the Server Module for the First Time 29 Initial Power-On Task Overview 29 ? Power On the System for the First Time 30 ? Configure the System 31 ? Install Oracle Solaris Software From the Network 31 Oracle Solaris Configuration Settings 32 ? Assign a Static IP Address to the Service Processor 33 Glossary 35 Index 41v Using This Documentation This document provides instructions, background information, and reference material to help you install the SPARC T3-1B server module from Oracle in the Sun Blade 6000 modular system from Oracle. ¦ “Related Documentation” on page v ¦ “Documentation, Support, and Training” on page vi Related Documentation The documents listed as online are available at: (http://docs.sun.com/app/docs/prod/sparc.t3.1b#hic) Application Title Format Location Product notes SPARC T3-1B Server Module Product Notes PDF Online Getting started SPARC T3-1B Server Module Getting Started Guide Printed Ships with system Installation, administration, and service SPARC T3-1B Server Module Topic Set HTML Online Installation SPARC T3-1B Server Module Installation Guide PDF HTML Online Administration SPARC T3 Series Servers Administration Guide PDF HTML Onlinevi SPARC T3-1B Server Module Installation Guide • December 2010 Note – The SPARC T3 Series Servers Administration Guide applies to several server and server module products. Some specific examples in that document are based on products other than this server module. Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://docs.sun.com) ¦ Support (http://www.sun.com/support) ¦ Training (http://www.sun.com/training) Service SPARC T3-1B Server Module Service Manual PDF HTML Online Safety SPARC T3-1B Server Module Safety and Compliance Manual PDF Online Modular system firmware updates SAS-1/SAS-2 Compatibility Upgrade Guide PDF Online Application Title Format Location1 Planning the Installation These topics help you plan installation of the server module. ¦ “Shipping Kit Inventory List” on page 2 ¦ “Features” on page 4 ¦ “Specifications” on page 5 ¦ “Site Planning” on page 5 ¦ “Preinstalled Software” on page 6 ¦ “Front and Rear Panel Components” on page 7 ¦ “Server Module Cabling” on page 8 ¦ “Plan Communication With the Server Module During Installation” on page 11 Related Information ¦ “Installing the Server Module” on page 152 SPARC T3-1B Server Module Installation Guide • December 2010 Shipping Kit Inventory List FIGURE: Shipping Kit Contents The customer information sheet includes further details about optional hardware and software already installed in the server module. Figure Legend 1 Printed documentation, including Getting Started Guide 2 Server module 3 Shipping carton 4 Customer information sheet (on outside of shipping carton). Save for MAC address and other information about installed hardware and software.Planning the Installation 3 Related Information ¦ “Features” on page 4 ¦ “Specifications” on page 5 ¦ “Site Planning” on page 54 SPARC T3-1B Server Module Installation Guide • December 2010 Features Related Information ¦ “Specifications” on page 5 ¦ “Site Planning” on page 5 Feature Description Processor One SPARC T3 multicore processor. Memory 16 slots for DDR3 DIMMs. Internal hard drives Up to four hot-plugable 2.5-inch SAS-2 hard drives. REM RAID expansion module (hard drive management) with RAID controller. See the SPARC T3-1B Server Module Product Notes for details about supported REMs. UCP One UCP in the front panel. A universal cable (UCP-3 or UCP-4) is included with the modular system and can be purchased separately. The following connections are supported: • USB 2.0 (two connections) • Serial • VGA video • Local KVMS support Architecture SPARC V9 architecture, ECC protected Platform group: sun4v Platform name: ORCL,SPARC-T3-1B Server Module Ethernet ports Two 10/100/1 Gb Intel 82576EB ports. PCI I/O Two PCI Express Gen2-capable ExpressModule slots. FEM See the SPARC T3-1B Server Module Product Notes for details about supported FEMs. System firmware 8.0.1.c (minimum). Operating system Oracle Solaris 10 9/10 OS or higher. Oracle Solaris 10 10/09 OS with Maintenance Update 9. Note - Refer to the SPARC T 3-1B Server Module Product Notes for details on required patches for supported Oracle Solaris OS releases. Power The modular system chassis provides power. Cooling The modular system chassis provides environmental controls.Planning the Installation 5 Specifications The following physical and electrical specifications apply to the server module. Physical Specifications Electrical Specifications Related Information ¦ “Features” on page 4 ¦ “Site Planning” on page 5 Site Planning Site-planning information is included in the documentation for the Sun Blade 6000 modular system. Refer to the Site Planning Guide for Sun Blade 6000 and Sun Blade 6048 Modular System. Measure U.S. Metric Width 13 in. 330 mm Depth 19.5 in. 495 mm Height 1.75 in. 45 mm Weight 17 lbs 8.0 kg Measure Value Voltage (nominal) 12V main from chassis backplane 3.3V AUX from chassis backplane Power (maximum) 380W (estimated)6 SPARC T3-1B Server Module Installation Guide • December 2010 The following environmental requirements are specific to the server module. Related Information ¦ “Features” on page 4 ¦ “Specifications” on page 5 Preinstalled Software You can order the server module with one to four disk drives assembled to order. In that case, the Oracle Solaris OS and other software is preinstalled on the root hard disk drive (HDD0). For details about the software preinstalled on this server module, refer to the SPARC T3-1B Server Module Product Notes. Preinstalled software is identified on the customer information sheet attached to the packaging for the server module. For further information about the software preinstalled on your system, refer to this site: (http://www.sun.com/software/preinstall) Related Information ¦ “Oracle Solaris Configuration Settings” on page 32 ¦ “Install Oracle Solaris Software From the Network” on page 31 ¦ “Shipping Kit Inventory List” on page 2 Condition Requirement Operating temperature 5°C (41°F) to 35°C (95°F) noncondensing Nonoperating temperature -40°C (-40°F) to 65°C (149°F) Operating humidity 10% to 90% noncondensing, 27°C (80°F) max. wet bulb Nonoperating humidity 93% noncondensing, 38°C (100°F) max. wet bulb Operating altitude 3048 meters (10,000 feet) at 35°C (95°F) Nonoperating altitude 12,000 meters (40,000 feet)Planning the Installation 7 Front and Rear Panel Components FIGURE: Front and Rear Components Figure Legend 1 White LED: Locator (functions as the physical presence switch) 2 Blue LED: Ready to Remove 3 Amber LED: Service Action Required 4 Green LED: OK 5 Power button 6 Reset button: NMI (for service use only) 7 Green LED: Drive OK 8 Amber LED: Drive Service Action Required 9 Blue LED: Drive Ready to Remove 10 RFID (sticker indicates serial number of the server module) 11 Universal connector port (UCP) 12 Chassis power connector 13 Chassis data connector8 SPARC T3-1B Server Module Installation Guide • December 2010 Related Information ¦ “Server Module Cabling” on page 8 Server Module Cabling No cables are connected to the server module during normal system operation. For setup, testing, or service purposes, you can connect cables directly to the server module by first attaching a dongle cable to the UCP on the front panel of the server module. Caution – Dongle cables are intended for setup, testing, or service purposes and should be removed when not in use. These cables have not been evaluated for electromagnetic compatibility compliance and are not to be used during normal system operation. You can use the dongle cable that shipped with the modular system chassis or order an optional dongle cable with the server module. There are two types of dongle cables, with either three or four connectors. Use the three-connector dongle cable (UCP-3) instead of the four-connector version (UCP-4) whenever possible.Planning the Installation 9 FIGURE: UCP-3 Three-Connector Dongle Cable Figure Legend 1 Dongle connector attaching to the server module UCP 2 RJ-45 serial connector 3 USB 2.0 (two connectors) 4 VGA 15-pin female connector 5 Insertion and release buttons10 SPARC T3-1B Server Module Installation Guide • December 2010 FIGURE: UCP-4 Four-Connector Dongle Cable Both the UCP-3 and UCP-4 dongle cables provide a USB 2.0 connection (with two connectors) and an HD-15 female connector. The serial connectors differ on the two types of dongle cables: ¦ The UCP-3 dongle cable has an RJ-45 connector. ¦ The UCP-4 dongle cable has an RJ-45 connector, but that is not supported on this server module. Instead, use the DB-9 connector provided on the UCP-4. If you need an RJ-45 connection, attach an optional DB-9-to-RJ-45 adapter to the DB-9 connector. Figure Legend 1 Dongle connector attaching to the server module UCP 2 RJ-45 serial connector (Do not use this connector on the UCP-4.) 3 DB-9 serial male connector (TTYA) 4 USB 2.0 (two connectors) 5 VGA 15-pin female connector 6 Insertion and release buttonsPlanning the Installation 11 Related Information ¦ “Front and Rear Panel Components” on page 7 ¦ “Plan Communication With the Server Module During Installation” on page 11 ¦ “Connect Through the Server Module Front Panel UCP” on page 25 ? Plan Communication With the Server Module During Installation There are several methods to communicate with the server module during the initial installation. Plan which method you will use. Before you perform the installation, arrange to have the equipment, information, and permissions required by that method. ? Choose one of the connection methods to communicate with the server module SP. The connection methods are shown in the figure and described in the table. Obtain the cables, monitoring devices, addresses, and passwords required for the method you choose.12 SPARC T3-1B Server Module Installation Guide • December 2010 Related Information ¦ “Connect Through the Ethernet Port of the Modular System CMM (Web Interface)” on page 20 ¦ “Connect Through the Modular System CMM Serial Port” on page 23 ¦ “Connect Through the Server Module Front Panel UCP” on page 25 ¦ “Front and Rear Panel Components” on page 7 Method Connection Description Connection Requirements Supported Interfaces 1 Ethernet From: CMM NET MGT port To : Your network The CMM NET MGT port must be connected to your network. You must know the IP addresses of both the CMM and the server module SP. From your network, you must be able to log in to ILOM on the CMM using the IP address of the CMM. Then you can use the ILOM proxy to navigate to the server module SP ILOM interface. ILOM CLI or the CMM ILOM web interface 2 Serial From: CMM SER MGT port To : Terminal device A terminal device connected to the CMM SER MGT RJ-45 port. From this connection, you can use ILOM to navigate to the server module SP ILOM interface. ILOM CLI 3 Serial From: Server module SP UCP port (dongle required) To : Terminal device A UCP-3 dongle cable that connects directly to the server module and a terminal device connected to the RJ-45 connector on the dongle cable. ILOM CLIPlanning the Installation 13 ¦ “Server Module Cabling” on page 814 SPARC T3-1B Server Module Installation Guide • December 201015 Installing the Server Module The following topics cover how to install the server module in the modular system, up to the point of powering on the server module for the first time. ¦ “Handling Precautions” on page 15 ¦ “ESD Precautions” on page 16 ¦ “Tools Needed for Installation” on page 16 ¦ “Optional Component Installation” on page 17 ¦ “Modular System Chassis Preparation” on page 17 ¦ “Insert the Server Module Into the Chassis” on page 18 ¦ “Communicating With the Server Module During Startup” on page 20 ¦ “Monitor the Diagnostic Messages” on page 26 Related Information ¦ “Powering On the Server Module for the First Time” on page 29 Handling Precautions ¦ Use both hands to carry the server module. ¦ Extend the ejector arms on the front panel only while they need to be in that position to perform a step. Related Information ¦ “ESD Precautions” on page 1616 SPARC T3-1B Server Module Installation Guide • December 2010 ESD Precautions Electronic equipment is susceptible to damage by static electricity. Use a grounded antistatic wriststrap, footstrap, or equivalent safety equipment to prevent ESD when you install the server module. Caution – To protect electronic components from ESD, which can permanently disable the system, or require repair by service technicians, place components on an antistatic surface, such as an antistatic discharge mat, an antistatic bag, or a disposable antistatic mat. Wear an antistatic grounding strap connected to a metal surface on the chassis when you work on system components. Related Information ¦ “Handling Precautions” on page 15 ¦ “Tools Needed for Installation” on page 16 Tools Needed for Installation The following tools are sufficient for installing the server module, whether or not you need to install components inside the server module: ¦ Antistatic mat ¦ Antistatic wrist strap ¦ UCP-3 or UCP-4 dongle cable ¦ Terminal or terminal emulator ¦ Stylus (to press power button) Related Information ¦ “Optional Component Installation” on page 17 ¦ “Server Module Cabling” on page 8 ¦ “Handling Precautions” on page 15 ¦ “ESD Precautions” on page 16Installing the Server Module 17 Optional Component Installation Optional components that you order as part of the server module’s initial configuration are installed in the server module before it is shipped. These optional components are identified on the customer information sheet included with the server module’s packaging. However, if you ordered optional components separately, you must install them in the server module before you install the server module in the modular system chassis. To install any optional components, refer to the SPARC T3-1B Server Module Service Manual. After you verify that the optional components are installed and close the server module, continue with “Installing the Server Module” on page 15. Related Information ¦ “Tools Needed for Installation” on page 16 Modular System Chassis Preparation You must install and configure the Sun Blade 6000 modular system before installing the server module. The modular system is sometimes called the chassis. This preparation includes configuring the modular system’s CMM and the CMM ILOM firmware that is preinstalled on the CMM. For more information about preparing the modular system and CMM ILOM, refer to the Sun Blade 6000 Modular System Installation Guide. Note – This server module is a SAS-2 component. You must upgrade the firmware of all SAS-1 components (such as SAS-1 NEMs and disk modules) to a firmware version that supports SAS-1/SAS-2 coexistence. You must complete this firmware upgrade before you insert this server module or any other SAS-2 component into the modular system chassis. Refer to the SPARC T3-1B Server Product Notes for more information about the firmware upgrade. Related Information ¦ “Insert the Server Module Into the Chassis” on page 1818 SPARC T3-1B Server Module Installation Guide • December 2010 ? Insert the Server Module Into the Chassis 1. Be prepared to communicate with the server module as quickly as possible after completing the physical installation. As soon as you insert the server module in a powered modular system, power is supplied to the server module and the service processor beings generating messages. Be ready to connect using one of the methods in “Communicating With the Server Module During Startup” on page 20. 2. Ensure that you have the MAC address and serial number for the server module. This information is on the customer information sheet attached to the shipping container. The serial number is also on a label attached to the RFID on the front panel of the server module. The MAC address is also displayed in the OBP banner. 3. Ensure that the modular system chassis is powered on. Refer to the documentation for the Sun Blade 6000 modular system. 4. Remove the protective cover from the rear connector of the server module. 5. Locate the slot in the chassis where you plan to install the server module. A filler panel should remain in this slot until just before you are ready to insert the server module. All slots should remain filled with server modules or filler panels to ensure correct air flow, heat, and electromagnetic interference conditions in the modular system. 6. (Optional) Connect cables to the server module or the chassis CMM to be ready to view messages from the server module. The server module generates diagnostic messages as soon as you insert it in a chassis that has power applied. See “Plan Communication With the Server Module During Installation” on page 11. 7. Remove the filler panel from the selected chassis slot. Pull down the ejector arm of the filler panel, then pull the panel straight out of the chassis. Caution – Be ready to insert the server module within 60 seconds of removing the filler panel.Installing the Server Module 19 8. Use both hands to position the server module vertically with the ejector arms on the right. See panel 1 in the figure. 9. Push the server module into the empty slot until the module extends about 1.5 cm (0.5 inch) from the chassis front. See panel 2 in the figure. 10. Push the ejector arms down until they snap into place. See panels 2 and 3 in the figure. 11. Monitor diagnostic messages when power is applied to the server module. As soon as you insert the server module into a chassis that is connected to power, the server module goes into standby mode and its ILOM service processor initializes.The front panel LEDs blinks three times, then the green OK LED on the front panel blinks for a few minutes. See panel 4 in the figure. Related Information ¦ “Powering On the Server Module for the First Time” on page 29 ¦ “Front and Rear Panel Components” on page 720 SPARC T3-1B Server Module Installation Guide • December 2010 Communicating With the Server Module During Startup Perform one of these procedures based on the connection method you selected in “Plan Communication With the Server Module During Installation” on page 11. ¦ “Connect Through the Ethernet Port of the Modular System CMM (Web Interface)” on page 20 ¦ “Connect Through the Ethernet Port of the Modular System CMM (CLI)” on page 22 ¦ “Connect Through the Modular System CMM Serial Port” on page 23 ¦ “Connect Through the Server Module Front Panel UCP” on page 25 Related Information ¦ “Plan Communication With the Server Module During Installation” on page 11 ¦ “Front and Rear Panel Components” on page 7 ¦ “Server Module Cabling” on page 8 ? Connect Through the Ethernet Port of the Modular System CMM (Web Interface) You can connect to the CMM through the RJ-45 NET MGT 0 Ethernet port. While this Ethernet connection supports both the CLI and the web interface to the CMM SP, this installation procedure uses the web interface. 1. Know the IP addresses for the CMM and the server module SP that you plan to connect. 2. Ensure that the CMM is connected to the network you are on. The network connection is through the RJ-45 connector labeled NET MGT 0 on the CMM. 3. In a browser on the same network as the modular system, enter the IP address of the CMM. For example, if your CMM has the IP address 129.99.99.99, enter that address. A login window for ILOM appears.Installing the Server Module 21 4. Log in to ILOM on the CMM by typing your user name and password. The factory default ILOM root password is changeme. You are now logged in to the CMM ILOM web interface. 5. Navigate to the server module SP. a. Select the chassis view for the modular system. b. Click on the image of the server module that you have installed in the modular system. The slots in the modular system are numbered 0 to 9. 6. Select Remote Control on the top menu. You are offered a choice of video redirection or serial redirection. 7. Start the Remote Console a. Select the Redirection tab. b. Click on Use serial redirection. c. Click on Launch Remote Console. 8. Power on the server module. a. Select the Remote Power Control tab. b. From the menu on that tab, select Power On. c. Select Save. d. Select OK when you see this prompt: Are you sure you want to perform a Power On of the server? The server module host is powered on for the first time. 9. You can now configure the Oracle Solaris OS to meet your needs. See “Configure the System” on page 31. Related Information ¦ “Powering On the Server Module for the First Time” on page 29 ¦ “Connect Through the Ethernet Port of the Modular System CMM (CLI)” on page 2222 SPARC T3-1B Server Module Installation Guide • December 2010 ? Connect Through the Ethernet Port of the Modular System CMM (CLI) You can connect to the CMM through the RJ-45 NET MGT 0 Ethernet port. While this Ethernet connection supports both the CLI and the web interface to the CMM SP, this installation procedure uses the CLI. 1. Know the IP addresses for the CMM and the server module SP that you plan to connect. 2. Ensure that the CMM is connected to the network you are on. The network connection is through the RJ-45 connector labeled NET MGT 0 on the CMM. 3. Log in to the CMM with the SSH client. Replace ipaddress with the IP address of the CMM. 4. Type your password for the CMM ILOM root account when prompted. The factory default ILOM root password is changeme. You are now logged in to the CMM ILOM CLI. Note – When you are ready to log out of the CMM ILOM, type exit. 5. Navigate to the server module SP. Replace n with a number that identifies the chassis slot in the modular system where the target server module is installed. $ ssh root@ipaddress Password: CMM_ILOM_password Oracle(TM) Integrated Lights Out Manager Version 3.x.x ... Warning: password is set to factory default. -> -> cd /CH/BLn/SP/cliInstalling the Server Module 23 6. Access the server module SP. If you are prompted for a password for the root user on the server module SP, type changeme (the factory default password). You are now logged into ILOM on the server module SP. 7. Continue to power on the server module host for the first time. “Powering On the Server Module for the First Time” on page 29 Related Information ¦ “Powering On the Server Module for the First Time” on page 29 ¦ “Connect Through the Ethernet Port of the Modular System CMM (Web Interface)” on page 20 ? Connect Through the Modular System CMM Serial Port You can access the server module SP by first accessing the chassis CMM ILOM through a terminal or terminal emulator connected to the RJ-45 serial port on the chassis. Then you can connect to the server module SP through the CLI of the CMM ILOM software. 1. Verify that the terminal, laptop, or terminal server that will connect to the chassis is operational. 2. Configure the terminal device or terminal emulation software with these settings: ¦ 8N1 (eight data bits, no parity, one stop bit) ¦ 9600 baud (the default, but can be set to any standard rate up to 57600) ¦ Disable hardware flow control (CTS/RTS) -> start Are you sure you want to start /CH/BLn/SP/cli (y/n)? y start: Connecting to /CH/BLn/SP/cli as user root24 SPARC T3-1B Server Module Installation Guide • December 2010 3. Connect a serial cable from the chassis serial port to the terminal device. Refer to the modular system chassis documentation for the location of the serial port. The serial port requires a cable with these pin assignments. 4. Press Enter on the terminal device. The connection between the terminal device and the CMM is established. If you have connected to the serial port before it has been powered up or during its power-up sequence, you will see boot messages. When the system has booted, the CMM ILOM software displays its login prompt: The first string in the prompt is the default host name, which consists of the prefix SUNCMM followed by the CMM ILOM MAC address. The MAC address for each service processor is unique. 5. Log in to ILOM on the CMM by typing your user name and password. The factory default ILOM root password is changeme. You are now logged in to the CMM ILOM web interface. After you have successfully logged in, the CMM ILOM displays its default command prompt: Pin Signal Description 1 Request To Send (RTS) 2 Data Terminal Ready (DTR) 3 Transmit Data (TXD) 4 Ground 5 Ground 6 Receive Data (RXD) 7 Data Carrier Detect (DCD) 8 Clear To Send (CTS) SUNCMMnnnnnnnnnn login: ->Installing the Server Module 25 6. Navigate to the server module ILOM: In this command, BL is followed by the slot identifier number (the lowest is 0) that represents this server module in the chassis. 7. Type the start command. A prompt is displayed. 8. Type y to continue. The ILOM software running on the server module SP prompts for the password specific to that server module SP. Note – The CMM ILOM logs into the server module ILOM using the user name in the user target under /CH/BLn/SP/cli (where n is the slot where the server module is installed). 9. Type the password when prompted. The default password is changeme. You are now logged into ILOM on the server module SP. You can continue to power on the server module host for the first time. See “Powering On the Server Module for the First Time” on page 29 Related Information ¦ “Powering On the Server Module for the First Time” on page 29 ? Connect Through the Server Module Front Panel UCP You can access the server module SP directly by connecting a dongle cable to the UCP on the front of the server module. Caution – Dongle cables are intended for setup, testing, or service purposes and should be removed when not in use. These cables have not been evaluated for electromagnetic compatibility compliance and are not to be used during normal system operation. -> cd /CH/BLn/SP/cli -> start26 SPARC T3-1B Server Module Installation Guide • December 2010 1. Configure the terminal device or terminal emulation software with these settings: ¦ 8N1 (eight data bits, no parity, one stop bit) ¦ 9600 baud (the default, but can be set to any standard rate up to 57600) ¦ Disable hardware flow control (CTS/RTS) 2. Connect the dongle cable to the universal connector port (UCP) on the front panel of the server module. If possible, use a three-connector UCP-3 dongle cable rather than a four-connector UCP-4. See “Server Module Cabling” on page 8 for more information about the UCP and the dongle cables. 3. Connect a terminal or terminal emulator to dongle cable. ¦ For a UCP-3 dongle cable, use the RJ-45 connector. ¦ For a UCP-4 dongle cable, use the DB-9 serial connector (TTYA). If you need to make an RJ-45 connection to a UCP-4, do so through a DB-9-to-RJ-45 adapter attached to the DB-9 connector. The ILOM login prompt is displayed on the terminal or terminal emulator. 4. Type the user name and password when prompted. The default user is root. The default password is changeme. You are now logged into ILOM on the server module SP. You can continue to power on the server module host for the first time. See “Powering On the Server Module for the First Time” on page 29 Related Information ¦ “Powering On the Server Module for the First Time” on page 29 ¦ “Monitor the Diagnostic Messages” on page 26 ? Monitor the Diagnostic Messages If the modular system is connected to power, the server module will go into standby mode as soon as you insert it into the chassis. The ILOM service processor initializes and diagnostic messages start to appear immediately. ? Check the messages displayed on the connection you made to the server module’s service processor. To help determine which portion of the server module is mentioned in a message, refer to the SPARC T3-1B Server Module Service Manual.Installing the Server Module 27 Related Information ¦ “Powering On the Server Module for the First Time” on page 2928 SPARC T3-1B Server Module Installation Guide • December 201029 Powering On the Server Module for the First Time After you install the server module in the modular system, you can power on the server for the first time and begin configuration. ¦ “Initial Power-On Task Overview” on page 29 ¦ “Power On the System for the First Time” on page 30 ¦ “Configure the System” on page 31 ¦ “Install Oracle Solaris Software From the Network” on page 31 ¦ “Oracle Solaris Configuration Settings” on page 32 ¦ “Assign a Static IP Address to the Service Processor” on page 33 Related Information ¦ “Planning the Installation” on page 1 ¦ “Installing the Server Module” on page 15 Initial Power-On Task Overview As soon as the server module is inserted in a modular system that is connected to power, the following stages occur: 1. The server module’s SP is provided with power and becomes active. 2. The SP runs diagnostics and initializes the ILOM firmware. Diagnostic and status messages are generated by the SP immediately. 3. The SP displays a prompt to log in. After that, you are able to enter commands at the -> prompt. 4. You enter an ILOM command causing the server module to power up, starting initialization and configuration of the Oracle Solaris OS.30 SPARC T3-1B Server Module Installation Guide • December 2010 Related Information ¦ “Power On the System for the First Time” on page 30 ¦ “Configure the System” on page 31 ? Power On the System for the First Time 1. At the server module ILOM prompt, type: The server module initializes. 2. Switch communication to the server module host. When the ILOM prompt appears, type: The server module might take several minutes to complete POST. If a boot device installed with Oracle Solaris OS is accessible locally, the server module boots. Otherwise, the system will use the boot net command to seek a boot device on the network. You are now connected to the server module host. 3. The server module hardware installation is now complete. You can now configure the Oracle Solaris OS to meet your needs. Related Information ¦ “Configure the System” on page 31 -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS. . . -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #. ...Powering On the Server Module for the First Time 31 ? Configure the System This procedure assumes that you are using the Oracle Solaris OS software that was preinstalled on the hard disk drive in slot HDD0 of the server module. If you are installing the Oracle Solaris OS another way, complete the Oracle Solaris OS installation then resume this procedure. ? Respond to configuration questions in the Oracle Solaris installation process. See the configuration choices you planned, based on “Oracle Solaris Configuration Settings” on page 32. Related Information ¦ “Install Oracle Solaris Software From the Network” on page 31 ¦ “Assign a Static IP Address to the Service Processor” on page 33 ? Install Oracle Solaris Software From the Network If you choose to use Oracle Solaris OS software other than the preinstalled Oracle Solaris OS, you can install the operating system from the network. ? Refer to the Solaris Installation Guide: Network-Based Installations for the version of Oracle Solaris OS that you plan to use. You can obtain this guide at: (http://docs.sun.com) This guide includes information about using a JumpStart server on your network to install the OS. Related Information ¦ “Oracle Solaris Configuration Settings” on page 3232 SPARC T3-1B Server Module Installation Guide • December 2010 Oracle Solaris Configuration Settings The following are configuration parameters that you are prompted to provide when configuring the Oracle Solaris OS on the SPARC T3-1B server module from Oracle. Parameter Description Language Select a number from the displayed language list. Locale Select a number from the displayed locale list. Terminal Type Select a terminal type that corresponds with your terminal device. Network? Select Yes. Multiple Network Interfaces Select the network interfaces that you plan to configure. If you are not sure, select the first interface in the list. DHCP? Select Yes or No according to your network environment. Host Name Enter the host name for the server. IP Address Enter the IP address for this Ethernet interface. Subnet? Select Yes or No according to your network environment. Subnet Netmask (If subnet was Yes) Enter the netmask for the subnet for your network environment. IPv6? Specify whether or not to use IPv6. If you are not sure, select No to configure the Ethernet interface for IPv4. Security Policy Select either standard UNIX security (No) or Kerberos Security (Yes). If you are not sure, select No. Confirm Review the onscreen information and change it if needed. Otherwise, continue. Name Service Select the name service according to your network environment. Note – If you select a name service other than None, you will be prompted for additional name service configuration information. NFSv4 Domain Name Select the type of domain name configuration according to your environment. If you are not sure, select Use the NFSv4 domain derived by the system. Time Zone (Continent) Select your continent. Time Zone (Country or Region) Select your country or region. Time Zone Select the time zone. Date and Time Accept the default date and time or change the values. root Password Enter the root password twice. This password is for the superuser account for the Oracle Solaris OS on this server. This password is not the SP password.Powering On the Server Module for the First Time 33 Related Information ¦ “Configure the System” on page 31 ¦ “Install Oracle Solaris Software From the Network” on page 31 ¦ “Assign a Static IP Address to the Service Processor” on page 33 ? Assign a Static IP Address to the Service Processor If the network your server module is connected to does not support DHCP for IP addressing, perform this procedure. 1. Set the SP to accept a Static IP Address. 2. Set the IP address for the SP. 3. Set the IP address for the SP gateway. 4. Set the netmask for the SP. This example uses 255.255.255.0 to set the netmask. Your network environment subnet might require a different netmask. Use a netmask number most appropriate to your environment. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0'34 SPARC T3-1B Server Module Installation Guide • December 2010 5. Use the show /SP/network command to verify that the parameters were set correctly. 6. Commit the changes to the SP network parameters. Note – You can run the show /SP/network command again (after performing the set /SP/network commitpending=true command) to verify that the parameters have been updated. 7. Set the static IP address when you configure the Oracle Solaris OS. See “Configure the System” on page 31. Related Information ¦ “Power On the System for the First Time” on page 30 ¦ “Configure the System” on page 31 ¦ “Oracle Solaris Configuration Settings” on page 32 -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'35 Glossary A ANSI SIS American National Standards Institute Status Indicator Standard. ASR Automatic system recovery. B blade Generic term for server modules and storage modules. blade server Server module. C chassis Modular system enclosure. CLI Command-line interface. CMM Chassis monitoring module. ILOM runs on the CMM, providing lights out management of the components in the modular system chassis. See ILOM. CMM ILOM ILOM that runs on the CMM. See ILOM.36 SPARC T3-1B Server Module Installation Guide • December 2010 D DHCP Dynamic Host Configuration Protocol. disk module or disk blade Interchangeable terms for storage module. DTE Data terminal equipment. E ESD Electrostatic discharge. F FEM Fabric expansion module. FEMs enable server modules to use the 10GbE connections provided by certain NEMs. See NEM. FRU Field-replaceable unit. H HBA Host bus adapter. See REM. I ILOM Oracle Integrated Lights Out Manager. ILOM firmware is preinstalled on a variety of Oracle systems. ILOM enables you to remotely manage your Oracle servers regardless of the state of the host system. ID PROM Chip that contains system information for the server module. IP Internet Protocol.Glossary 37 K KVM Keyboard, video, mouse. Refers to using a switch to enable sharing of one keyboard, one display, and one mouse with more than one computer. M MAC or MAC address Media access controller address. MSGID Message ID. N name space Top-level ILOM CMM target. NEM Network express module. NEMs provide 10/100/1000 Ethernet, 10GbE Ethernet ports, and SAS connectivity to storage modules. NET MGT Network management port. An Ethernet port on the CMM and on server module service processors. NMI Non-maskable interrupt. O OBP OpenBoot PROM. P PCI EM PCIe ExpressModule. Modular components that are based on the PCI Express industry-standard form factor and offer I/O features such as Gigabit Ethernet and Fibre Channel.38 SPARC T3-1B Server Module Installation Guide • December 2010 POST Power-on self-test. PSH Predictive self-healing. R REM RAID expansion module. Sometimes referred to as an HBA See HBA. Supports the creation of RAID volumes on disk drives. S SAS Serial attached SCSI. SCC System configuration chip. SER MGT Serial management port. A serial port on the CMM and on server modules service processors. server module Modular component that provides the main compute resources (CPU and memory) in a modular system. Server modules might also have onboard storage and connectors that hold REMs and FEMs. SP Service processor. SSH Secure shell. storage module Modular component that provides computing storage to the server modules. U UCP Universal connector port. UI User interface. UTC Coordinated Universal Time. UUID Universal unique identifier.Glossary 39 W WWID World-wide identifier. A unique number that identifies a SAS target.40 SPARC T3-1B Server Module Installation Guide • December 201041 Index A altitude speci?cations, 5 antistatic mat and wrist strap (Installation), 16 architecture, processor, 4 C cabling, 8 chassis inserting the server module, 18 preparation, 17 CLI for installation, 22 CMM NET MGT port, 11 CMM SER MGT port, 11 using for installation, 23 communicating during startup, 20 with the server module, 11 component installation, 17 con?guration settings for Oracle Solaris OS, 32 connecting to the server CMM NET MGT port (CLI), 22 CMM NET MGT port (Web Interface), 20 CMM SER MGT port (CLI), 23 UCP port, 25 connection methods, 11 connector covers, 18 cooling, 4 customer information sheet, 2 D data connector, 7 depth, 5 diagnostic messages, 26 dimensions, 5 DIMM types, 4 dongle cable, 8, 11, 25 E ejector arms, 18 electrical speci?cations, 5 environmental speci?cations, 5 ESD precautions, 16 Ethernet ports, 4 F features, server module, 4 FEMs, 4 ?ller panels, 18 front panel components, 7 G graphics, onboard, 4 H handling precautions, 15 height, 5 humidity speci?cations, 5 I ILOM root password, default, 20 installation chassis preparation, 17 planning, 1 tools required, 16 installing optional components, 17 server module, 15 inventory of shipping kit, 242 SPARC T3-1B Server Module Installation Guide • December 2010 IP address of CMM, 20 K KVMS, 4 L LEDs front panel, 7 M MAC address, 18 memory, 4 messages, diagnostic, 26 modular system chassis preparation, 17 monitoring diagnostic messages, 26 O optional component installation, 17 Oracle Solaris con?guration settings, 32 OS installing from the network, 31 Oracle Solaris con?guration settings, 32 P PCIe EMs, 4 physical speci?cations, 5 planning the installation, 1 power button, 7 power connector, 7 powering on for the ?rst time, 30 task overview, 29 precautions ESD, 16 handling, 15 preinstalled software, 6 processor architecture, 4 R rear panel components, 7 remote console, 20 REMs, 4 reset button, 7 RFID tag, 18 root password, default, 20 S serial cable pin assignments, 23 serial port connection, 11 serial redirection, 20 server module con?guring the OS, 31 features, 4 inserting into chassis, 18 installing, 15 installing the OS from the network, 31 powering on for the ?rst time, 30 starting, 23 startup communications, 20 shipping kit inventory, 2 site planning speci?cations, 5 software, preinstalled, 6 Solaris OS Solaris con?guration settings, 32 speci?cations electrical, 5 environmental, 5 physical, 5 ssh command, 22 start /SYS command, 30 start command, 22 starting the server module, 23 system ?rmware, 4 T temperature speci?cations, 5 terminal device, 16 tools required for installation, 16 U UCP port, 25 universal connector port (UCP), 4, 7 V voltage, 5 W web interface, 20 weight, 5 width, 5 Serveurs de la série SPARC T3 Guide d’administration N° de référence : E26261 Octobre 2011, révision AProduit recyclable Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation ix Présentation des ressources de l’administration système 1 Présentation d’ILOM 1 Fonctions d’ILOM spécifiques à la plate-forme 3 Présentation du SE Oracle Solaris 4 Présentation d’OpenBoot 4 Présentation d’Oracle VM Server pour SPARC 5 Logiciel de multiacheminement 6 Présentation du pack de gestion du matériel 7 Source du téléchargement du logiciel HMP (pack de gestion du matériel) 8 Source du téléchargement de la documentation HMP (pack de gestion du matériel) 9 Accès au serveur 11 ? Pour se connecter à ILOM 11 ? Pour se connecter à la console système 12 ? Pour afficher l’invite ok 13 ? Pour afficher l’invite -> d’ILOM 15 ? Pour utiliser un moniteur graphique local 15 ILOM Remote Console 17iv Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Contrôle du serveur 19 ? Pour mettre le serveur sous tension 19 ? Pour mettre le serveur hors tension 20 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris 21 ? Pour réinitialiser le serveur à partir d’ILOM 22 ? Pour rétablir les valeurs par défaut du SP 23 Configuration de volumes RAID matériels 25 Prise en charge des volumes RAID matériels 25 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques 28 Affichage des informations de zone de disques 29 Etat des zones de disques (zoningcli list) 30 Etat des zones de disques (probe-scsi-all) 31 Activation et désactivation du zonage des disques dans le champ 33 ? Activation des zones de disques (commande zoningcli) 34 ? Désactivation des zones de disques (commande zoningcli) 34 ? Mise à jour du microprogramme pour activer le zonage 34 Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs 35 ? Pour préparer l’utilisation de l’utilitaire FCode 36 Commandes de l’utilitaire FCode 37 ? Pour créer un volume RAID matériel 38 Disques hot spare de volumes RAID (LSI) 39 Diagnostic de l'état de fonctionnement d'un disque 40 DEL avant du disque de service requis 40 Messages d'erreur (console système et fichiers journaux) 40 ? Affichage de l'état (commande show-volumes, OBP) 41 ? Affichage de l'état (utilitaire sas2ircu, LSI) 42Sommaire v Stratégies de remplacement d'un disque RAID 43 ? Pour identifier les chemins d’accès aux périphériques 43 Modification des informations d’identification du serveur 45 ? Pour modifier les informations sur les données FRU des clients 45 ? Pour modifier les informations d’identification du système 46 Configuration des paramètres de stratégie 47 ? Pour définir le mode de refroidissement 47 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage 48 ? Pour définir l’état d’alimentation de l’hôte au redémarrage 49 ? Pour désactiver ou réactiver le délai de mise sous tension 50 ? Pour définir l’initialisation parallèle du SP et de l’hôte 50 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé 51 Configuration des adresses réseau 53 Options d’adresse réseau du SP 53 ? Pour désactiver ou réactiver l’accès réseau au SP 54 ? Pour afficher l’adresse IP du serveur DHCP 54 ? Pour afficher l’adresse MAC de l’hôte 55 Utilisation d’une connexion in-band au SP 56 Gestion in-band (sideband) d’ILOM 56 ? Pour configurer l’accès in-band (sideband) au SP 57 Configuration du mode d’initialisation 61 Présentation du mode d’initialisation 61 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC 62 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations 64 ? Pour gérer le script du mode d’initialisation de l’hôte 65vi Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte 66 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur 66 Configuration du comportement du serveur au redémarrage 69 ? Pour définir le comportement de l’hôte à sa réinitialisation 69 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête 70 ? Pour définir l’intervalle du délai d’attente d’initialisation 70 ? Pour définir le comportement à l’expiration du délai d’initialisation 71 ? Pour définir le comportement en cas d’échec du redémarrage 71 ? Pour définir le nombre maximum de tentatives de redémarrage 72 Configuration des périphériques 73 ? Pour déconfigurer manuellement un périphérique 73 ? Pour reconfigurer manuellement un périphérique 74 Contrôle du serveur 75 Contrôle des pannes 75 Présentation des diagnostics 76 ? Pour détecter les pannes (ILOM) 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) 77 ? Pour détecter les pannes à l’aide du POST 79 ? Pour afficher l’historique de la console 80 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) 81 ? Pour effacer une panne 83 Activation de la récupération automatique du système 83 Présentation de la récupération automatique de système 84 ? Pour activer la fonction ASR 84 ? Pour désactiver la fonction ASR 85 ? Pour afficher des informations sur les composants concernés par l’ASR 86Sommaire vii ? Pour afficher les composants du serveur 86 ? Pour localiser le serveur 87 Mise à jour du microprogramme 89 ? Pour afficher la version du microprogramme 89 ? Pour mettre à jour le microprogramme 90 ? Pour afficher la version d’OpenBoot 92 ? Pour afficher la version de POST 93 Mise à jour du système d’exploitation Oracle Solaris 95 Syntaxe de nom universel 95 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) 99 probe-scsi-all Exemple de sortie (SPARC T3-4) 102 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs 103 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs 105 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) 107 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) 111 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique 115 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID 116 Index 119viii Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011ix Utilisation de cette documentation Ce guide d’administration s’adresse aux administrateurs système expérimentés des serveurs de la série SPARC T3 d’Oracle (ci-après appelé le « serveur »). Il comprend des informations descriptives générales sur le serveur ainsi que des instructions détaillées sur la configuration et l’administration du serveur. Pour utiliser les informations de ce document, vous devez maîtriser les concepts et la terminologie des réseaux informatiques ainsi que posséder une connaissance poussée du système d’exploitation Oracle Solaris (SE Oracle Solaris). Remarque – Le Guide d’administration des serveurs de la série SPARC T3 s’applique à plusieurs serveurs et modules serveur. Certains exemples utilisés dans ce document sont basés sur des modèles particuliers de serveur. C’est pourquoi votre sortie peut différer des exemples présentés selon le produit que vous utilisez. ¦ « Commandes UNIX », page ix ¦ « Invites de shell », page x ¦ « Documentation, support et formation », page x Commandes UNIX Ce document peut ne pas contenir d’informations sur les commandes et procédures UNIX de base telles que l’arrêt et le démarrage du système ou la configuration des périphériques. Vous trouverez de plus amples informations à ce sujet dans : ¦ la documentation accompagnant les logiciels livrés avec votre système ; ¦ la documentation relative au SE Oracle Solaris, disponible à l’adresse suivante : http://www.oracle.com/technetwork/indexes/documentation/ index.htmlx Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Invites de shell Documentation, support et formation Le site Web d'Oracle Technology Network contient des informations sur les ressources supplémentaires suivantes : ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Shell Invite C shell nom-machine% Superutilisateur C shell nom-machine# Bourne shell et Korn shell $ Superutilisateur Bourne shell et Korn shell #1 Présentation des ressources de l’administration système Les sections suivantes présentent un récapitulatif des outils courants servant à administrer le serveur. ¦ « Présentation d’ILOM », page 1 ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ¦ « Logiciel de multiacheminement », page 6 ¦ « Présentation du pack de gestion du matériel », page 7 Présentation d’ILOM Oracle Integrated Lights Out Manager est un microprogramme de gestion système préinstallé sur les serveurs SPARC de la série T4. Il vous permet de gérer et de contrôler de manière active les composants installés sur le serveur. ILOM fournit une interface Web et une interface de ligne de commande, ainsi que les interfaces SNMP et IPMI. Le processeur de service ILOM fonctionne indépendamment du serveur et quel que soit l’état de marche du serveur, du moment que ce dernier (ou le système modulaire contenant le module serveur) est alimenté en courant CA. Lorsque vous connectez un serveur à une alimentation CA, le processeur de service ILOM démarre immédiatement et commence à contrôler le serveur. ILOM gère l’ensemble des tâches de surveillance et de contrôle environnementaux. L’invite -> indique que vous interagissez directement avec le processeur de service ILOM. Il s’agit de la première invite qui s’affiche lorsque vous vous connectez au serveur via le port de gestion série ou le port de gestion réseau, quel que soit l’état 2 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 d’alimentation de l’hôte. Sur un système modulaire, cette invite est également présente lorsque vous vous connectez à un module serveur soit directement soit via ILOM sur le module CMM du système modulaire. Vous pouvez également accéder à l’invite du processeur de service ILOM (->) à partir de l’invite ok de l’OpenBoot ou de l’invite # ou % d’Oracle Solaris, du moment que la console système est configurée pour être accessible via les ports de gestion série et réseau. Le processeur de service ILOM prend en charge un total de dix sessions simultanées par serveur : neuf connexions SSH via le port de gestion réseau et une via le port de gestion série. Pour plus d’informations sur l’utilisation des fonctions ILOM communes à toutes les plates-formes gérées par ILOM, consultez la documentation suivante à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage Informations connexes ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Pour se connecter à ILOM », page 11 Type d’information Titre Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur l’interface du navigateur Guide des procédures relatives à l’interface Web d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur les procédures CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations relatives aux protocoles SNMP et IPMI Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocols Reference Guide (Guide de référence des protocoles de gestion d’Oracle Integrated Lights Out Manager (ILOM) 3.0) Informations relatives à l’installation et à la configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur le module CMM Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM - Guide d’administration pour les systèmes modulaires 6000 et 6048 Présentation des ressources de l’administration système 3 Fonctions d’ILOM spécifiques à la plate-forme ILOM fonctionne sur diverses plates-formes, dont il prend en charge les fonctions qui leur sont communes. Certaines des fonctions d’ILOM sont limitées à un sous-ensemble de plates-formes. Cette section décrit la différence entre les fonctions d’ILOM prises en charge par le serveur et le jeu de fonctions communes décrit dans la documentation de base d’ILOM 3.0. Remarque – Pour effectuer certaines procédures décrites dans la documentation de base d’Oracle ILOM 3.0, vous devez établir une connexion série avec le serveur et activer le commutateur de présence physique sur ce dernier. Pour plus d’informations sur l’établissement d’une connexion série, reportez-vous au guide d’installation de votre serveur. Parmi les fonctions d’ILOM prises en charge sur d’autres plates-formes, les suivantes ne sont pas compatibles avec ce serveur : ¦ Fonctions du module de contrôle de châssis (CMM, Chassis Monitoring Module) telles que la connexion unique SSO (Single Sign On). Remarque : les serveurs lames T3 installés dans un système modulaire prennent en charge les fonctions du CMM. ¦ Déclencheur user-reset de diagnostics du POST non disponible ILOM prend en charge la fonction suivante sur ce serveur, mais cette dernière peut très bien ne pas être disponible sur d’autres plates-formes : ¦ Déclencheur hw-change de diagnostics du POST. Ce nouveau déclencheur (hw-change error-reset) constitue le paramètre par défaut du serveur. Il déclenche l’exécution du test POST chaque fois que le serveur est mis sous tension progressive CA ou que le capot du haut est retiré (le cas échéant). Pour plus d’informations sur le POST, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Présentation d’ILOM », page 14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation du SE Oracle Solaris Le SE Oracle Solaris comprend des commandes et d’autres ressources logicielles utilisées dans le cadre de l’administration du serveur. Pour une introduction aux outils de gestion de votre version d’Oracle Solaris, reportez-vous au manuel System Administration Guide: Basic Administration dans la collection de documents Oracle Solaris. Le logiciel SunVTS est inclus dans Oracle Solaris. Il permet de tester et de valider le matériel Oracle en contrôlant la connectivité et la fonctionnalité des périphériques, contrôleurs et dispositifs matériels. Outre les informations relatives à SunVTS contenues dans la documentation d’Oracle Solaris, les collections de documentation propres à SunVTS sont disponibles à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id=homepage Informations connexes ¦ « Présentation d’OpenBoot », page 4 Présentation d’OpenBoot Le microprogramme OpenBoot démarre le système d’exploitation, valide le matériel installé et permet d’effectuer d’autres tâches d’administration serveur situées en dessous du niveau du SE. Pour plus d’informations sur les commandes d’OpenBoot, reportez-vous au manuel OpenBoot 4.x Command Reference Manual inclus dans la collection de documents Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4Présentation des ressources de l’administration système 5 Présentation d’Oracle VM Server pour SPARC Un domaine logique regroupe de manière logique et discrète ses propres ressources, systèmes d’exploitation et identité au sein d’un seul système informatique. Les applications logicielles peuvent être exécutées dans les domaines logiques. Il est possible de créer, de détruire, de reconfigurer et de réinitialiser chaque domaine logique indépendamment des autres. Le logiciel Oracle VM Server pour SPARC vous permet de créer et de gérer jusqu’à 32 domaines logiques en fonction de la configuration matérielle du serveur sur lequel Oracle VM Server pour SPARC Manager est installé. Vous avez la possibilité de virtualiser les ressources et de définir des périphériques réseau, de stockage et d’E/S en tant que services pouvant être partagés entre les différents domaines. Les configurations Oracle VM Server pour SPARC sont stockées sur le SP. A l’aide des commandes de la CLI d’Oracle VM Server pour SPARC, vous pouvez ajouter une configuration, spécifier la configuration à utiliser et répertorier les configurations figurant sur le processeur de service. Vous avez également la possibilité d’utiliser la commande set /HOST/bootmode config=fichier_de_configuration d’ILOM pour indiquer la configuration d’initialisation d’Oracle VM Server. Informations connexes ¦ « Configuration du mode d’initialisation », page 61 ¦ Documentation d'Oracle VM Server pour SPARC http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html6 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Logiciel de multiacheminement Le logiciel de multiacheminement vous permet de définir et de contrôler les chemins physiques redondants des périphériques d’E/S, tels que les périphériques de stockage et les interfaces réseau. Si le chemin d’accès actif à un périphérique devient indisponible, le logiciel peut automatiquement basculer sur un chemin secondaire pour maintenir la disponibilité. Cette fonction est connue sous l’appellation de basculement automatique. Pour tirer parti des fonctions de multiacheminement, vous devez configurer le serveur avec du matériel redondant, par exemple des interfaces réseau redondantes ou deux adaptateurs de bus hôte connectés à la même baie de stockage à double accès. Pour le serveur, trois types différents de logiciel de multiacheminement sont disponibles : ¦ Le logiciel Oracle Solaris IP Network Multipathing assure le multiacheminement et l’équilibrage de charge pour les interfaces réseau IP. Pour des instructions de configuration et d’administration du logiciel Oracle Solaris IP Network Multipathing, consultez le manuel IP Network Multipathing Administration Guide fourni avec votre version d’Oracle Solaris. ¦ Le logiciel VVM inclut une fonction appelée DMP, qui assure le multiacheminement pour les disques ainsi que l’équilibrage de charge des disques en vue d’optimiser le débit d’E/S. Pour des informations sur VVM et sa fonction DMP, reportez-vous à la documentation qui accompagne le logiciel VERITAS Vo lume Ma na ger. ¦ StorageTek Traffic Manager est une architecture entièrement intégrée au sein du SE Oracle Solaris (à partir de la version Oracle Solaris 8) qui permet d’accéder aux périphériques d’E/S par le biais de plusieurs interfaces de contrôleur hôte depuis une unique instance du périphérique d’E/S. Pour plus d’informations sur StorageTek Traffic Manager, reportez-vous à la documentation de votre SE Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5Présentation des ressources de l’administration système 7 Présentation du pack de gestion du matériel Le pack de gestion du matériel (HMP) des serveurs Sun d'Oracle fournit des outils qui permettent de gérer et de configurer les serveurs Oracle à partir du système d'exploitation de l'hôte. Pour utiliser ces outils, vous devez installer le logiciel HMP sur votre serveur. Une fois le logiciel installé, vous pouvez effectuer les tâches de gestion de serveur décrites dans le tableau ci-après. TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil Surveillance du matériel Oracle avec l'adresse IP de l'hôte Utilisez l'agent de gestion du matériel et les plug-ins du protocole SNMP (Simple Network Management Protocol) au niveau du système d'exploitation pour activer la surveillance in-band de votre matériel Oracle. Cette fonctionnalité de surveillance in-band vous permet d'utiliser l'adresse IP du système d'exploitation hôte pour surveiller vos serveurs Oracle sans connecter le port de gestion Oracle ILOM à votre réseau. Outil de gestion au niveau du système d'exploitation hôte Surveillance des périphériques de stockage, notamment des baies de disque RAID Utilisez l'agent de gestion du stockage du serveur au niveau du système d'exploitation pour activer la surveillance in-band des périphériques de stockage configurés sur vos serveurs Oracle. L'agent de gestion du stockage du serveur fournit un démon de système d'exploitation qui collecte des informations sur les périphériques de stockage du serveur, notamment les disques durs et les baies RAID, puis les envoie au processeur de service Oracle ILOM. Les fonctions de surveillance du stockage dans Oracle ILOM vous permettent de consulter et de surveiller les informations fournies par l'agent de gestion du stockage du serveur. Vous pouvez accéder aux fonctions de surveillance du stockage dans Oracle ILOM à partir de l'interface de ligne de commande (CLI). Fonctions de surveillance du stockage de la CLI Oracle ILOM 3.0 Interrogation, mise à jour et validation des versions de microprogramme sur les périphériques de stockage SAS pris en charge Utilisez l'outil CLI fwupdate à partir du système d'exploitation hôte pour interroger, mettre à jour et valider les versions de microprogramme sur les périphériques de stockage pris en charge, tels que les adaptateurs de bus hôte SAS (HBA), les contrôleurs de stockage SAS intégrés, les expandeurs de stockage SAS LSI et les disques durs. CLI fwupdate au niveau du SE hôte8 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Source du téléchargement du logiciel HMP (pack de gestion du matériel) Vous pouvez télécharger le logiciel HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://support.oracle.com Restauration, définition et consultation des paramètres de configuration d'Oracle ILOM Utilisez l'outil CLI ilomconfig à partir du système d'exploitation hôte pour restaurer les paramètres de configuration d'Oracle ILOM, ainsi que pour consulter et définir les propriétés d'Oracle ILOM associées à la gestion du réseau, la configuration de l'horloge et la gestion des utilisateurs. CLI ilomconfig au niveau du SE hôte Affichage ou création de volumes RAID sur des unités de stockage Utilisez l'outil CLI raidconfig à partir du système d'exploitation hôte pour consulter et créer des volumes RAID sur les unités de stockage connectées aux contrôleurs RAID, notamment les baies de stockage. CLI raidconfig au niveau du SE hôte Utilisation de l'outil IPMItool pour accéder aux serveurs Oracle et les gérer Utilisez la ligne de commande « open source » IPMItool à partir du système d'exploitation hôte pour accéder aux serveurs Oracle et les gérer à l'aide du protocole IPMI. Ligne de commande IMPItool au niveau du SE hôte * Les systèmes d'exploitation pris en charge sont les suivants : Solaris, Linux, Windows et VMware TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur (suite) Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel OutilPrésentation des ressources de l’administration système 9 Source du téléchargement de la documentation HMP (pack de gestion du matériel) Vous pouvez télécharger la documentation HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://www.oracle.com/technetwork/documentation/sys-mgmt-network ing-190072.html Remarque – La documentation du pack de gestion du matériel version 2.1 fournie sur ce site est valable pour le pack de gestion du matériel version 2.1.1. Pour plus d'informations sur l'utilisation des fonctions de contrôle de stockage dans Oracle ILOM, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (Guide des notions fondamentales d'Oracle Integrated Lights Out Manager (ILOM) 3.0) et au Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (Guide des procédures relatives à la CLI d'Oracle Integrated Lights Out Manager (ILOM) 3.0). Pour plus d'informations sur l'accès et la gestion d'un serveur via SNMP ou IPMI, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (Guide des références des protocoles de gestion Oracle Integrated Lights Out Manager (ILOM) 3.0). Les liens vers ces manuels Oracle ILOM sont fournis sur le site Web indiqué ci-dessus. Vous trouverez l'intégralité de la documentation Oracle ILOM à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage10 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201111 Accès au serveur Les sections suivantes présentent des informations relatives à l’établissement de communications de bas niveau avec le serveur à l’aide de l’outil ILOM et de la console système. ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour se connecter à la console système », page 12 ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « ILOM Remote Console », page 17 ? Pour se connecter à ILOM Dans cette procédure, il est supposé que vous utilisez la configuration par défaut du processeur de service comme décrite dans le guide d’installation du serveur. Remarque – Pour un module serveur SPARC T3, consultez le guide d’installation qui contient des instructions relatives au démarrage d’ILOM via le module CMM du système modulaire, ainsi que des instructions concernant la connexion directe au processeur de service sur le module serveur.12 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Ouvrez une session SSH et connectez-vous au SP en spécifiant son adresse IP. Le nom d’utilisateur par défaut ILOM est root et le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM. Exécutez les tâches nécessaires. Remarque – Pour bénéficier d’une sécurité optimale sur le serveur, changez le mot de passe par défaut de ce dernier. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à la console système », page 12 ? Pour se connecter à la console système ? A l’invite -> d’ILOM, tapez : où option correspond à l’une des valeurs suivantes : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright 2010 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accès au serveur 13 ¦ -f|force : permet à un utilisateur doté du rôle Console (c) de prendre la console à l’utilisateur qui y est connecté et d’obliger ce dernier à utiliser le mode de visualisation. ¦ -script : contourne l’invite de confirmation (yes ou no). Remarque – Si le SE Oracle Solaris n’est pas en cours d’exécution, le serveur affiche l’invite ok. Informations connexes ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « Pour se connecter à ILOM », page 11 ? Pour afficher l’invite ok Dans cette procédure, il est supposé que vous utilisez la configuration par défaut de la console système. ? Dans le tableau suivant, choisissez la méthode d’arrêt appropriée pour accéder à l’invite ok. Pour s'assurer que l'invite ok s'affiche, définissez la propriété ILOM suivante avant d'exécuter les procédures décrites dans le tableau : -> set /HOST/bootmode script=”setenv auto-boot? false”14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Attention – Dans la mesure du possible, affichez l’invite ok en effectuant un arrêt progressif du SE. Toute autre méthode risque d'entraîner la perte des informations d'état du serveur. Informations connexes ¦ « Contrôle des pannes », page 75 Etat du serveur Procédure à suivre SE en cours d’exécution et réactif Arrêtez le serveur en utilisant l’une des méthodes suivantes : • Dans une fenêtre d’utilitaire de shell ou de commande, tapez une commande appropriée (par exemple, la commande shutdown ou init 0), comme décrit dans la documentation relative à l’administration système d’Oracle Solaris. • A l’invite -> d’ILOM, tapez : -> stop /SYS • Appuyez sur le bouton de marche/arrêt du serveur. • A partir d’Oracle Solaris, exécutez la commande suivante en tant qu’utilisateur root : # uadmin 2 0 SE non réactif Arrêtez le serveur à partir d’ILOM. (à condition que le logiciel de système d’exploitation ne soit pas en cours d’exécution et que le serveur soit déjà sous le contrôle du microprogramme OpenBoot) A l’invite -> d’ILOM, tapez : -> set /HOST send_break_action=break Appuyez sur Entrée. Tapez ensuite : -> start /HOST/console SE non réactif et initialisation automatique devant être empêchée Arrêtez le serveur à partir d’ILOM et désactivez la fonction d’initialisation automatique. A l’invite -> d’ILOM, tapez : -> set /HOST/bootmode script=”setenv auto-boot? false” Appuyez sur Entrée. Tapez ensuite : -> reset /SYS -> start /HOST/consoleAccès au serveur 15 ? Pour afficher l’invite -> d’ILOM ? Utilisez l’une des méthodes suivantes pour afficher l’invite -> d’ILOM : ¦ A partir de la console système, tapez la séquence d’échappement (#.) d’ILOM. ¦ Connectez-vous directement à ILOM à partir d’un périphérique relié au port de gestion série ou au port de gestion réseau. ¦ Connectez-vous à ILOM via une connexion SSH. Reportez-vous à la section « Pour se connecter à ILOM », page 11. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à ILOM », page 11 ? Pour utiliser un moniteur graphique local Vous pouvez rediriger la console système vers un moniteur graphique local. Vous ne pouvez pas utiliser un moniteur graphique local pour effectuer l’installation initiale du serveur, ni pour afficher les messages de l’autotest de l’allumage (POST). Pour utiliser un moniteur graphique local : 1. Connectez le câble vidéo du moniteur à un port vidéo du serveur. Fixez les vis à serrage à main pour maintenir la connexion. Reportez-vous à la documentation de votre système pour connaître les instructions de connexion qui peuvent s’appliquer à votre serveur. 2. Branchez le cordon d’alimentation du moniteur sur une prise CA. 3. Connectez le câble de clavier USB à un port USB. 4. Connectez le câble de souris USB à un autre port USB sur le serveur. 5. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13.16 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 6. A l’invite ok, définissez les variables de configuration OpenBoot PROM suivantes : 7. Pour appliquer vos modifications, tapez : Le serveur enregistre les modifications de paramètres et s’initialise automatiquement. Remarque – Au lieu d’utiliser la commande reset-all pour stocker les modifications de paramètres, vous pouvez également mettre le serveur progressivement sous tension à l’aide du bouton de marche/arrêt. Vous pouvez à présent exécuter des commandes système et afficher les messages du système en utilisant le moniteur graphique local. Pour activer l’interface graphique, passez à l’étape suivante. 8. Activez l’interface graphique du SE Oracle Solaris. Une fois que le SE Oracle Solaris est installé et initialisé, tapez les commandes suivantes afin d’afficher l’écran de connexion de l’IG. Informations connexes ¦ « Pour afficher l’invite ok », page 13. ¦ « ILOM Remote Console », page 17 ok setenv input-device keyboard ok setenv output-device screen ok reset-all # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # rebootAccès au serveur 17 ILOM Remote Console ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques suivants sur un serveur hôte. Ce groupe de périphériques est couramment désigné par l’abréviation KVMS (Keyboard, Video, Mouse, Storage, c’est-à-dire clavier, vidéo, souris et stockage). ¦ Clavier ¦ Affichage vidéo de la console ¦ Souris ¦ Affichage série de la console ¦ Périphériques de stockage ou images (CD/DVD) ILOM Remote Console est documentée dans le manuel Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (à la section « Managing Remote Hosts Redirection and Securing the ILOM Remote Console »). Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 5618 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201119 Contrôle du serveur Les sections suivantes présentent les procédures de commande des opérations de base relatives au serveur. ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Pour rétablir les valeurs par défaut du SP », page 23 ? Pour mettre le serveur sous tension 1. Connectez-vous à ILOM. « Pour se connecter à ILOM », page 11. Remarque – Si vous disposez d’un système modulaire, assurez-vous que vous n’êtes pas connecté au module serveur souhaité. 2. A l’invite -> d’ILOM, tapez : Remarque – Pour éviter d’avoir à confirmer, utilisez la commande start -script /SYS. -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->20 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour mettre le serveur hors tension 1. Arrêtez le SE Oracle Solaris. A l’invite Oracle Solaris, tapez : 2. Passez de l’invite de la console système à celle de la console du processeur de service. 3. A partir de l’invite -> d’ILOM, tapez ce qui suit : Remarque – Pour exécuter un arrêt immédiat, utilisez la commande stop -force -script /SYS. Vérifiez que toutes les données sont enregistrées avant de taper cette commande. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs41-58 syslogd: going down on signal 15 svc.stard: The system is down. syncing file systems...done Program terminated r)eboot o)k prompt, h)alt? # o ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Contrôle du serveur 21 Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris Il est inutile de mettre le serveur hors puis sous tension pour effectuer une réinitialisation. ? Pour réinitialiser le serveur à partir de l’invite d’Oracle Solaris, tapez l’une des commandes suivantes : ou Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 # shutdown -g0 -i6 -y # reboot22 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour réinitialiser le serveur à partir d’ILOM La commande reset d’ILOM entraîne une réinitialisation matérielle progressive ou forcée du serveur. Par défaut, la commande reset effectue une réinitialisation progressive du serveur. ? Tapez l’une des commandes suivantes pour réinitialiser le serveur. ¦ Procédez à une réinitialisation progressive à partir d’ILOM : ¦ Si cette opération est impossible, effectuez une réinitialisation matérielle forcée à partir d’ILOM : Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 -> reset /SYS -> reset -force /SYSContrôle du serveur 23 ? Pour rétablir les valeurs par défaut du SP Si le processeur de service (SP) est endommagé ou que vous souhaitez rétablir ses valeurs par défaut définies en usine, modifiez le paramètre /SP reset_to_defaults, puis mettez l’hôte hors tension afin d’appliquer les modifications. Il s’agit d’un nouveau comportement. Dans les versions précédentes, il était inutile de mettre l’hôte hors tension pour rétablir les valeurs par défaut du SP. Vous devez disposer des autorisations d’administrateur pour effectuer cette tâche. 1. Pour rétablir les valeurs par défaut du SP, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ all : supprime l’ensemble des données de configuration du SP. ¦ factory : supprime l’ensemble des données de configuration du SP de même que tous les fichiers journaux. 2. La mise hors tension suivie du redémarrage de l’hôte permet d’achever les changements de paramètres. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP24 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201125 Configuration de volumes RAID matériels Les sections suivantes décrivent les procédures de configuration et de gestion des volumes de disques RAID à l’aide des contrôleurs de disque SAS intégrés du serveur. ¦ « Prise en charge des volumes RAID matériels », page 25 ¦ « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28 ¦ « Affichage des informations de zone de disques », page 29 ¦ « Activation et désactivation du zonage des disques dans le champ », page 33 ¦ « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Disques hot spare de volumes RAID (LSI) », page 39 ¦ « Diagnostic de l'état de fonctionnement d'un disque », page 40 ¦ « Stratégies de remplacement d'un disque RAID », page 43 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 Prise en charge des volumes RAID matériels Les serveurs de la série SPARC T3 contiennent des contrôleurs RAID SAS 2 intégrés qui permettent la formation de volumes de disques logiques composés d'un ou plusieurs disques durs redondants. Ces contrôleurs prennent en charge les niveaux RAID suivants : ¦ RAID 0 : répartition des données26 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ RAID 1 : mise en miroir des données (à l'aide de deux disques) ¦ RAID 1e : mise en miroir améliorée (à l'aide de trois à huit disques) La répartition des données fait référence à la technique de distribution des fichiers de données sur plusieurs disques, de sorte que le stockage et la récupération puissent être effectués en parallèle sur plusieurs canaux de données. La répartition des données peut réduire le temps nécessaire à la lecture et l'écriture des fichiers de données. La mise en miroir des données fait référence à la technique de stockage de copies identiques de données sur des disques séparés. La mise en miroir des données critiques permet de réduire les risques de perte de données grâce à la création d'instances dupliquées des données. Le tableau suivant décrit les ressources des contrôleurs RAID par défaut fournies sur les différents serveurs de la série SPARC T3. TABLEAU : Contrôleurs SAS-2 intégrés sur les serveurs de la série SPARC T3 Modèle SPARC T3 Détails du contrôleur SAS-2 intégré et du fond de panier de disques T3-1 Deux contrôleurs intégrés et un fond de panier de disques. Il existe deux versions du fond de panier de disques T3-1 : Capacité de huit disques : – Le contrôleur 0 gère les emplacements de disque 0 à 3 – Le contrôleur 1 gère les emplacements de disque 4 à 7 Capacité de seize disques (zones activées) : * – Le contrôleur 0 gère les emplacements de disque 0 à 7 – Le contrôleur 1 gère les emplacements de disque 8 à 15 * Les fonds de panier d'une capacité de seize disques doivent être divisés en deux zones de huit disques. Pour plus d’informations, reportez-vous à la section « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. T3-1B Un contrôleur intégré et deux fonds de panier de disques dotés de deux emplacements de disque chacun. Le contrôleur intégré est connecté aux deux fonds de panier par deux câbles de données et deux câbles d'alimentation. T3-2 Un contrôleur intégré et un fond de panier de disques doté de six emplacements de disque. Le contrôleur intégré est connecté au fond de panier par deux câbles de données distincts. T3-4 Aucun contrôleur intégré, deux modules d'extension RAID (REM) enfichables internes et deux fonds de panier de disques : – REM 0 gère les emplacements de disque 0 à 3 (fond de panier 0) – REM 1 gère les emplacements de disque 4 à 7 (fond de panier 1)Configuration de volumes RAID matériels 27 Chaque contrôleur SAS-2 vous permet de créer jusqu'à deux volumes RAID contenant des disques connectés à ce contrôleur. Un volume ne peut pas contenir des disques connectés à un autre contrôleur. Vous avez le choix entre trois environnements pour créer et gérer les ressources RAID sur votre serveur. ¦ Utilitaire Fcode : Cet utilitaire se compose d’un ensemble de commandes permettant d’afficher les cibles et de gérer les volumes logiques de votre serveur. Vous accédez à ces commandes via l'environnement OpenBoot PROM (OBP). Les exemples figurant dans ce manuel s'appuient sur les commandes Fcode. ¦ Utilitaire de gestion LSI SAS2 2008 RAID pour serveurs SPARC T3 : Vous pouvez utiliser les commandes sas2ircu contenues dans l'utilitaire de configuration intégré LSI SAS2 pour configurer et gérer les volumes RAID sur votre serveur. Pour utiliser le jeu de commandes sas2ircu, téléchargez et installez le logiciel SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/index.aspx Vous pouvez télécharger la documentation SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Pack de gestion du matériel Oracle 2.1.1 : Vous pouvez utiliser les commandes RAIDconfig figurant dans le compostant Outils de l'interface CLI des serveurs Oracle de ce logiciel pour créer et gérer des volumes RAID sur votre serveur. Pour utiliser ces commandes, téléchargez et installez la toute dernière version du pack de gestion du matériel à partir du site My Oracle Support : http://support.oracle.com/CSP/ui/flash.html Cliquez sur le lien suivant pour accéder au guide d'installation du pack de gestion du matériel Oracle 2.1. http://download.oracle.com/docs/cd/E19960-01/index.html Remarque – La version 2.1.1 est la plus ancienne version du pack de gestion du matériel Oracle prenant en charge les serveurs de la série SPARC T3. Vous trouverez une documentation complète sur l'utilisation du pack de gestion du matériel version 2.1 à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21&id=homepage28 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Conseil – Certaines commandes du pack de gestion du matériel 2.1.1 présentent parfois de longs délais de démarrage ou d'exécution sur les serveurs SPARC T3-2 and T3-4. Dans de tels cas, vous pouvez, si vous le préférez, utiliser les commandes Fcode ou LSI sas2ircu. Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques Chaque fois qu'un fond de panier à seize disques SPARC T3-1 est géré par des contrôleurs SAS-2 intégrés, le fond de panier doit être divisé en deux zones logiques, à raison de huit emplacements de disque par zone : ¦ Zone A : Contient les emplacements de fond de panier 0 à 7 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 0. ¦ Zone B : Contient les emplacements de fond de panier 8 à 15 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 1. Le zonage des disques nécessite que le microprogramme de l'expandeur LSI du fond de panier dispose au minimum du patch 147034-01. Ce patch crée les zones de disques requises. Remarque – Pour plus d'informations sur le patch 147034-01, reportez-vous à son document LISEZ-MOI (README.147034) sur le site My Oracle Support. Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35.Configuration de volumes RAID matériels 29 Si une carte HBA RAID PCIe interne est utilisée pour gérer le fond de panier des disques au lieu des contrôleurs intégrés, les zones de disques doivent être désactivées. La plupart des serveurs SPARC T3-1 dotés de fonds de panier à seize disques sont livrés avec le zonage activé. Il existe deux exceptions à cette règle par défaut : ¦ Le zonage est désactivé à l'usine lorsqu'un système SPARC T3-1 doté d'un fond de panier à seize disques est fabriqué avec une carte HBA RAID PCIe interne. ¦ Les systèmes SPARC T3-1 fabriqués avec des fonds de panier à 16 disques avant que le zonage des disques ne devienne une spécification par défaut étaient livrés sans le patch 147034-01. Pour ces systèmes, le patch doit être installé dans le champ pour prendre en charge le zonage des disques. La version 2.1.1 du pack de gestion du matériel des serveurs Sun d'Oracle inclut un utilitaire de zonage de disques que vous pouvez utiliser pour activer et désactiver le zonage, ainsi que pour afficher les informations d'état des zones. Voir « Activation et désactivation du zonage des disques dans le champ », page 33 et « Affichage des informations de zone de disques », page 29 pour plus d'informations. Remarque – Les contrôleurs n'étant pas en mesure de voir les disques au delà d'une zone, un contrôleur SAS-2 ne peut pas créer un volume RAID qui contient des disques inclus dans l'autre zone. Vous pouvez utiliser l'utilitaire zoningcli pour activer ou désactiver le zonage dans un fond de panier à seize disques. Pour plus d’informations, reportez-vous à la section « Activation et désactivation du zonage des disques dans le champ », page 33. Affichage des informations de zone de disques Ces rubriques décrivent deux méthodes d'accès aux informations de zonage de disques. ¦ « Etat des zones de disques (zoningcli list) », page 30 ¦ « Etat des zones de disques (probe-scsi-all) », page 3130 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Etat des zones de disques (zoningcli list) Si le pack de gestion du matériel version 2.1.1 (ou une version plus récente) est installé sur votre système, vous pouvez utiliser la commande zoningcli list pour déterminer si le zonage est activé ou non. L'état du zonage est indiqué sur la première ligne de la sortie dans chacun des exemples suivants. Le zonage est désactivé : Le zonage est activé : Si l'utilitaire zoningcli n'est pas disponible sur votre système, vous pouvez utiliser la commande OBP probe-scsi-all afin de déterminer si le zonage est activé ou non. Reportez-vous à la section « Etat des zones de disques (probe-scsi-all) », page 31. # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: disable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 =================================================== # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: enable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 ===================================================Configuration de volumes RAID matériels 31 Etat des zones de disques (probe-scsi-all) Les exemples de sortie de la commande probe-scsi-all suivants illustrent la différence d'affichage des périphériques de stockage lorsque le zonage est activé et lorsqu'il est désactivé. 10 disques sont représentés dans les deux exemples. Ils sont identifiés comme PhyNum 0 à 9. Remarque – Les entrées PhyNum 1 à 6 ne sont pas indiquées dans ces exemples afin de réduire leur taille. Les entrées omises n'affectent pas l'illustration du concept. Le zonage est désactivé : Lorsque le zonage est désactivé, les deux contrôleurs sont en mesure de voir tous les disques. L'exemple suivant illustre ce point en répertoriant tous les disques avec le contrôleur 0 et ceux avec le contrôleur 1. Conseil – Notez que les valeurs SASDeviceName et SASAddress de chaque PhyNum répertorié sous le contrôleur 1 correspondent aux valeurs DeviceName et SASAddress du PhyNum répertorié sous le contrôleur 0. Ceci est également valable pour PhyNum 1 à 6 qui ont été omis pour réduire la taille de la table. {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 12 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 13 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 1432 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Le zonage est activé : Dans l'exemple suivant, le zonage est activé et chaque disque est illustré connecté à un seul contrôleur SAS-2. PhyNum 0 à 7 sont connectés au contrôleur 0 et PhyNum 8 à 9 sont connectés au contrôleur 1. Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 15 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 13 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 14 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 {0} ok {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Configuration de volumes RAID matériels 33 Activation et désactivation du zonage des disques dans le champ Ces rubriques décrivent comment activer et désactiver les zones de disques dans le champ. Remarque – Vous devez disposer de la version 2.1.1 du pack de gestion du matériel d'Oracle (ou une version plus récente) pour avoir accès à la commande zoningcli. ¦ « Activation des zones de disques (commande zoningcli) », page 34 ¦ « Désactivation des zones de disques (commande zoningcli) », page 34 ¦ « Mise à jour du microprogramme pour activer le zonage », page 34 Target b Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target c Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 Target d Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 {0} ok34 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Activation des zones de disques (commande zoningcli) ? Si le zonage a été désactivé, vous pouvez l'activer en exécutant la commande suivante : ? Désactivation des zones de disques (commande zoningcli) ? Si le zonage a été activé, vous pouvez le désactiver en exécutant la commande suivante : ? Mise à jour du microprogramme pour activer le zonage Si votre serveur SPARC T3-1 nécessite un zonage de disques alors qu'il ne dispose pas du niveau de microprogramme système minimal et/ou que le microprogramme LSI du fond de panier ne dispose pas du patch 147034-01, procédez comme suit pour que les contrôleurs fonctionnent correctement. Attention – Veillez à sauvegarder toutes les données stockées sur les disques avant d'installer ce patch. Vous pouvez restaurer les fichiers une fois que le patch est installé. ? Appliquez le patch 147034-01 au microprogramme LSI sur le fond de panier des disques. Ce patch entraîne le partitionnement du fond de panier en deux zones de huit disques décrites dans « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. # zoningcli enable zoning # zoningcli disable zoningConfiguration de volumes RAID matériels 35 Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35. Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs Pour que la commande devalias soit valide pour les emplacements de disque 8 à 15, le niveau du microprogramme système doit être 8.0.5.b (ou un niveau supérieur à 8.0) ou 8.1.0.c (ou un niveau supérieur). Si le microprogramme système de votre serveur ne répond pas à la configuration minimale, vous devez utiliser le chemin d'accès complet au disque afin d'identifier les disques individuels de la plage 8 à 15. Par exemple, s'il est en cours d'exécution avec le niveau minimal du microprogramme système et la commande devalias appropriée, vous pouvez utiliser la ligne de commande suivante pour démarrer le système à partir du disque se trouvant à l'emplacement 12 : Si l'emplacement du disque est un emplacement compris entre 8 et 15 et que le niveau du microprogramme système ne répond pas aux exigences décrites ci-dessus, vous devez indiquer le chemin complet d'accès au périphérique pour le disque d'initialisation. Cet exemple illustre le chemin d'accès du disque 12 : # boot disk12 # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10c36 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour préparer l’utilisation de l’utilitaire FCode 1. Ouvrez une fenêtre de terminal xterm ou gnome. Les commandes FCode génèrent une sortie détaillée volumineuse. Les fenêtres de terminal xterm ou gnome offrent cependant une fonctionnalité de barre de défilement, destinée à faciliter la visualisation de la sortie. 2. Désactivez le paramètre auto-boot dans OBP et activez l’environnement OBP après une mise sous tension ou une réinitialisation. 3. La commande show-devs dresse la liste des chemins de périphériques connectés au serveur. Remarque – Dans le cas d’un module serveur, le chemin d’accès au périphérique peut correspondre à /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. La commande select vous permet de choisir le contrôleur sur lequel vous souhaitez créer un volume RAID matériel. Au lieu d’utiliser l’intégralité du chemin d’accès au périphérique pour le contrôleur, vous pouvez définir un alias préconfiguré à associer à ce dernier. Par exemple : Pour afficher les alias préconfigurés sur le serveur, exécutez la commande devalias. Reportez-vous à la section « Pour identifier les chemins d’accès aux périphériques », page 43. Affichez les adresses SAS des unités connectées à l’aide de la commande show-children. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi0Configuration de volumes RAID matériels 37 Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Commandes de l’utilitaire FCode Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Commande FCode Description show-children Dresse la liste complète des unités physiques et des volumes logiques connectés. show-volumes Dresse une liste détaillée des volumes logiques connectés. create-raid0-volume Crée un volume RAID 0 (au minimum deux cibles). create-raid1-volume Crée un volume RAID 1 (exactement deux cibles). create-raid1e-volume Crée un volume RAID 1e (au minimum trois cibles). delete-volume Supprime un volume RAID. activate-volume Réactive un volume RAID après le remplacement de disques.38 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour créer un volume RAID matériel 1. Préparez la création du volume RAID. Reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 2. La commande show-children permet de répertorier les unités physiques situées sur le contrôleur sélectionné. 3. Exécutez la commande create-raid0-volume, create-raid1-volume ou create-raid1e-volume pour créer une unité logique à partir des disques physiques. Par exemple, pour créer un volume RAID 0 avec les cibles 9 et a, commencez par spécifier les cibles, puis tapez la commande create : Par exemple, pour créer un volume RAID 1e avec les cibles a, b et c, tapez : {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volumeConfiguration de volumes RAID matériels 39 4. Pour vérifier la création du volume, tapez : 5. Saisissez unselect-dev pour désélectionner le contrôleur. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Disques hot spare de volumes RAID (LSI) Vous pouvez configurer deux disques hot spare globaux pour protéger les données figurant sur des volumes RAID mis en miroir. Si l'un des disques d'un volume RAID 1 ou RAID 1E mis en miroir échoue, le contrôleur RAID intégré remplace automatiquement le disque défaillant par un disque hot spare, puis resynchronise les données mises en miroir. Utilisez l'utilitaire LSI sas2ircu pour ajouter des disques hot spare globaux. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'ajout de disques hot spare. {0} ok show-volumes {0} ok unselect-dev40 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Diagnostic de l'état de fonctionnement d'un disque Les rubriques suivantes traitent des diverses façons de déterminer si un disque figurant dans un volume RAID a échoué ou non : ¦ « DEL avant du disque de service requis », page 40 ¦ « Messages d'erreur (console système et fichiers journaux) », page 40 ¦ « Affichage de l'état (commande show-volumes, OBP) », page 41 ¦ « Affichage de l'état (utilitaire sas2ircu, LSI) », page 42 DEL avant du disque de service requis Lorsqu'une erreur se produit sur un disque d'un système SPARC T3, la DEL jaune de service requis s'allume à l'avant du disque. Cette DEL jaune vous permet de localiser le disque défaillant dans le système. Par ailleurs, les DEL d’opération de maintenance requise des panneaux avant et arrière s’allument également lorsque le système détecte une panne au niveau du disque dur. Reportez-vous à votre manuel d'entretien pour connaître l'emplacement et la description de ces DEL. Messages d'erreur (console système et fichiers journaux) Lorsqu'une erreur se produit sur un disque, des messages d'erreur s'affichent sur la console système. Il s'agit d'un exemple d'affichage de console système indiquant que le volume 905 a été endommagé par la perte de PhysDiskNum 1 : Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degradedConfiguration de volumes RAID matériels 41 Vous pouvez également afficher ces messages en consultant les fichiers /var/adm/messages : Reportez-vous à la rubrique View the System Message Log Files (Affichage des fichiers journaux de messages système) du manuel d'entretien pour plus d'informations sur la consultation de ces messages. ? Affichage de l'état (commande show-volumes, OBP) Vous pouvez arrêter le système et utilisez la commande show-volumes de l'OBP pour savoir si un disque est en panne. 1. Arrêtez le système et affichez l'invite ok de l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded42 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Sélectionnez le contrôleur SAS. Pour plus d’informations, reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 3. Saisissez la commande show-volumes pour afficher les volumes RAID et les disques qui leur sont associés. Dans l'exemple suivant, le disque secondaire d'un volume RAID 1 est hors ligne. 4. Saisissez la commande unselect-dev pour désélectionner le contrôleur SAS. ? Affichage de l'état (utilitaire sas2ircu, LSI) ? Utilisez l'utilitaire sas2ircu LSI pour afficher l'état du volume RAID et des périphériques qui lui sont associés. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'affichage et l'interprétation de l'état du périphérique à l'aide de l'utilitaire sas2ircu. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguration de volumes RAID matériels 43 Stratégies de remplacement d'un disque RAID Suivez les stratégies décrites ci-dessous lors du remplacement d'un disque défectueux dans un volume RAID. Remarque – Les instructions cfgadm figurant dans le manuel d'entretien s'appliquent à des disques individuels ne faisant pas partie de volumes RAID. Lorsqu'un disque fait partie d'un volume RAID, il n'est pas nécessaire d'annuler la configuration avant de le remplacer à chaud par un nouveau disque. ? Pour identifier les chemins d’accès aux périphériques La procédure suivante permet de localiser les chemins d’accès aux périphériques propres à votre serveur. 1. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Niveau de volume RAID Stratégie RAID 0 Lorsqu'un disque d'un volume RAID 0 tombe en panne, toutes les données figurant sur ce volume sont perdues. Remplacez le disque défectueux par un disque de même capacité, recréez le volume RAID 0, puis restaurez les données à partir d'une sauvegarde. RAID 1 Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID. RAID 1E Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID.44 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. A partir de l’invite ok, tapez : Informations connexes ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok45 Modification des informations d’identification du serveur Les sections suivantes décrivent la procédure de stockage des informations (à des fins de contrôle d’inventaire ou de gestion des ressources du site, par exemple) sur le SP et les PROM des FRU à l’aide de l’interface CLI d’ILOM. ¦ « Pour modifier les informations sur les données FRU des clients », page 45 ¦ « Pour modifier les informations d’identification du système », page 46 ? Pour modifier les informations sur les données FRU des clients La propriété /SP customer_frudata permet de stocker des informations dans toutes les PROM de FRU. Ce champ peut servir à identifier un système particulier pour une application tierce ou pour tout autre besoin d’identification au sein de votre environnement. ? A l’invite -> d’ILOM, tapez : Remarque – Vous devez placer la chaîne de données (données) entre guillemets anglo-saxons. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations d’identification du système », page 46 -> set /SP customer_frudata=”data”46 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier les informations d’identification du système La propriété /SP system_identifier permet de stocker les informations d’identification client. Cette chaîne de caractères est codée dans tous les messages d’interruption générés par SNMP. L’affectation d’un identificateur de système unique peut se révéler utile pour déterminer le système qui génère le message SNMP. ? A l’invite -> d’ILOM, tapez : Remarque – La chaîne des données (données) doit être placée entre guillemets anglo-saxons doubles. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations sur les données FRU des clients », page 45 -> set /SP system_identifier=”data”47 Configuration des paramètres de stratégie Les sections suivantes décrivent la gestion des stratégies de configuration à l’aide d’ILOM. ¦ « Pour définir le mode de refroidissement », page 47 ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’initialisation parallèle du SP et de l’hôte », page 50 ¦ « Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé », page 51 ? Pour définir le mode de refroidissement La propriété HOST_COOLDOWN, lorsqu’elle est activée, oblige le serveur à entrer en mode de refroidissement (cooldown) à la mise hors tension de l’hôte. Dès lors que le serveur est hors tension et que le mode de refroidissement est activé, ILOM est redirigé de manière à contrôler certains composants et à garantir qu’ils restent en dessous d’une température minimale et qu’ils ne présentent aucun danger pour l’utilisateur. Une fois les composants passés en dessous de la température minimale, le serveur n’est plus alimenté en courant ou, si cette opération prend plus de 4 minutes, l’hôte s’éteint. Remarque – La propriété HOST_COOLDOWN ne concerne pas les modules serveur.48 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le serveur refroidit certains composants avant d’être mis hors tension. ¦ disabled : la température des composants n’est pas contrôlée lors de la mise hors tension. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_LAST_POWER_STATE permet de contrôler le comportement du serveur après une panne de courant inattendue. Une fois le courant externe rétabli, le processeur de service d’ILOM est exécuté automatiquement. En général, l’hôte n’est pas remis sous tension tant que vous n’utilisez pas ILOM pour cette opération. ILOM enregistre l’état de l’alimentation actuelle du serveur dans l’espace de stockage non volatile. Si la stratégie HOST_LAST_POWER_STATE est activée, ILOM peut rétablir l’état d’alimentation précédent de l’hôte. Cette stratégie s’avère pratique en cas de panne d’alimentation ou si vous changez le serveur d’emplacement physique. Par exemple, si le serveur hôte est en cours d’exécution lors d’une panne d’alimentation et que la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur disabled, le serveur hôte demeure hors tension lorsque l’alimentation est rétablie. Si la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur enabled, le serveur hôte redémarre lorsque l’alimentation est rétablie. ? A l’invite -> d’ILOM, tapez : -> set /SP/policy HOST_COOLDOWN=value -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguration des paramètres de stratégie 49 où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : lorsque l’alimentation est rétablie, le serveur revient à l’état où il se trouvait au moment de la mise hors tension. ¦ disabled : maintient le serveur hors tension au retour du courant (valeur par défaut). Si vous activez HOST_LAST_POWER_STATE, vous devriez également configurer /SP/policy HOST_POWER_ON_DELAY. Pour plus d’informations, reportez-vous à la section « Pour désactiver ou réactiver le délai de mise sous tension », page 50. Informations connexes ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_AUTO_POWER_ON permet de mettre l’hôte sous tension lorsque le serveur est alimenté par du courant externe. Si cette stratégie est définie sur enabled, le processeur de service définit HOST_LAST_POWER_STATE sur disabled. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : une fois le courant rétabli, l’hôte est automatiquement mis sous tension après l’initialisation du SP. ¦ disabled : maintient l’hôte hors tension au retour du courant (valeur par défaut). Informations connexes ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 -> set /SP/policy HOST_AUTO_POWER_ON=value50 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour désactiver ou réactiver le délai de mise sous tension La propriété /SP/policy HOST_POWER_ON_DELAY permet de définir un délai d’attente avant la remise automatique sous tension du serveur. Ce délai est un intervalle aléatoire compris entre une et cinq secondes. Retarder la mise sous tension du serveur permet de minimiser les surintensités au niveau de la source d’alimentation principale. Cela est important lorsque plusieurs serveurs montés en rack se mettent sous tension après une coupure de courant. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : oblige le serveur à attendre un court moment avant de se mettre sous tension automatiquement. ¦ disabled : le serveur se met automatiquement et sans délai sous tension (valeur par défaut). Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’initialisation parallèle du SP et de l’hôte La propriété /SP/policy PARALLEL_BOOT, lorsqu’elle est activée, permet à l’hôte de s’initialiser/se mettre sous tension parallèlement au SP quand une stratégie de mise sous tension automatique (HOST_AUTO_POWER_ON ou HOST_LAST_POWER_STATE) est activée ou que l’utilisateur appuie sur le bouton de marche/arrêt pendant que le SP est en cours d’initialisation. ILOM doit être en cours d’exécution pour permettre la mise sous tension de l’hôte lorsque l’utilisateur appuie sur le bouton de marche/arrêt ou que les stratégies de mise sous tension automatique sont configurées. Lorsque cette propriété est désactivée, le SP s’initialise avant l’hôte. -> set /SP/policy HOST_POWER_ON_DELAY=valueConfiguration des paramètres de stratégie 51 Remarque – L’initialisation parallèle n’est pas prise en charge par les modules serveur. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le SP et l’hôte s’initialisent en même temps. ¦ disabled : le SP et l’hôte s’initialisent de manière consécutive (en série). Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé La propriété /SYS setkeyswitch_state permet de contrôler la position de l’interrupteur à clé virtuel. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ normal : le serveur peut se mettre automatiquement sous tension et lancer le processus d’initialisation (valeur par défaut). ¦ standby : met l’hôte hors tension et désactive la mise sous tension. ¦ diag : la mise sous tension de l’hôte est autorisée ; ce paramètre remplace ceux de /HOST/diag cible, ce qui se traduit par l’exécution d’un nombre maximum de POST. -> set /SP/policy PARALLEL_BOOT=value -> set /SYS keyswitch_state=value52 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ locked : la mise sous tension de l’hôte est autorisée. Toutefois, vous ne pouvez pas mettre à jour les périphériques flash ni définir la propriété /HOST send_break_action=break. Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 2053 Configuration des adresses réseau Les sections suivantes décrivent la gestion des adresses réseau à l’aide d’ILOM. ¦ « Options d’adresse réseau du SP », page 53 ¦ « Pour désactiver ou réactiver l’accès réseau au SP », page 54 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ¦ « Utilisation d’une connexion in-band au SP », page 56 Options d’adresse réseau du SP Vous pouvez accéder au SP de votre système de plusieurs façons. Tenez compte des options disponibles et choisissez la méthode d’accès la plus adaptée à votre environnement. Vous pouvez établir des connexions physiques avec le SP au moyen d’une connexion série ou réseau. La connexion réseau peut être configurée de manière à utiliser une adresse IP statique ou le protocole DHCP (valeur par défaut). Le cas échéant, les serveurs de la série T3 peuvent se connecter au SP via une connexion réseau in-band au lieu d’utiliser le port de gestion réseau out-of-band défini par défaut. Pour plus d’informations sur chaque option, reportez-vous à la documentation suivante : ¦ Pour utiliser une connexion série au SP, consultez la section suivante : Pour connecter un terminal ou un émulateur au port SER MGT, dans le guide d’installation de votre serveur ou Communication avec le module serveur au démarrage, dans le guide d’installation de votre module serveur. ¦ Pour assigner une adresse IP statique au SP, consultez la section suivante : Pour assigner une adresse IP statique au SP, dans le guide d’installation du serveur ¦ Pour utiliser une connexion in-band au SP, reportez-vous à la section suivante : « Gestion in-band (sideband) d’ILOM », page 5654 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ Documentation d’Oracle Integrated Lights Out Manager (ILOM) 3.0 ¦ « Présentation d’ILOM », page 1 ? Pour désactiver ou réactiver l’accès réseau au SP La propriété /SP/network state permet d’activer ou de désactiver l’interface réseau du processeur de service. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled (valeur par défaut) ¦ disabled Informations connexes ¦ « Options d’adresse réseau du SP », page 53 ? Pour afficher l’adresse IP du serveur DHCP Afin d’afficher l’adresse IP du serveur DHCP ayant fourni l’adresse IP dynamique requise par le processeur de service, affichez la propriété dhcp_server_ip. ? A l’invite -> d’ILOM, tapez : -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguration des adresses réseau 55 Remarque – La liste des propriétés peut varier en fonction de votre serveur. Informations connexes ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ? Pour afficher l’adresse MAC de l’hôte La propriété /HOST macaddress est automatiquement configurée par le logiciel serveur de sorte que vous ne pouvez ni la définir ni la modifier. La valeur est lue et déterminée à partir de la carte de configuration système amovible du serveur (PROM SCC) ou à partir de l’ID de PROM du module serveur, puis stockée en tant que propriété dans ILOM. /HOST macaddress désigne l’adresse MAC du port net0. Chaque adresse MAC de port supplémentaire augmente d’une unité, l’adresse de base étant /HOST macaddress. Par exemple, net1 équivaut à la valeur de /HOST macaddress plus un (1). ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show56 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 Utilisation d’une connexion in-band au SP Les sections suivantes décrivent l’utilisation d’une connexion in-band (ou sideband) au SP. ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 Gestion in-band (sideband) d’ILOM Par défaut, la connexion au SP du serveur est établie par le biais du port de gestion réseau out-of-band (NET MGT). La fonction de gestion sideband ILOM vous permet de sélectionner le port NET MGT ou l’un des ports Gigabit Ethernet du serveur (NETn), en l’occurrence des ports in-band, pour envoyer ou recevoir des commandes ILOM vers et à partir du SP du serveur. Les ports in-band sont également désignés en tant que ports sideband. En utilisant un port de gestion sideband pour gérer le processeur de service du serveur, une connexion par câble et un port de commutateur réseau ne sont plus nécessaires. Dans des configurations où de nombreux serveurs sont gérés, comme par exemple dans les centres de données, la gestion sideband peut ainsi permettre des économies importantes en termes d’utilisation de matériel et de réseau. Remarque – L’utilisation de connexions in-band est déconseillée avec les modules serveur. -> show /HOST macaddressConfiguration des adresses réseau 57 Lorsque la gestion sideband est active dans ILOM, les situations suivantes peuvent se produire : ¦ La connexion au SP du serveur peut être interrompue si vous changez la configuration du port de gestion SP lorsque vous êtes connecté au SP via une connexion réseau, telle que SSH, Web ou ILOM Remote Console. ¦ La connectivité intégrée entre le processeur de service et le système d’exploitation hôte peut ne pas être prise en charge par le contrôleur Gigabit Ethernet hôte intégré. Dans ce cas, utilisez un port différent ou routez le trafic de transmission entre la source et les cibles de destination au lieu d’utiliser la commutation/un pont L2. ¦ Les mises hors et sous tension de l’hôte du serveur peuvent interrompre la connectivité réseau des ports Gigabit Ethernet du serveur (NETn) configurés pour la gestion sideband. Dans ce cas, configurez les ports de commutation/pont contigus sous forme de ports hôtes. Informations connexes ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 ¦ « Options d’adresse réseau du SP », page 53 ? Pour configurer l’accès in-band (sideband) au SP Cette procédure décrit la méthode d’accès au SP via une gestion in-band (ou sideband) au moyen d’un port réseau hôte. Si vous effectuez cette procédure via une connexion réseau, vous risquez de perdre la connectivité au serveur. Une connexion série pour cette procédure permet d’éviter la perte de connectivité pendant les modifications de configuration de la gestion sideband. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. En cas de connexion par le port série, vous pouvez assigner une adresse IP statique. Pour obtenir les instructions, consultez les informations relatives à l’assignation d’une adresse IP dans le guide d’installation de votre serveur.58 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Affichez les paramètres réseau actuels : 4. Définissez le port de gestion du SP sur un port sideband (où n correspond à un chiffre compris entre 0 et 3) : -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set commitpending=trueConfiguration des adresses réseau 59 5. Vérifiez l’application de la modification : Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Options d’adresse réseau du SP », page 53 -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NET0 sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show60 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201161 Configuration du mode d’initialisation Les propriétés du mode d’initialisation d’ILOM permettent de spécifier la manière dont l’hôte s’initialise dans le cadre de la résolution d’un problème lié à OpenBoot ou Oracle VM Server pour SPARC. ¦ « Présentation du mode d’initialisation », page 61 ¦ « Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC », page 62 ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Pour gérer le script du mode d’initialisation de l’hôte », page 65 ¦ « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 Présentation du mode d’initialisation Les propriétés du mode d’initialisation (bootmode) annulent et remplacent la méthode d’initialisation par défaut du serveur. Cette possibilité s’avère pratique pour remplacer des paramètres OpenBoot ou Oracle VM Server particuliers pouvant être incorrects, pour configurer des variables OpenBoot à l’aide d’un script ou pour effectuer d’autres tâches similaires. Si, par exemple, les paramètres OpenBoot viennent à être endommagés, vous pouvez définir la propriété bootmode state sur reset_nvram, puis réinitialiser le serveur sur les paramètres OpenBoot par défaut définis en usine. Le personnel de maintenance peut également vous demander d’utiliser la propriété bootmode script afin de résoudre un problème. La portée intégrale des fonctionnalités de script n’est pas documentée et sert principalement à des fins de débogage.62 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Comme bootmode est destiné à corriger un problème lié aux paramètres OpenBoot ou Oracle VM Server, il ne s’applique qu’à une seule initialisation. De plus, pour éviter qu’un administrateur ne définisse la propriété bootmode state puis l’oublie, celle-ci expire lorsque l’hôte n’est pas réinitialisé dans les 10 minutes suivant la configuration de la propriété bootmode state. Informations connexes ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC Remarque – Vous devez utiliser un nom de configuration Oracle VM Server pour cette tâche. 1. Déterminez les configurations Oracle VM Server valides sur votre processeur de service en tapant ce qui suit à l’invite -> d’ILOM : -> show /HOST/domain/configsConfiguration du mode d’initialisation 63 2. Définissez la configuration du mode d’initialisation en tapant ce qui suit à l’invite -> d’ILOM : où la propriété config est dotée d’une valeur configname correspondant à une configuration de domaine logique nommée correcte. Par exemple, si vous avez créé une configuration Oracle VM Server intitulée ldm-set1 : Pour que le mode d’initialisation config revienne à la configuration par défaut d’usine, spécifiez factory-default. Par exemple : Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode config=configname -> set bootmode config=ldm-set1 -> set bootmode config=factory-default64 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations La propriété /HOST/bootmode state contrôle la manière dont les variables de la NVRAM OpenBoot sont utilisées. En général, les paramètres actifs de ces variables sont conservés. Définir /HOST/ bootmode state=reset_nvram permet de ramener les variables de la NVRAM OpenBoot à leurs valeurs par défaut à la réinitialisation suivante. ? A l’invite -> d’ILOM, tapez : où valeur correspond à l’un des paramètres suivants : ¦ normal : conserve les paramètres actifs des variables de la NVRAM à la réinitialisation suivante. ¦ reset_nvram : redéfinit les variables OpenBoot sur les paramètres par défaut à la réinitialisation suivante. Remarque – state=reset_nvram rétablit la valeur « normal » après la prochaine réinitialisation du serveur ou après dix minutes (voir la propriété expires décrite à la section « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66). Les propriétés config et script n’arrivent pas à échéance et sont effacées lors de la prochaine réinitialisation du serveur ou manuellement en définissant la valeur sur "". Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode state=valueConfiguration du mode d’initialisation 65 ? Pour gérer le script du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où script contrôle la méthode d’initialisation du microprogramme OpenBoot PROM du serveur hôte. Le script n’a aucune incidence sur le paramètre /HOST/bootmode actuel. valeur peut compter jusqu’à 64 octets. Vous pouvez spécifier le paramètre /HOST/bootmode et définir le script dans la même commande. Par exemple : Une fois que le serveur est réinitialisé et que l’OpenBoot PROM lit les valeurs stockées dans le script, le microprogramme définit la variable OpenBoot PROM diag-switch? sur la valeur requise par l’utilisateur : true. Remarque – Si vous définissez /HOST/bootmode script="", ILOM configure script sur une valeur vide. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"66 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où expires correspond aux date et heure d’échéance du mode d’initialisation actif. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur Cette procédure vous permet de remplacer les paramètres de l’OpenBoot PROM et de lancer la réinitialisation du domaine de contrôle, ce qui entraîne le démarrage de l’hôte à l’invite ok. ? A l’invite -> d’ILOM, tapez : L’hôte redémarre puis s’arrête à l’invite ok. -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled reset /HOST/domain/control [-force] [-script]Configuration du mode d’initialisation 67 Informations connexes ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Configuration du mode d’initialisation », page 61 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 568 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201169 Configuration du comportement du serveur au redémarrage Pour configurer le comportement d’ILOM dans les scénarios de redémarrage ci-dessous, suivez les procédures indiquées ci-après. ¦ « Pour définir le comportement de l’hôte à sa réinitialisation », page 69 ¦ « Pour définir le comportement de l’hôte lorsque son exécution s’arrête », page 70 ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 ? Pour définir le comportement de l’hôte à sa réinitialisation Spécifiez si l’hôte doit continuer à démarrer lorsqu’une erreur se produit. ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ false : l’hôte continue la procédure d’initialisation même s’il rencontre une erreur. ¦ true : l’hôte ne continue pas la procédure d’initialisation s’il rencontre une erreur. Informations connexes ¦ « Configuration des paramètres de stratégie », page 47 -> set /HOST autorunonerror=value70 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête Spécifiez le comportement d’ILOM lorsque l’hôte quitte l’état d’EXECUTION (à l’expiration de l’horloge chien de garde). ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none : ILOM ne prend pas d’autre mesure que l’émission d’un avertissement. ¦ reset : ILOM tente de réinitialiser le serveur lorsque l’horloge chien de garde Oracle Solaris expire (option par défaut). ¦ dumpcore : ILOM tente de forcer un core dump du SE lorsque l’horloge chien de garde expire. Informations connexes ¦ « Pour afficher l’historique de la console », page 80 ? Pour définir l’intervalle du délai d’attente d’initialisation ? Définissez le délai d’attente entre une requête d’initialisation de l’hôte et l’initialisation proprement dite : La valeur par défaut de boottimeout correspond à 0 (zéro seconde) ou aucun délai d’attente. Les valeurs possibles sont comprises entre 0 et 36 000 secondes. Informations connexes ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguration du comportement du serveur au redémarrage 71 ? Pour définir le comportement à l’expiration du délai d’initialisation Spécifiez le comportement d’ILOM en cas d’échec de l’initialisation de l’hôte avant l’expiration du délai d’initialisation. ? Définissez le comportement au terme de la commande boottimeout : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune, par défaut) ¦ Réinitialisation Informations connexes ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ? Pour définir le comportement en cas d’échec du redémarrage Spécifiez le comportement d’ILOM lorsque l’hôte ne parvient pas à atteindre l’état running pour Oracle Solaris. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ powercycle ¦ poweroff (valeur par défaut) Informations connexes ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value72 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le nombre maximum de tentatives de redémarrage Indiquez le nombre de fois qu’ILOM doit tenter de redémarrer l’hôte. ? A l’invite -> d’ILOM, tapez : La valeur par défaut de maxbootfail est 3 (trois tentatives). Si l’initialisation de l’hôte échoue après le nombre de tentatives indiqué par maxbootfail, l’hôte est mis hors tension ou soumis à un cycle d’alimentation progressive (selon la configuration de bootfailrecovery). Dans les deux cas, la commande boottimeout est définie sur 0 (zéro seconde), empêchant d’autres tentatives de redémarrage de l’hôte. Informations connexes ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 -> set /HOST maxbootfail=attempts73 Configuration des périphériques Les sections suivantes présentent des informations sur la configuration des périphériques du serveur. ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour déconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=disabled permettant de déconfigurer manuellement les périphériques du serveur. Cette commande identifie le périphérique spécifié comme étant désactivé (disabled). Tout périphérique marqué disabled, que ce soit manuellement ou par le microprogramme système, est supprimé de la description de machine du serveur avant le transfert de contrôle à d’autres couches du microprogramme système, comme l’OpenBoot PROM. ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=disabled74 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour reconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=enabled permettant de reconfigurer manuellement les périphériques serveur. Cette commande vous permet de marquer le périphérique spécifié comme étant activé (enabled). ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=enabled75 Contrôle du serveur Le serveur dispose de nombreuses méthodes pour signaler un comportement défectueux, notamment les DEL, ILOM et l’autotest de l’allumage (POST). Pour en savoir plus sur les DEL et obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Contrôle des pannes », page 75 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour localiser le serveur », page 87 Contrôle des pannes Les sections suivantes présentent un récapitulatif des outils de diagnostic ainsi que des informations de base sur la détection des pannes du serveur à l’aide d’outils exécutés en amont du système d’exploitation, notamment ILOM et le POST. Pour obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Présentation des diagnostics », page 76 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher l’historique de la console », page 80 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ¦ « Pour effacer une panne », page 8376 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation des diagnostics Vous disposez de toute une gamme d’outils de diagnostic, de commandes et d’indicateurs permettant de contrôler et de dépanner un serveur. Reportez-vous au manuel d’entretien de votre serveur pour obtenir des informations complètes sur ces outils de diagnostic : ¦ DEL : fournissent une indication visuelle rapide du statut du serveur et de certaines FRU. ¦ ILOM : microprogramme exécuté sur le processeur de service. Outre l’interface qu’il fournit entre le matériel et le SE, le microprogramme ILOM permet également de suivre et de signaler l’état général des composants clés du serveur. ILOM exploite pleinement le POST et la technologie d’autorétablissement prédictif d’Oracle Solaris pour maintenir le serveur en état de fonctionnement, même en présence d’un composant défectueux. ¦ Autotest de l’allumage (POST) : le POST effectue des tests de diagnostic sur les composants du serveur après une réinitialisation manuelle pour s’assurer de leur intégrité. Configurable, le POST utilise le microprogramme ILOM pour mettre hors tension les composants défectueux, le cas échéant. ¦ Autorétablissement prédictif du SE Oracle Solaris : cette technologie contrôle en permanence l’intégrité du processeur et de la mémoire, et fonctionne avec ILOM pour placer un composant défectueux hors ligne, le cas échéant. Elle permet aux serveurs de prévoir avec précision les pannes de composants et de limiter de nombreux problèmes graves avant qu’ils ne surviennent. ¦ Fichiers journaux et interface de commandes : fournissent les fichiers journaux standard du SE Oracle Solaris, ainsi que les commandes d’investigation qui peuvent être utilisées et affichées sur le périphérique de votre choix. ¦ SunVTS : application qui permet de tester le serveur, de vérifier le fonctionnement du matériel et d’identifier les composants éventuellement défectueux en fournissant des recommandations pour leur réparation. Les DEL, le microprogramme ILOM, l’autorétablissement prédictif du SE et les nombreux fichiers journaux et messages de la console offrent une intégration mutuelle totale. Cela signifie que, par exemple, en cas de panne détectée par le logiciel Oracle Solaris, celle-ci est affichée et consignée, tandis que les informations correspondantes sont transmises à ILOM qui les consigne. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ Consultez la section du manuel d’entretien du serveur concernant la détection et la gestion des pannes.Contrôle du serveur 77 ? Pour détecter les pannes (ILOM) ? A l’invite -> d’ILOM, tapez : Cette commande affiche la cible, la propriété et la valeur de la panne. Par exemple : Informations connexes ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) Le shell de gestion des pannes d’ILOM (Fault Management Shell) permet d’utiliser les commandes du gestionnaire des pannes d’Oracle Solaris (fmadm et fmstat à partir d’ILOM, afin de visualiser à la fois les pannes relatives à l’hôte et à ILOM. 1. Pour lancer le shell intégré, à l’invite -> d’ILOM, tapez : -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/Faultmgt/shell (y/n)? y faultmgmtsp>78 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Pour obtenir la liste des pannes actuelles du serveur, tapez : Remarque – Si le serveur détecte le remplacement de la FRU défectueuse, la réparation ne nécessite pas l’exécution d’une commande par l’utilisateur, car la panne sera effacée automatiquement. 3. Détectez des informations complémentaires sur une panne donnée. Recherchez l’identificateur de panne MSG-ID (SPT-8000-42 dans l’exemple précédent), puis saisissez-le dans la zone de recherche à l’adresse http://www.sun.com/msg. 4. Pour réparer la panne, reportez-vous à la section : « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81. 5. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Contrôle du serveur 79 Informations connexes ¦ Article sur l'autorétablissement prédictif (en anglais) « Oracle Solaris 10 OS Feature Sportlight: Predictive Self Healing » disponible à l’adresse www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ? Pour détecter les pannes à l’aide du POST L’interrupteur à clé virtuel permet d’exécuter des diagnostics POST complets sans avoir à modifier les paramètres des propriétés de diagnostic. Notez que l’exécution des diagnostics POST peuvent prendre temps considérable lors de la réinitialisation du serveur. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. A l’invite -> d’ILOM, tapez : Le serveur est configuré pour exécuter les diagnostics POST complets au moment de sa réinitialisation. 3. Pour revenir aux paramètres de diagnostic standard après l’exécution du POST, à l’invite -> d’ILOM, tapez ce qui suit : Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal80 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher l’historique de la console Cette rubrique décrit la procédure d’affichage des tampons de sortie de la console du serveur hôte. Il existe deux tampons d’historique de console pouvant contenir jusqu’à 1 Mo d’informations. La cible /HOST/console/history écrit tous les types d’informations de journalisation. La cible /HOST/console/bootlog consigne les informations de démarrage et les données d’initialisation dans le tampon de la console jusqu’à ce qu’ILOM soit notifié par le serveur que le SE Oracle Solaris est exécuté et opérationnel. Ce tampon est conservé jusqu’à ce que l’hôte soit réinitialisé. Remarque – Vous devez disposer des droits d’administrateur ILOM pour utiliser cette commande. 1. Pour gérer le journal /HOST/console/history, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 1 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 1 et tout nombre entier ou "" pour indiquer un nombre de lignes illimité. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Si vous tapez la commande show /HOST/console/history sans définir d’arguments préalables à l’aide de la commande set, ILOM affiche toutes les lignes du journal de la console en commençant par la fin. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. -> set /HOST/console/history property=option [...] -> show /HOST/console/historyContrôle du serveur 81 2. Pour afficher le journal /HOST/console/bootlog, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) Vous pouvez utiliser la commande fmadm repair pour corriger des pannes diagnostiquées par ILOM. (Contrairement aux pannes détectées par l’hôte, les pannes et erreurs diagnostiquées par ILOM sont dotées d’un ID de message commençant par SPT.) Le seul moment auquel vous devriez utiliser la commande fmadm repair dans le shell de gestion des pannes d’ILOM pour une panne détectée par l’hôte est le cas où la panne est réparée sans qu’ILOM le remarque. Il se peut, par exemple, qu’ILOM ait été hors service lorsque la panne a été réparée. Dans ce cas, l’hôte n’afficherait plus la panne, contrairement à ILOM. Utilisez la commande fmadm repair pour effacer la panne. -> show /HOST/console/bootlog property82 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 1. Localisez la panne : 2. Pour réparer une panne détectée par ILOM, exécutez la commande fmadm repair : Remarque – Vous pouvez utiliser soit le nom NAC (par exemple, /SYS/MB) soit l’UUID (par exemple, fa4a2f86-5156-4243-8e88-d6516db12970) de la panne avec la commande fmadm repair. 3. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : Informations connexes ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit ->Contrôle du serveur 83 ? Pour effacer une panne ? A l’invite -> d’ILOM, tapez : Définissez clear_fault_action sur true pour effacer la panne au niveau du composant et à tous les niveaux inférieurs de l’arborescence /SYS. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher les composants du serveur », page 86 Activation de la récupération automatique du système Les sections suivantes présentent des informations relatives à la configuration du serveur en vue de récupérer automatiquement de pannes mineures. Remarque – Cette section fait référence à la fonction de récupération automatique du système et non à la fonction de dénomination voisine, l’Auto Service Request (requête automatique de service). ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 -> set /SYS/component clear_fault_action=true84 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation de la récupération automatique de système Le serveur assure la récupération automatique du système (ASR) en cas de panne des modules de mémoire ou des cartes PCI. La fonction ASR permet au serveur de reprendre son fonctionnement après certaines défaillances ou pannes matérielles non fatales. Lorsque l’ASR est activée, les diagnostics du microprogramme du système détectent automatiquement les composants matériels en panne. Une fonction de configuration automatique intégrée au microprogramme du système permet au système de déconfigurer les composants en panne et de rétablir le fonctionnement du serveur. Tant que le serveur est en mesure de fonctionner sans le composant en panne, la fonction ASR lui permet de redémarrer automatiquement sans intervention de l’utilisateur. Remarque – Vous devez activer l’ASR manuellement. Reportez-vous à la section « Pour activer la fonction ASR », page 84. Pour plus d’informations sur l’ASR, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour activer la fonction ASR 1. A l’invite -> d’ILOM, tapez : 2. A l’invite ok, tapez : -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? trueContrôle du serveur 85 Remarque – Pour plus d’informations sur les variables de configuration OpenBoot, reportez-vous au manuel d’entretien du serveur. 3. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke en permanence les modifications apportées aux paramètres et est automatiquement initialisé si la variable de configuration OpenBoot auto-boot? est définie sur true (valeur par défaut). Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour désactiver la fonction ASR 1. A l’invite ok, tapez : 2. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke définitivement le changement de paramètre. Une fois désactivée, la fonction ASR le reste tant que vous ne la réactivez pas. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ¦ « Présentation de la récupération automatique de système », page 84 ok reset-all ok setenv auto-boot-on-error? false ok reset-all86 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher des informations sur les composants concernés par l’ASR ? A l’invite -> d’ILOM, tapez : Dans la sortie de la commande show /SYS/composant component_state, tout périphérique indiqué comme désactivé a été déconfiguré manuellement en utilisant le microprogramme du système. La sortie de la commande indique également les périphériques qui ont échoué aux diagnostics du microprogramme et ont été automatiquement déconfigurés par le microprogramme du système. Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour afficher les composants du serveur Affichez des informations en temps réel sur les composants installés sur votre serveur en utilisant la commande show components d’ILOM. ? A l’invite -> d’ILOM, tapez : -> show /SYS/component component_state -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | EnabledContrôle du serveur 87 Remarque – Les composants varient en fonction du serveur. Informations connexes ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 ? Pour localiser le serveur Si vous avez besoin d’effectuer une opération de maintenance sur un composant, vous identifierez plus facilement le serveur concerné par la DEL de localisation système qui s’allume. Vous n’avez besoin d’aucun droit administrateur pour utiliser les commandes set /SYS/LOCATE et show /SYS/LOCATE. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. Gérez la DEL de localisation à l’aide des commandes suivantes. ¦ Pour activer la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour désactiver la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour afficher l’état de la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : Informations connexes ¦ « Contrôle des pannes », page 75 ¦ « Configuration des périphériques », page 73 /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=off -> show /SYS/LOCATE88 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201189 Mise à jour du microprogramme Les sections suivantes décrivent les procédures de mise à jour du microprogramme système et d’affichage des versions actuelles des microprogrammes des serveurs de la série SPARC T3 d’Oracle. ¦ « Pour afficher la version du microprogramme », page 89 ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Pour afficher la version d’OpenBoot », page 92 ¦ « Pour afficher la version de POST », page 93 ? Pour afficher la version du microprogramme La propriété /HOST sysfw_version affiche des informations relatives à la version du microprogramme système installée sur l’hôte. ? Affichez le paramètre actuel de cette propriété. A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST sysfw_version90 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour mettre à jour le microprogramme 1. Assurez-vous que le port de gestion réseau du processeur de service est configuré. Pour les instructions, reportez-vous au guide d’installation de votre serveur. 2. Ouvrez une session SSH pour vous connecter au processeur de service : 3. Mettez l’hôte hors tension : 4. Définissez le paramètre keyswitch_state sur normal: 5. Tapez la commande load en indiquant le chemin d’accès à la nouvelle image flash. La commande load met à jour à la fois l’image flash du processeur de service et le microprogramme de l’hôte. La commande load requiert les informations suivantes : ¦ Adresse IP d’un serveur TFTP du réseau pouvant accéder à l’image flash ¦ Chemin d’accès complet à l’image flash à laquelle l’adresse IP peut accéder % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalMise à jour du microprogramme 91 Cette commande s’utilise de la manière suivante : load [-script] -source tftp://xxx.xxx.xx.xxx/chemin d’accès où : ¦ -script : ne demande aucune confirmation et agit comme si yes était spécifié. ¦ -source : indique l’adresse IP et le chemin d’accès complet (URL) de l’image flash. Une fois l’image flash mise à jour, le serveur est réinitialisé automatiquement, puis il exécute les diagnostics et revient à l’invite de connexion sur la console série. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED92 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour afficher la version du microprogramme », page 89 ? Pour afficher la version d’OpenBoot La propriété /HOST obp_version affiche des informations sur la version d’OpenBoot installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Présentation d’OpenBoot », page 4 ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionMise à jour du microprogramme 93 ? Pour afficher la version de POST La propriété /HOST post_version affiche des informations sur la version de POST installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST post_version94 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201195 Mise à jour du système d’exploitation Oracle Solaris Ces rubriques décrivent comment mettre à jour le SE Oracle Solaris sur les serveurs Oracle SPARC de la série T3. ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe de nom universel Le SE Oracle Solaris utilise à présent la syntaxe de nom universel (WWN) au lieu du champ unique au niveau local tn (ID cible) dans les noms de périphériques logiques. Ce changement modifie la façon dont un périphérique de stockage cible est identifié lors du téléchargement du système d'exploitation sur un réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement :96 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ Avant le passage à la nomenclature WWN, le SE Oracle Solaris identifiait le périphérique d'initialisation par défaut comme étant c0t0d0. ¦ Depuis ce changement, l'identificateur du périphérique d'initialisation par défaut est désormais c0tWWNd0, où WWN correspond à une valeur hexadécimale unique à ce périphérique au niveau mondial. ¦ Cette valeur WWN n'est pas mappée de façon prévisible à l'adresse physique du périphérique auquel elle fait référence. Pour spécifier de manière fiable un périphérique de stockage particulier lors du téléchargement d'un système d'exploitation, vous devez déterminer la correspondance entre la valeur WWN affectée à ce périphérique et son emplacement physique. Vous trouverez cette correspondance à l'aide des commandes OBP ou Oracle Solaris : ¦ Dans OBP, exécutez probe-scsi-all. Voir « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ Dans Oracle Solaris, exécutez la commande format suivie de prtconf -v. Voir « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ou « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111. Ces commandes génèrent des informations sur les contrôleurs SAS et les périphériques de stockage qui leur sont connectés. Ces informations comprennent les noms logiques et physiques que vous pouvez analyser pour déterminer les relations entre les adresses physiques et logiques. Informations connexes ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116Mise à jour du système d’exploitation Oracle Solaris 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans une configuration de fond de panier à huit disques. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 7 disques durs dans une configuration de fond de panier à huit disques. Dans cet exemple, les disques durs sont connectés aux deux contrôleurs SAS de la manière suivante : ¦ Quatre disques durs sont connectés au contrôleur SAS 0. Il s'agit des cibles 9, a, b et c. ¦ Trois disques durs, ainsi qu'une unité de DVD SATA sont connectés au contrôleur SAS 1. Il s'agit respectivement des cibles 9, b, c et a. TABLEAU : Mappage des ports de contrôleurs SAS pour les backplanes à huit disques Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 798 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple de configuration est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7680d4 SASAddress 5000cca00a7680d5 PhyNum 2 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 3 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d40bf9b SASAddress 5000c5001d40bf99 PhyNum 1Mise à jour du système d’exploitation Oracle Solaris 99 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans un fond de panier à seize disques connectés aux contrôleurs SAS intégrés 0 et 1.100 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – La configuration d'un fond de panier à 16 disques par défaut se compose de deux zones isolées de façon logique, les emplacements de disque 0 à 7 pouvant être vus par le contrôleur SAS 0 et les emplacements de disque 8 à 15 pouvant l'être par le contrôleur SAS 1. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 9 disques durs dans une configuration de fond de panier à seize disques. Remarque – Le contrôleur 1 gère l'unité de DVD SATA. L'emplacement d'initialisation par défaut (emplacement physique 0) est répertorié sous le nom PhyNum 0 dans la section du contrôleur SAS 0. Son SASDeviceName a la valeur 5000cca00a59278c et son SASAddress a la valeur 5000cca00a59278d. TABLEAU : Mappage des ports de contrôleurs SAS pour les fonds de panier à seize disques Contrôleur SAS PhyNum (Hexadécimal) Emplacement de disque (Décimal) Contrôleur SAS PhyNum (Hexadéci mal) Emplacement de disque (Décimal) 0 0 0 1 8 8 1 1 9 9 2 2 A 10 3 3 B 11 4 4 C 12 5 5 D 13 6 6 E 14 7 7 F 15 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a746490 SASAddress 5000cca00a746491 PhyNum 8 Target bMise à jour du système d’exploitation Oracle Solaris 101 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d1283 SASAddress 5000c5001d0d1281 PhyNum 9 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a01014c SASAddress 5000cca00a01014d PhyNum a Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0ca947 SASAddress 5000c5001d0ca945 PhyNum b Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d2857 SASAddress 5000c5001d0d2855 PhyNum c Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02f5d0 SASAddress 5000cca00a02f5d1 PhyNum d Target 10 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c3d9b SASAddress 5000c5001d0c3d99 PhyNum e Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097737 SASAddress 5000c5001d097735 PhyNum f Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a59278c SASAddress 5000cca00a59278d PhyNum 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7e6fb SASAddress 5000c50017c7e6f9 PhyNum 1 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4bfcb8 SASAddress 5000cca00a4bfcb9 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7a3a3 SASAddress 5000c50017c7a3a1 PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02cc18 SASAddress 5000cca00a02cc19 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76dec0 SASAddress 5000cca00a76dec1 PhyNum 5 Target 10 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a773eac SASAddress 5000cca00a773ead PhyNum 6102 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-4) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09654f SASAddress 5000c5001d09654d PhyNum d Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 okMise à jour du système d’exploitation Oracle Solaris 103 ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Un serveur SPARC T3-4 a deux contrôleurs SAS intégrés, chacun connecté à un fond de panier à quatre disques différent. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque de ces fonds de panier. Remarque – OBP utilise un chemin d'accès différent au contrôleur SAS 1 dans les serveurs SPARC T3-4, selon que le serveur dispose de quatre ou deux processeurs. Le chemin d'accès au contrôleur SAS 0 est le même pour les deux configurations de processeurs. Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à quatre processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. TABLEAU : Mappage des ports de contrôleurs SAS pour un fond de panier à huit disques SAS Contrôleur PhyNum Emplacement de disque SAS Contrôleur PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00104 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 105 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à deux processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2106 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 107 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) Utilisez probe-scsi-all pour afficher les informations suivantes d'un périphérique SAS : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. L'exemple suivant est basé sur un serveur SPARC T3-2 à six disques durs. Quatre disques durs sont connectés au contrôleur SAS en tant que périphériques de stockage individuels. Il s'agit de Target 9, d, e et f. Deux disques durs sont configurés en tant que volume RAID. Cette baie de disques est Target 389. ? Exécutez probe-scsi-all. Dans l'exemple suivant, le disque dur installé à l'emplacement physique 0 a la valeur PhyNum 0. Il est désigné Target 9 et son SASDeviceName a la valeur 5000c5001cb4a637. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB108 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – L'exemple de sortie de probe-scsi-all illustré ci-dessus peut être appliqué à l'interprétation de la sortie de probe-scsi-all pour les systèmes SPARC T3-1B. Remarque – La sortie de probe-scsi-all des serveurs SPARC T3-1 et SPARC T3-4 présente des caractéristiques spéciales en raison de leur utilisation de deux contrôleurs SAS intégrés. En outre, sur les serveurs SPARC T3-1 dotés d'un fond de panier à seize disques, les deux contrôleurs se connectent aux disques durs à l'aide d'un expandeur SAS figurant sur le fond de panier. Ces différences sont expliquées dans « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 et « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00Mise à jour du système d’exploitation Oracle Solaris 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 dotés d'un fond de panier à seize disques. Ces systèmes disposent d'un expandeur SAS placé entre les deux contrôleurs SAS intégrés et les connecteurs de disque dur. Le fond de panier à 16 disques est divisé en zones, la valeur phy-num associée à chaque disque étant relative à son contrôleur. Remarque – Pour les systèmes dotés d'un fond de panier à huit disques et de deux contrôleurs intégrés, chaque contrôleur fournit une interface à quatre emplacements de disque. La valeur phy-num associée à chaque disque est ainsi relative à son contrôleur. Un exemple de la procédure de configuration d'un seul initiateur est donné dans « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 1. Exécutez la commande format. Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000c5001d3ff2d7d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000c5001d3ff2d7d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000C5001D3FF2D7d0 /scsi_vhci/disk@g5000c5001d3ff2d7 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/sd3a110 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000c5001d3ff2d7. Notez la valeur target-port répertoriée avec cette valeur WWN. Dans cet exemple, il s'agit de 5000c5001d3ff2d5. Il s'agit de l'ID cible du disque physique. Remarque – Dans un système SPARC T3-1 doté d'un fond de panier à seize disques, les deux contrôleurs répertorient le nom logique (la valeur wwn), le nom de port correspondant (valeur target-port) et l'emplacement de disque physique (valeur phy-num) de chaque disque dur connecté. dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/rsd3a Paths from multipath bus adapters: mpt_sas#2 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ <<=== Hard drive target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 <<=== Hard drive slot number name=’path-class’ type=string items=1 value=’primary’ mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 name=’path-class’ type=string items=1 value=’primary’Mise à jour du système d’exploitation Oracle Solaris 111 4. The value shown for the name=’phy-num’ entry indicates the physical slot containing the hard drive. Dans cet exemple, le périphérique cible se trouve à l'emplacement 4. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 et aux serveurs SPARC T3-4 d'une configuration de fond de panier à huit disques et un seul initiateur. 1. Exécutez la commande format. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]112 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000CCA00ABBAEB8d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000CCA00ABBAEB8d0. 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000cca00abbaeb8. Notez la valeur obp-path répertoriée sous le WWN 5000cca00abbaeb8. Reportez-vous au tableau ci-dessous pour trouver le contrôleur. Pour les serveurs SPARC T3-1, le contrôleur est identifié dans le deuxième champ : pci@1 = contrôleur 0 et pci@2 = contrôleur 1. Pour les serveurs SPARC T3-4, le contrôleur est identifié dans le premier champ. Pour les systèmes équipés de quatre processeurs, pci@400 = contrôleur 0 et pci@700 = contrôleur 1. Pour les systèmes équipés de deux processeurs, pci@400 = contrôleur 0 et pci@500 = contrôleur 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/rsd3a SPARC T3-1 Contrôleur 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 4) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 2) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Mise à jour du système d’exploitation Oracle Solaris 113 L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-1. Dans cet exemple de serveur SPARC T3-1, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-4. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’114 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Dans cet exemple de serveur SPARC T3-4, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. 4. Cette valeur phy-num correspond à l'emplacement de disque physique 0, comme indiqué dans la table de mappage des ports suivante. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Mise à jour du système d’exploitation Oracle Solaris 115 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur une unité de disque précise. Dans cet exemple, le nom du périphérique contient la valeur WWN 5000CCA00A75DCAC. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap116 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur un volume RAID. Lors de l'installation d'un logiciel sur un volume RAID, utilisez la valeur VolumeDeviceName du périphérique virtuel au lieu du nom de périphérique individuel. Dans cet exemple, le nom du volume RAID est 3ce534e42c02a3c0. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapMise à jour du système d’exploitation Oracle Solaris 117 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115118 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011119 Index A A propos, 1 Accès à la console système, 12 Accès réseau, activation ou désactivation, 54 Activation, 84 Adresse MAC de l’hôte, affichage, 55 Affichage de la version, 89, 92, 93 Affichage des composants concernés, 86 Annulation de la configuration, 73 C Câbles, clavier et souris, 15 Chemins d’accès aux périphériques, 43 Clavier, connexion, 15 Commandes, 37 Communication système, 11 Comportement à l’expiration du délai d’initialisation, 71 Comportement en cas d’échec du redémarrage, 71 Comportement lorsque l’hôte cesse de fonctionner, 70 Comportement suite à la réinitialisation de l’hôte, 69 Configuration, 25, 74 Connexion, 11 Console système, connexion, 12 Contournement, 83 Contrôle, 19 Création de volumes, 38 D Date d’expiration, 66 Définition au redémarrage, 49 Définition de l’état d’alimentation de l’hôte au redémarrage, 49 Définition de l’intervalle du délai d’attente d’initialisation, 70 Définition du nombre maximum de tentatives de redémarrage, 72 Désactivation, 85 Détection à l’aide d’ILOM, 77 Détection à l’aide du POST, 79 DHCP, affichage de l’adresse IP du serveur, 54 Diagnostic, 76 E Effacement, 83 Exécution de diagnostics, 79 F FCode, utilitaire, 36 Fonctions spécifiques à la plate-forme, 3 FRU, modification des données, 45 G Gestion, 73, 75 Gestion de la configuration, 62 Gestion du délai de mise sous tension, 50 Gestion du script, 65 Gestion du système, 61 Gestion lors de la réinitialisation, 64 H Historique de la console, affichage, 80 I Identification du système, modification, 46 Interrupteur à clé, comportement de l’hôte, 51 Invite, 12, 15120 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 L Localisation du serveur, 87 M Méthodes d’accès, 15 Microprogramme, mise à jour, 90 Mise hors tension, 20 Mise sous tension, 19 Moniteur graphique local, 15 Multiacheminement, logiciel, 6 N Nom d’utilisateur et mot de passe par défaut, 12 O ok, affichage de l’invite, 13 Options d’adresse réseau, 53 Oracle VM Server (LDoms), 62 Oracle VM Server pour SPARC, présentation, 5 P Présentation, 1, 61 Présentation de l’administration système, 1 Prise en charge, 25 R Réinitialisation à partir d’ILOM, 22 Réinitialisation à partir du SE, 21 Restauration au redémarrage, 48 S setting configuration variables, 16 SP, réinitialisation, 23 Stratégie d’initialisation parallèle, 50 SunVTS, 76 SPARC T3 Series Servers Administration Guide Part No. E21415-02 July 2011, Revision APlease Recycle Copyright © 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation ix Understanding System Administration Resources 1 ILOM Overview 1 Platform-Specific ILOM Features 3 Oracle Solaris OS Overview 3 OpenBoot Overview 4 Oracle VM Server for SPARC Overview 4 Multipathing Software 5 Hardware Management Pack Overview 6 Source for Downloading Hardware Management Pack Software 7 Source for Downloading Hardware Management Pack Documentation 7 Accessing the Server 9 ? Log In to ILOM 9 ? Log In to the System Console 10 ? Display the ok Prompt 11 ? Display the ILOM -> Prompt 12 ? Use a Local Graphics Monitor 13 ILOM Remote Console 14iv SPARC T3 Series Servers Administration Guide • July 2011 Controlling the Server 15 ? Power On the Server 15 ? Power Off the Server 16 ? Reset the Server From the Oracle Solaris OS 17 ? Reset the Server From ILOM 17 ? Reset the SP to Default Values 18 Configuring Hardware RAID 19 Hardware RAID Support 19 Disk Zones for SPARC T3-1 Servers With Sixteen-Disk Backplanes 22 Displaying Disk Zone Information 23 Disk Zone Status (zoningcli list) 23 Disk Zone Status (probe-scsi-all) 24 Enabling and Disabling Disk Zoning In the Field 27 ? Enable Disk Zones (zoningcli Command) 27 ? Disable Disk Zones (zoningcli Command) 27 ? Update Firmware to Enable Zoning 27 Minimum System Firmware for Valid devalias in Upper Disk Locations 28 ? Prepare to Use the FCode Utility 28 FCode Utility Commands 30 ? Create a Hardware RAID Volume 30 Hot Spare Drives in RAID Volumes (LSI) 32 Determining If a Drive Has Failed 32 Front Service Required Drive LEDs 32 Error Messages (System Console and Log Files) 33 ? Display Status (show-volumes Command, OBP) 34 ? Display Status (sas2ircu Utility, LSI) 34Contents v RAID Drive Replacement Strategies 35 ? Locate Device Paths 35 Changing Server Identification Information 37 ? Change Customer FRUdata Information 37 ? Change System Identifier Information 38 Configuring Policy Settings 39 ? Specify Cooldown Mode 39 ? Restore Host Power State at Restart 40 ? Specify Host Power State at Restart 41 ? Disable or Re-Enable Power-On Delay 41 ? Specify Parallel Boot of the SP and Host 42 ? Configure Host Behavior With the Keyswitch State 42 Configuring Network Addresses 45 SP Network Address Options 45 ? Disable or Re-Enable Network Access to the SP 46 ? Display the DHCP Server IP Address 46 ? Display the Host MAC Address 47 Using an In-band Connection to the SP 48 ILOM In-band (Sideband) Management 48 ? Configure SP In-band (Sideband) Access 49 Configuring Boot Mode 53 Boot Mode Overview 53 ? Configure the Host Boot Mode of Oracle VM Server for SPARC 54 ? Change the Host Boot Mode Behavior at Reset 55 ? Manage the Host Boot Mode Script 56 ? Display Host Boot Mode Expiration Date 57 ? Override OpenBoot PROM Settings to Reset the Server 57vi SPARC T3 Series Servers Administration Guide • July 2011 Configuring Server Behavior at Restart 59 ? Specify Behavior When the Host Resets 59 ? Specify Behavior When the Host Stops Running 60 ? Set the Boot Timeout Interval 60 ? Specify Behavior at Boot Timeout 61 ? Specify Behavior if Restart Fails 61 ? Specify Maximum Restart Attempts 62 Configuring Devices 63 ? Unconfigure a Device Manually 63 ? Reconfigure a Device Manually 63 Monitoring the Server 65 Monitoring Faults 65 Diagnostics Overview 65 ? Discover Faults (ILOM) 67 ? Discover Faults (ILOM Fault Management Shell) 67 ? Discover Faults Using POST 69 ? Display Console History 69 ? Repair a Fault (ILOM Fault Management Shell) 71 ? Clear a Fault 72 Enabling Automatic System Recovery 73 Automatic System Recovery Overview 73 ? Enable ASR 74 ? Disable ASR 74 ? View Information on Components Affected by ASR 75 ? Display Server Components 75 ? Locate the Server 76Contents vii Updating the Firmware 79 ? Display the Firmware Version 79 ? Update the Firmware 79 ? Display OpenBoot Version 82 ? Display POST Version 82 Updating the Oracle Solaris Operating System 85 World Wide Name Syntax 85 probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane) 87 probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane) 89 probe-scsi-all Output Example (SPARC T3-4) 92 SAS Controller Device Path: SPARC T3-4 Server With Four Processors 93 SAS Controller Device Path: SPARC T3-4 Server With Two Processors 94 ? Identify a Disk Slot Using probe-scsi-all (OBP) 96 ? Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers) 98 ? Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator) 100 WWN Syntax in an OS Installation on a Specific Device 103 WWN Syntax in an OS Installation on a RAID Volume 104 Index 107viii SPARC T3 Series Servers Administration Guide • July 2011ix Using This Documentation This administration guide is for experienced system administrators of the SPARC T3 Series servers from Oracle (hereafter referred to as “the server”). It includes general descriptive information about the server and detailed instructions for configuring and administering the server. To use the information in this document, you must have working knowledge of computer network concepts and terms, and advanced familiarity with the Oracle Solaris Operating System (Oracle Solaris OS). Note – The SPARC T3 Series Servers Administration Guide applies to several server and server module products. Some examples used in this document may be based on particular server models. Your output may vary from the examples based on your product. ¦ “UNIX Commands” on page ix ¦ “Shell Prompts” on page x ¦ “Documentation, Support, and Training” on page x UNIX Commands This document might not contain information on basic UNIX commands and procedures such as shutting down the system, booting the system, and configuring devices. Refer to the following for this information: ¦ Software documentation that you received with your system ¦ Oracle Solaris OS documentation, which is at http://www.oracle.com/technetwork/indexes/documentation/ index.htmlx SPARC T3 Series Servers Administration Guide • July 2011 Shell Prompts Documentation, Support, and Training The Oracle Technology Network web site provides information about the following additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Shell Prompt C shell machine-name% C shell superuser machine-name# Bourne shell and Korn shell $ Bourne shell and Korn shell superuser #1 Understanding System Administration Resources These topics provide a summary of common tools used to administer the server. ¦ “ILOM Overview” on page 1 ¦ “Platform-Specific ILOM Features” on page 3 ¦ “Oracle Solaris OS Overview” on page 3 ¦ “OpenBoot Overview” on page 4 ¦ “Oracle VM Server for SPARC Overview” on page 4 ¦ “Multipathing Software” on page 5 ¦ “Hardware Management Pack Overview” on page 6 ILOM Overview Oracle Integrated Lights Out Manager is system management firmware that is preinstalled on the SPARC T4 servies servers. ILOM enables you to actively manage and monitor components installed in your server. ILOM provides a browser-based interface and a command-line interface, as well as SNMP and IPMI interfaces. The ILOM service processor runs independently of the server and regardless of the server power state as long as AC power is connected to the server (or to the modular system that contains the server module). When you connect your server to AC power, the ILOM service processor immediately starts up and begins monitoring the server. All environmental monitoring and control is handled by ILOM. The -> prompt indicates that you are interacting with the ILOM service processor directly. This prompt is the first prompt you see when you log in to the server through the serial management port or network management port, regardless of the host’s power state. On a modular system, that prompt is also present when you log in to a server module either directly or through ILOM on the CMM of the modular system.2 SPARC T3 Series Servers Administration Guide • July 2011 You can also access the ILOM service processor prompt (->) from the OpenBoot ok prompt, or from the Oracle Solaris # or % prompt, provided the system console is configured to be accessible through the serial management and network management ports. The ILOM service processor supports a total of ten concurrent sessions per server: nine SSH connections available through the network management port and one connection available through the serial management port. For more information about how to work with ILOM features that are common to all platforms managed by ILOM, see the following documentation at: http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage Related Information ¦ “Platform-Specific ILOM Features” on page 3 ¦ “Log In to ILOM” on page 9 Information Type Title Conceptual information Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide Browser interface information Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide CLI procedural information Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide SNMP and IPMI information Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocols Reference Guide Installation and configuration information Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide CMM information Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM Administration Guide for Sun Blade 6000 and 6048 Modular SystemsUnderstanding System Administration Resources 3 Platform-Specific ILOM Features ILOM operates on many platforms, supporting features that are common to all platforms. Some ILOM features belong to only a subset of platforms. This topic describes the difference between ILOM features supported on the server and the common set of features described in the ILOM 3.0 base documentation. Note – To perform some procedures documented in Oracle’s ILOM 3.0 base documentation, you must create a serial connection to the server and activate the Physical Presence switch on the server. For information about creating a serial connection, see the installation guide for your server. Among the ILOM features supported on other platforms, ILOM does not support the following features on this server: ¦ Chassis monitoring module (CMM) features, such as single signon. Note - T3 blade servers in a modular system do support the CMM features. ¦ POST diagnostics user-reset trigger is not available. ILOM supports the following feature on this server, which may not be available on other platforms: ¦ POST diagnostics hw-change trigger. This new trigger (hw-change error-reset) is the default setting for the server, and causes POST to run each time the server is AC power-cycled, or the top cover is removed (if applicable). For more information on POST, see the service manual for your server. Related Information ¦ “ILOM Overview” on page 1 Oracle Solaris OS Overview The Oracle Solaris OS includes commands and other software resources to use for server administration. For an introduction to management tools in your Oracle Solaris release, see System Administration Guide: Basic Administration in the Oracle Solaris documentation collection.4 SPARC T3 Series Servers Administration Guide • July 2011 Oracle Solaris software includes SunVTS software. SunVTS tests and validates Oracle hardware by verifying the connectivity and functionality of hardware devices, controllers and peripherals. In addition to the SunVTS information in the Oracle Solaris documentation, SunVTS documentation collections are available at: http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id=homepage Related Information ¦ “OpenBoot Overview” on page 4 OpenBoot Overview The OpenBoot firmware starts the OS, validates installed hardware, and can be used for other server administration tasks below the OS level. For more information about OpenBoot commands, see the OpenBoot 4.x Command Reference Manual in the Oracle Solaris documentation collection. Related Information ¦ “Oracle Solaris OS Overview” on page 3 Oracle VM Server for SPARC Overview A logical domain is a discrete logical grouping with its own operating systems, resources, and identity within a single computer system. Applications software can run in logical domains. Each logical domain can be created, destroyed, reconfigured, and rebooted independently. Oracle VM Server for SPARC software enables you to create and manage as many as 32 logical domains, depending on the hardware configuration of the server on which the Oracle VM Server for SPARC Manager has been installed. You can virtualize resources and define network, storage, and other I/O devices as services that can be shared between domains.Understanding System Administration Resources 5 The Oracle VM Server for SPARC configurations are stored on the SP. Using Oracle VM Server for SPARC CLI commands, you can add a configuration, specify a configuration to be used, and list the configurations on the service processor. You can also use the ILOM set /HOST/bootmode config=configfile command to specify an Oracle VM Server boot configuration. Related Information ¦ “Configuring Boot Mode” on page 53 ¦ Oracle VM Server for SPARC documentation http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html Multipathing Software Multipathing software enables you to define and control redundant physical paths to I/O devices such as storage devices and network interfaces. If the active path to a device becomes unavailable, the software can automatically switch to an alternate path to maintain availability. This capability is known as automatic failover. To take advantage of multipathing capabilities, you must configure the server with redundant hardware, such as redundant network interfaces or two host bus adapters connected to the same dual-ported storage array. For the server, three different types of multipathing software are available: ¦ Oracle Solaris IP Network Multipathing software provides multipathing and load-balancing capabilities for IP network interfaces. For instructions on how to configure and administer Oracle Solaris IP Network Multipathing, consult the IP Network Multipathing Administration Guide provided with your specific Oracle Solaris release. ¦ VVM software includes a feature called DMP, which provides disk multipathing as well as disk load balancing to optimize I/O throughput. For information about VVM and its DMP feature, refer to the documentation provided with the VERITAS Volume Manager software. ¦ StorageTek Traffic Manager is an architecture fully integrated within the Oracle Solaris OS (beginning with the Oracle Solaris 8 release) that enables I/O devices to be accessed through multiple host controller interfaces from a single instance of the I/O device. For information about StorageTek Traffic Manager, refer to your Oracle Solaris OS documentation.6 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Oracle Solaris OS Overview” on page 3 ¦ “Oracle VM Server for SPARC Overview” on page 4 Hardware Management Pack Overview The Sun Server Hardware Management Pack (HMP) from Oracle provides tools you can use to manage and configure Oracle servers from the host operating system. To use these tools, you must install the HMP software on your server. After installing the software, you will be able to perform the following server management tasks described in the following table. TABLE: Hardware Management Pack -- Server Managment Tasks Server Management Task From Host OS* Hardware Management Pack Implementation Tool Monitor Oracle hardware with host IP address Use the Hardware Management Agent and the associated Simple Network Management Protocol (SNMP) plug-ins at the operating-system level to enable in-band monitoring of your Oracle hardware. This in-band monitoring functionality enables you to use your host operating system IP address to monitor your Oracle servers without the need of connecting the Oracle ILOM management port to your network. Host OS-level management tool Monitor storage devices, including RAID arrays Use the Server Storage Management Agent at the operating-system level to enable in-band monitoring of the storage devices configured on your Oracle servers. The Server Storage Management Agent provides an operating-system daemon that gathers information about your server’s storage devices, such as hard disk drives (HDDs) and RAID arrays, and sends this information to the Oracle ILOM service processor. The Storage Monitoring features in Oracle ILOM enable you to view and monitor the information provided by the Server Storage Management Agent. You can access the Storage Monitoring features in Oracle ILOM from the command-line interface (CLI). Oracle ILOM 3.0 CLI Storage Monitoring features Query, update, and validate firmware versions on supported SAS storage devices Use the fwupdate CLI tool from the host operating system to query, update, and validate firmware versions on supported storage devices such as SAS host bus adapters (HBAs), embedded SAS storage controllers, LSI SAS storage expanders, and disk drives. Host OS-level fwupdate CLIUnderstanding System Administration Resources 7 Source for Downloading Hardware Management Pack Software You can download the Hardware Management Pack software from the following location: http://support.oracle.com Source for Downloading Hardware Management Pack Documentation You can download Hardware Management Pack documentaton from the following location: http://www.oracle.com/technetwork/documentation/sys-mgmt-network ing-190072.html Restore, set, and view Oracle ILOM configuration settings Use the ilomconfig CLI tool from the host operating system to restore Oracle ILOM configuration settings,as well as to view and set Oracle ILOM properties associated with network management, clock configuration, and user management. Host OS-level ilomconfig CLI View or create RAID volumes on storage drives Use the raidconfig CLI tool from the host operating system to view and create RAID volumes on storage drives that are attached to RAID controllers, including storage arrays. Host OS-level raidconfig CLI Use IPMItool to access and manage Oracle servers Use the open source command-line IPMItool from the host operating system to access and manage your Oracle servers via the IPMI protocol. Host OS-level command-line IMPItool * Supported host operating systems include: Solaris, Linux, Windows, and VMware TABLE: Hardware Management Pack -- Server Managment Tasks (Continued) Server Management Task From Host OS* Hardware Management Pack Implementation Tool8 SPARC T3 Series Servers Administration Guide • July 2011 Note – The Hardware Management Pack version 2.1 documentation provided on this site is valid for Hardware Management Pack version 2.1.1 software. For additional details about how to use the Storage Monitoring features in Oracle ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide and the Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide. For additional details about accessing and managing your server via SNMP or IPMI, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide. Links to these Oracle ILOM manuals are provided on the web site shown above. You can find the complete set of Oracle ILOM documentation at this location: http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage9 Accessing the Server These topics include information on establishing low-level communication with the server using the ILOM tool and the system console. ¦ “Log In to ILOM” on page 9 ¦ “Log In to the System Console” on page 10 ¦ “Display the ok Prompt” on page 11 ¦ “Display the ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “ILOM Remote Console” on page 14 ? Log In to ILOM This procedure assumes the default configuration of the service processor as described in your server’s installation guide. Note – For a SPARC T3 server module, see the installation guide for instructions on starting ILOM throught the modular system’s CMM, as well as logging in directly to the service processor on the server module.10 SPARC T3 Series Servers Administration Guide • July 2011 ? Open an SSH session and connect to the SP by specifying its IP address. The ILOM default username is root and the default password is changeme. You are now logged in to ILOM. Perform tasks as needed. Note – To provide optimum server security, change the default server password. Related Information ¦ “ILOM Overview” on page 1 ¦ “Log In to the System Console” on page 10 ? Log In to the System Console ? At the ILOM -> prompt, type: where option can be: ¦ -f|force – Enables a user with a Console (c) role to take the console from any current user and force that user into view mode. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright 2010 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accessing the Server 11 ¦ -script – Bypasses prompt for a yes or no confirmation. Note – If the Oracle Solaris OS is not running, the server displays the ok prompt. Related Information ¦ “Display the ILOM -> Prompt” on page 12 ¦ “Use a Local Graphics Monitor” on page 13 ¦ “Log In to ILOM” on page 9 ? Display the ok Prompt This procedure assumes the default system console configuration. ? Choose the appropriate shutdown method from the following table to reach the ok prompt. To ensure getting to the ok prompt, set the following ILOM property before performing the procedures described in the table: -> set /HOST/bootmode script=”setenv auto-boot? false”12 SPARC T3 Series Servers Administration Guide • July 2011 Caution – When possible, reach the ok prompt by performing a graceful shutdown of the OS. Using any other method might cause the loss of server state information. Related Information ¦ “Monitoring Faults” on page 65 ? Display the ILOM -> Prompt ? Use one of the following ways to display the ILOM -> prompt: ¦ From the system console, type the ILOM escape sequence (#.). Server State What To Do OS running and responsive Shut down the server using one of these methods: • From a shell or command tool window, issue an appropriate command (for example, the shutdown, or init 0 command) as described in the Oracle Solaris system administration documentation. • At the ILOM -> prompt, type: -> stop /SYS • Use the server Power button. • From Oracle Solaris, execute the following command as root user: # uadmin 2 0 OS unresponsive Shut down the server from ILOM. (Provided the operating system software is not running and the server is already under OpenBoot firmware control.) At the ILOM -> prompt, type: -> set /HOST send_break_action=break Press Enter. Then type: -> start /HOST/console OS unresponsive and need to prevent auto-boot Shut down the server from ILOM and disable autoboot. At the ILOM -> prompt, type: -> set /HOST/bootmode script=”setenv auto-boot? false” Press Enter. Then type: -> reset /SYS -> start /HOST/consoleAccessing the Server 13 ¦ Log in to ILOM directly from a device connected to the serial management port or network management port. ¦ Log in to ILOM through an SSH connection. See “Log In to ILOM” on page 9. Related Information ¦ “ILOM Overview” on page 1 ¦ “Log In to ILOM” on page 9 ? Use a Local Graphics Monitor You can redirect the system console to a local graphic monitor. You cannot use a local graphics monitor to perform the initial server installation, nor can you use a local graphics monitor to view POST messages. To use a local graphics monitor: 1. Connect the monitor video cable to a video port on the server. Tighten the thumbscrews to secure the connection. Refer to your system’s documentation for any special connection instructions that might apply to your server. 2. Connect the monitor power cord to an AC outlet. 3. Connect the USB keyboard cable to one USB port. 4. Connect the USB mouse cable to another USB port on the server. 5. Display the ok prompt. See “Display the ok Prompt” on page 11. 6. At the ok prompt, set the following OpenBoot PROM configuration variables: 7. Make the changes take effect: The server stores the parameter changes and boots automatically. ok setenv input-device keyboard ok setenv output-device screen ok reset-all14 SPARC T3 Series Servers Administration Guide • July 2011 Note – Instead of using the reset-all command to store the parameter changes, you can also power cycle the server using the Power button. You can now type system commands and view system messages using your local graphics monitor. To activate the GUI interface, continue to the next step. 8. Activate the Oracle Solaris OS GUI interface. Once the Oracle Solaris OS is installed and booted, type the following commands to display the GUI login screen. Related Information ¦ “Display the ok Prompt” on page 11. ¦ “ILOM Remote Console” on page 14 ILOM Remote Console ILOM Remote Console is a Java application that enables you to remotely redirect and control the following devices on the host server. This group of devices is commonly abbreviated as KVMS. ¦ Keyboard ¦ Video console display ¦ Mouse ¦ Serial console display ¦ Storage devices or images (CD/DVD) ILOM Remote Console is documented in the Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (”Managing Remote Hosts Redirection and Securing the ILOM Remote Console”). Related Information ¦ “ILOM In-band (Sideband) Management” on page 48 # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # reboot15 Controlling the Server These topics include procedures for contolling basic server operations. ¦ “Power On the Server” on page 15 ¦ “Power Off the Server” on page 16 ¦ “Reset the Server From the Oracle Solaris OS” on page 17 ¦ “Reset the Server From ILOM” on page 17 ¦ “Reset the SP to Default Values” on page 18 ? Power On the Server 1. Log in to ILOM. “Log In to ILOM” on page 9. Note – If you have a modular system, make sure you are logged in to the desired server module. 2. At the ILOM -> prompt, type: Note – To skip being prompted for confirmation, use the start -script /SYS command. Related Information ¦ “Power Off the Server” on page 16 -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->16 SPARC T3 Series Servers Administration Guide • July 2011 ¦ “Reset the Server From the Oracle Solaris OS” on page 17 ¦ “Reset the Server From ILOM” on page 17 ? Power Off the Server 1. Shut down the Oracle Solaris OS. At the Oracle Solaris prompt, type: 2. Switch from the system console prompt to the service processor console prompt. 3. From the ILOM -> prompt, type: Note – To perform an immediate shutdown, use the stop -force -script /SYS command. Ensure that all data is saved before typing this command. Related Information ¦ “Power On the Server” on page 15 ¦ “Reset the Server From the Oracle Solaris OS” on page 17 ¦ “Reset the Server From ILOM” on page 17 # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs41-58 syslogd: going down on signal 15 svc.stard: The system is down. syncing file systems...done Program terminated r)eboot o)k prompt, h)alt? # o ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Controlling the Server 17 ? Reset the Server From the Oracle Solaris OS It is not necessary to power the server off and on to perform a reset. ? To reset the server from the Oracle Solaris prompt, type one of the following commands: or Related Information ¦ “Power Off the Server” on page 16 ¦ “Power On the Server” on page 15 ¦ “Reset the Server From ILOM” on page 17 ? Reset the Server From ILOM The ILOM reset command generates a graceful or forced hardware reset of the server. By default, the reset command gracefully resets the server. ? Type one of the following commands to reset the server. ¦ Perform a graceful reset from ILOM: ¦ If a graceful reset is not possible, perform a forced hardware reset from ILOM: Related Information ¦ “Power Off the Server” on page 16 ¦ “Power On the Server” on page 15 # shutdown -g0 -i6 -y # reboot -> reset /SYS -> reset -force /SYS18 SPARC T3 Series Servers Administration Guide • July 2011 ¦ “Reset the Server From the Oracle Solaris OS” on page 17 ¦ “Override OpenBoot PROM Settings to Reset the Server” on page 57 ? Reset the SP to Default Values If your SP becomes corrupt, or you want to reset the SP to the factory default values, change the /SP reset_to_defaults setting then power off the host to implement the changes. This is new behavior. Previously you did not have to power off the host to reset default values to the SP. You need administrator permissions to perform this task. 1. To reset the SP to the default values, type: where value can be: ¦ all – Removes all of the SP configuration data. ¦ factory – Removes all SP configuration data as well as all log files. 2. Power off and restart the host to complete the setting change. Related Information ¦ “Power Off the Server” on page 16 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP19 Configuring Hardware RAID These topics describe how to configure and manage RAID disk volumes using the server’s onboard SAS-2 disk controllers. ¦ “Hardware RAID Support” on page 19 ¦ “Disk Zones for SPARC T3-1 Servers With Sixteen-Disk Backplanes” on page 22 ¦ “Displaying Disk Zone Information” on page 23 ¦ “Enabling and Disabling Disk Zoning In the Field” on page 27 ¦ “Minimum System Firmware for Valid devalias in Upper Disk Locations” on page 28 ¦ “Prepare to Use the FCode Utility” on page 28 ¦ “FCode Utility Commands” on page 30 ¦ “Create a Hardware RAID Volume” on page 30 ¦ “Hot Spare Drives in RAID Volumes (LSI)” on page 32 ¦ “Determining If a Drive Has Failed” on page 32 ¦ “RAID Drive Replacement Strategies” on page 35 ¦ “Locate Device Paths” on page 35 Hardware RAID Support SPARC T3 series servers contain onboard SAS 2 RAID controllers, which enable the formation of logical disk volumes consisting of two or more redundant disk drives. These controllers support the following RAID levels: ¦ RAID 0 -- Data striping ¦ RAID 1 -- Data mirroring (using two disks) ¦ RAID 1e -- Enhanced mirroring (using three to eight disks) Data striping refers to the technique of distributing data files across multiple disks so that storage and retrieval can be performed in parallel across multiple data channels. Data striping can reduce the time required to read and write data files.20 SPARC T3 Series Servers Administration Guide • July 2011 Data mirroring refers to the technique of storing identical copies of data on separate disks. Mirroring critical data reduces the risk of data loss by maintaining duplicate instances of the data. The following table describes the default RAID controller resources provided on the different SPARC T3 series servers. Each SAS-2 controller enables you to create up to two RAID volumes containing disks connected to that controller. A volume cannot contain disks connected to a different controller. You can choose from among three environments for creating and managing the RAID resources in your server. ¦ Fcode utility -- This utility consists of a set of special commands to display targets and manage logical volumes on your server. You access these commands through the OpenBoot PROM (OBP) environment. The examples shown in this manual rely on Fcode commands. TABLE: Onboard SAS-2 Controllers on SPARC T3 Series Servers SPARC T3 Model Onboard SAS-2 Controller and Disk Backplane Details T3-1 Two onboard controllers and one disk backplane. There are two versions of the T3-1 disk backplane: Eight-Disk Capacity: – Controller 0 manages disk locations 0-3 – Controller 1 manages disk locations 4-7 Sixteen-Disk Capacity (zones enabled): * – Controller 0 manages disk locations 0-7 – Controller 1 manages disk locations 8-15 * Backplanes with sixteen-disk capacity must be partitioned into two eight-disk zones. See “Disk Zones for SPARC T3-1 Servers With Sixteen-Disk Backplanes” on page 22 for more information. T3-1B One onboard controller and two disk backplanes with two disk slots each. The onboard controller is connected to the two backplanes by two data cables and two power cables. T3-2 One onboard controller and one disk backplane with six disk slots. The onboard controller is connected to the backplanes by two separate data cables. T3-4 No onboard controllers, two internal pluggable RAID Expansion Modules (REMs), and two disk backplanes: – REM 0 manages disk locations 0-3 (backplane 0) – REM 1 manages disk locations 4-7 (backplane 1)Configuring Hardware RAID 21 ¦ LSI SAS2 2008 RAID Management Utility for SPARC T3 servers -- You can use the sas2ircu commands contained in the LSI SAS2 Integrated Configuration Utility to configure and manage RAID volumes on your server. To use the sas2ircu command set, download and install the SAS2IRCU software from the following location: http://www.lsi.com/sep/Pages/oracle/index.aspx You can download SAS2IRCU documentation from this location: http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Oracle Hardware Management Pack 2.1.1 -- You can use the RAIDconfig commands contained in this software’s Oracle Server CLI Tools component to create and manage RAID volumes on your server. To use these commands, download and install the latest version of the Hardware Management Pack from My Oracle Support: http://support.oracle.com/CSP/ui/flash.html Click on the following link to access the Oracle Hardware Management Pack 2.1 Installation Guide. http://download.oracle.com/docs/cd/E19960-01/index.html Note – Version 2.1.1 is the earliest release of the Oracle Hardware Management Pack that supports servers in the SPARC T3 series. You can find complete documentation for using the Hardware Management Pack version 2.1 software at this location: http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21&id=homepage Tip – Some Hardware Management Pack 2.1.1 commands may have long startup or execution latencies on SPARC T3-2 and T3-4 servers. In such cases, you may prefer to use the Fcode or LSI sas2ircu commands. Related Information ¦ “Create a Hardware RAID Volume” on page 30 ¦ “Prepare to Use the FCode Utility” on page 2822 SPARC T3 Series Servers Administration Guide • July 2011 Disk Zones for SPARC T3-1 Servers With Sixteen-Disk Backplanes Whenever a SPARC T3-1 sixteen-disk backplane is managed by the onboard SAS-2 controllers, the backplane must be partitioned into two logical zones, with eight disk slots per zone: ¦ Zone A -- Contains backplane slots 0 through 7, which are visible only to onboard SAS-2 controller 0. ¦ Zone B -- Contains backplane slots 8 through 15, which are visible only to onboard SAS-2 controller 1. Disk zoning requires that the LSI expander firmware on the backplane include patch 147034-01 (at least). This patch creates the required disk zones. Note – For additional information about patch 147034-01, refer to its README document, README.147034 on the My Oracle Support site. Tip – When zoning is enabled, devalias for slots 8-15 will be incorrect unless the system firmware is updated to either 8.0.5.b (or a higher 8.0 level) or to 8.1.0 (or higher). For more information see “Minimum System Firmware for Valid devalias in Upper Disk Locations” on page 28. If an internal PCIe RAID HBA card is used to manage the disk backplane instead of the onboard controllers, the disk zones must be disabled. Most SPARC T3-1 servers with sixteen-disk capable backplanes are shipped with zoning enabled. There are two exceptions to this default rule: ¦ Zoning is disabled at the factory when a SPARC T3-1 system containing a sixteen-disk backplane is built with an internal PCIe RAID HBA. ¦ SPARC T3-1 systems manufactured with 16-disk backplanes before disk zoning became the default were shipped without patch 147034-01. For these systems, the patch must be installed in the field to support disk zoning. Oracle’s Sun Server Hardware Management Pack software version 2.1.1 includes a disk zoning utility that you can use to enable and disable zoning as well as display zone status information. See “Enabling and Disabling Disk Zoning In the Field” on page 27 and “Displaying Disk Zone Information” on page 23 for more information.Configuring Hardware RAID 23 Note – Because disks are not visible to controllers across zone boundaries, a SAS-2 controller cannot create a RAID volume that contains disks that are included in the other zone. You can use the zoningcli utility to enable or disable zoning in a sixteen-disk capable backplane. See “Enabling and Disabling Disk Zoning In the Field” on page 27 for more information. Displaying Disk Zone Information These topics describe two methods for accessing disk zoning information. ¦ “Disk Zone Status (zoningcli list)” on page 23 ¦ “Disk Zone Status (probe-scsi-all)” on page 24 Disk Zone Status (zoningcli list) If Hardware Management Pack software version 2.1.1 (or later) is installed on your system, you can use the zoningcli list command to determine whether or not zoning is enabled. Zoning status is shown in the first line of the output in each of the following examples. Zoning is disabled: # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: disable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 ===================================================24 SPARC T3 Series Servers Administration Guide • July 2011 Zoning is enabled: If the zoningcli utility is not available on your system, you can use the OBP command probe-scsi-all to determine whether or not zoning is enabled. See “Disk Zone Status (probe-scsi-all)” on page 24. Disk Zone Status (probe-scsi-all) The following probe-scsi-all output examples show the difference in how storage devices are listed when zoning is enabled and when it is disabled. There are 10 disks represented in both examples. They are identified as PhyNum 0-9. Note – The entries for PhyNum 1-6 are omitted in these examples to reduce their size. The missing entries would not alter the illustration of the concept. Zoning is disabled: When zoning is disabled, each disk is visible to both controllers. The following example shows this by listing every disk with controller 0 and with controller 1. Tip – Note that SASDeviceName and SASAddress for each PhyNum listed under controller 1 matches the corresponding PhyNum’s DeviceName and SASAddress listed under controller 0. This is true for PhyNum 1-6, which were omitted to reduce the size of the table. # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: enable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 =================================================== {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1Configuring Hardware RAID 25 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 12 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 13 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 14 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 15 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 13 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 14 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 {0} ok26 SPARC T3 Series Servers Administration Guide • July 2011 Zoning is enabled: In the following example, zoning is enabled and each disk is shown connected to a single SAS-2 controller. PhyNum 0-7 are connected to controller 0 and PhyNum 8-9 are connected to controller 1. {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target b Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target c Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 Target d Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 {0} okConfiguring Hardware RAID 27 Enabling and Disabling Disk Zoning In the Field These topics describe how to enable and disable disk zones in the field. Note – You must have version 2.1.1 of the Oracle Hardware Management Pack (or later) to have access to the zoningcli command. ¦ “Enable Disk Zones (zoningcli Command)” on page 27 ¦ “Disable Disk Zones (zoningcli Command)” on page 27 ¦ “Update Firmware to Enable Zoning” on page 27 ? Enable Disk Zones (zoningcli Command) ? If zoning has been disabled, you can enable it by running the following command: ? Disable Disk Zones (zoningcli Command) ? If zoning has been enabled, you can disable it by running the following command: ? Update Firmware to Enable Zoning If your SPARC T3-1 server requires disk zoning, but does not have the required minimum system firmware level and/or the LSI firmware on the backplane does not have patch 147034-01, you must take the following step for the controllers to function properly. # zoningcli enable zoning # zoningcli disable zoning28 SPARC T3 Series Servers Administration Guide • July 2011 Caution – Be certain to back up any data stored on the disks before you install this patch. You can restore the files after the patch is installed. ? Apply patch 147034-01 to the LSI firmware on the disk backplane. This patch causes the backplane to be partitioned into the two eight-disk zones described in “Disk Zones for SPARC T3-1 Servers With Sixteen-Disk Backplanes” on page 22. Tip – When zoning is enabled, devalias for slots 8-15 will be incorrect unless the system firmware is updated to either 8.0.5.b (or a higher 8.0 level) or to 8.1.0 (or higher). See “Minimum System Firmware for Valid devalias in Upper Disk Locations” on page 28 for more information. Minimum System Firmware for Valid devalias in Upper Disk Locations For devalias to be valid for disk slots 8-15, the system firmware level must be at 8.0.5.b (or a higher 8.0 level) or at 8.1.0.c (or higher). If your server’s system firmware does not meet the minimum requirement, you must use the full disk path to identify individual disks in the range 8-15. For example, if running with the minimum system firmware level and the correct devalias, you can use the following command line to boot from the disk in slot 12: If your disk slot is in the range 8-15 and the system firmware level does not meet the requirement described above, you will need to specify the full device path for the boot disk. This example shows the path for disk 12: ? Prepare to Use the FCode Utility 1. Open an xterm or gnome terminal window. FCode commands produce large amounts of detailed output. The xterm or gnome terminal windows provide scroll bar functionality, which helps view such output. # boot disk12 # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10cConfiguring Hardware RAID 29 2. Disable auto-boot in OBP and enter the OBP environment after a power on or reset. 3. Use the show-devs command to list the device paths on the server. Note – For a server module, the device path might be /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. Use the select command to choose the controller where you want to create a hardware RAID volume. Instead of using the entire device path for the controller, you can use a preconfigured alias for a controller. For example: To view the preconfigured aliases on your server, use the devalias command. See “Locate Device Paths” on page 35. Display the SAS addresses of any connected drives using the show-children command. Related Information ¦ “FCode Utility Commands” on page 30 ¦ “Display the ok Prompt” on page 11 {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi030 SPARC T3 Series Servers Administration Guide • July 2011 FCode Utility Commands Related Information ¦ “Create a Hardware RAID Volume” on page 30 ¦ “Prepare to Use the FCode Utility” on page 28 ? Create a Hardware RAID Volume 1. Prepare to create a RAID volume. See “Prepare to Use the FCode Utility” on page 28. 2. Use the show-children command to list the physical drives on the selected controller. FCode Command Description show-children Lists all connected physical drives and logical volumes. show-volumes Lists all connected logical volumes in detail. create-raid0-volume Creates a RAID 0 volume (minimum two targets). create-raid1-volume Creates a RAID 1 volume (exactly two targets). create-raid1e-volume Creates a RAID 1e volume (minimum three targets). delete-volume Deletes a RAID volume. activate-volume Re-activate a RAID volume after disks have been replaced. {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target bConfiguring Hardware RAID 31 3. Use the create-raid0-volume, create-raid1-volume, or create-raid1e-volume command to create a logical drive from the physical disks. For example, to create a RAID 0 volume with targets 9 and a, type the targets first then type the create command: For example, to create a RAID 1e volume with targets a, b, and c, type: 4. To verify creation of the volume, type: 5. Type unselect-dev to deselect the controller. Related Information ¦ “FCode Utility Commands” on page 30 ¦ “Display the ok Prompt” on page 11 Hot Spare Drives in RAID Volumes (LSI) You can configure two global hot spare drives to protect data on mirrored RAID volumes. If one of the drives in a RAID 1 or RAID 1E mirrored volume fails, the onboard RAID controller will replace the failed drive automatically with a hot spare drive and then resynchronize the mirrored data. Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volume {0} ok show-volumes {0} ok unselect-dev32 SPARC T3 Series Servers Administration Guide • July 2011 Use the sas2ircu LSI utility to add global hot spare drives. Refer to the SAS2 Integrated RAID Solution User Guide for more information about adding hot spare drives. Determining If a Drive Has Failed These topics explain various ways to determine if a drive contained in a RAID volume has failed: ¦ “Front Service Required Drive LEDs” on page 32 ¦ “Error Messages (System Console and Log Files)” on page 33 ¦ “Display Status (show-volumes Command, OBP)” on page 34 ¦ “Display Status (sas2ircu Utility, LSI)” on page 34 Front Service Required Drive LEDs When a fault occurs on a drive in a SPARC T3 system, the amber Service Required LED will light on the front of the drive. This amber LED will allow you to locate the faulted drive in the system. Additionally, the front and rear panel Service Action Required LEDs also light when the system detects a hard drive fault. Refer to your service manual for the location and description of these LEDs. Error Messages (System Console and Log Files) When a fault occurs on a drive, error messages will be displayed on the system console. This is an example of a system console display indicating that volume 905 has been degraded with the loss of PhysDiskNum 1: Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0):Configuring Hardware RAID 33 You can also view these messages by reviewing the /var/adm/messages files: Refer to the View the System Message Log Files topic in your service manual for more information about examining these messages. ? Display Status (show-volumes Command, OBP) You can halt the system and use the show-volumes OBP command to determine if a drive has failed. 1. Halt the system and display the OBP ok prompt. See “Display the ok Prompt” on page 11. Mar 16 16:28:26 hostname Volume 0 is now degraded Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded34 SPARC T3 Series Servers Administration Guide • July 2011 2. Select the SAS controller device. See “Prepare to Use the FCode Utility” on page 28 for more information. 3. Type the show-volumes command to display the RAID volumes and their associated disks. In the following example, the secondary disk in a RAID 1 volume is offline. 4. Type the unselect-dev command to deselect the SAS controller device. ? Display Status (sas2ircu Utility, LSI) ? Use the LSI sas2ircu utility to display the status of the RAID volume and its associated drives. Refer to the SAS2 Integrated RAID Solution User Guide for more information about displaying and interpreting device status using the sas2ircu utility. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguring Hardware RAID 35 RAID Drive Replacement Strategies Follow the strategies described below when replacing a failed drive in a RAID volume. Note – The cfgadm instructions in the service manual are for individual drives that are not part of RAID volumes. When a drive is part of a RAID volume, you do not need to unconfigure it before hot swapping it with a new drive. ? Locate Device Paths Use this procedure to locate device paths specific to your server. 1. Display the ok prompt. See “Display the ok Prompt” on page 11. 2. From the ok prompt, type: RAID Volume Level Strategy RAID 0 If a drive fails in a RAID 0 volume, you will lose all data on that volume. Replace the failed drive with a new drive of the same capacity, recreate the RAID 0 volume, and restore the data from a backup. RAID 1 Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume. RAID 1E Remove the failed drive and replace it with a new drive of the same capacity. The new drive will be automatically configured and synced with the RAID volume. {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@036 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Display the ok Prompt” on page 11 ¦ “Prepare to Use the FCode Utility” on page 28 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok37 Changing Server Identification Information These topics describe how to store information (for purposes such as inventory control or site resource management) on the SP and FRU PROMs using the ILOM CLI interface. ¦ “Change Customer FRUdata Information” on page 37 ¦ “Change System Identifier Information” on page 38 ? Change Customer FRUdata Information Use the /SP customer_frudata property to store information in all FRU PROMs. This field can be used to identify a particular system to a third-party application, or for any other identifcation needs in your environment. ? At the ILOM -> prompt, type: Note – You must enclose the data string (data) in quote marks. Related Information ¦ “Log In to ILOM” on page 9 ¦ “Change System Identifier Information” on page 38 -> set /SP customer_frudata=”data”38 SPARC T3 Series Servers Administration Guide • July 2011 ? Change System Identifier Information Use the /SP system_identifier property to store customer identification information. This string is encoded in all trap messages generated by SNMP. Assigning a unique system identifier can be useful in distinguishing which system generates which SNMP message. ? At the ILOM -> prompt, type: Note – The data string (data) must be enclosed in quote marks. Related Information ¦ “Log In to ILOM” on page 9 ¦ “Change Customer FRUdata Information” on page 37 -> set /SP system_identifier=”data”39 Configuring Policy Settings These topics describe managing configuration policies using ILOM. ¦ “Specify Cooldown Mode” on page 39 ¦ “Restore Host Power State at Restart” on page 40 ¦ “Specify Host Power State at Restart” on page 41 ¦ “Disable or Re-Enable Power-On Delay” on page 41 ¦ “Specify Parallel Boot of the SP and Host” on page 42 ¦ “Configure Host Behavior With the Keyswitch State” on page 42 ? Specify Cooldown Mode The HOST_COOLDOWN property, when set to enabled, will cause the server to enter cooldown mode when the host is powering off. Upon server poweroff, cooldown mode directs ILOM to monitor certain components to ensure that they are below a minimum temperature so as not to cause harm to the user. Once the components are below the minimum temperature, then the power is removed from the server, or if it takes longer then 4 minutes the host will turn off. Note – The HOST_COOLDOWN property does not apply to server modules. ? At the ILOM -> prompt, type: where value can be: ¦ enabled – Server cools certain components before powering off. ¦ disabled – Component temperatures are not monitored during power off. -> set /SP/policy HOST_COOLDOWN=value40 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Power Off the Server” on page 16 ? Restore Host Power State at Restart Use the /SP/policy HOST_LAST_POWER_STATE property to control the behavior of the server after an unexpected power outage. When external power is restored, the ILOM service processor starts to run automatically. Normally, the host power is not turned on until you use ILOM to turn it on. ILOM records the current power state of the server in nonvolatile storage. If the HOST_LAST_POWER_STATE policy is enabled, ILOM can restore the host to the previous power state. This policy is useful in the event of a power failure, or if you physically move the server to a different location. For example, if the host server is running when power is lost and the /SP/policy HOST_LAST_POWER_STATE property is set to disabled, the host server remains off when power is restored. If the /SP/policy HOST_LAST_POWER_STATE property is set to enabled, the host server restarts when the power is restored. ? At the ILOM -> prompt, type: where value can be: ¦ enabled – When power is restored, returns the server to the state it was in before the power was removed. ¦ disabled – Keeps the server off when power is applied (the default). If you enable HOST_LAST_POWER_STATE, you should also configure /SP/policy HOST_POWER_ON_DELAY. For further information, see “Disable or Re-Enable Power-On Delay” on page 41. Related Information ¦ “Disable or Re-Enable Power-On Delay” on page 41 ¦ “Specify Host Power State at Restart” on page 41 -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguring Policy Settings 41 ? Specify Host Power State at Restart Use /SP/policy HOST_AUTO_POWER_ON to power on the host when external power is applied to the server. If this policy is set to enabled, the service processor sets HOST_LAST_POWER_STATE to disabled. ? At the ILOM -> prompt, type: where value can be: ¦ enabled – When power is applied, automatically powers on the host when the SP has been booted. ¦ disabled – Keeps the host power off when power is applied (the default). Related Information ¦ “Restore Host Power State at Restart” on page 40 ¦ “Disable or Re-Enable Power-On Delay” on page 41 ? Disable or Re-Enable Power-On Delay Use the /SP/policy HOST_POWER_ON_DELAY property to cause the server to wait for a short time before powering on automatically. The delay is a random interval of one to five seconds. Delaying the server power on helps minimize current surges on the main power source. This power-on delay is important when multiple servers in racks power on after a power outage. ? At the ILOM -> prompt, type: where value can be: ¦ enabled – Causes the server to wait for a short time before powering on automatically. ¦ disabled – Server powers on automatically without a delay (the default). -> set /SP/policy HOST_AUTO_POWER_ON=value -> set /SP/policy HOST_POWER_ON_DELAY=value42 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Specify Host Power State at Restart” on page 41 ? Specify Parallel Boot of the SP and Host The /SP/policy PARALLEL_BOOT property, when enabled, allows the host to boot and power on in parallel with the SP if an auto-power policy (HOST_AUTO_POWER_ON or HOST_LAST_POWER_STATE) was on or a user presses the power button while the SP is in the process of booting. ILOM has to be running in order to allow the host to power on when the power button is pressed or the the auto-power policies are set. When this property is set to disabled, the SP boots first, then the host boots. Note – Parallel boot is not supported on server modules. ? At the ILOM -> prompt, type: where value can be: ¦ enabled – SP and host boot concurrently. ¦ disabled – SP and host boot serially. Related Information ¦ “Power On the Server” on page 15 ¦ “Power Off the Server” on page 16 ? Configure Host Behavior With the Keyswitch State Use the /SYS keyswitch_state property to control the position of the virtual keyswitch. -> set /SP/policy PARALLEL_BOOT=valueConfiguring Policy Settings 43 ? At the ILOM -> prompt, type: where value can be: ¦ normal – The server can power itself on and start the boot process (the default). ¦ standby – Powers off host, disables power on. ¦ diag – Host power on is allowed, it overrides the settings of /HOST/diag target, resulting in Max POST being executed. ¦ locked – Host power on is allowed, however, you are prohibited from updating any of the flash devices or setting /HOST send_break_action= break. Related Information ¦ “Power On the Server” on page 15 ¦ “Power Off the Server” on page 16 -> set /SYS keyswitch_state=value44 SPARC T3 Series Servers Administration Guide • July 201145 Configuring Network Addresses These topics describe managing network addresses with ILOM. ¦ “SP Network Address Options” on page 45 ¦ “Disable or Re-Enable Network Access to the SP” on page 46 ¦ “Display the DHCP Server IP Address” on page 46 ¦ “Display the Host MAC Address” on page 47 ¦ “Using an In-band Connection to the SP” on page 48 SP Network Address Options You can access the SP on your system in multiple ways. Consider the following options and choose the access method that is best for your environment. You can physically connect to the SP using a serial connection or a network connection. The network connection can be configured to use a static IP address or DHCP (the default). Optionally, the T3 Series servers can use an in-band network connection to the SP, rather than the default out-of-band network management port. For more information on each option, see the following documentation: ¦ To use a serial connection to the SP, see: Connect a Terminal or Emulator to the SER MGT Port, in the installation guide for your server or Communicating With the Server Module During Startup in the installation guide for your server module. ¦ To assign a static IP address to the SP, see: Assign a Static IP Address to the SP, in the installation guide for your server. ¦ To use an in-band connection to the SP, see: “ILOM In-band (Sideband) Management” on page 4846 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation ¦ “ILOM Overview” on page 1 ? Disable or Re-Enable Network Access to the SP Use the /SP/network state property to enable or disable the service processor’s network interface. ? At the ILOM -> prompt, type: where value can be: ¦ enabled (the default) ¦ disabled Related Information ¦ “SP Network Address Options” on page 45 ? Display the DHCP Server IP Address To display the IP address of the DHCP server that provided the dynamic IP address requested by the service processor, view the dhcp_server_ip property. ? At the ILOM -> prompt, type: -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnect ipv6 testConfiguring Network Addresses 47 Note – The list of properties might vary based on your server. Related Information ¦ “Display the Host MAC Address” on page 47 ? Display the Host MAC Address The /HOST macaddress property is automatically configured by the server software, so you cannot set or change the property. The value is read and determined from the server’s removable system configuration card (SCC PROM) or from the server module’s ID PROM and then stored as a property in ILOM. /HOST macaddress is the MAC address for the net0 port. The MAC addresses for each additional port increments from the /HOST macaddress. For example, net1 is equal to the value of /HOST macaddress plus one (1). ? At the ILOM -> prompt, type: Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show -> show /HOST macaddress48 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Display the DHCP Server IP Address” on page 46 Using an In-band Connection to the SP These topics describe how to use an in-band, or sideband connection, to the SP. ¦ “ILOM In-band (Sideband) Management” on page 48 ¦ “Configure SP In-band (Sideband) Access” on page 49 ILOM In-band (Sideband) Management By default, you connect to the server’s SP using the out-of-band network management port (NET MGT). The ILOM sideband management feature enables you to select either the NET MGT port or one of the server’s Gigabit Ethernet ports (NETn), which are in-band ports, to send and receive ILOM commands to and from the server SP. In-band ports are also called sideband ports. The advantage of using a sideband management port to manage the server’s SP is that one fewer cable connection and one fewer network switch port are needed. In configurations where numerous servers are being managed, such as data centers, sideband management can represent a significant savings in hardware and network utilization. Note – In-band connection is not recommended for server modules. When sideband management is enabled in ILOM, the following conditions might occur: ¦ Connectivity to the server SP might be lost when the SP management port configuration is changed while you are connected to the SP using a network connection, such as SSH, web, or ILOM Remote Console. ¦ In-chip connectivity between the SP and the host operating system might not be supported by the on-board host Gigabit Ethernet controller. If this condition occurs, use a different port or route to transmit traffic between the source and destination targets instead of using L2 bridging/switching. ¦ Server host power cycles might cause a brief interruption of network connectivity for server Gigabit Ethernet ports (NETn) that are configured for sideband management. If this condition occurs, configure the adjacent switch/bridge ports as host ports.Configuring Network Addresses 49 Related Information ¦ “Configure SP In-band (Sideband) Access” on page 49 ¦ “SP Network Address Options” on page 45 ? Configure SP In-band (Sideband) Access This procedure describes how to access the SP from an in-band (or sideband) management using a host network port. If you perform this procedure using a network connection, you might lose connectivity to the server. Using a serial connection for this procedure eliminates the possibility of losing connectivity during sideband management configuration changes. 1. Log in to ILOM. See “Log In to ILOM” on page 9. 2. If you logged in using the serial port, you can assign a static IP address. For instructions, see the information about assigning an IP address in the installation guide for your server. 3. View the current network settings: -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.050 SPARC T3 Series Servers Administration Guide • July 2011 4. Set the SP management port to a sideband port (where n is 0-3): 5. Verify the change: pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set commitpending=true -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NET0 sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands:Configuring Network Addresses 51 Related Information ¦ “ILOM In-band (Sideband) Management” on page 48 ¦ “SP Network Address Options” on page 45 cd set show52 SPARC T3 Series Servers Administration Guide • July 201153 Configuring Boot Mode Use the ILOM boot mode properties to specify how the host boots when correcting a problem with OpenBoot or Oracle VM Server for SPARC settings. ¦ “Boot Mode Overview” on page 53 ¦ “Configure the Host Boot Mode of Oracle VM Server for SPARC” on page 54 ¦ “Change the Host Boot Mode Behavior at Reset” on page 55 ¦ “Manage the Host Boot Mode Script” on page 56 ¦ “Display Host Boot Mode Expiration Date” on page 57 ¦ “Override OpenBoot PROM Settings to Reset the Server” on page 57 Boot Mode Overview Boot mode (bootmode) properties enable you to override the default method the server uses when it boots. This ability is useful to override particular OpenBoot or Oracle VM Server settings that might be incorrect, to set up OpenBoot variables using a script, or to perform similar tasks. For example, if the OpenBoot settings have become corrupt, you can set the bootmode state property to reset_nvram then reset the server to its factory default OpenBoot settings. Service personnel might instruct you to use the bootmode script property for problem resolution. The full extent of script capabilities are not documented and exist primarily for debugging. Because bootmode is intended to be used to correct a problem with the OpenBoot or Oracle VM Server settings, the bootmode takes effect for a single boot only. Additionally, to prevent an administrator from setting a bootmode state property and forgetting about it, a bootmode state property expires if the host is not reset within 10 minutes of the bootmode state property being set.54 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Reset the Server From the Oracle Solaris OS” on page 17 ¦ “Reset the Server From ILOM” on page 17 ¦ “OpenBoot Overview” on page 4 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Configure the Host Boot Mode of Oracle VM Server for SPARC Note – You must use a valid Oracle VM Server configuration name for this task. 1. Determine the valid Oracle VM Server configurations on your SP, at the ILOM -> prompt, type: 2. Set the boot mode configuration, at the ILOM -> prompt, type: where the config property takes a configname value that is a valid named logical domain configuration. For example, if you created a Oracle VM Server configuration called ldm-set1: To return the boot mode config to the factory default configuration, specify factory-default. For example: Related Information ¦ “Reset the Server From ILOM” on page 17 -> show /HOST/domain/configs -> set /HOST/bootmode config=configname -> set bootmode config=ldm-set1 -> set bootmode config=factory-defaultConfiguring Boot Mode 55 ¦ “Boot Mode Overview” on page 53 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Change the Host Boot Mode Behavior at Reset The /HOST/bootmode state property controls how OpenBoot NVRAM variables are used. Normally the current settings of these variables are retained. Setting /HOST/bootmode state=reset_nvram changes the OpenBoot NVRAM variables to their default settings at the next reset. ? At the ILOM -> prompt, type: where value is one of the following: ¦ normal – At next reset, retains current NVRAM variable settings. ¦ reset_nvram – At next reset, returns OpenBoot variables to default settings. Note – state=reset_nvram will return to normal after the next server reset or 10 minutes (see expires property in “Display Host Boot Mode Expiration Date” on page 57). config and script properties do not expire and will be cleared upon the next server reset or manually by setting value to "". Related Information ¦ “Reset the Server From ILOM” on page 17 ¦ “Boot Mode Overview” on page 53 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode state=value56 SPARC T3 Series Servers Administration Guide • July 2011 ? Manage the Host Boot Mode Script ? At the ILOM -> prompt, type: where script controls the host server OpenBoot PROM firmware method of booting. script does not affect the current /HOST/bootmode setting. value can be up to 64 bytes in length. You can specify a /HOST/bootmode setting and set the script within the same command. For example: After the server resets and OpenBoot PROM reads the values stored in the script, the OpenBoot PROM sets the OpenBoot PROM variable diag-switch? to the user-requested value of true. Note – If you set /HOST/bootmode script="", ILOM sets the script to empty. Related Information ¦ “Reset the Server From ILOM” on page 17 ¦ “Boot Mode Overview” on page 53 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"Configuring Boot Mode 57 ? Display Host Boot Mode Expiration Date ? At the ILOM -> prompt, type: where expires is the date and time when the current boot mode will expire. Related Information ¦ “Reset the Server From ILOM” on page 17 ¦ “Boot Mode Overview” on page 53 ¦ “Oracle VM Server for SPARC Overview” on page 4 ? Override OpenBoot PROM Settings to Reset the Server Use this procedure to override the OpenBoot PROM settings and initiate reboot of the control domain, which results in the host booting to the ok prompt. ? At the ILOM -> prompt, type: The host reboots and stops at the ok prompt. Related Information ¦ “Change the Host Boot Mode Behavior at Reset” on page 55 ¦ “Configuring Boot Mode” on page 53 ¦ “Boot Mode Overview” on page 53 ¦ “Oracle VM Server for SPARC Overview” on page 4 -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled reset /HOST/domain/control [-force] [-script]58 SPARC T3 Series Servers Administration Guide • July 201159 Configuring Server Behavior at Restart Use the following procedures to configure how ILOM should behave during the following restart scenarios. ¦ “Specify Behavior When the Host Resets” on page 59 ¦ “Specify Behavior When the Host Stops Running” on page 60 ¦ “Set the Boot Timeout Interval” on page 60 ¦ “Specify Behavior at Boot Timeout” on page 61 ¦ “Specify Behavior if Restart Fails” on page 61 ¦ “Specify Maximum Restart Attempts” on page 62 ? Specify Behavior When the Host Resets Specify if the host should continue to boot if an error is encountered. ? Set this property: where value can be: ¦ false – The host continues to boot if an error is encountered. ¦ true – The host does not continue to boot if an error is encountered. Related Information ¦ “Configuring Policy Settings” on page 39 -> set /HOST autorunonerror=value60 SPARC T3 Series Servers Administration Guide • July 2011 ? Specify Behavior When the Host Stops Running Specify what ILOM should do when the host leaves the RUNNING state (when the watchdog timer expires). ? Set this property: where value can be: ¦ none – ILOM takes no action other than to issue a warning. ¦ reset – ILOM attempts to reset the server when the Oracle Solaris watchdog timer expires (the default). ¦ dumpcore – ILOM attempts to force a core dump of the OS when the watchdog timer expires. Related Information ¦ “Display Console History” on page 69 ? Set the Boot Timeout Interval ? Set the time delay between a request to boot the host and booting the host: The default value of boottimeout is 0 (zero seconds) or no timeout. Possible values are in the range from 0 to 36000 seconds. Related Information ¦ “Specify Behavior at Boot Timeout” on page 61 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguring Server Behavior at Restart 61 ? Specify Behavior at Boot Timeout Specify what ILOM should do if the host fails to boot before the boot timeout interval. ? Specify behavior at the completion of boottimeout: where value can be: ¦ none (the default) ¦ reset Related Information ¦ “Set the Boot Timeout Interval” on page 60 ? Specify Behavior if Restart Fails Specify what ILOM should do if the host fails to reach the Oracle Solaris running state. ? At the ILOM -> prompt, type: where value can be: ¦ powercycle ¦ poweroff (the default) Related Information ¦ “Specify Maximum Restart Attempts” on page 62 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value62 SPARC T3 Series Servers Administration Guide • July 2011 ? Specify Maximum Restart Attempts Specify how many times ILOM should attempt to restart the host. ? At the ILOM -> prompt, type: The default value of maxbootfail is 3 (three attempts). If the host does not boot successfully within the number of tries indicated by maxbootfail, the host is powered off or powercycled (depending upon the setting of bootfailrecovery). In either case, boottimeout is set to 0 (zero seconds), disabling further attempts to restart the host. Related Information ¦ “Specify Behavior if Restart Fails” on page 61 -> set /HOST maxbootfail=attempts63 Configuring Devices These topics contain information about configuring devices in the server. ¦ “Unconfigure a Device Manually” on page 63 ¦ “Reconfigure a Device Manually” on page 63 ? Unconfigure a Device Manually The ILOM firmware provides a component_state=disabled command, which enables you to unconfigure server devices manually. This command marks the specified device as disabled. Any device marked disabled, whether manually or by the system firmware, is removed from the server’s machine description prior to transfer of control to other layers of system firmware, such as OpenBoot PROM. ? At the ILOM -> prompt, type: Related Information ¦ “Log In to ILOM” on page 9 ¦ “Reconfigure a Device Manually” on page 63 ¦ “Display Server Components” on page 75 ¦ “Locate Device Paths” on page 35 ? Reconfigure a Device Manually The ILOM firmware provides a component_state=enabled command, which enables you to reconfigure server devices manually. Use this command to mark the specified device as enabled. -> set component-name component_state=disabled64 SPARC T3 Series Servers Administration Guide • July 2011 ? At the ILOM -> prompt, type: Related Information ¦ “Log In to ILOM” on page 9 ¦ “Unconfigure a Device Manually” on page 63 ¦ “Display Server Components” on page 75 ¦ “Locate Device Paths” on page 35 -> set component-name component_state=enabled65 Monitoring the Server The server provides many ways to indicate faulty behavior, including LEDs, ILOM, and POST. For specific information about LEDs, and for complete troubleshooting information, refer to the service manual for your server. ¦ “Monitoring Faults” on page 65 ¦ “Enabling Automatic System Recovery” on page 73 ¦ “Display Server Components” on page 75 ¦ “Locate the Server” on page 76 Monitoring Faults These topics contain a summary of diagnostic tools and basic information about finding server faults using pre-OS tools, including ILOM and POST. For complete troubleshooting information, see the service manual for your server. ¦ “Diagnostics Overview” on page 65 ¦ “Discover Faults (ILOM)” on page 67 ¦ “Discover Faults (ILOM Fault Management Shell)” on page 67 ¦ “Discover Faults Using POST” on page 69 ¦ “Display Console History” on page 69 ¦ “Repair a Fault (ILOM Fault Management Shell)” on page 71 ¦ “Clear a Fault” on page 72 Diagnostics Overview You can use a variety of diagnostic tools, commands, and indicators to monitor and troubleshoot a server. See the service manual for your server for complete information about these diagnostic tools:66 SPARC T3 Series Servers Administration Guide • July 2011 ¦ LEDs – Provide a quick visual notification of the status of the server and of some of the FRUs. ¦ ILOM – This firmware runs on the service processor. In addition to providing the interface between the hardware and OS, ILOM also tracks and reports the health of key server components. ILOM works closely with POST and Oracle Solaris Predictive Self-Healing technology to keep the server running even when there is a faulty component. ¦ Power-on self-test – POST performs diagnostics on server components upon server reset to ensure the integrity of those components. POST is configureable and works with ILOM to take faulty components offline if needed. ¦ Oracle Solaris OS Predictive Self-Healing – This technology continuously monitors the health of the CPU, memory, and other components, and works with ILOM to take a faulty component offline if needed. The PSH technology enables servers to accurately predict component failures and mitigate many serious problems before they occur. ¦ Log files and command interface – Provide the standard Oracle Solaris OS log files and investigative commands that can be accessed and displayed on the device of your choice. ¦ SunVTS – An application that exercises the server, provides hardware validation, and discloses possible faulty components with recommendations for repair. The LEDs, ILOM, PSH, and many of the log files and console messages are integrated. For example, when the Oracle Solaris software detects a fault, it displays the fault, and logs it, and passes information to ILOM, where it is logged. Related Information ¦ “Discover Faults (ILOM)” on page 67 ¦ “Discover Faults Using POST” on page 69 ¦ “Discover Faults (ILOM Fault Management Shell)” on page 67 ¦ See the server service manual section detecting and managing faultsMonitoring the Server 67 ? Discover Faults (ILOM) ? At the ILOM -> prompt, type: This command displays the target, the property, and the value of the fault. For example: Related Information ¦ “Discover Faults Using POST” on page 69 ¦ “Log In to ILOM” on page 9 ¦ “Locate the Server” on page 76 ¦ “Clear a Fault” on page 72 ¦ “Enabling Automatic System Recovery” on page 73 ¦ “Discover Faults (ILOM Fault Management Shell)” on page 67 ? Discover Faults (ILOM Fault Management Shell) The ILOM Fault Management shell provides a way to use the Oracle Solaris Fault Manager commands (fmadm, fmstat) from within ILOM, and to view both host and ILOM faults. 1. To start the captive shell, at the ILOM -> prompt, type: -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/Faultmgt/shell (y/n)? y faultmgmtsp>68 SPARC T3 Series Servers Administration Guide • July 2011 2. For a list of current server faults, type: Note – If the server detects the replacement of the faulty FRU, the repair does not require a user command, and the fault will be cleared automatically. 3. Discover more information about a specific fault. Find the fault MSG-ID (SPT-8000-42 in the preceeding example), and enter it in the search box at http://www.sun.com/msg. 4. To repair the fault, see: “Repair a Fault (ILOM Fault Management Shell)” on page 71. 5. To leave the Fault Management shell and return to ILOM, type: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Monitoring the Server 69 Related Information ¦ “Oracle Solaris 10 OS Feature Spotlight: Predictive Self Healing” at www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ “Log In to ILOM” on page 9 ¦ “Discover Faults (ILOM)” on page 67 ¦ “Repair a Fault (ILOM Fault Management Shell)” on page 71 ? Discover Faults Using POST The virtual keyswitch can be used to run full POST diagnostics without having to modify the diagnostic property settings. Note that POST diagnostics can take a significant amount of time to run at server reset. 1. Log in to ILOM. See “Log In to ILOM” on page 9. 2. At the ILOM -> prompt, type: The server is set to run full POST diagnostics on server reset. 3. To return to your normal diagnostic settings after running POST, at the ILOM -> prompt, type: Related Information ¦ “Discover Faults (ILOM)” on page 67 ¦ “Locate the Server” on page 76 ¦ “Clear a Fault” on page 72 ? Display Console History This topic describes displaying the host server console output buffers. -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal70 SPARC T3 Series Servers Administration Guide • July 2011 There are two console history buffers that can contain up to 1 Mbyte of information. The /HOST/console/history target writes all types of log information. The /HOST/console/bootlog target writes boot information and initialization data into the console buffer until ILOM is notified by the server that the Oracle Solaris OS is up and running. This buffer is kept until the host is booted again. Note – You must have ILOM Administrator level user permission to use this command. 1. To manage the /HOST/console/history log, at the ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 1 to 2048 lines. Specify "" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of 1 to any valid integer or "" for infinite number of lines. The default is not to pause. ¦ start_from – The options are: ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. If you type the show /HOST/console/history command without first setting any arguments with the set command, ILOM displays all lines of the console log, starting from the end. Note – Timestamps recorded in the console log reflect server time. These timestamps reflect local time, and the ILOM console log uses UTC (Coordinated Universal Time). The Oracle Solaris OS system time is independent of the ILOM time. 2. To view the /HOST/console/bootlog, at the ILOM -> prompt, type: where property can be: ¦ line_count – This option accepts a value within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is all lines. ¦ pause_count – This option accepts a value of within the range of 0 to 2048 lines. Specify "0" for an unlimited number of lines. The default is not to pause. ¦ start_from – The options are: -> set /HOST/console/history property=option [...] -> show /HOST/console/history -> show /HOST/console/bootlog propertyMonitoring the Server 71 ¦ end – The last line (most recent) in the buffer (the default). ¦ beginning – The first line in the buffer. Note – Timestamps recorded in the console log reflect server time. These timestamps reflect local time, and the ILOM console log uses UTC (Coordinated Universal Time). The Oracle Solaris OS system time is independent of the ILOM time. Related Information ¦ “Specify Host Power State at Restart” on page 41 ? Repair a Fault (ILOM Fault Management Shell) You can use the fmadm repair command to fix faults diagnosed by ILOM. (Faults diagnosed by ILOM, rather than the host, have message IDs starting with “SPT.”) The only time you should use the fmadm repair command in the ILOM Fault Management shell for a host-diagnosed fault is when the fault is repaired and ILOM is unaware of the repair. For example, ILOM might be down when the fault is repaired. In that case, the host would no longer display the fault, yet the fault is still displayed in ILOM. Use the the fmadm repair command to clear the fault. 1. Locate the fault: faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired.72 SPARC T3 Series Servers Administration Guide • July 2011 2. To repair an ILOM-detected fault, use the fmadm repair command: Note – You can use either the NAC name (for instance, /SYS/MB) or the UUID (for instance, fa4a2f86-5156-4243-8e88-d6516db12970) of the fault with the fmadm repair command. 3. To leave the Fault Management shell and return to ILOM, type: Related Information ¦ “Discover Faults (ILOM Fault Management Shell)” on page 67 ? Clear a Fault ? At the ILOM -> prompt, type: Setting clear_fault_action to true clears the fault at the component and all levels below it in the /SYS tree. Related Information ¦ “Discover Faults (ILOM)” on page 67 ¦ “Discover Faults Using POST” on page 69 ¦ “Display Server Components” on page 75 Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit -> -> set /SYS/component clear_fault_action=trueMonitoring the Server 73 Enabling Automatic System Recovery These topics include information about configuring your server to automatically recover from minor faults. Note – This section refers to the automatic system recovery feature, not the similarly named auto service request feature. ¦ “Automatic System Recovery Overview” on page 73 ¦ “Enable ASR” on page 74 ¦ “Disable ASR” on page 74 ¦ “View Information on Components Affected by ASR” on page 75 Automatic System Recovery Overview The server provides for ASR from failures in memory modules or PCI cards. ASR functionality enables the server to resume operation after experiencing certain nonfatal hardware faults or failures. When ASR is enabled, the system’s firmware diagnostics automatically detect failed hardware components. An autoconfiguring capability designed into the system firmware enables the system to unconfigure failed components and to restore server operation. As long as the server is capable of operating without the failed component, the ASR features enable the server to reboot automatically, without operator intervention. Note – ASR is not activated until you enable it. See “Enable ASR” on page 74. For more information about ASR, refer to the service manual for your server. Related Information ¦ “Enable ASR” on page 74 ¦ “Disable ASR” on page 74 ¦ “View Information on Components Affected by ASR” on page 7574 SPARC T3 Series Servers Administration Guide • July 2011 ? Enable ASR 1. At the ILOM -> prompt, type: 2. At the ok prompt, type: Note – For more information about OpenBoot configuration variables, refer to the service manual for your server. 3. To cause the parameter changes to take effect, type: The server permanently stores the parameter changes and boots automatically when the OpenBoot configuration variable auto-boot? is set to true (its default value). Related Information ¦ “Automatic System Recovery Overview” on page 73 ¦ “Disable ASR” on page 74 ¦ “View Information on Components Affected by ASR” on page 75 ? Disable ASR 1. At the ok prompt, type: -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? true ok reset-all ok setenv auto-boot-on-error? falseMonitoring the Server 75 2. To cause the parameter changes to take effect, type: The server permanently stores the parameter change. After you disable the ASR feature, it is not activated again until you re-enable it. Related Information ¦ “Enable ASR” on page 74 ¦ “View Information on Components Affected by ASR” on page 75 ¦ “Automatic System Recovery Overview” on page 73 ? View Information on Components Affected by ASR ? At the ILOM -> prompt, type: In the show /SYS/component component_state command output, any devices marked disabled have been manually unconfigured using the system firmware. The command output also shows devices that have failed firmware diagnostics and have been automatically unconfigured by the system firmware. Related Information ¦ “Automatic System Recovery Overview” on page 73 ¦ “Enable ASR” on page 74 ¦ “Disable ASR” on page 74 ¦ “Unconfigure a Device Manually” on page 63 ¦ “Reconfigure a Device Manually” on page 63 ? Display Server Components View real-time information about the components installed in your server using the ILOM show components command. ok reset-all -> show /SYS/component component_state76 SPARC T3 Series Servers Administration Guide • July 2011 ? At the ILOM -> prompt, type: Note – Components will vary based on your server. Related Information ¦ “Locate Device Paths” on page 35 ? Locate the Server In case you need to service a component, lighting the system locator LED assists in easily identifying the correct server. You do not need administrator permissions to use the set /SYS/LOCATE and show /SYS/LOCATE commands. 1. Log in to ILOM. See “Log In to ILOM” on page 9. 2. Manage the Locator LED with the following commands. ¦ To turn on the Locator LED, from the ILOM service processor command prompt, type: ¦ To turn off the Locator LED, from the ILOM service processor command prompt, type: -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | Enabled /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=offMonitoring the Server 77 ¦ To display the state of the Locator LED, from the ILOM service processor command prompt, type: Related Information ¦ “Monitoring Faults” on page 65 ¦ “Configuring Devices” on page 63 -> show /SYS/LOCATE78 SPARC T3 Series Servers Administration Guide • July 201179 Updating the Firmware These topics describe how to update the system firmware and view current versions of firmware for Oracle’s SPARC T3 series servers. ¦ “Display the Firmware Version” on page 79 ¦ “Update the Firmware” on page 79 ¦ “Display OpenBoot Version” on page 82 ¦ “Display POST Version” on page 82 ? Display the Firmware Version The /HOST sysfw_version property displays information about the system firmware version on the host. ? View the current setting for this property. At the ILOM -> prompt, type: Related Information ¦ “Update the Firmware” on page 79 ? Update the Firmware 1. Ensure that the ILOM service processor network management port is configured. See the installation guide for your server for instructions. -> show /HOST sysfw_version80 SPARC T3 Series Servers Administration Guide • July 2011 2. Open an SSH session to connect to the service processor: 3. Power off the host: 4. Set the keyswitch_state parameter to normal: 5. Type the load command with the path to the new flash image. The load command updates the service processor flash image and the host firmware. The load command requires the following information: ¦ IP address of a TFTP server on the network that can access the flash image. ¦ Full path name to the flash image that the IP address can access. The command usage is as follows: load [-script] -source tftp://xxx.xxx.xx.xxx/pathname where: ¦ -script - Does not prompt for confirmation and acts as if yes was specified. % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalUpdating the Firmware 81 ¦ -source - Specifies the IP address and full path name (URL) to the flash image. After the flash image has been updated, the server automatically resets, runs diagnostics, and returns to the login prompt on the serial console. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open82 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “Display the Firmware Version” on page 79 ? Display OpenBoot Version The /HOST obp_version property displays information about the version of OpenBoot on the host. ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 79 ¦ “OpenBoot Overview” on page 4 ? Display POST Version The /HOST post_version property displays information about the version of POST on the host. Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionUpdating the Firmware 83 ? View the current setting for this property: Related Information ¦ “Update the Firmware” on page 79 -> show /HOST post_version84 SPARC T3 Series Servers Administration Guide • July 201185 Updating the Oracle Solaris Operating System These topics describe how to update the Oracle Solaris OS on Oracle’s SPARC T3 series servers. ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 World Wide Name Syntax The Oracle Solaris OS now uses the World Wide Name (WWN) syntax in place of the locally unique tn (target ID) field in logical device names. This change affects how a target storage device is identified when downloading the operating system over a network. The following points are key to understanding the impact of this change: ¦ Before the change to WWN nomenclature, the Oracle Solaris OS would ordinarily identify the default boot device as c0t0d0. ¦ With the change, the device identifier for the default boot device is now referred to as c0tWWNd0, where WWN is a hexadecimal value that is unique to this device throughout the world.86 SPARC T3 Series Servers Administration Guide • July 2011 ¦ This WWN value does not map in a predictable way to the physical address of the device to which it refers. To reliably specify a particular storage device for an OS download operation, you must determine the correspondence between the WWN value assigned to that device and its physical location. You can find this correspondence using either OBP or Oracle Solaris commands: ¦ When in OBP, run probe-scsi-all. See “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 for instructions. ¦ When in Oracle Solaris, run format, followed by prtconf -v. See “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 or “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 for instructions. These commands generate information about the SAS controllers and the storage devices that are connected to them. This information includes both logical and physical names, which you can analyze to determine these logical and physical address relationships. Related Information ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104Updating the Oracle Solaris Operating System 87 probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane) When analyzing probe-scsi-all output, look for this SAS device information: ¦ SASDeviceName -- This is the WWN that the Oracle Solaris OS recognizes. ¦ SASAddress -- This is the WWN that the OBP recognizes. ¦ PhyNum -- This is a hexadecimal value that identifies the port that a disk is connected to. ¦ VolumeDeviceName -- When a RAID volume has been configured, this is the RAID volume WWN value recognized by the Oracle Solaris OS. ¦ VolumeWWID -- When a RAID volume has been configured, this is the RAID volume WWN value referenced by OBP. The following table shows the PhyNum-to-disk slot correspondence for an eight-disk backplane configuration. The following example illustrates probe-scsi-all output for a SPARC T3-1 server with seven hard drives in an eight-disk capable backplane configuration. In this example, the hard drives are connected to the two SAS controllers in this manner: ¦ Four hard drives are connected to SAS controller 0. These are targets 9, a, b, and c. ¦ Three hard drives and a SATA DVD device are connected to SAS controller 1. These are targets 9, b, c, and a, respectively. TABLE: SAS Controller Port Mapping for Eight-Disk Backplanes SAS Controller PhyNum Disk Slot SAS Controller PhyNum Disk Slot 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 788 SPARC T3 Series Servers Administration Guide • July 2011 Because SAS controller 0 controls the hard drives installed in backplane slots 0-3, the default boot device for this sample configuration is PhyNum 0 in the group of hard drives under controller 0. It has a SASDeviceName value of 5000cca00a75dcac and a SASAddress value of 5000cca00a75dcad. Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7680d4 SASAddress 5000cca00a7680d5 PhyNum 2 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 3 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d40bf9b SASAddress 5000c5001d40bf99 PhyNum 1Updating the Oracle Solaris Operating System 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane) When analyzing probe-scsi-all output, look for this SAS device information: ¦ SASDeviceName -- This is the WWN that the Oracle Solaris OS recognizes. ¦ SASAddress -- This is the WWN that the OBP recognizes. ¦ PhyNum -- This is a hexadecimal value that identifies the port that a disk is connected to. ¦ VolumeDeviceName -- When a RAID volume has been configured, this is the RAID volume WWN value recognized by the Oracle Solaris OS. ¦ VolumeWWID -- When a RAID volume has been configured, this is the RAID volume WWN value referenced by OBP. The following table shows the PhyNum-to-disk slot correspondence for a sixteen-disk backplane connected to onboard SAS controllers 0 and 1. Note – The default 16-disk backplane configuration is divided into two logically isolated zones, with disk slots 0-7 visible to SAS controller 0 and disk slots 8-15 visible to SAS controller 1. TABLE: SAS Controller Port Mapping for Sixteen-Disk Backplanes SAS Controller PhyNum (Hex) Disk Slot (Dec) SAS Controller PhyNum (Hex) Disk Slot (Dec) 0 0 0 1 8 8 1 1 9 9 2 2 A 1090 SPARC T3 Series Servers Administration Guide • July 2011 The following example illustrates probe-scsi-all output for a SPARC T3-1 server with nine hard drives in a sixteen-disk capable backplane configuration. Note – Controller 1 manages the SATA DVD. The default boot location (physical slot 0) is listed as PhyNum 0 in the SAS controller 0 section. It has a SASDeviceName value of 5000cca00a59278c and a SASAddress value of 5000cca00a59278d. 3 3 B 11 4 4 C 12 5 5 D 13 6 6 E 14 7 7 F 15 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a746490 SASAddress 5000cca00a746491 PhyNum 8 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d1283 SASAddress 5000c5001d0d1281 PhyNum 9 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a01014c SASAddress 5000cca00a01014d PhyNum a Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0ca947 SASAddress 5000c5001d0ca945 PhyNum b Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d2857 SASAddress 5000c5001d0d2855 PhyNum c Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02f5d0 SASAddress 5000cca00a02f5d1 PhyNum d TABLE: SAS Controller Port Mapping for Sixteen-Disk Backplanes (Continued) SAS Controller PhyNum (Hex) Disk Slot (Dec) SAS Controller PhyNum (Hex) Disk Slot (Dec)Updating the Oracle Solaris Operating System 91 Target 10 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c3d9b SASAddress 5000c5001d0c3d99 PhyNum e Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097737 SASAddress 5000c5001d097735 PhyNum f Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a59278c SASAddress 5000cca00a59278d PhyNum 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7e6fb SASAddress 5000c50017c7e6f9 PhyNum 1 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4bfcb8 SASAddress 5000cca00a4bfcb9 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7a3a3 SASAddress 5000c50017c7a3a1 PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02cc18 SASAddress 5000cca00a02cc19 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76dec0 SASAddress 5000cca00a76dec1 PhyNum 5 Target 10 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a773eac SASAddress 5000cca00a773ead PhyNum 6 Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09654f SASAddress 5000c5001d09654d PhyNum d Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 ok92 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 probe-scsi-all Output Example (SPARC T3-4) When analyzing probe-scsi-all output, look for this SAS device information: ¦ SASDeviceName -- This is the WWN that the Oracle Solaris OS recognizes. ¦ SASAddress -- This is the WWN that the OBP recognizes. ¦ PhyNum -- This is a hexadecimal value that identifies the port that a disk is connected to. ¦ VolumeDeviceName -- When a RAID volume has been configured, this is the RAID volume WWN value recognized by the Oracle Solaris OS. ¦ VolumeWWID -- When a RAID volume has been configured, this is the RAID volume WWN value referenced by OBP. A SPARC T3-4 server has two onboard SAS controllers, each connected to a separate four-disk capable backplane. The following table shows the PhyNum-to-disk slot correspondence for these backplanes.Updating the Oracle Solaris Operating System 93 Note – OBP uses a different device path for SAS controller 1 in SPARC T3-4 servers, depending on whether the server has four-processors or two processors. The path for SAS Controller 0 is the same for both processor configurations. SAS Controller Device Path: SPARC T3-4 Server With Four Processors The following example illustrates probe-scsi-all output for a SPARC T3-4 with four processors and eight drives. Because SAS controller 0 controls the hard drives installed in backplane slots 0-3, the default boot device for this example is PhyNum 0 in the group of hard drives under controller 0. It has a SASDeviceName value of 5000cca00a75dcac and a SASAddress value of 5000cca00a75dcad. TABLE: SAS Controller Port Mapping for an Eight-Disk Backplane SAS Controller PhyNum Disk Slot SAS Controller PhyNum Disk Slot 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 394 SPARC T3 Series Servers Administration Guide • July 2011 SAS Controller Device Path: SPARC T3-4 Server With Two Processors The following example illustrates probe-scsi-all output for a SPARC T3-4 with two processors and eight drives. Because SAS controller 0 controls the hard drives installed in backplane slots 0-3, the default boot device for this example is PhyNum 0 in the group of hard drives under controller 0. It has a SASDeviceName value of 5000cca00a75dcac and a SASAddress value of 5000cca00a75dcad. /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3 ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target cUpdating the Oracle Solaris Operating System 95 Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 396 SPARC T3 Series Servers Administration Guide • July 2011 ? Identify a Disk Slot Using probe-scsi-all (OBP) Use probe-scsi-all to display the following SAS device information: ¦ SASDeviceName -- This is the WWN that the Oracle Solaris OS recognizes. ¦ SASAddress -- This is the WWN that the OBP recognizes. ¦ PhyNum -- This is a hexadecimal value that identifies the port that a disk is connected to. ¦ VolumeDeviceName -- When a RAID volume has been configured, this is the RAID volume WWN value recognized by the Oracle Solaris OS. ¦ VolumeWWID -- When a RAID volume has been configured, this is the RAID volume’s WWN value referenced by OBP. The following example is based on a SPARC T3-2 server with six hard drives. Four hard drives are connected to the SAS controller as individual storage devices. These are Target 9, d, e, and f. Two hard drives are configured as a RAID volume. This disk array is Target 389. ? Run probe-scsi-all. In the following example, the hard drive installed in physical slot 0 has the PhyNum value 0. It is designated Target 9 and has a SASDeviceName value of 5000c5001cb4a637. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GBUpdating the Oracle Solaris Operating System 97 Note – The probe-scsi-all output example shown above can be applied to the interpretation of probe-scsi-all output for SPARC T3-1B systems. Note – The probe-scsi-all output for SPARC T3-1 and SPARC T3-4 servers has special characteristics due to their use of two on-board SAS controllers. In addition, on SPARC T3-1 servers with sixteen-disk capable backplanes, the two controllers connect to the hard drives through a SAS expander unit on the backplane. These differences are explained in “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 and “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89. Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.0098 SPARC T3 Series Servers Administration Guide • July 2011 ? Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers) The procedure described below is intended for SPARC T3-1 servers with sixteen-disk capable backplanes. These systems include a SAS expander between the two on-board SAS controllers and the hard drive connectors. The 16 disk backplane is zoned such that the phy-num value associated with each drive is relative to its controller. Note – For systems with an eight-disk capable backplane and two on-board controllers, each controller provides an interface to four of the eight drive slots. As a result, the phy-num value associated with each drive is relative to its controller. A example of the single-initiator configuration procedure is provided in “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 1. Run the format command. The remaining steps in this example will identify the physical slot that corresponds to the device name c0t5000C5001D3FF2D7d0. 2. Run prtconf -v and search for the device link c0t5000C5001D3FF2D7d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000C5001D3FF2D7d0 /scsi_vhci/disk@g5000c5001d3ff2d7 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/rsd3aUpdating the Oracle Solaris Operating System 99 3. Search the prtconf output for a name=’wwn’ entry that has the WWN value 5000c5001d3ff2d7. Note the target-port value listed with that WWN value. In this example it is 5000c5001d3ff2d5. This is the target ID of the physical disk. Note – In a SPARC T3-1 system with a sixteen-disk backplane, both controllers list the logical name (the wwn value), a corresponding port name (target-port value), and physical disk location (phy-num value) for every connected hard drive. 4. The value shown for the name=’phy-num’ entry indicates the physical slot containing the hard drive. In this example, the target device is in slot 4. Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 Paths from multipath bus adapters: mpt_sas#2 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ <<=== Hard drive target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 <<=== Hard drive slot number name=’path-class’ type=string items=1 value=’primary’ mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 name=’path-class’ type=string items=1 value=’primary’100 SPARC T3 Series Servers Administration Guide • July 2011 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 ? Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator) The procedure described below is intended for SPARC T3-1 and SPARC T3-4 servers in a single-initiator, eight-disk backplane configuration. 1. Run the format command. The remaining steps in this example will identify the physical slot that corresponds to the device name c0t5000CCA00ABBAEB8d0. 2. Run prtconf -v and search for the device link c0t5000CCA00ABBAEB8d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/rsd3aUpdating the Oracle Solaris Operating System 101 3. Search the prtconf output for a name=’wwn’ entry that has the WWN value 5000cca00abbaeb8. Note the obp-path value listed under WWN 5000cca00abbaeb8. Refer to the following table to find the controller. For SPARC T3-1 servers,the controller is identified in the second field: pci@1 = controller 0 and pci@2 = controller 1. For SPARC T3-4 servers, the controller is identified in the first field. For systems with a four-processor configuration, pci@400 = controller 0 and pci@700 = controller 1. For systems with a two-processor configuration, pci@400 = controller 0 and pci@500 = controller 1. The following output example shows the obp-path for a SPARC T3-1 server. SPARC T3-1 Controller 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (4 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (2 processor) Controller 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Controller 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’102 SPARC T3 Series Servers Administration Guide • July 2011 In this SPARC T3-1 example, the obp-path is: Based on the previous table, this disk is on controller 0. The following output example shows the obp-path for a SPARC T3-4 server. In this SPARC T3-4 example, the obp-path is: Based on the previous table, this disk is on controller 0. 4. This phy-num value corresponds to physical disk slot 0, as shown in the following port mapping table. /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SAS Controller PhyNum Disk Slot SAS Controller PhyNum Disk Slot 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Updating the Oracle Solaris Operating System 103 Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 WWN Syntax in an OS Installation on a Specific Device The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the operating system on a specific disk drive. In this example, the device name contains the WWN value 5000CCA00A75DCAC. Note – Oracle Solaris syntax rules require all alpha characters to be capitalized. # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap104 SPARC T3 Series Servers Administration Guide • July 2011 Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a RAID Volume” on page 104 WWN Syntax in an OS Installation on a RAID Volume The following Oracle Solaris Jumpstart profile example shows how to use the WWN syntax when installing the OS on a RAID volume. When installing software on a RAID volume, use the virtual device’s VolumeDeviceName instead of an individual device name. In this example, the RAID volume name is 3ce534e42c02a3c0. # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapUpdating the Oracle Solaris Operating System 105 Related Information ¦ “World Wide Name Syntax” on page 85 ¦ “probe-scsi-all Output Example (SPARC T3-1, Eight-Disk Backplane)” on page 87 ¦ “probe-scsi-all Output Example (SPARC T3-1, Sixteen-Disk Backplane)” on page 89 ¦ “probe-scsi-all Output Example (SPARC T3-4)” on page 92 ¦ “Identify a Disk Slot Using probe-scsi-all (OBP)” on page 96 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Onboard Controllers)” on page 98 ¦ “Identify a Disk Slot Using prtconf (Oracle Solaris, Single Initiator)” on page 100 ¦ “WWN Syntax in an OS Installation on a Specific Device” on page 103106 SPARC T3 Series Servers Administration Guide • July 2011107 Index Symbols -> prompt about, 1 ways to access, 12 A Automatic System Recovery (ASR) disabling, 74 enabling, 74 viewing affected components, 75 B boot mode expiration date, 57 managing at reset, 55 managing con?guration, 54 managing script, 56 managing system, 53 Oracle VM Server (LDoms), 54 overview, 53 C cables, keyboard and mouse, 13 console history, displaying, 69 D device paths, 35 devices con?guring, 64 managing, 63 uncon?guring, 63 DHCP server, displaying IP Address, 46 diagnostics, 65 F faults bypassing, 73 clearing, 72 discovering with ILOM, 67 discovering with POST, 69 handling, 65 FCode utility commands, 30 RAID, 28 ?rmware, updating, 79 FRU data, changing, 37 H host power state managing power-on delay, 41 restoring at restart, 40 speci?ng at restart, 41 I ILOM accessing the system console, 10 default username and password, 10 logging in, 9 overview, 1 parallel boot policy, 42 platform-speci?c features, 3 prompt, 10, 12 speci?ng host power state property, 41 K keyboard, attaching, 13 keyswitch, specifying host behavior, 42 L local graphics monitor, 13 locating the server, 76108 SPARC T3 Series Servers Administration Guide • July 2011 M MAC address, displaying host, 47 multipathing software, 5 N network access, enabling or disabling, 46 network address options, 45 O ok prompt, displaying, 11 OpenBoot displaying version, 82 setting con?guration variables, 13 Oracle VM Server for SPARC overview, 4 P POST displaying version, 79, 82 running diagnostics, 69 power off, 16 power on, 15 R RAID con?guring, 19 creating volumes, 30 FCode utility, 28 support, 19 restart behavior setting the boot timeout interval, 60 specifying behavior at boot timeout, 61 specifying behavior if restart fails, 61 specifying behavior when host stops running, 60 specifying max restart attempts, 62 specifying on host reset, 59 S server controlling, 15 resetting from ILOM, 17 resetting from the OS, 17 SP, resetting, 18 SunVTS, 66 system administration overview, 1 system communication, 9 system console, logging in, 10 system identi?cation, changing, 38 Sun SPARC T3-1B Server Module Safety and Compliance Guide Part No. 821-1915-10 November 2010, Revision APlease Recycle Copyright © 2010 Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Declaration of Conformity v Regulatory Compliance Statements vii Safety Agency Compliance Statements ixiv SPARC T3-1B Server Module Safety and Compliance Manual • November 2010v Declaration of Conformity To receive a copy of the latest Declaration of Conformity (DoC) for the product, create an online request at(https://www2.sun.de/dct/forms/reg_us_1607_755_0.jsp), or send email to: compliance_request_www@oracle.com.vi SPARC T3-1B Server Module Safety and Compliance Manual • November 2010vii Regulatory Compliance Statements Your Sun product is marked to indicate its compliance class: • Federal Communications Commission (FCC) — USA • Industry Canada Equipment Standard for Digital Equipment (ICES-003) — Canada • Voluntary Control Council for Interference (VCCI) — Japan • Bureau of Standards Metrology and Inspection (BSMI) — Taiwan • Certi?cation and Accreditation Administration of the People’s Republic of China (CNCA) — China • Korea Communications Commission (KCC) — Korea Please read the appropriate section that corresponds to the marking on your Sun product before attempting to install the product. FCC Class A Notice This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if it is not installed and used in accordance with the instruction manual, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user will be required to correct the interference at his own expense. Modifications: Any modi?cations made to this device that are not approved by Sun Microsystems, Inc. may void the authority granted to the user by the FCC to operate this equipment. ICES-003 Class A Notice - Avis NMB-003, Classe A This Class A digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada. BSMI Class A Notice The following statement is applicable to products shipped to Taiwan and marked as Class A on the product complianceviii SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 label. CCC Class A Notice The following statement is applicable to products shipped to China and marked with “Class A” on the product’s compliance label. Korean Class A Notice The following is the Korean Class A Broadcasting and Telecommunication Products for Business Purpose Statement.ix Safety Agency Compliance Statements Read this section before beginning any procedure. The following text provides safety precautions to follow when installing a Sun Microsystems product. Safety Precautions For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Never push objects of any kind through openings in the equipment. Dangerous voltages may be present. Conductive foreign objects could produce a short circuit that could cause fire, electric shock, or damage to your equipment. ¦ This product is intended for restricted access whereby access is controlled through the use of a means of security (for example, key, lock, tool, badge access) and personnel authorized for access have been instructed on the reasons for the restrictions and any precautions that need to be taken. Symbols The following symbols may appear in this book: Caution – There is a risk of personal injury and equipment damage. Follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and may cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. Depending on the type of power switch your device has, one of the following symbols may be used: On – Applies AC power to the system. Off – Removes AC power from the system. Standby – The On/Standby switch is in the standby position. Modifications to Equipment Do not make mechanical or electrical modifications to the equipment. Sun Microsystems is not responsible for regulatory compliance of a modified Sun product. Placement of a Sun Product Caution – Do not block or cover the openings of your Sun product. Never place a Sun product near a radiator or heat register. Failure to follow these guidelines can cause overheating and affect the reliability of your Sun product. Noise Level Product: SPARC T3-1B Server Module In compliance with the requirements defined in ISO 7779, the workplace-dependent noise level of this product is less than 70 db (A). SELV Compliance Safety status of I/O connections comply to SELV requirements. Power Cord Connection Caution – Sun products are designed to work with power systems having a grounded neutral (grounded return for DC-powered products). To reduce the risk of electric shock, do not plug Sun products into any other type of power system. Contact your facilitiesx SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 manager or a qualified electrician if you are not sure what type of power is supplied to your building. Caution – Not all power cords have the same current ratings. Do not use the power cord provided with your equipment for any other products or use. Household extension cords do not have overload protection and are not meant for use with computer systems. Do not use household extension cords with your Sun product. The following caution applies only to devices with a Standby power switch: Caution – The power switch of this product functions as a standby type device only. The power cord serves as the primary disconnect device for the system. Be sure to plug the power cord into a grounded power outlet that is nearby the system and is readily accessible. Do not connect the power cord when the power supply has been removed from the system chassis. The following caution applies only to devices with multiple power cords: Caution – For products with multiple power cords, all power cords must be disconnected to completely remove power from the system. Battery Warning Caution – There is danger of explosion if batteries are mishandled or incorrectly replaced. On systems with replaceable batteries, replace only with the same manufacturer and type or equivalent type recommended by the manufacturer per the instructions provided in the product service manual. Do not disassemble batteries or attempt to recharge them outside the system. Do not dispose of batteries in fire. Dispose of batteries properly in accordance with the manufacturer’s instructions and local regulations. Note that on Sun CPU boards, there is a lithium battery molded into the realtime clock. These batteries are not customer replaceable parts. Energy Storage Module Caution Caution – There is a danger of shock or equipment damage if energy storage modules are mishandled or incorrectly replaced. When replacing the energy storage modules, use only replacement modules that have been provided by Sun Microsystems, following the instructions provided in the product service manual. Do not disassemble modules or attempt to recharge them outside of the system. Do not dispose of the modules; instead, return them to Sun Microsystems in accordance with Sun proocedures for the product. System Unit Cover You must remove the cover of your Sun computer system unit to add cards, memory, or internal storage devices. Be sure to replace the cover before powering on your computer system. Caution – Do not operate Sun products without the cover in place. Failure to take this precaution may result in personal injury and system damage.Safety Agency Compliance Statements xi Rack System Instructions The following or similar rack-mount instructions are included with the installation instructions: ¦ Elevated Operating Ambient – If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Therefore, consideration should be given to installing the equipment in an environment compatible with the maximum ambient temperature (Tma) specified by the manufacturer. ¦ Reduced Air Flow – Installation of the equipment in a rack should be such that the amount of air flow required for safe operation of the equipment is not compromised. ¦ Mechanical Loading – Mounting of the equipment in the rack should be such that a hazardous condition is not achieved due to uneven mechanical loading. ¦ Circuit Overloading – Consideration should be given to the connection of the equipment to the supply circuit and the effect that overloading of the circuits might have on overcurrent protection and supply wiring. Appropriate consideration of equipment nameplate ratings should be used when addressing this concern. ¦ Reliable Earthing – Reliable earthing of rackmounted equipment should be maintained. Particular attention should be given to supply connections other than direct connections to the branch circuit (for example, use of power strips). Caution – Slide/rail mounted equipment must not be used as a shelf or workspace. Rack System Warnings The following warnings apply to Racks and Rack Mounted systems. Caution – For safety, equipment should always be loaded from the bottom up. That is, install the equipment that will be mounted in the lowest part of the rack first, then the next higher systems, etc. Caution – To prevent the rack from tipping during equipment installation, the anti-tilt bar on the rack must be deployed. Caution – To prevent extreme operating temperature within the rack insure that the maximum temperature does not exceed the product’s ambient rated temperatures. Caution – To prevent extreme operating temperatures due to reduced airflow consideration should be made to the amount of air flow that is required for a safe operation of the equipment. Laser Compliance Notice Sun products that use laser technology comply with Class 1 laser requirements. CD and DVD Devices The following caution applies to CD, DVD, and other optical devices. Caution – Use of controls, adjustments, or the performance of procedures other than those specified herein may result in hazardous radiation exposure. Conformité aux normes de sécurité Veuillez lire attentivement cette section avant de commencer. Ce texte traite des mesures de sécurité qu’il convient de prendre pour l’installation d’un produit Sun Microsystems.xii SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 Mesures de sécurité Pour votre sécurité, nous vous recommandons de suivre scrupuleusement les mesures de sécurité ci-dessous lorsque vous installez votre matériel: ¦ Suivez tous les avertissements et toutes les instructions inscrites sur le matériel. ¦ Assurez-vous que la tension et la fréquence de votre source d'alimentation correspondent à la tension et à la fréquence indiquées sur l'étiquette de la tension électrique nominale du matériel ¦ N'introduisez jamais d'objets quels qu'ils soient dans les ouvertures de l'équipement. Vous pourriez vous trouver en présence de hautes tensions dangereuses. Tout objet étranger conducteur risque de produire un court-circuit pouvant présenter un risque d'incendie ou de décharge électrique, ou susceptible d'endommager le matériel. ¦ Ce produit est destiné à être utilisé dans des zones à accès limité, dans lesquelles les accès sont contrôlés au moyen de systèmes de sécurité (par exemple, à clé, verrou, dispositif ou badge). Le personnel autorisé à accéder à ces zones doit avoir été préalablement informé des raisons justifiant la limitation des accès et de toutes les précautions à prendre. Symboles Vous trouverez ci-dessous la signification des différents symboles utilisés: Attention – ous risquez d'endommager le matériel ou de vous blesser. Veuillez suivre les instructions. Attention – Surfaces brûlantes. Evitez tout contact. Les surfaces sont brûlantes. Vous risquez de vous blesser si vous les touchez. Attention – Tensions dangereuses. Pour réduire les risques de décharge électrique et de danger physique, observez les consignes indiquées. Selon le type d'interrupteur marche/arrêt dont votre appareil est équipé, l'un des symboles suivants sera utilisé: Marche – Met le système sous tension alternative. Arret – Met le système hors tension alternative. Veilleuse – L'interrupteur Marche/Veille est sur la position de veille. Modification du matériel N'apportez aucune modification mécanique ou électrique au matériel. Sun Microsystems décline toute responsabilité quant à la non-conformité éventuelle d'un produit Sun modifié. Positionnement d’un produit Sun Attention – Evitez d'obstruer ou de recouvrir les orifices de votre produit Sun. N'installez jamais un produit Sun près d'un radiateur ou d'une source de chaleur. Si vous ne respectez pas ces consignes, votre produit Sun risque de surchauffer et son fonctionnement en sera altéré. Niveau de pression acoustique Produit: SPARC T3-1B Server Module Conformément à la norme ISO 7779, le niveau sonore de ce produit sur le lieu de travail est inférieur à 70 db(A). Conformité SELV Le niveau de sécurité des connexions E/S est conforme aux normes SELV. Connexion du cordon d’alimentation Attention – Les produits Sun sont conçus pour fonctionner avec des systèmes d'alimentation équipés d'un conducteur neutre relié à la terre (conducteur neutre pour produits alimentés en CC). Pour réduire lesSafety Agency Compliance Statements xiii risques de décharge électrique, ne branchez jamais les produits Sun sur une source d'alimentation d'un autre type. Contactez le gérant de votre bâtiment ou un électricien agréé si vous avez le moindre doute quant au type d'alimentation fourni dans votre bâtiment. Attention – Tous les cordons d'alimentation ne présentent pas les mêmes caractéristiques électriques. Les cordons d'alimentation à usage domestique ne sont pas protégés contre les surtensions et ne sont pas conçus pour être utilisés avec des ordinateurs. N'utilisez jamais de cordon d'alimentation à usage domestique avec les produits Sun. L'avertissement suivant s'applique uniquement aux systèmes équipés d'un interrupteur Veille: Attention – L'interrupteur d'alimentation de ce produit fonctionne uniquement comme un dispositif de mise en veille. Le cordon d'alimentation constitue le moyen principal de déconnexion de l'alimentation pour le système. Assurez-vous de le brancher dans une prise d'alimentation mise à la terre près du système et facile d'accès. Ne le branchez pas lorsque l'alimentation électrique ne se trouve pas dans le châssis du système. L'avertissement suivant s'applique uniquement aux systèmes équipés de plusieurs cordons d'alimentation: Attention – Pour mettre un système équipé de plusieurs cordons d'alimentation hors tension, il est nécessaire de débrancher tous les cordons d'alimentation. Mise en garde relative aux batteries Attention – Les batteries risquent d’exploser en cas de manipulation maladroite ou de remplacement incorrect. Pour les systèmes dont les batteries sont remplaçables, effectuez les remplacements uniquement selon le modèle du fabricant ou un modèle équivalent recommandé par le fabricant, conformément aux instructions fournies dans le manuel de service du système. N’essayez en aucun cas de démonter les batteries, ni de les recharger hors du système. Ne les jetez pas au feu. Mettez-les au rebut selon les instructions du fabricant et conformément à la législation locale en vigueur. Notez que sur les cartes processeur de Sun, une batterie au lithium a été moulée dans l'horloge temps réel. Les batteries ne sont pas des pièces remplaçables par le client. Avertissement - Module de stockage d’énergie Attention – Si vous manipulez ou remplacez les modules de stockage d’énergie incorrectement, vous risquez de les endommager ou de vous exposer à un choc électrique. Remplacez les modules de stockage d’énergie uniquement par les modules de remplacement que Sun Microsystems fournit, en veillant à respecter les instructions indiquées dans le manuel d’entretien du produit. Ne démontez pas les modules. N’essayez pas de les recharger hors du système. Ne jetez pas les modules, mais retournez-les à Sun Microsystems conformément aux procédures Sun relatives au produit. Couvercle de l'unité Pour ajouter des cartes, de la mémoire ou des périphériques de stockage internes, vous devez retirer le couvercle de votre système Sun. Remettez le couvercle supérieur en place avant de mettre votre système sous tension.xiv SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 Attention – Ne mettez jamais des produits Sun sous tension si leur couvercle supérieur n'est pas mis en place. Si vous ne prenez pas ces précautions, vous risquez de vous blesser ou d'endommager le système. Instructions de montage en rack La mise en garde suivante s'applique aux racks et aux systèmes montés en rack. ¦ Température ambiante de fonctionnement élevée : en cas d'installation dans un châssis fermé ou contenant plusieurs appareils, la température ambiante de fonctionnement au niveau du rack peut être supérieure à la température ambiante de la pièce. En conséquence, il convient de veiller à installer le matériel dans un environnement compatible avec la température ambiante maximale (Tma), spécifiée par le fabricant. ¦ Débit d'air réduit : l'installation du matériel dans un rack doit être effectuée de façon à ne pas compromettre le débit d'air nécessaire pour un fonctionnement sûr de ce matériel. ¦ Charge mécanique : le montage de l'équipement en rack doit être réalisé de manière à éviter toute situation dangereuse résultant d'une charge déséquilibrée. ¦ Surcharge de circuit : il convient de prendre les précautions nécessaires pour la connexion du matériel au circuit d'alimentation et de réfléchir aux conséquences d'une éventuelle surcharge des circuits sur la protection de surintensité et sur le câblage d'alimentation. En l'occurrence, les valeurs nominales de la plaque signalétique du matériel doivent être prises en compte. ¦ Mise à la terre fiable : une mise à la terre fiable du matériel monté en rack doit être assurée. Une attention toute particulière est requise pour les raccordements d'alimentation autres que ceux effectués directement sur le circuit principal (par exemple, en cas d'utilisation de blocs multiprises). Attention – L’équipement monté sur glissière/rail ne doit servir ni d’étagère ni d’espace de travail. Mise en garde relative au système en racks La mise en garde suivante s'applique aux racks et aux systèmes montés en rack. Attention – Pour des raisons de sécurité, le matériel doit toujours être chargé du bas vers le haut. En d'autres termes, vous devez installer, en premier, le matériel qui doit se trouver dans la partie la plus inférieure du rack, puis installer le matériel sur le niveau suivant, etc. Attention – Afin d'éviter que le rack ne penche pendant l'installation du matériel, tirez la barre anti-basculement du rack. Attention – Pour éviter des températures de fonctionnement extrêmes dans le rack, assurez-vous que la température maximale ne dépasse pas la fourchette de températures ambiantes du produit déterminée par le fabricant. Attention – Afin d'empêcher des températures de fonctionnement extrêmes provoquées par une aération insuffisante, assurez-vous de fournir une aération appropriée pour un fonctionnement du matériel en toute sécurité Avis de conformité des appareils laser Les instructions de montage en rack suivantes ou similaires à celles-ci sont fournies avec les instructions d'installation :Safety Agency Compliance Statements xv Périphériques CD et DVD L'avertissement suivant s'applique aux périphériques CD, DVD et autres périphériques optiques: Attention – L'utilisation de contrôles et de réglages ou l'application de procédures autres que ceux spécifiés dans le présent document peuvent entraîner une exposition à des radiations dangereuses. Einhaltung sicherheitsbehördlicher Vorschriften Lesen Sie vor dem Ausführen von Arbeiten diesen Abschnitt. Im folgenden Text werden Sicherheitsvorkehrungen beschrieben, die Sie bei der Installation eines Sun Microsystems-Produkts beachten müssen. Sicherheitsvorkehrungen Treffen Sie zu Ihrem eigenen Schutz bei der Installation des Geräts die folgenden Sicherheitsvorkehrungen: ¦ Beachten Sie alle auf den Geräten angebrachten Warnhinweise und Anweisungen. ¦ Stellen Sie sicher, dass Spannung und Frequenz der Stromversorgung den Nennleistungen auf dem am Gerät angebrachten Etikett entsprechen. ¦ Führen Sie niemals Fremdobjekte in die Öffnungen am Gerät ein. Es können gefährliche Spannungen anliegen. Leitfähige Fremdobjekte können einen Kurzschluss verursachen, der einen Brand, Stromschlag oder Geräteschaden herbeiführen kann. ¦ Dieses Produkt unterliegt Zugangsbeschränkungen. Der Zugang wird mithilfe eines Sicherheitsmechanismus kontrolliert (z. B. einem Schlüssel, einer Sperre, einem Tool oder eines Werksausweises) und das autorisierte Zugangspersonal wurde über die Gründe für die Beschränkungen und die zu treffenden Sicherheitsmaßnahmen unterrichtet. Symbole Die Symbole in diesem Handbuch haben folgende Bedeutung: Achtung – Gefahr von Verletzung und Geräteschaden. Befolgen Sie die Anweisungen. Achtung – Heiße Oberfläche. Nicht berühren, da Verletzungsgefahr durch heiße Oberfläche besteht. Achtung – Gefährliche Spannungen. Befolgen Sie die Anweisungen, um Stromschläge und Verletzungen zu vermeiden. Je nach Netzschaltertyp an Ihrem Gerät kann eines der folgenden Symbole verwendet werden: Ein – Versorgt das System mit Wechselstrom. Aus– Unterbricht die Wechselstromzufuhr zum Gerät. Wartezustand – Der Ein-/Standby-Netzschalter befindet sich in der Standby-Position. Modifikationen des Geräts Nehmen Sie keine elektrischen oder mechanischen Gerätemodifikationen vor. Sun Microsystems ist für die Einhaltung der Sicherheitsvorschriften von modifizierten Sun-Produkten nicht haftbar. Aufstellung von Sun-Geräten Achtung – Geräteöffnungen Ihres SunProdukts dürfen nicht blockiert oder abgedeckt werden. Sun-Geräte sollten niemals in der Nähe von Heizkörpern oder Heißluftklappen aufgestellt werden. Die Nichtbeach-xvi SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 tung dieser Richtlinien kann Überhitzung verursachen und die Zuverlässigkeit Ihres Sun-Geräts beeinträchtigen. Lautstärke Produkt: SPARC T3-1B Server Module Gemäß den Vorgaben in der Norm ISO 7779 beträgt der Geräuschpegel dieses Geräts in Abhängigkeit vom Arbeitsplatz unter 70 db(A). SELV-Konformität Der Sicherheitsstatus der E/A-Verbindungen entspricht den SELV-Anforderungen. Anschluss des Netzkabels Achtung – Sun-Geräte sind für Stromversorgungssysteme mit einem geerdeten neutralen Leiter (geerdeter Rückleiter bei gleichstrombetriebenen Geräten) ausgelegt. Um die Gefahr von Stromschlägen zu vermeiden, schließen Sie das Gerät niemals an andere Stromversorgungssysteme an. Wenden Sie sich an den zuständigen Gebäudeverwalter oder an einen qualifizierten Elektriker, wenn Sie nicht sicher wissen, an welche Art von Stromversorgungssystem Ihr Gebäude angeschlossen ist. Achtung – Nicht alle Netzkabel verfügen über die gleichen Nennwerte. Herkömmliche, im Haushalt verwendete Verlängerungskabel besitzen keinen Überlastschutz und sind daher für Computersysteme nicht geeignet. Verwenden Sie bei Ihrem Sun-Produkt keine Haushalts-Verlängerungskabel. Die folgende Warnung gilt nur für Geräte mit StandbyNetzschalter: Achtung – Beim Netzschalter dieses Geräts handelt es sich nur um einen Ein/StandbySchalter. Zum völligen Abtrennen des Systems von der Stromversorgung dient hauptsächlich das Netzkabel. Stellen Sie sicher, dass das Netzkabel an eine frei zugängliche geerdete Steckdose in der Nähe des Systems angeschlossen ist. Schließen Sie das Stromkabel nicht an, wenn die Stromversorgung vom Systemchassis entfernt wurde. Die folgende Warnung gilt nur für Geräte mit mehreren Netzkabeln: Achtung – Bei Produkten mit mehreren Netzkabeln müssen alle Netzkabel abgetrennt werden, um das System völlig von der Stromversorgung zu trennen. Warnung bezüglich Batterien Achtung – Bei unsachgemäßer Handhabung oder nicht fachgerechtem Austausch der Batterien besteht Explosionsgefahr. Verwenden Sie bei Systemen mit austauschbaren Batterien ausschließlich Ersatzbatterien desselben Typs und Herstellers bzw. einen entsprechenden, vom Hersteller gemäß den Anweisungen im Service-Handbuch des Produkts empfohlenen Batterietyp. Versuchen Sie nicht, die Batterien auszubauen oder außerhalb des Systems wiederaufzuladen. Werfen Sie die Batterien nicht ins Feuer. Entsorgen Sie die Batterien entsprechend den Anweisungen des Herstellers und den vor Ort geltenden Vorschriften. CPU-Karten von Sun verfügen über eine Echtzeituhr mit integrierter Lithiumbatterie. Diese Batterie darf nur von einem qualifizierten Servicetechniker ausgewechselt werden. Sicherheitshinweise zum Energiespeichermodul Achtung – Bei unsachgemäßer Handhabung oder unsachgemäßem Austausch von Energiespeichermodulen besteht die GefahrSafety Agency Compliance Statements xvii eines Stromschlags oder Geräteschadens. Verwenden Sie beim Austausch von Energiespeichermodulen nur Ersatzmodule, die von Sun Microsystems bereitgestellt wurden, und folgen Sie den im Service Manual zum Produkt enthaltenen Anweisungen. Versuchen Sie auf keinen Fall, Module auszubauen oder diese außerhalb des Systems wiederaufzuladen. Entsorgen Sie die Module bitte nicht. Geben Sie sie stattdessen an Sun Microsystems gemäß den SunVerfahren für das Produkt zurück. Gehäuseabdeckung Sie müssen die Abdeckung Ihres Sun-Computersystems entfernen, um Karten, Speicher oder interne Speichergeräte hinzuzufügen. Bringen Sie vor dem Einschalten des Systems die Gehäuseabdeckung wieder an. Achtung – Nehmen Sie Sun-Geräte nicht ohne Abdeckung in Betrieb. Die Nichtbeachtung dieses Warnhinweises kann Verletzungen oder Geräteschaden zur Folge haben. Anweisungen zur Rack-Montage Die folgenden oder ähnlichen Anweisungen zur RackMontage wurden in die Installationsanweisungen aufgenommen: ¦ Erhöhte Betriebsumgebungstemperatur - Wenn das Rack in einer geschlossenen Rack-Baugruppe oder in einer Multi-unit-Rack-Baugruppe installiert ist, kann die Betriebsumgebungstemperatur der RackUmgebung höher sein als die Umgebungstemperatur des Raumes. Deshalb sollte berücksichtigt werden, das Gerät in einer Umgebung zu installieren, die kompatibel zu der vom Hersteller angegebenen maximalen Umgebungstemperatur (Tma) ist. ¦ Reduzierter Luftstrom - Die Installation des Geräts in einem Rack sollte so erfolgen, dass die Luftstrommenge, die für den sicheren Betrieb des Geräts erforderlich ist, nicht beeinträchtigt wird. ¦ Mechanische Belastung - Die Montage des Geräts im Rack sollte so erfolgen, dass bei einer ungleichmäßigen mechanischen Belastung keine gefährliche Betriebsbedingung entstehen kann. ¦ Stromkreisüberlastung - Der Anschluss des Geräts an den Speisestromkreis und die Wirkung, die ein Überlasten der Stromkreise auf das ÜberstromschutzGerät und die Speisestromkreisverkabelung haben kann, sollten sorgfältig geprüft und berücksichtigt werden. Beim Behandeln dieses Aspekts sollten besonders die Lastangaben auf dem Leistungsschild des Geräts sorgfältig geprüft werden. ¦ Zuverlässige Erdung - Ausrüstung, die in Racks montiert ist, muss zuverlässig geerdet sein. Besonders müssen hierbei die Stromanschlussleitungen und weniger die direkten Verbindungen zum Abzweigstromkreis beachtet werden (z. B. durch die Verwendung von Adapterleisten). Achtung – Verwenden Sie Geräte in Steckplätzen bzw. auf Schienen nicht als Regal oder Arbeitsbereich. Warnungen bezüglich in Racks eingebauter Systeme Die folgenden Warnungen gelten für Racks und in Racks eingebaute Systeme: Achtung – Aus Sicherheitsgründen sollten sämtliche Geräte von unten nach oben in Racks eingebaut werden. Installieren Sie also zuerst die Geräte, die an der untersten Position im Rack eingebaut werden, gefolgt von den Systemen, die an nächsthöherer Stelle eingebaut werden, usw. Achtung – Verwenden Sie beim Einbau den Kippschutz am Rack, um ein Umkippen zu vermeiden. Achtung – Um extreme Betriebstemperaturen im Rack zu vermeiden, stellen Sie sicher, dass die Maximaltemperatur die Nennleistung der Umgebungstemperatur für das Produkt nicht überschreitetxviii SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 Achtung – Um extreme Betriebstemperaturen durch verringerte Luftzirkulation zu vermeiden, sollte die für den sicheren Betrieb des Geräts erforderliche Luftzirkulation eingesetzt werden. Hinweis zur Laser-Konformität Sun-Produkte, die die Laser-Technologie verwenden, entsprechen den Laser-Anforderungen der Klasse 1. CD- und DVD-Geräte Die folgende Warnung gilt für CD-, DVD- und andere optische Geräte: Achtung – Die hier nicht aufgeführte Verwendung von Steuerelementen, Anpassungen oder Ausführung von Vorgängen kann eine gefährliche Strahlenbelastung verursachen. Normativas de seguridad Lea esta sección antes de realizar cualquier operación. En ella se explican las medidas de seguridad que debe tomar al instalar un producto de Sun Microsystems. Medidas de seguridad Para su protección, tome las medidas de seguridad siguientes durante la instalación del equipo: ¦ Siga todos los avisos e instrucciones indicados en el equipo. ¦ Asegúrese de que el voltaje y frecuencia de la fuente de alimentación coincidan con el voltaje y frecuencia indicados en la etiqueta de clasificación eléctrica del equipo. ¦ No introduzca objetos de ningún tipo por las rejillas del equipo, ya que puede quedar expuesto a voltajes peligrosos. Los objetos conductores extraños pueden producir cortocircuitos y, en consecuencia, incendios, descargas eléctricas o daños en el equipo. ¦ Este producto se ha concebido para un acceso restringido y, por tanto, éste se controla mediante mecanismos de seguridad (p. ej., acceso con clave, bloqueo, herramienta y tarjeta de identificación). Las personas con acceso autorizado están al corriente de los motivos de esta restricción y de las precauciones que se deben tomar. Símbolos En este documento aparecen los siguientes símbolos: Precaución – Existe el riesgo de que se produzcan lesiones personales y daños en el equipo. Siga las instrucciones. Precaución – Superficie caliente. Evite todo contacto. Las superficies están calientes y pueden causar lesiones personales si se tocan. Precaución – Voltaje peligroso. Para reducir el riesgo de descargas eléctricas y lesiones personales, siga las instrucciones. En función del tipo de interruptor de alimentación del que disponga el dispositivo, se utilizará uno de los símbolos siguientes: Encendido – Suministra alimentación de CA al sistema. Apagado – Corta la alimentación de CA del sistema. Espera – El interruptor de encendido/espera está en la posición de espera.Safety Agency Compliance Statements xix Modificaciones en el equipo No realice modificaciones de tipo mecánico ni eléctrico en el equipo. Sun Microsystems no se hace responsable del cumplimiento de normativas en caso de que un producto Sun se haya modificado. Colocación de un producto Sun Precaución – No obstruya ni tape las rejillas del producto Sun. Nunca coloque un producto Sun cerca de radiadores ni fuentes de calor. Si no sigue estas indicaciones, el producto Sun podría sobrecalentarse y la fiabilidad de su funcionamiento se vería afectada. Nivel de ruido Producto: SPARC T3-1B Server Module En conformidad con la norma ISO 7779, el nivel de emisión de ruido de este producto en el puesto de trabajo es inferior a los 70 db(A). Cumplimiento de la normativa para instalaciones SELV Las condiciones de seguridad de las conexiones de entrada y salida cumplen los requisitos para instalaciones SELV (del inglés Safe Extra Low Voltage, voltaje bajo y seguro). Conexión del cable de alimentación Precaución – Los productos Sun se han diseñado para funcionar con sistemas de alimentación que cuenten con un conductor neutro a tierra (con conexión a tierra de regreso para los productos con alimentación de CC). Para reducir el riesgo de descargas eléctricas, no conecte ningún producto Sun a otro tipo de sistema de alimentación. Póngase en contacto con el encargado de las instalaciones de su empresa o con un electricista cualificado en caso de que no esté seguro del tipo de alimentación del que se dispone en el edificio. Precaución – No todos los cables de alimentación tienen la misma clasificación eléctrica. Los alargadores de uso doméstico no cuentan con protección frente a sobrecargas y no están diseñados para su utilización con sistemas informáticos. No utilice alargadores de uso doméstico con el producto Sun. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de un interruptor de alimentación de espera: Precaución – El interruptor de alimentación de este producto funciona solamente como un dispositivo de espera. El cable de alimentación hace las veces de dispositivo de desconexión principal del sistema. Asegúrese de que conecta el cable de alimentación a una toma de tierra situada cerca del sistema y de fácil acceso. No conecte el cable de alimentación si la unidad de alimentación no se encuentra en el bastidor del sistema. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de varios cables de alimentación: Precaución – En los productos que cuentan con varios cables de alimentación, debe desconectar todos los cables de alimentación para cortar por completo la alimentación eléctrica del sistema. Advertencia sobre las baterías Precaución – Si las baterías no se manipulan o reemplazan correctamente, se corre el riesgo de que estallen. En los sistemas que cuentan con baterías reemplazables, reemplácelas sólo con baterías del mismo fabricante y el mismo tipo, o un tipo equivalente recomendado por el fabricante, de acuerdo con las instruccionesxx SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 descritas en el manual de servicio del producto. No desmonte las baterías ni intente recargarlas fuera del sistema. No intente deshacerse de las baterías echándolas al fuego. Deshágase de las baterías correctamente de acuerdo con las instrucciones del fabricante y las normas locales. Tenga en cuenta que en las placas CPU de Sun, hay una batería de litio incorporada en el reloj en tiempo real. Los usuarios no deben reemplazar este tipo de baterías. Advertencia relativa al módulo de almacenamiento de energía Precaución – Existe un peligro de electrocuciones o daños en el equipo si se manipulan o sustituyen incorrectamente los módulos de almacenamiento de energía. Cuando cambie los módulos de almacenamiento de energía, utilice exclusivamente módulos de sustitución que hayan sido suministrados por Sun Microsystems, de conformidad con las instrucciones indicadas en el manual de servicio del producto. No desmonte módulos ni intente recargarlos fuera del sistema. No elimine los módulos. En su lugar, devuélvalos a Sun Microsystems de conformidad con los procedimientos de Sun para el producto. Cubierta de la unidad del sistema Debe extraer la cubierta de la unidad del sistema informático Sun para instalar tarjetas, memoria o dispositivos de almacenamiento internos. Vuelva a colocar la cubierta antes de encender el sistema informático. Precaución – No ponga en funcionamiento los productos Sun que no tengan colocada la cubierta. De lo contrario, puede sufrir lesiones personales y ocasionar daños en el sistema. Instrucciones para el montaje en armario Las siguientes instrucciones de montaje en armario u otras similares se incluyen en las instrucciones de instalación: ¦ Temperatura de funcionamiento elevada - si se instala en un armario cerrado o con más unidades, la temperatura ambiente de funcionamiento del entorno del armario puede ser superior a la de la habitación. Por tanto, el equipo debería instalarse en un entorno compatible con la temperatura ambiente máxima (Tma) especificada por el fabricante. ¦ Flujo de aire reducido - para instalar el equipo en un armario hay que asegurarse de que se mantendrá el flujo de aire necesario para el correcto funcionamiento del equipo. ¦ Carga mecánica - el montaje del equipo en el armario debería realizarse de modo que no se dé una situación de peligro debido a una carga mecánica irregular. ¦ Sobrecarga del circuito - debe prestarse atención a la conexión del equipo al circuito de alimentación y a las consecuencias que puede tener la sobrecarga de los circuitos en la protección de sobrecorriente y el cableado de alimentación. En caso de sobrecarga, es recomendable tener en cuenta la potencia del equipo que aparece en la placa de identificación. ¦ Puesta a tierra fiable - debería mantenerse una puesta a tierra fiable del equipo montado en un armario. Debería prestarse especial atención a las conexiones de suministro que no sean las directas al circuito derivado (p. ej., las regletas de distribución). Precaución – Los equipos instalados por deslizamiento o sobre raíles no deben utilizarse como estantería o espacio de trabajo. Advertencia sobre el sistema en bastidor Las advertencias siguientes se aplican a los sistemas montados en bastidor y a los propios bastidores. Precaución – Por seguridad, siempre deben montarse los equipos de abajo arriba. A saber, primero debe instalarse el equipo que se situará en el bastidor inferior; a continuación, el que se situará en el siguiente nivel, etc.Safety Agency Compliance Statements xxi Precaución – Para evitar que el bastidor se vuelque durante la instalación del equipo, debe extenderse la barra antivolcado del bastidor. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema en el bastidor, asegúrese de que la temperatura máxima no sea superior a la temperatura ambiente establecida como adecuada para el producto. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema debido a una circulación de aire reducida, debe considerarse la magnitud de la circulación de aire requerida para que el equipo funcione de forma segura. Aviso de cumplimiento de la normativa para la utilización de láser Los productos Sun que utilizan tecnología láser cumplen los requisitos establecidos para los productos láser de clase 1. Dispositivos de CD y DVD La siguiente medida se aplica a los dispositivos de CD y DVD, así como a otros dispositivos ópticos: Precaución – La utilización de controles, ajustes o procedimientos distintos a los aquí especificados puede dar lugar a niveles de radiación peligrosos. Nordic Lithium Battery Cautions Norge Advarsel – Litiumbatteri — Eksplosjonsfare. Ved utskifting benyttes kun batteri som anbefalt av apparatfabrikanten. Brukt batteri returneres apparatleverandøren. Sverige Varning – Explosionsfara vid felaktigt batteribyte. Använd samma batterityp eller en ekvivalent typ som rekommenderas av apparattillverkaren. Kassera använt batteri enligt fabrikantens instruktion. Danmark Advarsel! – Litiumbatteri — Eksplosionsfare ved fejlagtig håndtering. Udskiftning må kun ske med batteri af samme fabrikat og type. Levér det brugte batteri tilbage til leverandøren. Suomi Varoitus – Paristo voi räjähtää, jos se on virheellisesti asennettu. Vaihda paristo ainoastaan laitevalmistajan suosittelemaan tyyppiin. Hävitä käytetty paristo valmistajan ohjeiden mukaisesti. Nordic Power Distribution Cautions English Caution – This product is also designed for an IT power distribution system with phase-tophase voltage of 230V.xxii SPARC T3-1B Server Module Safety and Compliance Manual • November 2010 Danmark Advarsel! – Dette produkt er også beregnet til et IT-strømfordelingssystem med en fase-tilfase spænding på 230 V. Nordic Grounded Socket Cautions English Caution – The appliance must be connected to a grounded socket. Norge Advarsel – Apparatet må tilkoples jordet stikkontakt. Sverige Varning – Apparaten skall anslutas till jordat uttag. Suomi Varoitus – Laite on liitettävä suojamaadoituskoskettimilla varustettuun pistorasiaan. SPARC T3 Series Servers Program Documentation Third Party Licenses and Notices Part No.: E25077-01, September 2011Copyright © 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. UNIX est une marque déposée d’The Open Group. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents 1. Third Party Technology Notices and Licenses 1 Third Party Technology 1 Third Party Notices and Licenses 2iv SPARC T3 Series Servers Program Documentation Third Party Licenses and Notices • August 20111 C H A P T E R 1 Third Party Technology Notices and Licenses This chapter contains the following: ¦ “Third Party Technology” on page 1 ¦ “Third Party Notices and Licenses” on page 2 Third Party Technology The following third party technology may be included in or distributed with this product. The notices provided below in “Third Party Notices and Licenses” on page 2 are based on information made available to Oracle by the third party licensors listed. Some software is expressly licensed only under the license terms indicated. Such software is licensed separately and not under the terms of the Oracle license. Additionally, software whose license terms require separate licensing of the software under open source terms, including without limitation the GPL, the LGPL and the Mozilla license, will be understood to be separately licensed under the relevant open source license and not under the terms of the Oracle license. ¦ “Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software” on page 2 ¦ “Preboot Execution Environment (PXE)” on page 22 SPARC T3 Series Servers Program Documentation Third Party Licenses and Notices • August 2011 Third Party Notices and Licenses Intel 1 GbE and 10 GbE Controller Device Drivers and Utility Software Use of any of this software is governed by the terms of the license below: The software and all copies shall remain the property of Intel. Intel retains the right to use, copy, modify, sublicense, and distribute the software. Marking requirement – US Government sales. All copies of Object Code distributed directly or indirectly to the US government are governed by a legend substantially similar to the following: The enclosed software products and documentation were developed at private expense, and are provided with “RESTRICTED RIGHTS”. Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et seq. or its successor. The use of this product by the government constitutes an acknowledgment of Intel’s proprietary rights in the product. If you are acquiring this software on behalf of the U.S. government, the Government shall have only “Restricted Rights” in the software and related documentation as defined in the Federal Acquisition Regulations (FARs) in Clause 52.227.19 (c) (2). If you are acquiring the software on behalf of the Department of Defense, the software shall be classified as “Commercial Computer Software” and the Government shall have only “Restricted Rights” as defined in Clause 252.227- 7013 (c) (1) of DFARs. Notwithstanding the foregoing, the authors grant the U.S. Government and others acting in its behalf permission to use and distribute the software in accordance with the terms specified in this license. Preboot Execution Environment (PXE) The enclosed software products and documentation were developed at private expense, and are provided with “Restricted Rights.” Use, duplication or disclosure by the government is subject to restrictions as set forth in FAR 52.227-14 and DFARS 252.227-7013 et. seq. or its successor. The use of this product by the government constitutes acknowledgment of Intel’s proprietary rights in the product. Serveur SPARC T3-2 Notes de produit N° de référence : 821-2892-12 Décembre 2010, révision AProduit recyclable Copyright © 2010, Oracle et/ou ses sociétés af?liées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des États-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. En tant que tels, leurs utilisation, duplication, divulgation, modi?cation et adaptation doivent être soumises aux restrictions et conditions de licence énoncées dans le contrat du Gouvernement applicable et, dans la mesure autorisée par ce contrat du Gouvernement, aux droits supplémentaires énoncés dans le FAR 52.227-19, Commercial Computer Software License (décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, États-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés af?liées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.1 Notes de produit du serveur SPARC T3-2 Ce document contient les rubriques suivantes et des informations de dernière minute concernant le serveur SPARC T3-2 d’Oracle : ¦ « Logiciels préinstallés pour les configurations standard », page 2 ¦ « Versions du SE Oracle Solaris prises en charge », page 2 ¦ « Patch obligatoire du microprogramme système », page 3 ¦ « Informations sur les patchs », page 4 ¦ « Shell de compatibilité ALOM CMT non pris en charge », page 4 ¦ « Problèmes connus concernant le produit », page 52 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Logiciels préinstallés pour les configurations standard Le tableau suivant dresse la liste des logiciels préinstallés sur le serveur. Les patchs requis au moment où le serveur était prêt à être expédié ont été installés en usine. Pour des informations récentes sur tous les patchs, y compris ceux destinés aux logiciels préinstallés, rendez-vous sur le site Web My Oracle Support : https://support.oracle.com/ Remarque – Le SE Oracle Solaris préinstallé est stocké sur un système de fichiers ZFS. Versions du SE Oracle Solaris prises en charge Une copie du SE Oracle Solaris 10 9/10 est préinstallée sur le premier disque du serveur. Le SE est prêt à être configuré au moment opportun lors de la mise sous tension initiale du serveur. Le serveur prend en charge les versions suivantes du SE Oracle Solaris : ¦ SE Oracle Solaris 10 10/09 avec le bundle de patchs Oracle Solaris 10 9/10 ou les bundles compatibles avec les futures versions ¦ SE Oracle Solaris 10 9/10 (préinstallé sur le serveur) Logiciel Emplacement Fonction SE Oracle Solaris 10 9/10 Tranche 0 du disque root (et tranche 3 pour un ABE) Système d’exploitation Oracle VM Server pour SPARC 2.0 /opt/SUNWldm Gestion des domaines logiques Electronic Prognostics 1.1 /opt/ep Génération d’avertissements précoces concernant des pannes de FRU potentielles.Notes de produit du serveur SPARC T3-2 3 Pour des informations récentes sur les patchs du serveur, les composants optionnels et les logiciels, rendez-vous sur le site Web Oracle Support : https://support.oracle.com/ Remarque – Dans le cadre de l’utilisation du logiciel Oracle VM Server, les domaines control et guest prennent tous deux en charge ces versions minimales du SE Oracle Solaris. Pour obtenir des instructions d’installation et de configuration d’Oracle Solaris, reportez-vous à la documentation livrée avec le système d’exploitation. Patch obligatoire du microprogramme système Les premiers serveurs SPARC T3-2 ont été livrés avec un microprogramme système qui réglait la vitesse des ventilateurs des alimentations à un niveau qui ne refroidissait pas suffisamment les alimentations et les disques situés à l’avant. La version 8.0.1.e du microprogramme système règle la vitesse des ventilateurs sur le niveau approprié. Pour afficher la version du microprogramme de votre système, tapez la commande suivante à l’invite d’ILOM (->) : Attention – Si le numéro de révision du microprogramme de votre système est inférieur à 8.0.1.e, vous devez installer la dernière version compatible du patch 145667-02. Vous pouvez télécharger la dernière version du patch 145667-02 à partir du site Web SunSolve suivant : http://sunsolve.sun.com Vous pouvez également utiliser le site Web My Oracle Support : https://support.oracle.com/ -> show /HOST sysfw_version /HOST Properties: sysfw_version = Sun System Firmware 8.0.1.e 2010/11/23 16:424 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Pour obtenir des instructions d’installation, reportez-vous au Guide d’administration des serveurs de la série SPARC T3, ainsi qu’à toute documentation fournie avec le patch. Informations sur les patchs Tous les patchs obligatoires sont installés en usine. Si vous réinstallez le SE Oracle Solaris sur le serveur, vous devez impérativement installer les patchs requis pour le SE, le serveur et tous les composants matériels et logiciels optionnels installés. Au moment de la publication de ce document, le serveur nécessitait les patchs du SE Oracle Solaris 10 9/10 suivants. Si vous réinstallez le SE Oracle Solaris 10 9/10, vous devez installer les dernières versions compatibles de ces patchs. ¦ 143647-08 ¦ 144567-01 ¦ 145098-02 ¦ 145868-01 Pour télécharger la dernière version de ces patchs et obtenir la liste à jour des patchs obligatoires, rendez-vous sur le site Web My Oracle Support : https://support.oracle.com/ Remarque – Pour des informations actualisées sur les patchs obligatoires et les mises à jour des composants matériels et logiciels optionnels, consultez la documentation des produits concernés. Shell de compatibilité ALOM CMT non pris en charge Le serveur SPARC T3-2 ne prend pas en charge le shell de compatibilité de ligne de commande ALOM (Advanced Lights Out Manager) CMT (cli_mode=alom), disponible sur les plates-formes antérieures. Pour plus d’informations sur les fonctions Oracle ILOM (Integrated Lights Out Manager) prises en charge, reportez-vous au Guide d’administration des serveurs de la série SPARC T3.Notes de produit du serveur SPARC T3-2 5 Problèmes connus concernant le produit Cette section décrit les problèmes connus ayant un impact sur le serveur SPARC T3-2 d’Oracle. Les problèmes sont décrits de la manière suivante : ¦ « Problèmes liés au matériel », page 5 ¦ « Problèmes liés au système d’exploitation Oracle Solaris », page 13 ¦ « Problèmes liés au microprogramme », page 28 ¦ « Erreurs identifiées dans la documentation », page 32 Problèmes liés au matériel Cette section décrit les problèmes connus relatifs au matériel. Non-activation de la DEL bleue Prêt pour le retrait après une préparation au retrait à l’aide de l’application MegaRAID Storage Manager (CR 6929361) Lorsque vous utilisez le logiciel MegaRAID Storage Manager (MSM) afin de préparer le retrait d’une unité, MSM signale que l’unité est prête pour le retrait, mais la DEL bleue correspondante ne s’allume parfois qu’un bref moment, voire pas du tout. Solution : Lorsque le logiciel MSM vous a informé que l’unité est prête à être retirée, vous pouvez procéder au retrait sans crainte. Si vous devez localiser l’unité sélectionnée, servez-vous de la fonction de localisation de MSM, de l’utilitaire de ligne de commande MegaCLI ou encore de l’utilitaire de configuration WebBIOS. Pour plus d’informations, consultez la documentation du logiciel MSM.6 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Échec de la détection du HBA RAID PCIe SAS 6 Gb Sun Storage interne par MegaRAID Storage Manager (CR 6971789) Le logiciel MegaRAID Storage Manager (MSM) n’est pas en mesure de détecter, de configurer ou de contrôler un HBA RAID PCIe SAS 6 Gb Sun Storage interne. Solution : Pour détecter, configurer et contrôler le HBA RAID PCIe SAS 6 Gb Sun Storage interne, faites appel à l’utilitaire de ligne de commande MegaCLI. Lecteur de DVD désactivé suite à l’installation du HBA RAID PCIe SAS 6 Gb Sun Storage interne Après l’installation d’un HBA RAID PCIe SAS 6 Gb Sun Storage interne dans un serveur, vous ne pourrez plus utiliser le lecteur DVD du panneau avant. Dans le serveur SPARC T3-2, vous pouvez connecter jusqu’à six unités et le lecteur de DVD optionnel au même backplane d’unités de disque dur. Deux câbles internes permettent de connecter le backplane d’unités de disque dur à la carte mère. Lors de l’installation du HBA RAID PCIe SAS 6 Gb Sun Storage interne, vous devez utiliser les mêmes câbles pour connecter les ports du HBA au backplane d’unités de disque dur. (À des fins de compatibilité RAID 5, assurez-vous que les deux câbles sont connectés.) Le HBA ne fournit pas les signaux de données SATA requis par le lecteur de DVD du panneau avant. C’est pourquoi vous ne pouvez plus utiliser le lecteur de DVD. Solution : Pour accéder à un lecteur de DVD après avoir installé le HBA RAID PCIe SAS 6 Gb Sun Storage : ¦ Connectez un lecteur de DVD USB externe à l’un des quatre ports USB du serveur. ¦ Contrôlez à distance le lecteur de DVD connecté en réseau à l’aide d’ILOM Remote Console. ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques clavier, vidéo, souris et stockage (KVMS, keyboard, video, mouse, and storage) d’un serveur hôte. Pour des instructions d’utilisation d’ILOM Remote Console, reportez-vous au document Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (réf. 821-6411-xx).Notes de produit du serveur SPARC T3-2 7 Installation obligatoire du HBA RAID PCIe SAS 6 Gb Sun Storage interne dans l’emplacement PCIe2 0 (CR 6982358) Si vous planifiez d’installer le HBA RAID PCIe SAS 6 Gb Sun Storage interne dans le serveur, vous devez installer la carte dans l’emplacement PCIe2 0 (il s’agit de l’emplacement le plus proche des alimentations). L’installation de cette carte dans tout autre emplacement PCIe2 n’est pas prise en charge. Connectez la carte PCIe au backplane d’unités au moyen des câbles existants du serveur. Déconnectez les deux câbles SAS de la carte mère (les ports étiquetés DISK0-3 et DISK4-7) et reliez-les aux ports du HBA RAID PCIe SAS 6 Gb Sun Storage interne. Remarque – L’installation d’un HBA RAID PCIe SAS 6 Gb Sun Storage interne dans le système entraîne la désactivation de l’unité DVD+/-RW SATA du panneau avant. Baisse des performances TCP RX des cartes PCIe SFP+ 10 Gb 4 ports Sun Dual (CR 6943558) Une perte excessive de paquets a été observée suite à l’utilisation d’au moins trois ports par plusieurs cartes PCIe SFP+ 10 Gb Sun Dual. De ce fait, les performances de transmission et de réception ont été considérablement dégradées. Lorsque deux ports seulement sont utilisés, la perte de paquets est minime et les performances d’émission et de réception sont conformes aux attentes. Solution : Pour activer le contrôle de flux des interfaces, suivez l’une des procédures ci-dessous. Vous pourrez ainsi considérablement réduire la perte de paquets observée et augmenter les performances. ? Pour activer le contrôle de flux (avec redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf suivant : 2. Redémarrez le système afin d’appliquer les modifications apportées au pilote. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;8 Notes de produit du serveur SPARC T3-2 • Décembre 2010 ? Pour activer le contrôle de flux (sans redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf suivant : 2. Démontez toutes les interfaces ixgbe. 3. Tapez la commande update_drv ixgbe : 4. Montez toutes les interfaces ixgbe. PARALLEL_BOOT/HOST_LAST_POWER_STATE=enabled en échec, état de marche inattendu (arrêt) après un cycle de CA(CR 6994047) Lorsque le paramètre HOST_LAST_POWER_STATE est défini sur enabled puis que le système est mis progressivement sous tension CA, l’hôte est quelquefois affiché comme étant OFF (ÉTEINT) au terme de l’opération de mise sous tension. Ces informations de statut peuvent être erronées. Méthode de récupération : Remettez progressivement sous tension le système afin d’effacer les informations de statut erronées. Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) Lorsque vous tentez d’initialiser une clé USB (unité flash USB portable) insérée dans l’un des ports USB avant (USB2 ou USB3), le serveur génère une erreur grave et ne parvient pas à s’initialiser. Solution : Utilisez les ports USB arrière du serveur (USB0 ou USB1) pour démarrer à partir d’une clé USB externe. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; # update_drv ixgbeNotes de produit du serveur SPARC T3-2 9 Câbles QSFP en cuivre non pris en charge (CR 6941888) Le module réseau 10 Gb du serveur SPARC T3-2 ne prend pas en charge les câbles QSFP en cuivre. Le module réseau est uniquement compatible avec les câbles et modules de transcepteurs QSFP optiques. Blocage possible des opérations de DR lors du retrait de mémoire suite au montage de plusieurs modules réseau 10 Gb (CR 6983286) Le montage de plusieurs modules réseau 10 Gb pour serveur SPARC T3-2 dans un domaine crée une condition dans le noyau Oracle Solaris qui peut entraîner le blocage d’une opération de reconfiguration dynamique (DR) lors du retrait de mémoire du domaine. Solution : Si vous projetez d’exécuter des opérations de DR suite au retrait de mémoire, ne montez pas plus d’un seul module réseau 10 Gb pour serveur SPARC T3-2. Méthode de récupération : En cas de blocage d’une opération de DR, réinitialisez le domaine afin de résoudre le problème. Impossible de lancer deux commandes probe-scsiall consécutives sur des systèmes équipés de HBA PCIe FC 8 Gb Sun StorageTek (CR 6983959) Sur les systèmes équipés d’un ou de plusieurs HBA Emulex PCIe FC 8 Gb Sun StorageTek, il est impossible d’exécuter plus d’une fois la commande probescsi-all de l’OpenBoot PROM (OBP). Vous devez réinitialiser le système à l’aide de la commande reset d’OBP avant de pouvoir réexécuter la commande probescsi-all.10 Notes de produit du serveur SPARC T3-2 • Décembre 2010 La première exécution de la commande probe-scsi-all se déroule normalement. Si la commande est à nouveau émise avant que le système ne soit réinitialisé à l’aide de la commande reset d’OBP, la seconde exécution de probe-scsi-all se solde par un échec, accompagné d’un message d’erreur similaire à l’exemple suivant : Solution : Réinitialisez le système à l’aide de la commande reset d’OBP entre les deux exécutions de probe-scsi-all. Erreurs lors de l’initialisation initiale suite à l’installation de plusieurs cartes PCIe F20 Sun Flash Accelerator (CR 6988352) Si vous installez plusieurs cartes PCIe F20 Sun Flash Accelerator sur le serveur, ce dernier affichera les messages d’erreur suivants lors de sa première initialisation : Vous pouvez ignorer ces messages d’erreur en toute sécurité. Solution : Il vous suffit de redémarrer une nouvelle fois le serveur pour faire disparaître ces messages d’erreur. FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00ab4403c SASAddress 5000cca00ab4403d PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00ab2551c SASAddress 5000cca00ab2551d PhyNum 1 [...] /pci@600/pci@2/pci@0/pci@5/pci@0/pci@3/SUNW,emlxs@0,1 Cannot Init Link. /pci@600/pci@2/pci@0/pci@5/pci@0/pci@3/SUNW,emlxs@0 Cannot Init Link. [...] Cannot initialize port. READ_LA Failed. date machinename scsi: [ID 243001 kern.info] smp: smp_do_attach: failed to allocate softstate, device unit-address @w508002000000377f date machinename scsi: [ID 243001 kern.info] smp: smp_attach(), device unit-address @w508002000000377f failed date machinename scsi: [ID 243001 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@0/LSILogic,sas@0 (mpt2): date machinename failed to configure smp w508002000000377fNotes de produit du serveur SPARC T3-2 11 Messages d’erreur non conservés après des erreurs de mémoire incorrigibles et corrigibles (CR 6990058) Si la mémoire du serveur rencontre une erreur incorrigible suivie d’une erreur corrigible, les messages d’erreur corrects ne sont ni générés ni conservés par le processeur de service. Vous ne pourrez donc pas diagnostiquer le problème de mémoire. Solution : Redémarrez le système. Si les problèmes de mémoire persistent, renseignez-vous auprès de votre représentant services. Remplacement rapide conseillé des modules DIMM défectueux présentant des erreurs incorrigibles (CR 6996144) Si un module DIMM présente une erreur incorrigible, le serveur générera une erreur de type fault.memory.bank, qui signale un module DIMM défectueux. Vous pouvez afficher cette erreur à l’aide de la commande show faulty ou fmdump -v d’Oracle ILOM. Si un module DIMM du système contient une erreur incorrigible persistante (c.-à-d., qui se produit constamment, même après plusieurs redémarrages), remplacez-le dès que possible afin d’éviter toute indisponibilité du serveur. Solution : Au lieu de planifier une période d’indisponibilité en vue de remplacer les modules DIMM défectueux, procédez au remplacement le plus tôt possible. Contactez votre représentant services pour obtenir de l’aide.12 Notes de produit du serveur SPARC T3-2 • Décembre 2010 ereport signale de manière erronée une erreur de carte mère au lieu d’une erreur de carte mémoire riser (CR 6996218) Si un serveur est équipé d’une carte mémoire riser défectueuse, il peut générer les deux événements de rapport d’erreur (ereports) suivants : ereport.cpu.generic-sparc.membuf-other-uc suivi de ereport.cpu.generic-sparc.membuf-crc-failover. Le rapport d’erreur résultant indique de manière erronée que le problème est lié à la carte mère (/SYS/MB) au lieu de la carte mémoire riser (/SYS/MB/CMPn/MCUn). Exemple : Solution : Si vous recevez une erreur /SYS/MB de catégorie fault.memory.memlink-uc, le problème provient en réalité des cartes mémoire riser et non de la carte mère. Si une erreur vous signale qu’il est nécessaire de remplacer votre carte mère, vérifiez d’abord que les cartes mémoire riser fonctionnent correctement. La commande fmdump -eV vous permet de vérifier les ererports afin de détecter un éventuel problème de carte mémoire riser. Recherchez les messages hc-name = memorybuffer et hc-id = 4 dans les ereports. Contactez votre représentant services pour obtenir de l’aide. Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------ 2010-10-21/19:11:37 cc5085f6-eac8-e4a0-cbfe-ac2ca9612096 SUN4V-8002-Q2 Critical Fault class : fault.memory.memlink-uc FRU : /SYS/MB (Part Number: 541-4295-03) (Serial Number: 1005LCB-1036TB00FA) Description : A fault has been diagnosed by the Host Operating System. Response : The service required LED on the chassis and on the affected FRU may be illuminated. Impact : No SP impact. Check the Host OS for more information. Action : The administrator should review the fault on the Host OS. Please refer to the Details section of the Knowledge Article for additional information.Notes de produit du serveur SPARC T3-2 13 create-raid10-volume : échec de la création d’un volume RAID 10 sur un HBA PCIe SASA 6 Gb Sun Storage (CR 6943131) Le HBA PCIe SASA 6 Gb Sun Storage prend en charge les niveaux RAID 0, 1 et 10. Lorsque vous tentez de créer un volume RAID 10, la commande create-raid10- volume de l’OpenBoot PROM (OBP) aboutit à un échec. Dans l’environnement OBP, aucune commande ne vous permet de créer de volume RAID 10. Cependant, la commande create-raid1e-volume vous offre la possibilité de créer un volume RAID 1E. Une fois que vous avez exécuté cette commande pour créer un volume, l’utilitaire SAS2IRCU affiche ce volume en tant que volume de type RAID 10. Solution : Pour créer un volume RAID 10 dans l’environnement OBP, utilisez la commande create-raid1e-volume. Problèmes liés au système d’exploitation Oracle Solaris Cette section décrit les problèmes liés au SE Oracle Solaris observés dans cette version. Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris Le SE Oracle Solaris utilise à présent l’ID universel SAS 2.0 (WWID, World Wide ID) au lieu du champ tn (ID cible) dans les noms de périphériques logiques. Ce changement a un impact sur la méthode d’identification du disque cible lors du téléchargement du SE via le réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement : ¦ Lors du téléchargement du SE via un réseau, vous devriez spécifier le disque inséré dans l’emplacement de disque dur (HDD) 0 comme destination. Il s’agit du disque que OBP utilise comme périphérique d’initialisation par défaut. ¦ Avant le passage aux noms WWID, ce disque aurait été reconnu par le SE d’après son nom logique c0t0d0. ¦ Depuis ce changement, l’identificateur de périphérique du périphérique d’initialisation par défaut est désigné sous le nom c0tWWIDd0, où WWID correspond à une valeur hexadécimale. Or, cette valeur WWID n’est pas mappée de manière prévisible à l’ID physique du disque situé dans l’emplacement de disque dur HDD 0.14 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Remarque – Par défaut, le SE Oracle Solaris est installé sur le disque inséré dans l’emplacement de disque dur HDD 0. Si vous souhaitez l’installer ailleurs, spécifiez le numéro d’emplacement du disque voulu. Pour spécifier de manière fiable l’emplacement HDD 0 dans le cadre de l’opération de téléchargement du SE, vous devez déterminer la correspondance entre la valeur WWID de ce disque et son emplacement physique. Pour ce faire, exécutez probescsi-all et consultez la sortie de la commande. Dans la sortie de probe-scsi-all, recherchez les identificateurs de disque suivants : ¦ SASDeviceName : il s’agit du WWID de disque reconnu par le SE Oracle Solaris. ¦ SASAddress : il s’agit du WWID de disque auquel OBP fait référence. ¦ PhyNum : il s’agit de l’emplacement de disque dur (HDD) physique occupé par le disque. Il est également exprimé sous forme de valeur hexadécimale. ¦ VolumeDeviceName : ce numéro correspond au WWID du volume RAID reconnu par le SE Oracle Solaris. ¦ VolumeWWID : il s’agit du WWID du volume RAID auquel OBP fait référence. Un serveur SPARC T3-2 est équipé d’un contrôleur SAS intégré, lequel vérifie les six unités connectées. La sortie de l’exemple de commande probe-scsi-all suivante s’applique à un serveur SPARC T3-2 équipé de six unités. Remarque – Dans la sortie de l’exemple de commande probe-scsi-all, le disque installé dans l’emplacement HDD 0 est doté d’une valeur PhyNum égale à 0, d’une valeur SASDeviceName égale à 5000c5001cb4a637 et d’un nombre de cibles égal à 9. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@e/scsi@0 <---- SAS Controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target cNotes de produit du serveur SPARC T3-2 15 La sortie d’exemple de commande probe-scsi-all illustre une con?guration RAID. La valeur VolumeDeviceName du volume RAID est égale à 3ce534e42c02a3c0. Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7dfde0 SASAddress 5000cca00a7dfde1 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7e1a18 SASAddress 5000cca00a7e1a19 PhyNum 5 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@e/scsi@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.0016 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Exemples d’Oracle Solaris Jumpstart L’exemple de pro?l Oracle Solaris Jumpstart suivant illustre l’utilisation de la syntaxe WWID dans le cadre de l’installation du SE sur une unité de disque précise. Le nom de périphérique SAS SASDeviceName provient de la précédente con?guration à six unités de disque. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques dans le WWID. L’exemple de profil Oracle Solaris Jumpstart suivant illustre l’utilisation de la syntaxe WWID dans le cadre de l’installation du SE sur un volume RAID. La valeur VolumeDeviceName provient de l’exemple probe-scsi-all RAID précédent. # install_type flash_install boot_device c0t5000C5001CB4A637d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap # install_type flash_install boot_device c0t3CE534E42C02A3C0d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapNotes de produit du serveur SPARC T3-2 17 Exemple d’installation interactive Dans une installation interactive, un message vous invite à spécifier un ou plusieurs disques comme cibles de l’installation du SE. Cette étape a pour objectif de s’assurer que l’installation dispose de suffisamment d’espace disque. Dans le cadre de cette étape, spécifiez le disque dont la valeur WWID correspond à l’unité de disque sur laquelle vous souhaitez installer le logiciel. Ces valeurs WWID sont illustrées dans l’exemple interactif suivant, qui repose sur le même environnement à six unités de disque que celui utilisé dans les exemples précédents. L’unité de disque sélectionnée comme cible d’installation se trouve à l’emplacement HDD 0, l’emplacement OBP par défaut. Remarque – Si vous préférez utiliser un autre disque, vous pouvez le définir à la place de l’emplacement HDD 0. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000C5001CB477CBd0 286090 MB [ ] c0t5000C5001CB47F7Fd0 286090 MB [ ] c0t5000C5001CB47F93d0 286090 MB [X] c0t5000C5001CB4A637d0 286090 MB (F4 to edit) [ ] c0t5000CCA00A7DFDE0d0 286090 MB [ ] c0t5000CCA00A7E1A18d0 286090 MB Total Selected: 286090 MB Suggested Minimum: 5032 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_Help18 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Erreurs incorrigibles multiples pouvant entraîner une erreur grave bad kernel MMU inattendue (CR 6947664) Si le serveur génère plusieurs erreurs incorrigibles, il risque de se bloquer en générant une erreur grave de type bad kernel MMU miss. Solution : Installez la version compatible la plus récente du patch 144488-04. Vous pouvez télécharger ce patch à partir du site Web My Oracle Support à l’adresse : https://support.oracle.com/ Si les problèmes persistent sur le système malgré l’installation de ce patch, contactez votre représentant services. Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 (CR 6995458) Si vous avez installé le bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 sur le serveur, le pilote 10/1 Gigabit Ethernet (nxge) ne pourra pas être connecté aux périphériques 10 GbE. Solution : Insérez la ligne suivante dans le fichier /etc/driver_aliases : nxge "SUNW,niusl-kt" Redémarrez ensuite le serveur et configurez normalement les périphériques Gigabit Ethernet. Impossible de démarrer le DVD du SE Oracle Solaris 10 10/09 à partir du lecteur de DVD interne Il n’est pas possible de démarrer un DVD d’Oracle Solaris 10 10/09 à partir du lecteur de DVD interne. Solution : Pour démarrer le DVD d’Oracle Solaris 10 10/09, servez-vous d’un lecteur de DVD externe connecté à l’un des ports arrière du serveur. Vous pouvez également utiliser ILOM Remote Console afin de démarrer à distance un lecteur DVD ou une image ISO connecté(e) au réseau. Pour des instructions d’utilisation d’ILOM Remote Console, reportez-vous au document Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (réf. 821-6411-xx).Notes de produit du serveur SPARC T3-2 19 fault.memory.memlink-uc : erreur d’interconnexion n’ayant pas causé d’erreur grave contrairement à ce qui est affirmé dans un article de la base de connaissances (CR 6940599) Lorsqu’une erreur d’interconnexion de type fault.memory.memlink-uc est détectée, le système devrait s’arrêter afin de protéger l’intégrité de la mémoire. De manière intermittente, cette panne a été signalée lors d’opérations d’initialisation sans que le système ne s’arrête. Même s’il est possible que ce comportement irrégulier indique la récupération effective du système suite à l’erreur de liaison de mémoire, et la restauration d’un état d’initialisation normal, la mesure la plus sûre à prendre consiste à effectuer une séquence de mise hors/sous tension. Méthode de récupération : Remettez progressivement sous tension le système. prtpicl : informations sur les unités non affichées par la commande (CR 6963594) Sur les systèmes antérieurs, la commande prtpicl -v affichait l’état, l’emplacement et le chemin d’accès aux périphériques des unités système sous l’en-tête disk_discovery. Sur les systèmes SPARC T3, la commande prtpicl ne présente plus ces informations sur les unités.20 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) Le système miniroot est un système de fichiers root initialisable comprenant la version minimale du SE Oracle Solaris requise pour démarrer le serveur et configurer le système d’exploitation. Le système miniroot s’exécute uniquement lors du processus d’installation. Lorsque le serveur démarre le système miniroot pour la configuration initiale, les messages suivants peuvent s’afficher sur la console système : Le messages indique que le serveur Xsun sous le système miniroot Oracle Solaris ne parvient pas à détecter un pilote pris en charge par le périphérique graphique AST dans le processeur de service. Ces messages sont attendus, car le système miniroot contient uniquement l’environnement Xsun alors que le tampon de mémoire AST (astfb) est uniquement pris en charge par l’environnement Xorg. L’environnement Xorg est inclus dans le système installé. Par conséquent, le périphérique graphique peut être utilisé lors de l’exécution du SE Oracle Solaris installé. Solution : Vous pouvez ignorer ce message en toute sécurité. Message d’interruption parasite affiché sur la console système (CR 6963563) Au cours du fonctionnement normal du serveur et lors de l’exécution du programme de test système Oracle VTS, la console système peut afficher le message suivant : Solution : Vous pouvez ignorer ce message en toute sécurité. Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error. date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info]Notes de produit du serveur SPARC T3-2 21 Événement de rapport d’erreur (ereport) de SP indisponible non généré pour un processeur de service endommagé (CR 6978171) L’événement de rapport d’erreur (ereport) suivant est généré lorsque le processeur de service fonctionne dans un état endommagé (ereport.fm.fmd.module) : Un processeur de service endommagé devrait également générer l’ereport suivant, mais ce n’est pas le cas pour l’instant : ereport.chassis.sp.unavailable Pour afficher les événements ereport, exécutez la commande fmdump -eV. Pour des instructions, reportez-vous à la page de manuel fmdump(1M). Aug 18 2010 08:47:32.905536867 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = sun4v server-id = wgs94-63 (end authority) mod-name = etm mod-version = 1.2 (end detector) ena = 0x2653413e3403001 msg = error: bad conn open during ver negot: errno 5 __ttl = 0x1 __tod = 0x4c6bd664 0x35f9656322 Notes de produit du serveur SPARC T3-2 • Décembre 2010 e1000g : pilote générant des ereports lors de l’installation du SE Oracle Solaris sur un adaptateur Sun PCIe Dual Gigabit Ethernet (CR 6958011) Lors de l’installation du SE Oracle Solaris sur des domaines contrôlés au moyen d’adaptateurs Sun PCIe Dual Gigabit Ethernet (UTP ou MMF), le pilote Gigabit Ethernet e1000g génère des événements de rapport d’erreur (ereports) sur les domaines SDIO (Static Direct Input/Output) et principaux. Examinez la sortie suivante pour un exemple d’ereport : Le pilote e1000g génère également les ereports ereport.io.pci.sec-sta et ereport.io.pciex.tl.ur. Solution : Vous pouvez ignorer ces ereports en toute sécurité et poursuivre l’installation du SE Oracle Solaris sur le domaine SDIO. Jun 01 2010 15:35:26.512234400 ereport.io.pciex.tl.ca nvlist version: 0 ena = 0x298a9f62243802 detector = (embedded nvlist) nvlist version: 0 scheme = dev device-path = /pci@400/pci@1 (end detector) class = ereport.io.pciex.tl.ca dev-status = 0x2 ue-status = 0x8000 ue-severity = 0x62030 adv-ctl = 0xf source-id = 0x600 source-valid = 1 __ttl = 0x1 __tod = 0x4c058b2e 0x1e8813a0Notes de produit du serveur SPARC T3-2 23 Impossible de connecter les périphériques Ethernet internes après la reconfiguration d’une CPU défectueuse sur l’hôte (CR 6984323) Lorsque vous redémarrez le serveur suite à une reconfiguration de CPU défectueuse ou désactivée sur l’hôte, les connexions Gigabit Ethernet internes ne sont pas rétablies avec le réseau. Les exemples de messages suivants s’affichent alors sur la console système : Solution : Redémarrez le serveur à deux autres reprises. Si le problème persiste, renseignezvous auprès de votre représentant services. Mise à niveau du matériel serveur pouvant entraîner la création d’instances de périphériques incorrectes (CR 6974219) Si vous ajoutez des composants matériels à un système entièrement configuré, les noms des périphériques (instances) peuvent ne pas être associés correctement aux composants matériels correspondants. Ce problème empêche alors le système de fonctionner normalement. Solution : Redémarrez deux fois le serveur. Si le problème persiste, renseignez-vous auprès de votre représentant services. igb0: DL_ATTACH_REQ failed: DL_SYSERR (errno 22) igb0: DL_BIND_REQ failed: DL_OUTSTATE igb0: DL_PHYS_ADDR_REQ failed: DL_OUTSTATE igb0: DL_UNBIND_REQ failed: DL_OUTSTATE Failed to plumb IPv4 interface(s): igb024 Notes de produit du serveur SPARC T3-2 • Décembre 2010 hostconfig : échec de la commande à mettre à jour le numéro de série CPU dans le descripteur machine de l’inventaire des ressources physiques (PRI MD) (CR 6989166) En cas de problème de thread CPU, l’enregistrement correspondant est conservé lors du redémarrage du système, même si l’origine du problème a été résolue. La présence de cet enregistrement entraîne la mise hors ligne du thread CPU lors du redémarrage du système. Méthode de récupération : Activez de manière explicite le ou les threads posant problème. Messages d’avertissement nxge erronés (CR 6938085) Au cours du fonctionnement normal de votre serveur, des messages d’avertissement tels que le suivant peuvent s’afficher sur la console système : Ces messages ne sont pas de véritables messages d’avertissement. Ces messages relatifs au pilote Gigabit Ethernet (nxge) affichent le numéro de version de l’hyperviseur, car le pilote est compatible avec plusieurs versions de l’hyperviseur. Ces messages devraient être désignés comme messages INFORMATIONNELS ou AVIS plutôt que sous forme d’AVERTISSEMENTS. Solution : Vous pouvez ignorer ces messages en toute sécurité. date heure nom-machine nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.0Notes de produit du serveur SPARC T3-2 25 mptsas request inquiry page 0x89 for SATA target:a - Messages d’erreur (CR 6986482) Des messages d’erreur indiquant une demande non aboutie de la page 0x89 pour une cible SATA peuvent être consignés lors du redémarrage du système. L’exemple suivant présente les types de messages susceptibles d’être consignés dans le fichier /var/adm/messages. Solution : Vous pouvez ignorer ces messages en toute sécurité. qlge : panique du pilote lorsque le MTU est défini sur 9 000 (Cr 6964519) Le pilote Gigabit Ethernet qlge 10 peut provoquer une erreur grave sur le système si des erreurs d’allocation de mémoire se produisent. Ces erreurs d’allocation de mémoire ont été observées lorsque l’unité de transmission maximale (MTU, maximum transmission unit) du pilote qlge est dé?nie sur la valeur 9 000. En revanche, elles n’ont pas été observées lorsque le paramètre MTU est dé?ni sur 1 500 et que le nombre d’adaptateurs réseau PCIe 10 GbE FCoE Converge Sun Storage installés ne dépasse pas trois. Solution : Définissez le paramètre MTU sur 1 500 et limitez à trois au minimum le nombre d’adaptateurs réseau PCIe 10 GbE FCoE Converge Sun Storage. date heure nom-machine genunix: [ID 936769 kern.info] mpt_sas5 is /pci@400/pci@2/pci@0/pci@e/scsi@0/iport@80 date heure nom-machine genunix: [ID 408114 kern.info] /pci@400/pci@2/pci@0/pci@e/scsi@0/iport@80 (mpt_sas5) online date heure nom-machine scsi: [ID 243001 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): date heure nom-machine mptsas request inquiry page 0x89 for SATA target:a failed!26 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (CR 6968801) Lors de l’exécution du logiciel Oracle VTS sur les serveurs de la série SPARC T3, il est possible (bien que rare) qu’un test d’Oracle VTS se bloque. Si cela se produit, le processus de blocage peut provoquer le blocage d’autres processus et commandes, notamment celu ide l’outil de configuration de la gestion des pannes (fmadm) et de la commande de configuration du système d’impression (prtconf). Il est impossible de terminer ces processus bloqués. Solution : Redémarrez le système. Si le problème se répète, renseignez-vous auprès de votre représentant services. Évitez d’exécuter le logiciel Oracle VTS dans des environnements de production. Blocage sans fin du processus Oracle Enterprise Manager (CR 6994300) Le processus Java Oracle Enterprise Manager peut se bloquer et devenir impossible à terminer sur le serveur. Lorsque le processus Enterprise Manager se bloque, il continue à écouter sur son port d’interface graphique Web, vous empêchant d’y mettre un terme. Ce problème a été observé sur des serveurs exécutant à la fois Java SE 5.0 (livré avec le logiciel Oracle Database) et la dernière version téléchargeable de Java SE 6 Update 22. Solution : Redémarrez le système. Si le problème se répète, renseignez-vous auprès de votre représentant services. cfgadm : temps d’impression de la sortie anormalement long (CR 6937169) L’exécution de la commande cfgadm(1M) de configuration ou d’annulation de la configuration des périphériques enfichables à chaud est anormalement lente. Ainsi, la commande cfgadm -al peut mettre plus de cinq minutes avant d’afficher la liste des points de connexion de l’ensemble des périphériques enfichables à chaud. Solution : Gérez les périphériques enfichables à chaud à l’aide de la commande hotplug(1M). Pour obtenir des instructions, reportez-vous à la page de manuel hotplug(1M) et au manuel Oracle Solaris OS System Administration Guide: Devices and File Systems.Notes de produit du serveur SPARC T3-2 27 Abandon et arrêt d’un hyperviseur provoqués par l’ajout d’un périphérique terminal PCIe à un domaine invité (CR 6999227) Le système Oracle VM Server pour SPARC 2.0 peut rencontrer l’un des problèmes suivants si vous redémarrez le domaine root après avoir ajouté un périphérique terminal PCIe à un domaine invité : ¦ Abandon et arrêt d’un hyperviseur ¦ Impossible de revenir à l’OpenBoot PROM ¦ Impossible de revenir au SE Oracle Solaris Ces problèmes se produisent uniquement si vous n’avez pas démarré le domaine invité après avoir ajouté le périphérique PCIe. Ce faisant, les interfaces virtuelles précédemment configurées risquent de ne pas avoir été nettoyées correctement. Solution : Si ces problèmes se produisent, redémarrez le système. Afin d’éviter ces problèmes, démarrez un domaine invité après lui avoir ajouté une ressource d’E/S. Si vous ne souhaitez pas activer le domaine pour l’instant, arrêtez-le après son démarrage.28 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Problèmes liés au microprogramme Cette section décrit des problèmes relatifs au microprogramme système. Vidage d’erreur grave abandonné suite à l’exécution de la commande break d’ILOM suivie de la commande sync d’OBP (CR 6923763) Si vous arrêtez le système à l’aide de la commande break d’ILOM : Puis que vous tentez de forcer le système à créer un fichier de vidage d’arrêt brutal à l’aide de la commande sync de l’OpenBoot PROM, le délai d’attente expire et entraîne l’affichage d’un message d’erreur de type dump aborted. Aucun fichier de vidage d’arrêt brutal n’est enregistré. Solution : La commande suivante d’ILOM vous permet d’arrêter le système et d’enregistrer un fichier de vidage d’arrêt brutal : sas2flash : échec de l’utilitaire suite à l’installation d’au moins six HBA PCIe RAID SAS 6 Gb Sun Storage externes (CR 6983246) L’utilitaire sas2flash de LSI Corporation aboutit à un échec lorsque six HBA PCIe RAID SAS 6 Gb Sun Storage externes ou plus sont installés sur le système. Par exemple, lorsque vous tentez de lister les HBA à l’aide de la commande sas2flash -listall, le message d’erreur suivant risque de s’afficher : Solution : Installez cinq HBA PCIe RAID SAS 6 Gb Sun Storage externes au maximum sur le système. -> set /HOST send_break_action=break -> set /HOST send_break_action=dumpcore 6 SAS2008(??) ERROR: Failed to Upload Image! ----------- ---------- ERROR: Failed to Upload Image!Notes de produit du serveur SPARC T3-2 29 Échec de la mise à jour d’EEPROM par le SE Oracle Solaris en vue d’un redémarrage automatique lorsque diag-switch? est défini sur true (CR 6982060) Dans le cadre de l’installation du SE Oracle Solaris sur un périphérique, si le paramètre OBP diag-switch? est défini sur true, le programme d’installation d’Oracle Solaris ne parvient pas à mettre à jour le paramètre boot-device pour refléter le nouveau chemin d’accès au périphérique sur lequel le SE a été installé. Par conséquent, ce chemin ne pourra pas être utilisé lors des redémarrages système automatiques suivants. Lorsque vous tentez d’installer le SE Oracle Solaris sur un périphérique alors que le paramètre diag-switch? est défini sur true, vous ne pourrez plus redémarrer à partir du périphérique et le serveur affiche le message d’erreur suivant : Sur les systèmes précédents, le paramètre OBP diag-device définissait le nouveau chemin d’accès au périphérique d’initialisation lorsque le paramètre diag-switch? était défini sur true. Sur les systèmes SPARC T3, le paramètre diag-device n’est plus pris en charge et le programme d’installation du SE Oracle Solaris génère un avertissement concernant le paramètre OBP boot-device. Solution : À partir de l’invite d’ILOM, définissez le paramètre OBP diag-switch? sur false : Une autre solution consiste à définir ce paramètre à partir de l’invite ok d’OBP : Installing boot information - Installing boot blocks (cxtxdxsx) - Installing boot blocks (/dev/rdsk/cxtxdxsx) - Updating system firmware for automatic rebooting WARNING: Could not update system for automatic rebooting -> set /HOST/bootmode script="setenv diag-switch? false" ok setenv diag-switch? false30 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Prise en charge de quatre adaptateurs de profil bas Sun Dual 10 GbE SFP+ PCIe 2.0 ou moins (CR 6977073) Sur les serveurs équipés de plus de quatre adaptateurs de profil bas Sun Dual 10 GbE SFP+ PCIe 2.0, le pilote 10 GbE (ixgbe) ne peut pas connecter tous les ports 10 GbE disponibles. Pour le moment, le pilote ixgbe utilise trop de mémoire DMA (DMA, direct access memory) et d’espace IOMMU (input/output memory management unit) par instance de pilote. Par conséquent, sur les systèmes équipés de plus de quatre cartes 10 GbE, le pilote ixgbe ne dispose pas de suffisamment de mémoire et, de ce fait, ne parvient pas à connecter tous le sports 10 GbE disponibles. Solution : Installez au maximum quatre adaptateurs de profil bas Sun Dual 10 GbE SFP+ PCIe 2.0. Vous devez par ailleurs installer les adaptateurs de profil bas Sun Dual 10 GbE SFP+ PCIe 2.0 dans des emplacements PCIe2 serveur spécifiques. Installez au plus deux adaptateurs dans les emplacements PCIe2 pairs suivants : 0, 2, 4, 6 et 8. Installez au plus deux adaptateurs supplémentaires dans les emplacements PCIe2 impairs suivants : 1, 3, 5, 7 et 9. Problèmes d’allocation de mémoire avec plusieurs HBA Emulex FC 8 Gb au sein d’un boîtier d’E/S EB7-X8G2- RAS Magma connecté (CR 6982072) Lorsque quatre HBA Emulex PCI-Express FC 8 Gb Sun StorageTek ou plus sont utilisés avec un boîtier d’extension E/S EB7-X8G2-RAS Magma, des erreurs d’allocation de mémoire peuvent se produire. Les exemples suivants présentent les types de messages pouvant être consignés dans le fichier /var/adm/messages lors de la survenance de ce type de problème. date heure nom-machine emlxs: [ID 349649 kern.info] [13.02D8]emlxs19: NOTICE: 200: Adapter initialization. (Firmware update not needed.) date heure nom-machine emlxs: [ID 349649 kern.info] [13.02D8]emlxs24: NOTICE: 200: Adapter initialization. (Firmware update not needed.) date heure nom-machine emlxs: [ID 349649 kern.info] [13.02D8]emlxs22: NOTICE: 200: Adapter initialization. (Firmware update not needed.) date heure nom-machine emlxs: [ID 349649 kern.info] [13.02D8]emlxs20: NOTICE: 200: Adapter initialization. (Firmware update not needed.) date heure nom-machine emlxs: [ID 349649 kern.info] [ B.1CE4]emlxs22: ERROR: 301: Memory alloc failed. (ddi_dma_addr_bind_handle failed: status=ffffffff count=1 size=400 align=20 flags=11) date heure nom-machine emlxs: [ID 349649 kern.info] [ B.1CE4]emlxs20: ERROR: 301: Memory alloc failed. (ddi_dma_addr_bind_handle failed: status=ffffffff count=1 size=400 align=20 flags=11)Notes de produit du serveur SPARC T3-2 31 Solution : Installez au plus trois HBA Emulex PCI-Express FC 8 Gb Sun StorageTek dans un boîtier d’extension E/S EB7-X8G2-RAS Magma connecté au système. Blocage système lors du processus d’initialisation (CR 6956116) Dans de rares situations, le système peut se bloquer lors du processus d’initialisation après avoir seulement affiché le message de la bannière SunOS 5.10. Le message de la bannière SunOS ressemble à l’exemple suivant : Remarque – Cette condition a uniquement été observée dans des environnements de simulation (jamais sur un serveur de production pour le moment). Solution : Redémarrez le système. Si un autre blocage se produit, renseignez-vous auprès de votre représentant services. Système à ne pas mettre sous tension lorsque les cartes mémoire riser sont retirées (CR 6991746) Le microprogramme ne vous empêche pas pour l’instant de mettre le serveur sous tension après avoir retiré toutes les cartes mémoire riser de la carte mère. Même si le système sera effectivement mis sous tension, il s’arrêtera rapidement dès qu’il aura détecté une configuration matérielle incorrecte. Une mise à jour du microprogramme empêchant la mise sous tension du serveur lorsque les cartes mémoire riser sont retirées est prévue. Solution : N’essayez jamais de mettre le serveur sous tension lorsqu’il n’est plus équipé d’aucune carte mémoire riser. SunOS Release 5.10 Version 6956116_142909-17 64-bit Copyright (c) 1983, 2010, Oracle and/or its affiliates. All rights reserved.32 Notes de produit du serveur SPARC T3-2 • Décembre 2010 Messages intermittents de type WARNING: ios#, peu# Link Width x8 Link Speed GEN1 (CR 6958263) Lors de la mise sous tension du serveur sur l’OpenBoot PROM (OBP), des messages d’avertissement semblables à l’exemple suivant peuvent s’afficher sur la console système : Solution : Vous pouvez ignorer ces messages en toute sécurité. Erreurs identifiées dans la documentation Il n’existe aucun problème connu lié à la documentation du serveur SPARC T3-2 d’Oracle pour l’instant. Remarque – Si vous installez des composants matériels ou des packages logiciels optionnels, consultez la documentation associée pour connaître les toutes dernières informations relatives aux mises à jour et aux patchs requis. WARNING: ios0, peu0 Link Width x8 Link Speed GEN1. 1 Ce guide décrit les étapes minimales à effectuer pour mettre sous tension et initialiser pour la première fois le serveur SPARC T3-2 d’Oracle à l’aide du système d’exploitation Oracle Solaris (SE Oracle Solaris). Pour obtenir des instructions d’installation complètes, reportez-vous au Guide d’installation du serveur SPARC T3-2. Contenu de la livraison Quantité Article 1 Serveur 2 Cordons d’alimentation CA (selon la commande) 1 Adaptateur croisé RJ-45/DB-9 1 Bracelet antistatique 1 Kit de montage en rack sur rails 1 Bras de gestion des câbles (selon la commande) Divers documents Serveur SPARC T3-2 Guide de démarrage2 Avant de commencer Pour une installation et une configuration rapides, suivez cette procédure. Pour obtenir des informations plus détaillées, consultez la documentation produit complète disponible en ligne à l’adresse : http:// docs.sun.com/app/docs/prod/sparc.t3.2#hic. Prenez connaissance des informations suivantes avant de configurer le serveur pour la première fois : ¦ Ne mettez pas le courant avant d’y être invité : ce système comprend un processeur de service (SP) permettant de configurer et de démarrer le serveur hôte. Afin de configurer correctement le serveur hôte et d’afficher les messages du SP, n’alimentez pas le serveur en courant alternatif (CA) tant que les connexions réseau de l’hôte et du SP ne sont pas établies, comme décrit dans ce guide. ¦ Choisissez les instructions les plus adaptées à votre situation : les instructions d’installation rapide s’appliquent à tous les environnements réseau et nécessitent l’utilisation d’un périphérique terminal pour établir les connexions avec un port série. Si votre environnement réseau utilise le protocole DHCP, vous pouvez configurer votre système à l’aide du port de gestion Ethernet. Pour tirer parti de la méthode de configuration DHCP, reportez-vous au guide d’installation en ligne faisant partie de la documentation produit disponible à l’adresse : http://docs.sun.com/app/docs/prod/sparc.t3.2#hic ¦ Planifiez un laps de temps suffisant : la durée d’une installation est variable. Cependant, si vous suivez ces instructions pour la première fois, prévoyez environ 45 minutes à 1 h 15 pour effectuer la totalité de ces instructions. Vous aurez peut-être besoin de plus de temps si vous installez des kits de montage en rack et des composants matériels supplémentaires. ¦ Procurez-vous un périphérique terminal : configurez ce serveur montable en rack par le biais du SP au moyen des ports de gestion série et réseau intégrés (ni interface graphique, ni clavier. Pour communiquer avec le SP, vous aurez besoin d’un périphérique terminal : terminal, serveur de terminal ou ordinateur portable exécutant un logiciel d’émulation de terminal. ¦ Réunissez les informations de configuration nécessaires : pendant la configuration, vous êtes invité à spécifier les paramètres de fuseau horaire et réseau spécifiques à votre environnement. Le TABLEAU 1 vous permet de consigner vos informations de configuration. TABLEAU 1 Informations de configuration Paramètre Description Vos informations Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui). Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. Si vous avez des doutes, sélectionnez la première de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur. IP Address (Adresse IP) Saisissez l’adresse IP des interfaces Ethernet sélectionnées. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau.3 Instructions d’installation rapide 1. Déballez le serveur et vérifiez que tous les articles commandés sont présents. Pour plus de détails, reportez-vous à la section « Contenu de la livraison ». 2. Placez le serveur à l’emplacement prévu à titre de vérification. Pour obtenir des instructions de montage en rack, reportez-vous au Guide d’installation du serveur SPARC T3-2, disponible en ligne. 3. Reliez le port SER MGT du serveur (voir FIGURE 1) au périphérique terminal à l’aide d’un câble série. Cette connexion assure la communication initiale avec le SP. Le périphérique doit être configuré de manière à communiquer à 9 600 bauds, 8 bits, sans parité et avec 1 bit d’arrêt. Une configuration de type inverseur est requise, signifiant que les signaux de transmission et de réception sont inversés (croisés) pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. Subnet Netmask (Masque de sous-réseau) (Avec une réponse affirmative pour le sous-réseau) Indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. Si vous avez des doutes, sélectionnez Use the NFSv4 domain derived by the system (Utiliser le domaine NFSv4 dérivé par le système). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP. TABLEAU 1 Informations de configuration (suite)4 FIGURE 1 Connexions du serveur 4. (Facultatif) Reliez au moyen d’un câble Ethernet le port Net MGT du serveur au réseau avec lequel les futures connexions au SP et à l’hôte seront établies. Une fois la configuration initiale du système effectuée à l’aide du port SER MGT, la communication avec le SP et l’hôte est généralement assurée par le biais de cette interface Ethernet. 5. Reliez au moyen d’un câble Ethernet l’un des ports NET du serveur au réseau avec lequel le serveur communiquera. 6. Branchez les cordons d’alimentation sur les alimentations et des sources de courant distinctes. Si le serveur est équipé de deux alimentations, branchez-les dans des sources d’alimentation distinctes pour garantir une redondance de l’alimentation à votre système. Le système peut fonctionner avec une seule connexion d’alimentation, mais il ne dispose alors d’aucune redondance. Lorsqu’il est mis sous tension, le SP s’initialise et les DEL d’alimentation s’allument. Après quelques minutes, l’invite de connexion du SP s’affiche sur le périphérique terminal. Notez que l’hôte n’est pas encore initialisé ou mis sous tension à ce stade.5 7. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM (Integrated Lights Out Manager). Par exemple, pour créer un utilisateur nommé admin et dé?nir le rôle du compte admin avec les privilèges cuar (console, gestion des utilisateurs, administration et contrôle de la réinitialisation et de l’hôte), tapez : Vous noterez que les astérisques indiqués dans l’exemple ne sont pas visibles lorsque vous tapez le mot de passe. Vous trouverez des informations supplémentaires sur le SP (modification du mot de passe, configuration des paramètres réseau, etc.) dans la documentation en ligne. 8. Mettez le serveur sous tension et redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console du SP démarrée, l’initialisation du serveur prend une vingtaine de minutes. 9. Lorsque vous y êtes invité, suivez les instructions qui s’affichent à l’écran et saisissez les informations de configuration. Pour obtenir la liste des informations de configuration et vos données personnelles, reportez-vous au TABLEAU 1. Vous êtes invité à confirmer la configuration à plusieurs reprises, ce qui vous permet de confirmer ou de modifier des paramètres. Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la lorsque le SE Oracle Solaris est exécuté. Lorsque tous les menus de configuration sont paramétrés, le serveur redémarre et affiche l’invite de connexion d’Oracle Solaris. 10. Connectez-vous au serveur et explorez ses fonctions. Les commandes suivantes fournissent des informations sur le système : ¦ showrev : affiche le nom d’hôte et des informations sur l’architecture du système. Utilisez l’option -a avec cette commande pour afficher les patchs installés. ¦ psrinfo : affiche des informations sur le nombre et le statut des processeurs et noyaux de l’hôte. Pour plus d’informations, consultez les pages de manuel et la documentation du SE Oracle Solaris. SUNSP00144FAC732F login: root Password: changeme . . . -> -> create /SP/users/admin role=cuar Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/admin -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. . . .6 Accès à des informations complémentaires Vous pouvez visualiser, imprimer et télécharger des informations supplémentaires sur ce produit à partir des sites Web suivants : ¦ Documentation complète relative au serveur SPARC T3-2 d’Oracle, comprenant notamment des documents essentiels tels que les notes de produit : http://docs.sun.com/app/docs/prod/sparc.t3.2#hic ¦ Large sélection de documentation, versions traduites comprises : http://docs.sun.com/ ¦ Informations fournies avec le SE Oracle Solaris préinstallé : http://www.sun.com/software/preinstall Support technique Pour toute question d’ordre technique sur ce produit à laquelle ce document ne répond pas, consultez l’adresse suivante : http://www.sun.com/service/contacting Commentaires sur la documentation Pour nous envoyer vos commentaires sur ce document, cliquez sur le lien Feedback[+] à l’adresse : http://docs.sun.com/ Veuillez mentionner le titre et le numéro de référence du document dans vos commentaires : Guide de démarrage du serveur SPARC T3-2, référence 821-2897-10. Copyright © 2010, Oracle et/ou ses sociétés affiliées. Tous droits réservés. N° de référence : 821-2897-10, rév. A Novembre 2010 Serveur SPARC T3-2 Guide d’installation N° de référence : 821-2905-10 Novembre 2010, révision AProduit recyclable Copyright © 2010, Oracle et/ou ses sociétés af?liées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modi?ées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés af?liées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Table des matières Utilisation de cette documentation vii Préparation de l’installation 1 Présentation des tâches d’installation 2 Présentation du serveur 3 Vérification des spécifications du serveur 5 Spécifications physiques 5 Spécifications électriques 6 Informations sur la puissance d’entrée 7 Conditions environnementales requises 7 Émissions sonores 9 Zones de refroidissement et circulation de l’air 9 Inventaire du kit de livraison 11 Composants du panneau avant 12 Composants du panneau arrière 13 Précautions de manipulation du serveur 15 Précautions contre les dommages électrostatiques 16 Outils nécessaires pour l’installation 17 Installation des composants optionnels 18iv Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Installation du serveur 19 Compatibilité des racks 20 ? Pour stabiliser le rack à installer 22 ? Pour désassembler les rails coulissants 22 ? Pour installer des supports de montage 24 ? Pour fixer les assemblages de rails coulissants 25 ? Pour installer le serveur dans les assemblages de rails coulissants 29 ? Pour installer le bras de gestion des câbles 32 ? Pour vérifier le fonctionnement des rails coulissants et du CMA 36 Connexion des câbles du serveur 37 Câblage requis 38 Connecteurs et ports du panneau arrière 39 ? Pour connecter le câble SER MGT 41 ? Pour connecter le câble NET MGT 42 ? Pour connecter les câbles réseau Ethernet 43 ? Pour connecter les câbles du module réseau 44 ? Pour connecter d’autres câbles de données 48 ? Pour préparer les cordons d’alimentation 48 ? Pour fixer les câbles au bras de gestion des câbles 50 Mise sous tension initiale du serveur 53 Tâches de mise sous tension 54 Console système ILOM 55 ? Pour connecter un terminal ou un émulateur au port SER MGT 56 ? Pour mettre le système sous tension pour la première fois 58 Paramètres de configuration du SE Oracle Solaris 61 ? Pour assigner une adresse IP statique au SP 62Table des matières v Identification des ports du serveur 65 Ports USB 66 Port SER MGT 67 Port NET MGT 68 Ports Gigabit Ethernet 69 Ports vidéo 70 Connecteurs SAS 71 Port QSFP 73 Glossaire 75 Index 79vi Guide d’installation du serveur SPARC T3-2 • Novembre 2010vii Utilisation de cette documentation Ce guide d’installation contient des instructions et des informations d’ordre général visant à faciliter l’installation du serveur SPARC T3-2 d’Oracle. ¦ « Documentation connexe », page vii ¦ « Documentation, support et formation », page viii Documentation connexe Les documents mis en ligne sont disponibles à l’adresse suivante : (http://docs.sun.com/app/docs/prod/sparc.t3.2#hic) TABLEAU : Documentation du serveur SPARC T3-2 Application Titre Format Emplacement Informations de dernière minute Notes de produit du serveur SPARC T3-2 PDF En ligne Guide de démarrage Guide de démarrage du serveur SPARC T3-2 Imprimé Livré avec le système Installation Guide d’installation du serveur SPARC T3-2 PDF HTML En ligne Administration Guide d’administration des serveurs de la série SPARC T3 PDF HTML En ligne Maintenance SPARC T3-2 Server Service Manual PDF HTML En ligne Sécurité SPARC T3-2 Server Safety and Compliance Guide PDF En ligneviii Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Documentation, support et formation Ces sites proposent des ressources supplémentaires : ¦ Documentation (http://docs.sun.com) ¦ Support (http://www.sun.com/support) ¦ Formation (http://www.sun.com/training) TABLEAU : Documentation d’Oracle Integrated Lights Out Manager 3.0 Application Titre Emplacement Informations de dernière minute et problèmes Mises à jour des fonctions d’Oracle Integrated Lights Out Manager (ILOM) 3.0 et notes de version En ligne Installation et configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures relatives à l'interface du navigateur Guide des procédures relatives à l'interface Web d'Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures relatives à la CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures SNMP et IPMI Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide SNMP, IPMI, WS-Man, CIM En ligne1 Préparation de l’installation Ces rubriques présentent des informations générales sur les procédures d’installation du serveur. ¦ « Présentation des tâches d’installation », page 2 ¦ « Présentation du serveur », page 3 ¦ « Vérification des spécifications du serveur », page 5 ¦ « Inventaire du kit de livraison », page 11 ¦ « Composants du panneau avant », page 12 ¦ « Composants du panneau arrière », page 13 ¦ « Précautions de manipulation du serveur », page 15 ¦ « Précautions contre les dommages électrostatiques », page 16 ¦ « Outils nécessaires pour l’installation », page 17 ¦ « Installation des composants optionnels », page 18 Informations connexes ¦ « Installation du serveur », page 19 ¦ « Connexion des câbles du serveur », page 37 ¦ « Mise sous tension initiale du serveur », page 532 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Présentation des tâches d’installation Pour installer et configurer le serveur, effectuez les tâches suivantes. Informations connexes ¦ Notes de produit du serveur SPARC T3-2 ¦ SPARC T3-2 Server Safety and Compliance Guide ¦ Guide d’administration des serveurs de la série SPARC T3 ¦ SPARC T3-2 Server Service Manual Étape Description Liens 1 Pour des informations de dernière minute sur le serveur, passez en revue les Notes de produit du serveur SPARC T3-2. Notes de produit du serveur SPARC T3-2 2 Passez en revue les fonctions du serveur, les spécifications et les conditions requises pour le site. « Présentation du serveur », page 3 « Vérification des spécifications du serveur », page 5 3 Vérifiez que tous les articles que vous avez commandés ont bien été livrés. « Inventaire du kit de livraison », page 11 4 Familiarisez-vous avec les fonctions du serveur, les commandes et les DEL nécessaires à l’installation. « Composants du panneau avant », page 12 « Composants du panneau arrière », page 13 5 Respectez les consignes de sécurité et prenez les précautions ESD, et assemblez les outils nécessaires. « Précautions de manipulation du serveur », page 15 « Précautions contre les dommages électrostatiques », page 16 « Outils nécessaires pour l’installation », page 17 6 Installez les éventuels composants optionnels dans le serveur. « Installation des composants optionnels », page 18 7 Installez le serveur dans un rack. « Installation du serveur », page 19 8 Reliez les câbles de données et de gestion au serveur. « Connexion des câbles du serveur », page 37 9 Branchez les cordons d’alimentation du serveur, configurez le processeur de service ILOM, mettez le serveur sous tension pour la première fois et configurez le système d’exploitation. « Mise sous tension initiale du serveur », page 53Préparation de l’installation 3 Présentation du serveur Cette rubrique décrit les principaux composants et les capacités du serveur. Composant Description CPU Deux processeurs sont installés sur l’assemblage de la carte mère. Mémoire Jusqu’à quatre modules riser mémoire sont pris en charge (deux cartes riser par CPU). • Chaque module riser prend en charge 8 modules DIMM, autorisant jusqu’à 16 DIMM par processeur. • Un serveur utilisant quatre modules riser entièrement occupés par des modules DIMM de 8 Go prend en charge un maximum de 256 Go de mémoire système. Périphériques de stockage Pour le stockage interne, le serveur fournit : • Six baies d’unités 2,5 pouces, accessibles par le panneau avant. • Un lecteur DVD+/-RW de chargement d’emplacement facultatif sur l’avant du serveur, en dessous des baies. • Un port USB grande vitesse interne sur la carte mère. Il peut contenir un périphérique flash USB pour le démarrage du système. Ports USB 2.0 Deux à l’avant, deux à l’arrière et un en interne. Ports vidéo Un port vidéo DB-15 haute densité à l’avant et un à l’arrière.4 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Informations connexes ¦ SPARC T3-2 Server Service Manual ¦ Documentation d’ILOM ¦ « Composants du panneau avant », page 12 ¦ « Composants du panneau arrière », page 13 Emplacements d’E/S PCI Express 2.0 Dix emplacements PCI Express 2.0 accueillent des cartes PCIe bas profil. Tous les emplacements prennent en charge les cartes PCIe x8. Deux emplacements sont également compatibles avec les cartes PCIe x16. • Emplacements 4 et 5 : interface électrique x4 • Emplacements 0, 1, 2, 7, 8 et 9 : interface électrique x8 • Emplacements 3 et 6 : interface électrique x8 (connecteur x16) Emplacement du module réseau Un emplacement dédié réservé à l’utilisation avec la carte du module réseau 10 Gbit du serveur SPARC T3-2. Le serveur ne prend pas en charge l’occupation de cet emplacement par des cartes PCIe. Port Ethernet Quatre ports GbE RJ-45 10/100/1000 sur le panneau arrière. Processeur de service Le processeur de service prend en charge les fonctions suivantes : • BMC intégré, prenant en charge l’ensemble de fonctions IPMI standard. • Prise en charge des fonctionnalités KVMS à distance, DVD et lecteur de disquette sur IP. • Comprend un port série. • Prend en charge l’accès Ethernet au SP via un port de gestion 10/100BaseT dédié et également via l’un des ports GbE hôtes (à l’aide de la gestion sideband ILOM). Alimentations Deux alimentations remplaçables à chaud, chacune avec sélection automatique, mode d’efficacité à charge faible et mode de surallocation redondante. Ventilateurs de refroidissement Six ventilateurs redondants remplaçables à chaud à l’avant du châssis (chargement par le haut) ; ventilateurs redondants dans chacune des alimentations. Logiciel de gestion ILOM. Composant DescriptionPréparation de l’installation 5 Vérification des spécifications du serveur Avant d’installer le serveur, passez en revue ses spécifications et préparez le site d’installation. ¦ « Spécifications physiques », page 5 ¦ « Spécifications électriques », page 6 ¦ « Informations sur la puissance d’entrée », page 7 ¦ « Conditions environnementales requises », page 7 ¦ « Émissions sonores », page 9 ¦ « Zones de refroidissement et circulation de l’air », page 9 Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Inventaire du kit de livraison », page 11 ¦ « Identification des ports du serveur », page 65 Spécifications physiques Remarque – Pour garantir une installation et un entretien sûrs, veillez à laisser un espace libre de 91 cm devant et derrière le serveur. Informations connexes ¦ « Inventaire du kit de livraison », page 11 ¦ « Installation du serveur », page 19 Dimension Valeur Hauteur 129,85 mm Largeur 436,5 mm Profondeur 732 mm Poids 36,29 kg, 26,31 kg minimum6 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Spécifications électriques Les chiffres de dissipation d’énergie répertoriés dans le tableau suivant sont les chiffres nominaux de puissance maximum définis pour l’alimentation utilisée sur ce serveur. Ces chiffres ne sont pas une évaluation de la consommation réelle du système. Pour des informations à jour sur la consommation électrique, visitez le site Web suivant et allez à la page appropriée : (http://www.oracle.com/goto/powercalculators/). Remarque – Prévoyez de connecter chaque alimentation sur un circuit distinct dans la mesure du possible. Cette redondance permet de maintenir le serveur en service en cas de panne de l’un des circuits. Vérifiez les normes électriques de votre région pour connaître les éventuelles conditions requises supplémentaires. Informations connexes ¦ « Informations sur la puissance d’entrée », page 7 ¦ « Pour préparer les cordons d’alimentation », page 48 ¦ « Mise sous tension initiale du serveur », page 53 Paramètre Valeur Entrée Fréquences nominales 50 à 60 Hz Plage de tension de fonctionnement CA 100 à 127/200 à 240 V CA Courant maximal RMS CA par cordon d’alimentation 12 A à 100 VAC/12 A à 200 V CA Plage de fonctionnement CA 90 à 264 V CA Sortie 3,3 V CC VEILLE 10 A +12 V CC 165 A Dissipation d’énergie Consommation max. d’énergie 2 175 W Dégagement max. de chaleur 7 417 BTU/h Volts-ampères nominaux 2 218 VA à 240 V CA, 0,98 P.F.Préparation de l’installation 7 Informations sur la puissance d’entrée Le serveur fournit des alimentations redondantes, remplaçables à chaud. Lorsque chaque alimentation est connectée à une source d’alimentation distincte, le serveur continue à fonctionner dans les conditions de panne suivantes : ¦ Une panne de la source de courant coupe l’alimentation en entrée au niveau d’une des alimentations. ¦ L’une des alimentations tombe en panne. ¦ Une opération de maintenance exige le retrait d’une ou des deux alimentations. Pour des instructions de remplacement d’une alimentation, reportez-vous au SPARC T3-2 Server Service Manual. Remarque – Câbles d’alimentation d’entrée : afin de ne pas manquer de messages d’initialisation, ne reliez pas ces câbles aux alimentations avant que les câbles de données soient branchés et le serveur connecté à un terminal série ou un émulateur (PC ou station de travail). Le serveur passe en mode veille et le processeur de service ILOM s’initialise dès que les câbles d’alimentation d’entrée sont connectés à la source de courant. Informations connexes ¦ SPARC T3-2 Server Service Manual ¦ « Spécifications électriques », page 6 ¦ « Pour préparer les cordons d’alimentation », page 48 Conditions environnementales requises Installez et utilisez le serveur sur un site dont la température ambiante est comprise entre 21 °C et 23 °C, fourchette optimale du point de vue de la fiabilité du serveur. À 22 °C, il est facile de maintenir des niveaux d’humidité relatifs sûrs. Le fonctionnement dans cette plage de température fournit une marge de sécurité dans le cas d’une défaillance du système de contrôle environnemental. L’utilisation du serveur sur un site dont le niveau d’humidité relative ambiante est compris entre 45 et 50 % empêche la corrosion, offre un tampon de temps de service dans le cas d’une panne du système de contrôle environnemental et permet d’éviter les pannes liées aux décharges statiques survenant avec une humidité relative basse.8 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Remarque – Les décharges électrostatiques se produisent facilement. Elles se dissipent plus difficilement lorsque l’humidité relative est inférieure à 35 % et deviennent critiques lorsque le niveau tombe en dessous de 30 %. Le serveur a été testé pour répondre à toutes les conditions de fonctionnement requises lors de son utilisation dans les limites environnementales indiquées dans le tableau ci-dessous (toutes les valeurs concernent un seul serveur non monté en rack). Informations connexes ¦ « Émissions sonores », page 9 ¦ « Zones de refroidissement et circulation de l’air », page 9 Paramètre Valeur Température en service Entre 5 °C et 35 °C (entre 41 °F et 95 °F) Température hors service Entre -40 °C et 65 °C (-40 °F et 149 °F) Taux d’humidité en service 10 à 90 % d’humidité relative, 27 °C (80,6 °F) maximum avec thermomètre humide, sans condensation Taux d’humidité hors service Jusqu’à 93 % d’humidité relative, 38 °C (100,4 °F) maximum avec thermomètre humide, sans condensation Altitude en service Jusqu’à 3 048 m (10 000 pieds), la température ambiante maximale étant réduite de 2 degrés Celsius tous les 1 km (3,6 degrés F tous les 3 280 pieds) Altitude hors service Jusqu’à 12 000 m (39 370 pieds) Vibrations en service 0,15 G (vertical), 0,10 G (horizontal), 5 à 500 Hz, sinus de balayage Vibrations hors service 0,5 G (vertical), 0,25 G (horizontal), 5 à 500 Hz, sinus de balayage Chocs en service Pulsation demi-sinusoïdale de 3 G, 11 ms Chocs hors service • Basculement : chute libre de 2,54 cm, de l’avant vers l’arrière • Seuil : hauteur limite de 25 mm avec une vélocité d’impact de 0,75 m/sPréparation de l’installation 9 Émissions sonores Les émissions sonores déclarées sont conformes aux normes ISO 9296 pour le serveur. Informations connexes ¦ SPARC T3-2 Server Safety and Compliance Guide ¦ « Conditions environnementales requises », page 7 ¦ « Zones de refroidissement et circulation de l’air », page 9 Zones de refroidissement et circulation de l’air Remarque – Veillez à assurer une circulation d’air entrant et sortant adéquate afin de maintenir la température interne du serveur dans une plage de fonctionnement sûre. Le serveur présente deux zones de refroidissement pressurisées : la zone de refroidissement principale et la zone de refroidissement des alimentations. Dans la première, six ventilateurs, installés en deux rangées redondantes, servent à refroidir la carte mère, les cartes riser mémoire et les cartes d’E/S. Dans la seconde, les ventilateurs d’alimentation arrière refroidissent les alimentations et les baies d’unités avant. Le serveur doit maintenir un joint de paroi séparatrice plastique pressurisé de manière à permettre aux ventilateurs des alimentations d’aspirer de l’air via les baies d’unités avant. L’air frais entre par l’avant du serveur tandis que l’air chaud s’échappe par l’arrière. Description Mode Spécification LwAd (1 B = 10 dB) Émissions sonores en service Émissions sonores en période d’inactivité 7,7 B 7,6 B LpAm (positions en veille) Émissions sonores en service Émissions sonores en période d’inactivité 61,5 dB 61,2 dB10 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Pour éviter toute surchauffe du serveur : ¦ Assurez-vous que l’air pénètre par l’avant du serveur et s’échappe par l’arrière. ¦ Assurez-vous que la circulation de l’air dans le serveur n’est pas obstruée. ¦ Ne dirigez pas directement de l’air chaud en direction de l’arrivée d’air avant du serveur. ¦ Empêchez l’air évacué de recirculer dans un rack ou une armoire. ¦ Manipulez les câbles de façon à réduire les interférences avec les ouvertures d’évacuation du serveur. ¦ Veillez à ce que les ouvertures de ventilation du serveur utilisées pour l’arrivée et l’évacuation d’air offrent un modèle de perforations d’une zone d’ouverture de 60 % sur les parties avant et arrière du serveur. ¦ Laissez un espace libre minimal de 5 mm à l’avant du serveur et de 80 mm à l’arrière une fois l’installation terminée. Ces valeurs d’espace libre sont calculées à partir de l’impédance d’arrivée et d’évacuation précédentes (zone d’ouverture disponible) et supposent une distribution uniforme de la zone d’ouverture sur l’arrivée et l’évacuation d’air. Il est recommandé d’utiliser des valeurs d’espace libre supérieures aux chiffres donnés ici afin d’améliorer les performances de refroidissement. Remarque – Notez que la combinaison de restrictions d’arrivée et d’évacuation (telles que les portes de l’armoire et l’espace libre entre le serveur et les portes) peut affecter les performances de refroidissement du serveur.Préparation de l’installation 11 Informations connexes ¦ « Conditions environnementales requises », page 7 ¦ « Émissions sonores », page 9 Inventaire du kit de livraison Remarque – Lorsque vous réceptionnez le serveur, placez-le dans l’environnement dans lequel il sera installé. Laissez-le dans son carton d’emballage à sa destination finale pendant 24 heures. Cette période de repos évite les chocs thermiques et la condensation. Assurez-vous d’avoir bien reçu tous les composants livrés avec le serveur. ¦ Serveur SPARC T3-2 ¦ 2 cordons d’alimentation CA (en fonction de la commande) ¦ Adaptateur croisé RJ-45/DB-9 pour le port SER MGT ¦ Bracelet antistatique ¦ Kit de montage en rack12 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ¦ Bras de gestion des câbles (en fonction de la commande) ¦ Guide de démarrage du serveur SPARC T3-2 avec licence et consignes de sécurité ¦ Composants optionnels (cartes PCIe, par exemple) emballés séparément Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Vérification des spécifications du serveur », page 5 Composants du panneau avant N° Description N° Description 1 DEL/bouton de localisation (de couleur blanche) 10 Connecteur vidéo DB-15 2 DEL d’opération de maintenance requise orange 11 Unité de DVD SATA (optionnelle) 3 DEL d’alimentation principale/OK verte 12 Unité de disque 0 (optionnelle) 4 Bouton de marche/arrêt 13 Unité de disque 1 (optionnelle) 5 DEL OK/Panne du SP de couleur verte/orange 14 Unité de disque 2 (optionnelle) 6 DEL d’opération de maintenance requise (3) : pour le module de ventilation (FAN), le processeur (CPU) et la mémoire, de couleur orange 15 Unité de disque 3 (optionnelle)Préparation de l’installation 13 Informations connexes ¦ « Composants du panneau arrière », page 13 ¦ « Pour mettre le système sous tension pour la première fois », page 58 Composants du panneau arrière 7 DEL de panne d’alimentation (PS) (Opération de maintenance requise) orange 16 Unité de disque 4 (optionnelle) 8 DEL d’avertissement de surchauffe orange 17 Unité de disque 5 (optionnelle) 9 Connecteurs USB 2.0 (2) N° Description N° Description 1 DEL de statut de l’alimentation 0 : • DEL d’opération de maintenance requise orange • CA normal : vert ou orange 8 Ports réseau 10/100/1000 : NET0–NET3 2 Entrée CA 0 de l’alimentation 0 9 Connecteurs USB 2.0 (2) N° Description N° Description14 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Informations connexes ¦ « Composants du panneau avant », page 12 ¦ « Connexion des câbles du serveur », page 37 3 DEL de statut de l’alimentation 1 : • DEL d’opération de maintenance requise orange • CA normal : vert ou orange 10 Emplacements de carte PCIe 5 à 9 4 Entrée CA de l’unité d’alimentation 1 11 Connecteur vidéo DB-15 5 DEL de statut du système : • Alimentation/OK : verte • Attention : orange • Localisation : blanche 12 Port série RJ-45 SER MGT du SP 6 Emplacements de carte PCIe2 0 à 4 13 Port réseau RJ-45 NET MGT du SP 7 Emplacement de la carte du module réseau N° Description N° DescriptionPréparation de l’installation 15 Précautions de manipulation du serveur Attention – Déployez la barre antibasculement du rack d’équipement avant de commencer l’installation. Attention – Le serveur pèse environ 36 kg. Deux personnes sont nécessaires pour soulever ce serveur de 2U et l’installer dans un rack en suivant les procédures décrites dans ce document. Attention – Dans le cadre d’une procédure dans laquelle interviennent deux personnes, communiquez toujours clairement vos intentions avant, pendant et au terme de chaque étape pour minimiser la confusion. Informations connexes ¦ « Spécifications physiques », page 5 ¦ « Installation du serveur », page 19 ¦ Guide de démarrage du serveur SPARC T3-216 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Précautions contre les dommages électrostatiques Les équipements électroniques peuvent être endommagés par l’électricité statique. Utilisez un bracelet antistatique relié à la terre, une sangle de cheville ou un dispositif de sécurité équivalent pour éviter tout dommage électrostatique (ESD) lorsque vous effectuez l’installation ou la maintenance du serveur. Attention – Pour protéger les composants électriques des dégâts dus aux décharges électrostatiques, qui peuvent irrémédiablement endommager le système ou nécessiter des réparations effectuées par des techniciens de maintenance, placez les composants sur une surface antistatique (telle qu’un tapis de décharge antistatique, un sachet antistatique ou un tapis antistatique jetable). Portez un bracelet de mise à la terre antistatique raccordé à une surface métallique du châssis lorsque vous travaillez sur les composants du système. Informations connexes ¦ « Installation du serveur », page 19 ¦ « Connexion des câbles du serveur », page 37Préparation de l’installation 17 Outils nécessaires pour l’installation Pour pouvoir installer le système, assurez-vous de disposer des outils suivants : ¦ Tournevis cruciforme n°2 ¦ Tapis antistatique et bracelet de mise à la terre En outre, vous devez disposer d’un périphérique de console système, tel que l’un des éléments suivants : ¦ Terminal ASCII ¦ Station de travail ¦ Serveur de terminal ¦ Tableau de connexions relié à un serveur de terminal Informations connexes ¦ « Installation des composants optionnels », page 18 ¦ SPARC T3-2 Server Service Manual18 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Installation des composants optionnels Les composants standard du serveur sont installés en usine. Cependant, si vous avez commandé des options telles que de la mémoire supplémentaire ou des cartes PCIe, celles-ci seront livrées séparément. Dans la mesure du possible, installez ces composants avant de monter le serveur dans un rack. Si vous avez commandé des options qui ne sont pas installées en usine, reportez-vous au SPARC T3-2 Server Service Manual et à la documentation du composant pour obtenir des instructions d’installation. Remarque – La liste des composants optionnels peut être mise à jour sans préavis. Consultez les pages Web des produits pour obtenir la liste actualisée des composants pris en charge par le serveur. Informations connexes ¦ Documentation des composants optionnels ¦ SPARC T3-2 Server Service Manual19 Installation du serveur Les rubriques suivantes présentent la procédure d’installation du serveur dans un rack à l’aide des rails du kit de montage en rack. Suivez ces procédures si vous avez fait l’acquisition d’un assemblage de rails. Remarque – Dans ce guide, le terme « rack » signifie soit un rack ouvert, soit une armoire fermée. ¦ « Compatibilité des racks », page 20 ¦ « Pour stabiliser le rack à installer », page 22 ¦ « Pour désassembler les rails coulissants », page 22 ¦ « Pour installer des supports de montage », page 24 ¦ « Pour fixer les assemblages de rails coulissants », page 25 ¦ « Pour installer le serveur dans les assemblages de rails coulissants », page 29 ¦ « Pour installer le bras de gestion des câbles », page 32 ¦ « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 36 Informations connexes ¦ « Préparation de l’installation », page 1 ¦ « Connexion des câbles du serveur », page 3720 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Compatibilité des racks Vérifiez que votre rack est compatible avec les options de rails coulissants et de bras de gestion des câbles (CMA). Les rails coulissants disponibles en option sont compatibles avec un large éventail de racks pour matériel qui respectent les normes suivantes. Attention – Chargement du matériel : chargez toujours le matériel dans un rack en partant du bas vers le haut, afin de ne pas alourdir la partie supérieure, ce qui risquerait de faire basculer l’unité. Déployez la barre antibasculement du rack pour empêcher celui-ci de basculer pendant l’installation du matériel. Attention – Température ambiante de fonctionnement élevée : si le serveur est installé dans un rack fermé ou un assemblage comportant plusieurs racks, la température ambiante de fonctionnement de l’environnement en rack peut être Article Configuration requise Structure Rack à quatre montants (montage à l’avant et à l’arrière). Les racks à deux montants ne sont pas compatibles. Ouverture horizontale du rack et insertion verticale d’unités Conforme aux normes ANSI/EIA 310-D-1992 ou IEC 60927. Taille des trous de montage des rails du rack Seuls les trous de montage carrés de 9,5 mm et les trous de montage ronds M6 sont compatibles. Toutes les autres tailles, y compris les modèles de 7,2 mm, M5 ou 10-32, ne sont pas pris en charge. Distance entre les plans de montage avant et arrière Entre 622 mm minimum et 895 mm au maximum. Espace libre devant le plan de montage avant Distance à la porte avant de l’armoire de 27 mm minimum. Espace libre derrière le plan de montage avant Distance par rapport à la porte arrière de l’armoire de 900 mm minimum avec bras de gestion des câbles ou de 770 mm sans bras de gestion des câbles. Espace libre entre les plans de montage avant et arrière Distance entre les supports de structure et les chemins de câbles de 456 mm minimum. Dimensions du serveur Profondeur (poignée d’unité d’alimentation exclue) : 732 mm Largeur (sans les pattes) : 436,5 mm Hauteur : 129,85 mmInstallation du serveur 21 supérieure à la température ambiante de la pièce. Par conséquent, installez le matériel dans un environnement entièrement compatible avec la température ambiante maximum (Tma) indiquée pour le serveur. Attention – Circulation d’air réduite : installez le matériel dans le rack en veillant à assurer une circulation d’air suffisante pour garantir un fonctionnement sûr de ce matériel. Attention – Charge mécanique : installez le matériel dans le rack de façon à répartir le poids de manière uniforme. Une répartition du poids inégale peut engendrer une situation dangereuse. Attention – Surcharge du circuit : évitez de surcharger les circuits d’alimentation. Avant de connecter le serveur au circuit d’alimentation, vérifiez les valeurs nominales de la plaque signalétique du matériel et prenez en considération les conséquences d’une éventuelle surcharge des circuits sur la protection de surintensité et sur le câblage d’alimentation. Attention – Fiabilité de la mise à la terre : respectez les règles de sécurité en matière de mise à la terre du matériel. Une attention particulière doit être apportée aux connexions d’alimentation autres que les connexions directes au circuit (par exemple, l’utilisation de bandes d’alimentation). Attention – N’utilisez pas le matériel à montage sur rails coulissants comme étagère ou espace de travail. Informations connexes ¦ « Spécifications physiques », page 5 ¦ « Précautions de manipulation du serveur », page 15 ¦ « Pour stabiliser le rack à installer », page 2222 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour stabiliser le rack à installer Attention – Afin de réduire les risques de blessures, stabilisez le rack d’extension et allongez tous les dispositifs antibasculement avant d’installer le serveur. Reportez-vous à la documentation du rack pour obtenir des instructions détaillées concernant les étapes suivantes. 1. Ouvrez puis démontez les portes avant et arrière du rack. 2. Afin d’éviter que le rack ne bascule lors de l’installation, stabilisez l’armoire en déployant toutes les dispositifs antibasculement fournis. 3. Si le rack est équipé de pieds de stabilisation destiné à l’empêcher de rouler, allongez-les entièrement jusqu’à ce qu’ils touchent le sol. 4. Déployez entièrement les pattes ou la barre antibasculement du rack, situés sur la partie inférieure avant du rack. Informations connexes ¦ Documentation du rack ¦ SPARC T3-2 Server Safety and Compliance Guide ¦ « Compatibilité des racks », page 20 ? Pour désassembler les rails coulissants Pour désassembler les rails coulissants avant de procéder à l’installation, effectuez la tâche suivante. Pour retirer les supports de montage des assemblages de rails coulissants : 1. Déballez les rails coulissants. 2. Localisez le verrou du rail coulissant à l’avant de l’un des assemblages de rails coulissants.Installation du serveur 23 FIGURE : Désassemblage de rails coulissants avant l’installation 3. Maintenez enfoncé le verrou du rail coulissant dans la direction de la flèche pendant que vous tirez le support de montage hors de l’assemblage de rails coulissants, jusqu’à ce qu’il atteigne la butée. 4. Poussez le bouton de déverrouillage du support de montage vers l’avant et retirez en même temps le support de montage de l’assemblage. 5. Répétez l’opération pour l’autre assemblage. Informations connexes ¦ « Pour installer des supports de montage », page 24 ¦ « Pour fixer les assemblages de rails coulissants », page 25 ¦ « Pour installer le serveur dans les assemblages de rails coulissants », page 29 Légende de la figure 1 Verrou de rail coulissant 2 Bouton de déverrouillage du support de montage24 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour installer des supports de montage Vous devez installer les supports de montage sur le serveur avant de pouvoir monter en rack ce dernier. 1. Placez un support de montage contre le châssis de sorte que le verrou du rail coulissant se trouve à l’avant du serveur et que les cinq ouvertures du support de montage soient alignées sur les cinq broches de repère situées sur le côté du châssis. Remarque – Les supports de montage sont identiques et peuvent être installés sur l’un ou l’autre côté du châssis. FIGURE : Alignement du support de montage sur le châssis du serveur 2. Les cinq têtes des broches de repère sortant par les cinq ouvertures du support de montage, tirez le support de montage vers l’avant du châssis jusqu’à ce qu’il s’encastre avec un déclic sonore.Installation du serveur 25 3. Vérifiez que la broche de repère arrière est bien clipsée dans le support de montage. 4. Répétez ces opérations pour installer l’autre support de montage de l’autre côté du serveur. Informations connexes ¦ « Pour désassembler les rails coulissants », page 22 ¦ « Pour fixer les assemblages de rails coulissants », page 25 ¦ « Pour installer le serveur dans les assemblages de rails coulissants », page 29 ? Pour fixer les assemblages de rails coulissants Effectuez les procédures suivantes pour fixer les assemblages de rails coulissants au rack : Remarque – Les assemblages de rails coulissants prennent uniquement en charge les racks équipés de trous carrés de 9,5 mm et de trous ronds M6. Tous les autres racks, y compris les modèles dotés de trous de montage de 7,2 mm, M5 ou 10-32, ne sont pas compatibles. Pour plus d’informations sur la taille des trous de rails, consultez la documentation du rack. 1. (Facultatif) Si vous devez déplacer le rack une fois le serveur installé, fixez les assemblages de rails coulissants au rack au moyen des vis de montage et des écrous à cage. Insérez les écrous à cage avant d’effectuer les étapes suivantes. Pour des instructions sur l’insertion des écrous à cage, reportez-vous à la carte Rail Rackmount Kit Overview and Information. Cette carte est incluse dans le kit de montage en rack. 2. Placez un assemblage de rail coulissant dans le rack de sorte que le support avant de l’assemblage se trouve à l’extérieur du montant avant du rack et le support arrière de l’assemblage soit placé à l’intérieur du montant arrière du rack.26 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 3. Alignez les broches de montage de l’assemblage de rail coulissant sur les trous de montage des montants avant et arrière du rack. Verrouillez ensuite l’assemblage en poussant ce dernier vers l’arrière du rack jusqu’à ce que les broches de montage s’engagent dans le rack. Un déclic sonore signale que les broches de montage sont fermement clipsées dans le rack.Installation du serveur 27 Les broches de montage de l’assemblage coulissant sont compatibles avec les trous de montage carrés de 9,5 mm ou les trous ronds M6. Aucune autre taille de trou de montage n’est prise en charge.28 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 4. (Facultatif) Si vous avez choisi de fixer l’assemblage de rail coulissant au rack au moyen de vis, faites passer les vis M6 à travers les supports avant et arrière du rail coulissant et les montants du rack, puis fixez-les aux montants du rack à l’aide des écrous à cage. 5. Répétez la procédure de l’étape 2 à étape 4 pour l’autre assemblage de rail coulissant. Attention – Si votre rack n’est pas équipé d’un dispositif antibasculement, le rack pourrait basculer lors de l’installation du serveur. 6. Le cas échéant, étendez les pattes ou la barre antibasculement située sous le rack. Pour des instructions, consultez la documentation du rack. Pour plus d’informations à ce sujet, reportez-vous à la section « Pour stabiliser le rack à installer », page 22. Informations connexes ¦ « Pour désassembler les rails coulissants », page 22 ¦ « Pour installer des supports de montage », page 24 ¦ « Pour installer le serveur dans les assemblages de rails coulissants », page 29Installation du serveur 29 ? Pour installer le serveur dans les assemblages de rails coulissants Suivez cette procédure pour installer le châssis du serveur, au moyen de supports de montage, dans les assemblages de rails coulissants installés dans le rack. Attention – Cette procédure nécessite au moins deux personnes en raison du poids du serveur. Si vous tentez d’effectuer seul cette opération, vous risquez de vous blesser ou d’endommager l’équipement. Attention – Les équipements doivent toujours être chargés dans un rack en partant du bas vers le haut, afin de ne pas alourdir la partie supérieure, ce qui risquerait de faire basculer le rack. Déployez la barre ou les pattes antibasculement du rack pour empêcher celui-ci de basculer pendant l’installation du matériel. Pour plus d’informations, reportez-vous à la section « Pour stabiliser le rack à installer », page 22. 1. Poussez aussi loin que possible les rails coulissants dans les assemblages du rack.30 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 2. Soulevez le serveur de manière à aligner les extrémités arrière des supports de montage sur les assemblages de rails coulissants montés dans le rack. 3. Insérez les supports de montage dans les rails coulissants, puis poussez le serveur dans le rack jusqu’à ce que les supports de montage heurtent les butées des rails coulissants (environ 30 cm). Attention – Lors du placement du serveur dans le rail coulissant, assurez-vous que les rebords supérieur et inférieur des supports de montage sont bien insérés dans le rail. Le serveur doit facilement glisser en avant et en arrière s’il est installé correctement. Si l’unité ne glisse pas facilement, vérifiez que les bords de montage sont insérés correctement. Si les supports de montage ne sont pas insérés correctement, l’unité risque de tomber lorsque vous la retirez du rack.Installation du serveur 31 4. Maintenez enfoncés les boutons de déverrouillage verts des rails coulissants situés sur chaque support de montage tout en enfonçant le serveur dans le rack. Continuez à pousser jusqu’à ce que les verrous des rails coulissants (situés à l’avant des supports de montage) s’engagent dans les assemblages. Vous entendez alors un déclic sonore. Attention – Avant de continuer, vérifiez que le serveur est fermement installé dans le rack et que les verrous des rails coulissants sont engagés dans les supports de montage. Informations connexes ¦ « Pour désassembler les rails coulissants », page 22 ¦ « Pour installer des supports de montage », page 24 ¦ « Pour fixer les assemblages de rails coulissants », page 25 ¦ « Pour installer le bras de gestion des câbles », page 32 ¦ « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 3632 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour installer le bras de gestion des câbles Le bras de gestion des câbles est un assemblage optionnel que vous pouvez utiliser pour acheminer les câbles du serveur dans le rack. 1. Déballez les pièces du bras de gestion des câbles. 2. Amenez le bras de gestion des câbles à l’arrière du rack de l’équipement et assurez-vous d’avoir suffisamment de place pour travailler à l’arrière du serveur. Remarque – Les indications « gauche » ou « droite » figurant de cette procédure supposent que vous vous trouvez face à l’arrière du rack d’équipement. 3. Enlevez le ruban adhésif pour séparer les pièces du bras de gestion des câbles. 4. Insérez le connecteur du support de montage du CMA dans le rail coulissant droit jusqu’à ce que le connecteur s’enclenche avec un déclic sonore. FIGURE : Insertion du support de montage du bras de gestion des câbles à l’arrière du rail coulissant droit Légende de la figure 1 Support de montage du CMA 2 Rail coulissant droitInstallation du serveur 33 5. Insérez le connecteur droit du support de montage du CMA dans le rail coulissant droit jusqu’à ce que le connecteur s’enclenche avec un déclic sonore. FIGURE : Insertion du connecteur de rail coulissant CMA à l’arrière du rail coulissant droit Légende de la figure 1 Connecteur du rail coulissant CMA 2 Rail coulissant droit34 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 6. Insérez le connecteur gauche du support de montage CMA dans le rail coulissant gauche jusqu’à ce que le connecteur s’enclenche avec un déclic sonore. FIGURE : Insertion du connecteur de rail coulissant CMA à l’arrière du rail coulissant gauche 7. Installez et acheminez les câbles vers votre serveur en fonction de vos besoins. Remarque – Des instructions d’installation des câbles du serveur sont fournies à la section « Connexion des câbles du serveur », page 37. 8. Si nécessaire, fixez les crochets et les brides pour câbles au CMA, puis resserrez-les pour fixer les câbles. Légende de la figure 1 Connecteur du rail coulissant CMA 2 Rail coulissant gaucheInstallation du serveur 35 Remarque – Les crochets et brides pour câbles sont préinstallés sur le CMA. Effectuez la procédure de cette étape si vous devez réinstaller les crochets et brides de suspension de câble sur le CMA. Pour obtenir de meilleurs résultats, placez trois brides de câble, régulièrement espacées, sur le côté faisant face à l’arrière du CMA et trois brides sur le côté du CMA le plus proche du serveur. FIGURE : Installation des brides pour câbles du CMA Informations connexes ¦ « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 36 ¦ « Pour fixer les câbles au bras de gestion des câbles », page 50 Légende de la figure 1 CMA, brides pour câbles 2 CMA, bras de gestion des câbles36 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour vérifier le fonctionnement des rails coulissants et du CMA Suivez la procédure ci-dessous pour vérifier que les rails coulissants et le bras de gestion des câbles fonctionnent correctement. Remarque – Cette procédure nécessite deux personnes : une pour tirer et pousser le serveur dans le rack, l’autre pour observer les câbles et le bras de gestion des câbles. 1. Sortez lentement le serveur du rack jusqu’à ce que les rails coulissants arrivent en fin de course. 2. Inspectez les câbles raccordés pour vérifier qu’ils ne sont ni pliés ni tordus. 3. Vérifiez qu’il est possible de déployer complètement le bras de gestion des câbles à partir des rails coulissants. 4. Repoussez le serveur dans le rack, de la manière suivante : Lorsque le serveur est complètement sorti, vous devez dégager deux butées de rail coulissant pour ramener le serveur dans le rack : a. Le premier ensemble de butées est constitué de leviers, placés à l’intérieur de chaque rail coulissant, juste derrière le panneau arrière du serveur. Poussez les deux leviers verts simultanément et faites glisser le serveur vers le rack. Le serveur doit s’enfoncer d’environ 46 cm avant de s’arrêter. Avant de continuer, vérifiez que les câbles et le CMA se rétractent sans coincer. b. Le second ensemble de butées est composé de boutons de déverrouillage du rail coulissant, situés à proximité de l’avant de chaque support de montage. Poussez simultanément les deux boutons verts de déverrouillage du rail coulissant et repoussez complètement le serveur à l’intérieur du rack jusqu’à l’enclenchement des deux verrouillages de rail coulissant. 5. Ajustez les brides des câbles et le bras de gestion des câbles le cas échéant. Informations connexes ¦ « Pour installer le bras de gestion des câbles », page 32 ¦ « Pour fixer les câbles au bras de gestion des câbles », page 5037 Connexion des câbles du serveur Connectez et configurez les ports réseau et série avant de tenter d’initialiser le serveur. ¦ « Câblage requis », page 38 ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Pour connecter le câble SER MGT », page 41 ¦ « Pour connecter le câble NET MGT », page 42 ¦ « Pour connecter les câbles réseau Ethernet », page 43 ¦ « Pour connecter les câbles du module réseau », page 44 ¦ « Pour connecter d’autres câbles de données », page 48 ¦ « Pour préparer les cordons d’alimentation », page 48 ¦ « Pour fixer les câbles au bras de gestion des câbles », page 50 Informations connexes ¦ « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 36 ¦ « Composants du panneau arrière », page 1338 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Câblage requis Avant de câbler et de mettre sous tension le serveur, rassemblez les informations suivantes concernant le réseau : ¦ Masque de réseau ¦ Adresse IP du processeur de service ¦ Adresse IP de la passerelle Vous devez, au minimum, connecter les câbles à ces ports avant la première mise sous tension du serveur : ¦ Port SER MGT du SP ¦ Port NET MGT du SP ¦ Un port réseau Ethernet intégré au système au minimum ¦ Câbles d’alimentation pour les ports d’entrée Informations connexes ¦ « Pour connecter le câble SER MGT », page 41 ¦ « Pour connecter le câble NET MGT », page 42 ¦ « Pour connecter les câbles réseau Ethernet », page 43 ¦ « Pour préparer les cordons d’alimentation », page 48 ¦ « Pour mettre le système sous tension pour la première fois », page 58Connexion des câbles du serveur 39 Connecteurs et ports du panneau arrière N° Port de câble ou connecteur d’extension Description 1 Entrée CA de l’alimentation 0 Utilisez les cordons d’alimentation CA fournis ou des cordons compatibles. Remarque - Ne raccordez pas de cordons d’alimentation aux alimentations tant que vous n’avez pas terminé de raccorder les câbles de données et que vous n’avez pas connecté le serveur à un terminal série ou à un émulateur de terminal série (PC ou station de travail). 2 Entrée CA de l’alimentation 1 3 Port QSFD du module réseau 10 Gbits du serveur SPARC T3-2 Le port QSFD de la carte du module réseau 10 Gbits du serveur SPARC T3-2 fournit quatre connexions 10 Gbits avec un transcepteur et un câble compatibles. 4 Ports réseau 10/100/1000 (NET0, NET1, NET2 et NET3) Les quatre ports Gigabit Ethernet vous permettent de connecter le système au réseau. Remarque - Grâce à la fonction de gestion sideband d’ILOM, vous pouvez accéder au SP à partir de l’un de ces ports. Pour des instructions, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. 5 Ports USB (USB 0, USB 1) Les deux ports USB prennent en charge l’enfichage à chaud. Vous pouvez connecter et déconnecter les câbles USB et les unités périphériques pendant que le serveur fonctionne, sans que cela n’ait d’incidence sur les opérations système. Remarque - Vous pouvez connecter jusqu’à 126 périphériques à chacun des quatre contrôleurs USB (deux ports à l’avant et deux autres à l’arrière), pour un total de 504 périphériques USB par serveur.40 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Informations connexes ¦ « Câblage requis », page 38 ¦ « Pour fixer les câbles au bras de gestion des câbles », page 50 6 Port vidéo DB-15 Utilisez un câble vidéo DB-15 pour vous connecter à un périphérique vidéo. 7 Port Ethernet NET MGT du SP Le port de gestion réseau constitue une connexion facultative au SP ILOM. Le port de gestion réseau du processeur de service utilise un câble RJ-45 pour une connexion 10/100 BASE-T. Si le réseau n’utilise pas le protocole DHCP, ce port ne sera pas disponible tant que vous n’aurez pas configuré les paramètres réseau via le port SER MGT du SP. Remarque - Ce port ne prend pas en charge les connexions établies avec des réseaux Gigabit. 8 SP, port SER MGT Le port de gestion série utilise un câble RJ-45 et est toujours disponible. Il constitue la connexion par défaut au contrôleur système ILOM. N° Port de câble ou connecteur d’extension DescriptionConnexion des câbles du serveur 41 ? Pour connecter le câble SER MGT Le port de gestion série du processeur de service est étiqueté SER MGT. Utilisez le port SER MGT du SP uniquement pour la gestion de serveurs. Ce port constitue la connexion par défaut entre le processeur de service et un terminal ou un ordinateur. Utilisez ce port pour la gestion de serveurs. Attention – Ne connectez pas de modem à ce port. ? Utilisez un câble de catégorie 5 (ou supérieure) pour connecter le port SER MGT à un périphérique terminal. Lors du branchement d’un câble DB-9, servez-vous d’un adaptateur pour effectuer les croisements relatifs à chaque connecteur. Informations connexes ¦ « Pour connecter le câble NET MGT », page 42 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 56 ¦ « Port SER MGT », page 6742 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour connecter le câble NET MGT Le port de gestion réseau du processeur de service est étiqueté NET MGT. Après la phase de configuration initiale du serveur, vous pouvez établir des connexions avec le processeur de service via un réseau Ethernet au moyen de ce port NET MGT. Si le réseau utilise un serveur DHCP pour assigner les adresses IP, ce serveur affectera une adresse IP à ce port NET MGT. Cette adresse IP vous permet de vous connecter au processeur de service via une connexion SSH. Si le réseau n’utilise pas le protocole DHCP, ce port NET MGT ne sera pas accessible tant que vous n’aurez pas configuré les paramètres réseau via le port SER MGT. Pour des instructions, reportez-vous à la section « Pour assigner une adresse IP statique au SP », page 62. ? Connectez le port NET MGT au commutateur ou hub de votre réseau au moyen d’un câble de catégorie 5 (ou supérieure). Informations connexes ¦ « Pour connecter les câbles réseau Ethernet », page 43 ¦ « Pour assigner une adresse IP statique au SP », page 62 ¦ « Port NET MGT », page 68Connexion des câbles du serveur 43 ? Pour connecter les câbles réseau Ethernet Le serveur est équipé de quatre connecteurs réseau Gigabit Ethernet étiquetés NET0, NET1, NET2 et NET3. Utilisez ces ports pour connecter le serveur au réseau. Remarque – La fonction de gestion sideband d’ILOM vous permet d’accéder au SP à partir de l’un de ces ports Ethernet. Pour des instructions, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. 1. Utilisez un câble de catégorie 5 (ou supérieure) pour connecter le commutateur ou hub réseau au port Ethernet 0 (NET0) situé à l’arrière du châssis. 2. Connectez le commutateur ou hub réseau aux ports Ethernet restants (NET1, NET2 et NET3), selon les besoins, au moyen de câbles de catégorie 5 (ou supérieure). Informations connexes ¦ Guide d’administration des serveurs de la série SPARC T3 ¦ « Mise sous tension initiale du serveur », page 53 ¦ « Ports Gigabit Ethernet », page 6944 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour connecter les câbles du module réseau La carte du module réseau 10 Gbits (optionnelle) du serveur SPARC T3-2 fournit quatre connexions réseau 10 GbE avec un module transcepteur QSFP compatible. 1. Retirez le module transcepteur de son emballage et posez-le sur un tapis antistatique. 2. Retirez le capuchon protecteur du module transcepteur. 3. Ouvrez la poignée de verrouillage du module transcepteur jusqu’à ce qu’elle se mettre bien en place en émettant un déclic.Connexion des câbles du serveur 45 4. Alignez le module transcepteur sur l’emplacement QSFP comme illustré dans la figure suivante. 5. En tenant le module transcepteur par ses bords, faites-le glisser délicatement dans l’emplacement QSFP. 6. Exercez une pression uniforme sur le haut et le bas du module transcepteur et enfoncez ce dernier jusqu’à ce qu’il soit bien en place.46 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 7. Verrouillez la poignée en position fermée en appuyant dessus afin de bloquer le module transcepteur. Remarque – Si vous ouvrez la poignée de verrouillage lorsque le module transcepteur est en cours d’installation, retirez entièrement le module et réinstallez-le. La poignée actionne un verrou interne. L’ouverture de la poignée peut déconnecter le module transcepteur, même si celui-ci semble connecté.Connexion des câbles du serveur 47 8. Branchez le câble dans le connecteur. Vérifiez que la poignée se trouve en position de verrouillage, puis connectez le câble au module transcepteur. Informations connexes ¦ Documentation relative au matériel réseau ¦ « Port QSFP », page 7348 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour connecter d’autres câbles de données Si votre configuration serveur comprend des cartes PCIe optionnelles, branchez les câbles d’E/S appropriés sur les connecteurs correspondants. ? Si votre configuration serveur comprend des cartes PCIe optionnelles, branchez les câbles d’E/S appropriés sur les connecteurs correspondants. Pour des instructions spéci?ques, reportez-vous à la documentation de la carte PCIe. Informations connexes ¦ Documentation de la carte PCIe ¦ SPARC T3-2 Server Service Manual ? Pour préparer les cordons d’alimentation Préparez les cordons d’alimentation en les acheminant de la source d’alimentation CA vers le serveur. Attention – Ne raccordez pas de câbles d’alimentation aux alimentations tant que vous n’avez pas connecté le serveur à un terminal série ou à un émulateur de terminal série (PC ou station de travail). Remarque – Le serveur passe en mode veille et le processeur de service ILOM s’initialise dès qu’une alimentation est connectée à une source de courant externe par un câble. Les messages système peuvent se perdre après une minute si un terminal ou un émulateur de terminal n’est pas connecté au port SER MGT avant la mise sous tension. Remarque – ILOM va signaler une erreur si les deux alimentations ne sont pas câblées en même temps, car il s’agira d’une condition de non-redondance.Connexion des câbles du serveur 49 1. Assurez-vous que les disjoncteurs sont éteints sur la source d’alimentation CA. Pour des instructions, reportez-vous à la documentation de la source d’alimentation secteur. 2. Acheminez les cordons d’alimentation de la source d’alimentation CA vers l’arrière du serveur. Ne reliez pas les cordons d’alimentation aux alimentations pour le moment. Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Mise sous tension initiale du serveur », page 5350 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour fixer les câbles au bras de gestion des câbles Après avoir connecté les câbles du serveur, fixez-les au bras de gestion des câbles. 1. Ouvrez les attaches de câble et les brides de boucle du bras de gestions des câbles. 2. Acheminez les câbles du serveur à l’aide des attaches de câble et les brides de boucle. 3. Fixez les câbles au bras de gestion des câbles en fermant les attaches et en serrant les brides. 4. Vérifiez le fonctionnement des rails coulissants et du bras de gestion des câbles. Reportez-vous à la section « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 36.Connexion des câbles du serveur 51 Informations connexes ¦ « Pour installer le bras de gestion des câbles », page 32 ¦ « Pour vérifier le fonctionnement des rails coulissants et du CMA », page 36 ¦ « Connecteurs et ports du panneau arrière », page 3952 Guide d’installation du serveur SPARC T3-2 • Novembre 201053 Mise sous tension initiale du serveur Les rubriques suivantes contiennent des instructions de mise sous tension initiale du serveur et de configuration du SE Oracle Solaris. Ce chapitre aborde les sujets suivants : ¦ « Tâches de mise sous tension », page 54 ¦ « Console système ILOM », page 55 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 56 ¦ « Pour mettre le système sous tension pour la première fois », page 58 ¦ « Paramètres de configuration du SE Oracle Solaris », page 61 ¦ « Pour assigner une adresse IP statique au SP », page 62 Informations connexes ¦ « Préparation de l’installation », page 1 ¦ « Installation du serveur », page 19 ¦ « Connexion des câbles du serveur », page 3754 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Tâches de mise sous tension Lorsque vous mettez sous tension le serveur pour la première fois, vous devez suivre plusieurs étapes qui ne vous seront plus demandées lors des mises sous tension ultérieures. Informations connexes ¦ « Connexion des câbles du serveur », page 37 N° Étape Objectif Liens 1 Connectez un terminal ou un émulateur de terminal au port SER MGT. Cette étape permet de se connecter au processeur de service avant qu’il ne soit configuré pour l’accès réseau. « Pour connecter un terminal ou un émulateur au port SER MGT », page 56 2 Connectez-vous au processeur de service et modifiez le mot de passe root par défaut. Modifiez le mot de passe root par défaut afin de protéger le système des accès non autorisés. « Pour mettre le système sous tension pour la première fois », page 58 3 Démarrez la console système ILOM. Cette étape vous permet de contrôler les messages d’initialisation système du microprogramme ILOM. « Pour mettre le système sous tension pour la première fois », page 58 4 Configurez le SE Oracle Solaris. Après la mise sous tension du serveur, vous serez invité à configurer le système d’exploitation Oracle Solaris préinstallé. « Pour mettre le système sous tension pour la première fois », page 58 « Paramètres de configuration du SE Oracle Solaris », page 61Mise sous tension initiale du serveur 55 Console système ILOM Lorsque vous mettez le système sous tension, le processus d’initialisation commence sous le contrôle de la console système ILOM. Celle-ci affiche les messages de statut et d’erreur générés par les tests effectués par le microprogramme pendant le démarrage du système. Remarque – Pour af?cher ces messages de statut et d’erreur, connectez un terminal ou un émulateur de terminal au port SER MGT avant de mettre le serveur sous tension. Une fois que la console système a terminé ses diagnostics système de bas niveau, le processeur de service initialise et exécute une série de diagnostics d’un niveau supérieur. Lorsque vous accédez au processeur de service au moyen d’un périphérique connecté au port de gestion série, la sortie des diagnostics ILOM est générée. Par défaut, le processeur de service configure automatiquement le port de gestion réseau, récupérant les paramètres de configuration réseau à l’aide du protocole DHCP et autorisant les connexions via un shell sécurisé. Pour une description plus détaillée de la configuration de la console système et de la connexion à des terminaux, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. Informations connexes ¦ Guide d’administration des serveurs de la série SPARC T3 ¦ Documentation d’ILOM ¦ « Pour mettre le système sous tension pour la première fois », page 58 ¦ « Pour assigner une adresse IP statique au SP », page 6256 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour connecter un terminal ou un émulateur au port SER MGT Avant la mise sous tension initiale du serveur, établissez une connexion série avec le processeur de service. Une fois la connexion série établie, vous pourrez afficher les messages système dès que vous aurez relié les cordons d’alimentation. 1. Vérifiez la totalité des étapes de préparation à l’installation. Reportez-vous aux instructions de la section « Préparation de l’installation », page 1. 2. Vérifiez que vous avez bien effectué toutes les étapes d’installation du serveur dans un rack. Reportez-vous aux instructions de la section « Connexion des câbles du serveur », page 37. 3. Connectez un terminal ou un émulateur de terminal (PC ou station de travail) au port de gestion série du processeur de service. Configurez ce terminal ou cet émulateur de terminal avec les paramètres suivants : ¦ 9 600 bauds ¦ 8 bits ¦ Pas de parité ¦ 1 bit d’arrêt ¦ Pas de protocole de transfert Une configuration de type inverseur est requise, signifiant que les signaux de transmission et de réception sont inversés (croisés) pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. Remarque – Si, lorsque vous mettez pour la première fois le système sous tension, aucun terminal ou émulateur de terminal (PC ou station de travail) n’est connecté au port SER MGT du SP, les messages système ne sont pas visibles.Mise sous tension initiale du serveur 57 4. Poursuivez l’installation en mettant le serveur sous tension pour la première fois. Reportez-vous à la section « Pour mettre le système sous tension pour la première fois », page 58. Informations connexes ¦ « Pour connecter le câble SER MGT », page 41 ¦ « Pour mettre le système sous tension pour la première fois », page 5858 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 ? Pour mettre le système sous tension pour la première fois 1. Vérifiez que vous avez bien installé le serveur dans un rack et branché tous les câbles de données. Pour obtenir des instructions, reportez-vous aux sections : ¦ « Installation du serveur », page 19 ¦ « Connexion des câbles du serveur », page 37 2. Vérifiez que vous avez bien établi une connexion série avec le processeur de service. Pour des instructions, reportez-vous à la section « Pour connecter un terminal ou un émulateur au port SER MGT », page 56. Remarque – Si, lorsque vous mettez pour la première fois le système sous tension, aucun terminal ou émulateur de terminal (PC ou station de travail) n’est connecté au port SER MGT du SP, les messages système ne sont pas visibles. 3. (Facultatif) Reliez au moyen d’un câble Ethernet le port Net MGT du serveur au réseau avec lequel les futures connexions au SP et à l’hôte seront établies. Remarque – Une fois la configuration initiale du système effectuée à l’aide du port SER MGT du SP, la communication avec le SP et l’hôte est généralement assurée par le biais de cette interface Ethernet. 4. Reliez au moyen d’un câble Ethernet l’un des ports Gigabit Ethernet du serveur au réseau avec lequel le serveur communiquera. Pour des instructions, reportez-vous à la section « Pour connecter les câbles réseau Ethernet », page 43. 5. Branchez les cordons d’alimentation sur les alimentations et des sources de courant distinctes. Pour assurer la redondance, branchez les deux alimentations sur des sources de courant distinctes. Le système peut fonctionner avec une seule connexion d’alimentation, mais il ne bénéficie alors d’aucune redondance. Le processeur de service fonctionne selon une tension de veille de 3,3 V. Dès que l’alimentation CA est reliée au système, la DEL OK/de panne du SP se met à clignoter sur le panneau avant lorsque le processeur de service est mis sous tension, exécute des diagnostics et initialise le microprogramme ILOM.Mise sous tension initiale du serveur 59 FIGURE : DEL d’alimentation principale et du SP sur le panneau avant Une fois le microprogramme ILOM initialisé, la DEL OK/Panne du SP reste allumée, la DEL OK/Panne de l’alimentation principale se met à clignoter lentement et l’invite de connexion du SP s’affiche sur le périphérique terminal. L’hôte n’est pas encore initialisé ou mis sous tension. 6. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM. Vous trouverez des informations supplémentaires sur le SP (modification du mot de passe, configuration des paramètres réseau, etc.) dans la documentation en ligne d’ILOM. Légende de la figure 1 DEL d’alimentation principale/OK 2 DEL OK/Panne du SP XXXXXXXXXXXXXXXX login: root Password: changeme . . . ->60 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 7. Mettez le serveur sous tension et redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console hôte du SP démarrée, l’initialisation du serveur prend une vingtaine de minutes. 8. Lorsque vous y êtes invité, suivez les instructions de configuration du système d’exploitation Oracle Solaris sur l’hôte et spécifiez les informations de configuration suivantes. Vous êtes invité à confirmer la configuration à plusieurs reprises, ce qui vous permet de confirmer ou de modifier des paramètres. Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la lorsque le SE Oracle Solaris est exécuté. Pour plus d’informations, reportez-vous à la section « Paramètres de configuration du SE Oracle Solaris », page 61. 9. Connectez-vous au serveur et explorez ses fonctions. Il comprend de nombreuses commandes vous permettant de vérifier les fonctionnalités du système, notamment les suivantes : ¦ showrev : affiche le nom d’hôte et des informations sur l’architecture du système. Utilisez l’option -a avec cette commande pour afficher les patchs installés. ¦ psrinfo : affiche des informations sur le nombre et le statut des processeurs et noyaux de l’hôte. ¦ prtdiag : af?che des informations de diagnostic et sur la con?guration système. Pour plus d’informations, consultez les pages de manuel et la documentation du SE Oracle Solaris. Informations connexes ¦ Documentation relative à Oracle Solaris ¦ Guide d’administration des serveurs de la série SPARC T3 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 56 -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. To stop, type #. . . .Mise sous tension initiale du serveur 61 Paramètres de configuration du SE Oracle Solaris Lors de la configuration du SE Oracle Solaris, vous êtes invité à définir les paramètres de configuration suivants. Pour plus d’informations sur ces paramètres, reportez-vous à la documentation d’Oracle Solaris. Paramètre Description Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui). Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. Si vous avez des doutes, sélectionnez la première de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur. IP Address (Adresse IP) Tapez l’adresse IP de l’interface Ethernet. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Subnet Netmask (Masque de sous-réseau) Si votre réponse à la question Subnet? étant affirmative, indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Lorsque vous y êtes invité, vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires.62 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Informations connexes ¦ Documentation relative au SE Oracle Solaris ¦ « Pour mettre le système sous tension pour la première fois », page 58 ? Pour assigner une adresse IP statique au SP Si votre réseau utilise le protocole DHCP pour assigner des adresses IP, le périphérique DHCP affectera automatiquement une adresse IP au processeur de service. Si le réseau n’utilise pas le protocole DHCP, suivez cette procédure pour assigner une adresse IP statique au processeur de service. Remarque – Pour plus d’informations sur la configuration d’ILOM, reportez-vous au Guide d’administration des serveurs de la série SPARC T3 et à la documentation d’ILOM. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. Si vous avez des doutes, sélectionnez Use the NFSv4 domain derived by the system (Utiliser le domaine NFSv4 dérivé par le système). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Tapez deux fois le mot de passe root. Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP. Paramètre DescriptionMise sous tension initiale du serveur 63 1. Connectez-vous au processeur de service via un câble série relié au port SER MGT. Pour des instructions sur les connexions série, reportez-vous à la section « Pour connecter un terminal ou un émulateur au port SER MGT », page 56. Connectez-vous au processeur de service en tant qu’utilisateur root (changeme étant le mot de passe root par défaut) afin d’afficher l’invite (->) d’ILOM. 2. Définissez le processeur de service pour qu’il accepte une adresse IP statique. 3. Définissez l’adresse IP du processeur de service. 4. Définissez l’adresse IP de la passerelle du processeur de service. 5. Définissez le masque de réseau du processeur de service. Cet exemple utilise 255.255.255.0 pour définir le masque de réseau. Le sous-réseau de votre environnement réseau peut exiger un masque de réseau différent. Utilisez un numéro de masque de réseau approprié à votre environnement. hostname login: root Password: password (nothing displayed) Oracle(R) Integrated Lights Out Manager Version 3.0.12.2 Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. Warning: password is set to factory default. -> -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0'64 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 6. Exécutez la commande show /SP/network -display properties pour vérifier que les paramètres ont été définis correctement. L’exemple de code suivant indique les paramètres qui ont été configurés pour convertir un processeur de service d’une configuration DHCP en configuration statique. Remarque – Une fois les paramètres de configuration définis, vous devez exécuter la commande set /SP/network commitpending=true pour que les nouvelles valeurs soient appliquées. 7. Validez les modifications apportées aux paramètres réseau du processeur de service. Remarque – Vous pouvez réexécuter la commande show /SP/network (après la commande set /SP/network commitpending=true) afin de vérifier que les paramètres ont bien été mis à jour. Informations connexes ¦ Guide d’administration des serveurs de la série SPARC T3 ¦ Documentation d’ILOM -> show /SP/network -display properties /SP/network Properties: commitpending = (Cannot show property) dhcp_server_ip = none ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.255.0 macaddress = 00:21:28:6F:A7:BB managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:6F:A7:BB pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:21:F8:6F:A7:BA state = enabled -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'65 Identification des ports du serveur Les rubriques suivantes présentent une description des broches du ports du serveur. ¦ « Ports USB », page 66 ¦ « Port SER MGT », page 67 ¦ « Port NET MGT », page 68 ¦ « Ports Gigabit Ethernet », page 69 ¦ « Ports vidéo », page 70 ¦ « Connecteurs SAS », page 71 ¦ « Port QSFP », page 73 Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Connexion des câbles du serveur », page 3766 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Ports USB Il est possible d’accéder à deux ports USB à partir de l’avant du serveur et à deux autres depuis l’arrière. FIGURE : Connecteur USB Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 Légende de la figure 1 Alimentation +5 V 3 Données + 2 Données - 4 TerreIdentification des ports du serveur 67 Port SER MGT Le port RJ-45 SER MGT, situé sur le panneau arrière, fournit une connexion par défaut à la console système. FIGURE : Port SER MGT Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Pour connecter le câble SER MGT », page 41 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 56 Légende de la figure 1 Prêt à émettre 5 Terre 2 Détection de porteuse de données 6 Réception de données 3 Transmission de données 7 Terminal de données prêt 4 Terre 8 Prêt à envoyer68 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Port NET MGT Le port RJ-45 NET MGT, situé à l’arrière, fournit une connexion Ethernet optionnelle au processeur de service. FIGURE : Port NET MGT Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Pour connecter le câble NET MGT », page 42 ¦ « Pour assigner une adresse IP statique au SP », page 62 Légende de la figure 1 Transmission de données + 5 Pas de connexion 2 Transmission de données - 6 Réception de données - 3 Réception de données + 7 Pas de connexion 4 Pas de connexion 8 Pas de connexionIdentification des ports du serveur 69 Ports Gigabit Ethernet Quatre connecteurs Gigabit Ethernet RJ-45 (NET0, NET1, NET2 et NET3) sont accessibles depuis le panneau arrière. Les interface Ethernet fonctionnent aux vitesses de 10 Mbit/s, 100 Mbit/s et 1000 Mbit/s. FIGURE : Port Gigabit Ethernet Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Pour connecter les câbles réseau Ethernet », page 43 Légende de la figure 1 Transmission/Réception de données 0 + 5 Transmission/Réception de données 2 – 2 Transmission/Réception de données 0 – 6 Transmission/Réception de données 1 – 3 Transmission/Réception de données 1 + 7 Transmission/Réception de données 3 + 4 Transmission/Réception de données 2 + 8 Transmission/Réception de données 3 –70 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Ports vidéo Le serveur dispose de deux ports vidéo VGA à 15 broches, un situé à l’avant et l’autre à l’arrière. FIGURE : Connecteur vidéo Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 Légende de la figure 1 Vidéo rouge 9 +5 V 2 Vidéo vert 10 Synchronisation terre 3 Vidéo bleu 11 ID du moniteur - Bit 0 (terre) 4 ID de moniteur - Bit 2 (terre) 12 Données série VGA 12C 5 Terre 13 Synchronisation horizontale 6 Terre rouge 14 Synchronisation verticale 7 Terre vert 15 Horloge série VGA 12C 8 Terre bleuIdentification des ports du serveur 71 Connecteurs SAS Les six connecteurs SAS sont situés sur le backplane d’unités à l’intérieur du serveur. FIGURE : Connecteur SAS Le tableau suivant dresse la liste des broches du connecteur SAS. TABLEAU : Brochage du connecteur SAS Segment de signal S1 GND Deuxième couplage S2 TX+ Transmission de PHY vers le disque dur S3 TXS4 GND Deuxième couplage S5 RX- Réception du disque dur vers PHY S6 RX+ S7 GND Deuxième couplage Signal côté arrière S8 GND Deuxième couplage S9 S10 S11 GND Deuxième couplage S12 S13 S14 GND Deuxième couplage72 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Informations connexes ¦ SPARC T3-2 Server Service Manual Segment alimentation P1 3,3 V Non pris en charge P2 3,3 V Non pris en charge P3 3,3 V Non pris en charge P4 GND Premier couplage P5 GND Deuxième couplage P6 GND Deuxième couplage P7 5 V Préchargement, deuxième couplage P8 5 V P9 5 V P10 GND Deuxième couplage P11 Réservé Mise à la terre conseillée P12 GND Premier couplage P13 12 V Préchargement, deuxième couplage P14 12 V P15 12 V TABLEAU : Brochage du connecteur SAS (suite)Identification des ports du serveur 73 Port QSFP La carte du module réseau 10 Gbits du serveur SPARC T3-2 d’Oracle contient un port QSFP. Le tableau suivant répertorie les broches associées à chaque connexion. Broche Signal Broche Signal Broche Signal Broche Signal 1 GND 11 SCL 21 RX2n 31 Réservé 2 TX2n 12 SDA 22 RX2p 32 GND 3 TX2p 13 GND 23 GND 33 TX3p 4 GND 14 RX3p 24 RX4n 34 TX3n 5 TX4n 15 RX3n 25 RX4p 35 GND 6 TX4p 16 GND 26 GND 36 TX1p 7 GND 17 RX1p 27 ModPrsL 37 TX1n 8 ModSelL 18 RX1n 28 IntL 38 GND 9 LPMode_Reset 19 GND 29 VccTx 10 VccRx 20 GND 30 Vcc174 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Le tableau suivant décrit les signaux QSFP. Informations connexes ¦ « Connecteurs et ports du panneau arrière », page 39 ¦ « Pour connecter les câbles du module réseau », page 44 Signal Description GND Mise à la terre du signal et du retour d’alimentation SDA Données d’interface I 2 C SCL Horloge d’interface I 2 C ModSelL Sélection du module sur faible - Réception de commandes I 2 C activée ResetL Réinitialisation sur niveau faible LPMode Mode d’économie d’énergie ModPrsL Présence du module sur niveau faible - Présence du connecteur QSFP identifiée IntL Interruption sur niveau faible - Identification de pannes activée75 Glossaire B BMC Baseboard Management Controller C CMA Cable management arm, bras de gestion des câbles D DHCP Dynamic Host Configuration Protocol DTE Data terminal equipment, équipement terminal de traitement des données E ESD Electrostatic discharge, décharge électrostatique76 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 H HBA Adaptateur de bus hôte I ILOM Oracle Integrated Lights Out Manager IP Internet Protocol IU Interface utilisateur N NET MGT Port de gestion réseau NIC Contrôleur ou carte d’interface réseau O Oracle Solaris (SE) Système d’exploitation Oracle Solaris P POST Power-On Self-Test, autotest de l’allumageGlossaire 77 Q QSFP Quad Small Form-Pactor pluggable S SAS Serial Attached SCSI SER MGT Port de gestion série SP Processeur de service SSD Solid-State Drive, disque dur électronique SSH Shell sécurisé U UUID Identifiant universel unique W WWID Identificateur universel. Numéro unique permettant d’identifier une cible SAS.78 Guide d’installation du serveur SPARC T3-2 • Novembre 201079 Index A Adaptateur pour câbles série, 41 Adresse IP Passerelle, 38 Processeur de service, 38 Statique, 62 Alimentation, 4, 7 CA, tâches de mise sous tension initiale, 54 Connexion des cordons, 58 DEL, 13 DEL de panne, emplacement, 13 Entrée CA, 39 Entrée d’alimentation, 14 Mise sous tension initiale, 54 Mode veille, 48 Assemblage de rails coulissants Arrêt, 36 Broches de montage, 26 Désassemblage, 22 Installation, 22, 25 Installation du serveur, 29 Véri?cation du fonctionnement, 36 B Bit d’arrêt, 56 Bit, paramètre du terminal série, 56 Bouton Localisation, 12 Marche/arrêt, emplacement, 12 Bras de gestion des câbles (CMA) Bride de câble, 35 Connecteur du rail coulissant, 34 Crochets et brides pour câbles, installation, 34 Fixation des câbles, 50 Installation, 32 Support de montage, 32 Véri?cation du fonctionnement, 36 Brochage Connecteur SAS, 71 Connecteur vidéo, 70 Port Ethernet, 69 Port NET MGT, 68 Port SER MGT, 67 Ports USB, 66 C CA normal, emplacement de la DEL, 13 Câblage Adaptateur pour câbles de données série, 41 Câbles de données optionnels, 48 Cartes PCIe, 48 Connexions requises, 38 Cordons d’alimentation, 48 Emplacement des ports arrière, 39 Fixation du bras de gestion des câbles, 50 Module réseau, 44 Port Ethernet, 43 Port NET MGT, 42 Port QSFP, 44 Port SER MGT, 41 Cartes PCIe Câblage, 48 Emplacements, 4, 14 Circulation de l’air, conditions requises, 10 CMA Voir Bras de gestion des câbles (CMA) Composants optionnels, instructions d’installation, 18 Conditions environnementales requises, 7 Con?guration Informations requises, 38 Oracle Solaris (SE), 61 Connecteur vidéo Arrière, 1480 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Avant, 12 Brochage, 70 Description, 3 Emplacement, 40 Contenu du kit de livraison, 11 Cordons d’alimentation, câblage, 48 CPU, description, 3 D DEL Alimentation principale/OK, 12, 59 Avertissement de surchauffe, 13 Bouton de localisation, 12 Bouton de marche/arrêt/OK, 12 CA normal, 13 OK/Panne du SP, 12, 58 Opération de maintenance requise, 12 Panne d’alimentation, 13 SP, OK/Panne, 12, 58 Statut du système, 14 DHCP, 42, 62 Diagnostic, 58 DIMM, description, 3 Dissipation d’énergie, chiffres, 6 E Émissions sonores, 9 G Gestion sideband, 43 H Humidité relative ambiante, 7 I ILOM, 55 Informations sur la puissance d’entrée, 7 Installation Assemblage de rails coulissants, 25 Bras de gestion des câbles (CMA), 32 Composants optionnels, 18 Présentation des tâches, 2 Serveur dans un rack, 19 Support de montage, 24 M Manipulation, précautions, 15 Masque de réseau, 38 Mémoire, description, 3 Mise sous tension initiale, 54 Module réseau, 4 Câblage, 44 Numéro d’emplacement, 14, 39 Montage en rack Assemblage de rails coulissants, 25 Arrêt, déverrouillage, 36 Avertissements de sécurité, 20 CMA Connecteur du rail coulissant, 33 Installation, 32 Crochets et brides pour câbles, 34 Installation des câbles, 34 Installation du serveur, 29 Kit, 19 Montage Supports, 24 Trous, 26 Pattes ou barre antibasculement, allongement, 22 Racks pris en charge, 20 Stabilisation du rack, 22 O Oracle Solaris (SE) Con?guration, 60 Paramètres de con?guration, 61 Outils nécessaires, 17 P Panneau arrière Composants, 13 Ports et connecteurs, 39 Paramètres du terminal série, 56 Parité du terminal série, aucune, 56 Passerelle, adresse IP, 38 Pieds ou barre antibasculement, 22 Plage de températures ambiantes, 7 Port de gestion du réseau (NET MGT) Adresse IP statique, 42 Brochage, 68 Câblage, 42Index 81 DHCP, 42 Emplacement, 14, 40 Port de gestion série (SER MGT), 14 Brochage, 67 Câblage, 41 Emplacement, 40 Mise sous tension initiale, 56 Port Ethernet, 4, 13 Brochage, 69 Câblage, 43 Emplacement, 39 Gestion sideband, 43 Port NET MGT Voir Port de gestion réseau (NET MGT) Ports USB, 3 Arrière, 14, 39 Avant, 13 Brochage, 66 En?chage à chaud, 39 Précautions contre les dommages électrostatiques, 16 Précautions de manipulation, 15 Présentation du serveur, 3 Processeur de service Adresse IP statique, 62 Connexion à un terminal, 56 Description, 4 DHCP, 62 Mise sous tension initiale, 58 set, commande, 63 show, commande, 64 start, commande, 60 Protocole de transfert du terminal série, aucun, 56 Q QSFP Brochage du connecteur, 73 Câblage, 44 Emplacement de carte NM, 39 Module transcepteur, 44 R Rack Compatibilité, 20 Montants, 25 Spéci?cations, 20 Stabilisation, 22 Trous de montage pris en charge, 20 S SAS, brochage connecteurs, 71 SER MGT, port Voir Port de gestion série (SER MGT) set, commande, 63 show /SP/network, commande, 64 show, commande, 64 Spéci?cations Circulation de l’air, 9 Conditions environnementales requises, 8 Électriques, 6 Émissions sonores, 9 Physiques, 5 Zones de refroidissement, 9 start, commande, 60 Support de montage Bouton de déverrouillage, 23 Broches, 24 Installation, 24 Installation du serveur, 29 Surchauffe DEL d’avertissement, 13 Éviter, 10 Système, emplacements des DEL de statut, 14 T Température requise, 8 U Unité, 3, 12 Unité de DVD, 12 V Veille Mode, 48 Tension, 58 Verrou de rail coulissant, 23 Vitesse de transmission du terminal série en bauds, 56 Z Zones de refroidissement, 982 Guide d’installation du serveur SPARC T3-2 • Novembre 2010 Serveurs de la série SPARC T3 Guide d’administration N° de référence : E26261 Octobre 2011, révision AProduit recyclable Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation ix Présentation des ressources de l’administration système 1 Présentation d’ILOM 1 Fonctions d’ILOM spécifiques à la plate-forme 3 Présentation du SE Oracle Solaris 4 Présentation d’OpenBoot 4 Présentation d’Oracle VM Server pour SPARC 5 Logiciel de multiacheminement 6 Présentation du pack de gestion du matériel 7 Source du téléchargement du logiciel HMP (pack de gestion du matériel) 8 Source du téléchargement de la documentation HMP (pack de gestion du matériel) 9 Accès au serveur 11 ? Pour se connecter à ILOM 11 ? Pour se connecter à la console système 12 ? Pour afficher l’invite ok 13 ? Pour afficher l’invite -> d’ILOM 15 ? Pour utiliser un moniteur graphique local 15 ILOM Remote Console 17iv Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Contrôle du serveur 19 ? Pour mettre le serveur sous tension 19 ? Pour mettre le serveur hors tension 20 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris 21 ? Pour réinitialiser le serveur à partir d’ILOM 22 ? Pour rétablir les valeurs par défaut du SP 23 Configuration de volumes RAID matériels 25 Prise en charge des volumes RAID matériels 25 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques 28 Affichage des informations de zone de disques 29 Etat des zones de disques (zoningcli list) 30 Etat des zones de disques (probe-scsi-all) 31 Activation et désactivation du zonage des disques dans le champ 33 ? Activation des zones de disques (commande zoningcli) 34 ? Désactivation des zones de disques (commande zoningcli) 34 ? Mise à jour du microprogramme pour activer le zonage 34 Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs 35 ? Pour préparer l’utilisation de l’utilitaire FCode 36 Commandes de l’utilitaire FCode 37 ? Pour créer un volume RAID matériel 38 Disques hot spare de volumes RAID (LSI) 39 Diagnostic de l'état de fonctionnement d'un disque 40 DEL avant du disque de service requis 40 Messages d'erreur (console système et fichiers journaux) 40 ? Affichage de l'état (commande show-volumes, OBP) 41 ? Affichage de l'état (utilitaire sas2ircu, LSI) 42Sommaire v Stratégies de remplacement d'un disque RAID 43 ? Pour identifier les chemins d’accès aux périphériques 43 Modification des informations d’identification du serveur 45 ? Pour modifier les informations sur les données FRU des clients 45 ? Pour modifier les informations d’identification du système 46 Configuration des paramètres de stratégie 47 ? Pour définir le mode de refroidissement 47 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage 48 ? Pour définir l’état d’alimentation de l’hôte au redémarrage 49 ? Pour désactiver ou réactiver le délai de mise sous tension 50 ? Pour définir l’initialisation parallèle du SP et de l’hôte 50 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé 51 Configuration des adresses réseau 53 Options d’adresse réseau du SP 53 ? Pour désactiver ou réactiver l’accès réseau au SP 54 ? Pour afficher l’adresse IP du serveur DHCP 54 ? Pour afficher l’adresse MAC de l’hôte 55 Utilisation d’une connexion in-band au SP 56 Gestion in-band (sideband) d’ILOM 56 ? Pour configurer l’accès in-band (sideband) au SP 57 Configuration du mode d’initialisation 61 Présentation du mode d’initialisation 61 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC 62 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations 64 ? Pour gérer le script du mode d’initialisation de l’hôte 65vi Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte 66 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur 66 Configuration du comportement du serveur au redémarrage 69 ? Pour définir le comportement de l’hôte à sa réinitialisation 69 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête 70 ? Pour définir l’intervalle du délai d’attente d’initialisation 70 ? Pour définir le comportement à l’expiration du délai d’initialisation 71 ? Pour définir le comportement en cas d’échec du redémarrage 71 ? Pour définir le nombre maximum de tentatives de redémarrage 72 Configuration des périphériques 73 ? Pour déconfigurer manuellement un périphérique 73 ? Pour reconfigurer manuellement un périphérique 74 Contrôle du serveur 75 Contrôle des pannes 75 Présentation des diagnostics 76 ? Pour détecter les pannes (ILOM) 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) 77 ? Pour détecter les pannes à l’aide du POST 79 ? Pour afficher l’historique de la console 80 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) 81 ? Pour effacer une panne 83 Activation de la récupération automatique du système 83 Présentation de la récupération automatique de système 84 ? Pour activer la fonction ASR 84 ? Pour désactiver la fonction ASR 85 ? Pour afficher des informations sur les composants concernés par l’ASR 86Sommaire vii ? Pour afficher les composants du serveur 86 ? Pour localiser le serveur 87 Mise à jour du microprogramme 89 ? Pour afficher la version du microprogramme 89 ? Pour mettre à jour le microprogramme 90 ? Pour afficher la version d’OpenBoot 92 ? Pour afficher la version de POST 93 Mise à jour du système d’exploitation Oracle Solaris 95 Syntaxe de nom universel 95 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) 99 probe-scsi-all Exemple de sortie (SPARC T3-4) 102 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs 103 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs 105 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) 107 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) 111 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique 115 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID 116 Index 119viii Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011ix Utilisation de cette documentation Ce guide d’administration s’adresse aux administrateurs système expérimentés des serveurs de la série SPARC T3 d’Oracle (ci-après appelé le « serveur »). Il comprend des informations descriptives générales sur le serveur ainsi que des instructions détaillées sur la configuration et l’administration du serveur. Pour utiliser les informations de ce document, vous devez maîtriser les concepts et la terminologie des réseaux informatiques ainsi que posséder une connaissance poussée du système d’exploitation Oracle Solaris (SE Oracle Solaris). Remarque – Le Guide d’administration des serveurs de la série SPARC T3 s’applique à plusieurs serveurs et modules serveur. Certains exemples utilisés dans ce document sont basés sur des modèles particuliers de serveur. C’est pourquoi votre sortie peut différer des exemples présentés selon le produit que vous utilisez. ¦ « Commandes UNIX », page ix ¦ « Invites de shell », page x ¦ « Documentation, support et formation », page x Commandes UNIX Ce document peut ne pas contenir d’informations sur les commandes et procédures UNIX de base telles que l’arrêt et le démarrage du système ou la configuration des périphériques. Vous trouverez de plus amples informations à ce sujet dans : ¦ la documentation accompagnant les logiciels livrés avec votre système ; ¦ la documentation relative au SE Oracle Solaris, disponible à l’adresse suivante : http://www.oracle.com/technetwork/indexes/documentation/ index.htmlx Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Invites de shell Documentation, support et formation Le site Web d'Oracle Technology Network contient des informations sur les ressources supplémentaires suivantes : ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Shell Invite C shell nom-machine% Superutilisateur C shell nom-machine# Bourne shell et Korn shell $ Superutilisateur Bourne shell et Korn shell #1 Présentation des ressources de l’administration système Les sections suivantes présentent un récapitulatif des outils courants servant à administrer le serveur. ¦ « Présentation d’ILOM », page 1 ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ¦ « Logiciel de multiacheminement », page 6 ¦ « Présentation du pack de gestion du matériel », page 7 Présentation d’ILOM Oracle Integrated Lights Out Manager est un microprogramme de gestion système préinstallé sur les serveurs SPARC de la série T4. Il vous permet de gérer et de contrôler de manière active les composants installés sur le serveur. ILOM fournit une interface Web et une interface de ligne de commande, ainsi que les interfaces SNMP et IPMI. Le processeur de service ILOM fonctionne indépendamment du serveur et quel que soit l’état de marche du serveur, du moment que ce dernier (ou le système modulaire contenant le module serveur) est alimenté en courant CA. Lorsque vous connectez un serveur à une alimentation CA, le processeur de service ILOM démarre immédiatement et commence à contrôler le serveur. ILOM gère l’ensemble des tâches de surveillance et de contrôle environnementaux. L’invite -> indique que vous interagissez directement avec le processeur de service ILOM. Il s’agit de la première invite qui s’affiche lorsque vous vous connectez au serveur via le port de gestion série ou le port de gestion réseau, quel que soit l’état 2 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 d’alimentation de l’hôte. Sur un système modulaire, cette invite est également présente lorsque vous vous connectez à un module serveur soit directement soit via ILOM sur le module CMM du système modulaire. Vous pouvez également accéder à l’invite du processeur de service ILOM (->) à partir de l’invite ok de l’OpenBoot ou de l’invite # ou % d’Oracle Solaris, du moment que la console système est configurée pour être accessible via les ports de gestion série et réseau. Le processeur de service ILOM prend en charge un total de dix sessions simultanées par serveur : neuf connexions SSH via le port de gestion réseau et une via le port de gestion série. Pour plus d’informations sur l’utilisation des fonctions ILOM communes à toutes les plates-formes gérées par ILOM, consultez la documentation suivante à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage Informations connexes ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Pour se connecter à ILOM », page 11 Type d’information Titre Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur l’interface du navigateur Guide des procédures relatives à l’interface Web d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur les procédures CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations relatives aux protocoles SNMP et IPMI Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocols Reference Guide (Guide de référence des protocoles de gestion d’Oracle Integrated Lights Out Manager (ILOM) 3.0) Informations relatives à l’installation et à la configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur le module CMM Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM - Guide d’administration pour les systèmes modulaires 6000 et 6048 Présentation des ressources de l’administration système 3 Fonctions d’ILOM spécifiques à la plate-forme ILOM fonctionne sur diverses plates-formes, dont il prend en charge les fonctions qui leur sont communes. Certaines des fonctions d’ILOM sont limitées à un sous-ensemble de plates-formes. Cette section décrit la différence entre les fonctions d’ILOM prises en charge par le serveur et le jeu de fonctions communes décrit dans la documentation de base d’ILOM 3.0. Remarque – Pour effectuer certaines procédures décrites dans la documentation de base d’Oracle ILOM 3.0, vous devez établir une connexion série avec le serveur et activer le commutateur de présence physique sur ce dernier. Pour plus d’informations sur l’établissement d’une connexion série, reportez-vous au guide d’installation de votre serveur. Parmi les fonctions d’ILOM prises en charge sur d’autres plates-formes, les suivantes ne sont pas compatibles avec ce serveur : ¦ Fonctions du module de contrôle de châssis (CMM, Chassis Monitoring Module) telles que la connexion unique SSO (Single Sign On). Remarque : les serveurs lames T3 installés dans un système modulaire prennent en charge les fonctions du CMM. ¦ Déclencheur user-reset de diagnostics du POST non disponible ILOM prend en charge la fonction suivante sur ce serveur, mais cette dernière peut très bien ne pas être disponible sur d’autres plates-formes : ¦ Déclencheur hw-change de diagnostics du POST. Ce nouveau déclencheur (hw-change error-reset) constitue le paramètre par défaut du serveur. Il déclenche l’exécution du test POST chaque fois que le serveur est mis sous tension progressive CA ou que le capot du haut est retiré (le cas échéant). Pour plus d’informations sur le POST, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Présentation d’ILOM », page 14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation du SE Oracle Solaris Le SE Oracle Solaris comprend des commandes et d’autres ressources logicielles utilisées dans le cadre de l’administration du serveur. Pour une introduction aux outils de gestion de votre version d’Oracle Solaris, reportez-vous au manuel System Administration Guide: Basic Administration dans la collection de documents Oracle Solaris. Le logiciel SunVTS est inclus dans Oracle Solaris. Il permet de tester et de valider le matériel Oracle en contrôlant la connectivité et la fonctionnalité des périphériques, contrôleurs et dispositifs matériels. Outre les informations relatives à SunVTS contenues dans la documentation d’Oracle Solaris, les collections de documentation propres à SunVTS sont disponibles à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id=homepage Informations connexes ¦ « Présentation d’OpenBoot », page 4 Présentation d’OpenBoot Le microprogramme OpenBoot démarre le système d’exploitation, valide le matériel installé et permet d’effectuer d’autres tâches d’administration serveur situées en dessous du niveau du SE. Pour plus d’informations sur les commandes d’OpenBoot, reportez-vous au manuel OpenBoot 4.x Command Reference Manual inclus dans la collection de documents Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4Présentation des ressources de l’administration système 5 Présentation d’Oracle VM Server pour SPARC Un domaine logique regroupe de manière logique et discrète ses propres ressources, systèmes d’exploitation et identité au sein d’un seul système informatique. Les applications logicielles peuvent être exécutées dans les domaines logiques. Il est possible de créer, de détruire, de reconfigurer et de réinitialiser chaque domaine logique indépendamment des autres. Le logiciel Oracle VM Server pour SPARC vous permet de créer et de gérer jusqu’à 32 domaines logiques en fonction de la configuration matérielle du serveur sur lequel Oracle VM Server pour SPARC Manager est installé. Vous avez la possibilité de virtualiser les ressources et de définir des périphériques réseau, de stockage et d’E/S en tant que services pouvant être partagés entre les différents domaines. Les configurations Oracle VM Server pour SPARC sont stockées sur le SP. A l’aide des commandes de la CLI d’Oracle VM Server pour SPARC, vous pouvez ajouter une configuration, spécifier la configuration à utiliser et répertorier les configurations figurant sur le processeur de service. Vous avez également la possibilité d’utiliser la commande set /HOST/bootmode config=fichier_de_configuration d’ILOM pour indiquer la configuration d’initialisation d’Oracle VM Server. Informations connexes ¦ « Configuration du mode d’initialisation », page 61 ¦ Documentation d'Oracle VM Server pour SPARC http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html6 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Logiciel de multiacheminement Le logiciel de multiacheminement vous permet de définir et de contrôler les chemins physiques redondants des périphériques d’E/S, tels que les périphériques de stockage et les interfaces réseau. Si le chemin d’accès actif à un périphérique devient indisponible, le logiciel peut automatiquement basculer sur un chemin secondaire pour maintenir la disponibilité. Cette fonction est connue sous l’appellation de basculement automatique. Pour tirer parti des fonctions de multiacheminement, vous devez configurer le serveur avec du matériel redondant, par exemple des interfaces réseau redondantes ou deux adaptateurs de bus hôte connectés à la même baie de stockage à double accès. Pour le serveur, trois types différents de logiciel de multiacheminement sont disponibles : ¦ Le logiciel Oracle Solaris IP Network Multipathing assure le multiacheminement et l’équilibrage de charge pour les interfaces réseau IP. Pour des instructions de configuration et d’administration du logiciel Oracle Solaris IP Network Multipathing, consultez le manuel IP Network Multipathing Administration Guide fourni avec votre version d’Oracle Solaris. ¦ Le logiciel VVM inclut une fonction appelée DMP, qui assure le multiacheminement pour les disques ainsi que l’équilibrage de charge des disques en vue d’optimiser le débit d’E/S. Pour des informations sur VVM et sa fonction DMP, reportez-vous à la documentation qui accompagne le logiciel VERITAS Vo lume Ma na ger. ¦ StorageTek Traffic Manager est une architecture entièrement intégrée au sein du SE Oracle Solaris (à partir de la version Oracle Solaris 8) qui permet d’accéder aux périphériques d’E/S par le biais de plusieurs interfaces de contrôleur hôte depuis une unique instance du périphérique d’E/S. Pour plus d’informations sur StorageTek Traffic Manager, reportez-vous à la documentation de votre SE Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5Présentation des ressources de l’administration système 7 Présentation du pack de gestion du matériel Le pack de gestion du matériel (HMP) des serveurs Sun d'Oracle fournit des outils qui permettent de gérer et de configurer les serveurs Oracle à partir du système d'exploitation de l'hôte. Pour utiliser ces outils, vous devez installer le logiciel HMP sur votre serveur. Une fois le logiciel installé, vous pouvez effectuer les tâches de gestion de serveur décrites dans le tableau ci-après. TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil Surveillance du matériel Oracle avec l'adresse IP de l'hôte Utilisez l'agent de gestion du matériel et les plug-ins du protocole SNMP (Simple Network Management Protocol) au niveau du système d'exploitation pour activer la surveillance in-band de votre matériel Oracle. Cette fonctionnalité de surveillance in-band vous permet d'utiliser l'adresse IP du système d'exploitation hôte pour surveiller vos serveurs Oracle sans connecter le port de gestion Oracle ILOM à votre réseau. Outil de gestion au niveau du système d'exploitation hôte Surveillance des périphériques de stockage, notamment des baies de disque RAID Utilisez l'agent de gestion du stockage du serveur au niveau du système d'exploitation pour activer la surveillance in-band des périphériques de stockage configurés sur vos serveurs Oracle. L'agent de gestion du stockage du serveur fournit un démon de système d'exploitation qui collecte des informations sur les périphériques de stockage du serveur, notamment les disques durs et les baies RAID, puis les envoie au processeur de service Oracle ILOM. Les fonctions de surveillance du stockage dans Oracle ILOM vous permettent de consulter et de surveiller les informations fournies par l'agent de gestion du stockage du serveur. Vous pouvez accéder aux fonctions de surveillance du stockage dans Oracle ILOM à partir de l'interface de ligne de commande (CLI). Fonctions de surveillance du stockage de la CLI Oracle ILOM 3.0 Interrogation, mise à jour et validation des versions de microprogramme sur les périphériques de stockage SAS pris en charge Utilisez l'outil CLI fwupdate à partir du système d'exploitation hôte pour interroger, mettre à jour et valider les versions de microprogramme sur les périphériques de stockage pris en charge, tels que les adaptateurs de bus hôte SAS (HBA), les contrôleurs de stockage SAS intégrés, les expandeurs de stockage SAS LSI et les disques durs. CLI fwupdate au niveau du SE hôte8 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Source du téléchargement du logiciel HMP (pack de gestion du matériel) Vous pouvez télécharger le logiciel HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://support.oracle.com Restauration, définition et consultation des paramètres de configuration d'Oracle ILOM Utilisez l'outil CLI ilomconfig à partir du système d'exploitation hôte pour restaurer les paramètres de configuration d'Oracle ILOM, ainsi que pour consulter et définir les propriétés d'Oracle ILOM associées à la gestion du réseau, la configuration de l'horloge et la gestion des utilisateurs. CLI ilomconfig au niveau du SE hôte Affichage ou création de volumes RAID sur des unités de stockage Utilisez l'outil CLI raidconfig à partir du système d'exploitation hôte pour consulter et créer des volumes RAID sur les unités de stockage connectées aux contrôleurs RAID, notamment les baies de stockage. CLI raidconfig au niveau du SE hôte Utilisation de l'outil IPMItool pour accéder aux serveurs Oracle et les gérer Utilisez la ligne de commande « open source » IPMItool à partir du système d'exploitation hôte pour accéder aux serveurs Oracle et les gérer à l'aide du protocole IPMI. Ligne de commande IMPItool au niveau du SE hôte * Les systèmes d'exploitation pris en charge sont les suivants : Solaris, Linux, Windows et VMware TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur (suite) Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel OutilPrésentation des ressources de l’administration système 9 Source du téléchargement de la documentation HMP (pack de gestion du matériel) Vous pouvez télécharger la documentation HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://www.oracle.com/technetwork/documentation/sys-mgmt-network ing-190072.html Remarque – La documentation du pack de gestion du matériel version 2.1 fournie sur ce site est valable pour le pack de gestion du matériel version 2.1.1. Pour plus d'informations sur l'utilisation des fonctions de contrôle de stockage dans Oracle ILOM, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (Guide des notions fondamentales d'Oracle Integrated Lights Out Manager (ILOM) 3.0) et au Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (Guide des procédures relatives à la CLI d'Oracle Integrated Lights Out Manager (ILOM) 3.0). Pour plus d'informations sur l'accès et la gestion d'un serveur via SNMP ou IPMI, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (Guide des références des protocoles de gestion Oracle Integrated Lights Out Manager (ILOM) 3.0). Les liens vers ces manuels Oracle ILOM sont fournis sur le site Web indiqué ci-dessus. Vous trouverez l'intégralité de la documentation Oracle ILOM à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage10 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201111 Accès au serveur Les sections suivantes présentent des informations relatives à l’établissement de communications de bas niveau avec le serveur à l’aide de l’outil ILOM et de la console système. ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour se connecter à la console système », page 12 ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « ILOM Remote Console », page 17 ? Pour se connecter à ILOM Dans cette procédure, il est supposé que vous utilisez la configuration par défaut du processeur de service comme décrite dans le guide d’installation du serveur. Remarque – Pour un module serveur SPARC T3, consultez le guide d’installation qui contient des instructions relatives au démarrage d’ILOM via le module CMM du système modulaire, ainsi que des instructions concernant la connexion directe au processeur de service sur le module serveur.12 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Ouvrez une session SSH et connectez-vous au SP en spécifiant son adresse IP. Le nom d’utilisateur par défaut ILOM est root et le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM. Exécutez les tâches nécessaires. Remarque – Pour bénéficier d’une sécurité optimale sur le serveur, changez le mot de passe par défaut de ce dernier. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à la console système », page 12 ? Pour se connecter à la console système ? A l’invite -> d’ILOM, tapez : où option correspond à l’une des valeurs suivantes : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright 2010 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accès au serveur 13 ¦ -f|force : permet à un utilisateur doté du rôle Console (c) de prendre la console à l’utilisateur qui y est connecté et d’obliger ce dernier à utiliser le mode de visualisation. ¦ -script : contourne l’invite de confirmation (yes ou no). Remarque – Si le SE Oracle Solaris n’est pas en cours d’exécution, le serveur affiche l’invite ok. Informations connexes ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « Pour se connecter à ILOM », page 11 ? Pour afficher l’invite ok Dans cette procédure, il est supposé que vous utilisez la configuration par défaut de la console système. ? Dans le tableau suivant, choisissez la méthode d’arrêt appropriée pour accéder à l’invite ok. Pour s'assurer que l'invite ok s'affiche, définissez la propriété ILOM suivante avant d'exécuter les procédures décrites dans le tableau : -> set /HOST/bootmode script=”setenv auto-boot? false”14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Attention – Dans la mesure du possible, affichez l’invite ok en effectuant un arrêt progressif du SE. Toute autre méthode risque d'entraîner la perte des informations d'état du serveur. Informations connexes ¦ « Contrôle des pannes », page 75 Etat du serveur Procédure à suivre SE en cours d’exécution et réactif Arrêtez le serveur en utilisant l’une des méthodes suivantes : • Dans une fenêtre d’utilitaire de shell ou de commande, tapez une commande appropriée (par exemple, la commande shutdown ou init 0), comme décrit dans la documentation relative à l’administration système d’Oracle Solaris. • A l’invite -> d’ILOM, tapez : -> stop /SYS • Appuyez sur le bouton de marche/arrêt du serveur. • A partir d’Oracle Solaris, exécutez la commande suivante en tant qu’utilisateur root : # uadmin 2 0 SE non réactif Arrêtez le serveur à partir d’ILOM. (à condition que le logiciel de système d’exploitation ne soit pas en cours d’exécution et que le serveur soit déjà sous le contrôle du microprogramme OpenBoot) A l’invite -> d’ILOM, tapez : -> set /HOST send_break_action=break Appuyez sur Entrée. Tapez ensuite : -> start /HOST/console SE non réactif et initialisation automatique devant être empêchée Arrêtez le serveur à partir d’ILOM et désactivez la fonction d’initialisation automatique. A l’invite -> d’ILOM, tapez : -> set /HOST/bootmode script=”setenv auto-boot? false” Appuyez sur Entrée. Tapez ensuite : -> reset /SYS -> start /HOST/consoleAccès au serveur 15 ? Pour afficher l’invite -> d’ILOM ? Utilisez l’une des méthodes suivantes pour afficher l’invite -> d’ILOM : ¦ A partir de la console système, tapez la séquence d’échappement (#.) d’ILOM. ¦ Connectez-vous directement à ILOM à partir d’un périphérique relié au port de gestion série ou au port de gestion réseau. ¦ Connectez-vous à ILOM via une connexion SSH. Reportez-vous à la section « Pour se connecter à ILOM », page 11. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à ILOM », page 11 ? Pour utiliser un moniteur graphique local Vous pouvez rediriger la console système vers un moniteur graphique local. Vous ne pouvez pas utiliser un moniteur graphique local pour effectuer l’installation initiale du serveur, ni pour afficher les messages de l’autotest de l’allumage (POST). Pour utiliser un moniteur graphique local : 1. Connectez le câble vidéo du moniteur à un port vidéo du serveur. Fixez les vis à serrage à main pour maintenir la connexion. Reportez-vous à la documentation de votre système pour connaître les instructions de connexion qui peuvent s’appliquer à votre serveur. 2. Branchez le cordon d’alimentation du moniteur sur une prise CA. 3. Connectez le câble de clavier USB à un port USB. 4. Connectez le câble de souris USB à un autre port USB sur le serveur. 5. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13.16 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 6. A l’invite ok, définissez les variables de configuration OpenBoot PROM suivantes : 7. Pour appliquer vos modifications, tapez : Le serveur enregistre les modifications de paramètres et s’initialise automatiquement. Remarque – Au lieu d’utiliser la commande reset-all pour stocker les modifications de paramètres, vous pouvez également mettre le serveur progressivement sous tension à l’aide du bouton de marche/arrêt. Vous pouvez à présent exécuter des commandes système et afficher les messages du système en utilisant le moniteur graphique local. Pour activer l’interface graphique, passez à l’étape suivante. 8. Activez l’interface graphique du SE Oracle Solaris. Une fois que le SE Oracle Solaris est installé et initialisé, tapez les commandes suivantes afin d’afficher l’écran de connexion de l’IG. Informations connexes ¦ « Pour afficher l’invite ok », page 13. ¦ « ILOM Remote Console », page 17 ok setenv input-device keyboard ok setenv output-device screen ok reset-all # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # rebootAccès au serveur 17 ILOM Remote Console ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques suivants sur un serveur hôte. Ce groupe de périphériques est couramment désigné par l’abréviation KVMS (Keyboard, Video, Mouse, Storage, c’est-à-dire clavier, vidéo, souris et stockage). ¦ Clavier ¦ Affichage vidéo de la console ¦ Souris ¦ Affichage série de la console ¦ Périphériques de stockage ou images (CD/DVD) ILOM Remote Console est documentée dans le manuel Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (à la section « Managing Remote Hosts Redirection and Securing the ILOM Remote Console »). Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 5618 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201119 Contrôle du serveur Les sections suivantes présentent les procédures de commande des opérations de base relatives au serveur. ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Pour rétablir les valeurs par défaut du SP », page 23 ? Pour mettre le serveur sous tension 1. Connectez-vous à ILOM. « Pour se connecter à ILOM », page 11. Remarque – Si vous disposez d’un système modulaire, assurez-vous que vous n’êtes pas connecté au module serveur souhaité. 2. A l’invite -> d’ILOM, tapez : Remarque – Pour éviter d’avoir à confirmer, utilisez la commande start -script /SYS. -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->20 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour mettre le serveur hors tension 1. Arrêtez le SE Oracle Solaris. A l’invite Oracle Solaris, tapez : 2. Passez de l’invite de la console système à celle de la console du processeur de service. 3. A partir de l’invite -> d’ILOM, tapez ce qui suit : Remarque – Pour exécuter un arrêt immédiat, utilisez la commande stop -force -script /SYS. Vérifiez que toutes les données sont enregistrées avant de taper cette commande. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs41-58 syslogd: going down on signal 15 svc.stard: The system is down. syncing file systems...done Program terminated r)eboot o)k prompt, h)alt? # o ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Contrôle du serveur 21 Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris Il est inutile de mettre le serveur hors puis sous tension pour effectuer une réinitialisation. ? Pour réinitialiser le serveur à partir de l’invite d’Oracle Solaris, tapez l’une des commandes suivantes : ou Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 # shutdown -g0 -i6 -y # reboot22 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour réinitialiser le serveur à partir d’ILOM La commande reset d’ILOM entraîne une réinitialisation matérielle progressive ou forcée du serveur. Par défaut, la commande reset effectue une réinitialisation progressive du serveur. ? Tapez l’une des commandes suivantes pour réinitialiser le serveur. ¦ Procédez à une réinitialisation progressive à partir d’ILOM : ¦ Si cette opération est impossible, effectuez une réinitialisation matérielle forcée à partir d’ILOM : Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 -> reset /SYS -> reset -force /SYSContrôle du serveur 23 ? Pour rétablir les valeurs par défaut du SP Si le processeur de service (SP) est endommagé ou que vous souhaitez rétablir ses valeurs par défaut définies en usine, modifiez le paramètre /SP reset_to_defaults, puis mettez l’hôte hors tension afin d’appliquer les modifications. Il s’agit d’un nouveau comportement. Dans les versions précédentes, il était inutile de mettre l’hôte hors tension pour rétablir les valeurs par défaut du SP. Vous devez disposer des autorisations d’administrateur pour effectuer cette tâche. 1. Pour rétablir les valeurs par défaut du SP, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ all : supprime l’ensemble des données de configuration du SP. ¦ factory : supprime l’ensemble des données de configuration du SP de même que tous les fichiers journaux. 2. La mise hors tension suivie du redémarrage de l’hôte permet d’achever les changements de paramètres. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP24 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201125 Configuration de volumes RAID matériels Les sections suivantes décrivent les procédures de configuration et de gestion des volumes de disques RAID à l’aide des contrôleurs de disque SAS intégrés du serveur. ¦ « Prise en charge des volumes RAID matériels », page 25 ¦ « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28 ¦ « Affichage des informations de zone de disques », page 29 ¦ « Activation et désactivation du zonage des disques dans le champ », page 33 ¦ « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Disques hot spare de volumes RAID (LSI) », page 39 ¦ « Diagnostic de l'état de fonctionnement d'un disque », page 40 ¦ « Stratégies de remplacement d'un disque RAID », page 43 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 Prise en charge des volumes RAID matériels Les serveurs de la série SPARC T3 contiennent des contrôleurs RAID SAS 2 intégrés qui permettent la formation de volumes de disques logiques composés d'un ou plusieurs disques durs redondants. Ces contrôleurs prennent en charge les niveaux RAID suivants : ¦ RAID 0 : répartition des données26 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ RAID 1 : mise en miroir des données (à l'aide de deux disques) ¦ RAID 1e : mise en miroir améliorée (à l'aide de trois à huit disques) La répartition des données fait référence à la technique de distribution des fichiers de données sur plusieurs disques, de sorte que le stockage et la récupération puissent être effectués en parallèle sur plusieurs canaux de données. La répartition des données peut réduire le temps nécessaire à la lecture et l'écriture des fichiers de données. La mise en miroir des données fait référence à la technique de stockage de copies identiques de données sur des disques séparés. La mise en miroir des données critiques permet de réduire les risques de perte de données grâce à la création d'instances dupliquées des données. Le tableau suivant décrit les ressources des contrôleurs RAID par défaut fournies sur les différents serveurs de la série SPARC T3. TABLEAU : Contrôleurs SAS-2 intégrés sur les serveurs de la série SPARC T3 Modèle SPARC T3 Détails du contrôleur SAS-2 intégré et du fond de panier de disques T3-1 Deux contrôleurs intégrés et un fond de panier de disques. Il existe deux versions du fond de panier de disques T3-1 : Capacité de huit disques : – Le contrôleur 0 gère les emplacements de disque 0 à 3 – Le contrôleur 1 gère les emplacements de disque 4 à 7 Capacité de seize disques (zones activées) : * – Le contrôleur 0 gère les emplacements de disque 0 à 7 – Le contrôleur 1 gère les emplacements de disque 8 à 15 * Les fonds de panier d'une capacité de seize disques doivent être divisés en deux zones de huit disques. Pour plus d’informations, reportez-vous à la section « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. T3-1B Un contrôleur intégré et deux fonds de panier de disques dotés de deux emplacements de disque chacun. Le contrôleur intégré est connecté aux deux fonds de panier par deux câbles de données et deux câbles d'alimentation. T3-2 Un contrôleur intégré et un fond de panier de disques doté de six emplacements de disque. Le contrôleur intégré est connecté au fond de panier par deux câbles de données distincts. T3-4 Aucun contrôleur intégré, deux modules d'extension RAID (REM) enfichables internes et deux fonds de panier de disques : – REM 0 gère les emplacements de disque 0 à 3 (fond de panier 0) – REM 1 gère les emplacements de disque 4 à 7 (fond de panier 1)Configuration de volumes RAID matériels 27 Chaque contrôleur SAS-2 vous permet de créer jusqu'à deux volumes RAID contenant des disques connectés à ce contrôleur. Un volume ne peut pas contenir des disques connectés à un autre contrôleur. Vous avez le choix entre trois environnements pour créer et gérer les ressources RAID sur votre serveur. ¦ Utilitaire Fcode : Cet utilitaire se compose d’un ensemble de commandes permettant d’afficher les cibles et de gérer les volumes logiques de votre serveur. Vous accédez à ces commandes via l'environnement OpenBoot PROM (OBP). Les exemples figurant dans ce manuel s'appuient sur les commandes Fcode. ¦ Utilitaire de gestion LSI SAS2 2008 RAID pour serveurs SPARC T3 : Vous pouvez utiliser les commandes sas2ircu contenues dans l'utilitaire de configuration intégré LSI SAS2 pour configurer et gérer les volumes RAID sur votre serveur. Pour utiliser le jeu de commandes sas2ircu, téléchargez et installez le logiciel SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/index.aspx Vous pouvez télécharger la documentation SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Pack de gestion du matériel Oracle 2.1.1 : Vous pouvez utiliser les commandes RAIDconfig figurant dans le compostant Outils de l'interface CLI des serveurs Oracle de ce logiciel pour créer et gérer des volumes RAID sur votre serveur. Pour utiliser ces commandes, téléchargez et installez la toute dernière version du pack de gestion du matériel à partir du site My Oracle Support : http://support.oracle.com/CSP/ui/flash.html Cliquez sur le lien suivant pour accéder au guide d'installation du pack de gestion du matériel Oracle 2.1. http://download.oracle.com/docs/cd/E19960-01/index.html Remarque – La version 2.1.1 est la plus ancienne version du pack de gestion du matériel Oracle prenant en charge les serveurs de la série SPARC T3. Vous trouverez une documentation complète sur l'utilisation du pack de gestion du matériel version 2.1 à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21&id=homepage28 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Conseil – Certaines commandes du pack de gestion du matériel 2.1.1 présentent parfois de longs délais de démarrage ou d'exécution sur les serveurs SPARC T3-2 and T3-4. Dans de tels cas, vous pouvez, si vous le préférez, utiliser les commandes Fcode ou LSI sas2ircu. Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques Chaque fois qu'un fond de panier à seize disques SPARC T3-1 est géré par des contrôleurs SAS-2 intégrés, le fond de panier doit être divisé en deux zones logiques, à raison de huit emplacements de disque par zone : ¦ Zone A : Contient les emplacements de fond de panier 0 à 7 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 0. ¦ Zone B : Contient les emplacements de fond de panier 8 à 15 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 1. Le zonage des disques nécessite que le microprogramme de l'expandeur LSI du fond de panier dispose au minimum du patch 147034-01. Ce patch crée les zones de disques requises. Remarque – Pour plus d'informations sur le patch 147034-01, reportez-vous à son document LISEZ-MOI (README.147034) sur le site My Oracle Support. Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35.Configuration de volumes RAID matériels 29 Si une carte HBA RAID PCIe interne est utilisée pour gérer le fond de panier des disques au lieu des contrôleurs intégrés, les zones de disques doivent être désactivées. La plupart des serveurs SPARC T3-1 dotés de fonds de panier à seize disques sont livrés avec le zonage activé. Il existe deux exceptions à cette règle par défaut : ¦ Le zonage est désactivé à l'usine lorsqu'un système SPARC T3-1 doté d'un fond de panier à seize disques est fabriqué avec une carte HBA RAID PCIe interne. ¦ Les systèmes SPARC T3-1 fabriqués avec des fonds de panier à 16 disques avant que le zonage des disques ne devienne une spécification par défaut étaient livrés sans le patch 147034-01. Pour ces systèmes, le patch doit être installé dans le champ pour prendre en charge le zonage des disques. La version 2.1.1 du pack de gestion du matériel des serveurs Sun d'Oracle inclut un utilitaire de zonage de disques que vous pouvez utiliser pour activer et désactiver le zonage, ainsi que pour afficher les informations d'état des zones. Voir « Activation et désactivation du zonage des disques dans le champ », page 33 et « Affichage des informations de zone de disques », page 29 pour plus d'informations. Remarque – Les contrôleurs n'étant pas en mesure de voir les disques au delà d'une zone, un contrôleur SAS-2 ne peut pas créer un volume RAID qui contient des disques inclus dans l'autre zone. Vous pouvez utiliser l'utilitaire zoningcli pour activer ou désactiver le zonage dans un fond de panier à seize disques. Pour plus d’informations, reportez-vous à la section « Activation et désactivation du zonage des disques dans le champ », page 33. Affichage des informations de zone de disques Ces rubriques décrivent deux méthodes d'accès aux informations de zonage de disques. ¦ « Etat des zones de disques (zoningcli list) », page 30 ¦ « Etat des zones de disques (probe-scsi-all) », page 3130 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Etat des zones de disques (zoningcli list) Si le pack de gestion du matériel version 2.1.1 (ou une version plus récente) est installé sur votre système, vous pouvez utiliser la commande zoningcli list pour déterminer si le zonage est activé ou non. L'état du zonage est indiqué sur la première ligne de la sortie dans chacun des exemples suivants. Le zonage est désactivé : Le zonage est activé : Si l'utilitaire zoningcli n'est pas disponible sur votre système, vous pouvez utiliser la commande OBP probe-scsi-all afin de déterminer si le zonage est activé ou non. Reportez-vous à la section « Etat des zones de disques (probe-scsi-all) », page 31. # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: disable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 =================================================== # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: enable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 ===================================================Configuration de volumes RAID matériels 31 Etat des zones de disques (probe-scsi-all) Les exemples de sortie de la commande probe-scsi-all suivants illustrent la différence d'affichage des périphériques de stockage lorsque le zonage est activé et lorsqu'il est désactivé. 10 disques sont représentés dans les deux exemples. Ils sont identifiés comme PhyNum 0 à 9. Remarque – Les entrées PhyNum 1 à 6 ne sont pas indiquées dans ces exemples afin de réduire leur taille. Les entrées omises n'affectent pas l'illustration du concept. Le zonage est désactivé : Lorsque le zonage est désactivé, les deux contrôleurs sont en mesure de voir tous les disques. L'exemple suivant illustre ce point en répertoriant tous les disques avec le contrôleur 0 et ceux avec le contrôleur 1. Conseil – Notez que les valeurs SASDeviceName et SASAddress de chaque PhyNum répertorié sous le contrôleur 1 correspondent aux valeurs DeviceName et SASAddress du PhyNum répertorié sous le contrôleur 0. Ceci est également valable pour PhyNum 1 à 6 qui ont été omis pour réduire la taille de la table. {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 12 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 13 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 1432 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Le zonage est activé : Dans l'exemple suivant, le zonage est activé et chaque disque est illustré connecté à un seul contrôleur SAS-2. PhyNum 0 à 7 sont connectés au contrôleur 0 et PhyNum 8 à 9 sont connectés au contrôleur 1. Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 15 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 13 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 14 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 {0} ok {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Configuration de volumes RAID matériels 33 Activation et désactivation du zonage des disques dans le champ Ces rubriques décrivent comment activer et désactiver les zones de disques dans le champ. Remarque – Vous devez disposer de la version 2.1.1 du pack de gestion du matériel d'Oracle (ou une version plus récente) pour avoir accès à la commande zoningcli. ¦ « Activation des zones de disques (commande zoningcli) », page 34 ¦ « Désactivation des zones de disques (commande zoningcli) », page 34 ¦ « Mise à jour du microprogramme pour activer le zonage », page 34 Target b Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target c Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 Target d Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 {0} ok34 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Activation des zones de disques (commande zoningcli) ? Si le zonage a été désactivé, vous pouvez l'activer en exécutant la commande suivante : ? Désactivation des zones de disques (commande zoningcli) ? Si le zonage a été activé, vous pouvez le désactiver en exécutant la commande suivante : ? Mise à jour du microprogramme pour activer le zonage Si votre serveur SPARC T3-1 nécessite un zonage de disques alors qu'il ne dispose pas du niveau de microprogramme système minimal et/ou que le microprogramme LSI du fond de panier ne dispose pas du patch 147034-01, procédez comme suit pour que les contrôleurs fonctionnent correctement. Attention – Veillez à sauvegarder toutes les données stockées sur les disques avant d'installer ce patch. Vous pouvez restaurer les fichiers une fois que le patch est installé. ? Appliquez le patch 147034-01 au microprogramme LSI sur le fond de panier des disques. Ce patch entraîne le partitionnement du fond de panier en deux zones de huit disques décrites dans « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. # zoningcli enable zoning # zoningcli disable zoningConfiguration de volumes RAID matériels 35 Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35. Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs Pour que la commande devalias soit valide pour les emplacements de disque 8 à 15, le niveau du microprogramme système doit être 8.0.5.b (ou un niveau supérieur à 8.0) ou 8.1.0.c (ou un niveau supérieur). Si le microprogramme système de votre serveur ne répond pas à la configuration minimale, vous devez utiliser le chemin d'accès complet au disque afin d'identifier les disques individuels de la plage 8 à 15. Par exemple, s'il est en cours d'exécution avec le niveau minimal du microprogramme système et la commande devalias appropriée, vous pouvez utiliser la ligne de commande suivante pour démarrer le système à partir du disque se trouvant à l'emplacement 12 : Si l'emplacement du disque est un emplacement compris entre 8 et 15 et que le niveau du microprogramme système ne répond pas aux exigences décrites ci-dessus, vous devez indiquer le chemin complet d'accès au périphérique pour le disque d'initialisation. Cet exemple illustre le chemin d'accès du disque 12 : # boot disk12 # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10c36 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour préparer l’utilisation de l’utilitaire FCode 1. Ouvrez une fenêtre de terminal xterm ou gnome. Les commandes FCode génèrent une sortie détaillée volumineuse. Les fenêtres de terminal xterm ou gnome offrent cependant une fonctionnalité de barre de défilement, destinée à faciliter la visualisation de la sortie. 2. Désactivez le paramètre auto-boot dans OBP et activez l’environnement OBP après une mise sous tension ou une réinitialisation. 3. La commande show-devs dresse la liste des chemins de périphériques connectés au serveur. Remarque – Dans le cas d’un module serveur, le chemin d’accès au périphérique peut correspondre à /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. La commande select vous permet de choisir le contrôleur sur lequel vous souhaitez créer un volume RAID matériel. Au lieu d’utiliser l’intégralité du chemin d’accès au périphérique pour le contrôleur, vous pouvez définir un alias préconfiguré à associer à ce dernier. Par exemple : Pour afficher les alias préconfigurés sur le serveur, exécutez la commande devalias. Reportez-vous à la section « Pour identifier les chemins d’accès aux périphériques », page 43. Affichez les adresses SAS des unités connectées à l’aide de la commande show-children. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi0Configuration de volumes RAID matériels 37 Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Commandes de l’utilitaire FCode Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Commande FCode Description show-children Dresse la liste complète des unités physiques et des volumes logiques connectés. show-volumes Dresse une liste détaillée des volumes logiques connectés. create-raid0-volume Crée un volume RAID 0 (au minimum deux cibles). create-raid1-volume Crée un volume RAID 1 (exactement deux cibles). create-raid1e-volume Crée un volume RAID 1e (au minimum trois cibles). delete-volume Supprime un volume RAID. activate-volume Réactive un volume RAID après le remplacement de disques.38 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour créer un volume RAID matériel 1. Préparez la création du volume RAID. Reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 2. La commande show-children permet de répertorier les unités physiques situées sur le contrôleur sélectionné. 3. Exécutez la commande create-raid0-volume, create-raid1-volume ou create-raid1e-volume pour créer une unité logique à partir des disques physiques. Par exemple, pour créer un volume RAID 0 avec les cibles 9 et a, commencez par spécifier les cibles, puis tapez la commande create : Par exemple, pour créer un volume RAID 1e avec les cibles a, b et c, tapez : {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volumeConfiguration de volumes RAID matériels 39 4. Pour vérifier la création du volume, tapez : 5. Saisissez unselect-dev pour désélectionner le contrôleur. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Disques hot spare de volumes RAID (LSI) Vous pouvez configurer deux disques hot spare globaux pour protéger les données figurant sur des volumes RAID mis en miroir. Si l'un des disques d'un volume RAID 1 ou RAID 1E mis en miroir échoue, le contrôleur RAID intégré remplace automatiquement le disque défaillant par un disque hot spare, puis resynchronise les données mises en miroir. Utilisez l'utilitaire LSI sas2ircu pour ajouter des disques hot spare globaux. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'ajout de disques hot spare. {0} ok show-volumes {0} ok unselect-dev40 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Diagnostic de l'état de fonctionnement d'un disque Les rubriques suivantes traitent des diverses façons de déterminer si un disque figurant dans un volume RAID a échoué ou non : ¦ « DEL avant du disque de service requis », page 40 ¦ « Messages d'erreur (console système et fichiers journaux) », page 40 ¦ « Affichage de l'état (commande show-volumes, OBP) », page 41 ¦ « Affichage de l'état (utilitaire sas2ircu, LSI) », page 42 DEL avant du disque de service requis Lorsqu'une erreur se produit sur un disque d'un système SPARC T3, la DEL jaune de service requis s'allume à l'avant du disque. Cette DEL jaune vous permet de localiser le disque défaillant dans le système. Par ailleurs, les DEL d’opération de maintenance requise des panneaux avant et arrière s’allument également lorsque le système détecte une panne au niveau du disque dur. Reportez-vous à votre manuel d'entretien pour connaître l'emplacement et la description de ces DEL. Messages d'erreur (console système et fichiers journaux) Lorsqu'une erreur se produit sur un disque, des messages d'erreur s'affichent sur la console système. Il s'agit d'un exemple d'affichage de console système indiquant que le volume 905 a été endommagé par la perte de PhysDiskNum 1 : Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degradedConfiguration de volumes RAID matériels 41 Vous pouvez également afficher ces messages en consultant les fichiers /var/adm/messages : Reportez-vous à la rubrique View the System Message Log Files (Affichage des fichiers journaux de messages système) du manuel d'entretien pour plus d'informations sur la consultation de ces messages. ? Affichage de l'état (commande show-volumes, OBP) Vous pouvez arrêter le système et utilisez la commande show-volumes de l'OBP pour savoir si un disque est en panne. 1. Arrêtez le système et affichez l'invite ok de l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded42 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Sélectionnez le contrôleur SAS. Pour plus d’informations, reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 3. Saisissez la commande show-volumes pour afficher les volumes RAID et les disques qui leur sont associés. Dans l'exemple suivant, le disque secondaire d'un volume RAID 1 est hors ligne. 4. Saisissez la commande unselect-dev pour désélectionner le contrôleur SAS. ? Affichage de l'état (utilitaire sas2ircu, LSI) ? Utilisez l'utilitaire sas2ircu LSI pour afficher l'état du volume RAID et des périphériques qui lui sont associés. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'affichage et l'interprétation de l'état du périphérique à l'aide de l'utilitaire sas2ircu. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguration de volumes RAID matériels 43 Stratégies de remplacement d'un disque RAID Suivez les stratégies décrites ci-dessous lors du remplacement d'un disque défectueux dans un volume RAID. Remarque – Les instructions cfgadm figurant dans le manuel d'entretien s'appliquent à des disques individuels ne faisant pas partie de volumes RAID. Lorsqu'un disque fait partie d'un volume RAID, il n'est pas nécessaire d'annuler la configuration avant de le remplacer à chaud par un nouveau disque. ? Pour identifier les chemins d’accès aux périphériques La procédure suivante permet de localiser les chemins d’accès aux périphériques propres à votre serveur. 1. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Niveau de volume RAID Stratégie RAID 0 Lorsqu'un disque d'un volume RAID 0 tombe en panne, toutes les données figurant sur ce volume sont perdues. Remplacez le disque défectueux par un disque de même capacité, recréez le volume RAID 0, puis restaurez les données à partir d'une sauvegarde. RAID 1 Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID. RAID 1E Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID.44 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. A partir de l’invite ok, tapez : Informations connexes ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok45 Modification des informations d’identification du serveur Les sections suivantes décrivent la procédure de stockage des informations (à des fins de contrôle d’inventaire ou de gestion des ressources du site, par exemple) sur le SP et les PROM des FRU à l’aide de l’interface CLI d’ILOM. ¦ « Pour modifier les informations sur les données FRU des clients », page 45 ¦ « Pour modifier les informations d’identification du système », page 46 ? Pour modifier les informations sur les données FRU des clients La propriété /SP customer_frudata permet de stocker des informations dans toutes les PROM de FRU. Ce champ peut servir à identifier un système particulier pour une application tierce ou pour tout autre besoin d’identification au sein de votre environnement. ? A l’invite -> d’ILOM, tapez : Remarque – Vous devez placer la chaîne de données (données) entre guillemets anglo-saxons. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations d’identification du système », page 46 -> set /SP customer_frudata=”data”46 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier les informations d’identification du système La propriété /SP system_identifier permet de stocker les informations d’identification client. Cette chaîne de caractères est codée dans tous les messages d’interruption générés par SNMP. L’affectation d’un identificateur de système unique peut se révéler utile pour déterminer le système qui génère le message SNMP. ? A l’invite -> d’ILOM, tapez : Remarque – La chaîne des données (données) doit être placée entre guillemets anglo-saxons doubles. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations sur les données FRU des clients », page 45 -> set /SP system_identifier=”data”47 Configuration des paramètres de stratégie Les sections suivantes décrivent la gestion des stratégies de configuration à l’aide d’ILOM. ¦ « Pour définir le mode de refroidissement », page 47 ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’initialisation parallèle du SP et de l’hôte », page 50 ¦ « Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé », page 51 ? Pour définir le mode de refroidissement La propriété HOST_COOLDOWN, lorsqu’elle est activée, oblige le serveur à entrer en mode de refroidissement (cooldown) à la mise hors tension de l’hôte. Dès lors que le serveur est hors tension et que le mode de refroidissement est activé, ILOM est redirigé de manière à contrôler certains composants et à garantir qu’ils restent en dessous d’une température minimale et qu’ils ne présentent aucun danger pour l’utilisateur. Une fois les composants passés en dessous de la température minimale, le serveur n’est plus alimenté en courant ou, si cette opération prend plus de 4 minutes, l’hôte s’éteint. Remarque – La propriété HOST_COOLDOWN ne concerne pas les modules serveur.48 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le serveur refroidit certains composants avant d’être mis hors tension. ¦ disabled : la température des composants n’est pas contrôlée lors de la mise hors tension. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_LAST_POWER_STATE permet de contrôler le comportement du serveur après une panne de courant inattendue. Une fois le courant externe rétabli, le processeur de service d’ILOM est exécuté automatiquement. En général, l’hôte n’est pas remis sous tension tant que vous n’utilisez pas ILOM pour cette opération. ILOM enregistre l’état de l’alimentation actuelle du serveur dans l’espace de stockage non volatile. Si la stratégie HOST_LAST_POWER_STATE est activée, ILOM peut rétablir l’état d’alimentation précédent de l’hôte. Cette stratégie s’avère pratique en cas de panne d’alimentation ou si vous changez le serveur d’emplacement physique. Par exemple, si le serveur hôte est en cours d’exécution lors d’une panne d’alimentation et que la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur disabled, le serveur hôte demeure hors tension lorsque l’alimentation est rétablie. Si la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur enabled, le serveur hôte redémarre lorsque l’alimentation est rétablie. ? A l’invite -> d’ILOM, tapez : -> set /SP/policy HOST_COOLDOWN=value -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguration des paramètres de stratégie 49 où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : lorsque l’alimentation est rétablie, le serveur revient à l’état où il se trouvait au moment de la mise hors tension. ¦ disabled : maintient le serveur hors tension au retour du courant (valeur par défaut). Si vous activez HOST_LAST_POWER_STATE, vous devriez également configurer /SP/policy HOST_POWER_ON_DELAY. Pour plus d’informations, reportez-vous à la section « Pour désactiver ou réactiver le délai de mise sous tension », page 50. Informations connexes ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_AUTO_POWER_ON permet de mettre l’hôte sous tension lorsque le serveur est alimenté par du courant externe. Si cette stratégie est définie sur enabled, le processeur de service définit HOST_LAST_POWER_STATE sur disabled. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : une fois le courant rétabli, l’hôte est automatiquement mis sous tension après l’initialisation du SP. ¦ disabled : maintient l’hôte hors tension au retour du courant (valeur par défaut). Informations connexes ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 -> set /SP/policy HOST_AUTO_POWER_ON=value50 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour désactiver ou réactiver le délai de mise sous tension La propriété /SP/policy HOST_POWER_ON_DELAY permet de définir un délai d’attente avant la remise automatique sous tension du serveur. Ce délai est un intervalle aléatoire compris entre une et cinq secondes. Retarder la mise sous tension du serveur permet de minimiser les surintensités au niveau de la source d’alimentation principale. Cela est important lorsque plusieurs serveurs montés en rack se mettent sous tension après une coupure de courant. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : oblige le serveur à attendre un court moment avant de se mettre sous tension automatiquement. ¦ disabled : le serveur se met automatiquement et sans délai sous tension (valeur par défaut). Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’initialisation parallèle du SP et de l’hôte La propriété /SP/policy PARALLEL_BOOT, lorsqu’elle est activée, permet à l’hôte de s’initialiser/se mettre sous tension parallèlement au SP quand une stratégie de mise sous tension automatique (HOST_AUTO_POWER_ON ou HOST_LAST_POWER_STATE) est activée ou que l’utilisateur appuie sur le bouton de marche/arrêt pendant que le SP est en cours d’initialisation. ILOM doit être en cours d’exécution pour permettre la mise sous tension de l’hôte lorsque l’utilisateur appuie sur le bouton de marche/arrêt ou que les stratégies de mise sous tension automatique sont configurées. Lorsque cette propriété est désactivée, le SP s’initialise avant l’hôte. -> set /SP/policy HOST_POWER_ON_DELAY=valueConfiguration des paramètres de stratégie 51 Remarque – L’initialisation parallèle n’est pas prise en charge par les modules serveur. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le SP et l’hôte s’initialisent en même temps. ¦ disabled : le SP et l’hôte s’initialisent de manière consécutive (en série). Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé La propriété /SYS setkeyswitch_state permet de contrôler la position de l’interrupteur à clé virtuel. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ normal : le serveur peut se mettre automatiquement sous tension et lancer le processus d’initialisation (valeur par défaut). ¦ standby : met l’hôte hors tension et désactive la mise sous tension. ¦ diag : la mise sous tension de l’hôte est autorisée ; ce paramètre remplace ceux de /HOST/diag cible, ce qui se traduit par l’exécution d’un nombre maximum de POST. -> set /SP/policy PARALLEL_BOOT=value -> set /SYS keyswitch_state=value52 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ locked : la mise sous tension de l’hôte est autorisée. Toutefois, vous ne pouvez pas mettre à jour les périphériques flash ni définir la propriété /HOST send_break_action=break. Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 2053 Configuration des adresses réseau Les sections suivantes décrivent la gestion des adresses réseau à l’aide d’ILOM. ¦ « Options d’adresse réseau du SP », page 53 ¦ « Pour désactiver ou réactiver l’accès réseau au SP », page 54 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ¦ « Utilisation d’une connexion in-band au SP », page 56 Options d’adresse réseau du SP Vous pouvez accéder au SP de votre système de plusieurs façons. Tenez compte des options disponibles et choisissez la méthode d’accès la plus adaptée à votre environnement. Vous pouvez établir des connexions physiques avec le SP au moyen d’une connexion série ou réseau. La connexion réseau peut être configurée de manière à utiliser une adresse IP statique ou le protocole DHCP (valeur par défaut). Le cas échéant, les serveurs de la série T3 peuvent se connecter au SP via une connexion réseau in-band au lieu d’utiliser le port de gestion réseau out-of-band défini par défaut. Pour plus d’informations sur chaque option, reportez-vous à la documentation suivante : ¦ Pour utiliser une connexion série au SP, consultez la section suivante : Pour connecter un terminal ou un émulateur au port SER MGT, dans le guide d’installation de votre serveur ou Communication avec le module serveur au démarrage, dans le guide d’installation de votre module serveur. ¦ Pour assigner une adresse IP statique au SP, consultez la section suivante : Pour assigner une adresse IP statique au SP, dans le guide d’installation du serveur ¦ Pour utiliser une connexion in-band au SP, reportez-vous à la section suivante : « Gestion in-band (sideband) d’ILOM », page 5654 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ Documentation d’Oracle Integrated Lights Out Manager (ILOM) 3.0 ¦ « Présentation d’ILOM », page 1 ? Pour désactiver ou réactiver l’accès réseau au SP La propriété /SP/network state permet d’activer ou de désactiver l’interface réseau du processeur de service. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled (valeur par défaut) ¦ disabled Informations connexes ¦ « Options d’adresse réseau du SP », page 53 ? Pour afficher l’adresse IP du serveur DHCP Afin d’afficher l’adresse IP du serveur DHCP ayant fourni l’adresse IP dynamique requise par le processeur de service, affichez la propriété dhcp_server_ip. ? A l’invite -> d’ILOM, tapez : -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguration des adresses réseau 55 Remarque – La liste des propriétés peut varier en fonction de votre serveur. Informations connexes ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ? Pour afficher l’adresse MAC de l’hôte La propriété /HOST macaddress est automatiquement configurée par le logiciel serveur de sorte que vous ne pouvez ni la définir ni la modifier. La valeur est lue et déterminée à partir de la carte de configuration système amovible du serveur (PROM SCC) ou à partir de l’ID de PROM du module serveur, puis stockée en tant que propriété dans ILOM. /HOST macaddress désigne l’adresse MAC du port net0. Chaque adresse MAC de port supplémentaire augmente d’une unité, l’adresse de base étant /HOST macaddress. Par exemple, net1 équivaut à la valeur de /HOST macaddress plus un (1). ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show56 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 Utilisation d’une connexion in-band au SP Les sections suivantes décrivent l’utilisation d’une connexion in-band (ou sideband) au SP. ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 Gestion in-band (sideband) d’ILOM Par défaut, la connexion au SP du serveur est établie par le biais du port de gestion réseau out-of-band (NET MGT). La fonction de gestion sideband ILOM vous permet de sélectionner le port NET MGT ou l’un des ports Gigabit Ethernet du serveur (NETn), en l’occurrence des ports in-band, pour envoyer ou recevoir des commandes ILOM vers et à partir du SP du serveur. Les ports in-band sont également désignés en tant que ports sideband. En utilisant un port de gestion sideband pour gérer le processeur de service du serveur, une connexion par câble et un port de commutateur réseau ne sont plus nécessaires. Dans des configurations où de nombreux serveurs sont gérés, comme par exemple dans les centres de données, la gestion sideband peut ainsi permettre des économies importantes en termes d’utilisation de matériel et de réseau. Remarque – L’utilisation de connexions in-band est déconseillée avec les modules serveur. -> show /HOST macaddressConfiguration des adresses réseau 57 Lorsque la gestion sideband est active dans ILOM, les situations suivantes peuvent se produire : ¦ La connexion au SP du serveur peut être interrompue si vous changez la configuration du port de gestion SP lorsque vous êtes connecté au SP via une connexion réseau, telle que SSH, Web ou ILOM Remote Console. ¦ La connectivité intégrée entre le processeur de service et le système d’exploitation hôte peut ne pas être prise en charge par le contrôleur Gigabit Ethernet hôte intégré. Dans ce cas, utilisez un port différent ou routez le trafic de transmission entre la source et les cibles de destination au lieu d’utiliser la commutation/un pont L2. ¦ Les mises hors et sous tension de l’hôte du serveur peuvent interrompre la connectivité réseau des ports Gigabit Ethernet du serveur (NETn) configurés pour la gestion sideband. Dans ce cas, configurez les ports de commutation/pont contigus sous forme de ports hôtes. Informations connexes ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 ¦ « Options d’adresse réseau du SP », page 53 ? Pour configurer l’accès in-band (sideband) au SP Cette procédure décrit la méthode d’accès au SP via une gestion in-band (ou sideband) au moyen d’un port réseau hôte. Si vous effectuez cette procédure via une connexion réseau, vous risquez de perdre la connectivité au serveur. Une connexion série pour cette procédure permet d’éviter la perte de connectivité pendant les modifications de configuration de la gestion sideband. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. En cas de connexion par le port série, vous pouvez assigner une adresse IP statique. Pour obtenir les instructions, consultez les informations relatives à l’assignation d’une adresse IP dans le guide d’installation de votre serveur.58 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Affichez les paramètres réseau actuels : 4. Définissez le port de gestion du SP sur un port sideband (où n correspond à un chiffre compris entre 0 et 3) : -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set commitpending=trueConfiguration des adresses réseau 59 5. Vérifiez l’application de la modification : Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Options d’adresse réseau du SP », page 53 -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NET0 sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show60 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201161 Configuration du mode d’initialisation Les propriétés du mode d’initialisation d’ILOM permettent de spécifier la manière dont l’hôte s’initialise dans le cadre de la résolution d’un problème lié à OpenBoot ou Oracle VM Server pour SPARC. ¦ « Présentation du mode d’initialisation », page 61 ¦ « Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC », page 62 ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Pour gérer le script du mode d’initialisation de l’hôte », page 65 ¦ « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 Présentation du mode d’initialisation Les propriétés du mode d’initialisation (bootmode) annulent et remplacent la méthode d’initialisation par défaut du serveur. Cette possibilité s’avère pratique pour remplacer des paramètres OpenBoot ou Oracle VM Server particuliers pouvant être incorrects, pour configurer des variables OpenBoot à l’aide d’un script ou pour effectuer d’autres tâches similaires. Si, par exemple, les paramètres OpenBoot viennent à être endommagés, vous pouvez définir la propriété bootmode state sur reset_nvram, puis réinitialiser le serveur sur les paramètres OpenBoot par défaut définis en usine. Le personnel de maintenance peut également vous demander d’utiliser la propriété bootmode script afin de résoudre un problème. La portée intégrale des fonctionnalités de script n’est pas documentée et sert principalement à des fins de débogage.62 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Comme bootmode est destiné à corriger un problème lié aux paramètres OpenBoot ou Oracle VM Server, il ne s’applique qu’à une seule initialisation. De plus, pour éviter qu’un administrateur ne définisse la propriété bootmode state puis l’oublie, celle-ci expire lorsque l’hôte n’est pas réinitialisé dans les 10 minutes suivant la configuration de la propriété bootmode state. Informations connexes ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC Remarque – Vous devez utiliser un nom de configuration Oracle VM Server pour cette tâche. 1. Déterminez les configurations Oracle VM Server valides sur votre processeur de service en tapant ce qui suit à l’invite -> d’ILOM : -> show /HOST/domain/configsConfiguration du mode d’initialisation 63 2. Définissez la configuration du mode d’initialisation en tapant ce qui suit à l’invite -> d’ILOM : où la propriété config est dotée d’une valeur configname correspondant à une configuration de domaine logique nommée correcte. Par exemple, si vous avez créé une configuration Oracle VM Server intitulée ldm-set1 : Pour que le mode d’initialisation config revienne à la configuration par défaut d’usine, spécifiez factory-default. Par exemple : Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode config=configname -> set bootmode config=ldm-set1 -> set bootmode config=factory-default64 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations La propriété /HOST/bootmode state contrôle la manière dont les variables de la NVRAM OpenBoot sont utilisées. En général, les paramètres actifs de ces variables sont conservés. Définir /HOST/ bootmode state=reset_nvram permet de ramener les variables de la NVRAM OpenBoot à leurs valeurs par défaut à la réinitialisation suivante. ? A l’invite -> d’ILOM, tapez : où valeur correspond à l’un des paramètres suivants : ¦ normal : conserve les paramètres actifs des variables de la NVRAM à la réinitialisation suivante. ¦ reset_nvram : redéfinit les variables OpenBoot sur les paramètres par défaut à la réinitialisation suivante. Remarque – state=reset_nvram rétablit la valeur « normal » après la prochaine réinitialisation du serveur ou après dix minutes (voir la propriété expires décrite à la section « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66). Les propriétés config et script n’arrivent pas à échéance et sont effacées lors de la prochaine réinitialisation du serveur ou manuellement en définissant la valeur sur "". Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode state=valueConfiguration du mode d’initialisation 65 ? Pour gérer le script du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où script contrôle la méthode d’initialisation du microprogramme OpenBoot PROM du serveur hôte. Le script n’a aucune incidence sur le paramètre /HOST/bootmode actuel. valeur peut compter jusqu’à 64 octets. Vous pouvez spécifier le paramètre /HOST/bootmode et définir le script dans la même commande. Par exemple : Une fois que le serveur est réinitialisé et que l’OpenBoot PROM lit les valeurs stockées dans le script, le microprogramme définit la variable OpenBoot PROM diag-switch? sur la valeur requise par l’utilisateur : true. Remarque – Si vous définissez /HOST/bootmode script="", ILOM configure script sur une valeur vide. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"66 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où expires correspond aux date et heure d’échéance du mode d’initialisation actif. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur Cette procédure vous permet de remplacer les paramètres de l’OpenBoot PROM et de lancer la réinitialisation du domaine de contrôle, ce qui entraîne le démarrage de l’hôte à l’invite ok. ? A l’invite -> d’ILOM, tapez : L’hôte redémarre puis s’arrête à l’invite ok. -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled reset /HOST/domain/control [-force] [-script]Configuration du mode d’initialisation 67 Informations connexes ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Configuration du mode d’initialisation », page 61 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 568 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201169 Configuration du comportement du serveur au redémarrage Pour configurer le comportement d’ILOM dans les scénarios de redémarrage ci-dessous, suivez les procédures indiquées ci-après. ¦ « Pour définir le comportement de l’hôte à sa réinitialisation », page 69 ¦ « Pour définir le comportement de l’hôte lorsque son exécution s’arrête », page 70 ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 ? Pour définir le comportement de l’hôte à sa réinitialisation Spécifiez si l’hôte doit continuer à démarrer lorsqu’une erreur se produit. ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ false : l’hôte continue la procédure d’initialisation même s’il rencontre une erreur. ¦ true : l’hôte ne continue pas la procédure d’initialisation s’il rencontre une erreur. Informations connexes ¦ « Configuration des paramètres de stratégie », page 47 -> set /HOST autorunonerror=value70 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête Spécifiez le comportement d’ILOM lorsque l’hôte quitte l’état d’EXECUTION (à l’expiration de l’horloge chien de garde). ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none : ILOM ne prend pas d’autre mesure que l’émission d’un avertissement. ¦ reset : ILOM tente de réinitialiser le serveur lorsque l’horloge chien de garde Oracle Solaris expire (option par défaut). ¦ dumpcore : ILOM tente de forcer un core dump du SE lorsque l’horloge chien de garde expire. Informations connexes ¦ « Pour afficher l’historique de la console », page 80 ? Pour définir l’intervalle du délai d’attente d’initialisation ? Définissez le délai d’attente entre une requête d’initialisation de l’hôte et l’initialisation proprement dite : La valeur par défaut de boottimeout correspond à 0 (zéro seconde) ou aucun délai d’attente. Les valeurs possibles sont comprises entre 0 et 36 000 secondes. Informations connexes ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguration du comportement du serveur au redémarrage 71 ? Pour définir le comportement à l’expiration du délai d’initialisation Spécifiez le comportement d’ILOM en cas d’échec de l’initialisation de l’hôte avant l’expiration du délai d’initialisation. ? Définissez le comportement au terme de la commande boottimeout : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune, par défaut) ¦ Réinitialisation Informations connexes ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ? Pour définir le comportement en cas d’échec du redémarrage Spécifiez le comportement d’ILOM lorsque l’hôte ne parvient pas à atteindre l’état running pour Oracle Solaris. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ powercycle ¦ poweroff (valeur par défaut) Informations connexes ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value72 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le nombre maximum de tentatives de redémarrage Indiquez le nombre de fois qu’ILOM doit tenter de redémarrer l’hôte. ? A l’invite -> d’ILOM, tapez : La valeur par défaut de maxbootfail est 3 (trois tentatives). Si l’initialisation de l’hôte échoue après le nombre de tentatives indiqué par maxbootfail, l’hôte est mis hors tension ou soumis à un cycle d’alimentation progressive (selon la configuration de bootfailrecovery). Dans les deux cas, la commande boottimeout est définie sur 0 (zéro seconde), empêchant d’autres tentatives de redémarrage de l’hôte. Informations connexes ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 -> set /HOST maxbootfail=attempts73 Configuration des périphériques Les sections suivantes présentent des informations sur la configuration des périphériques du serveur. ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour déconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=disabled permettant de déconfigurer manuellement les périphériques du serveur. Cette commande identifie le périphérique spécifié comme étant désactivé (disabled). Tout périphérique marqué disabled, que ce soit manuellement ou par le microprogramme système, est supprimé de la description de machine du serveur avant le transfert de contrôle à d’autres couches du microprogramme système, comme l’OpenBoot PROM. ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=disabled74 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour reconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=enabled permettant de reconfigurer manuellement les périphériques serveur. Cette commande vous permet de marquer le périphérique spécifié comme étant activé (enabled). ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=enabled75 Contrôle du serveur Le serveur dispose de nombreuses méthodes pour signaler un comportement défectueux, notamment les DEL, ILOM et l’autotest de l’allumage (POST). Pour en savoir plus sur les DEL et obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Contrôle des pannes », page 75 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour localiser le serveur », page 87 Contrôle des pannes Les sections suivantes présentent un récapitulatif des outils de diagnostic ainsi que des informations de base sur la détection des pannes du serveur à l’aide d’outils exécutés en amont du système d’exploitation, notamment ILOM et le POST. Pour obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Présentation des diagnostics », page 76 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher l’historique de la console », page 80 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ¦ « Pour effacer une panne », page 8376 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation des diagnostics Vous disposez de toute une gamme d’outils de diagnostic, de commandes et d’indicateurs permettant de contrôler et de dépanner un serveur. Reportez-vous au manuel d’entretien de votre serveur pour obtenir des informations complètes sur ces outils de diagnostic : ¦ DEL : fournissent une indication visuelle rapide du statut du serveur et de certaines FRU. ¦ ILOM : microprogramme exécuté sur le processeur de service. Outre l’interface qu’il fournit entre le matériel et le SE, le microprogramme ILOM permet également de suivre et de signaler l’état général des composants clés du serveur. ILOM exploite pleinement le POST et la technologie d’autorétablissement prédictif d’Oracle Solaris pour maintenir le serveur en état de fonctionnement, même en présence d’un composant défectueux. ¦ Autotest de l’allumage (POST) : le POST effectue des tests de diagnostic sur les composants du serveur après une réinitialisation manuelle pour s’assurer de leur intégrité. Configurable, le POST utilise le microprogramme ILOM pour mettre hors tension les composants défectueux, le cas échéant. ¦ Autorétablissement prédictif du SE Oracle Solaris : cette technologie contrôle en permanence l’intégrité du processeur et de la mémoire, et fonctionne avec ILOM pour placer un composant défectueux hors ligne, le cas échéant. Elle permet aux serveurs de prévoir avec précision les pannes de composants et de limiter de nombreux problèmes graves avant qu’ils ne surviennent. ¦ Fichiers journaux et interface de commandes : fournissent les fichiers journaux standard du SE Oracle Solaris, ainsi que les commandes d’investigation qui peuvent être utilisées et affichées sur le périphérique de votre choix. ¦ SunVTS : application qui permet de tester le serveur, de vérifier le fonctionnement du matériel et d’identifier les composants éventuellement défectueux en fournissant des recommandations pour leur réparation. Les DEL, le microprogramme ILOM, l’autorétablissement prédictif du SE et les nombreux fichiers journaux et messages de la console offrent une intégration mutuelle totale. Cela signifie que, par exemple, en cas de panne détectée par le logiciel Oracle Solaris, celle-ci est affichée et consignée, tandis que les informations correspondantes sont transmises à ILOM qui les consigne. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ Consultez la section du manuel d’entretien du serveur concernant la détection et la gestion des pannes.Contrôle du serveur 77 ? Pour détecter les pannes (ILOM) ? A l’invite -> d’ILOM, tapez : Cette commande affiche la cible, la propriété et la valeur de la panne. Par exemple : Informations connexes ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) Le shell de gestion des pannes d’ILOM (Fault Management Shell) permet d’utiliser les commandes du gestionnaire des pannes d’Oracle Solaris (fmadm et fmstat à partir d’ILOM, afin de visualiser à la fois les pannes relatives à l’hôte et à ILOM. 1. Pour lancer le shell intégré, à l’invite -> d’ILOM, tapez : -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/Faultmgt/shell (y/n)? y faultmgmtsp>78 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Pour obtenir la liste des pannes actuelles du serveur, tapez : Remarque – Si le serveur détecte le remplacement de la FRU défectueuse, la réparation ne nécessite pas l’exécution d’une commande par l’utilisateur, car la panne sera effacée automatiquement. 3. Détectez des informations complémentaires sur une panne donnée. Recherchez l’identificateur de panne MSG-ID (SPT-8000-42 dans l’exemple précédent), puis saisissez-le dans la zone de recherche à l’adresse http://www.sun.com/msg. 4. Pour réparer la panne, reportez-vous à la section : « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81. 5. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Contrôle du serveur 79 Informations connexes ¦ Article sur l'autorétablissement prédictif (en anglais) « Oracle Solaris 10 OS Feature Sportlight: Predictive Self Healing » disponible à l’adresse www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ? Pour détecter les pannes à l’aide du POST L’interrupteur à clé virtuel permet d’exécuter des diagnostics POST complets sans avoir à modifier les paramètres des propriétés de diagnostic. Notez que l’exécution des diagnostics POST peuvent prendre temps considérable lors de la réinitialisation du serveur. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. A l’invite -> d’ILOM, tapez : Le serveur est configuré pour exécuter les diagnostics POST complets au moment de sa réinitialisation. 3. Pour revenir aux paramètres de diagnostic standard après l’exécution du POST, à l’invite -> d’ILOM, tapez ce qui suit : Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal80 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher l’historique de la console Cette rubrique décrit la procédure d’affichage des tampons de sortie de la console du serveur hôte. Il existe deux tampons d’historique de console pouvant contenir jusqu’à 1 Mo d’informations. La cible /HOST/console/history écrit tous les types d’informations de journalisation. La cible /HOST/console/bootlog consigne les informations de démarrage et les données d’initialisation dans le tampon de la console jusqu’à ce qu’ILOM soit notifié par le serveur que le SE Oracle Solaris est exécuté et opérationnel. Ce tampon est conservé jusqu’à ce que l’hôte soit réinitialisé. Remarque – Vous devez disposer des droits d’administrateur ILOM pour utiliser cette commande. 1. Pour gérer le journal /HOST/console/history, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 1 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 1 et tout nombre entier ou "" pour indiquer un nombre de lignes illimité. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Si vous tapez la commande show /HOST/console/history sans définir d’arguments préalables à l’aide de la commande set, ILOM affiche toutes les lignes du journal de la console en commençant par la fin. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. -> set /HOST/console/history property=option [...] -> show /HOST/console/historyContrôle du serveur 81 2. Pour afficher le journal /HOST/console/bootlog, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) Vous pouvez utiliser la commande fmadm repair pour corriger des pannes diagnostiquées par ILOM. (Contrairement aux pannes détectées par l’hôte, les pannes et erreurs diagnostiquées par ILOM sont dotées d’un ID de message commençant par SPT.) Le seul moment auquel vous devriez utiliser la commande fmadm repair dans le shell de gestion des pannes d’ILOM pour une panne détectée par l’hôte est le cas où la panne est réparée sans qu’ILOM le remarque. Il se peut, par exemple, qu’ILOM ait été hors service lorsque la panne a été réparée. Dans ce cas, l’hôte n’afficherait plus la panne, contrairement à ILOM. Utilisez la commande fmadm repair pour effacer la panne. -> show /HOST/console/bootlog property82 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 1. Localisez la panne : 2. Pour réparer une panne détectée par ILOM, exécutez la commande fmadm repair : Remarque – Vous pouvez utiliser soit le nom NAC (par exemple, /SYS/MB) soit l’UUID (par exemple, fa4a2f86-5156-4243-8e88-d6516db12970) de la panne avec la commande fmadm repair. 3. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : Informations connexes ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit ->Contrôle du serveur 83 ? Pour effacer une panne ? A l’invite -> d’ILOM, tapez : Définissez clear_fault_action sur true pour effacer la panne au niveau du composant et à tous les niveaux inférieurs de l’arborescence /SYS. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher les composants du serveur », page 86 Activation de la récupération automatique du système Les sections suivantes présentent des informations relatives à la configuration du serveur en vue de récupérer automatiquement de pannes mineures. Remarque – Cette section fait référence à la fonction de récupération automatique du système et non à la fonction de dénomination voisine, l’Auto Service Request (requête automatique de service). ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 -> set /SYS/component clear_fault_action=true84 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation de la récupération automatique de système Le serveur assure la récupération automatique du système (ASR) en cas de panne des modules de mémoire ou des cartes PCI. La fonction ASR permet au serveur de reprendre son fonctionnement après certaines défaillances ou pannes matérielles non fatales. Lorsque l’ASR est activée, les diagnostics du microprogramme du système détectent automatiquement les composants matériels en panne. Une fonction de configuration automatique intégrée au microprogramme du système permet au système de déconfigurer les composants en panne et de rétablir le fonctionnement du serveur. Tant que le serveur est en mesure de fonctionner sans le composant en panne, la fonction ASR lui permet de redémarrer automatiquement sans intervention de l’utilisateur. Remarque – Vous devez activer l’ASR manuellement. Reportez-vous à la section « Pour activer la fonction ASR », page 84. Pour plus d’informations sur l’ASR, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour activer la fonction ASR 1. A l’invite -> d’ILOM, tapez : 2. A l’invite ok, tapez : -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? trueContrôle du serveur 85 Remarque – Pour plus d’informations sur les variables de configuration OpenBoot, reportez-vous au manuel d’entretien du serveur. 3. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke en permanence les modifications apportées aux paramètres et est automatiquement initialisé si la variable de configuration OpenBoot auto-boot? est définie sur true (valeur par défaut). Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour désactiver la fonction ASR 1. A l’invite ok, tapez : 2. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke définitivement le changement de paramètre. Une fois désactivée, la fonction ASR le reste tant que vous ne la réactivez pas. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ¦ « Présentation de la récupération automatique de système », page 84 ok reset-all ok setenv auto-boot-on-error? false ok reset-all86 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher des informations sur les composants concernés par l’ASR ? A l’invite -> d’ILOM, tapez : Dans la sortie de la commande show /SYS/composant component_state, tout périphérique indiqué comme désactivé a été déconfiguré manuellement en utilisant le microprogramme du système. La sortie de la commande indique également les périphériques qui ont échoué aux diagnostics du microprogramme et ont été automatiquement déconfigurés par le microprogramme du système. Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour afficher les composants du serveur Affichez des informations en temps réel sur les composants installés sur votre serveur en utilisant la commande show components d’ILOM. ? A l’invite -> d’ILOM, tapez : -> show /SYS/component component_state -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | EnabledContrôle du serveur 87 Remarque – Les composants varient en fonction du serveur. Informations connexes ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 ? Pour localiser le serveur Si vous avez besoin d’effectuer une opération de maintenance sur un composant, vous identifierez plus facilement le serveur concerné par la DEL de localisation système qui s’allume. Vous n’avez besoin d’aucun droit administrateur pour utiliser les commandes set /SYS/LOCATE et show /SYS/LOCATE. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. Gérez la DEL de localisation à l’aide des commandes suivantes. ¦ Pour activer la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour désactiver la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour afficher l’état de la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : Informations connexes ¦ « Contrôle des pannes », page 75 ¦ « Configuration des périphériques », page 73 /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=off -> show /SYS/LOCATE88 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201189 Mise à jour du microprogramme Les sections suivantes décrivent les procédures de mise à jour du microprogramme système et d’affichage des versions actuelles des microprogrammes des serveurs de la série SPARC T3 d’Oracle. ¦ « Pour afficher la version du microprogramme », page 89 ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Pour afficher la version d’OpenBoot », page 92 ¦ « Pour afficher la version de POST », page 93 ? Pour afficher la version du microprogramme La propriété /HOST sysfw_version affiche des informations relatives à la version du microprogramme système installée sur l’hôte. ? Affichez le paramètre actuel de cette propriété. A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST sysfw_version90 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour mettre à jour le microprogramme 1. Assurez-vous que le port de gestion réseau du processeur de service est configuré. Pour les instructions, reportez-vous au guide d’installation de votre serveur. 2. Ouvrez une session SSH pour vous connecter au processeur de service : 3. Mettez l’hôte hors tension : 4. Définissez le paramètre keyswitch_state sur normal: 5. Tapez la commande load en indiquant le chemin d’accès à la nouvelle image flash. La commande load met à jour à la fois l’image flash du processeur de service et le microprogramme de l’hôte. La commande load requiert les informations suivantes : ¦ Adresse IP d’un serveur TFTP du réseau pouvant accéder à l’image flash ¦ Chemin d’accès complet à l’image flash à laquelle l’adresse IP peut accéder % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalMise à jour du microprogramme 91 Cette commande s’utilise de la manière suivante : load [-script] -source tftp://xxx.xxx.xx.xxx/chemin d’accès où : ¦ -script : ne demande aucune confirmation et agit comme si yes était spécifié. ¦ -source : indique l’adresse IP et le chemin d’accès complet (URL) de l’image flash. Une fois l’image flash mise à jour, le serveur est réinitialisé automatiquement, puis il exécute les diagnostics et revient à l’invite de connexion sur la console série. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED92 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour afficher la version du microprogramme », page 89 ? Pour afficher la version d’OpenBoot La propriété /HOST obp_version affiche des informations sur la version d’OpenBoot installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Présentation d’OpenBoot », page 4 ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionMise à jour du microprogramme 93 ? Pour afficher la version de POST La propriété /HOST post_version affiche des informations sur la version de POST installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST post_version94 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201195 Mise à jour du système d’exploitation Oracle Solaris Ces rubriques décrivent comment mettre à jour le SE Oracle Solaris sur les serveurs Oracle SPARC de la série T3. ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe de nom universel Le SE Oracle Solaris utilise à présent la syntaxe de nom universel (WWN) au lieu du champ unique au niveau local tn (ID cible) dans les noms de périphériques logiques. Ce changement modifie la façon dont un périphérique de stockage cible est identifié lors du téléchargement du système d'exploitation sur un réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement :96 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ Avant le passage à la nomenclature WWN, le SE Oracle Solaris identifiait le périphérique d'initialisation par défaut comme étant c0t0d0. ¦ Depuis ce changement, l'identificateur du périphérique d'initialisation par défaut est désormais c0tWWNd0, où WWN correspond à une valeur hexadécimale unique à ce périphérique au niveau mondial. ¦ Cette valeur WWN n'est pas mappée de façon prévisible à l'adresse physique du périphérique auquel elle fait référence. Pour spécifier de manière fiable un périphérique de stockage particulier lors du téléchargement d'un système d'exploitation, vous devez déterminer la correspondance entre la valeur WWN affectée à ce périphérique et son emplacement physique. Vous trouverez cette correspondance à l'aide des commandes OBP ou Oracle Solaris : ¦ Dans OBP, exécutez probe-scsi-all. Voir « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ Dans Oracle Solaris, exécutez la commande format suivie de prtconf -v. Voir « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ou « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111. Ces commandes génèrent des informations sur les contrôleurs SAS et les périphériques de stockage qui leur sont connectés. Ces informations comprennent les noms logiques et physiques que vous pouvez analyser pour déterminer les relations entre les adresses physiques et logiques. Informations connexes ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116Mise à jour du système d’exploitation Oracle Solaris 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans une configuration de fond de panier à huit disques. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 7 disques durs dans une configuration de fond de panier à huit disques. Dans cet exemple, les disques durs sont connectés aux deux contrôleurs SAS de la manière suivante : ¦ Quatre disques durs sont connectés au contrôleur SAS 0. Il s'agit des cibles 9, a, b et c. ¦ Trois disques durs, ainsi qu'une unité de DVD SATA sont connectés au contrôleur SAS 1. Il s'agit respectivement des cibles 9, b, c et a. TABLEAU : Mappage des ports de contrôleurs SAS pour les backplanes à huit disques Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 798 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple de configuration est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7680d4 SASAddress 5000cca00a7680d5 PhyNum 2 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 3 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d40bf9b SASAddress 5000c5001d40bf99 PhyNum 1Mise à jour du système d’exploitation Oracle Solaris 99 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans un fond de panier à seize disques connectés aux contrôleurs SAS intégrés 0 et 1.100 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – La configuration d'un fond de panier à 16 disques par défaut se compose de deux zones isolées de façon logique, les emplacements de disque 0 à 7 pouvant être vus par le contrôleur SAS 0 et les emplacements de disque 8 à 15 pouvant l'être par le contrôleur SAS 1. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 9 disques durs dans une configuration de fond de panier à seize disques. Remarque – Le contrôleur 1 gère l'unité de DVD SATA. L'emplacement d'initialisation par défaut (emplacement physique 0) est répertorié sous le nom PhyNum 0 dans la section du contrôleur SAS 0. Son SASDeviceName a la valeur 5000cca00a59278c et son SASAddress a la valeur 5000cca00a59278d. TABLEAU : Mappage des ports de contrôleurs SAS pour les fonds de panier à seize disques Contrôleur SAS PhyNum (Hexadécimal) Emplacement de disque (Décimal) Contrôleur SAS PhyNum (Hexadéci mal) Emplacement de disque (Décimal) 0 0 0 1 8 8 1 1 9 9 2 2 A 10 3 3 B 11 4 4 C 12 5 5 D 13 6 6 E 14 7 7 F 15 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a746490 SASAddress 5000cca00a746491 PhyNum 8 Target bMise à jour du système d’exploitation Oracle Solaris 101 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d1283 SASAddress 5000c5001d0d1281 PhyNum 9 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a01014c SASAddress 5000cca00a01014d PhyNum a Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0ca947 SASAddress 5000c5001d0ca945 PhyNum b Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d2857 SASAddress 5000c5001d0d2855 PhyNum c Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02f5d0 SASAddress 5000cca00a02f5d1 PhyNum d Target 10 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c3d9b SASAddress 5000c5001d0c3d99 PhyNum e Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097737 SASAddress 5000c5001d097735 PhyNum f Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a59278c SASAddress 5000cca00a59278d PhyNum 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7e6fb SASAddress 5000c50017c7e6f9 PhyNum 1 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4bfcb8 SASAddress 5000cca00a4bfcb9 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7a3a3 SASAddress 5000c50017c7a3a1 PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02cc18 SASAddress 5000cca00a02cc19 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76dec0 SASAddress 5000cca00a76dec1 PhyNum 5 Target 10 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a773eac SASAddress 5000cca00a773ead PhyNum 6102 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-4) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09654f SASAddress 5000c5001d09654d PhyNum d Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 okMise à jour du système d’exploitation Oracle Solaris 103 ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Un serveur SPARC T3-4 a deux contrôleurs SAS intégrés, chacun connecté à un fond de panier à quatre disques différent. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque de ces fonds de panier. Remarque – OBP utilise un chemin d'accès différent au contrôleur SAS 1 dans les serveurs SPARC T3-4, selon que le serveur dispose de quatre ou deux processeurs. Le chemin d'accès au contrôleur SAS 0 est le même pour les deux configurations de processeurs. Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à quatre processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. TABLEAU : Mappage des ports de contrôleurs SAS pour un fond de panier à huit disques SAS Contrôleur PhyNum Emplacement de disque SAS Contrôleur PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00104 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 105 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à deux processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2106 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 107 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) Utilisez probe-scsi-all pour afficher les informations suivantes d'un périphérique SAS : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. L'exemple suivant est basé sur un serveur SPARC T3-2 à six disques durs. Quatre disques durs sont connectés au contrôleur SAS en tant que périphériques de stockage individuels. Il s'agit de Target 9, d, e et f. Deux disques durs sont configurés en tant que volume RAID. Cette baie de disques est Target 389. ? Exécutez probe-scsi-all. Dans l'exemple suivant, le disque dur installé à l'emplacement physique 0 a la valeur PhyNum 0. Il est désigné Target 9 et son SASDeviceName a la valeur 5000c5001cb4a637. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB108 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – L'exemple de sortie de probe-scsi-all illustré ci-dessus peut être appliqué à l'interprétation de la sortie de probe-scsi-all pour les systèmes SPARC T3-1B. Remarque – La sortie de probe-scsi-all des serveurs SPARC T3-1 et SPARC T3-4 présente des caractéristiques spéciales en raison de leur utilisation de deux contrôleurs SAS intégrés. En outre, sur les serveurs SPARC T3-1 dotés d'un fond de panier à seize disques, les deux contrôleurs se connectent aux disques durs à l'aide d'un expandeur SAS figurant sur le fond de panier. Ces différences sont expliquées dans « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 et « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00Mise à jour du système d’exploitation Oracle Solaris 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 dotés d'un fond de panier à seize disques. Ces systèmes disposent d'un expandeur SAS placé entre les deux contrôleurs SAS intégrés et les connecteurs de disque dur. Le fond de panier à 16 disques est divisé en zones, la valeur phy-num associée à chaque disque étant relative à son contrôleur. Remarque – Pour les systèmes dotés d'un fond de panier à huit disques et de deux contrôleurs intégrés, chaque contrôleur fournit une interface à quatre emplacements de disque. La valeur phy-num associée à chaque disque est ainsi relative à son contrôleur. Un exemple de la procédure de configuration d'un seul initiateur est donné dans « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 1. Exécutez la commande format. Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000c5001d3ff2d7d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000c5001d3ff2d7d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000C5001D3FF2D7d0 /scsi_vhci/disk@g5000c5001d3ff2d7 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/sd3a110 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000c5001d3ff2d7. Notez la valeur target-port répertoriée avec cette valeur WWN. Dans cet exemple, il s'agit de 5000c5001d3ff2d5. Il s'agit de l'ID cible du disque physique. Remarque – Dans un système SPARC T3-1 doté d'un fond de panier à seize disques, les deux contrôleurs répertorient le nom logique (la valeur wwn), le nom de port correspondant (valeur target-port) et l'emplacement de disque physique (valeur phy-num) de chaque disque dur connecté. dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/rsd3a Paths from multipath bus adapters: mpt_sas#2 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ <<=== Hard drive target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 <<=== Hard drive slot number name=’path-class’ type=string items=1 value=’primary’ mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 name=’path-class’ type=string items=1 value=’primary’Mise à jour du système d’exploitation Oracle Solaris 111 4. The value shown for the name=’phy-num’ entry indicates the physical slot containing the hard drive. Dans cet exemple, le périphérique cible se trouve à l'emplacement 4. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 et aux serveurs SPARC T3-4 d'une configuration de fond de panier à huit disques et un seul initiateur. 1. Exécutez la commande format. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]112 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000CCA00ABBAEB8d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000CCA00ABBAEB8d0. 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000cca00abbaeb8. Notez la valeur obp-path répertoriée sous le WWN 5000cca00abbaeb8. Reportez-vous au tableau ci-dessous pour trouver le contrôleur. Pour les serveurs SPARC T3-1, le contrôleur est identifié dans le deuxième champ : pci@1 = contrôleur 0 et pci@2 = contrôleur 1. Pour les serveurs SPARC T3-4, le contrôleur est identifié dans le premier champ. Pour les systèmes équipés de quatre processeurs, pci@400 = contrôleur 0 et pci@700 = contrôleur 1. Pour les systèmes équipés de deux processeurs, pci@400 = contrôleur 0 et pci@500 = contrôleur 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/rsd3a SPARC T3-1 Contrôleur 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 4) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 2) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Mise à jour du système d’exploitation Oracle Solaris 113 L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-1. Dans cet exemple de serveur SPARC T3-1, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-4. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’114 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Dans cet exemple de serveur SPARC T3-4, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. 4. Cette valeur phy-num correspond à l'emplacement de disque physique 0, comme indiqué dans la table de mappage des ports suivante. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Mise à jour du système d’exploitation Oracle Solaris 115 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur une unité de disque précise. Dans cet exemple, le nom du périphérique contient la valeur WWN 5000CCA00A75DCAC. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap116 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur un volume RAID. Lors de l'installation d'un logiciel sur un volume RAID, utilisez la valeur VolumeDeviceName du périphérique virtuel au lieu du nom de périphérique individuel. Dans cet exemple, le nom du volume RAID est 3ce534e42c02a3c0. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapMise à jour du système d’exploitation Oracle Solaris 117 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115118 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011119 Index A A propos, 1 Accès à la console système, 12 Accès réseau, activation ou désactivation, 54 Activation, 84 Adresse MAC de l’hôte, affichage, 55 Affichage de la version, 89, 92, 93 Affichage des composants concernés, 86 Annulation de la configuration, 73 C Câbles, clavier et souris, 15 Chemins d’accès aux périphériques, 43 Clavier, connexion, 15 Commandes, 37 Communication système, 11 Comportement à l’expiration du délai d’initialisation, 71 Comportement en cas d’échec du redémarrage, 71 Comportement lorsque l’hôte cesse de fonctionner, 70 Comportement suite à la réinitialisation de l’hôte, 69 Configuration, 25, 74 Connexion, 11 Console système, connexion, 12 Contournement, 83 Contrôle, 19 Création de volumes, 38 D Date d’expiration, 66 Définition au redémarrage, 49 Définition de l’état d’alimentation de l’hôte au redémarrage, 49 Définition de l’intervalle du délai d’attente d’initialisation, 70 Définition du nombre maximum de tentatives de redémarrage, 72 Désactivation, 85 Détection à l’aide d’ILOM, 77 Détection à l’aide du POST, 79 DHCP, affichage de l’adresse IP du serveur, 54 Diagnostic, 76 E Effacement, 83 Exécution de diagnostics, 79 F FCode, utilitaire, 36 Fonctions spécifiques à la plate-forme, 3 FRU, modification des données, 45 G Gestion, 73, 75 Gestion de la configuration, 62 Gestion du délai de mise sous tension, 50 Gestion du script, 65 Gestion du système, 61 Gestion lors de la réinitialisation, 64 H Historique de la console, affichage, 80 I Identification du système, modification, 46 Interrupteur à clé, comportement de l’hôte, 51 Invite, 12, 15120 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 L Localisation du serveur, 87 M Méthodes d’accès, 15 Microprogramme, mise à jour, 90 Mise hors tension, 20 Mise sous tension, 19 Moniteur graphique local, 15 Multiacheminement, logiciel, 6 N Nom d’utilisateur et mot de passe par défaut, 12 O ok, affichage de l’invite, 13 Options d’adresse réseau, 53 Oracle VM Server (LDoms), 62 Oracle VM Server pour SPARC, présentation, 5 P Présentation, 1, 61 Présentation de l’administration système, 1 Prise en charge, 25 R Réinitialisation à partir d’ILOM, 22 Réinitialisation à partir du SE, 21 Restauration au redémarrage, 48 S setting configuration variables, 16 SP, réinitialisation, 23 Stratégie d’initialisation parallèle, 50 SunVTS, 76 Serveur SPARC T3-4 Notes de produit N° de référence : 821-3143-11 Décembre 2010, révision ACopyright © 2010, Oracle et/ou ses sociétés af?liées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des États-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. En tant que tels, leurs utilisation, duplication, divulgation, modi?cation et adaptation doivent être soumises aux restrictions et conditions de licence énoncées dans le contrat du Gouvernement applicable et, dans la mesure autorisée par ce contrat du Gouvernement, aux droits supplémentaires énoncés dans le FAR 52.227-19, Commercial Computer Software License (décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, États-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés af?liées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.1 Notes de produit du serveur SPARC T3-4 Ce document contient les rubriques suivantes et des informations de dernière minute concernant le serveur SPARC T3-4 d’Oracle : ¦ « Logiciels préinstallés pour les configurations standard », page 1 ¦ « Versions du SE Oracle Solaris prises en charge », page 2 ¦ « Informations sur les patchs », page 3 ¦ « Configuration de module de processeur unique non prise en charge », page 3 ¦ « Module d’E/S arrière doté d’une configuration de ports QSFP non pris en charge », page 4 ¦ « Shell de compatibilité ALOM CMT non pris en charge », page 4 ¦ « Problèmes connus concernant le produit », page 5 Logiciels préinstallés pour les configurations standard Le tableau suivant dresse la liste des logiciels préinstallés sur le serveur. Les patchs requis au moment où le serveur était prêt à être expédié ont été installés en usine. Pour des informations récentes sur tous les patchs, y compris ceux destinés aux logiciels préinstallés, rendez-vous sur le site Web My Oracle Support : https://support.oracle.com/2 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Remarque – Le SE Oracle Solaris préinstallé est stocké sur un système de fichiers ZFS. Versions du SE Oracle Solaris prises en charge Une copie du SE Oracle Solaris 10 9/10 est préinstallée sur le premier disque du serveur. Le SE est prêt à être configuré au moment opportun lors de la mise sous tension initiale du serveur. Le serveur prend en charge les versions suivantes du SE Oracle Solaris : ¦ SE Oracle Solaris 10 10/09 avec le bundle de patchs Oracle Solaris 10 9/10 ou les bundles compatibles avec les futures versions ¦ SE Oracle Solaris 10 9/10 (préinstallé sur le serveur) Pour des informations récentes sur les patchs du serveur, les composants optionnels et les logiciels, rendez-vous sur le site Web Oracle Support : https://support.oracle.com/ Remarque – Dans le cadre de l’utilisation du logiciel Oracle VM Server, les domaines control et guest prennent tous deux en charge ces versions minimales du SE Oracle Solaris. Pour obtenir des instructions d’installation et de configuration d’Oracle Solaris, reportez-vous à la documentation livrée avec le système d’exploitation. Logiciel Emplacement Fonction SE Oracle Solaris 10 9/10 Tranche 0 du disque root (et tranche 3 pour un ABE) Système d’exploitation Oracle VM Server pour SPARC 2.0 /opt/SUNWldm Gestion des domaines logiques Electronic Prognostics 1.1 /opt/ep Génération d’avertissements précoces concernant des pannes de FRU potentielles.Notes de produit du serveur SPARC T3-4 3 Informations sur les patchs Tous les patchs obligatoires sont installés en usine. Si vous réinstallez le SE Oracle Solaris sur le serveur, vous devez impérativement installer les patchs requis pour le SE, le serveur et tous les composants matériels et logiciels optionnels installés. Au moment de la publication de ce document, le serveur nécessitait les patchs du SE Oracle Solaris 10 9/10 suivants. Si vous réinstallez le SE Oracle Solaris 10 9/10, vous devez installer les dernières versions compatibles de ces patchs. ¦ 143647-08 ¦ 144567-01 ¦ 145098-02 ¦ 145868-01 ¦ 144486-04 ¦ 144488-04 ¦ 145786-02 ¦ 145961-01 Pour télécharger la dernière version de ces patchs et obtenir la liste à jour des patchs obligatoires, rendez-vous sur le site Web My Oracle Support : https://support.oracle.com/ Remarque – Pour des informations actualisées sur les patchs obligatoires et les mises à jour des composants matériels et logiciels optionnels, consultez la documentation des produits concernés. Configuration de module de processeur unique non prise en charge Le SPARC T3-4 Server Service Manual contient des informations sur la configuration de module de processeur unique, non prise en charge pour l’instant. Ne tenez pas compte des informations sur ce sujet figurant dans ce manuel.4 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Module d’E/S arrière doté d’une configuration de ports QSFP non pris en charge Il existe deux configurations pour le module d’E/S arrière : ¦ Module d’E/S arrière doté de ports QSFP ¦ Module d’E/S arrière sans ports QSFP Pour le moment, le module d’E/S arrière doté d’une configuration de ports QSFP n’est pas pris en charge. Ne tenez pas compte des informations figurant dans la documentation du serveur SPARC T3-4 concernant le module d’E/S arrière doté d’une configuration de ports QSFP. Shell de compatibilité ALOM CMT non pris en charge Le serveur SPARC T3-4 ne prend pas en charge le shell de compatibilité de ligne de commande ALOM (Advanced Lights Out Manager) CMT (cli_mode=alom), disponible sur les plates-formes antérieures. Pour plus d’informations sur les fonctions Oracle ILOM (Integrated Lights Out Manager) prises en charge, reportezvous au Guide d’administration des serveurs de la série SPARC T3.Notes de produit du serveur SPARC T3-4 5 Problèmes connus concernant le produit Cette section décrit les problèmes connus ayant un impact sur le serveur SPARC T3-4 d’Oracle. Les problèmes sont décrits de la manière suivante : ¦ « Problèmes liés au matériel », page 5 ¦ « Problèmes liés au système d’exploitation Oracle Solaris », page 13 ¦ « Problèmes liés au microprogramme », page 30 Problèmes liés au matériel Cette section décrit les problèmes connus relatifs au matériel. Baisse des performances TCP RX des cartes PCIe SFP+ 10 Gb 4 ports Sun Dual (CR 6943558) Une perte excessive de paquets a été observée suite à l’utilisation d’au moins trois ports par plusieurs cartes PCIe SFP+ 10 Gb Sun Dual. De ce fait, les performances de transmission et de réception ont été considérablement dégradées. Lorsque deux ports seulement sont utilisés, la perte de paquets est minime et les performances d’émission et de réception sont conformes aux attentes. Solution : Pour activer le contrôle de flux des interfaces, suivez l’une des procédures ci-dessous. Vous pourrez ainsi considérablement réduire la perte de paquets observée et augmenter les performances. ? Pour activer le contrôle de flux (avec redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf suivant : 2. Redémarrez le système afin d’appliquer les modifications apportées au pilote. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;6 Notes de produit du serveur SPARC T3-4 • Décembre 2010 ? Pour activer le contrôle de flux (sans redémarrage du système) 1. Insérez les lignes suivantes dans le fichier de configuration /kernel/drv/ixgbe.conf suivant : 2. Démontez toutes les interfaces ixgbe. 3. Tapez la commande update_drv ixgbe : 4. Montez toutes les interfaces ixgbe. PARALLEL_BOOT/HOST_LAST_POWER_STATE=enabled en échec, état de marche inattendu (arrêt) après un cycle de CA (CR 6994047) Lorsque le paramètre HOST_LAST_POWER_STATE est défini sur enabled puis que le système est mis progressivement sous tension CA, l’hôte est quelquefois affiché comme étant OFF (ÉTEINT) au terme de l’opération de mise sous tension. Ces informations de statut peuvent être erronées. Méthode de récupération : Remettez progressivement sous tension le système afin d’effacer les informations de statut erronées. Panique du serveur lors d’un démarrage à partir d’une clé USB connectée à l’un des ports USB avant (CR 6983185) Lorsque vous tentez d’initialiser une clé USB (unité flash USB portable) insérée dans l’un des ports USB avant (USB2 ou USB3), le serveur génère une erreur grave et ne parvient pas à s’initialiser. Solution : Utilisez les ports USB arrière du serveur (USB0 ou USB1) pour démarrer à partir d’une clé USB externe. fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; # update_drv ixgbeNotes de produit du serveur SPARC T3-4 7 Câbles QSFP en cuivre non pris en charge (CR 6941888) Le module réseau 10 Gb du serveur SPARC T3-4 ne prend pas en charge les câbles QSFP en cuivre. Le module réseau est uniquement compatible avec les câbles et modules de transcepteurs QSFP optiques. Solution : Utilisez le câble indiqué dans la liste des options de système prises en charge. Performances limitées lors d’un enfichage à chaud de carte x8 dans un emplacement précédemment occupé par une carte x4 (CR 6987359) Si vous enfichez à chaud une carte NIC (Network Interface Card) Dual 10GbE SFP+ PCIe2.0 Niantic EM (réf. 1110A-Z) dans un emplacement de module Express PCI précédemment occupé par une carte de module Express à 4 ports (Cu) PCIe (x4) (réf. (X)7284A-Z-N), vous n’observerez peut-être pas les performances attendues avec une carte NIC Dual 10GbE SFP+ PCIe2.0 Niantic. Ce problème ne se produit pas si l’emplacement était précédemment inoccupé ou s’il était occupé par un autre type de carte optionnelle. Il n’a pas lieu non plus si la carte est déjà insérée lorsque le système est sous tension. Solution : Enfichez à chaud la carte EM Dual 10Gbe SFP+ PCIe2.0 Niantic une deuxième fois en utilisant l’une des méthodes suivantes. ¦ Exécutez la commande cfgadm(1m) pour déconnecter puis reconnecter la carte : ¦ Exécutez la commande hotplug(1M) pour désactiver et mettre hors tension le périphérique, puis mettre sous tension et activer ce dernier : ¦ Utilisez le bouton Attention (ATTN) figurant sur la carte pour déconfigurer puis reconfigurer cette dernière. # cfgadm -c disconnect nom-emplacement # cfgadm -c configure nom-emplacement # hotplug disable chemin-périphérique nom-emplacement # hotplug poweroff chemin-périphérique nom-emplacement # hotplug poweron chemin-périphérique nom-emplacement # hotplug enable chemin-périphérique nom-emplacement8 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Remarque – Il est inutile de retirer physiquement la carte puis de la réinsérer dans le cadre de la deuxième opération d’enfichage à chaud. Messages d’erreur non conservés après des erreurs de mémoire incorrigibles et corrigibles (CR 6990058) Si la mémoire du serveur rencontre une erreur incorrigible suivie d’une erreur corrigible, les messages d’erreur corrects ne sont ni générés ni conservés par le processeur de service. Vous ne pourrez donc pas diagnostiquer le problème de mémoire. Solution : Redémarrez le système. Si les problèmes de mémoire persistent, renseignez-vous auprès de votre représentant services. Délais d’attente possibles du chien de garde sous une charge très lourde (CR 6994535) Dans certains cas de lourdes charges de travail inhabituelles, l’hôte peut sembler tout à coup se réinitialiser sur OBP sans montrer aucun signe de blocage ou d’une erreur grave. Le journal d’événements d’ILOM contient une entrée de type « Host watchdog expired » (Chien de garde de l’hôte arrivé à expiration). Affichez le journal d’événements du SP : Si ce problème concerne le serveur, le journal d’événements contient une entrée intitulée « Host watchdog expired. ». Solution : Contactez votre fournisseur de services agréé pour voir si un correctif est disponible. Vous pouvez également étendre le délai d’expiration du chien de garde en ajoutant cette entrée dans le fichier /etc/system d’Oracle Solaris : Le délai d’attente du chien de garde sera ainsi étendu à 10 minutes (600 000 millisecondes). -> show /SP/logs/event/list set watchdog_timeout = 600000Notes de produit du serveur SPARC T3-4 9 Dans les cas extrêmes, vous pouvez également désactiver totalement l’expiration du chien de garde en ajoutant cette entrée dans le fichier /etc/system : Remarque – Vous devez redémarrer le serveur pour que les modifications apportées au fichier /etc/system entrent en vigueur. Apparition d’erreurs matérielles USB irrécupérables dans certaines circonstances (CR 6995634) Dans quelques cas rares, des erreurs matérielles USB irrécupérables se produisent, comme par exemple : Solution : Redémarrez le système. Contactez le représentant de services si ces messages d’erreur persistent. Remplacement rapide conseillé des modules DIMM défectueux présentant des erreurs incorrigibles (CR 6996144) Si un module DIMM présente une erreur incorrigible, le serveur générera une erreur de type fault.memory.bank, qui signale un module DIMM défectueux. Vous pouvez afficher cette erreur à l’aide de la commande show faulty ou fmdump -v d’Oracle ILOM. Si un module DIMM du système contient une erreur incorrigible persistante (c.-à-d., qui se produit constamment, même après plusieurs redémarrages), remplacez-le dès que possible afin d’éviter toute indisponibilité du serveur. Solution : Au lieu de planifier une période d’indisponibilité en vue de remplacer les modules DIMM défectueux, procédez au remplacement le plus tôt possible. Contactez votre représentant services pour obtenir de l’aide. set watchdog_enabled = 0 usba: WARNING: /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2 (ehci0): Unrecoverable USB Hardware Error usba: WARNING: /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,1/hub@1/hub@3 (hubd5): Connecting device on port 2 failed10 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Initialisation non systématique du processeur de service lors de la coupure de l’alimentation CA pendant moins de 120 secondes (CR 6997182) Le processeur de service (SP) ne parvient pas toujours à s’initialiser lorsque l’alimentation CA est coupée pendant moins de 120 secondes. Solution : Pour initialiser le SP, débranchez les quatre cordons d’alimentation du serveur. Attendez au moins 120 secondes avant de reconnecter les cordons d’alimentation. Panne de tension empêchant la mise sous tension de l’hôte (CR 7003014) Dans une petite fraction du temps de mise sous tension du système, ILOM peut signaler un problème de sonde de 12 V sur l’un des modules de processeur (PM0 ou MP1), consigner une panne système et abandonner la séquence de mise sous tension. L’exemple suivant illustre le message d’erreur qui s’affiche dans l’interface de ligne de commande d’ILOM si la commande start /SYS d’ILOM échoue et que la séquence de mise sous tension est abandonnée : Si le système ne se met pas sous tension à l’aide de la commande start/SYS d’ILOM, consultez le journal d’événements d’ILOM : Ce problème peut exister si une erreur consignée dans le journal d’erreurs d’ILOM mentionne PMx/PDx/V_+12V0 (où x correspond à 0 ou 1), comme dans cet exemple : En outre, le shell de gestion des pannes d’ILOM indique que le module de processeur est défectueux. -> start /SYS Are you sure you want to start /SYS (y/n)? y start: System faults or hardware configuration prevents power on. -> show /SP/logs/event/list 1115 Sat Jan 1 12:44:15 2000 IPMI Log minor ID = b2 : 01/01/2000 : 12:44:15 : Voltage : PM0/PD1/V_+12V0 : Lower Non -critical going low : reading 0 <= threshold 11.43 VoltsNotes de produit du serveur SPARC T3-4 11 Pour afficher la liste des composants défectueux, procédez de la manière suivante : 1. Démarrez le shell de gestion des pannes d’ILOM : 2. Affichez la liste des composants défectueux : L’exemple suivant présente une panne de sonde de tension sur le module de processeur 0 (PM0) : Solution : Contactez votre fournisseur de services agréé pour voir s’il existe un correctif à ce problème. -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ ------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------- ------- 2010-11-12/19:59:33 c55af62d-2da0-48de-f02f-b437146752f7 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/PM0 (Part Number: 541-4182-08) (Serial Number: 1005LCB-1041HB01A1) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.12 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Si aucun correctif n’est disponible et que vous rencontrez effectivement un problème de mise sous tension et un événement concernant l’une des sondes PMx/PDx/V_+12V0, effacez l’erreur à l’aide de l’une des procédures ci-dessous, puis tentez de mettre à nouveau le système sous tension. 1. Effacez l’erreur à l’aide de l’une des méthodes suivantes : a. Pour effacer l’erreur à l’aide de la CLI d’ILOM : Par exemple, pour effacer une erreur sur le module de processeur 0 (PM0) : b. Pour effacer l’erreur à l’aide du shell de gestion des pannes d’ILOM : Par exemple, pour effacer une erreur sur le module du processeur 0 (PM0) : 2. Tentez de mettre le système sous tension : Si le système se met sous tension sans problème après que vous avez effacé l’erreur, cela signifie que vous avez effectivement rencontré le CR 7003014. Votre système devrait se mettre sous tension et fonctionner normalement à présent. Si l’erreur persiste et que le système ne parvient pas à se mettre sous tension, il doit alors s’agir d’une véritable panne. Contactez votre fournisseur de services agréé pour obtenir de l’aide. -> set FRU-name clear_fault_action=true -> set /SYS/PM0 clear_fault_action=true faultmgmtsp> fmadm repair nom-FRU faultmgmtsp> fmadm repair /SYS/PM0 ... faultmgmtsp> exit -> -> start /SYSNotes de produit du serveur SPARC T3-4 13 Problèmes liés au système d’exploitation Oracle Solaris Cette section décrit les problèmes liés au SE Oracle Solaris observés dans cette version. Entrée/Sortie statique/dynamique non prises en charge Le serveur SPARC T3-4 ne prend pas en charge la fonction SDIO d’Oracle VM Server pour SPARC sans l’installation d’un correctif pour 6983964. Veuillez ne pas utiliser la fonction SDIO d’Oracle VM Server pour SPARC tant qu’un correctif n’est pas disponible. Pour plus d’informations, reportez-vous à la section « Erreur grave possible du domaine principal au démarrage due à des violations de la stratégie SDIO (CR 6983964) », page 24. Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris Le SE Oracle Solaris utilise à présent l’ID universel SAS 2.0 (WWID, World Wide ID) au lieu du champ tn (ID cible) dans les noms de périphériques logiques. Ce changement a un impact sur la méthode d’identification du disque cible lors du téléchargement du SE via le réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement : ¦ Lors du téléchargement du SE via un réseau, vous devriez spécifier le disque inséré dans l’emplacement de disque dur (HDD) 0 comme destination. Il s’agit du disque que OBP utilise comme périphérique d’initialisation par défaut. ¦ Avant le passage aux noms WWID, ce disque aurait été reconnu par le SE d’après son nom logique c0t0d0s0. ¦ Depuis ce changement, l’identificateur de périphérique du périphérique d’initialisation par défaut est désigné sous le nom c0tWWIDd0s0, où WWID correspond à une valeur hexadécimale. Or, cette valeur WWID n’est pas mappée de manière prévisible à l’ID physique du disque situé dans l’emplacement de disque dur HDD 0. Remarque – Par défaut, le SE Oracle Solaris est installé sur le disque inséré dans l’emplacement de disque dur HDD 0. Si vous souhaitez l’installer ailleurs, spécifiez le numéro d’emplacement du disque voulu.14 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Pour spécifier de manière fiable l’emplacement HDD 0 dans le cadre de l’opération de téléchargement du SE, vous devez déterminer la correspondance entre la valeur WWID de ce disque et son emplacement physique. Pour ce faire, exécutez probescsi-all et consultez la sortie de la commande. Dans la sortie de probe-scsi-all, recherchez les identi?cateurs de disque suivants : ¦ SASDeviceName : il s’agit du WWID de disque reconnu par le SE Oracle Solaris. ¦ SASAddress : il s’agit du WWID de disque auquel OBP fait référence. ¦ PhyNum : il s’agit de l’emplacement de disque dur (HDD) physique occupé par le disque. Il est également exprimé sous forme de valeur hexadécimale. ¦ VolumeDeviceName : ce numéro correspond au WWID du volume RAID reconnu par le SE Oracle Solaris. ¦ VolumeWWID : il s’agit du WWID du volume RAID auquel OBP fait référence.Notes de produit du serveur SPARC T3-4 15 Un serveur SPARC T3-4 possède deux contrôleurs SAS intégrés, chacun contrôlant quatre disques connectés. La sortie de l’exemple de commande probe-scsi-all suivante s’applique à un serveur SPARC SPARC T3-4 équipé de huit unités. ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3 {0} ok16 Notes de produit du serveur SPARC T3-4 • Décembre 2010 La sortie d’exemple de commande probe-scsi-all illustre une configuration RAID. Le nom de périphérique VolumeDeviceName du volume RAID est 3c2f959213c8a292. ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target 37e Volume 0 Unit 0 Disk LSI Logical Volume 3000 1167966208 Blocks, 597 GB VolumeDeviceName 3c2f959213c8a292 VolumeWWID 0c2f959213c8a292 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3 {0} okNotes de produit du serveur SPARC T3-4 17 Exemples d’Oracle Solaris Jumpstart L’exemple de profil Oracle Solaris Jumpstart suivant illustre l’utilisation de la syntaxe WWID dans le cadre de l’installation du SE sur une unité de disque précise. Le nom de périphérique SAS SASDeviceName provient de la précédente configuration à six unités de disque. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques dans le WWID. L’exemple de profil Oracle Solaris Jumpstart suivant illustre l’utilisation de la syntaxe WWID dans le cadre de l’installation du SE sur un volume RAID. La valeur VolumeDeviceName provient de l’exemple probe-scsi-all RAID précédent. # install_type flash_install boot_device c0t5000C5001CB4A637d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap # install_type flash_install boot_device c0t3CE534E42C02A3C0d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap18 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Exemple d’installation interactive Dans une installation interactive, un message vous invite à spécifier un ou plusieurs disques comme cibles de l’installation du SE. Cette étape a pour objectif de s’assurer que l’installation dispose de suffisamment d’espace disque. Dans le cadre de cette étape, spécifiez le disque dont la valeur WWID correspond à l’unité de disque sur laquelle vous souhaitez installer le logiciel. Ces valeurs WWID sont illustrées dans l’exemple interactif suivant, qui repose sur le même environnement à six unités de disque que celui utilisé dans les exemples précédents. L’unité de disque sélectionnée comme cible d’installation se trouve à l’emplacement HDD 0, l’emplacement OBP par défaut. Remarque – Si vous préférez utiliser un autre disque, vous pouvez le définir à la place de l’emplacement HDD 0. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000CCA00ABAF620d0 286090 MB [X] ** c0t5000CCA00ABC51A8d0 286090 MB [ ] c0t5000CCA00ABC5218d0 286090 MB [ ] c0t5000CCA00ABC5354d0 286090 MB [ ] c0t5000CCA00ABC5CC8d0 286090 MB [ ] c0t5000CCA00ABCE89Cd0 286090 MB [ ] c0t5000CCA00ABCEC4Cd0 286090 MB [ ] c0t5000CCA00ABCEDE0d0 286090 MB Total Selected: 286090 MB Suggested Minimum: 5009 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_HelpNotes de produit du serveur SPARC T3-4 19 Temps d’impression de la sortie anormalement long par la commande cfgadm (CR 6937169) L’exécution de la commande cfgadm(1M) de configuration ou d’annulation de la configuration des périphériques enfichables à chaud est anormalement lente. Ainsi, la commande cfgadm -al peut mettre plus de cinq minutes avant d’afficher la liste des points de connexion de l’ensemble des périphériques enfichables à chaud. Solution : Gérez les périphériques enfichables à chaud PCIe à l’aide de la commande hotplug(1M). Remarque – La solution consistant à utiliser la commande hotplug à la place de cfgadm -al s’applique uniquement aux périphériques PCI. ? Utilisez la commande hotplug list -l pour répertorier le statut de tous les emplacements PCIe enfichables à chaud. Exemple : ? Utilisez la commande hotplug disable pour désactiver une carte PCIe. Par exemple, pour désactiver la carte EM d’un module PCI-EM3 et vérifier qu’elle est effectivement désactivée : # hotplug list -l | grep PCI-EM /pci@400/pci@1/pci@0/pci@4 [PCI-EM2] (EMPTY) /pci@400/pci@2/pci@0/pci@1 [PCI-EM0] (EMPTY) /pci@400/pci@2/pci@0/pci@2 [PCI-EM1] (EMPTY) /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (ENABLED) /pci@500/pci@1/pci@0/pci@1 [PCI-EM8] (EMPTY) /pci@500/pci@1/pci@0/pci@2 [PCI-EM10] (ENABLED) /pci@500/pci@2/pci@0/pci@2 [PCI-EM9] (ENABLED) /pci@500/pci@2/pci@0/pci@3 [PCI-EM11] (EMPTY) /pci@600/pci@1/pci@0/pci@4 [PCI-EM4] (EMPTY) /pci@600/pci@1/pci@0/pci@5 [PCI-EM6] (ENABLED) /pci@600/pci@2/pci@0/pci@0 [PCI-EM7] (EMPTY) /pci@600/pci@2/pci@0/pci@5 [PCI-EM5] (EMPTY) /pci@700/pci@1/pci@0/pci@4 [PCI-EM14] (EMPTY) /pci@700/pci@2/pci@0/pci@3 [PCI-EM12] (ENABLED) /pci@700/pci@2/pci@0/pci@4 [PCI-EM13] (EMPTY) /pci@700/pci@2/pci@0/pci@5 [PCI-EM15] (EMPTY) # hotplug disable /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (POWERED)20 Notes de produit du serveur SPARC T3-4 • Décembre 2010 ? Utilisez la commande hotplug poweroffpour mettre hors tension une carte PCIe. Par exemple, pour mettre hors tension la carte EM d’un module PCI-EM3 : Vous pouvez à présent retirer physiquement la carte EM. ? Utilisez la commande hotplug list pour vérifier qu’une carte est effectivement retirée. Par exemple : ? Utilisez la commande hotplug poweron pour mettre sous tension une carte PCIe. Ainsi, pour mettre sous tension la carte EM d’un module PCI-EM3 et vérifier qu’elle est définie sur l’état POWERED (SOUS TENSION) : ? Utilisez la commande hotplug enable pour activer une carte PCIe. Ainsi, pour activer la carte EM d’un module PCI-EM3 et vérifier qu’elle est définie sur l’état ENABLED (ACTIVÉ) : Remarque – Pour plus d’informations sur la commande hotplug, consultez la page de manuel hotplug(1M). # hotplug poweroff /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (PRESENT) # hotplug list -l | grep PCI-EM ... /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (EMPTY) ... # hotplug poweron /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (POWERED) # hotplug enable /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (ENABLED)Notes de produit du serveur SPARC T3-4 21 Messages d’avertissement nxge erronés (CR 6938085) Au cours du fonctionnement normal de votre serveur, des messages d’avertissement tels que le suivant peuvent s’afficher sur la console système : Ces messages ne sont pas de véritables messages d’avertissement. Ces messages relatifs au pilote Gigabit Ethernet (nxge) affichent le numéro de version de l’hyperviseur, car le pilote est compatible avec plusieurs versions de l’hyperviseur. Ces messages devraient être désignés comme messages INFORMATIONNELS ou AVIS plutôt que sous forme d’AVERTISSEMENTS. Solution : Vous pouvez ignorer ces messages en toute sécurité. Message d’interruption parasite affiché sur la console système (CR 6963563) Au cours du fonctionnement normal du serveur et lors de l’exécution du programme de test système Oracle VTS, la console système peut afficher le message suivant : Solution : Vous pouvez ignorer ce message en toute sécurité. date heure nom-machine nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.0 date heure nom-machine px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date heure nom-machine px: [ID 548919 kern.info] ehci-0#0 date heure nom-machine px: [ID 100033 kern.info]22 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Informations sur les unités non affichées par la commande prtpicl (CR 6963594) Sur les systèmes antérieurs, la commande prtpicl -v affichait l’état, l’emplacement et le chemin d’accès aux périphériques des unités système sous l’en-tête disk_discovery. Sur les systèmes SPARC T3, la commande prtpicl ne présente plus ces informations sur les unités. Solution : Utilisez la commande probe-scsi-all de l’OpenBoot. Vous trouverez un exemple de sortie à la section « Modification de la dénomination des périphériques logiques dans le SE Oracle Solaris », page 13. Interruption manquante entraînant le blocage d’un thread d’enfichage à chaud de hub USB, puis celui de processus (CR 6968801) Lors de l’exécution du logiciel Oracle VTS sur les serveurs de la série SPARC T3, il est possible (bien que rare) qu’un test d’Oracle VTS se bloque. Si cela se produit, le processus de blocage peut provoquer le blocage d’autres processus et commandes, notamment celui de l’outil de configuration de la gestion des pannes (fmadm) et de la commande de configuration du système d’impression (prtconf). Il est impossible de terminer ces processus bloqués. Solution : Redémarrez le système. Si le problème se répète, renseignez-vous auprès de votre représentant services. Évitez d’exécuter le logiciel Oracle VTS dans des environnements de production.Notes de produit du serveur SPARC T3-4 23 Délais importants de la console locale lors de la connexion et de la déconnexion d’Oracle Solaris (CR 6971884) Il se peut que vous rencontriez des temps de latence importants (jusqu’à trois minutes) lors de la connexion et de la déconnexion du SE Solaris à partir d’une console locale ou d’un ensemble clavier-souris-écran local. Solution : Utilisez une connexion réseau pour accéder au système et placez en commentaire les lignes contenant les noms des périphériques de console USB (/dev/usb/*) dans le fichier de configuration /etc/logindevperm : Message d’erreur parasite lors de l’installation initiale du SE Oracle Solaris (CR 6971896) Le système miniroot est un système de fichiers root initialisable comprenant la version minimale du SE Oracle Solaris requise pour démarrer le serveur et configurer le système d’exploitation. Le système miniroot s’exécute uniquement lors du processus d’installation. Lorsque le serveur démarre le système miniroot pour la configuration initiale, les messages suivants peuvent s’afficher sur la console système : Le messages indique que le serveur Xsun sous le système miniroot Oracle Solaris ne parvient pas à détecter un pilote pris en charge par le périphérique graphique AST dans le processeur de service. Ces messages sont attendus, car le système miniroot contient uniquement l’environnement Xsun alors que le tampon de mémoire AST (astfb) est uniquement pris en charge par l’environnement Xorg. L’environnement Xorg est inclus dans le système installé. Par conséquent, le périphérique graphique peut être utilisé lors de l’exécution du SE Oracle Solaris installé. # /dev/console 0600 /dev/usb/hid[0-9]+ # hid devices should have the same permission with conskbd and consms # /dev/console 0600 /dev/usb/[0-9a-f]+[.][0-9a-f]+/[0-9]+/* driver=scsa2usb,usb_mid,usbprn,ugen #libusb/ugen devices ... Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error.24 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Solution : Vous pouvez ignorer ce message en toute sécurité. Erreur grave possible du domaine principal au démarrage due à des violations de la stratégie SDIO (CR 6983964) Si vous disposez d’un système exécutant Oracle VM Server pour SPARC et que plusieurs invités sont configurés pour utiliser la fonction SDIO (Static/Direct Input/Output), il est possible que le domaine principal génère une erreur grave juste après la mise sous tension du système et son propre démarrage. Le message d’erreur grave ressemble au suivant : Ce problème peut se produire pendant que le domaine principal est en cours d’initialisation ; il ne survient pas lorsque les systèmes sont déjà en cours d’exécution. Solution : Il n’existe aucune solution à ce problème pour le moment. Contactez votre fournisseur de services agréé pour obtenir un correctif. panic[cpu6]/thread=2a101283ca0: Fatal error has occured in: PCIe fabric.(0x1)(0x43) 000002a101283700 px:px_err_panic+1ac (702cec00, 7bf57000, 43, 2a1012837b0, 1, 0) %l0-3: 0000009980001602 00000000702cf000 0000000000000000 0000000000000001 %l4-7: 0000000000000000 00000000018af000 0000000000000001 0000000000000000 000002a101283810 px:px_err_fabric_intr+1c0 (6002c594480, 1, 702cf000, 1, 43, 200) %l0-3: 0000000000000200 0000000000000001 00000000702cf2c0 00000000702cf000 %l4-7: 00000000702cf2b8 00000000702cf000 0000000000000001 000006002c4d4790 000002a101283980 px:px_msiq_intr+1e8 (6002c447bf0, 30002df1908, 7bf495d0, 0, 1, 6002c6f01f0) %l0-3: 000006002c639220 000006002b561e40 0000030002df1908 0000000000000000 %l4-7: 0000000000000000 0000000003a60000 000002a101283a80 0000000000000030Notes de produit du serveur SPARC T3-4 25 Impossible de connecter les périphériques Ethernet internes après la reconfiguration d’une CPU défectueuse sur l’hôte (CR 6984323) Lorsque vous redémarrez le serveur suite à une reconfiguration de CPU défectueuse ou désactivée sur l’hôte, les connexions Gigabit Ethernet internes ne sont pas rétablies avec le réseau. Les exemples de messages suivants s’affichent alors sur la console système : Solution : Redémarrez le serveur à deux autres reprises. Si le problème persiste, renseignezvous auprès de votre représentant services. hostconfig : échec de la commande à mettre à jour le numéro de série CPU dans le descripteur machine de l’inventaire des ressources physiques (PRI MD) (CR 6989166) En cas de problème de thread CPU, l’enregistrement correspondant est conservé lors du redémarrage du système, même si l’origine du problème a été résolue. La présence de cet enregistrement entraîne la mise hors ligne du thread CPU lors du redémarrage du système. Méthode de récupération : Activez de manière explicite le ou les threads posant problème. igb0: DL_ATTACH_REQ failed: DL_SYSERR (errno 22) igb0: DL_BIND_REQ failed: DL_OUTSTATE igb0: DL_PHYS_ADDR_REQ failed: DL_OUTSTATE igb0: DL_UNBIND_REQ failed: DL_OUTSTATE Failed to plumb IPv4 interface(s): igb026 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Blocage sans fin du processus Oracle Enterprise Manager (CR 6994300) Le processus Java Oracle Enterprise Manager peut se bloquer et devenir impossible à terminer sur le serveur. Lorsque le processus Enterprise Manager se bloque, il continue à écouter sur son port d’interface graphique Web, vous empêchant d’y mettre un terme. Ce problème a été observé sur des serveurs exécutant à la fois Java SE 5.0 (livré avec le logiciel Oracle Database) et la dernière version téléchargeable de Java SE 6 Update 22. Solution : Redémarrez le système. Si le problème se répète, renseignez-vous auprès de votre représentant services. Impossible de charger le pilote Gigabit Ethernet (nxge) sur les systèmes dotés du bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 (CR 6995458) Si vous avez installé le bundle de patchs Oracle Solaris 10 10/09 et Solaris 10 9/10 sur le serveur, le pilote 10/1 Gigabit Ethernet (nxge) ne pourra pas être connecté aux périphériques 10 GbE. Solution : Insérez la ligne suivante dans le fichier /etc/driver_aliases : nxge "SUNW,niusl-kt" Redémarrez ensuite le serveur et configurez normalement les périphériques Gigabit Ethernet. Désactivation du moteur de diagnostic (eft) lors d’erreurs de mémoire irrécupérables signalées comme dues à un dépassement de la limite de mémoire du module (CR 7000649) Dans certaines circonstances, une erreur de mémoire peut entraîner une erreur interne dans le moteur de diagnostic FMA qui empêche le diagnostic correct de l’erreur de mémoire. Ce problème peut se produire si la sortie de commande fmadm faulty comprend l’erreur FMD-8000-2K dans la liste des composants défectueux.Notes de produit du serveur SPARC T3-4 27 Exemple : Pour vérifier qu’il s’agit bien de l’erreur CR 70000649, utilisez la commande fmdump -eV et recherchez un rapport ereport.fm.fmd.module ereport contenant les mots « eft’s allocation of XX bytes exceeds module memory limit » où XX est un nombre. # fmadm faulty ... --------------- ------------------------------------ ----------------------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ ----------------------- Nov 16 12:02:01 865e378b-27a5-ebf7-c550-e34179d57241 FMD-8000-2K Minor Host : xxxxxxx Platform : ORCL,SPARC-T3-4 Chassis_id : Product_sn : Fault class : defect.sunos.fmd.module Affects : fmd:///module/eft faulted and taken out of service FRU : None faulty Description : A Solaris Fault Manager component has experienced an error that required the module to be disabled. Refer to http://sun.com/msg/FMD-8000-2K for more information. Response : The module has been disabled. Events destined for the module will be saved for manual diagnosis. Impact : Automated diagnosis and response for subsequent events associated with this module will not occur. Action : Use fmdump -v -u to locate the module. Use fmadm reset to reset the module.28 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Exemple : Solution : Si la sortie fmdump -eV indique qu’il s’agit bien de l’erreur CR 7000649, contactez votre fournisseur de services agréé pour voir s’il existe un correctif à ce problème. Planifiez le redémarrage du serveur avec la fonction de diagnostic activée pour permettre au POST de repérer le module DIMM suspect. Après avoir arrêté toutes les sessions Solaris ouvertes sur le système, procédez comme suit : 1. Mettez le système hors tension : # fmdump -eV ... Nov 16 2010 12:02:01.052061745 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = ORCL,SPARC-T3-4 server-id = xxxxxxxx (end authority) mod-name = eft mod-version = 1.16 (end detector) ena = 0x3ddfe7a2c3f07401 msg = eft’s allocation of 20 bytes exceeds module memory limit (10485756) __ttl = 0x1 __tod = 0x4ce2e339 0x31a6631 -> stop /SYSNotes de produit du serveur SPARC T3-4 29 2. Définissez keyswitch_state sur Diag : Remarque – Cette option remplace les valeurs précédemment définies des propriétés de diagnostic. 3. Mettez le serveur sous tension : 4. Une fois la séquence de mise sous tension terminée, activez le shell de gestion des pannes d’ILOM et utilisez la commande show faulty d’ILOM pour rechercher les modules DIMM défectueux. a. Démarrez le shell de gestion des pannes : b. Affichez la liste des composants défectueux : 5. Remplacez les modules de mémoire DIMM défectueux qui sont signalés. Si aucun module DIMM défectueux n’est signalé, contactez votre fournisseur de services agréé pour obtenir de l’aide. -> show /SYS keyswitch_state /SYS Properties: keyswitch_state = Normal -> set /SYS keyswitch_state=diag Set ’keyswitch_state’ to ’diag’ -> show /SYS keyswitch_state /SYS Properties: keyswitch_state = Diag -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty30 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Problèmes liés au microprogramme Cette section décrit des problèmes relatifs au microprogramme système. Messages intermittents de type WARNING: ios#, peu# Link Width x8 Link Speed GEN1 (CR 6958263) Lors de la mise sous tension du serveur sur l’OpenBoot PROM (OBP), des messages d’avertissement semblables à l’exemple suivant peuvent s’afficher sur la console système : Solution : Vous pouvez ignorer ces messages en toute sécurité. sas2flash : échec de l’utilitaire suite à l’installation d’au moins six HBA PCIe RAID SAS 6 Gb Sun Storage externes (CR 6983246) L’utilitaire sas2flash de LSI Corporation aboutit à un échec lorsque six HBA PCIe RAID SAS 6 Gb Sun Storage externes ou plus sont installés sur le système. Par exemple, lorsque vous tentez de lister les HBA à l’aide de la commande sas2flash -listall, le message d’erreur suivant risque de s’afficher : Solution : Installez cinq HBA PCIe RAID SAS 6 Gb Sun Storage externes au maximum sur le système. WARNING: ios0, peu0 Link Width x8 Link Speed GEN1. 6 SAS2008(??) ERROR: Failed to Upload Image! ----------- ---------- ERROR: Failed to Upload Image!Notes de produit du serveur SPARC T3-4 31 Abandon et arrêt d’un hyperviseur provoqués par l’ajout d’un périphérique terminal PCIe à un domaine invité (CR 6999227) Le système Oracle VM Server pour SPARC 2.0 peut rencontrer l’un des problèmes suivants si vous redémarrez le domaine root après avoir ajouté un périphérique terminal PCIe à un domaine invité : ¦ Abandon et arrêt d’un hyperviseur ¦ Impossible de revenir à l’OpenBoot PROM ¦ Impossible de revenir au SE Oracle Solaris Ces problèmes se produisent uniquement si vous n’avez pas démarré le domaine invité après avoir ajouté le périphérique PCIe. Ce faisant, les interfaces virtuelles précédemment configurées risquent de ne pas avoir été nettoyées correctement. Solution : Si ces problèmes se produisent, redémarrez le système. Afin d’éviter ces problèmes, démarrez un domaine invité après lui avoir ajouté une ressource d’E/S. Si vous ne souhaitez pas activer le domaine pour l’instant, arrêtez-le après son démarrage. Panne de tension critique générée par l’exécution de stop /SYS avec la stratégie HOST_COOLDOWN activée Par défaut, la stratégie HOST_COOLDOWN est désactivé dans la liste de stratégies du SP, comme indiqué par la commande ILOM suivante : -> ls /SP/policy /SP/policy Targets: Properties: HOST_AUTO_POWER_ON = disabled HOST_COOLDOWN = disabled HOST_LAST_POWER_STATE = disabled HOST_POWER_ON_DELAY = disabled PARALLEL_BOOT = enabled Commands: cd set show32 Notes de produit du serveur SPARC T3-4 • Décembre 2010 Si vous modifiez cette valeur pour la définir sur enabled, une panne de type fault.chassis.voltage.fail peut se produire lors de la mise hors tension du système. Tant qu’elle ne sera pas effacée, cette erreur vous empêchera de remettre le système sous tension. Cette erreur figure dans la liste d’événements de l’interface de ligne de commande d’ILOM. Exemple : Solution : 1. Désactivez la stratégie HOST_COOLDOWN : 2. Effacez l’erreur : 3. Redémarrez le système : -> show /SP/logs/event/list 24756 Wed Nov 24 11:23:36 2010 Fault Fault critical Fault detected at time = Wed Nov 24 11:23:36 2010. The suspect component: /SYS/MB has fault.chassis.voltage.fail with probability=100. Refer to ht tp://www.sun.com/msg/SPT-8000-DH for details. 24755 Wed Nov 24 11:23:36 2010 System Log minor Host: Solaris powering down 24754 Wed Nov 24 11:23:24 2010 System Log minor Host: Host stopped -> set /SP/policy HOST_COOLDOWN=disabled Set ’HOST_COOLDOWN’ to ’disabled’ -> set /SYS/MB clear_fault_action=true Are you sure you want to clear /SYS/MB (y/n)? y Set ’clear_fault_action’ to ’true’ -> start /SYS SPARC T3-4 Server Product Notes Part No.: E20814-05 December 2011Please Recycle Copyright © 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.1 SPARC T3-4 Server Product Notes This document contains the following information and late-breaking news about Oracle’s SPARC T3-4 server: ¦ “Preinstalled Software For Standard Configurations” on page 1 ¦ “Oracle Solaris OS Support” on page 2 ¦ “Minimum Required Patches and Package Updates” on page 3 ¦ “ALOM CMT Compatibility Shell Not Supported” on page 4 ¦ “Power Supply Inrush/Input Surge Current Information” on page 4 ¦ “Custom nvalias Settings Will Not Change During a System Reconfiguration” on page 4 ¦ “Known Product Issues” on page 5 Preinstalled Software For Standard Configurations The following table lists the software preinstalled on your server. Any patches that were known to be needed at the time your server was prepared for shipment were installed at the factory. For the latest information about all patches, including those for the preinstalled software, go to the My Oracle Support web site: https://support.oracle.com/2 SPARC T3-4 Server Product Notes • December 2011 Note – The preinstalled Oracle Solaris OS is installed on a ZFS file system. Note – Refer to the Customer Information Sheet shipped with your server to identify which version of Oracle Solaris OS is preinstalled. Oracle Solaris OS Support The server’s first drive is preinstalled with a copy of the Oracle Solaris 10 9/10 OS. The OS is ready to be configured at the appropriate point when you first apply power to the server. The server supports the following Oracle Solaris OS releases: ¦ Oracle Solaris 11 ¦ Oracle Solaris 10 10/09 OS with the Oracle Solaris 10 9/10 Patch Bundle or future compatible patch bundles ¦ Oracle Solaris 10 9/10 OS (preinstalled on the server) For the latest information about patches for the server, optional components, and software, go to the Oracle Support web site: https://support.oracle.com/ Note – When using the Oracle VM Server software, both the control and guest domains support these minimum Oracle Solaris OS releases. Refer to the Oracle Solaris documentation for instructions on installing and configuring the Oracle Solaris OS. Software Location Function Oracle Solaris 10 9/10 OS or Oracle Solaris 11 OS Root disk Slice 0 (and on Slice 3 in the ABE) Operating system Oracle VM Server for SPARC 2.0 /opt/SUNWldm Manages logical domains Electronic Prognostics 1.1 (Oracle Solaris 10 9/10 OS) Electronic Prognostics 1.2 (Oracle Solaris 11 OS) /opt/ep Provides early warning of the potential for specific FRU faults.SPARC T3-4 Server Product Notes 3 Required Patches and Package Updates This section describes patches required for the Oracle Solaris OS. Note – For current information about required patches and package updates for optional hardware and software, refer to the documentation for each product. Oracle Solaris 10 9/10 OS Patches All required patches are installed prior to shipment. If you reinstall the Oracle Solaris OS on the server, you must install the required patches for the OS, the server, and for any optionally installed hardware or software. When this document was published, the server required the following Oracle Solaris 10 9/10 OS patches. If you reinstall the Oracle Solaris 10 9/10 OS, you must install the latest compatible versions of these patches. ¦ 143647-08 ¦ 144567-01 ¦ 145098-02 ¦ 145868-01 ¦ 144486-04 ¦ 144488-04 ¦ 145786-02 ¦ 145961-01 To download the latest version of these patches, and to find the current list of required patches, go to the My Oracle Support web site: https://support.oracle.com/ Oracle Solaris 11 OS Package Updates To use the Oracle Solaris 11 OS, install an Oracle Solaris 11 Support Repository Update (SRU), if available. Use the pkg command or the package manager GUI to download any available SRU from: https://pkg.oracle.com/solaris/support4 SPARC T3-4 Server Product Notes • December 2011 ALOM CMT Compatibility Shell Not Supported The SPARC T3-4 server does not support the Advanced Lights Out Manager (ALOM) CMT command-line compatibility shell (cli_mode=alom) that was available in previous platforms. For more information about the supported Oracle Integrated Lights Out Manager (ILOM) features, refer to the SPARC T3 Series Servers Administration Guide. Power Supply Inrush/Input Surge Current Information Following are the inrush/input surge current values for the SPARC T3-4 server power supplies: Inrush = 25Apk, Leakage = 1.6mA Custom nvalias Settings Will Not Change During a System Reconfiguration If you use the nvalias OBP command to make custom system settings, you must update these settings if the system reconfigures itself after a hardware failure. For example, if the system experiences a hardware failure such as a failed CMP, the system will reconfigure the I/O device paths during the next reboot. If you set a custom device path to a boot disk using the nvalias command, the system will not reconfigure the custom device path and the server will not boot the operating system. You must rediscover the device path to the boot disk and update the nvalias setting accordingly.SPARC T3-4 Server Product Notes 5 Known Product Issues This section describes issues that are known to affect Oracle’s SPARC T3-4 server. The issue descriptions are organized as follows: ¦ “Hardware Issues” on page 5 ¦ “Oracle Solaris OS Issues” on page 15 ¦ “Firmware Issues” on page 31 Hardware Issues This section describes issues related to SPARC T3-4 server components. Direct I/O Support Only certain PCIe cards can be used as direct I/O endpoint devices on an I/O domain. You can still use other cards in your Oracle VM Server for SPARC environment, but these other cards cannot be used with the Direct I/O feature. Instead, these PCIe cards can be used for service domains and for I/O domains that have entire root complexes assigned to them. For the most up-to-date list of PCIe cards that support the Sirect I/O feature, refer to https://support.oracle.com/CSP/main/article?cmd=show&type= NOT&doctype=REFERENCE&id=1325454.1 Note – Not all cards listed on the Direct I/O web page are supported in the SPARC T3-4 server. Check the server hardware compatibility list before installing any PCIe cards. Sun Type 6 Keyboards Are Not Supported by SPARC T3 Series Servers Sun Type 6 keyboards cannot be used with SPARC T3 series servers.6 SPARC T3-4 Server Product Notes • December 2011 Hardware RAID 1E Not Supported Although hardware RAID 0 and 1 are supported on the SPARC T3-4 server, hardware RAID 1E is not supported. Other RAID formats are available through software RAID. I/O Performance Might Degrade When Using More Than Two Ports Across Multiple Sun Dual 10 GbE SFP+ PCIe Cards (CR 6943558) Excessive packet loss has been seen when three or more ports are used across multiple Sun Dual 10GbE SFP+ PCIe cards. This loss is likely to significantly degrade trasmit and receive performance. When only two ports are used, packet loss is minimal and transmit/receive performance is as expected. Workaround: If you are experiencing network performance issues, use one of the following procedures to enable flow control for the interfaces. This will greatly reduce packet loss and improve performance. ? Enable Flow Control (With a System Reboot) 1. Add the following lines in the /kernel/drv/ixgbe.conf file: 2. Reboot the system. ? Enable Flow Control (Without a System Reboot) 1. Add the following lines in the /kernel/drv/ixgbe.conf file: fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000; fm_capable = 0; flow_control = 3; tx_queue_number = 2; rx_queue_number = 6; intr_throttling = 1000;SPARC T3-4 Server Product Notes 7 2. Unplumb all the ixgbe interfaces. 3. Type the update_drv ixgbe command: 4. Plumb all the ixgbe interfaces. PARALLEL_BOOT/HOST_LAST_POWER_STATE=enabled Failed, Unexpected Power State (Off) After AC Cycle (CR 6994047) When HOST_LAST_POWER_STATE is set to enabled and then the system goes through an AC power cycle, the host sometimes is shown as OFF when the power up operation completes. This status information might be false. Recovery: Power cycle the system again to clear the false status information. Server Panics When Booting From a USB Thumbdrive Attached to the Front USB Ports (CR 6983185) When attempting to boot a USB thumbdrive (portable USB flash drive) inserted in one of the front USB ports (USB2 or USB3), the server will panic and fail to boot. Workaround: Use the server’s rear USB ports (USB0 or USB1) whenever booting off of an external USB thumbdrive. Copper QSFP Cables Not Supported (CR 6941888) The SPARC T3-4 Server 10 Gb Network Module does not support copper QSFP cables. The network module supports only optical QSFP transceiver modules and cables. Workaround: Use the cable specified in the list of supported system options. # update_drv ixgbe8 SPARC T3-4 Server Product Notes • December 2011 Performance Limitations Occur When Performing a HotPlug Installation of a x8 Card Into a Slot Previously Occupied With a x4 Card (CR 6987359) If you hot-plug a Dual 10GbE SFP+ PCIe2.0 Niantic EM Network Interface Card (NIC) (part number 1110A-Z) into a PCI Express Module slot that had previously held a 4-Port (Cu) PCIe (x4) Northstar ExpressModule (part number (X)7284A-Z-N), the expected performance benefit of the Dual 10GbE SFP+ PCIe2.0 Niantic NIC might not occur. This problem does not occur if the slot was previously unoccupied, or if it had been occupied by any other option card. This problem does this occur if the card is present when the system is powered on. Workaround: Hot-plug the Dual 10Gbe SFP+ PCIe2.0 Niantic EM card a second time, using one of the following methods. ¦ Use the cfgadm(1m) command to disconnect, then reconnect, the card: ¦ Use the hotplug(1M) command to disable and poweroff the device, and then poweron and enable the device: ¦ Use the Attention (ATTN) button on the card to deconfigure and then reconfigure the card. Note – You don’t need to physically remove and re-insert the card as part of the second hot plug operation. # cfgadm -c disconnect slot-name # cfgadm -c configure slot-name # hotplug disable device-path slot-name # hotplug poweroff device-path slot-name # hotplug poweron device-path slot-name # hotplug enable device-path slot-nameSPARC T3-4 Server Product Notes 9 Error Messages Not Retained After UE and CE Memory Failures (CR 6990058) If your server’s memory experiences a uncorrectable error (UE) followed by a correctable error (CE), the correct error messages will not be generated and they will not be retained by the service processor. You will not be able to diagnose the memory problem. Workaround: Reboot the system. If memory problems persist, contact your service representative for assistance. Watchdog Timeouts Might Occur Under Very Heavy Load (CR 6994535) In certain unusual heavy workloads, the host may appear to suddenly reset back to OBP without any sign of a crash or a panic. The ILOM event log contains a “Host watchdog expired” entry. Display the SP event log: If this issue is affecting the server, the event log contains an entry labelled, “Host watchdog expired.” Workaround: Contact your authorized service provider to see if a fix is available. You can also extend the watchdog timeout period by adding this entry to the Oracle Solaris /etc/system file: This extends the watchdog timeout period to 10 minutes (600,000 milliseconds). In extreme cases, you can also disable the watchdog timeout altogether by adding this entry to the /etc/system file: -> show /SP/logs/event/list set watchdog_timeout = 600000 set watchdog_enabled = 010 SPARC T3-4 Server Product Notes • December 2011 Note – You must reboot the server for any /etc/system modification to take effect. Unrecoverable USB Hardware Errors Occur In Some Circumstances (CR 6995634) In some rare instances, unrecoverable USB hardware errors occur, such as the following: Workaround: Reboot the system. Contact your service representative if these error messages persist. Replace Faulty DIMMs With Uncorrectable Errors (UEs) As Soon As Possible (CR 6996144) If a DIMM has an uncorrectable error (UE), the server will generate a fault.memory.bank error that labels a DIMM as faulty. You can view this error using the Oracle ILOM show faulty command or the fmdump -v command. If a DIMM in your system contains a persistent uncorrectable error (an error that continually occurs even after multiple reboots), replace this DIMM as soon as possible to avoid any server downtime. Workaround: Instead of scheduling downtime to replace the faulty DIMMs, replace the faulty DIMMs as soon as possible. Contact your service representative for assistance. usba: WARNING: /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2 (ehci0): Unrecoverable USB Hardware Error usba: WARNING: /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,1/hub@1/hub@3 (hubd5): Connecting device on port 2 failedSPARC T3-4 Server Product Notes 11 Service Processor Does Not Always Initialize When AC Power Is Removed for Less Than 120 Seconds (CR 6997182) The service processor (SP) does not always initialize when AC power is removed for less than 120 seconds. Workaround: To initialize the SP, unplug all four server power cords. Wait at least 120 seconds before reconnecting the power cords. Intermittent Power Supply Faults Occur During Power On (CR 7066165) In rare instances, the system FRU power-up probing routine might fail to list all installed system power supplies. The power supplies themselves are not faulted, but commands listing system FRUs do not show the presence of the non-probed power supply. The fault sets the system fault LED, but no power supply fault LED is illuminated. To find the fault, use the fmadm utility from the ILOM fault management shell. Start the fmadm utility from the ILOM CLI: To view the fault, type the following: -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------ Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------ 2011-09-21/13:59:35 f13524d6-9970-4002-c2e6-de5d750f4088 ILOM-8000-2V Major Fault class : fault.fruid.corrupt FRU : /SYS/PS0 (Part Number: 300-2159) (Serial Number: 476856F+1115CC0001) Description : A Field Replaceable Unit (FRU) has a corrupt FRUID SEEPROM12 SPARC T3-4 Server Product Notes • December 2011 Workaround: From the fault management shell prompt, clear the fault, exit the fault management shell, and reset the SP. For example: After the SP has reset, verify that all installed power supplies appear in the list of system devices: If the problem occurs again after applying this workaround, contact your authorized Oracle Service Provider for further assistance. Voltage Fault Prevents Host Power-On (CR 7003014) In a very small percentage of the time when a system is powered on, ILOM may report a problem with a 12V sensor on one of the processor modules (PM0 or PM1), log a system fault, and abort the power-on sequence. Response : The service-required LED may be illuminated on the affected FRU and chassis. Impact : The system may not be able to use one or more components on the affected FRU. This may prevent the system from powering on. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm repair /SYS/PS0 faultmgmtsp> exit -> reset /SP Are you sure you want to reset /SP (y/n)? y -> ls /SYSSPARC T3-4 Server Product Notes 13 The following is an example of the error message desplayed in the ILOM command line interface if the ILOM start /SYS command fails and the power-on sequence is aborted: If your system does not power on using the ILOM start /SYS command, view the ILOM event log: This issue might be present if you see an error in the ILOM event log that includes PMx/PDx/V_+12V0 (where x is either 0 or 1), such as the following: In addition, the ILOM fault management shell indicates that the processor module is faulty. To view a list of faulty components, do the following: 1. Start the ILOM fault management shell: -> start /SYS Are you sure you want to start /SYS (y/n)? y start: System faults or hardware configuration prevents power on. -> show /SP/logs/event/list 1115 Sat Jan 1 12:44:15 2000 IPMI Log minor ID = b2 : 01/01/2000 : 12:44:15 : Voltage : PM0/PD1/V_+12V0 : Lower Non -critical going low : reading 0 <= threshold 11.43 Volts -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y14 SPARC T3-4 Server Product Notes • December 2011 2. Display the list of faulty components: The following example displays a voltage sensor fault on Processor Module 0 (PM0): Workaround: Contact your authorized service provider to see if a fix for this issue is available. This issue is fixed in firmware release 8.0.4.b and later. If you have a firmware release earlier than 8.0.4.b, continue with these workaround instructions. If a fix is not available and you do encounter a power-on failure and an event with one of the PMx/PDx/V_+12V0 sensors, clear the fault using one of the procedures below, and attempt to power on the system again. 1. Clear the fault using one of the following methods: faultmgmtsp> fmadm faulty ------------------- ------------------------------------ ------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------- ------- 2010-11-12/19:59:33 c55af62d-2da0-48de-f02f-b437146752f7 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/PM0 (Part Number: 541-4182-08) (Serial Number: 1005LCB-1041HB01A1) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.SPARC T3-4 Server Product Notes 15 a. To clear the fault using the ILOM CLI: For example, to clear a fault on Processor Module 0 (PM0): b. To clear the fault using the ILOM fault management shell: For example, to clear a fault on Processor Module 0 (PM0): 2. Attempt to power on the system: If the system powers on without failure after you clear the fault, you have encountered CR 7003014, and your system should power on and operate normally. If the error persists and the system fails to power on, it should be treated as a genuine failure. Contact your authorized service provider for assistance. Oracle Solaris OS Issues This section describes issues related to the Oracle Solaris OS in this release. Static/Dynamic Input/Output Not Currently Supported The SPARC T3-4 server does not support the SDIO feature of Oracle VM Server for SPARC without a fix for 6983964. Please do not use the SDIO feature of Oracle VM Server for SPARC until a fix is available. See “SDIO Policy Violations Might Cause the Primary Domain To Panic During Boot (CR 6983964)” on page 25 for more information. -> set FRU-name clear_fault_action=true -> set /SYS/PM0 clear_fault_action=true faultmgmtsp> fmadm repair FRU-name faultmgmtsp> fmadm repair /SYS/PM0 ... faultmgmtsp> exit -> -> start /SYS16 SPARC T3-4 Server Product Notes • December 2011 Oracle Solaris OS Has Changed How It Specifies Logical Device Names The Oracle Solaris OS now uses SAS 2.0 World Wide ID (WWID) in place of the tn (target ID) field in logical device names. This change will affect how you identify the target disk when downloading the OS over a network. The following points are key to understanding the impact of this change: ¦ When downloading the OS over a network, you should specify the disk in HDD slot 0 as the download destination. This is the disk that OBP uses as the default boot device. ¦ Before the change to using WWIDs, this disk would be known to the OS by the logical name c0t0d0s0. ¦ With the change, the device identifier for the default boot device is now referred to as c0tWWIDd0s0, where WWID is a hexadecimal value. This WWID value does not map in a predictable way to the physical ID of the disk in HDD slot 0. Note – By default, the Oracle Solaris OS is installed on the disk in HDD slot 0. If you want to install the OS on a disk in another slot, specify the disk in the preferred slot number. To reliably specify HDD slot 0 for the OS download operation, you must determine the correspondence between the WWID value for that disk and its physical location. You can do this by running probe-scsi-all and reading the output. In the probe-scsi-all output, look for the following disk identifiers: ¦ SASDeviceName – This is the disk WWID that the Oracle Solaris OS recognizes. ¦ SASAddress – This is the disk WWID that the OBP references. ¦ PhyNum – This is the physical HDD slot that the disk occupies. It is also expressed as a hexadecimal value. ¦ VolumeDeviceName – This number is the RAID volume’s WWID that the Oracle Solaris OS recognizes. ¦ VolumeWWID – This is the RAID volume’s WWID that OBP references.SPARC T3-4 Server Product Notes 17 A SPARC T3-4 server has two on-board SAS controllers, each controlling four connected drives. The following example probe-scsi-all output is for a SPARC SPARC T3-4 with eight drives. ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3 {0} ok18 SPARC T3-4 Server Product Notes • December 2011 The following probe-scsi-all example output shows a RAID configuration. The RAID volume’s VolumeDeviceName is 3c2f959213c8a292. Oracle Solaris Jumpstart Examples The following Oracle Solaris Jumpstart profile example shows how to use the WWID syntax when installing the OS on a specific disk drive. The SASDeviceName is taken from the previous six-drive configuration listing. ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target 37e Volume 0 Unit 0 Disk LSI Logical Volume 3000 1167966208 Blocks, 597 GB VolumeDeviceName 3c2f959213c8a292 VolumeWWID 0c2f959213c8a292 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3 {0} okSPARC T3-4 Server Product Notes 19 Note – The Oracle Solaris syntax rules require all alpha characters in the WWID be capitalized. The following Oracle Solaris Jumpstart profile example shows how to use the WWID syntax when installing the OS on a RAID volume. The VolumeDeviceName is taken from the previous RAID probe-scsi-all example. Interactive Installation Example In an interactive install, you will be asked to specify one or more disks as the targets for the OS installation. The purpose of this step is to ensure that enough disk capacity is being provided for the installation. For this step, specify the disk with the WWID value corresponding to the drive on which you want to install the software. These WWID values are illustrated in the following interactive example, which is based on the same six-disk environment used in the previous examples. The drive selected as the install target is located in HDD slot 0—the default OBP location. # install_type flash_install boot_device c0t5000C5001CB4A637d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap # install_type flash_install boot_device c0t3CE534E42C02A3C0d0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap20 SPARC T3-4 Server Product Notes • December 2011 Note – If some other disk is preferred, you can specify it instead of the one in HDD slot 0. The cfgadm -al Command Takes a Long Time to Print Output (CR 6937169) The cfgadm(1M) command for configuring or unconfiguring hot-plug devices takes a long time to complete. For example, the cfgadm -al command could take more than five minutes before it lists the attachment points for all the hot-plug devices. Workaround: Use the hotplug(1M) command to manage PCIe hotplug devices. Note – The workaround using the hotplug command instead of cfgadm -al only works for PCI devices. _ Select Disks_________________________________________________________________ On this screen you must select the disks for installing Solaris software. Start by looking at the Suggested Minimum field; this value is the approximate space needed to install the software you’ve selected. Keep selecting disks until the Total Selected value exceeds the Suggested Minimum value. NOTE: ** denotes current boot disk Disk Device Available Space ============================================================================= [ ] c0t5000CCA00ABAF620d0 286090 MB [X] ** c0t5000CCA00ABC51A8d0 286090 MB [ ] c0t5000CCA00ABC5218d0 286090 MB [ ] c0t5000CCA00ABC5354d0 286090 MB [ ] c0t5000CCA00ABC5CC8d0 286090 MB [ ] c0t5000CCA00ABCE89Cd0 286090 MB [ ] c0t5000CCA00ABCEC4Cd0 286090 MB [ ] c0t5000CCA00ABCEDE0d0 286090 MB Total Selected: 286090 MB Suggested Minimum: 5009 MB ______________________________________________________________________________ Esc-2_Continue F3_Go Back F4_Edit F5_Exit F6_HelpSPARC T3-4 Server Product Notes 21 ? Use the hotplug list -l command to list the status of all hot-plug PCIe slots. For example: ? Use the hotplug disable command to disable a PCIe card. For example, to disable the EM card in PCI-EM3 and confirm that it is no longer enabled: ? Use the hotplug poweroff command to power off a PCIe card. For example, to power off the EM card in PCI-EM3: You may now physically remove the EM card. ? Use the hotplug list command to verify that a card is removed. For example: # hotplug list -l | grep PCI-EM /pci@400/pci@1/pci@0/pci@4 [PCI-EM2] (EMPTY) /pci@400/pci@2/pci@0/pci@1 [PCI-EM0] (EMPTY) /pci@400/pci@2/pci@0/pci@2 [PCI-EM1] (EMPTY) /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (ENABLED) /pci@500/pci@1/pci@0/pci@1 [PCI-EM8] (EMPTY) /pci@500/pci@1/pci@0/pci@2 [PCI-EM10] (ENABLED) /pci@500/pci@2/pci@0/pci@2 [PCI-EM9] (ENABLED) /pci@500/pci@2/pci@0/pci@3 [PCI-EM11] (EMPTY) /pci@600/pci@1/pci@0/pci@4 [PCI-EM4] (EMPTY) /pci@600/pci@1/pci@0/pci@5 [PCI-EM6] (ENABLED) /pci@600/pci@2/pci@0/pci@0 [PCI-EM7] (EMPTY) /pci@600/pci@2/pci@0/pci@5 [PCI-EM5] (EMPTY) /pci@700/pci@1/pci@0/pci@4 [PCI-EM14] (EMPTY) /pci@700/pci@2/pci@0/pci@3 [PCI-EM12] (ENABLED) /pci@700/pci@2/pci@0/pci@4 [PCI-EM13] (EMPTY) /pci@700/pci@2/pci@0/pci@5 [PCI-EM15] (EMPTY) # hotplug disable /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (POWERED) # hotplug poweroff /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (PRESENT) # hotplug list -l | grep PCI-EM ... /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (EMPTY) ...22 SPARC T3-4 Server Product Notes • December 2011 ? Use the hotplug poweron command to power on a PCIe card. For example, to power on the EM card in PCI-EM3 and confirm that it has moved to the POWERED state: ? Use the hotplug enable command to enable a PCIe card. For example, to enable the EM card in PCI-EM3 and confirm that it has moved to the ENABLED state: Note – For more information about the hotplug command, see the hotplug(1M) man page. False nxge Warning Messages (CR 6938085) During the normal operation of your server, you might see warning messages like the following in the system console: These messages are not true warning messages. These Gigabit Ethernet driver (nxge) messages display the version number of the hypervisor since the driver can operate on multiple hypervisor versions. These messages should labeled as a INFO or NOTICE messages instead of WARNING messages. # hotplug poweron /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (POWERED) # hotplug enable /pci@400/pci@2/pci@0/pci@3 PCI-EM3 # hotplug list -l | grep PCI-EM3 /pci@400/pci@2/pci@0/pci@3 [PCI-EM3] (ENABLED) date time machinename nxge: [ID 752849 kern.warning] WARNING: nxge0 : nxge_hio_init: hypervisor services version 2.0SPARC T3-4 Server Product Notes 23 Workaround: You can safely ignore these messages. Spurious Interrupt Message in System Console (CR 6963563) During the normal operation of the server, and when running the Oracle VTS system exerciser, you might see the following message in the system console: Workaround: You can safely ignore this message. The prtpicl Command Does Not Display Drive Information (CR 6963594) On previous systems, the prtpicl -v command displayed the state, location, and device paths for system drives under a disk_discovery heading. On SPARC T3 systems, the prtpicl command no longer displays this drive information. Workaround: Use the OpenBoot probe-scsi-all command. For example output, see “Oracle Solaris OS Has Changed How It Specifies Logical Device Names” on page 16. Missing Interrupt Causes USB Hub Hotplug Thread to Hang, Resulting In Process Hangs (CR 6968801) When running the Oracle VTS software on SPARC T3 series servers, it is possible (although rare) for a Oracle VTS test to hang. If this test process hangs, the hung process might cause other processes and commands to hang, including the fault management configuration tool (fmadm) and the print system configuration command (prtconf). These hung processes cannot be killed. date time hostname px: [ID 781074 kern.warning] WARNING: px0: spurious interrupt from ino 0x4 date time hostname px: [ID 548919 kern.info] ehci-0#0 date time hostname px: [ID 100033 kern.info]24 SPARC T3-4 Server Product Notes • December 2011 Workaround: Reboot the system. If the problem repeats, contact your service representative for assistance. Avoid running the Oracle VTS software in production environments. Long Local Console Delays During Login or Logout of Oracle Solaris (CR 6971884) You might experience long latency times (up to three minutes) when logging in or logging out of the Solaris OS using a local console or local keyboard, mouse and monitor. Workaround: Use a network connection to access the system, and comment out the lines containing USB console device names (/dev/usb/*) in the /etc/logindevperm configuration file: Spurious Error Message During Initial Oracle Solaris OS Installation (CR 6971896) The miniroot is a bootable root file system that includes the minimum Oracle Solaris OS software required to boot the server and configure the OS. The miniroot runs only during the installation process. When the server boots the miniroot for the initial configuration, you might see the following messages in the system console:. # /dev/console 0600 /dev/usb/hid[0-9]+ # hid devices should have the same permission with conskbd and consms # /dev/console 0600 /dev/usb/[0-9a-f]+[.][0-9a-f]+/[0-9]+/* driver=scsa2usb,usb_mid,usbprn,ugen #libusb/ugen devices ... Fatal server error: InitOutput: Error loading module for /dev/fb giving up. /usr/openwin/bin/xinit: Network is unreachable (errno 128): unable to connect to X server /usr/openwin/bin/xinit: No such process (errno 3): Server error.SPARC T3-4 Server Product Notes 25 The messages indicate that the Xsun server in the Oracle Solaris OS miniroot cannot find a supported driver for the AST graphics device in the service processor. These messages are fully expected, as the miniroot contains only the Xsun environment, and the AST framebuffer (astfb) is supported only in the Xorg environment. The Xorg environment is included in the installed system, so the graphics device may be used when running the installed Oracle Solaris OS. Workaround: You can safely ignore this message. SDIO Policy Violations Might Cause the Primary Domain To Panic During Boot (CR 6983964) If you have a system using Oracle VM Server for SPARC and you have one or more guests configured to use the Static/Direct Input/Output (SDIO) feature, it is possible for the primary domain to panic when the system has just been powered on and the primary domain is booting. The panic message appears similar to the following: This problem can occur while the primary domain is booting; it does not happen to already running systems. Workaround: There is no workaround currently available for this issue. Please contact your authorized service provider for a fix. panic[cpu6]/thread=2a101283ca0: Fatal error has occured in: PCIe fabric.(0x1)(0x43) 000002a101283700 px:px_err_panic+1ac (702cec00, 7bf57000, 43, 2a1012837b0, 1, 0) %l0-3: 0000009980001602 00000000702cf000 0000000000000000 0000000000000001 %l4-7: 0000000000000000 00000000018af000 0000000000000001 0000000000000000 000002a101283810 px:px_err_fabric_intr+1c0 (6002c594480, 1, 702cf000, 1, 43, 200) %l0-3: 0000000000000200 0000000000000001 00000000702cf2c0 00000000702cf000 %l4-7: 00000000702cf2b8 00000000702cf000 0000000000000001 000006002c4d4790 000002a101283980 px:px_msiq_intr+1e8 (6002c447bf0, 30002df1908, 7bf495d0, 0, 1, 6002c6f01f0) %l0-3: 000006002c639220 000006002b561e40 0000030002df1908 0000000000000000 %l4-7: 0000000000000000 0000000003a60000 000002a101283a80 000000000000003026 SPARC T3-4 Server Product Notes • December 2011 On-Board Ethernet Devices Fail to Connect After a Faulty CPU Reconfigures Back to the Host (CR 6984323) When rebooting the server after a failed or disabled CPU reconfigures back to the host, the onboard Gigabit Ethernet connections will not connect to network. The following example messages will display on the system console: Workaround: Reboot the server two additional times. If the problem persists, contact your service representative for assistance. hostconfig Command Does Not Update CPU Serial Number in the Physical Resource Inventory Machine Descriptor (PRI MD) (CR 6989166) When a CPU thread faults, the record of that fault is retained when the system reboots, even if the cause of the fault has been corrected. The presence of this record will cause the CPU thread to be off-lined when the system reboots. Recovery: Enable the faulted thread(s) explicitly. Oracle Enterprise Manager Process Hangs and Becomes Unkillable (CR 6994300) The Oracle Enterprise Manager Java process can hang and become unkillable on the server. When the Enterprise Manager process hangs, it continues to listen on its Web UI port, which makes the process unkillable. This problem has been seen on servers running both the Java SE 5.0 version that is bundled with Oracle Database software and with the most recent downloadable Java SE 6 Update 22 version. Workaround: Reboot the system. If the problem repeats, contact your service representative for assistance. igb0: DL_ATTACH_REQ failed: DL_SYSERR (errno 22) igb0: DL_BIND_REQ failed: DL_OUTSTATE igb0: DL_PHYS_ADDR_REQ failed: DL_OUTSTATE igb0: DL_UNBIND_REQ failed: DL_OUTSTATE Failed to plumb IPv4 interface(s): igb0SPARC T3-4 Server Product Notes 27 Gigabit Ethernet (nxge) Driver Not Loading on Systems With Oracle Solaris 10 10/09 OS and Solaris 10 9/10 Patch Bundle (CR 6995458) If you installed the Oracle Solaris 10 10/09 OS and the Solaris 10 9/10 Patch Bundle on the server, the 10/1 Gigabit Ethernet (nxge) driver will not attach to 10 GbE devices. Workaround: Add the following line to the /etc/driver_aliases file: nxge "SUNW,niusl-kt" Then reboot the server and configure the Gigabit Ethernet devices normally. Diagnosis Engine (eft) is Disabled on Memory Unrecoverable Errors Reportedly Due To Exceeding Module Memory Limit (CR 7000649) Under certain circumstances, a memory error can cause an internal error in the FMA diagnosis engine that prevents proper diagnosis of the memory error. This failure might be present if fmadm faulty command output includes the fault FMD-8000-2K in the list of faulty components.28 SPARC T3-4 Server Product Notes • December 2011 For example: To confirm that you have encountered CR 70000649, use the fmdump -eV command and look for an ereport.fm.fmd.module ereport that contains the words “eft’s allocation of XX bytes exceeds module memory limit” where XX is any number. # fmadm faulty ... --------------- ------------------------------------ ----------------------- TIME EVENT-ID MSG-ID SEVERITY --------------- ------------------------------------ ----------------------- Nov 16 12:02:01 865e378b-27a5-ebf7-c550-e34179d57241 FMD-8000-2K Minor Host : xxxxxxx Platform : ORCL,SPARC-T3-4 Chassis_id : Product_sn : Fault class : defect.sunos.fmd.module Affects : fmd:///module/eft faulted and taken out of service FRU : None faulty Description : A Solaris Fault Manager component has experienced an error that required the module to be disabled. Refer to http://sun.com/msg/FMD-8000-2K for more information. Response : The module has been disabled. Events destined for the module will be saved for manual diagnosis. Impact : Automated diagnosis and response for subsequent events associated with this module will not occur. Action : Use fmdump -v -u to locate the module. Use fmadm reset to reset the module.SPARC T3-4 Server Product Notes 29 For example: Workaround: If the fmdump -eV output indicates that you have encountered CR 7000649, contact your authorized service provider to see if a fix is available. Schedule a reboot of the server with diagnostics enabled to allow POST to attempt to find the suspect DIMM. After halting all of the Solaris sessions on your system, complete the following: 1. Power off the system: # fmdump -eV ... Nov 16 2010 12:02:01.052061745 ereport.fm.fmd.module nvlist version: 0 version = 0x0 class = ereport.fm.fmd.module detector = (embedded nvlist) nvlist version: 0 version = 0x0 scheme = fmd authority = (embedded nvlist) nvlist version: 0 version = 0x0 product-id = ORCL,SPARC-T3-4 server-id = xxxxxxxx (end authority) mod-name = eft mod-version = 1.16 (end detector) ena = 0x3ddfe7a2c3f07401 msg = eft’s allocation of 20 bytes exceeds module memory limit (10485756) __ttl = 0x1 __tod = 0x4ce2e339 0x31a6631 -> stop /SYS30 SPARC T3-4 Server Product Notes • December 2011 2. Set keyswitch_state to Diag: Note – This option overrides previously set values of diagnostic properties. 3. Power on the server: 4. After the power-on sequence is complete, enter the ILOM Fault Management shell and use the ILOM show faulty command to look for any faulty DIMMs. a. Start the fault management shell: b. Display the list of faulty components: 5. Replace any faulty DIMMs that are reported. If no faulty DIMMs are reported, contact your authorized service provider for further assistance. -> show /SYS keyswitch_state /SYS Properties: keyswitch_state = Normal -> set /SYS keyswitch_state=diag Set ’keyswitch_state’ to ’diag’ -> show /SYS keyswitch_state /SYS Properties: keyswitch_state = Diag -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faultySPARC T3-4 Server Product Notes 31 Firmware Issues This section describes issues related to the system firmware. Intermittent WARNING: ios#, peu# Link Width x8 Link Speed GEN1 Messages (CR 6958263) When your server powers on to the OpenBoot PROM (OBP), you might see warning messages like the following in the system console: Workaround: You can safely ignore these messages. sas2flash Utility Fails When Six or More Sun Storage 6 Gb SAS RAID PCIe HBAs, External, Are Installed (CR 6983246) The LSI Corporation sas2flash utility fails when there are six or more Sun Storage 6 Gb SAS RAID PCIe HBAs, External, installed in the system. For example, when attempting to list the HBAs using the sas2flash -listall command, you might see the following error message: Workaround: Install five or less Sun Storage 6 Gb SAS RAID PCIe HBAs, External, in the system. Adding a PCIe End-Point Device to a Guest Domain Might Result in a Hypervisor Abort and Shutdown (CR 6999227) Your Oracle VM Server for SPARC 2.0 system might encounter one of the following problems if you reboot the root domain after adding a PCIe end-point device to a guest domain: WARNING: ios0, peu0 Link Width x8 Link Speed GEN1. 6 SAS2008(??) ERROR: Failed to Upload Image! ----------- ---------- ERROR: Failed to Upload Image!32 SPARC T3-4 Server Product Notes • December 2011 ¦ Experience a hypervisor abort and shut down ¦ Fail to return to the OpenBoot PROM ¦ Fail to return to the Oracle Solaris OS These problems only occur if you did not start the guest domain after adding the PCIe device. By not starting the guest domain, previously configured virtual interfaces might not have been properly cleaned up. Workaround: If these problems occur, restart the system. To avoid these problems, start a guest domain after adding an I/O resource to it. If you do not want the domain to be active at this time, stop the guest domain after it has been started. Performing stop /SYS with HOST_COOLDOWN Policy Enabled Generates a Critical Voltage Fault By default, the HOST_COOLDOWN policy is disabled in the SP policy list, as shown by the following ILOM command: If you change this value to enabled, you will encounter a fault.chassis.voltage.fail fault when you power off your system. This fault prevents you from powering your system on again until it is cleared. -> ls /SP/policy /SP/policy Targets: Properties: HOST_AUTO_POWER_ON = disabled HOST_COOLDOWN = disabled HOST_LAST_POWER_STATE = disabled HOST_POWER_ON_DELAY = disabled PARALLEL_BOOT = enabled Commands: cd set showSPARC T3-4 Server Product Notes 33 This fault is in the event list in the ILOM command-line interface. For example: Workaround: 1. Disable the HOST_COOLDOWN policy: 2. Clear the fault: 3. Restart the system: -> show /SP/logs/event/list 24756 Wed Nov 24 11:23:36 2010 Fault Fault critical Fault detected at time = Wed Nov 24 11:23:36 2010. The suspect component: /SYS/MB has fault.chassis.voltage.fail with probability=100. Refer to ht tp://www.sun.com/msg/SPT-8000-DH for details. 24755 Wed Nov 24 11:23:36 2010 System Log minor Host: Solaris powering down 24754 Wed Nov 24 11:23:24 2010 System Log minor Host: Host stopped -> set /SP/policy HOST_COOLDOWN=disabled Set ’HOST_COOLDOWN’ to ’disabled’ -> set /SYS/MB clear_fault_action=true Are you sure you want to clear /SYS/MB (y/n)? y Set ’clear_fault_action’ to ’true’ -> start /SYS34 SPARC T3-4 Server Product Notes • December 2011 1 Ce guide décrit les étapes minimales à effectuer pour mettre sous tension et initialiser pour la première fois votre serveur SPARC T3-4 Oracle à l’aide du système d’exploitation Oracle Solaris (SE Oracle Solaris). Pour obtenir des instructions d’installation complètes, reportez-vous au Guide d’installation du serveur SPARC T3-4. FIGURE 1 Serveur SPARC T3-4 Contenu de la livraison Quantité Article 1 Serveur 4 Cordons d’alimentation CA (selon la commande) 1 Adaptateur croisé RJ-45/DB-9 1 Adaptateur croisé RJ-45/DB-25 1 Câble Ethernet 1 Bracelet antistatique 1 Kit de montage en rack Divers documents Serveur SPARC T3-4 Guide de démarrage2 Avant de commencer Pour une installation et une configuration rapides, suivez cette procédure. Pour obtenir des informations plus détaillées, consultez la documentation produit complète disponible en ligne à l’adresse : http://docs.sun.com/app/docs/prod/sparc.t3.4#hic Prenez connaissance des informations suivantes avant de configurer le serveur pour la première fois : ¦ Ne mettez pas le courant avant d’y être invité : ce système comprend un processeur de service (SP) permettant de configurer et de démarrer le serveur hôte. Afin de configurer correctement le serveur hôte et d’afficher les messages du SP, n’alimentez pas le serveur en courant alternatif (CA) tant que les connexions réseau de l’hôte et du SP ne sont pas établies, comme décrit dans ce guide. ¦ Choisissez les instructions les plus adaptées à votre situation : les instructions d’installation rapide s’appliquent à tous les environnements réseau et nécessitent l’utilisation d’un périphérique terminal pour établir les connexions avec un port série. Si votre environnement réseau utilise le protocole DHCP, vous pouvez configurer votre système à l’aide du port de gestion Ethernet. Pour tirer parti de la méthode de configuration DHCP, reportez-vous au guide d’installation faisant partie de la documentation produit disponible à l’adresse : http://docs.sun.com/app/docs/prod/sparc.t3.4#hic ¦ Planifiez un laps de temps suffisant : la durée d’une installation est variable. Cependant, si vous suivez ces instructions pour la première fois, prévoyez environ 45 minutes à 1 h 15 pour effectuer la totalité de ces instructions. Vous aurez peut-être besoin de plus de temps si vous installez des kits de montage en rack et des composants matériels supplémentaires. ¦ Procurez-vous un périphérique terminal : configurez ce serveur montable en rack par le biais du SP au moyen des ports de gestion série et réseau intégrés (ni interface graphique, ni clavier Sun). Pour communiquer avec le SP, vous aurez besoin d’un périphérique terminal : terminal, serveur de terminal ou ordinateur portable exécutant un logiciel d’émulation de terminal. ¦ Réunissez les informations de configuration nécessaires : pendant la configuration, vous êtes invité à spécifier les paramètres de fuseau horaire et réseau spécifiques à votre environnement. Le TABLEAU 1 vous permet de consigner vos informations de configuration. TABLEAU 1 Informations de configuration Paramètre Description Vos informations Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui). Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. Si vous avez des doutes, sélectionnez la première de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur. IP Address (Adresse IP) Saisissez l’adresse IP des interfaces Ethernet sélectionnées. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau.3 Instructions d’installation rapide 1. Déballez le serveur et vérifiez que tous les articles commandés sont présents (voir FIGURE 1). 2. Placez le serveur à l’emplacement prévu à titre de vérification. Pour obtenir des instructions de montage en rack, reportez-vous au Guide d’installation du serveur SPARC T3-4, disponible en ligne. 3. Reliez le port SER MGT du serveur au périphérique terminal à l’aide d’un câble série (voir FIGURE 2). Cette connexion assure la communication initiale avec le SP. Le périphérique doit être configuré de manière à communiquer à 9 600 bauds, 8 bits, sans parité et avec 1 bit d’arrêt. Une configuration de type inverseur est requise, signifiant que les signaux de transmission et de réception sont inversés (croisés) pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. Subnet Netmask (Masque de sous-réseau) (Avec une réponse affirmative pour le sous-réseau) Indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. Si vous avez des doutes, sélectionnez Use the NFSv4 domain derived by the system (Utiliser le domaine NFSv4 dérivé par le système). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Tapez deux fois le mot de passe root. Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP. TABLEAU 1 Informations de configuration (suite)4 FIGURE 2 Connexions du serveur 4. (Facultatif) Reliez au moyen d’un câble Ethernet le port NET MGT du serveur au réseau avec lequel les futures connexions au SP et à l’hôte seront établies (voir FIGURE 2). Une fois la configuration initiale du système effectuée à l’aide du port SER MGT, la communication avec le SP et l’hôte est généralement assurée par le biais de cette interface Ethernet. 5. Reliez au moyen d’un câble Ethernet l’un des ports NET du serveur au réseau avec lequel le serveur communiquera (voir FIGURE 2). Remarque – De plus, une fonction d’ILOM, intitulée gestion in-band ou sideband, vous permet d’accéder au SP à l’aide de l’un de ces ports Ethernet NET. Pour des instructions, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. 6. Branchez les cordons d’alimentation sur les alimentations et des sources de courant distinctes. Branchez les alimentations sur les sources de courant comme l’illustre la FIGURE 2. Votre système bénéficiera ainsi d’une alimentation redondante. Le système peut fonctionner avec deux connexions d’alimentation, mais la présence de seulement deux connexions de ce type empêche la redondance. Lorsqu’il est mis sous tension, le SP s’initialise et les DEL d’alimentation s’allument. Après quelques minutes, l’invite de connexion du SP s’affiche sur le périphérique terminal. Notez que l’hôte n’est pas encore initialisé ou mis sous tension à ce stade.5 7. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM (Integrated Lights Out Manager). Par exemple, pour créer un utilisateur nommé admin et définir le rôle du compte admin avec les privilèges cuar (console, gestion des utilisateurs, administration et contrôle de la réinitialisation et de l’hôte), tapez : Vous noterez que les astérisques indiqués dans l’exemple ne sont pas visibles lorsque vous saisissez le mot de passe. Vous trouverez des informations supplémentaires sur le SP (modification du mot de passe, configuration des paramètres réseau, etc.) dans la documentation en ligne. 8. Mettez le serveur sous tension et redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console de l’hôte démarrée, l’initialisation du serveur prend une vingtaine de minutes. 9. Lorsque vous y êtes invité, suivez les instructions qui s’affichent à l’écran et saisissez les informations de configuration. Pour obtenir la liste des informations de configuration et vos données personnelles, reportez-vous au TABLEAU 1. Vous êtes invité à confirmer la configuration à plusieurs reprises, ce qui vous permet de confirmer ou de modifier des paramètres. Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la lorsque le SE Oracle Solaris est exécuté. Lorsque tous les menus de configuration sont paramétrés, le serveur redémarre et affiche l’invite de connexion d’Oracle Solaris. 10. Connectez-vous au serveur et explorez ses fonctions. Les commandes suivantes fournissent des informations sur le système : ¦ showrev : affiche le nom d’hôte et des informations sur l’architecture du système. Utilisez l’option -a avec cette commande pour afficher les patchs installés. ¦ psrinfo : affiche des informations sur le nombre et le statut des processeurs et noyaux de l’hôte. SUNSP00144FAC732F login: root Password: changeme . . . -> -> create /SP/users/admin role=cuar Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/admin -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. . . .6 ¦ prtdiag : affiche des informations de diagnostic et de configuration système relatives à l’hôte. Pour plus d’informations, consultez les pages de manuel et la documentation du SE Oracle Solaris. Accès à des informations complémentaires Vous pouvez visualiser, imprimer et télécharger des informations supplémentaires sur ce produit à partir des URL suivants : ¦ Documentation complète relative au serveur SPARC T3-4 d’Oracle, comprenant notamment des documents essentiels tels que les notes de produit : http://docs.sun.com/app/docs/prod/sparc.t3.4#hic ¦ Large sélection de documentation Oracle Sun, versions traduites comprises : http://docs.sun.com ¦ Informations fournies avec le SE Oracle Solaris préinstallé : http://www.sun.com/software/preinstall Support technique Pour toute question d’ordre technique sur ce produit à laquelle ce document ne répond pas, consultez l’adresse suivante : http://www.sun.com/service/contacting Commentaires sur la documentation Pour nous envoyer vos commentaires sur ce document, cliquez sur le lien Feedback[+] à l’adresse : http://docs.sun.com/ Veuillez mentionner le titre et le numéro de référence du document dans vos commentaires : Guide de démarrage du serveur SPARC T3-4, référence 821-3148-10. Copyright © 2010, Oracle et/ou ses sociétés affiliées. Tous droits réservés. N° de référence : 821-3148-10, rév. A Décembre 2010 1 This guide describes the minimum steps you must perform to power on and boot Oracle’s SPARC T3-4 server for the first time using the preinstalled Oracle Solaris Operating System (Oracle Solaris OS). For complete installation instructions, refer to the SPARC T3-4 Server Installation Guide. FIGURE 1 SPARC T3-4 Server Shipping Contents Quantity Item 1 Server 4 AC power cords (if ordered) 1 RJ-45 to DB-9 crossover adapter 1 RJ-45 to DB-25 crossover adapter 1 Ethernet cable 1 Antistatic wrist strap 1 Rackmount kit Various documents SPARC T3-4 Server Getting Started Guide2 Before You Begin For quick installation and configuration, follow these steps. For more detailed information, refer to the complete online product documentation set at: http://docs.sun.com/app/docs/prod/sparc.t3.4#hic Understand the following information before you set up the server for the first time: ¦ Do not apply power until instructed to do so – This system includes a service processor (SP) that is used to configure and boot the host server. To properly configure the host server and view SP messages, do not apply AC power to the server until the SP and host networking connections are made, as described in this guide. ¦ Choose the best instructions for your situation – The quick setup instructions in this guide work for any networking environment and require the use of a terminal device for connection to a serial port. If you have a networking environment running DHCP, you can configure your system using the Ethernet management port. To take advantage of the DHCP setup method, refer to the installation guide in the online product documentation set at: http://docs.sun.com/app/docs/prod/sparc.t3.4#hic ¦ Set aside sufficient time – Installation times vary, but if you are performing these setup instructions for the first time, plan to spend about 45 to 75 minutes to complete all of these instructions. Additional time might be required for installing optional hardware and rackmounting kits. ¦ Obtain a terminal device – You configure this rackmountable server through the SP using the built-in serial and network management ports, and not through a graphical interface and Sun keyboard. To communicate with the SP, you will need a terminal device, which can be a terminal, terminal server, or laptop running terminal emulation software. ¦ Gather your configuration information – During the configuration, you are prompted for time zone and networking parameters for your environment. Use TABLE 1 to record your configuration information. TABLE 1 Configuration Information Parameter Description Your Entry Language Select a number from the displayed language list. Locale Select a number from the displayed locale list. Terminal Type Select a terminal type that corresponds with your terminal device. Network? Select Yes. Multiple Network Interfaces Select the network interfaces that you plan to configure. If you are not sure, select the first one in the list. DHCP? Select Yes or No according to your network environment. Host Name Type the host name for the server. IP Address Type the IP address for the selected Ethernet interfaces. Subnet? Select Yes or No according to your network environment. Subnet Netmask (If subnet was Yes) Type the netmask for the subnet for your network environment. IPv6? Specify whether or not to use IPv6. If you are not sure, select No to configure the Ethernet interface for IPv4. Security Policy Select either standard UNIX security (No) or Kerberos Security (Yes). If you are not sure, select No.3 Quick Setup Instructions 1. Unpack the server, and check that you received all of the shipping contents (FIGURE 1). 2. Place the server in its intended location for verification. For rackmounting instructions, refer to the online SPARC T3-4 Server Installation Guide. 3. Connect a serial cable between the server’s SER MGT port and a terminal device (FIGURE 2). This connection provides your initial communication with the SP. The device must be set up to communicate using 9600 baud, 8 bit, no parity, 1 stop bit. A null modem configuration is needed, meaning the transmit and receive signals are reversed (crossed over) for DTE to DTE communications. You can use the supplied RJ-45 crossover adapters with a standard RJ-45 cable to achieve the null modem configuration. Confirm Review the onscreen information and change it if needed. Otherwise, continue. Name Service Select the name service according to your network environment. Note – If you select a name service other than None, you will be prompted for additional name service configuration information. NFSv4 Domain Name Select the type of domain name configuration according to your environment. If you are not sure, select Use the NFSv4 domain derived by the system. Time Zone (Continent) Select your continent. Time Zone (Country or Region) Select your country or region. Time Zone Select the time zone. Date and Time Accept the default date and time, or change the values. root Password Type the root password twice. This password is for the superuser account for the Oracle Solaris OS on this server. This password is not the SP password. TABLE 1 Configuration Information (Continued)4 FIGURE 2 Server Connections 4. (Optional) Connect an Ethernet cable between the server’s NET MGT port and the network to which future connections to the SP and host will be made (FIGURE 2). After the initial configuration of the system using the SER MGT port, communication with the SP and host is usually performed through this Ethernet interface. 5. Connect an Ethernet cable between one of the server’s NET ports and the network to which the server will communicate (FIGURE 2). Note – There is also an ILOM feature called in-band, or sideband, management that enables you to access the SP using one of these NET Ethernet ports. Refer to the SPARC T3 Series Servers Administration Guide for instructions. 6. Plug the power cords into the power supplies and into separate power sources. Plug the power supplies into power sources as shown in FIGURE 2. This will provide your system with power redundancy. The system can operate with two power connections, but having only two power connections removes the redundancy. When power is applied, the SP initializes and the power supply LEDs illuminate. After a few minutes, the SP login prompt is displayed on the terminal device. Note that the host is not initialized or powered on yet.5 7. At the terminal device, log in to the SP as root with a password of changeme. After a brief delay, the SP prompt is displayed (->). At this point, there are many commands you can perform using the Integrated Lights Out Manager (ILOM) interface. For example, to create a user named admin, and to set the admin account role to have cuar (console, user management, admin, and reset and host control) privileges, type: Note that the asterisks in the example will not be displayed when you enter your password. Additional SP information, such as how to change the password and how to set up the SP network parameters, is available in the online documentation set. 8. Power on the server and redirect the host output to display on the serial terminal device: After you start the HOST console, the server initialization takes approximately 20 minutes to complete. 9. When prompted, follow the onscreen instructions and enter the configuration information. Refer to TABLE 1 for the list of configuration information and your entries. You will be prompted to confirm the configuration several times, enabling confirmation and changes. If you are not sure how to respond to a particular value, you can accept the default, and make future changes when the Oracle Solaris OS is running. When the configuration menus are completed, the server reboots and displays the Oracle Solaris login prompt. 10. Log in to the server and explore the capabilities. The following commands provide information about the system: ¦ showrev – Displays the host name and system architecture information. Use the -a option with this command to see the patches that are installed. ¦ psrinfo – Displays information about the number and status of the processors and cores in the host. ¦ prtdiag – Displays system configuration and diagnostic information about the host. Review the Oracle Solaris OS man pages and documentation for more details. SUNSP00144FAC732F login: root Password: changeme . . . -> -> create /SP/users/admin role=cuar Creating user... Enter new password: ******** Enter new password again: ******** Created /SP/users/admin -> start /SYS Are you sure you want to start /SYS (y/n)? y -> start /HOST/console Are you sure you want to start /HOST/CONSOLE (y/n)? y Serial console started. . . .6 Accessing Additional Information You can view, print, and download additional information for this product from the following URLs: ¦ Oracle’s SPARC T3-4 server documentation set, including important documents such as product notes: http://docs.sun.com/app/docs/prod/sparc.t3.4#hic ¦ A broad selection of Oracle Sun documentation, including localized versions: http://docs.sun.com ¦ Preinstalled Oracle Solaris OS information: http://www.sun.com/software/preinstall Technical Support If you have technical questions about this product that are not answered in this document, go to: http://www.sun.com/service/contacting Documentation Feedback Submit comments about this document by clicking the Feedback[+] link at: http://docs.sun.com/ Include the title and part number of your document with your feedback: SPARC T3-4 Server Getting Started Guide, part number 821-2111-10 Copyright © 2010, Oracle and/or its affiliates. All rights reserved. Copyright © 2010, Oracle et/ou ses affiliés. Tous droits réservés. Part No. 821-2111-10, Rev. A December 2010 Serveur SPARC T3-4 Guide d’installation N° de référence : 821-3153-10 Décembre 2010, révision AProduit recyclable Copyright © 2010, Oracle et/ou ses sociétés af?liées. Tous droits réservés. FUJITSU LIMITED a fourni et véri?é des données techniques de certaines parties de ce composant. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modi?ées sans préavis. Par ailleurs, Oracle Corporation et FUJITSU LIMITED ne garantissent pas qu’elles soient exemptes d’erreurs et vous invitent, le cas échéant, à leur en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des États-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des États-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ÉTATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des États-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. En tant que tels, leurs utilisation, duplication, divulgation, modi?cation et adaptation doivent être soumises aux restrictions et conditions de licence énoncées dans le contrat du Gouvernement applicable et, dans la mesure autorisée par ce contrat du Gouvernement, aux droits supplémentaires énoncés dans le FAR 52.227-19, Commercial Computer Software License (déc. 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, États-Unis et FUJITSU LIMITED, 1-1, Kamikodanaka 4-chome, Nakahara-ku, Kawasaki-shi, Kanagawa-ken 211-8588, Japon. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés af?liées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés af?liées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Fujitsu et le logo Fujitsu sont des marques déposées de Fujitsu Limited. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation, ses sociétés af?liées et FUJITSU LIMITED déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation, ses sociétés af?liées et FUJITSU LIMITED ne sauraient être tenues pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Table des matières Préface vii Préparation de l’installation 1 Présentation des tâches d’installation 2 Présentation du serveur 3 Vérification des spécifications du serveur 6 Spécifications physiques 6 Spécifications électriques 7 Informations sur la puissance d’entrée 8 Spécifications environnementales 9 Émissions sonores 10 Inventaire 10 Précautions de manipulation du serveur 12 Précautions contre les décharges électrostatiques 13 Outils nécessaires lors de l’installation 13 Installation des composants optionnels 14 Installation du serveur 15 Compatibilité des racks 16 Contenu du kit de montage en rack 16 ? Pour identifier le matériel de montage en rack approprié 18 ? Pour indiquer l’emplacement du montage en rack 18 ? Pour installer le matériel à monter en rack 19iv Guide d’installation du serveur SPARC T 3-4 • Décembre 2010 ? Pour installer le serveur 23 Installation et utilisation de l’ensemble de supports d’expédition (facultatif) 25 Contenu du kit de supports d’expédition 25 ? Pour identifier les attaches de supports appropriées 27 ? Pour installer le support d’expédition avant 28 ? Pour installer le support d’expédition arrière 29 ? Pour retirer le support d’expédition avant 29 Connexion des câbles du serveur 31 Câblage requis 31 Connecteurs et ports du panneau avant 33 Connecteurs et ports du panneau arrière 34 Installation et utilisation du module de fixation des câbles (facultatif) 35 À propos du module de fixation des câbles 36 ? Pour identifier le matériel CMA approprié 37 ? Pour installer le module de fixation des câbles 37 ? Pour fixer les câbles à l’aide du module de fixation des câbles 39 ? Pour connecter le câble SER MGT 40 ? Pour connecter le câble NET MGT 40 ? Pour connecter les câbles réseau Ethernet 41 ? Pour connecter d’autres câbles de données 42 ? Pour préparer les cordons d’alimentation 42 Mise sous tension initiale du serveur 43 Présentation des tâches de mise sous tension 44 Présentation de la console système Oracle ILOM 44 ? Pour connecter un terminal ou un émulateur au port SER MGT 45 ? Pour mettre le serveur sous tension pour la première fois 46 Paramètres de configuration du SE Oracle Solaris 48Table des matières v Assignation d’une adresse IP statique au processeur de service 50 ? Pour se connecter au processeur de service via le port SER MGT 50 ? Pour affecter une adresse IP statique au port NET MGT 52 Initialisation du système d’exploitation Oracle Solaris 55 ? Pour initialiser le système d’exploitation Oracle Solaris 56 ? Pour éviter d’initialiser le système d’exploitation Oracle Solaris au démarrage 57 ? Pour réinitialiser le serveur 57 ? Pour mettre le serveur progressivement sous tension 57 Identification des ports du serveur 59 Brochage des ports USB 60 Brochage des ports SER MGT 61 Brochage des ports NET MGT 62 Brochage des ports Gigabit Ethernet 63 Brochage des ports QSFP 64 Brochage des ports VGA 64 Index 65vi Guide d’installation du serveur SPARC T 3-4 • Décembre 2010vii Préface Ce guide d’installation contient des instructions, des informations d’ordre général et de référence visant à faciliter l’installation du serveur SPARC T3-4 d’Oracle. Ces instructions d’installation partent du principe que l’administrateur système maîtrise le système d’exploitation Oracle Solaris 10 (SE Oracle Solaris). Remarque – Tous les composants internes à l’exception des disques durs doivent être installés par des techniciens de service qualifiés. ¦ « Commandes UNIX », page vii ¦ « Invites de shell », page viii ¦ « Documentation connexe », page viii ¦ « Documentation, support et formation », page ix Commandes UNIX Ce document peut ne pas contenir d’informations sur les commandes et procédures UNIX de base telles que l’arrêt et le démarrage du système ou la configuration des périphériques. Vous trouverez de plus amples informations à ce sujet dans : ¦ la documentation accompagnant les logiciels livrés avec votre système ; ¦ la documentation relative au système d’exploitation Oracle Solaris, disponible à l’adresse suivante : (http://docs.sun.com)viii Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Invites de shell Documentation connexe (http://docs.sun.com/app/docs/prod/sparc.t3.4#hic) Documentation relative au serveur SPARC T3-4 : Shell Invite C shell nom-machine% Superutilisateur C shell nom-machine# Bourne shell et Korn shell $ Superutilisateur Bourne shell et Korn shell # Application Titre Format Emplacement Informations de dernière minute Notes de produit du serveur SPARC T3-4 PDF En ligne Guide de démarrage Guide de démarrage du serveur SPARC T3-4 Imprimé Livré avec le système Installation Guide d’installation du serveur SPARC T3-4 PDF HTML En ligne Administration Guide d’administration des serveurs de la série SPARC T3 PDF HTML En ligne Maintenance SPARC T3-4 Server Service Manual PDF HTML En ligne Sécurité SPARC T3-4 Server Safety and Compliance Manual PDF En lignePréface ix Documentation d’Oracle Integrated Lights Out Manager 3.0 Documentation, support et formation Ces sites proposent des ressources supplémentaires : ¦ Documentation (http://www.sun.com/documentation) ¦ Support (http://www.sun.com/support) ¦ Formation (http://www.sun.com/training) Application Titre Emplacement Informations de dernière minute et problèmes Mises à jour des fonctionnalités et Notes de version d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Installation et configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures relatives à l’interface du navigateur Guide des procédures relatives à l’interface Web d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures relatives à la CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 En ligne Procédures SNMP et IPMI Guide de référence des protocoles de gestion d’Oracle Integrated Lights Out Manager 3.0 : SNMP, IPMI, WS-Man, CIM En lignex Guide d’installation du serveur SPARC T3-4 • Décembre 20101 Préparation de l’installation Les rubriques qui suivent présentent des informations de référence dont vous devez prendre connaissance avant de procéder à l’installation du serveur SPARC T3-4. ¦ « Présentation des tâches d’installation », page 2 ¦ « Présentation du serveur », page 3 ¦ « Vérification des spécifications du serveur », page 6 ¦ « Inventaire », page 10 ¦ « Précautions de manipulation du serveur », page 12 ¦ « Précautions contre les décharges électrostatiques », page 13 ¦ « Outils nécessaires lors de l’installation », page 13 ¦ « Installation des composants optionnels », page 14 Informations connexes ¦ « Installation du serveur », page 152 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Présentation des tâches d’installation Informations connexes ¦ « Précautions de manipulation du serveur », page 12 ¦ « Précautions contre les décharges électrostatiques », page 13 ¦ « Outils nécessaires lors de l’installation », page 13 ¦ « Mise sous tension initiale du serveur », page 43 Étape Description Liens 1 Passez en revue les Notes de produit du serveur SPARC T3-4 pour connaître les toutes dernières informations sur le serveur. Notes de produit du serveur SPARC T3-4 2 Passez en revue les spécifications du serveur et la configuration de site requise. « Vérification des spécifications du serveur », page 6 3 Assurez-vous d’avoir bien reçu tous les articles que vous avez commandés, familiarisez-vous avec les précautions relatives aux décharges électrostatiques et les consignes de sécurité, et assemblez les outils dont vous aurez besoin. « Précautions de manipulation du serveur », page 12 « Précautions contre les décharges électrostatiques », page 13 « Outils nécessaires lors de l’installation », page 13 4 Installez le serveur dans une armoire d’équipement. « Installation du serveur », page 15 5 Reliez les câbles de données et de gestion du serveur au serveur. « Câblage requis », page 31 « Connecteurs et ports du panneau arrière », page 34 « Pour installer le module de fixation des câbles », page 37 6 Branchez les cordons d’alimentation du serveur, configurez le processeur de service, mettez le serveur sous tension pour la première fois et configurez le système d’exploitation. « Mise sous tension initiale du serveur », page 43Préparation de l’installation 3 Présentation du serveur Le SPARC T3-4 est un serveur de cinq unités de rack (5U). Composant/Fonction Nouvelles caractéristiques Processeur Jusqu’à 4 CMP (Chip Multiprocessor) SPARC T3 16 noyaux, cadencés à 1,65 GHz, avec 8 threads par noyau Configuration à 2 multiprocesseurs également disponible Mémoire 16 emplacements de modules DIMM DDR3 ; modules de capacité de 4 Go et 8 Go E/S - Extension 16 emplacements de cartes PCIe Gen2 4 ports Gigabit Ethernet 4 ports USB 8 ports 10 Gigabit Ethernet en option Stockage sur disque dur Backplane de 8 disques prenant en charge toute combinaison d’unités de disque dur et de disques durs électroniques (SSD) Processeur de service Modulaire, enfichable sur la carte mère4 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 FIGURE : Ports du panneau avant Légende de la figure 1 Por t VGA 2 Ports USB 3 Port EthernetPréparation de l’installation 5 FIGURE : Ports du panneau arrière Informations connexes ¦ « Vérification des spécifications du serveur », page 6 ¦ « Inventaire », page 10 ¦ « Précautions de manipulation du serveur », page 12 ¦ « Outils nécessaires lors de l’installation », page 13 Vérification des spécifications du serveur Les rubriques qui suivent présentent les spécifications physiques, environnementales et électriques du serveur. Légende de la figure 1 2 Ports USB 3 Ports d’alimentation CA 4 Port Gigabit Ethernet 5 Port SER MGT 6 Port NET MGT6 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ¦ « Spécifications physiques », page 6 ¦ « Spécifications électriques », page 7 ¦ « Informations sur la puissance d’entrée », page 8 ¦ « Spécifications environnementales », page 9 ¦ « Émissions sonores », page 10 Informations connexes ¦ « Présentation du serveur », page 3 ¦ « Précautions de manipulation du serveur », page 12 ¦ « Précautions contre les décharges électrostatiques », page 13 ¦ « Installation des composants optionnels », page 14 ¦ « Identification des ports du serveur », page 59 Spécifications physiques Informations connexes ¦ « Spécifications électriques », page 7 ¦ « Informations sur la puissance d’entrée », page 8 ¦ « Spécifications environnementales », page 9 Description Système anglo-saxon Système métrique Largeur 17,5 po 445 mm Profondeur 24,9 po 633 mm Hauteur 8,75 po (5U) 222 mm Poids approximatif (sans cartes PCI et montage en rack) 175 lb 80 kg Espace libre minimum pour les accès aux services (à l’avant) 36 po 91 cm Espace libre minimum pour les accès aux services (à l’arrière) 36 po 91 cmPréparation de l’installation 7 Spécifications électriques Le serveur SPARC T3-4 dispose de quatre alimentations électriques autocalibrées. Afin de garantir la redondance des alimentations, branchez les cordons d’alimentation sur au moins deux circuits CA distincts. Utilisez seulement ces spécifications à titre indicatif dans le cadre de la planification. Pour obtenir des valeurs plus précises, prenez des mesures électriques au sein de votre propre configuration de serveur en utilisant la charge de travail prévue. Informations connexes ¦ « Informations sur la puissance d’entrée », page 8 ¦ « Spécifications environnementales », page 9 ¦ SPARC T3-4 Server Service Manual Description Spécification Spécifications d’ordre général Plage des tensions d’entrée en fonctionnement 200 à 240 VAC, 50 à 60 Hz (tolérance VAC +/- 10 %) Courant d’entrée maximal en service à 200 VAC 12,6 A Puissance d’entrée maximale en service à 200 VAC 2 400 W Dissipation de la chaleur maximale 8 200 BTU/heure ou 8 700 KJ/heure Alimentation maximale en veille 55 W Spécifications maximales de configuration du serveur Aux température et tension nominales 4 CMP, 1,65 GHz, 64 noyaux, 64 modules DIMM DDR3 8 Go 800 MHz, 8 disques durs, 16 cartes d’E/S Alimentation d’entrée CA au repos 1 500W Alimentation d’entrée CA de pointe lors de l’exécution de SpecJBB 2 300 W Spécifications de configuration minimales du serveur Aux température et tension nominales 2 CMP, 1,65 GHz, 32 noyaux, 16 modules DIMM DDR3 4 Go, pas de disque dur, pas de carte d’E/S Alimentation d’entrée CA au repos 1 250 W Alimentation d’entrée CA de pointe lors de l’exécution de SpecJBB 1 450 W8 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Informations sur la puissance d’entrée Les valeurs maximales de courant en service sont calculées sur la base de W/V à l’aide de l’équation suivante : W/(V * 0,95) = A Utilisez cette formule pour calculer le courant maximal en service du serveur selon la tension d’entrée de votre installation. Exemple : 1 060 W/(220 V * 0,95) = 5,1 A Informations connexes ¦ « Spécifications électriques », page 7 »Préparation de l’installation 9 Spécifications environnementales Informations connexes ¦ « Spécifications physiques », page 6 ¦ « Informations sur la puissance d’entrée », page 8 Spécification En service Hors service Température • Niveau de la mer à 900 m (2 953 pieds) : 41 °F à 95 °F (5 °C à 35 °C) • Au-dessus de 900 m (2 953 pieds) : Baisse de la température admise maximale de 1,6 ?F/1 000 pieds (1 °C/300 m) IEC 60068-2-1 Test Ad et 60068-2-2 Test Bd -40 °F à 149 °F (-40 °C à 65 °C) IEC 60068-2-1 Test Ab et 60068-2-2 Test Bb Humidité relative 10 à 90 % d’humidité relative, 27 °C max. avec thermomètre humide (sans condensation) IEC 60068-2-56 Test Cb 93 %, 35 °C max. avec thermomètre humide (sans condensation) IEC 60068-2-56 Test Cb Altitude 3 000 m (10 000 pieds) IEC 60068-2-13 Test M et 60068-2-41 Test Z/BM 12 000 m (40 000 pieds) IEC 60068-2-13 Test M Vibrations Choc sinusoïdal de 0,15 G (axe Z), 0,10 G (axes X et Y), balayage de sinus de 5 à 500 Hz IEC 60068-2-6 Test Fc Choc sinusoïdal de 0.5 G (axe Z), 0,25 G (axes X et Y), balayage de sinus de 5 à 500 Hz IEC 60068-2-6 Test Fc Chocs Pulsation demi-sinusoïdale de 3 Gs, 11 ms IEC 60068-2-27 Test Ea • Basculement : Chute libre avec basculement de 1 pouce (2,54 cm), de l’avant vers l’arrière • Seuil : Hauteur limite de 25 mm avec une vélocité d’impact de 0,75 m/s ETE-1010-02 Rév. A10 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Émissions sonores Les émissions de bruit déclarées sont conformes aux normes ISO 9296 pour le serveur SPARC T3-4. Informations connexes ¦ « Informations sur la puissance d’entrée », page 8 ¦ « Spécifications environnementales », page 9 Inventaire La FIGURE : Inventaire, page 11 illustre les composants livrés avec le serveur. Description Fonctionnement au repos Fonctionnement à la puissance maximale Niveau de puissance sonore, LWAd (1 B= 10 dB) 7,4 B 8,9 B Niveau de pression sonore, LpAm (positions en veille) 63 dB 80 dBPréparation de l’installation 11 FIGURE : Inventaire Informations connexes ¦ « Présentation des tâches d’installation », page 2 ¦ « Présentation du serveur », page 3 ¦ « Contenu du kit de montage en rack », page 16 Légende de la figure 1 Serveur SPARC T3-4 2 Câble Ethernet 3 Kit de montage en rack 4 Modèle de montage en rack 5 Kit d’impression du document 6 Adaptateurs de câbles12 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Précautions de manipulation du serveur Attention – Déployez la barre antibasculement du rack d’équipement avant de commencer l’installation. Attention – Chargez toujours le matériel dans un rack de bas en haut, afin d’éviter qu’il ne se déséquilibre par le haut et bascule. Attention – Un serveur SPARC T3-4 entièrement configuré pèse environ 80 kg. Deux personnes sont nécessaires pour le soulever et l’installer dans un rack en suivant les procédures décrites dans ce document. Attention – Communiquez toujours clairement vos intentions avant, pendant et au terme de chaque étape pour minimiser la confusion. Informations connexes ¦ « Précautions contre les décharges électrostatiques », page 13Préparation de l’installation 13 Précautions contre les décharges électrostatiques L’électricité statique peut endommager les équipements électroniques. Munissez-vous d’un bracelet antistatique mis à la terre, d’un cale-pied ou d’un dispositif de sécurité équivalent afin de prévenir des dommages électrostatiques lors de l’installation ou de l’entretien du serveur. Attention – Pour protéger les composants électriques des dommages dus aux décharges électrostatiques, qui peuvent irrémédiablement endommager le serveur ou nécessiter des réparations effectuées par des techniciens de maintenance, placez les composants sur une surface antistatique (telle qu’un tapis de décharge antistatique, un sachet antistatique ou un tapis antistatique jetable). Portez un bracelet de mise à la terre antistatique relié à une surface métallique du châssis lorsque vous travaillez sur les composants du serveur. Informations connexes ¦ « Précautions de manipulation du serveur », page 12 Outils nécessaires lors de l’installation Pour installer le serveur, vous aurez besoin des outils suivants : ¦ Tournevis cruciforme n°2 ¦ Pince coupante ou ciseaux résistants ¦ Marqueur ou du ruban adhésif ¦ Tapis antistatique et bracelet de mise à la terre ¦ Appareil de levage hydraulique ou mécanique14 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 En outre, vous devez disposer d’un périphérique de console système, tel que l’un des éléments suivants : ¦ Terminal ASCII ¦ Station de travail ¦ Serveur de terminal ¦ Tableau de connexions relié à un serveur de terminal Informations connexes ¦ « Précautions de manipulation du serveur », page 12 ¦ « Précautions contre les décharges électrostatiques », page 13 Installation des composants optionnels Les composants standard du serveur sont installés en usine. Cependant, si vous avez commandé des options telles que de la mémoire supplémentaire ou des cartes PCI, celles-ci seront livrées séparément. Dans la mesure du possible, installez ces composants avant de monter le serveur dans un rack. Pour des instructions d’installations spécifiques, reportez-vous au SPARC T3-4 Server Service Manual. Remarque – La liste des composants optionnels peut être mise à jour sans préavis. Consultez les pages produit Web pour obtenir la liste actualisée des composants pris en charge par le serveur. Informations connexes ¦ « Outils nécessaires lors de l’installation », page 1315 Installation du serveur Ces rubriques décrivent la procédure d’installation du serveur dans une armoire dotée de trous carrés. Si vous disposez d’une armoire d’équipement à trous de montage ronds, reportez-vous·à la section « Pour identifier le matériel de montage en rack approprié », page 18. Remarque – Si le kit de montage en rack est accompagné d’instructions, utilisez ces dernières au lieu de suivre les instructions contenues dans ce chapitre. Une fois l’installation du serveur terminée, passez au « Mise sous tension initiale du serveur », page 43 pour des informations sur la première mise sous tension. Si vous envoyez le rack sur un autre site pour son installation finale ou si vous installez le serveur dans un véhicule, installez les supports d’expédition. Reportez-vous à la section « Installation et utilisation de l’ensemble de supports d’expédition (facultatif) », page 25. Ces rubriques abordent les sujets suivants : ¦ « Compatibilité des racks », page 16 ¦ « Contenu du kit de montage en rack », page 16 ¦ « Pour identifier le matériel de montage en rack approprié », page 18 ¦ « Pour indiquer l’emplacement du montage en rack », page 18 ¦ « Pour installer le matériel à monter en rack », page 19 ¦ « Pour installer le serveur », page 23 ¦ « Installation et utilisation de l’ensemble de supports d’expédition (facultatif) », page 25 Informations connexes ¦ « Préparation de l’installation », page 1 ¦ « Connexion des câbles du serveur », page 31 ¦ « Mise sous tension initiale du serveur », page 4316 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Compatibilité des racks Le kit de montage en rack est compatible avec les racks répondant aux normes suivantes : ¦ Structure à quatre montants (montage possible à l’avant et à l’arrière). Remarque – Les racks à deux montants ne sont pas compatibles. ¦ Ouverture horizontale du rack et insertion verticale d’unités conformes aux normes ANSI/EIA 310-D-1992 ou IEC 60927. ¦ Distance entre les plans de montage avant et arrière comprise entre 65 cm et 91,5 cm (36 et 65 po). ¦ Espace libre minimal (jusqu’à la porte avant de l’armoire) devant le plan avant : 25,4 mm (1 po). ¦ Espace libre minimal (jusqu’à la porte arrière) derrière le plan avant : 120 cm (47,2 po) avec le module de fixation des câbles (recommandé) ou 100 cm (39,4 po) sans le CMA. ¦ Espace libre minimal (entre les supports structurels et les chemins de câbles) entre les plans avant et arrière de 45,6 mm (18 po). Informations connexes ¦ « Outils nécessaires lors de l’installation », page 13 ¦ « Contenu du kit de montage en rack », page 16 ¦ « Pour identifier le matériel de montage en rack approprié », page 18 Contenu du kit de montage en rack Le kit de montage en rack comprend deux rails d’étagère, un pour chaque côté du rack. Chaque rail d’étagère porte la mention LEFT (GAUCHE) ou RIGHT (DROIT). (FIGURE : Kit de montage en rack, page 17). Les rails d’étagère sont montés sur le rack ou sur l’armoire à l’aide de quatre supports adaptateurs. Les rails d’étagère se règlent en fonction de la profondeur du rack, de 63,5 à 87 cm (25 à 34,25 po).Installation du serveur 17 FIGURE : Kit de montage en rack Informations connexes ¦ « Outils nécessaires lors de l’installation », page 13 ¦ « Compatibilité des racks », page 16 ¦ « Pour identifier le matériel de montage en rack approprié », page 18 ¦ « Installation et utilisation de l’ensemble de supports d’expédition (facultatif) », page 25 Légende de la figure 1 Supports arrière du haut 2 Rails d’étagère 3 Supports adaptateurs (deux types fournis) 4 Vis à tête fraisée 5 Douilles taraudées 6 Vis M6 7 Vis de montage en rack18 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour identifier le matériel de montage en rack approprié ? Le tableau suivant permet de déterminer le matériel nécessaire à l’installation du rack. Remarque – Tous les sachets d’attaches inclus dans le kit ne sont pas requis pour installer ce serveur. ? Pour indiquer l’emplacement du montage en rack Utilisez le modèle de montage en rack pour identifier les trous de montage adaptés aux rails d’étagère. Remarque – Chargez le rack de bas en haut. 1. Vérifiez que l’espace vertical de l’armoire est suffisant pour installer le serveur. Type d’armoire Sachets d’attaches requis Trou carré VIS, SEMS, M6 x 16 ÉCROUS À CAGE, M6 VIS À TÊTE FRAISE, M4 x 10 Trou rond (10-32) avec collerette d’encastrement VIS, SEMS, 10-32 x 10 VIS À TÊTE FRAISE, M4 x 10 Trou rond (M6) avec collerette d’encastrement VIS, SEMS, M6 x 12 VIS À TÊTE FRAISE, M4 x 10 Trou rond (10-32) - installation intérieure VIS À ÉPAULEMENT, 10-32 VIS À TÊTE FRAISE, M4 x 10 Trou rond (M6) - installation intérieure VIS, SEMS, M6 x 12 VIS À TÊTE FRAISE, M4 x 10Installation du serveur 19 2. Placez le modèle de montage en rack par rapport aux rails avant. Le bord inférieur du modèle correspond au bord inférieur du serveur. Mesurez de bas en haut sur le modèle. 3. Indiquez les trous de montage des rails avant de l’étagère. 4. Indiquez les trous de montage des rails arrière de l’étagère. ? Pour installer le matériel à monter en rack 1. Répétez les étapes suivantes pour les points de montage avant gauche et droit : a. Placez le support adaptateur à l’emplacement indiqué. Remarque – Une flèche pointant vers le haut indique l’orientation qui convient. b. Fixez le support adaptateur dans le trou du milieu à l’aide d’une vis cruciforme n° 2.20 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 c. Introduisez un clip de montage dans le trou, juste au-dessus du haut du support du rail du rack. 2. Répétez les étapes suivantes pour les points de montage arrière gauche et droit : a. Placez le support adaptateur à l’emplacement indiqué. Remarque – Une flèche pointant vers le haut indique l’orientation qui convient. b. Fixez les trous supérieurs et inférieurs des supports adaptateurs à l’aide de deux vis cruciformes n° 2.Installation du serveur 21 3. Installez les supports d’angle supérieurs gauche et droit. a. Placez deux écrous à cage dans l’armoire, dans les deux trous situés au-dessus du haut des supports adaptateurs. b. Fixez chaque support d’angle supérieur à l’aide de deux vis cruciformes n° 2.22 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 4. Installez les rails d’étagère. Remarque – Les rails d’étagère portent les mentions « Left » (Gauche) ou « Right » (Droite) (comme si l’on se plaçait face au serveur) et « Front » (Avant) ou « Rear » (Arrière). Répétez ces étapes pour les rails d’étagère gauche et droit : a. Introduisez l’avant du rail d’étagère dans le support adaptateur avant. b. Introduisez l’arrière du rail d’étagère dans le support adaptateur arrière. Le rail d’étagère coulisse à l’intérieur afin de s’adapter aux différentes profondeurs d’armoire.Installation du serveur 23 c. Fixez chaque rail d’étagère au moyen de deux vis cruciformes n° 2 à tête fraisée. ? Pour installer le serveur Attention – Un serveur entièrement configuré pèse 80 kg (175 livres). Servez-vous d’un appareil de levage mécanique pour installer le serveur dans le rack. 1. Vérifiez que le un appareil de levage mécanique est bien réglé et stable. 2. Soulevez le serveur jusqu’à la hauteur voulue. 3. Faites glisser le serveur dans le rack. Assurez-vous que le bord inférieur du serveur ne se trouve plus sur le bas des rails du rack.24 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 FIGURE : Installation du serveur 4. Fixez le serveur au panneau avant à l’aide de quatre vis cruciformes n° 2. Légende de la figure 1 Appareil de levage mécanique 2 Serveur SPARC T3-4 3 Armoire 4 Rail d’étagère 5 Vérifier que le serveur est monté au-dessus du rail d’étagèreInstallation du serveur 25 Installation et utilisation de l’ensemble de supports d’expédition (facultatif) Respectez cet ensemble de procédures pour installer le serveur dans un rack d’équipement destiné à être expédié sur un autre site ou dans le cadre d’une installation dans un véhicule. Remarque – Cette procédure décrit l’installation du serveur dans une armoire dotée de trous de montage carrés. Si vous disposez d’une armoire d’équipement à trous de montage ronds, reportez-vous·à la section « Pour identifier le matériel de montage en rack approprié », page 18. Cette rubrique comprend les sections suivantes : ¦ « Contenu du kit de supports d’expédition », page 25 ¦ « Pour identifier les attaches de supports appropriées », page 27 ¦ « Pour installer le support d’expédition avant », page 28 ¦ « Pour installer le support d’expédition arrière », page 29 Informations connexes ¦ « Compatibilité des racks », page 16 ¦ « Contenu du kit de montage en rack », page 16 ¦ « Pour identifier le matériel de montage en rack approprié », page 18 ¦ « Pour indiquer l’emplacement du montage en rack », page 18 ¦ « Pour installer le serveur », page 23 Contenu du kit de supports d’expédition Le kit de supports d’expédition optionnel offre une protection renforcée contre les chocs et les vibrations. Ce kit est recommandé pour les installations dans un véhicule ou dans une armoire d’équipement qui sera expédiée ailleurs en vue de son installation finale.26 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 FIGURE : Kit de supports d’expédition Informations connexes ¦ « Outils nécessaires lors de l’installation », page 13 ¦ « Compatibilité des racks », page 16 ¦ « Pour identifier le matériel de montage en rack approprié », page 18 ¦ « Pour indiquer l’emplacement du montage en rack », page 18 ¦ « Pour identifier les attaches de supports appropriées », page 27 Légende de la figure 1 Support d’expédition arrière 2 Support d’expédition avant 3 AttachesInstallation du serveur 27 ? Pour identifier les attaches de supports appropriées ? Référez-vous au tableau suivant pour identifier les attaches correspondant à votre type d’installation. Remarque – Tous les sachets d’attaches ne sont pas nécessaires pour installer ce serveur. Type d’armoire Sachets d’attaches requis Trou rond avec collerette d’encastrement VIS, SEMS, M6 x 16 MM VIS, SEMS, M6 x 30 MM ÉCROUS À CAGE, M6 VIS DE CISAILLEMENT Trou taraudé (10-32) VIS, SEMS, 10-32 x 1-1/4” VIS, SEMS, 10-32 x 10 MM Trou taraudé (M6) VIS, SEMS, M6 x 16 MM VIS, SEMS, M6 x 30 MM28 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour installer le support d’expédition avant 1. Retirez les deux vis de montage inférieures du panneau avant. Remarque – Utilisez les trous taraudés du support d’expédition avant pour fixer ces vis à des fins d’utilisation ultérieure. 2. Maintenez en place le support d’expédition avant. 3. Fixez le support d’expédition à l’aide de vis longues.Installation du serveur 29 ? Pour installer le support d’expédition arrière 1. Maintenez en place le support d’expédition inférieur. 2. Fixez deux vis cruciformes n° 2 dans les trous du bas du support d’expédition inférieur. ? Pour retirer le support d’expédition avant Retirez le support d’expédition avant une fois l’armoire du serveur arrivée à sa destination finale. 1. Retirez les deux vis cruciformes n° 2 courtes stockées avec le support d’expédition. 2. Retirez les deux vis servant à fixer le support d’expédition avant à l’armoire. 3. Faites coulisser le support d’expédition avant hors de l’avant de l’armoire. 4. Fixez les deux vis cruciformes n° 2 courtes dans les deux emplacements de vis inférieurs du panneau avant. Utilisez les vis stockées dans le support d’expédition avant pendant le déplacement.30 Guide d’installation du serveur SPARC T3-4 • Décembre 201031 Connexion des câbles du serveur Cette rubrique aborde les sujets suivants : ¦ « Câblage requis », page 31 ¦ « Connecteurs et ports du panneau avant », page 33 ¦ « Connecteurs et ports du panneau arrière », page 34 ¦ « Installation et utilisation du module de fixation des câbles (facultatif) », page 35 ¦ « Pour connecter le câble SER MGT », page 40 ¦ « Pour connecter le câble NET MGT », page 40 ¦ « Pour connecter les câbles réseau Ethernet », page 41 ¦ « Pour connecter d’autres câbles de données », page 42 ¦ « Pour préparer les cordons d’alimentation », page 42 Informations connexes ¦ « Préparation de l’installation », page 1 ¦ « Installation du serveur », page 15 ¦ « Mise sous tension initiale du serveur », page 43 ¦ « Identification des ports du serveur », page 59 Câblage requis ¦ Connexions de câbles minimales pour le serveur : ¦ une connexion réseau Ethernet intégrée min. au serveur (port NET) ; ¦ port de gestion série du processeur de service (port SER MGT) ; ¦ port de gestion réseau du processeur de service (port NET MGT) ; ¦ des câbles d’alimentation pour le serveur.32 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ¦ Ports de gestion du processeur de service : au nombre de deux, les ports de gestion du processeur de service sont destinés à être utilisés avec le processeur de service ILOM. ¦ Le port de gestion série du processeur de service (étiqueté SER MGT) utilise un câble RJ-45 et est toujours disponible. Il s’agit du port de connexion par défaut au processeur de service ILOM. ¦ Le port de gestion réseau du processeur de service (étiqueté NET MGT) constitue la connexion facultative au processeur de service ILOM. Par défaut, le port NET MGT est configuré pour utiliser le protocole DHCP. Pour définir une adresse IP statique, reportez-vous à la section « Assignation d’une adresse IP statique au processeur de service », page 50. Le port de gestion réseau du processeur de service utilise un câble RJ-45 pour une connexion 10/100 BASE-T. Ce port ne prend pas en charge les connexions établies avec des réseaux Gigabit. ¦ Les ports Ethernet sont étiquetés NET0, NET1, NET2 et NET3. Les interfaces Ethernet fonctionnent à 10 Mbits/s, 100 Mbits/s et 1 000 Mbits/s. ¦ Ports USB : assurent la prise en charge de l’enfichage à chaud. Vous pouvez connecter et déconnecter les câbles USB et les unités périphériques pendant que le serveur fonctionne, sans que cela n’ait d’incidence sur les opérations du serveur. ¦ Vous pouvez uniquement effectuer des opérations d’enfichage à chaud USB quand le SE est en cours d’exécution. Les opérations d’enfichage à chaud USB ne sont pas prises en charge lorsque l’invite ok du serveur est affichée ou que l’initialisation du serveur n’est pas complètement terminée. ¦ Vous pouvez connecter jusqu’à 126 périphériques à chacun des quatre contrôleurs USB, soit au total 504 périphériques USB par serveur. ¦ Câbles d’alimentation CA¬: ne raccordez pas de câbles aux alimentations tant que vous n’avez pas terminé de relier les câbles de données et n’avez pas connecté le serveur à un terminal série ou à un émulateur de terminal série (PC ou station de travail). Le serveur passe en mode veille et le processeur de service ILOM s’initialise dès que les câbles d’alimentation CA sont connectés à la source de courant. Vous risquez de perdre des messages système après une minute si le serveur n’est pas connecté à un terminal, un PC ou une station de travail. Type de connexion Terminologie IEEE Vitesse de transfert Ethernet 10BASE-T 10 Mbits/s Fast Ethernet 100BASE-TX 100 Mbits/s Gigabit Ethernet 1000BASE-T 1 000 Mbits/sConnexion des câbles du serveur 33 Informations connexes ¦ « Vérification des spécifications du serveur », page 6 ¦ « Précautions de manipulation du serveur », page 12 ¦ « Pour fixer les câbles à l’aide du module de fixation des câbles », page 39 Connecteurs et ports du panneau avant FIGURE : Connecteurs du panneau avant Légende de la figure 1 Por t VGA 2 Ports USB 3 Port NET MGT34 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Connecteurs et ports du panneau arrière FIGURE : Connecteurs du panneau arrière Remarque – Vous devez connecter les câbles au serveur dans l’ordre approprié. Ne connectez pas les câbles d’alimentation tant que tous les câbles de données ne sont pas branchés. Informations connexes ¦ « Précautions de manipulation du serveur », page 12 ¦ « Précautions contre les décharges électrostatiques », page 13 ¦ « Câblage requis », page 31 ¦ « Pour installer le module de fixation des câbles », page 37 ¦ « Pour fixer les câbles à l’aide du module de fixation des câbles », page 39Connexion des câbles du serveur 35 Installation et utilisation du module de fixation des câbles (facultatif) Le module de fixation des câbles (CMA, cable management assembly) est un kit optionnel permettant de gérer et d’acheminer les câbles d’alimentation et de données connectés à l’arrière du serveur. Cette rubrique aborde les sujets suivants : ¦ « À propos du module de fixation des câbles », page 36 ¦ « Pour identifier le matériel CMA approprié », page 37 ¦ « Pour installer le module de fixation des câbles », page 37 ¦ « Pour fixer les câbles à l’aide du module de fixation des câbles », page 3936 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 À propos du module de fixation des câbles FIGURE : Module de fixation des câbles (CMA) Légende de la figure 1 Fixations sur pivot 2 Supports en « L » 3 Attaches 4 Module de fixation des câbles.Connexion des câbles du serveur 37 ? Pour identifier le matériel CMA approprié ? Le tableau suivant permet de déterminer le matériel nécessaire à l’installation du module de fixation des câbles. Remarque – Tous les sachets d’attaches inclus dans le kit ne sont pas requis pour installer ce serveur. ? Pour installer le module de fixation des câbles Le module de fixation des câbles se fixe à la partie centrale de l’arrière du serveur. Remarque – L’installation du module de fixation des câbles peut bloquer (et donc rendre indisponibles) certaines des prises de courant de l’armoire. 1. Installez les supports en L à l’arrière. Les supports portent la mention « Left » (Gauche) ou « Right » (Droite) vu de l’arrière du serveur. Répétez cette opération pour les côtés gauche et droit : a. Identifiez les supports prévus pour les côtés gauche et droit. b. Retirez les deux vis du milieu de l’adaptateur de montage en rack. c. Placez le support sur les deux trous de montage du milieu. d. Fixez chaque support de montage à l’aide de deux vis cruciformes n° 2. Type d’armoire Sachets d’attaches requis Trou carré Trou rond (M6) (tous types) VIS, SEMS, M6 x 16 Trou rond (10-32) (tous types)l VIS, SEMS, 10-32 x 7/16”38 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 2. Faites glisser les clips pivotants gauche et droit dans les supports en L gauche et droit. 3. Fixez le module de fixation des câbles à l’aide des deux vis imperdables.Connexion des câbles du serveur 39 ? Pour fixer les câbles à l’aide du module de fixation des câbles Le module de fixation des câbles permet de fixer les câbles et d’assurer le bon acheminement des différents câbles. 1. Retirez le couvercle du module de fixation des câbles. Le couvercle du module de fixation des câbles est fixé à l’aide de deux vis cruciformes n° 2. 2. Placez les câbles du système dans les logements prévus à cet effet dans le module de fixation des câbles. 3. Installez le couvercle du module de fixation des câbles. Le couvercle est fixé à l’aide de deux vis cruciformes n° 2.40 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour connecter le câble SER MGT Le port de gestion série du processeur de service est étiqueté SER MGT. Pour connaître l’emplacement des connecteurs, reportez-vous à la section « Connecteurs et ports du panneau arrière », page 34. ? Connectez le port SER MGT du processeur de service au périphérique terminal au moyen d’un câble de catégorie 5. Utilisez ce port pour la gestion initiale du serveur. Ce port est requis pour activer le port NET MGT, comme détaillé à la section « Mise sous tension initiale du serveur », page 43. Lors de la connexion d’un câble DB-9 ou DB-25, servez-vous d’un adaptateur pour effectuer les croisements relatifs à chaque connecteur. Remarque – Le port de gestion série du processeur de service est exclusivement réservé à la gestion du serveur. Il s’agit de la connexion par défaut entre le processeur de service et un terminal ou un ordinateur. Attention – Ne raccordez pas de modem au port de gestion série du processeur de service. ? Pour connecter le câble NET MGT ? Connectez le port de gestion réseau du processeur de service au commutateur ou le hub du réseau au moyen d’un câble de catégorie 5. Pour connaître l’emplacement des connecteurs, reportez-vous à la section « Connecteurs et ports du panneau arrière », page 34. Le port de gestion réseau du processeur de service est étiqueté NET MGT. Ce port n’est pas opérationnel tant que vous ne configurez pas les paramètres réseau (au moyen du port de gestion série), comme décrit à la section « Pour se connecter au processeur de service via le port SER MGT », page 50. Si vous avez accès à un serveur DHCP du réseau, vous pouvez observer que le processeur de service obtient une adresse IP car le client DHCP est activé par défaut.Connexion des câbles du serveur 41 Remarque – Le port NET MGT est configuré par défaut afin de récupérer les paramètres réseau via DHCP et d’autoriser les connexions à l’aide du shell sécurisé (SSH). Il peut s’avérer nécessaire de modifier ces paramètres pour votre réseau. Vous trouverez des instructions à la section « Mise sous tension initiale du serveur », page 43. ? Pour connecter les câbles réseau Ethernet Le serveur est équipé de quatre connecteurs réseau étiquetés NET0, NET1, NET2 et NET3. Ces connecteurs sont de type Gigabit Ethernet RJ-45. Pour connaître l’emplacement des connecteurs, reportez-vous à la section « Connecteurs et ports du panneau arrière », page 34. Remarque – La fonction de gestion sideband d’ILOM vous permet d’accéder au SP à partir de l’un de ces ports Ethernet. Pour des instructions, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. Remarque – Si une carte 10 GBit Ethernet (XAUI) est installée dans le système, le port Ethernet correspondant est désactivé. Par exemple, si une carte XAUI est installée dans l’emplacement XAUI0, le port NET0 est désactivé. Remarque – Des informations plus détaillées sur le port Ethernet NET0 peuvent être disponibles dans une notice d’information sur site (FIN) ou SunAlert. Contactez votre représentant local pour des informations plus détaillées. 1. Utilisez un câble de catégorie 5 (ou supérieure) pour connecter le commutateur ou hub réseau au port Ethernet 0 (NET0) situé à l’arrière du châssis. 2. Connectez le commutateur ou hub réseau aux ports Ethernet restants (NET1, NET2 et NET3), selon les besoins, au moyen de câbles de catégorie 5 (ou supérieure).42 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour connecter d’autres câbles de données ? Si le serveur est configuré pour utiliser d’autres composants d’E/S, connectez les câbles externes au serveur. Pour obtenir des instructions spécifiques, consultez la documentation de ces périphériques. ? Pour préparer les cordons d’alimentation Attention – Terminez les procédures matérielles de ce chapitre, mais ne raccordez pas encore les câbles d’alimentation CA au secteur. La mise sous tension initiale du serveur nécessite une préparation et des procédures spéciales. Si, par exemple, vous n’avez pas préparé d’écran avant de raccorder le câble d’alimentation CA, vous risquez de ne pas voir les éventuels messages initiaux générés par le système. Attention – Le serveur passe en mode veille et le processeur de service s’initialise dès que le câble d’alimentation en CA est connecté à la source d’alimentation. ? Lisez la section « Présentation des tâches de mise sous tension », page 44 pour les instructions de connexion du serveur au courant CA.43 Mise sous tension initiale du serveur Les rubriques qui suivent présentent les instructions d’initialisation du serveur et d’activation du port de gestion réseau du processeur de service. ¦ « Présentation des tâches de mise sous tension », page 44 ¦ « Présentation de la console système Oracle ILOM », page 44 ¦ « Pour connecter un terminal ou un émulateur au port SER MGT », page 45 ¦ « Pour mettre le serveur sous tension pour la première fois », page 46 ¦ « Paramètres de configuration du SE Oracle Solaris », page 48 ¦ « Assignation d’une adresse IP statique au processeur de service », page 50 ¦ « Initialisation du système d’exploitation Oracle Solaris », page 55 Informations connexes ¦ « Préparation de l’installation », page 1 ¦ « Connexion des câbles du serveur », page 3144 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Présentation des tâches de mise sous tension Les rubriques qui suivent présentent une vue d’ensemble et des instructions relatives à la mise sous tension initiale du serveur. Informations connexes ¦ « Préparation de l’installation », page 1 Présentation de la console système Oracle ILOM Lorsque vous mettez le serveur sous tension, le processus d’initialisation commence sous le contrôle de la console système Oracle ILOM (Integrated Lights Out Manager). Celle-ci affiche les messages d’erreur et de statut générés par les tests basés sur le microprogramme pendant le démarrage du serveur. Par défaut, les messages de la console système ILOM sont dirigés vers le port NET MGT. Le port NET MGT utilise le protocole DHCP et permet d’établir des connexions via le shell sécurisé (SSH). Étape Description Liens 1 Connectez un périphérique terminal série ou un serveur de terminal au port SER MGT. « Pour connecter un terminal ou un émulateur au port SER MGT », page 45 2 Mettez le serveur sous tension pour la première fois. « Pour mettre le serveur sous tension pour la première fois », page 46 3 Définissez les paramètres de configuration du SE Oracle Solaris. « Paramètres de configuration du SE Oracle Solaris », page 48 4 (facultatif) Configurez le port NET MGT de manière à utiliser une adresse IP statique. « Assignation d’une adresse IP statique au processeur de service », page 50 5 Initialisez le SE Oracle Solaris. « Initialisation du système d’exploitation Oracle Solaris », page 55Mise sous tension initiale du serveur 45 Remarque – Si vous ne parvenez pas à utiliser le protocole DHCP sur le réseau, connectez-vous au processeur de service ILOM à l’aide du port de gestion série afin de configurer le port de gestion réseau pour votre réseau. Reportez-vous à la section « Pour affecter une adresse IP statique au port NET MGT », page 52. Informations connexes ¦ « Assignation d’une adresse IP statique au processeur de service », page 50 ? Pour connecter un terminal ou un émulateur au port SER MGT ? Connectez un terminal ou un émulateur de terminal (PC ou station de travail) au port de gestion série du processeur de service. Configurez ce terminal ou cet émulateur de terminal avec les paramètres suivants : ¦ 9 600 bauds ¦ 8 bits ¦ Pas de parité ¦ 1 bit d’arrêt ¦ Pas de protocole de transfert Une configuration de type inverseur est requise, signifiant que les signaux de transmission et de réception sont inversés (croisés) pour les communications d’équipements terminaux de traitement de données (ETTD à ETTD). Vous pouvez utiliser les adaptateurs croisés RJ-45 fournis avec un câble RJ-45 standard pour réaliser la configuration inverseur. Remarque – Si, lorsque vous mettez pour la première fois le serveur sous tension, aucun terminal ou émulateur de terminal (PC ou station de travail) n’est connecté au port de gestion série du processeur de service, vous ne verrez pas les messages du système.46 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour mettre le serveur sous tension pour la première fois Effectuez les tâches suivantes : ¦ Vérifiez l’installation du serveur dans son rack. Reportez-vous à la section « Installation du serveur », page 15. ¦ Fixez l’ensemble de gestion des câbles. Reportez-vous à la section « Pour installer le module de fixation des câbles », page 37. ¦ Connectez un terminal ou un émulateur de terminal au port SER MGT. Reportez-vous à la section « Pour connecter un terminal ou un émulateur au port SER MGT », page 45. 1. (Facultatif) Reliez au moyen d’un câble Ethernet le port Net MGT du serveur au réseau avec lequel les futures connexions au SP et à l’hôte seront établies. Reportez-vous à la section « Pour connecter le câble NET MGT », page 40. Une fois la configuration initiale du serveur effectuée via le port SER MGT, la communication avec le SP et l’hôte est généralement assurée par le biais de cette interface Ethernet. 2. Reliez au moyen d’un câble Ethernet l’un des ports NET du serveur (voir « Connecteurs et ports du panneau arrière », page 34) au réseau avec lequel le serveur communiquera. 3. Branchez les cordons d’alimentation sur les alimentations et une source de courant. Remarque – Deux branchements électriques seulement sont nécessaires. Utilisez quatre branchements électriques et deux circuits distincts pour la redondance. Le processeur de service fonctionne sur la tension de veille de 3,3 V. Dès que l’alimentation CA est reliée au serveur, le processeur de service est mis sous tension, exécute des diagnostics et initialise le microprogramme ILOM. Après quelques minutes, l’invite de connexion du SP s’affiche sur le périphérique terminal. L’hôte n’est pas encore initialisé ou mis sous tension.Mise sous tension initiale du serveur 47 4. Sur le périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM. Vous trouverez des informations supplémentaires sur le SP (modi?cation du mot de passe, con?guration des paramètres réseau, etc.) dans la documentation en ligne. 5. Ouvrez un deuxième périphérique terminal, connectez-vous au SP en tant qu’utilisateur root et en utilisant le mot de passe changeme. Après un court délai, l’invite du SP s’affiche (->). À ce stade, de nombreuses commandes sont à votre disposition à partir de l’interface ILOM. 6. Dans le premier périphérique de terminal, redirigez la sortie de l’hôte vers le périphérique terminal série : Une fois la console du SP démarrée, l’initialisation du serveur prend une vingtaine de minutes. Ce périphérique terminal affiche tous les messages de la console SP pendant la première initialisation. 7. Dans le deuxième périphérique terminal, mettez le serveur sous tension : Ce périphérique terminal affiche tous les messages de la console système pendant la première initialisation. XXXXXXXXXXXXXXXX login: root Password: changeme . . . -> -> start /SP/console Are you sure you want to start /SP/console (y/n)? y Serial console started. To stop, type #. . . . -> start /SYS Are you sure you want to start /SYS (y/n)? y48 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 8. Lorsque vous y êtes invité, suivez les instructions de configuration du système d’exploitation Oracle Solaris sur l’hôte et spécifiez les informations de configuration suivantes. Vous êtes invité à confirmer la configuration à plusieurs reprises, ce qui vous permet de confirmer ou de modifier des paramètres. Si vous ne savez pas comment répondre à une question donnée, acceptez la valeur par défaut et, le cas échéant, modifiez-la lorsque le SE Oracle Solaris est exécuté. Le Paramètre, page 48 indique les paramètres du SE Oracle Solaris que vous devez fournir pendant la configuration initiale. 9. Connectez-vous au serveur et explorez ses fonctions. Il comprend de nombreuses commandes vous permettant de vérifier les fonctionnalités du serveur. La liste suivante en présente quelques unes : ¦ showrev : affiche le nom d’hôte et des informations sur l’architecture du serveur. Utilisez l’option -a avec cette commande pour afficher les patchs installés. ¦ psrinfo : affiche des informations sur le nombre et le statut des processeurs et noyaux de l’hôte. ¦ prtdiag : affiche des informations de diagnostic et sur la configuration serveur. Pour plus d’informations, consultez les pages de manuel et la documentation du SE Oracle Solaris. Paramètres de configuration du SE Oracle Solaris Cette rubrique décrit les paramètres de configuration que vous devez fournir pendant la configuration initiale du SE Oracle Solaris. Paramètre Description Language (Langue) Sélectionnez un numéro dans la liste des langues affichée. Locale (Environnement linguistique) Sélectionnez un numéro dans la liste des environnements linguistiques affichée. Terminal Type (Type de terminal) Sélectionnez un type de terminal correspondant à votre périphérique terminal. Network? (Réseau ?) Sélectionnez Yes (Oui).Mise sous tension initiale du serveur 49 Informations connexes ¦ « Assignation d’une adresse IP statique au processeur de service », page 50 ¦ « Pour initialiser le système d’exploitation Oracle Solaris », page 56 ¦ « Initialisation du système d’exploitation Oracle Solaris », page 55 Multiple Network Interfaces (Interfaces réseau multiples) Sélectionnez les interfaces réseau que vous projetez de configurer. Si vous avez des doutes, sélectionnez la première de la liste. DHCP? Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Host Name (Nom d’hôte) Saisissez le nom d’hôte du serveur. IP Address (Adresse IP) Tapez l’adresse IP de l’interface Ethernet. Subnet? (Sous-réseau ?) Sélectionnez Yes (Oui) ou No (Non) en fonction de l’environnement réseau. Subnet Netmask (Masque de sous-réseau) (Avec une réponse affirmative pour le sous-réseau) Indiquez le masque réseau du sous-réseau de votre environnement réseau. IPv6? Indiquez si vous utilisez ou non le protocole IPv6. Si vous avez des doutes, sélectionnez No (Non) afin de configurer l’interface Ethernet pour le protocole IPv4. Security Policy (Stratégie de sécurité) Sélectionnez la sécurité UNIX standard (No) ou la sécurité Kerberos (Yes). Si vous avez des doutes, sélectionnez No. Confirm (Confirmer) Vérifiez les informations affichées à l’écran et modifiez-les si nécessaire. Sinon, continuez. Name Service (Service de noms) Sélectionnez le service de noms en fonction de l’environnement réseau. Remarque : si vous sélectionnez un service de noms autre que None (Aucun), vous êtes invité à spécifier des informations de configuration de service de noms supplémentaires. NFSv4 Domain Name (Nom du domaine NFSv4) Sélectionnez le type de configuration du nom de domaine en fonction de votre environnement. En cas de doute, sélectionnez Use the NFSv4 domain derived by the server (Utiliser le domaine NFSv4 dérivé par le serveur). Time Zone (Continent) Sélectionnez votre continent. Time Zone (Country or Region) Sélectionnez votre pays ou zone géographique. Time Zone Sélectionnez le fuseau horaire. Date and Time (Date et heure) Acceptez les date et heure définies par défaut ou modifiez-les. root Password (Mot de passe root) Tapez deux fois le mot de passe root. Ce mot de passe s’applique au compte superutilisateur du SE Oracle Solaris exécuté sur ce serveur. Il ne s’agit pas du mot de passe du SP.50 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Assignation d’une adresse IP statique au processeur de service Si le réseau n’utilise pas le protocole DHCP, le port de gestion réseau demeure non opérationnel tant que vous ne configurez pas les paramètres réseau pour le processeur de service. Cette rubrique comprend les tâches suivantes : ¦ « Pour se connecter au processeur de service via le port SER MGT », page 50 ¦ « Pour affecter une adresse IP statique au port NET MGT », page 52 Informations connexes ¦ « Présentation des tâches de mise sous tension », page 44 ¦ « Présentation de la console système Oracle ILOM », page 44 ¦ « Paramètres de configuration du SE Oracle Solaris », page 48 ? Pour se connecter au processeur de service via le port SER MGT Une fois le processeur de service initialisé, accédez à l’interface de ligne de commande ILOM pour configurer et gérer le serveur. L’invite de la CLI ILOM ( >) s’affiche la première fois que le processeur de service est initialisé. La configuration par défaut fournit un compte utilisateur root de CLI ILOM. Le mot de passe de l’utilisateur root par défaut est changeme. Changez ce mot de passe à l’aide de la commande password de l’interface de ligne de commande ILOM. 1. Si le serveur est mis sous tension pour la première fois, utilisez la commande password pour modifier le mot de passe root. ... Starting OpenBSD Secure Shell server: sshd. Starting Servicetags listener: stlistener. Starting FRU update program: frutool. hostname login: root Password: changeme Copyright 2007 Sun Microsystems, Inc. All rights reserved.Mise sous tension initiale du serveur 51 Remarque – Une fois le mot de passe root défini, aux réinitialisations suivantes, l’invite de connexion de l’interface de ligne de commande ILOM s’affiche. 2. Tapez root en tant que nom de connexion, puis votre mot de passe. Use is subject to license terms. ... Federal Acquisitions: Commercial Software -- Government Users Subject to Standard License Terms and Conditions. ... Warning: password is set to factory default. -> set /HOST/users/root password Enter new password: ******** Enter new password again: ******** -> ... hostname login: root Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 2.0.0.0 Copyright 2007 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms. ->52 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour affecter une adresse IP statique au port NET MGT Effectuez uniquement cette procédure dans les cas suivants : ¦ Vous ne parvenez pas à utiliser le protocole DHCP sur le réseau. ¦ Vous devez modifier les paramètres du port NET MGT. Dans cette procédure, vous vous connectez au port SER MGT afin de reconfigurer manuellement le port NET MGT de sorte qu’il utilise une adresse IP statique. Remarque – Pour plus d’informations sur la configuration d’ILOM, consultez le Serveurs de la série SPARC T3 Guide d’administration. 1. Définissez ces paramètres réseau selon votre configuration réseau spécifique : Configurez ces paramètres à l’aide de la commande set. Par exemple : 2. Configurez le processeur de service à l’aide des informations fournies par l’administrateur réseau. Paramètre Description /SP/network state Indique si le processeur de service est connecté ou non au réseau. /SP/network pendingipaddress Adresse IP du processeur de service. /SP/network pendingipgateway Adresse IP de la passerelle du sous-réseau. /SP/network pendingipnetmask Masque de réseau utilisé par le sous-réseau du processeur de service. /SP/network pindingipdiscovery Indique si le processeur de service utilise DHCP ou l’assignation d’adresse IP statique. /SP/network commitpending Force le processeur de service à utiliser les paramètres en attente. -> set /host/network pendingaddress=xxx.xxx.xxx.xxx Set ‘pendingaddress’ to ‘xxx.xxx.xxx.xxx’ Paramètre Description dhcp Configurez la connexion réseau à l’aide d’une configuration IP créée de manière dynamique. static Configurez la connexion réseau à l’aide d’une configuration IP statique.Mise sous tension initiale du serveur 53 a. Si vous optez pour une adresse IP créée de manière dynamique (en utilisant le protocole DHCP pour récupérer les paramètres réseau), définissez pendingipdiscovery sur la valeur dhcp. b. Si vous choisissez de procéder à une configuration IP statique, définissez les paramètres pendingipdiscovery, pendingipaddress, pendingipgateway et pendingipnetmask de la manière suivante. i. Définissez le processeur de service pour qu’il accepte une adresse IP statique. ii. Définissez l’adresse IP du processeur de service. iii. Définissez l’adresse IP de la passerelle du processeur de service. iv. Définissez le masque de réseau du processeur de service. Cet exemple utilise 255.255.255.0 pour définir le masque de réseau. Le sous-réseau de votre environnement réseau peut exiger un masque de réseau différent. Utilisez un numéro de masque de réseau approprié à votre environnement. -> set /SP/network pendingipdiscovery=dhcp Set 'pendingipdiscovery' to 'dhcp' -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0'54 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 3. Utilisez la commande show /SP/network pour vérifier que les paramètres ont été configurés correctement. L’exemple suivant indique les paramètres qui ont été configurés pour convertir un processeur de services d’une configuration dhcp en configuration statique. Remarque – Une fois les paramètres de configuration définis, vous devez exécuter la commande set /SP/network commitpending=true pour que les nouvelles valeurs soient appliquées. 4. Validez les modifications apportées aux paramètres réseau du processeur de service. Remarque – Vous pouvez réexécuter la commande show /SP/network (après la commande set /SP/network commitpending=true) afin de vérifier que les paramètres ont bien été mis à jour. -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'Mise sous tension initiale du serveur 55 Initialisation du système d’exploitation Oracle Solaris Le SE Oracle Solaris est préinstallé sur les serveurs sur le disque dans l’emplacement 0. Le système d’exploitation Oracle Solaris n’est pas configuré (plus précisément, la commande sys-unconfig a été exécutée en usine). Si vous initialisez le serveur à partir de ce disque, vous serez invité à configurer le SE Oracle Solaris pour votre environnement. Après la mise sous tension initiale du serveur, vous pouvez utiliser le logiciel SunVTS d’Oracle pour vérifier le fonctionnement et les performances des composants installés, de même que les connexions réseau correspondantes. Pour plus d’informations à ce sujet, consultez la documentation de SunVTS (http://www.sun.com/documentation). Pour plus d’informations sur la configuration du serveur et l’utilisation du processeur de service ILOM, reportez-vous au Guide d’administration des serveurs de la série SPARC T3. Pour plus d’informations sur l’ajout de composants optionnels, consultez le SPARC T3-4 Server Service Manual. Les rubriques ci-dessous décrivent les tâches suivantes : ¦ « Pour initialiser le système d’exploitation Oracle Solaris », page 56 ¦ « Pour éviter d’initialiser le système d’exploitation Oracle Solaris au démarrage », page 57 ¦ « Pour réinitialiser le serveur », page 57 ¦ « Pour mettre le serveur progressivement sous tension », page 57 Informations connexes ¦ « Paramètres de configuration du SE Oracle Solaris », page 4856 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 ? Pour initialiser le système d’exploitation Oracle Solaris 1. À l’invite ok, lancez l’initialisation à partir du disque contenant le SE Oracle Solaris. ¦ Si vous savez à partir de quel disque effectuer l’initialisation, sautez cette étape et passez à l’étape 2. ¦ Si vous devez déterminer le disque dont il s’agit, tapez la commande show-disks à l’invite ok pour afficher les chemins des disques configurés. Par exemple : 2. Tapez la commande boot à l’invite ok. Utilisez la valeur de l’étape 1 pour construire la commande boot. Vous devez ajouter la cible au chemin du disque. Dans l’exemple suivant, le serveur est initialisé à partir du disque 0 (zéro). ok show-disks a) /pci@0/pci@0/pci@2/scsi@0/disk0 b) /pci@0/pci@0/pci@1/pci@0/pci@1/pci@0/usb@0,2/storage@2/disk q) NO SELECTION Enter Selection, q to quit: q ok ok boot disk0 Boot device: /pci@0/pci@0/pci@2/scsi@0/disk@0 File and args: SunOS Release 5.10 Version Generic_127127-03 64-bit Copyright 1983-2010 Oracle Corp. All rights reserved. Use is subject to license terms. Hostname: hostname NIS domain name is x.x.x.x hostname console login:Mise sous tension initiale du serveur 57 ? Pour éviter d’initialiser le système d’exploitation Oracle Solaris au démarrage Sur le disque dur HDD0, le SE Oracle Solaris est préinstallé. ? Si vous préférez ne pas démarrer le SE préinstallé, définissez le paramètre auto-boot? de l’Open Boot PROM sur false. Par exemple : ? Pour réinitialiser le serveur ? S’il est nécessaire de réinitialiser le serveur, utilisez la commande shutdown -g0 -i6 -y. Pour simplement réinitialiser le serveur, il est inutile de le mettre hors tension puis sous tension. ? Pour mettre le serveur progressivement sous tension Si une simple réinitialisation n’élimine pas un problème système, vous pouvez mettre le serveur hors puis sous tension en suivant cette procédure. 1. Arrêtez le SE Oracle Solaris. À l’invite du SE Oracle Solaris, tapez la commande shutdown -g0 -i0 -y. Saisissez ensuite h lorsque vous êtes invité à arrêter le SE Oracle Solaris et à revenir à l’invite ok. -> set /HOST/bootmode script="setenv auto-boot? false" # shutdown -g0 -i6 -y # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs40-58 syslogd: going down on signal 15 svc.startd: The system is down. syncing file systems... done Program terminated r)eboot, o)k prompt, h)alt?58 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 2. Basculez de l’invite de la console du système à celle de la console du processeur de service en émettant la séquence d’échappement (par défaut, #.). 3. Dans l’interface de ligne de commande (CLI) d’ILOM, tapez la commande stop /SYS pour procéder à l’arrêt progressif du serveur. Remarque – Pour procéder à un arrêt immédiat brutal, utilisez les commandes stop -force -script /SYS ou stop -script /SYS. Ces commandes arrêtent tous les processus en cours sur le champ. Assurez-vous que toutes les données sont enregistrées avant de les exécuter. 4. Tapez la commande start /SYS. Remarque – Pour forcer une séquence de mise sous tension, utilisez la commande start -script /SYS. 5. Reconnectez-vous à la console système en utilisant la commande start /HOST/console. La console du système affiche différents messages, suivis de l’invite ok. ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.59 Identification des ports du serveur Ces rubriques présentent des informations de référence sur les ports du panneau arrière et les affectations des broches. ¦ « Brochage des ports USB », page 60 ¦ « Brochage des ports SER MGT », page 61 ¦ « Brochage des ports NET MGT », page 62 ¦ « Brochage des ports Gigabit Ethernet », page 63 ¦ « Brochage des ports QSFP », page 64 ¦ « Brochage des ports VGA », page 64 Informations connexes ¦ « Présentation du serveur », page 360 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Brochage des ports USB Deux ports USB (Universal Serial Bus) sont situés sur le panneau arrière. Deux ports USB supplémentaires sont situés sur le module principal et sont accessibles à partir du panneau avant. Broche Description du signal Broche Description du signal A1 +5 V (avec fusible) B1 +5 V (avec fusible) A2 USB0/1- B2 USB2/3- A3 USB0/1+ B3 USB2/3+ A4 Terre B4 Terre 1 2 3 4 1 2 3 4 A BIdentification des ports du serveur 61 Brochage des ports SER MGT Le port SER MGT est un connecteur RJ-45 situé sur le panneau arrière. Il s’agit de la connexion par défaut à la console système. Un autre port SER MGT est situé sur le module principal et est accessible à partir du panneau avant. TABLEAU : Signaux du connecteur de gestion série Broche Description du signal Broche Description du signal 1 Requête d’envoi 5 Terre 2 Terminal de données prêt 6 Réception de données 3 Transmission de données 7 Jeu de données prêt 4 Terre 8 Prêt à émettre62 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Brochage des ports NET MGT Le port NET MGT est un connecteur RJ-45 situé sur le panneau arrière du système. Ce port doit être configuré avant toute utilisation. Broche Description du signal Broche Description du signal 1 Transmission de données + 5 Terminaison de mode courant 2 Transmission de données - 6 Réception de données - 3 Réception de données + 7 Terminaison de mode courant 4 Terminaison de mode courant 8 Terminaison de mode courantIdentification des ports du serveur 63 Brochage des ports Gigabit Ethernet Quatre connecteurs RJ-45 Gigabit Ethernet (NET0, NET1, NET2 et NET3) sont situés sur le panneau arrière du système. Les interface Ethernet fonctionnent aux vitesses de 10 Mbit/s, 100 Mbit/s et 1000 Mbit/s. Broche Description du signal Broche Description du signal 1 Transmission/Réception de données 0 + 5 Transmission/Réception de données 2 – 2 Transmission/Réception de données 0 – 6 Transmission/Réception de données 1 – 3 Transmission/Réception de données 1 + 7 Transmission/Réception de données 3 + 4 Transmission/Réception de données 2 + 8 Transmission/Réception de données 3 –64 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Brochage des ports QSFP Le connecteur QSFP est une connexion de port InfiniBand unique. Brochage des ports VGA Broche Signal Broche Signal Broche Signal Broche Signal 1 GND 11 SCL 21 RX2n 31 Réservé 2 TX2n 12 SDA 22 RX2p 32 GND 3 TX2p 13 GND 23 GND 33 TX3p 4 GND 14 RX3p 24 RX4n 34 TX3n 5 TX4n 15 RX3n 25 RX4p 35 GND 6 TX4p 16 GND 26 GND 36 TX1p 7 GND 17 RX1p 27 ModPrsL 37 TX1n 8 ModSeIL 18 RX1n 28 IntL 38 GND 9 LPMode_Reset 19 GND 29 VccTx 10 VccRx 20 GND 30 Vcc1 Broche Description du signal Broche Description du signal 1 Vidéo rouge 9 [TOUCHE] 2 Vidéo vert 10 Synchronisation terre 3 Vidéo bleu 11 ID de moniteur - Bit 1 4 ID de moniteur - Bit 2 12 ID de moniteur - Bit 0 5 Terre 13 Synchronisation horizontale 6 Terre rouge 14 Synchronisation verticale 7 Terre vert 15 N/C (réservé) 8 Terre bleu65 Index Symboles #., séquence d’échappement de la console système, 58 A Adaptateurs pour câbles série, 40 admin, mot de passe de connexion, 50 Alimentation en CA initiale, 44 Attaches Kit de montage en rack, 18 Module de ?xation des câbles., 37 Support d’expédition, 27 B Bit d’arrêt, 45 Bit, paramètre du terminal série, 45 boot Commande boot d’OpenBoot PROM, 56 Initialisation du système, 43 Brochage Connecteur QSFP, 64 Port Gigabit Ethernet, 63 Port NET MGT, 62 Port VGA, 64 Ports USB, 60 C Câble Adaptateurs pour câbles de données série, 40 Commande set /SP/network, 53 show /SP/network, 54 show-disks, 56 Compatibilité des racks, 16 Connecteurs Panneau arrière, 34 Panneau avant, 33 Connecteurs, ports et DEL (illustration), 34 Connexion au processeur de service Utilisation du port de gestion série, 50 Connexions de câbles minimales, 31 Console système, séquence d’échappement #., 58 console, commande, 58 D DEL, ports et connecteurs (illustration), 34 Diagnostics, exécution, 46 E Émissions sonores, 10 Emplacement des ports, connecteurs et DEL (illustration), 34 En?chage à chaud des ports USB, 32 Exemple de chemin d’accès complet au disque, 56 G Gigabit Ethernet, brochage de sports, 63 I Installation, composants optionnels, 14 K Kit d’expédition, contenu, 10 Kit de montage en rack, contenu, 16 M Messages, limites de conservation, 32 Mise sous tension Initiale, 4466 Guide d’installation du serveur SPARC T3-4 • Décembre 2010 Mise sous tension progressive du système, 57 Mode veille, CA branché, 32 Modem non adapté au port de gestion série SER MGT, 40 Module de ?xation des câbles, attaches, 37 Montage en rack, 15 Attaches, 18 N NET MGT, brochage des ports, 62 O Oracle Solaris (SE) Initialisation, 56 Initialisation au démarrage bloquée, 57 P Panneau arrière, connecteurs, 34 Panneau avant, connecteurs, 33 Parité du terminal série, aucune, 45 password, commande, 50 Port de gestion série, 50 Ports, connecteurs et DEL (illustration), 34 poweroff, commande, 58 Processeur de service Accès via un port de gestion série, 50 Connexion via le port de gestion série, 50 Mise sous tension initiale, 46 set, commande, 52 Protocole de transfert du terminal série, aucun, 45 Q QSFP, brochage du connecteur, 64 R Racks, compatibles, 16 Réinitialisation du système, 57 reset, réinitialisation du système avec uadmin, 57 RJ-45, câble, 32 S Séquence d’échappement de la console système (#.), 58 set, commande, 52 show /SP/network, commande, 54 show-disks, commande, 56 Spéci?cations environnementales, 9 Support d’expédition Arrière, installation, 29 Avant, installation, 28 Avant, retrait à la destination, 29 Kit, contenu, 25 Support d’expédition, attaches, 27 T Tension de veille de 3,3 V, 46 Terminal série, paramètres, 45 Terminologie, assemblage de rails coulissants, 16 U uadmin, commande, 57 USB, brochage des ports, 60 V Veille, mode, 42 VGA, brochage des ports, 64 Vitesse de transmission du terminal série en bauds, 45 SPARC T3-4 Server Installation Guide Part No. E23514-01 July 2011, Revision APlease Recycle Copyright © 2010, 2011, Oracle and/or its af?liates. All rights reserved. FUJITSU LIMITED provided technical input and review on portions of this material. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010,2011, Oracle et/ou ses af?liés. Tous droits réservés. Entrée et revue tecnical fournies par FUJITSU LIMITED sur des parties de ce matériel. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation et FUJITSU LIMITED ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065 et FUJITSU LIMITED, 1-1, Kamikodanaka 4-chome, Nakahara-ku, Kawasaki-shi, Kanagawa-ken 211-8588, Japan. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. Fujitsu et le logo Fujitsu sont des marques déposées de Fujitsu Limited. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés et FUJITSU LIMITED déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés et FUJITSU LIMITED ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Preface vii Preparing for Installation 1 Installation Task Overview 2 Server Overview 3 Confirming Server Specifications 6 Physical Specifications 6 Electrical Specifications 7 Input Power Information 8 Environmental Specifications 9 Acoustic Noise Emissions 10 Inventory List 10 Server Handling Precautions 12 ESD Precautions 12 Tools Needed for Installation 13 Optional Component Installation 13 Installing the Server 15 Rack Compatibility 16 Rackmount Kit Contents 16 ? Determine Correct Rackmount Hardware 18 ? Mark the Rackmounting Location 18 ? Install the Rackmount Hardware 19iv SPARC T3-4 Server Installation Guide • July 2011 ? Install the Server 23 Installing and Using the Shipping Bracket Assembly (Optional) 25 Shipping Bracket Kit Contents 25 ? Determine Correct Shipping Bracket Fasteners 27 ? Install the Front Shipping Bracket 27 ? Install the Rear Shipping Bracket 28 ? Remove the Front Shipping Bracket 29 Connecting the Server Cables 31 Cabling Requirements 31 Front Panel Connectors and Ports 33 Rear Panel Connectors and Ports 34 Installing and Using the CMA (Optional) 35 About the CMA 36 ? Determine Correct CMA Hardware 36 ? Install the CMA 37 ? Secure Cables Using the CMA 38 ? Connect the SER MGT Cable 39 ? Connect the NET MGT Cable 40 ? Connect the Ethernet Network Cables 41 ? Connect Other Data Cables 41 ? Prepare Power Cords 41 Powering On the Server for the First Time 43 Power On Task Overview 44 Oracle ILOM System Console Overview 44 ? Connect a Terminal or Emulator to the SER MGT Port 45 ? Power On the Server for the First Time 46 Oracle Solaris OS Configuration Parameters 48Contents v Assigning a Static IP Address to the Service Processor 49 ? Log In to the Service Processor Using the SER MGT Port 50 ? Assign a Static IP to the NET MGT Port 51 Booting the Oracle Solaris Operating System 54 ? Boot the Oracle Solaris Operating System 55 ? Avoid Booting the Oracle Solaris Operating System at Start Up 56 ? Reset the Server 56 ? Power Cycle the Server 56 Identifying the Server Ports 59 USB Port Pinouts 59 SER MGT Port Pinouts 60 NET MGT Port Pinouts 61 Gigabit Ethernet Port Pinouts 61 QSFP Port Pinouts 62 VGA Port Pinouts 63 Index 65vi SPARC T3-4 Server Installation Guide • July 2011vii Preface This installation guide provides instructions, background information, and reference material to help you install Oracle’s SPARC T3-4 server. These installation instructions assume that a system administrator is experienced with the Oracle Solaris 10 Operating System. Note – All internal components except hard drives must be installed by qualified service technicians only. ¦ “UNIX Commands” on page vii ¦ “Shell Prompts” on page viii ¦ “Related Documentation” on page viii ¦ “Documentation, Support, and Training” on page ix UNIX Commands This document might not contain information on basic UNIX commands and procedures such as shutting down the system, booting the system, and configuring devices. Refer to the following for this information: ¦ Software documentation that you received with your system ¦ Oracle Solaris Operating System documentation, which is at (http://www.oracle.com/technetwork/indexes/documentation)viii SPARC T3-4 Server Installation Guide • July 2011 Shell Prompts Related Documentation (http://download.oracle.com/docs/cd/E19417-01) SPARC T3-4 server documentation: Shell Prompt C shell machine-name% C shell superuser machine-name# Bourne shell and Korn shell $ Bourne shell and Korn shell superuser # Application Title Format Location Late-breaking information SPARC T3-4 Server Product Notes PDF Online Getting started SPARC T3-4 Server Getting Started Guide Printed Ships with system Installation SPARC T3-4 Server Installation Guide PDF HTML Online Administration SPARC T3 Series Servers Administration Guide PDF HTML Online Service SPARC T3-4 Server Service Manual PDF HTML Online Safety SPARC T3-4 Server Safety and Compliance Manual PDF OnlinePreface ix Oracle Integrated Lights Out Manager 3.0 documentation Documentation, Support, and Training These web sites provide additional resources: ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Application Title Location Late-breaking news and issues Oracle Integrated Lights Out Manager (ILOM) 3.0 Features Updates and Release Notes Online Installation and configuration Oracle Integrated Lights Out Manager (ILOM) 3.0 Getting Started Guide Online Conceptual information Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide Online Browser interface procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide Online CLI procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide Online SNMP and IPMI procedures Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide: SNMP, IPMI, WS-Man, CIM Onlinex SPARC T3-4 Server Installation Guide • July 20111 Preparing for Installation These topics provide background information needed to install the SPARC T3-4 server. ¦ “Installation Task Overview” on page 2 ¦ “Server Overview” on page 3 ¦ “Confirming Server Specifications” on page 6 ¦ “Inventory List” on page 10 ¦ “Server Handling Precautions” on page 12 ¦ “ESD Precautions” on page 12 ¦ “Tools Needed for Installation” on page 13 ¦ “Optional Component Installation” on page 13 Related Information ¦ “Installing the Server” on page 152 SPARC T3-4 Server Installation Guide • July 2011 Installation Task Overview Related Information ¦ “Server Handling Precautions” on page 12 ¦ “ESD Precautions” on page 12 ¦ “Tools Needed for Installation” on page 13 ¦ “Installing the SPARC T3-4 Server” on page 13 ¦ “Powering On the Server for the First Time” on page 43 Step Description Links 1 Review the SPARC T3-4 Server Product Notes for any late-breaking news about the server. SPARC T3-4 Server Product Notes 2 Review the server specifications and site requirements. “Confirming Server Specifications” on page 6 3 Confirm that you have received all the items you ordered, familiarize yourself with ESD and safety precautions, and assemble the required tools. “Server Handling Precautions” on page 12 “ESD Precautions” on page 12 “Tools Needed for Installation” on page 13 4 Install the server into an equipment cabinet. “Installing the Server” on page 15 5 Attach data and server management cables to the server. “Cabling Requirements” on page 31 “Rear Panel Connectors and Ports” on page 34 “Install the CMA” on page 37 6 Connect power cords to the server, configure the service processor, power on the server for the first time, and set up the operating system. “Powering On the Server for the First Time” on page 43Preparing for Installation 3 Server Overview The SPARC T3-4 is a 5-rack unit (5U) server. FIGURE: SPARC T3-4 Server Component/Function New Characteristics Processor Up to 4x SPARC T3, 1.65 GHz, 16-core chip multiprocessor (CMP) with 8 threads per core. 2x multiprocessor configuration also available. Memory 16x DDR3 DIMM slots; 4GB and 8GB capacity modules.4 SPARC T3-4 Server Installation Guide • July 2011 FIGURE: Front Panel Ports I/O - Expansion 16x PCIe Gen2 card slots. 4x Gigabit Ethernet ports. 4x USB ports. Optional 8x 10-Gigabit Ethernet ports. Hard drive storage 8-disk capable backplane supporting any mix of hard drives and solid state drives. Service processor Modular, pluggable on the motherboard. Figure Legend 1 VGA port 2 USB ports 3 SER MGT port Component/Function New CharacteristicsPreparing for Installation 5 FIGURE: Back Panel Ports Related Information ¦ “Confirming Server Specifications” on page 6 ¦ “Inventory List” on page 10 ¦ “Server Handling Precautions” on page 12 ¦ “Tools Needed for Installation” on page 13 Confirming Server Specifications These topics include server physical, environmental, and electrical specifications. ¦ “Physical Specifications” on page 6 Figure Legend 1 QSFP ports 2 USB ports 3 AC power ports 4 Gigabit Ethernet ports 5 SER MGT port 6 NET MGT port6 SPARC T3-4 Server Installation Guide • July 2011 ¦ “Electrical Specifications” on page 7 ¦ “Input Power Information” on page 8 ¦ “Environmental Specifications” on page 9 ¦ “Acoustic Noise Emissions” on page 10 Related Information ¦ “Server Overview” on page 3 ¦ “Server Handling Precautions” on page 12 ¦ “ESD Precautions” on page 12 ¦ “Optional Component Installation” on page 13 ¦ “Identifying the Server Ports” on page 59 Physical Specifications Related Information ¦ “Electrical Specifications” on page 7 ¦ “Input Power Information” on page 8 ¦ “Environmental Specifications” on page 9 Electrical Specifications The SPARC T3-4 server has four autoranging power supplies. To ensure redundant operation of the power supplies, connect the power cords to at least two separate AC circuits. Description U.S. Metric Width 17.5 in. 445 mm Depth 27.6 in. 700 mm Height 8.62 in. (5U) 219 mm Weight, approximate (without rackmount kit) 175 lb (max.) 79 kg (max.) Minimum service access clearance (front) 36 in. 91 cm Minimum service access clearance (rear) 36 in. 91 cmPreparing for Installation 7 Use these specifications only as a planning guide. For more precise power values, make power measurements on your specific server configuration using your planned workload. Related Information ¦ “Input Power Information” on page 8 ¦ “Environmental Specifications” on page 9 ¦ SPARC T3-4 Server Service Manual Input Power Information The maximum operating current values are based on P/V using the following equation: P / (V * 0.95) = A Description Specification General Specifications Operating input voltage range 200 to 240 VAC, 50 to 60 Hz (VAC tolerance +/- 10%) Maximum operating input current at 200 VAC 12.6 A Maximum operating input power at 200 VAC 2400 W Maximum heat dissipation 7030 BTU/hour or 7417 kJ/hour Maximum standby power 55 W Maximum Server Configuration Specifications Under Nominal Temperature and Voltage Conditions 4 CMP, 1.65 GHz, 64 cores, 64 x 8-GByte DDR3 DIMMs, 8 HDDs, 16 I/O cards Idle AC input power 1500 W Peak AC input power running SpecJBB 2300 W Minimum Server Configuration Specifications Under Nominal Temperature and Voltage Conditions 2 CMP, 1.65 GHz, 32 cores, 16 x 4-GByte DDR3 DIMMs, no HDDs, no I/O cards Idle AC input power 1250 W Peak AC input power running SpecJBB 1450 W8 SPARC T3-4 Server Installation Guide • July 2011 Use this formula to calculate server maximum operating current at the input voltage at your facility. For example: 1060W / (220V * 0.95) = 5.1A Related Information ¦ “Electrical Specifications” on page 7‘Preparing for Installation 9 Environmental Specifications Related Information ¦ “Physical Specifications” on page 6 ¦ “Input Power Information” on page 8 Specification Operating Nonoperating Temperature • Sea level to 2953 ft. (900m): 41°F to 95°F (5°C to 35°C) • Above 2953 ft. (900m): Decrease the maximum allowable temperature by 1.6°F/1000 ft (1°C/300m) IEC 60068-2-1 Test Ad, and 60068-2-2 Test Bd -40°F to 149°F (-40°C to 65°C) IEC 60068-2-1 Test Ab and 60068-2-2 Test Bb Relative Humidity 10 to 90% RH, 27°C maximum wet bulb (noncondensing) IEC 60068-2-56 Test Cb 93% RH, 35°C maximum wet bulb (noncondensing) IEC 60068-2-56 Test Cb Altitude 10,000 ft. (3,000m) IEC 60068-2-13 Test M, and 60068-2-41 Test Z/BM 40,000 ft. (12,000m) IEC 60068-2-13 Test M Vibration 0.15 G (z-axis), 0.10 G (x-, y-axes), 5-500Hz swept sine IEC 60068-2-6 Test Fc 0.5 G (z-axis), 0.25 G (x-, y-axes), 5-500Hz swept sine IEC 60068-2-6 Test Fc Shock 3 Gs, 11 ms half-sine IEC 60068-2-27 Test Ea • Roll-off: 1-inch roll-off free fall, front to back rolling directions • Threshold: 25 mm threshold height at 0.75 m/s impact velocity ETE-1010-02 Rev A10 SPARC T3-4 Server Installation Guide • July 2011 Acoustic Noise Emissions Declared noise emissions for the SPARC T3-4 server is in accordance with ISO 9296 standards. Related Information ¦ “Input Power Information” on page 8 ¦ “Environmental Specifications” on page 9 Inventory List FIGURE: Inventory List on page 11 illustrates the components that are shipped with the server. Description Operating at Idle Operating at Maximum Power Sound power level, LwAd (1 B = 10 dB) 7.4 B 8.2 B Sound Pressure Level, LpAm (bystander positions) 63 dBA 68.2 dBAPreparing for Installation 11 FIGURE: Inventory List Related Information ¦ “Installation Task Overview” on page 2 ¦ “Server Overview” on page 3 ¦ “Rackmount Kit Contents” on page 16 Figure Legend 1 SPARC T3-4 Server 2 Ethernet cable 3 Rackmount kit 4 Rackmount template 5 Print document kit 6 Cable adaptors12 SPARC T3-4 Server Installation Guide • July 2011 Server Handling Precautions Caution – Deploy the anti-tilt bar on the equipment rack before beginning an installation. Caution – Always load equipment into a rack from the bottom up so that it will not become top-heavy and tip over. Caution – A fully configured SPARC T3-4 server weighs approximately 175 lb. (79 kg). An equipment lift is required to lift and mount this server into a rack enclosure when using the procedures in this document. Caution – Always communicate your intentions clearly before, during, and after each step of the rackmounting procedure to minimize confusion. Related Information ¦ “ESD Precautions” on page 12 ESD Precautions Electronic equipment is susceptible to damage by static electricity. Use a grounded antistatic wriststrap, footstrap, or equivalent safety equipment to prevent electrostatic damage when you install or service the server. Caution – To protect electronic components from electrostatic damage, which can permanently disable the server or require repair by service technicians, place components on an antistatic surface, such as an antistatic discharge mat, an antistatic bag, or a disposable antistatic mat. Wear an antistatic grounding strap connected to a metal surface on the chassis when you work on server components.Preparing for Installation 13 Related Information ¦ “Server Handling Precautions” on page 12 Tools Needed for Installation To install the server, you must have the following tools: ¦ Long No. 2 Phillips screwdriver ¦ Cutters or heavy-duty scissors ¦ Marking pen or tape ¦ ESD mat and grounding strap ¦ Hydraulic or mechanical lift In addition, you must provide a system console device, such as one of the following: ¦ ASCII terminal ¦ Workstation ¦ Terminal server ¦ Patch panel connected to a terminal server Related Information ¦ “Server Handling Precautions” on page 12 ¦ “ESD Precautions” on page 12 Optional Component Installation The standard components of the server are installed at the factory. However, if you ordered options such as additional memory or PCI cards, these will be shipped separately. If possible, install these components prior to installing the server in a rack. See the SPARC T3-4 Server Service Manual for specific installation instructions. Note – The list of optional components can be updated without notice. See the product web pages for the most current list of components supported in the server.14 SPARC T3-4 Server Installation Guide • July 2011 Related Information ¦ “Tools Needed for Installation” on page 1315 Installing the Server These topics describe how to install the server into an equipment cabinet equipped with square mounting holes. If you are installing the server into a cabinet equipped with round mounting holes, see “Determine Correct Rackmount Hardware” on page 18. Note – If your rackmount kit came with its own instructions, use the instructions in your rackmount kit instead of the instructions in this chapter. After performing the server installation, proceed to “Powering On the Server for the First Time” on page 43 for first-time power on. If you are shipping the equipment rack to another location for final installation, or installing the server into a vehicle, install the shipping bracket assembly. See “Installing and Using the Shipping Bracket Assembly (Optional)” on page 25. These topics include the following: ¦ “Rack Compatibility” on page 16 ¦ “Rackmount Kit Contents” on page 16 ¦ “Determine Correct Rackmount Hardware” on page 18 ¦ “Mark the Rackmounting Location” on page 18 ¦ “Install the Rackmount Hardware” on page 19 ¦ “Install the Server” on page 23 ¦ “Installing and Using the Shipping Bracket Assembly (Optional)” on page 25 Related Information ¦ “Preparing for Installation” on page 1 ¦ “Connecting the Server Cables” on page 31 ¦ “Powering On the Server for the First Time” on page 4316 SPARC T3-4 Server Installation Guide • July 2011 Rack Compatibility The rackmount kit is compatible with equipment racks that meet the following standards: ¦ Four-post structure (mounting at both front and rear). Note – Two-post racks are not compatible. ¦ Rack horizontal opening and unit vertical pitch conforming to ANSI/EIA 310-D-1992 or IEC 60927 standards. ¦ Distance between front and rear mounting planes between 24 to 36 inches (65 cm and 91.5 cm). ¦ Minimum clearance depth (to front cabinet door) in front of front rackmount plane: 1 inch (25.4 mm). ¦ Minimum clearance depth (to rear cabinet door) behind front rackmount plane: 34.6 inches (88 cm) with cable management assembly (recommended) or 31.5 inches (80 cm) without the cable management assembly. ¦ Minimum clearance width (between structural supports and cable troughs) between front and rear mounting planes: 18.9 inches (48 cm). Related Information ¦ “Tools Needed for Installation” on page 13 ¦ “Rackmount Kit Contents” on page 16 ¦ “Determine Correct Rackmount Hardware” on page 18 Rackmount Kit Contents The rackmount kit has two shelf rails, one for each side of the rack. Each shelf rail is marked LEFT or RIGHT. (FIGURE: Rackmount Kit on page 17). The shelf rails are mounted to the rack or cabinet with four adaptor brackets. The shelf rails adjust to fit rack depths from 25 to 34.25 in. (63.5 to 87 cm).Installing the Server 17 FIGURE: Rackmount Kit Related Information ¦ “Tools Needed for Installation” on page 13 ¦ “Installing the Rackmount Kit” on page 13 ¦ “Rack Compatibility” on page 16 ¦ “Determine Correct Rackmount Hardware” on page 18 ¦ “Installing and Using the Shipping Bracket Assembly (Optional)” on page 25 Figure Legend 1 Upper rear brackets 2 Shelf rails 3 Adaptor brackets (two types provided) 4 Flathead screws 5 Threaded inserts 6 M6 screws 7 Rackmount screws18 SPARC T3-4 Server Installation Guide • July 2011 ? Determine Correct Rackmount Hardware ? Use the following table to determine the hardware needed for your rack installation. Note – Some of the fastener bags that are included in the kit are not required to install this server. ? Mark the Rackmounting Location Use the rackmounting template to identify the correct mounting holes for the shelf rails. Note – Load the rack from bottom to top. 1. Ensure that there is enough vertical space in the cabinet to install the server. Cabinet Type Fastener Bags Required Square hole SCREW, SEMS, M6 X 16 CAGENUTS, M6 SCREW, FLAT HEAD, M4 X 10 Round hole (10-32) with corner bezel SCREW, SEMS, 10-32 X 10 SCREW, FLAT HEAD, M4 X 10 Round hole (M6) with corner bezel SCREW, SEMS, M6 X 12 SCREW, FLAT HEAD, M4 X 10 Round hole (10-32) inside installation SCREW, SHOULDER, 10-32 SCREW, FLAT HEAD, M4 X 10 Round hole (M6) inside installation SCREW, SEMS, M6 X 12 SCREW, FLAT HEAD, M4 X 10Installing the Server 19 2. Place the rackmounting template against the front rails. The bottom edge of the template corresponds to the bottom edge of the server. Measure up from the bottom of the template. 3. Mark the mounting holes for the front shelf rails. 4. Mark the mounting holes for the rear shelf rails. ? Install the Rackmount Hardware 1. Repeat the following steps for both the left and right front mounting points: a. Place the adaptor bracket in the marked location. Note – An “up” arrow indicates proper orientation. b. Secure the adaptor bracket, with one No. 2 Phillips screw in the center hole. c. Insert a mounting clip in the hole just above the top of the rack rail bracket.20 SPARC T3-4 Server Installation Guide • July 2011 2. Repeat the following steps for both the left and right rear mounting points: a. Place the adaptor bracket in the marked location. Note – An “up” arrow indicates proper orientation. b. Secure the adaptor bracket top and bottom holes, with two No. 2 Phillips screws.Installing the Server 21 3. Install the left and right upper corner brackets. a. Install two cage nuts into the cabinet in the two holes above the tops of the adaptor brackets. b. Secure each upper curner bracket with two No. 2 Phillips screws. 4. Install the shelf rails. Note – The shelf rails are marked “Left” and “Right” (as viewed from the front of the server) and “Front” and “Rear.” Repeat for left and right shelf rails: a. Insert the front of the shelf rail into the front adaptor bracket. b. Insert the rear of the shelf rail into the rear adaptor bracket. The shelf rail slides in and out to fit cabinets of different depths.22 SPARC T3-4 Server Installation Guide • July 2011 c. Secure each shelf rail with two flat-head No. 2 Phillips screws.Installing the Server 23 ? Install the Server Caution – A fully configured server weighs 175 lbs (80 kg). Use a mechanical lift to install the server into the rack. 1. Ensure the mechanical lift is level and stable. 2. Lift the server up to the correct height. 3. Slide the server into the rack. Ensure that the bottom edge of the server has cleared the bottom of the rack rails.24 SPARC T3-4 Server Installation Guide • July 2011 FIGURE: Installing the Server 4. Secure the server to the front panel using four No. 2 Phillips screws. Figure Legend 1 Mechanical lift 2 SPARC T3-4 server 3 Cabinet 4 Shelf rail 5 Ensure server mounted above shelf railInstalling the Server 25 Installing and Using the Shipping Bracket Assembly (Optional) Use this set of procedures if you are installing the server into an equipment rack that will be shipped to another location, or if you are installing the server into a vehicle. Note – This procedure describes how to install the server into a cabinet with square mounting holes. If you are installing the server into a cabinet with round mounting holes, see “Determine Correct Rackmount Hardware” on page 18. This topic includes the following sections: ¦ “Shipping Bracket Kit Contents” on page 25 ¦ “Determine Correct Shipping Bracket Fasteners” on page 27 ¦ “Install the Front Shipping Bracket” on page 27 ¦ “Install the Rear Shipping Bracket” on page 28 Related Information ¦ “Rack Compatibility” on page 16 ¦ “Rackmount Kit Contents” on page 16 ¦ “Determine Correct Rackmount Hardware” on page 18 ¦ “Mark the Rackmounting Location” on page 18 ¦ “Install the Server” on page 23 Shipping Bracket Kit Contents The optional shipping bracket kit provides extra shock and vibration protection. Use this kit when installing the server into a vehicle, or when you are installing the server into an equipment cabinet that will be shipped to another location for final installation.26 SPARC T3-4 Server Installation Guide • July 2011 FIGURE: Shipping Bracket Kit Related Information ¦ “Tools Needed for Installation” on page 13 ¦ “Rack Compatibility” on page 16 ¦ “Determine Correct Rackmount Hardware” on page 18 ¦ “Mark the Rackmounting Location” on page 18 ¦ “Determine Correct Shipping Bracket Fasteners” on page 27 ? Determine Correct Shipping Bracket Fasteners ? Use the following table to determine the correct fasteners for your shipping bracket installation. Figure Legend 1 Rear shipping bracket 2 Front shipping bracket 3 Fasteners Cabinet Type Fastener Bags Required Square hole with corner bezel SCREW, SEMS, M6 X 16MM SCREW, SEMS, M6 X 30MMInstalling the Server 27 Note – Some fastener bags are not required to install this server. ? Install the Front Shipping Bracket 1. Remove the bottom two front panel mounting screws. Note – Use the tapped holes in the front shipping bracket to secure these screws for later use. 2. Hold the front shipping bracket in place. 3. Secure the front shipping bracket with two long screws. Tapped hole (10-32) SCREW, SEMS, 10-32 X 1-1/4” SCREW, SEMS, 10-32 X 10MM Tapped hole (M6) SCREW, SEMS, M6 X 16MM SCREW, SEMS, M6 X 30MM Cabinet Type Fastener Bags Required28 SPARC T3-4 Server Installation Guide • July 2011 ? Install the Rear Shipping Bracket 1. Remove the bottom two rear rackmount screws on each side (four total). The server is held in place by the top four screws (two on each side.) 2. Hold the lower shipping bracket in place. 3. Install two No. 2 Phillips screws in the bottom holes of the lower shipping bracket.Installing the Server 29 ? Remove the Front Shipping Bracket Remove the front shipping bracket after the server cabinet reaches its final destination. 1. Remove the two short No. 2 Phillips screws that are stored with the shipping bracket. 2. Remove the two screws that secure the front shipping bracket to the cabinet. 3. Slide the front shipping bracket out from the front of the cabinet. 4. Install the two short No. 2 Phillips screws into the lower two front panel screws. Use the screws that were stored in the front shipping bracket during transit.30 SPARC T3-4 Server Installation Guide • July 201131 Connecting the Server Cables This topic contains the following sections: ¦ “Cabling Requirements” on page 31 ¦ “Front Panel Connectors and Ports” on page 33 ¦ “Rear Panel Connectors and Ports” on page 34 ¦ “Installing and Using the CMA (Optional)” on page 35 ¦ “Connect the SER MGT Cable” on page 39 ¦ “Connect the NET MGT Cable” on page 40 ¦ “Connect the Ethernet Network Cables” on page 41 ¦ “Connect Other Data Cables” on page 41 ¦ “Prepare Power Cords” on page 41 Related Information ¦ “Preparing for Installation” on page 1 ¦ “Installing the Server” on page 15 ¦ “Powering On the Server for the First Time” on page 43 ¦ “Identifying the Server Ports” on page 59 Cabling Requirements ¦ Minimum cable connections for the server: ¦ At least one server on-board Ethernet network connection (NET port) ¦ The service processor serial management port (SER MGT port) ¦ The service processor network management port (NET MGT port) ¦ Power cables for the server power supplies ¦ Service processor management ports: There are two service processor management ports for use with the ILOM service processor.32 SPARC T3-4 Server Installation Guide • July 2011 ¦ The service processor serial management port (labeled SER MGT) uses an RJ-45 cable and is always available. This port is the default connection to the ILOM service processor. ¦ The service processor network management port (labeled NET MGT) is the optional connection to the ILOM service processor. The NET MGT port is configured to use DHCP by default. To set a static IP address, see “Assigning a Static IP Address to the Service Processor” on page 49. The service processor network management port uses an RJ-45 cable for a 10/100 BASE-T connection. This port does not support connections to Gigabit networks. ¦ Ethernet ports are labeled NET0, NET1, NET2, and NET3. The Ethernet interfaces operate at 10 Mbps, 100 Mbps, and 1000 Mbps. ¦ USB Ports: USB ports support hot-plugging. You can connect and disconnect USB cables and peripheral devices while the server is running, without affecting server operations. ¦ You can only perform USB hot-plug operations while the OS is running. USB hot-plug operations are not supported when the server ok prompt is displayed or before the server has completed booting. ¦ You can connect up to 126 devices to each of the four USB controllers, for a total of 504 USB devices per server. ¦ AC power cables: Do not attach power cables to the power supplies until you have finished connecting the data cables, and have connected the server to a serial terminal or a terminal emulator (PC or workstation). The server goes into Standby mode and the ILOM service processor initializes as soon as the AC power cables are connected to the power source. System messages might be lost after 60 seconds if the server is not connected to a terminal, PC, or workstation. Related Information ¦ “Confirming Server Specifications” on page 6 ¦ “Server Handling Precautions” on page 12 ¦ “Rear Panel Cable Connections Reference” on page 24 ¦ “Secure Cables Using the CMA” on page 38 Connection Type IEEE Terminology Transfer Rate Ethernet 10BASE-T 10 Mbit/sec Fast Ethernet 100BASE-TX 100 Mbits/sec Gigabit Ethernet 1000BASE-T 1000 Mbit/secConnecting the Server Cables 33 Front Panel Connectors and Ports FIGURE: Front Panel connectors Figure Legend 1 VGA port 2 USB ports 3 SER MGT port34 SPARC T3-4 Server Installation Guide • July 2011 Rear Panel Connectors and Ports FIGURE: Rear Panel Connectors Note – You must follow the proper sequence when connecting cables to the server. Do not connect the power cords until all data cables have been connected. Related Information ¦ “Server Handling Precautions” on page 12 ¦ “ESD Precautions” on page 12 ¦ “Cabling Requirements” on page 31 ¦ “Install the CMA” on page 37 ¦ “Secure Cables Using the CMA” on page 38 Figure Legend 1 QCFP ports 2 USB ports 3 AC power ports 4 Gigabit Ethernet ports 5 SER MGT port 6 NET MGT PortConnecting the Server Cables 35 Installing and Using the CMA (Optional) The cable management assembly (CMA) is an optional kit for managing and routing power and data cables attached to the back of the server. This topic includes the following: ¦ “About the CMA” on page 36 ¦ “Determine Correct CMA Hardware” on page 36 ¦ “Install the CMA” on page 37 ¦ “Secure Cables Using the CMA” on page 38 About the CMA FIGURE: Cable Management Assembly (CMA) Figure Legend 1 Swivel mounts36 SPARC T3-4 Server Installation Guide • July 2011 ? Determine Correct CMA Hardware ? Use the following table to determine the hardware needed for your CMA installation. Note – Some of the fastener bags that are included in the kit are not required to install this server. ? Install the CMA The CMA is attached to the center rear of the server. Note – The CMA installation might block some of the power outlets in the cabinet, making them unavailable. 1. Install the L brackets at the rear . The brackets are marked “Left” and “Right” as viewed from the back of the server. Repeat for left and right sides: a. Identify the “left” and “right” side brackets. b. Remove the two middle screws from the rackmount adaptor. c. Place the bracket over the center two mounting holes. d. Secure each mounting bracket with two No. 2 Phillips screws. 2 “L” brackets 3 Fastners 4 CMA Cabinet Type Fastener Bags Required Square hole Round Hole (M6) (all types) SCREW, SEMS, M6 X 16 Round hole (10-32) (all types)l SCREW, SEMS, 10-32 X 7/16” Figure Legend (Continued)Connecting the Server Cables 37 2. Slide the left and right swivel clips into the left and right L brackets. 3. Secure the CMA with the two captive screws. ? Secure Cables Using the CMA Use the CMA to secure cables and ensure proper cable routing. 1. Remove the CMA cover. The CMA cover is secured with two No. 2 Phillips screws.38 SPARC T3-4 Server Installation Guide • July 2011 2. Place system cables into appropriate slots in the CMA. 3. Install the CMA cover. The cover is secured with two No. 2 Phillips screws. ? Connect the SER MGT Cable The service processor serial management port is marked SER MGT. See “Front Panel Connectors and Ports” on page 33 and “Rear Panel Connectors and Ports” on page 34 for connector locations.Connecting the Server Cables 39 ? Connect a Category 5 cable from the service processor SER MGT port to the terminal device. Use this port for initial server management. This port is needed to activate the NET MGT port, as detailed in “Powering On the Server for the First Time” on page 43. When connecting either a DB-9 or a DB-25 cable, use an adapter to perform the crossovers given for each connector. Note – Use the service processor serial management port only for server management. It is the default connection between the service processor and a terminal or a computer. Caution – Do not attach a modem to the service processor serial management port. ? Connect the NET MGT Cable ? Connect a Category 5 cable from the service processor network management port to your network switch or hub. See “Rear Panel Connectors and Ports” on page 34 for connector locations. The service processor network management port is labeled NET MGT. This port is not operational until you configure the network settings (through the serial management port), as detailed in “Log In to the Service Processor Using the SER MGT Port” on page 50. If you have access to a DHCP server on the network, you can see the service processor get an IP address because the DHCP client is enabled by default. Note – The NET MGT port is configured by default to retrieve network settings with DHCP and allow connections using SSH. You might need to modify these settings for your network. Instructions are given in “Powering On the Server for the First Time” on page 43.40 SPARC T3-4 Server Installation Guide • July 2011 ? Connect the Ethernet Network Cables The server has four network connectors, marked NET0, NET1, NET2, and NET3. These connectors are RJ-45 Gigabit Ethernet. See “Rear Panel Connectors and Ports” on page 34 for connector locations. Note – The ILOM sideband management feature enables you to access the SP using one of these Ethernet ports. Refer to the SPARC T3 Series Servers Administration Guide for instructions. 1. Connect a Category 5 (or better) cable from your network switch or hub to Ethernet Port 0 (NET0) on the rear of the chassis. 2. Connect Category 5 (or better) cables from your network switch or hub to the remaining Ethernet ports (NET1, NET2, NET3), as needed. ? Connect Other Data Cables ? If the server is configured with additional I/O components, connect the external cables to the server. See peripheral documentation for specific instructions. ? Prepare Power Cords Caution – Finish the hardware procedures in this chapter, but do not attach the AC power cables to a power source yet. Powering on the server for the first time requires special preparation and procedures. For example, if you have not prepared a display before connecting the AC power cable, initial system messages could be lost.Connecting the Server Cables 41 Caution – The server goes into Standby mode and the service processor initializes as soon as the AC power cable is connected to the power source. ? Go to “Power On Task Overview” on page 44 for instructions on connecting the server to AC power.42 SPARC T3-4 Server Installation Guide • July 201143 Powering On the Server for the First Time These topics include instructions for booting the server and for enabling the service processor network management port. ¦ “Power On Task Overview” on page 44 ¦ “Oracle ILOM System Console Overview” on page 44 ¦ “Connect a Terminal or Emulator to the SER MGT Port” on page 45 ¦ “Power On the Server for the First Time” on page 46 ¦ “Oracle Solaris OS Configuration Parameters” on page 48 ¦ “Assigning a Static IP Address to the Service Processor” on page 49 ¦ “Booting the Oracle Solaris Operating System” on page 54 Related Information ¦ “Preparing for Installation” on page 1 ¦ “Installing the SPARC T3-4 Server” on page 13 ¦ “Connecting the Server Cables” on page 3144 SPARC T3-4 Server Installation Guide • July 2011 Power On Task Overview These topics provide an overview and instructions for powering on your server for the first time. Related Information ¦ “Preparing for Installation” on page 1 Oracle ILOM System Console Overview When you power on the server, the boot process begins under the control of the Oracle Integrated Lights Out Manager system console. The ILOM system console displays status and error messages generated by firmware-based tests during server startup. By default, ILOM system console messages are directed to the NET MGT port. The NET MGT port uses DHCP and allows connections using SSH. Note – If you are unable to use DHCP on your network, you must connect to the ILOM service processor using the serial management port to configure the network management port for your network. See “Assign a Static IP to the NET MGT Port” on page 51. Step Description Links 1 Connect a serial terminal device or terminal server to the SER MGT port. “Connect a Terminal or Emulator to the SER MGT Port” on page 45 2 Power on the server for the first time. “Power On the Server for the First Time” on page 46 3 Set Oracle Solaris OS configuration parameters. “Oracle Solaris OS Configuration Parameters” on page 48 4 (Optional) Configure the NET MGT port to use a static IP address. “Assigning a Static IP Address to the Service Processor” on page 49 5 Boot the Oracle Solaris OS. “Booting the Oracle Solaris Operating System” on page 54Powering On the Server for the First Time 45 Related Information ¦ “Assigning a Static IP Address to the Service Processor” on page 49 ? Connect a Terminal or Emulator to the SER MGT Port ? Connect a terminal or a terminal emulator (PC or workstation) to the service processor serial management port. Configure the terminal or terminal emulator with these settings: ¦ 9600 baud ¦ 8 bits ¦ No parity ¦ 1 Stop bit ¦ No handshake A null modem configuration is needed, meaning the transmit and receive signals are reversed (crossed over) for DTE to DTE communications. You can use the supplied RJ-45 crossover adapters with a standard RJ-45 cable to achieve the null modem configuration. Note – When you power on the server for the first time and you do not have a terminal or terminal emulator (PC or workstation) connected to the service processor serial management port, you will not see system messages. ? Power On the Server for the First Time Complete the following tasks: ¦ Confirm that you have completed the installation of the server in its rack. See “Installing the Server” on page 15. ¦ Attach the cable management assembly. See “Install the CMA” on page 37. ¦ Connect a terminal or terminal emulator to the SER MGT port. See “Connect a Terminal or Emulator to the SER MGT Port” on page 45.46 SPARC T3-4 Server Installation Guide • July 2011 1. (Optional) Connect an Ethernet cable between the server’s NET MGT port and the network to which future connections to the SP and host will be made. See “Connect the NET MGT Cable” on page 40. After the initial configuration of the server using the SER MGT port, communication with the SP and host is usually performed through this Ethernet interface. 2. Connect an Ethernet cable between one of the server’s NET ports (“Rear Panel Connectors and Ports” on page 34) and the network to which the server will communicate. 3. Plug the power cords into the power supplies and into a power source. Note – Only two power connections are required for operation. Use four power connections and two separate circuits for redundancy. The service processor runs on the 3.3V standby voltage. As soon as AC power is connected to the server, the service processor powers on, runs diagnostics, and initializes the ILOM firmware. After a few minutes, the SP login prompt appears on the terminal device. The host is not initialized or powered on yet. 4. At the terminal device, log in to the SP as root with a password of changeme. After a brief delay, the SP prompt is displayed (->). At this point, there are many commands you can perform using the ILOM interface. Additional SP information, such as how to change the password and how to set up the SP network parameters is available in the online documentation set. 5. Open a second terminal device, log in to the SP as root with a password of changeme After a brief delay, the SP prompt is displayed (->). At this point, there are many commands you can perform using the ILOM interface. XXXXXXXXXXXXXXXX login: root Password: changeme . . . ->Powering On the Server for the First Time 47 6. In the first terminal device, redirect the host output to display on the serial terminal device: After you start the SP console, the server initialization takes approximately 20 minutes to complete. This terminal device displays all SP console messages during intial boot. 7. In the second terminal device, power on the server: This terminal device displays all system console messages during initial boot. 8. When prompted, follow the onscreen instructions for configuring the Oracle Solaris Operating System on your host and enter the following configuration information. You will be prompted to confirm the configuration several times, enabling confirmation and changes. If you are not sure how to respond to a particular value, you can accept the default, and make future changes when the Oracle Solaris OS is running. See “Oracle Solaris OS Configuration Parameters” on page 48 for a description of the Oracle Solaris OS parameters you must provide during initial configuration. 9. Log in to the server and explore its capabilities. There are many commands you can use to verify the functionality of the server. The following list describes a few of them: ¦ showrev – Displays the host name and server architecture information. Use the -a option with this command to see the patches that are installed. ¦ psrinfo – Displays information about the number and status of the processors and cores in the host. ¦ prtdiag – Displays server configuration and diagnostic information. Review the Oracle Solaris OS man pages and documentation for more details. -> start /SP/console Are you sure you want to start /SP/console (y/n)? y Serial console started. To stop, type #. . . . -> start /SYS Are you sure you want to start /SYS (y/n)? y48 SPARC T3-4 Server Installation Guide • July 2011 Oracle Solaris OS Configuration Parameters This topic describes configuration parameters you must provide during initial Oracle Solaris OS configuration. Parameter Description Language Select a number from the displayed language list. Locale Select a number from the displayed locale list. Terminal Type Select a terminal type that corresponds with your terminal device. Network? Select Yes. Multiple Network Interfaces Select the network interfaces that you plan to configure. If you are not sure, select the first one in the list. DHCP? Select Yes or No according to your network environment. Host Name Type the host name for the server. IP Address Type the IP address for this Ethernet interface. Subnet? Select Yes or No according to your network environment. Subnet Netmask (If subnet was Yes) Type the netmask for the subnet for your network environment. IPv6? Specify whether or not to use IPv6. If you are not sure, select No to configure the Ethernet interface for IPv4. Security Policy Select either standard UNIX security (No) or Kerberos Security (Yes). If you are not sure, select No. Confirm Review the onscreen information and change it if needed. Otherwise, continue. Name Service Select the name service according to your network environment. Note–If you select a name service other than None, you will be prompted for additional name service configuration information. NFSv4 Domain Name Select the type of domain name configuration according to your environment. If you are not sure, select Use the NFSv4 domain derived by the server. Time Zone (Continent) Select your continent. Time Zone (Country or Region) Select your country or region.Powering On the Server for the First Time 49 Related Information ¦ “Rear Panel Cable Connections Reference” on page 24 ¦ “Assigning a Static IP Address to the Service Processor” on page 49 ¦ “Boot the Oracle Solaris Operating System” on page 55 ¦ “Booting the Oracle Solaris Operating System” on page 54 Assigning a Static IP Address to the Service Processor If your network does not use DHCP, the network management port is not operational until you configure network settings for the service processor. This topic includes the following tasks: ¦ “Log In to the Service Processor Using the SER MGT Port” on page 50 ¦ “Assign a Static IP to the NET MGT Port” on page 51 Related Information ¦ “Power On Task Overview” on page 44 ¦ “Oracle ILOM System Console Overview” on page 44 ¦ “Oracle Solaris OS Configuration Parameters” on page 48 Time Zone Select the time zone. Date and Time Accept the default date and time or change the values. root Password Type the root password twice. This password is for the superuser account for the Oracle Solaris OS on this server. This password is not the SP password.50 SPARC T3-4 Server Installation Guide • July 2011 ? Log In to the Service Processor Using the SER MGT Port After the service processor boots, access the ILOM CLI to configure and manage the server. The ILOM CLI prompt (->) is displayed at the first time the service processor is booted. The default configuration provides an ILOM CLI root user account. The default root password is changeme. Change the password using the service processor ILOM CLI password command. 1. If this is the first time the server has been powered on, use the password command to change the root password. Note – After the root password has been set, on subsequent reboots, the ILOM CLI login prompt is displayed. 2. Enter root for the login name followed by your password. ... Starting OpenBSD Secure Shell server: sshd. Starting Servicetags listener: stlistener. Starting FRU update program: frutool. hostname login: root Password: changeme Copyright 2007 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms. ... Federal Acquisitions: Commercial Software -- Government Users Subject to Standard License Terms and Conditions. ... Warning: password is set to factory default. -> set /HOST/users/root password Enter new password: ******** Enter new password again: ******** -> ... hostname login: root Password: password (nothing displayed) Waiting for daemons to initialize...Powering On the Server for the First Time 51 ? Assign a Static IP to the NET MGT Port Use this procedure only when: ¦ You are unable to use DHCP on your network. ¦ You need to modify the NET MGT port settings. In this procedure, you connect to the SER MGT port to manually reconfigure the NET MGT port to use a static IP address. Note – For more information on configuring ILOM, refer to the SPARC T3 Series Servers Administration Guide. Daemons ready Integrated Lights Out Manager Version 2.0.0.0 Copyright 2007 Sun Microsystems, Inc. All rights reserved. Use is subject to license terms. ->52 SPARC T3-4 Server Installation Guide • July 2011 1. Set these network parameters according to the specific details of your network configuration. Configure these parameters using the set command. For example: 2. Configure the service processor using information from your network administrator. a. If you choose to use a dynamically created IP address (use DHCP to retrieve the network setting), set pendingipdiscovery to dhcp. b. If you choose to configure a static IP configuration. set the parameters pendingipdiscovery, pendingipaddress, pendingipgateway, and pendingipnetmask as follows. Parameter Description /SP/network state Specifies whether or not the service processor is on the network. /SP/network pendingipaddress IP address of the service processor. /SP/network pendingipgateway IP address of the gateway for the subnet. /SP/network pendingipnetmask Netmask for the service processor subnet. /SP/network pindingipdiscovery Specifies whether the service processor uses DHCP or static IP address assignment. /SP/network commitpending Commits the service processor to use the pending settings -> set /host/network pendingaddress=xxx.xxx.xxx.xxx Set ‘pendingaddress’ to ‘xxx.xxx.xxx.xxx’ Parameter Description dhcp Set up the network connection with a dynamically created IP configuration. static Set up the network connection with a static IP configuration. -> set /SP/network pendingipdiscovery=dhcp Set 'pendingipdiscovery' to 'dhcp'Powering On the Server for the First Time 53 i. Set the service processor to accept a static IP address. ii. Set the IP address for the service processor. iii. Set the IP address for the service processor gateway. iv. Set the netmask for the service processor. This example uses 255.255.255.0 to set the netmask. Your network environment subnet might require a different netmask. Use a netmask number most appropriate to your environment. 3. Use the show /SP/network command to verify that the parameters were set correctly. The following example shows parameters that have been set to convert a service processor from a DHCP configuration to a static configuration. -> set /SP/network pendingipdiscovery=static Set 'pendingipdiscovery' to 'static' -> set /SP/network pendingipaddress=service-processor-IPaddr Set 'pendingipaddress' to 'service-processor-IPaddr' -> set /SP/network pendingipgateway=gateway-IPaddr Set 'pendingipgateway' to 'gateway-IPaddr' -> set /SP/network pendingipnetmask=255.255.255.0 Set 'pendingipnetmask' to '255.255.255.0' -> show /SP/network /SP/network Targets: Properties: commitpending = (Cannot show property) dhcp_server_ip = xxx.xxx.xxx.xxx ipaddress = xxx.xxx.xxx.xxx ipdiscovery = dhcp ipgateway = xxx.xxx.xxx.xxx ipnetmask = 255.255.252.0 macaddress = 00:14:4F:3F:8C:AF pendingipaddress = xxx.xxx.xxx.xxx pendingipdiscovery = static pendingipgateway = xxx.xxx.xxx.xxx pendingipnetmask = 255.255.255.0 state = enabled54 SPARC T3-4 Server Installation Guide • July 2011 Note – After setting the configuration parameters, you must enter the set /SP/network commitpending=true command for the new values to take affect. 4. Commit the changes to the service processor network parameters. Note – You can run the show /SP/network command again (after performing the set /SP/network commitpending=true command) to verify that the parameters have been updated. Booting the Oracle Solaris Operating System The Oracle Solaris OS is preinstalled on the server on the disk in slot 0. The Oracle Solaris OS is not configured (that is, the sys-unconfig command was run in the factory). If you boot the server from this disk, you will be prompted to configure the Oracle Solaris OS for your environment. After powering on the server for the first time, you can use Oracle’s SunVTS software to verify the functionality and performance of any installed components, as well as its network connections. Refer to the SunVTS documentation at (http://www.sun.com/documentation) for more information. For more information about configuring the server and using the ILOM service processor, refer to the SPARC T3 Series Servers Administration Guide. For more information about adding optional components, refer to the SPARC T3-4 Server Service Manual. These topics describe the following tasks: ¦ “Boot the Oracle Solaris Operating System” on page 55 Commands: cd set show -> -> set /SP/network commitpending=true Set 'commitpending' to 'true'Powering On the Server for the First Time 55 ¦ “Avoid Booting the Oracle Solaris Operating System at Start Up” on page 56 ¦ “Reset the Server” on page 56 ¦ “Power Cycle the Server” on page 56 Related Information ¦ “Oracle Solaris OS Configuration Parameters” on page 48 ? Boot the Oracle Solaris Operating System 1. At the ok prompt, boot from the disk that contains the Oracle Solaris OS. ¦ If you know which disk to boot from, skip this step and perform Step 2. ¦ If you need to determine which disk to boot from, type the show-disks command at the ok prompt to see the path to the configured disks, similar to the following: 2. Type the boot command at the ok prompt. Use the value from Step 1 to construct the boot command. You must append the target to the disk path. In the following example, the server is booted from disk 0 (zero). ok show-disks a) /pci@0/pci@0/pci@2/scsi@0/disk0 b) /pci@0/pci@0/pci@1/pci@0/pci@1/pci@0/usb@0,2/storage@2/disk q) NO SELECTION Enter Selection, q to quit: q ok ok boot disk0 Boot device: /pci@0/pci@0/pci@2/scsi@0/disk@0 File and args: SunOS Release 5.10 Version Generic_127127-03 64-bit Copyright 1983-2010 Oracle Corp. All rights reserved. Use is subject to license terms. Hostname: hostname NIS domain name is x.x.x.x hostname console login:56 SPARC T3-4 Server Installation Guide • July 2011 ? Avoid Booting the Oracle Solaris Operating System at Start Up In hard drive HDD0, the Oracle Solaris OS is preinstalled. ? If you do not want to start the preinstalled OS, set the Open Boot PROM parameter auto-boot? to false. For example: ? Reset the Server ? If it is necessary to reset the server, use the shutdown -g0 -i6 -y command. It is not necessary to power the server off and on to simply reset the server. ? Power Cycle the Server If a simple reset does not clear a system problem, you can power the server off and on with this procedure. 1. Shut down the Oracle Solaris OS. At the Oracle Solaris OS prompt, type the shutdown -g0 -i0 -y command. Then type h when prompted to halt the Oracle Solaris OS and to return to the ok prompt. -> set /HOST/bootmode script="setenv auto-boot? false" # shutdown -g0 -i6 -y # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs40-58 syslogd: going down on signal 15 svc.startd: The system is down. syncing file systems... done Program terminated r)eboot, o)k prompt, h)alt?Powering On the Server for the First Time 57 2. Switch from the system console prompt to the service processor console prompt by issuing the console escape sequence (by default, #.). 3. Using the ILOM CLI, type the stop /SYS command to perform a graceful shutdown of the server. Note – To perform an immediate and ungraceful shutdown, use the stop -force -script /SYS or stop -script /SYS commands. These commands stop everything immediately. Ensure that all data is saved before entering these commands. 4. Type the start /SYS command. Note – To force a power-on sequence, use the start -script /SYS command. 5. Reconnect to the system console with the start /HOST/console command. The system console displays various messages, followed by the ok prompt. ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> -> start /HOST/console Are you sure you want to start /HOST/console (y/n)? y Serial console started. To stop, type #.58 SPARC T3-4 Server Installation Guide • July 201159 Identifying the Server Ports These topics provide reference information about the back panel ports and pin assignments. ¦ “USB Port Pinouts” on page 59 ¦ “SER MGT Port Pinouts” on page 60 ¦ “NET MGT Port Pinouts” on page 61 ¦ “Gigabit Ethernet Port Pinouts” on page 61 ¦ “QSFP Port Pinouts” on page 62 ¦ “VGA Port Pinouts” on page 63 Related Information ¦ “Server Overview” on page 3 USB Port Pinouts Two Universal Serial Bus (USB) ports are located the back panel. Two additional USB ports are located on the main module, and are accessible from the front panel.60 SPARC T3-4 Server Installation Guide • July 2011 SER MGT Port Pinouts The SER MGT port is an RJ-45 connector located on the back panel. This port is the default connection to the system console. An additional SER MGT port is located on the main module, and is accessible from the front panel. Pin Signal Description Pin Signal Description A1 +5 V (fused) B1 +5 V (fused) A2 USB0/1- B2 USB2/3- A3 USB0/1+ B3 USB2/3+ A4 Ground B4 Ground 1 2 3 4 1 2 3 4 A BIdentifying the Server Ports 61 NET MGT Port Pinouts The NET MGT port is an RJ-45 connector located on the system back panel. This port must be configured prior to use. TABLE: Serial Management Connector Signals Pin Signal Description Pin Signal Description 1 Request to Send 5 Ground 2 Data Terminal Ready 6 Receive Data 3 Transmit Data 7 Data Set Ready 4 Ground 8 Clear to Send Pin Signal Description Pin Signal Description 1 Transmit Data + 5 Common Mode Termination 2 Transmit Data – 6 Receive Data – 3 Receive Data + 7 Common Mode Termination 4 Common Mode Termination 8 Common Mode Termination62 SPARC T3-4 Server Installation Guide • July 2011 Gigabit Ethernet Port Pinouts Four RJ-45 Gigabit Ethernet connectors (NET0, NET1, NET2, NET3) are located on the system back panel. The Ethernet interfaces operate at 10 Mbit/sec, 100 Mbit/sec, and 1000 Mbit/sec. QSFP Port Pinouts The QSFP connector is a single InfiniBand port connection. Pin Signal Description Pin Signal Description 1 Transmit/Receive Data 0 + 5 Transmit/Receive Data 2 – 2 Transmit/Receive Data 0 – 6 Transmit/Receive Data 1 – 3 Transmit/Receive Data 1 + 7 Transmit/Receive Data 3 + 4 Transmit/Receive Data 2 + 8 Transmit/Receive Data 3 – Pin Signal Pin Signal Pin Signal Pin Signal 1 GND 11 SCL 21 RX2n 31 Reserved 2 TX2n 12 SDA 22 RX2p 32 GND 3 TX2p 13 GND 23 GND 33 TX3p 4 GND 14 RX3p 24 RX4n 34 TX3n 5 TX4n 15 RX3n 25 RX4p 35 GND 6 TX4p 16 GND 26 GND 36 TX1p 7 GND 17 RX1p 27 ModPrsL 37 TX1n 8 ModSeIL 18 RX1n 28 IntL 38 GNDIdentifying the Server Ports 63 VGA Port Pinouts 9 LPMode_Reset 19 GND 29 VccTx 10 VccRx 20 GND 30 Vcc1 Pin Signal Description Pin Signal Description 1 Red Video 9 [KEY] 2 Green Video 10 Sync Ground 3 Blue Video 11 Monitor ID - Bit 1 4 Monitor ID - Bit 2 12 Monitor ID - Bit 0 5 Ground 13 Horizontal Sync 6 Red Ground 14 Vertical Sync 7 Green Ground 15 N/C (Reserved) 8 Blue Ground Pin Signal Pin Signal Pin Signal Pin Signal64 SPARC T3-4 Server Installation Guide • July 201165 Index Symbols #. escape sequence for system console, 57 A acoustic noise emissions, 10 adapters for serial cables, 40 admin login, setting password for, 50 B baud rate for serial terminal, 45 bits setting for serial terminal, 45 boot booting the system, 43 OpenBoot PROM boot command, 55 C cables adapters for serial data cables, 40 CMA fasteners, 36 command set /SP/network, 53 show /SP/network, 53 show-disks, 55 compatible racks, 16 connectors front panel, 33 rear panel, 34 console command, 57 D diagnostics, when run, 46 E environmental speci?cations, 9 escape sequence #. for system console, 57 F fasteners CMA, 36 rackmount kit, 18 shipping bracket, 27 ?rst time AC power, 44 front panel connectors, 33 full disk path example, 55 G Gigabit Ethernet port pinouts, 61 H handshaking for serial terminal, no, 45 hot-plugging USB ports, 32 I installing optional components, 14 L LEDs, ports, and slots illustrated, 34 locations of ports, slots, and LEDs (illustration), 34 logging into service processor using serial management port, 50 M messages retention, limits of, 32 minimum cable connections, 31 modem not for use with the SER MGT serial management port, 40 N NET MGT port pinouts, 6166 SPARC T3-4 Server Installation Guide • July 2011 O Oracle Solaris OS avoid booting into at startup, 56 booting into, 55 P parity for serial terminal, no, 45 password command, 50 pinouts Gigabit Ethernet ports, 61 NET MGT port, 61 QSFP connector, 62 USB ports, 59 VGA port, 63 ports, slots, and LEDs illustrated, 34 power cycling the system, 56 power on for the ?rst time, 44 poweroff command, 57 Q QSFP connector pinouts, 62 R rackmount fasteners, 18 rackmount kit contents, 16 rackmounting, 15 racks, compatible, 16 rear panel connectors, 34 reset resetting the system with uadmin, 56 RJ-45 cable, 32 S serial management port, 50 serial terminal settings, 45 service processor accessing with serial management port, 50 log in using serial management port, 50 powering on for the ?rst time, 46 set command, 52 set command, 52 shipping bracket front, installation, 27 front, removal at destination, 29 kit contents, 25 rear, installation, 28 shipping bracket fasteners, 27 shipping kit contents, 10 show /SP/network command, 53 show-disks command, 55 slots, ports, and LEDs illustrated, 34 Standby mode, 42 standby mode, when AC connected, 32 standby voltage, 3.3v, 46 stop bit, 45 system console escape sequence #., 57 system reset, 56 T terms slide rail assembly, 16 U uadmin command, 56 USB port pinouts, 59 V VGA port pinouts, 63 Serveurs de la série SPARC T3 Guide d’administration N° de référence : E26261 Octobre 2011, révision AProduit recyclable Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. En aucun cas, Oracle Corporation et ses affiliés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l'accès à des contenus, produits ou services tiers, ou à leur utilisation. Copyright © 2010, 2011, Oracle et/ou ses sociétés affiliées. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition contraire de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles d’être modifiées sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles sont exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : DROITS DU GOUVERNEMENT DES ETATS-UNIS. Les programmes, les logiciels, les bases de données, de même que la documentation et les données techniques connexes, fournis à des clients faisant partie du Gouvernement des Etats-Unis, sont considérés·comme des « commercial computer software » ou des « commercial technical data » conformément aux réglementations F.A.R. et autres applicables. De ce fait, l’utilisation, la duplication, la divulgation, la modification et l’adaptation sont soumises aux restrictions et conditions de licence définies dans le contrat applicable et, dans les limites applicables sous-jacentes, les droits supplémentaires exposés dans la réglementation F.A.R. 52.227-19 (Commercial Computer Software License de décembre 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065, Etats-Unis. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est ni conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses sociétés affiliées. Tout autre nom cité peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses sociétés affiliées déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses sociétés affiliées ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Sommaire Utilisation de cette documentation ix Présentation des ressources de l’administration système 1 Présentation d’ILOM 1 Fonctions d’ILOM spécifiques à la plate-forme 3 Présentation du SE Oracle Solaris 4 Présentation d’OpenBoot 4 Présentation d’Oracle VM Server pour SPARC 5 Logiciel de multiacheminement 6 Présentation du pack de gestion du matériel 7 Source du téléchargement du logiciel HMP (pack de gestion du matériel) 8 Source du téléchargement de la documentation HMP (pack de gestion du matériel) 9 Accès au serveur 11 ? Pour se connecter à ILOM 11 ? Pour se connecter à la console système 12 ? Pour afficher l’invite ok 13 ? Pour afficher l’invite -> d’ILOM 15 ? Pour utiliser un moniteur graphique local 15 ILOM Remote Console 17iv Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Contrôle du serveur 19 ? Pour mettre le serveur sous tension 19 ? Pour mettre le serveur hors tension 20 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris 21 ? Pour réinitialiser le serveur à partir d’ILOM 22 ? Pour rétablir les valeurs par défaut du SP 23 Configuration de volumes RAID matériels 25 Prise en charge des volumes RAID matériels 25 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques 28 Affichage des informations de zone de disques 29 Etat des zones de disques (zoningcli list) 30 Etat des zones de disques (probe-scsi-all) 31 Activation et désactivation du zonage des disques dans le champ 33 ? Activation des zones de disques (commande zoningcli) 34 ? Désactivation des zones de disques (commande zoningcli) 34 ? Mise à jour du microprogramme pour activer le zonage 34 Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs 35 ? Pour préparer l’utilisation de l’utilitaire FCode 36 Commandes de l’utilitaire FCode 37 ? Pour créer un volume RAID matériel 38 Disques hot spare de volumes RAID (LSI) 39 Diagnostic de l'état de fonctionnement d'un disque 40 DEL avant du disque de service requis 40 Messages d'erreur (console système et fichiers journaux) 40 ? Affichage de l'état (commande show-volumes, OBP) 41 ? Affichage de l'état (utilitaire sas2ircu, LSI) 42Sommaire v Stratégies de remplacement d'un disque RAID 43 ? Pour identifier les chemins d’accès aux périphériques 43 Modification des informations d’identification du serveur 45 ? Pour modifier les informations sur les données FRU des clients 45 ? Pour modifier les informations d’identification du système 46 Configuration des paramètres de stratégie 47 ? Pour définir le mode de refroidissement 47 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage 48 ? Pour définir l’état d’alimentation de l’hôte au redémarrage 49 ? Pour désactiver ou réactiver le délai de mise sous tension 50 ? Pour définir l’initialisation parallèle du SP et de l’hôte 50 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé 51 Configuration des adresses réseau 53 Options d’adresse réseau du SP 53 ? Pour désactiver ou réactiver l’accès réseau au SP 54 ? Pour afficher l’adresse IP du serveur DHCP 54 ? Pour afficher l’adresse MAC de l’hôte 55 Utilisation d’une connexion in-band au SP 56 Gestion in-band (sideband) d’ILOM 56 ? Pour configurer l’accès in-band (sideband) au SP 57 Configuration du mode d’initialisation 61 Présentation du mode d’initialisation 61 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC 62 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations 64 ? Pour gérer le script du mode d’initialisation de l’hôte 65vi Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte 66 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur 66 Configuration du comportement du serveur au redémarrage 69 ? Pour définir le comportement de l’hôte à sa réinitialisation 69 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête 70 ? Pour définir l’intervalle du délai d’attente d’initialisation 70 ? Pour définir le comportement à l’expiration du délai d’initialisation 71 ? Pour définir le comportement en cas d’échec du redémarrage 71 ? Pour définir le nombre maximum de tentatives de redémarrage 72 Configuration des périphériques 73 ? Pour déconfigurer manuellement un périphérique 73 ? Pour reconfigurer manuellement un périphérique 74 Contrôle du serveur 75 Contrôle des pannes 75 Présentation des diagnostics 76 ? Pour détecter les pannes (ILOM) 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) 77 ? Pour détecter les pannes à l’aide du POST 79 ? Pour afficher l’historique de la console 80 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) 81 ? Pour effacer une panne 83 Activation de la récupération automatique du système 83 Présentation de la récupération automatique de système 84 ? Pour activer la fonction ASR 84 ? Pour désactiver la fonction ASR 85 ? Pour afficher des informations sur les composants concernés par l’ASR 86Sommaire vii ? Pour afficher les composants du serveur 86 ? Pour localiser le serveur 87 Mise à jour du microprogramme 89 ? Pour afficher la version du microprogramme 89 ? Pour mettre à jour le microprogramme 90 ? Pour afficher la version d’OpenBoot 92 ? Pour afficher la version de POST 93 Mise à jour du système d’exploitation Oracle Solaris 95 Syntaxe de nom universel 95 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) 99 probe-scsi-all Exemple de sortie (SPARC T3-4) 102 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs 103 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs 105 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) 107 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) 111 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique 115 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID 116 Index 119viii Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011ix Utilisation de cette documentation Ce guide d’administration s’adresse aux administrateurs système expérimentés des serveurs de la série SPARC T3 d’Oracle (ci-après appelé le « serveur »). Il comprend des informations descriptives générales sur le serveur ainsi que des instructions détaillées sur la configuration et l’administration du serveur. Pour utiliser les informations de ce document, vous devez maîtriser les concepts et la terminologie des réseaux informatiques ainsi que posséder une connaissance poussée du système d’exploitation Oracle Solaris (SE Oracle Solaris). Remarque – Le Guide d’administration des serveurs de la série SPARC T3 s’applique à plusieurs serveurs et modules serveur. Certains exemples utilisés dans ce document sont basés sur des modèles particuliers de serveur. C’est pourquoi votre sortie peut différer des exemples présentés selon le produit que vous utilisez. ¦ « Commandes UNIX », page ix ¦ « Invites de shell », page x ¦ « Documentation, support et formation », page x Commandes UNIX Ce document peut ne pas contenir d’informations sur les commandes et procédures UNIX de base telles que l’arrêt et le démarrage du système ou la configuration des périphériques. Vous trouverez de plus amples informations à ce sujet dans : ¦ la documentation accompagnant les logiciels livrés avec votre système ; ¦ la documentation relative au SE Oracle Solaris, disponible à l’adresse suivante : http://www.oracle.com/technetwork/indexes/documentation/ index.htmlx Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Invites de shell Documentation, support et formation Le site Web d'Oracle Technology Network contient des informations sur les ressources supplémentaires suivantes : ¦ Documentation (http://www.oracle.com/technetwork/indexes/ documentation/index.html) ¦ Support (https://support.oracle.com) ¦ Training (https://education.oracle.com) Shell Invite C shell nom-machine% Superutilisateur C shell nom-machine# Bourne shell et Korn shell $ Superutilisateur Bourne shell et Korn shell #1 Présentation des ressources de l’administration système Les sections suivantes présentent un récapitulatif des outils courants servant à administrer le serveur. ¦ « Présentation d’ILOM », page 1 ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ¦ « Logiciel de multiacheminement », page 6 ¦ « Présentation du pack de gestion du matériel », page 7 Présentation d’ILOM Oracle Integrated Lights Out Manager est un microprogramme de gestion système préinstallé sur les serveurs SPARC de la série T4. Il vous permet de gérer et de contrôler de manière active les composants installés sur le serveur. ILOM fournit une interface Web et une interface de ligne de commande, ainsi que les interfaces SNMP et IPMI. Le processeur de service ILOM fonctionne indépendamment du serveur et quel que soit l’état de marche du serveur, du moment que ce dernier (ou le système modulaire contenant le module serveur) est alimenté en courant CA. Lorsque vous connectez un serveur à une alimentation CA, le processeur de service ILOM démarre immédiatement et commence à contrôler le serveur. ILOM gère l’ensemble des tâches de surveillance et de contrôle environnementaux. L’invite -> indique que vous interagissez directement avec le processeur de service ILOM. Il s’agit de la première invite qui s’affiche lorsque vous vous connectez au serveur via le port de gestion série ou le port de gestion réseau, quel que soit l’état 2 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 d’alimentation de l’hôte. Sur un système modulaire, cette invite est également présente lorsque vous vous connectez à un module serveur soit directement soit via ILOM sur le module CMM du système modulaire. Vous pouvez également accéder à l’invite du processeur de service ILOM (->) à partir de l’invite ok de l’OpenBoot ou de l’invite # ou % d’Oracle Solaris, du moment que la console système est configurée pour être accessible via les ports de gestion série et réseau. Le processeur de service ILOM prend en charge un total de dix sessions simultanées par serveur : neuf connexions SSH via le port de gestion réseau et une via le port de gestion série. Pour plus d’informations sur l’utilisation des fonctions ILOM communes à toutes les plates-formes gérées par ILOM, consultez la documentation suivante à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage Informations connexes ¦ « Fonctions d’ILOM spécifiques à la plate-forme », page 3 ¦ « Pour se connecter à ILOM », page 11 Type d’information Titre Informations d’ordre conceptuel Guide des notions fondamentales sur Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur l’interface du navigateur Guide des procédures relatives à l’interface Web d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur les procédures CLI Guide des procédures relatives à la CLI d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations relatives aux protocoles SNMP et IPMI Oracle Integrated Lights Out Manager (ILOM) 3.0 Protocols Reference Guide (Guide de référence des protocoles de gestion d’Oracle Integrated Lights Out Manager (ILOM) 3.0) Informations relatives à l’installation et à la configuration Guide de démarrage d’Oracle Integrated Lights Out Manager (ILOM) 3.0 Informations sur le module CMM Oracle Integrated Lights Out Manager (ILOM) 3.0 CMM - Guide d’administration pour les systèmes modulaires 6000 et 6048 Présentation des ressources de l’administration système 3 Fonctions d’ILOM spécifiques à la plate-forme ILOM fonctionne sur diverses plates-formes, dont il prend en charge les fonctions qui leur sont communes. Certaines des fonctions d’ILOM sont limitées à un sous-ensemble de plates-formes. Cette section décrit la différence entre les fonctions d’ILOM prises en charge par le serveur et le jeu de fonctions communes décrit dans la documentation de base d’ILOM 3.0. Remarque – Pour effectuer certaines procédures décrites dans la documentation de base d’Oracle ILOM 3.0, vous devez établir une connexion série avec le serveur et activer le commutateur de présence physique sur ce dernier. Pour plus d’informations sur l’établissement d’une connexion série, reportez-vous au guide d’installation de votre serveur. Parmi les fonctions d’ILOM prises en charge sur d’autres plates-formes, les suivantes ne sont pas compatibles avec ce serveur : ¦ Fonctions du module de contrôle de châssis (CMM, Chassis Monitoring Module) telles que la connexion unique SSO (Single Sign On). Remarque : les serveurs lames T3 installés dans un système modulaire prennent en charge les fonctions du CMM. ¦ Déclencheur user-reset de diagnostics du POST non disponible ILOM prend en charge la fonction suivante sur ce serveur, mais cette dernière peut très bien ne pas être disponible sur d’autres plates-formes : ¦ Déclencheur hw-change de diagnostics du POST. Ce nouveau déclencheur (hw-change error-reset) constitue le paramètre par défaut du serveur. Il déclenche l’exécution du test POST chaque fois que le serveur est mis sous tension progressive CA ou que le capot du haut est retiré (le cas échéant). Pour plus d’informations sur le POST, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Présentation d’ILOM », page 14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation du SE Oracle Solaris Le SE Oracle Solaris comprend des commandes et d’autres ressources logicielles utilisées dans le cadre de l’administration du serveur. Pour une introduction aux outils de gestion de votre version d’Oracle Solaris, reportez-vous au manuel System Administration Guide: Basic Administration dans la collection de documents Oracle Solaris. Le logiciel SunVTS est inclus dans Oracle Solaris. Il permet de tester et de valider le matériel Oracle en contrôlant la connectivité et la fonctionnalité des périphériques, contrôleurs et dispositifs matériels. Outre les informations relatives à SunVTS contenues dans la documentation d’Oracle Solaris, les collections de documentation propres à SunVTS sont disponibles à l’adresse : http://www.oracle.com/pls/topic/lookup?ctx=E19719-01&id=homepage Informations connexes ¦ « Présentation d’OpenBoot », page 4 Présentation d’OpenBoot Le microprogramme OpenBoot démarre le système d’exploitation, valide le matériel installé et permet d’effectuer d’autres tâches d’administration serveur situées en dessous du niveau du SE. Pour plus d’informations sur les commandes d’OpenBoot, reportez-vous au manuel OpenBoot 4.x Command Reference Manual inclus dans la collection de documents Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4Présentation des ressources de l’administration système 5 Présentation d’Oracle VM Server pour SPARC Un domaine logique regroupe de manière logique et discrète ses propres ressources, systèmes d’exploitation et identité au sein d’un seul système informatique. Les applications logicielles peuvent être exécutées dans les domaines logiques. Il est possible de créer, de détruire, de reconfigurer et de réinitialiser chaque domaine logique indépendamment des autres. Le logiciel Oracle VM Server pour SPARC vous permet de créer et de gérer jusqu’à 32 domaines logiques en fonction de la configuration matérielle du serveur sur lequel Oracle VM Server pour SPARC Manager est installé. Vous avez la possibilité de virtualiser les ressources et de définir des périphériques réseau, de stockage et d’E/S en tant que services pouvant être partagés entre les différents domaines. Les configurations Oracle VM Server pour SPARC sont stockées sur le SP. A l’aide des commandes de la CLI d’Oracle VM Server pour SPARC, vous pouvez ajouter une configuration, spécifier la configuration à utiliser et répertorier les configurations figurant sur le processeur de service. Vous avez également la possibilité d’utiliser la commande set /HOST/bootmode config=fichier_de_configuration d’ILOM pour indiquer la configuration d’initialisation d’Oracle VM Server. Informations connexes ¦ « Configuration du mode d’initialisation », page 61 ¦ Documentation d'Oracle VM Server pour SPARC http://www.oracle.com/technetwork/documentation/vm-sparc-19428 7.html6 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Logiciel de multiacheminement Le logiciel de multiacheminement vous permet de définir et de contrôler les chemins physiques redondants des périphériques d’E/S, tels que les périphériques de stockage et les interfaces réseau. Si le chemin d’accès actif à un périphérique devient indisponible, le logiciel peut automatiquement basculer sur un chemin secondaire pour maintenir la disponibilité. Cette fonction est connue sous l’appellation de basculement automatique. Pour tirer parti des fonctions de multiacheminement, vous devez configurer le serveur avec du matériel redondant, par exemple des interfaces réseau redondantes ou deux adaptateurs de bus hôte connectés à la même baie de stockage à double accès. Pour le serveur, trois types différents de logiciel de multiacheminement sont disponibles : ¦ Le logiciel Oracle Solaris IP Network Multipathing assure le multiacheminement et l’équilibrage de charge pour les interfaces réseau IP. Pour des instructions de configuration et d’administration du logiciel Oracle Solaris IP Network Multipathing, consultez le manuel IP Network Multipathing Administration Guide fourni avec votre version d’Oracle Solaris. ¦ Le logiciel VVM inclut une fonction appelée DMP, qui assure le multiacheminement pour les disques ainsi que l’équilibrage de charge des disques en vue d’optimiser le débit d’E/S. Pour des informations sur VVM et sa fonction DMP, reportez-vous à la documentation qui accompagne le logiciel VERITAS Vo lume Ma na ger. ¦ StorageTek Traffic Manager est une architecture entièrement intégrée au sein du SE Oracle Solaris (à partir de la version Oracle Solaris 8) qui permet d’accéder aux périphériques d’E/S par le biais de plusieurs interfaces de contrôleur hôte depuis une unique instance du périphérique d’E/S. Pour plus d’informations sur StorageTek Traffic Manager, reportez-vous à la documentation de votre SE Oracle Solaris. Informations connexes ¦ « Présentation du SE Oracle Solaris », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5Présentation des ressources de l’administration système 7 Présentation du pack de gestion du matériel Le pack de gestion du matériel (HMP) des serveurs Sun d'Oracle fournit des outils qui permettent de gérer et de configurer les serveurs Oracle à partir du système d'exploitation de l'hôte. Pour utiliser ces outils, vous devez installer le logiciel HMP sur votre serveur. Une fois le logiciel installé, vous pouvez effectuer les tâches de gestion de serveur décrites dans le tableau ci-après. TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel Outil Surveillance du matériel Oracle avec l'adresse IP de l'hôte Utilisez l'agent de gestion du matériel et les plug-ins du protocole SNMP (Simple Network Management Protocol) au niveau du système d'exploitation pour activer la surveillance in-band de votre matériel Oracle. Cette fonctionnalité de surveillance in-band vous permet d'utiliser l'adresse IP du système d'exploitation hôte pour surveiller vos serveurs Oracle sans connecter le port de gestion Oracle ILOM à votre réseau. Outil de gestion au niveau du système d'exploitation hôte Surveillance des périphériques de stockage, notamment des baies de disque RAID Utilisez l'agent de gestion du stockage du serveur au niveau du système d'exploitation pour activer la surveillance in-band des périphériques de stockage configurés sur vos serveurs Oracle. L'agent de gestion du stockage du serveur fournit un démon de système d'exploitation qui collecte des informations sur les périphériques de stockage du serveur, notamment les disques durs et les baies RAID, puis les envoie au processeur de service Oracle ILOM. Les fonctions de surveillance du stockage dans Oracle ILOM vous permettent de consulter et de surveiller les informations fournies par l'agent de gestion du stockage du serveur. Vous pouvez accéder aux fonctions de surveillance du stockage dans Oracle ILOM à partir de l'interface de ligne de commande (CLI). Fonctions de surveillance du stockage de la CLI Oracle ILOM 3.0 Interrogation, mise à jour et validation des versions de microprogramme sur les périphériques de stockage SAS pris en charge Utilisez l'outil CLI fwupdate à partir du système d'exploitation hôte pour interroger, mettre à jour et valider les versions de microprogramme sur les périphériques de stockage pris en charge, tels que les adaptateurs de bus hôte SAS (HBA), les contrôleurs de stockage SAS intégrés, les expandeurs de stockage SAS LSI et les disques durs. CLI fwupdate au niveau du SE hôte8 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Source du téléchargement du logiciel HMP (pack de gestion du matériel) Vous pouvez télécharger le logiciel HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://support.oracle.com Restauration, définition et consultation des paramètres de configuration d'Oracle ILOM Utilisez l'outil CLI ilomconfig à partir du système d'exploitation hôte pour restaurer les paramètres de configuration d'Oracle ILOM, ainsi que pour consulter et définir les propriétés d'Oracle ILOM associées à la gestion du réseau, la configuration de l'horloge et la gestion des utilisateurs. CLI ilomconfig au niveau du SE hôte Affichage ou création de volumes RAID sur des unités de stockage Utilisez l'outil CLI raidconfig à partir du système d'exploitation hôte pour consulter et créer des volumes RAID sur les unités de stockage connectées aux contrôleurs RAID, notamment les baies de stockage. CLI raidconfig au niveau du SE hôte Utilisation de l'outil IPMItool pour accéder aux serveurs Oracle et les gérer Utilisez la ligne de commande « open source » IPMItool à partir du système d'exploitation hôte pour accéder aux serveurs Oracle et les gérer à l'aide du protocole IPMI. Ligne de commande IMPItool au niveau du SE hôte * Les systèmes d'exploitation pris en charge sont les suivants : Solaris, Linux, Windows et VMware TABLEAU : Pack de gestion du matériel : Tâches de gestion de serveur (suite) Tâche de gestion de serveur A partir du système d'exploitation hôte * Implémentation du pack de gestion du matériel OutilPrésentation des ressources de l’administration système 9 Source du téléchargement de la documentation HMP (pack de gestion du matériel) Vous pouvez télécharger la documentation HMP (pack de gestion du matériel) à partir de l'adresse suivante : http://www.oracle.com/technetwork/documentation/sys-mgmt-network ing-190072.html Remarque – La documentation du pack de gestion du matériel version 2.1 fournie sur ce site est valable pour le pack de gestion du matériel version 2.1.1. Pour plus d'informations sur l'utilisation des fonctions de contrôle de stockage dans Oracle ILOM, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide (Guide des notions fondamentales d'Oracle Integrated Lights Out Manager (ILOM) 3.0) et au Oracle Integrated Lights Out Manager (ILOM) 3.0 CLI Procedures Guide (Guide des procédures relatives à la CLI d'Oracle Integrated Lights Out Manager (ILOM) 3.0). Pour plus d'informations sur l'accès et la gestion d'un serveur via SNMP ou IPMI, reportez-vous au Oracle Integrated Lights Out Manager (ILOM) 3.0 Management Protocols Reference Guide (Guide des références des protocoles de gestion Oracle Integrated Lights Out Manager (ILOM) 3.0). Les liens vers ces manuels Oracle ILOM sont fournis sur le site Web indiqué ci-dessus. Vous trouverez l'intégralité de la documentation Oracle ILOM à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id=homepage10 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201111 Accès au serveur Les sections suivantes présentent des informations relatives à l’établissement de communications de bas niveau avec le serveur à l’aide de l’outil ILOM et de la console système. ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour se connecter à la console système », page 12 ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « ILOM Remote Console », page 17 ? Pour se connecter à ILOM Dans cette procédure, il est supposé que vous utilisez la configuration par défaut du processeur de service comme décrite dans le guide d’installation du serveur. Remarque – Pour un module serveur SPARC T3, consultez le guide d’installation qui contient des instructions relatives au démarrage d’ILOM via le module CMM du système modulaire, ainsi que des instructions concernant la connexion directe au processeur de service sur le module serveur.12 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Ouvrez une session SSH et connectez-vous au SP en spécifiant son adresse IP. Le nom d’utilisateur par défaut ILOM est root et le mot de passe par défaut est changeme. Vous êtes à présent connecté à ILOM. Exécutez les tâches nécessaires. Remarque – Pour bénéficier d’une sécurité optimale sur le serveur, changez le mot de passe par défaut de ce dernier. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à la console système », page 12 ? Pour se connecter à la console système ? A l’invite -> d’ILOM, tapez : où option correspond à l’une des valeurs suivantes : % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright 2010 Oracle and/or its affiliates. All rights reserved. -> -> start /HOST/console [-option] Are you sure you want to start /HOST/console (y/n) ? y Serial console started. To stop, type #. . . .Accès au serveur 13 ¦ -f|force : permet à un utilisateur doté du rôle Console (c) de prendre la console à l’utilisateur qui y est connecté et d’obliger ce dernier à utiliser le mode de visualisation. ¦ -script : contourne l’invite de confirmation (yes ou no). Remarque – Si le SE Oracle Solaris n’est pas en cours d’exécution, le serveur affiche l’invite ok. Informations connexes ¦ « Pour afficher l’invite -> d’ILOM », page 15 ¦ « Pour utiliser un moniteur graphique local », page 15 ¦ « Pour se connecter à ILOM », page 11 ? Pour afficher l’invite ok Dans cette procédure, il est supposé que vous utilisez la configuration par défaut de la console système. ? Dans le tableau suivant, choisissez la méthode d’arrêt appropriée pour accéder à l’invite ok. Pour s'assurer que l'invite ok s'affiche, définissez la propriété ILOM suivante avant d'exécuter les procédures décrites dans le tableau : -> set /HOST/bootmode script=”setenv auto-boot? false”14 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Attention – Dans la mesure du possible, affichez l’invite ok en effectuant un arrêt progressif du SE. Toute autre méthode risque d'entraîner la perte des informations d'état du serveur. Informations connexes ¦ « Contrôle des pannes », page 75 Etat du serveur Procédure à suivre SE en cours d’exécution et réactif Arrêtez le serveur en utilisant l’une des méthodes suivantes : • Dans une fenêtre d’utilitaire de shell ou de commande, tapez une commande appropriée (par exemple, la commande shutdown ou init 0), comme décrit dans la documentation relative à l’administration système d’Oracle Solaris. • A l’invite -> d’ILOM, tapez : -> stop /SYS • Appuyez sur le bouton de marche/arrêt du serveur. • A partir d’Oracle Solaris, exécutez la commande suivante en tant qu’utilisateur root : # uadmin 2 0 SE non réactif Arrêtez le serveur à partir d’ILOM. (à condition que le logiciel de système d’exploitation ne soit pas en cours d’exécution et que le serveur soit déjà sous le contrôle du microprogramme OpenBoot) A l’invite -> d’ILOM, tapez : -> set /HOST send_break_action=break Appuyez sur Entrée. Tapez ensuite : -> start /HOST/console SE non réactif et initialisation automatique devant être empêchée Arrêtez le serveur à partir d’ILOM et désactivez la fonction d’initialisation automatique. A l’invite -> d’ILOM, tapez : -> set /HOST/bootmode script=”setenv auto-boot? false” Appuyez sur Entrée. Tapez ensuite : -> reset /SYS -> start /HOST/consoleAccès au serveur 15 ? Pour afficher l’invite -> d’ILOM ? Utilisez l’une des méthodes suivantes pour afficher l’invite -> d’ILOM : ¦ A partir de la console système, tapez la séquence d’échappement (#.) d’ILOM. ¦ Connectez-vous directement à ILOM à partir d’un périphérique relié au port de gestion série ou au port de gestion réseau. ¦ Connectez-vous à ILOM via une connexion SSH. Reportez-vous à la section « Pour se connecter à ILOM », page 11. Informations connexes ¦ « Présentation d’ILOM », page 1 ¦ « Pour se connecter à ILOM », page 11 ? Pour utiliser un moniteur graphique local Vous pouvez rediriger la console système vers un moniteur graphique local. Vous ne pouvez pas utiliser un moniteur graphique local pour effectuer l’installation initiale du serveur, ni pour afficher les messages de l’autotest de l’allumage (POST). Pour utiliser un moniteur graphique local : 1. Connectez le câble vidéo du moniteur à un port vidéo du serveur. Fixez les vis à serrage à main pour maintenir la connexion. Reportez-vous à la documentation de votre système pour connaître les instructions de connexion qui peuvent s’appliquer à votre serveur. 2. Branchez le cordon d’alimentation du moniteur sur une prise CA. 3. Connectez le câble de clavier USB à un port USB. 4. Connectez le câble de souris USB à un autre port USB sur le serveur. 5. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13.16 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 6. A l’invite ok, définissez les variables de configuration OpenBoot PROM suivantes : 7. Pour appliquer vos modifications, tapez : Le serveur enregistre les modifications de paramètres et s’initialise automatiquement. Remarque – Au lieu d’utiliser la commande reset-all pour stocker les modifications de paramètres, vous pouvez également mettre le serveur progressivement sous tension à l’aide du bouton de marche/arrêt. Vous pouvez à présent exécuter des commandes système et afficher les messages du système en utilisant le moniteur graphique local. Pour activer l’interface graphique, passez à l’étape suivante. 8. Activez l’interface graphique du SE Oracle Solaris. Une fois que le SE Oracle Solaris est installé et initialisé, tapez les commandes suivantes afin d’afficher l’écran de connexion de l’IG. Informations connexes ¦ « Pour afficher l’invite ok », page 13. ¦ « ILOM Remote Console », page 17 ok setenv input-device keyboard ok setenv output-device screen ok reset-all # ln -s /dev/fbs/ast0 /dev/fb # fbconfig -xserver Xorg # rebootAccès au serveur 17 ILOM Remote Console ILOM Remote Console est une application Java vous permettant de rediriger et de contrôler à distance les périphériques suivants sur un serveur hôte. Ce groupe de périphériques est couramment désigné par l’abréviation KVMS (Keyboard, Video, Mouse, Storage, c’est-à-dire clavier, vidéo, souris et stockage). ¦ Clavier ¦ Affichage vidéo de la console ¦ Souris ¦ Affichage série de la console ¦ Périphériques de stockage ou images (CD/DVD) ILOM Remote Console est documentée dans le manuel Oracle Integrated Lights Out Manager (ILOM) 3.0 Web Interface Procedures Guide (à la section « Managing Remote Hosts Redirection and Securing the ILOM Remote Console »). Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 5618 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201119 Contrôle du serveur Les sections suivantes présentent les procédures de commande des opérations de base relatives au serveur. ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Pour rétablir les valeurs par défaut du SP », page 23 ? Pour mettre le serveur sous tension 1. Connectez-vous à ILOM. « Pour se connecter à ILOM », page 11. Remarque – Si vous disposez d’un système modulaire, assurez-vous que vous n’êtes pas connecté au module serveur souhaité. 2. A l’invite -> d’ILOM, tapez : Remarque – Pour éviter d’avoir à confirmer, utilisez la commande start -script /SYS. -> start /SYS Are you sure you want to start /SYS (y/n) ? y Starting /SYS ->20 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour mettre le serveur hors tension 1. Arrêtez le SE Oracle Solaris. A l’invite Oracle Solaris, tapez : 2. Passez de l’invite de la console système à celle de la console du processeur de service. 3. A partir de l’invite -> d’ILOM, tapez ce qui suit : Remarque – Pour exécuter un arrêt immédiat, utilisez la commande stop -force -script /SYS. Vérifiez que toutes les données sont enregistrées avant de taper cette commande. # shutdown -g0 -i0 -y # svc.startd: The system is coming down. Please wait. svc.startd: 91 system services are now being stopped. Jun 12 19:46:57 wgs41-58 syslogd: going down on signal 15 svc.stard: The system is down. syncing file systems...done Program terminated r)eboot o)k prompt, h)alt? # o ok #. -> -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS ->Contrôle du serveur 21 Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ? Pour réinitialiser le serveur à partir du SE Oracle Solaris Il est inutile de mettre le serveur hors puis sous tension pour effectuer une réinitialisation. ? Pour réinitialiser le serveur à partir de l’invite d’Oracle Solaris, tapez l’une des commandes suivantes : ou Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 # shutdown -g0 -i6 -y # reboot22 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour réinitialiser le serveur à partir d’ILOM La commande reset d’ILOM entraîne une réinitialisation matérielle progressive ou forcée du serveur. Par défaut, la commande reset effectue une réinitialisation progressive du serveur. ? Tapez l’une des commandes suivantes pour réinitialiser le serveur. ¦ Procédez à une réinitialisation progressive à partir d’ILOM : ¦ Si cette opération est impossible, effectuez une réinitialisation matérielle forcée à partir d’ILOM : Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 -> reset /SYS -> reset -force /SYSContrôle du serveur 23 ? Pour rétablir les valeurs par défaut du SP Si le processeur de service (SP) est endommagé ou que vous souhaitez rétablir ses valeurs par défaut définies en usine, modifiez le paramètre /SP reset_to_defaults, puis mettez l’hôte hors tension afin d’appliquer les modifications. Il s’agit d’un nouveau comportement. Dans les versions précédentes, il était inutile de mettre l’hôte hors tension pour rétablir les valeurs par défaut du SP. Vous devez disposer des autorisations d’administrateur pour effectuer cette tâche. 1. Pour rétablir les valeurs par défaut du SP, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ all : supprime l’ensemble des données de configuration du SP. ¦ factory : supprime l’ensemble des données de configuration du SP de même que tous les fichiers journaux. 2. La mise hors tension suivie du redémarrage de l’hôte permet d’achever les changements de paramètres. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 -> set /SP reset_to_defaults=value -> stop /SYS -> reset /SP24 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201125 Configuration de volumes RAID matériels Les sections suivantes décrivent les procédures de configuration et de gestion des volumes de disques RAID à l’aide des contrôleurs de disque SAS intégrés du serveur. ¦ « Prise en charge des volumes RAID matériels », page 25 ¦ « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28 ¦ « Affichage des informations de zone de disques », page 29 ¦ « Activation et désactivation du zonage des disques dans le champ », page 33 ¦ « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Disques hot spare de volumes RAID (LSI) », page 39 ¦ « Diagnostic de l'état de fonctionnement d'un disque », page 40 ¦ « Stratégies de remplacement d'un disque RAID », page 43 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 Prise en charge des volumes RAID matériels Les serveurs de la série SPARC T3 contiennent des contrôleurs RAID SAS 2 intégrés qui permettent la formation de volumes de disques logiques composés d'un ou plusieurs disques durs redondants. Ces contrôleurs prennent en charge les niveaux RAID suivants : ¦ RAID 0 : répartition des données26 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ RAID 1 : mise en miroir des données (à l'aide de deux disques) ¦ RAID 1e : mise en miroir améliorée (à l'aide de trois à huit disques) La répartition des données fait référence à la technique de distribution des fichiers de données sur plusieurs disques, de sorte que le stockage et la récupération puissent être effectués en parallèle sur plusieurs canaux de données. La répartition des données peut réduire le temps nécessaire à la lecture et l'écriture des fichiers de données. La mise en miroir des données fait référence à la technique de stockage de copies identiques de données sur des disques séparés. La mise en miroir des données critiques permet de réduire les risques de perte de données grâce à la création d'instances dupliquées des données. Le tableau suivant décrit les ressources des contrôleurs RAID par défaut fournies sur les différents serveurs de la série SPARC T3. TABLEAU : Contrôleurs SAS-2 intégrés sur les serveurs de la série SPARC T3 Modèle SPARC T3 Détails du contrôleur SAS-2 intégré et du fond de panier de disques T3-1 Deux contrôleurs intégrés et un fond de panier de disques. Il existe deux versions du fond de panier de disques T3-1 : Capacité de huit disques : – Le contrôleur 0 gère les emplacements de disque 0 à 3 – Le contrôleur 1 gère les emplacements de disque 4 à 7 Capacité de seize disques (zones activées) : * – Le contrôleur 0 gère les emplacements de disque 0 à 7 – Le contrôleur 1 gère les emplacements de disque 8 à 15 * Les fonds de panier d'une capacité de seize disques doivent être divisés en deux zones de huit disques. Pour plus d’informations, reportez-vous à la section « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. T3-1B Un contrôleur intégré et deux fonds de panier de disques dotés de deux emplacements de disque chacun. Le contrôleur intégré est connecté aux deux fonds de panier par deux câbles de données et deux câbles d'alimentation. T3-2 Un contrôleur intégré et un fond de panier de disques doté de six emplacements de disque. Le contrôleur intégré est connecté au fond de panier par deux câbles de données distincts. T3-4 Aucun contrôleur intégré, deux modules d'extension RAID (REM) enfichables internes et deux fonds de panier de disques : – REM 0 gère les emplacements de disque 0 à 3 (fond de panier 0) – REM 1 gère les emplacements de disque 4 à 7 (fond de panier 1)Configuration de volumes RAID matériels 27 Chaque contrôleur SAS-2 vous permet de créer jusqu'à deux volumes RAID contenant des disques connectés à ce contrôleur. Un volume ne peut pas contenir des disques connectés à un autre contrôleur. Vous avez le choix entre trois environnements pour créer et gérer les ressources RAID sur votre serveur. ¦ Utilitaire Fcode : Cet utilitaire se compose d’un ensemble de commandes permettant d’afficher les cibles et de gérer les volumes logiques de votre serveur. Vous accédez à ces commandes via l'environnement OpenBoot PROM (OBP). Les exemples figurant dans ce manuel s'appuient sur les commandes Fcode. ¦ Utilitaire de gestion LSI SAS2 2008 RAID pour serveurs SPARC T3 : Vous pouvez utiliser les commandes sas2ircu contenues dans l'utilitaire de configuration intégré LSI SAS2 pour configurer et gérer les volumes RAID sur votre serveur. Pour utiliser le jeu de commandes sas2ircu, téléchargez et installez le logiciel SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/index.aspx Vous pouvez télécharger la documentation SAS2IRCU à partir de l'adresse suivante : http://www.lsi.com/sep/Pages/oracle/sparc_t3_series.aspx ¦ Pack de gestion du matériel Oracle 2.1.1 : Vous pouvez utiliser les commandes RAIDconfig figurant dans le compostant Outils de l'interface CLI des serveurs Oracle de ce logiciel pour créer et gérer des volumes RAID sur votre serveur. Pour utiliser ces commandes, téléchargez et installez la toute dernière version du pack de gestion du matériel à partir du site My Oracle Support : http://support.oracle.com/CSP/ui/flash.html Cliquez sur le lien suivant pour accéder au guide d'installation du pack de gestion du matériel Oracle 2.1. http://download.oracle.com/docs/cd/E19960-01/index.html Remarque – La version 2.1.1 est la plus ancienne version du pack de gestion du matériel Oracle prenant en charge les serveurs de la série SPARC T3. Vous trouverez une documentation complète sur l'utilisation du pack de gestion du matériel version 2.1 à l'adresse suivante : http://www.oracle.com/pls/topic/lookup?ctx=mgtpk21&id=homepage28 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Conseil – Certaines commandes du pack de gestion du matériel 2.1.1 présentent parfois de longs délais de démarrage ou d'exécution sur les serveurs SPARC T3-2 and T3-4. Dans de tels cas, vous pouvez, si vous le préférez, utiliser les commandes Fcode ou LSI sas2ircu. Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques Chaque fois qu'un fond de panier à seize disques SPARC T3-1 est géré par des contrôleurs SAS-2 intégrés, le fond de panier doit être divisé en deux zones logiques, à raison de huit emplacements de disque par zone : ¦ Zone A : Contient les emplacements de fond de panier 0 à 7 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 0. ¦ Zone B : Contient les emplacements de fond de panier 8 à 15 qui ne peuvent être vus que par le contrôleur SAS-2 numéro 1. Le zonage des disques nécessite que le microprogramme de l'expandeur LSI du fond de panier dispose au minimum du patch 147034-01. Ce patch crée les zones de disques requises. Remarque – Pour plus d'informations sur le patch 147034-01, reportez-vous à son document LISEZ-MOI (README.147034) sur le site My Oracle Support. Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35.Configuration de volumes RAID matériels 29 Si une carte HBA RAID PCIe interne est utilisée pour gérer le fond de panier des disques au lieu des contrôleurs intégrés, les zones de disques doivent être désactivées. La plupart des serveurs SPARC T3-1 dotés de fonds de panier à seize disques sont livrés avec le zonage activé. Il existe deux exceptions à cette règle par défaut : ¦ Le zonage est désactivé à l'usine lorsqu'un système SPARC T3-1 doté d'un fond de panier à seize disques est fabriqué avec une carte HBA RAID PCIe interne. ¦ Les systèmes SPARC T3-1 fabriqués avec des fonds de panier à 16 disques avant que le zonage des disques ne devienne une spécification par défaut étaient livrés sans le patch 147034-01. Pour ces systèmes, le patch doit être installé dans le champ pour prendre en charge le zonage des disques. La version 2.1.1 du pack de gestion du matériel des serveurs Sun d'Oracle inclut un utilitaire de zonage de disques que vous pouvez utiliser pour activer et désactiver le zonage, ainsi que pour afficher les informations d'état des zones. Voir « Activation et désactivation du zonage des disques dans le champ », page 33 et « Affichage des informations de zone de disques », page 29 pour plus d'informations. Remarque – Les contrôleurs n'étant pas en mesure de voir les disques au delà d'une zone, un contrôleur SAS-2 ne peut pas créer un volume RAID qui contient des disques inclus dans l'autre zone. Vous pouvez utiliser l'utilitaire zoningcli pour activer ou désactiver le zonage dans un fond de panier à seize disques. Pour plus d’informations, reportez-vous à la section « Activation et désactivation du zonage des disques dans le champ », page 33. Affichage des informations de zone de disques Ces rubriques décrivent deux méthodes d'accès aux informations de zonage de disques. ¦ « Etat des zones de disques (zoningcli list) », page 30 ¦ « Etat des zones de disques (probe-scsi-all) », page 3130 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Etat des zones de disques (zoningcli list) Si le pack de gestion du matériel version 2.1.1 (ou une version plus récente) est installé sur votre système, vous pouvez utiliser la commande zoningcli list pour déterminer si le zonage est activé ou non. L'état du zonage est indiqué sur la première ligne de la sortie dans chacun des exemples suivants. Le zonage est désactivé : Le zonage est activé : Si l'utilitaire zoningcli n'est pas disponible sur votre système, vous pouvez utiliser la commande OBP probe-scsi-all afin de déterminer si le zonage est activé ou non. Reportez-vous à la section « Etat des zones de disques (probe-scsi-all) », page 31. # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: disable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 =================================================== # zoningcli list expander Expander: SUN SAS2 X16DBP zoning: enable <==== =================================================== PHY SAS ADDRESS ZG ZG Persist att-dev att-id =================================================== 00 5000c50017b0c149 010 1 01 00 01 5000c5000576a349 010 1 01 00 [...] 25 0000000000000000 001 1 00 00 ===================================================Configuration de volumes RAID matériels 31 Etat des zones de disques (probe-scsi-all) Les exemples de sortie de la commande probe-scsi-all suivants illustrent la différence d'affichage des périphériques de stockage lorsque le zonage est activé et lorsqu'il est désactivé. 10 disques sont représentés dans les deux exemples. Ils sont identifiés comme PhyNum 0 à 9. Remarque – Les entrées PhyNum 1 à 6 ne sont pas indiquées dans ces exemples afin de réduire leur taille. Les entrées omises n'affectent pas l'illustration du concept. Le zonage est désactivé : Lorsque le zonage est désactivé, les deux contrôleurs sont en mesure de voir tous les disques. L'exemple suivant illustre ce point en répertoriant tous les disques avec le contrôleur 0 et ceux avec le contrôleur 1. Conseil – Notez que les valeurs SASDeviceName et SASAddress de chaque PhyNum répertorié sous le contrôleur 1 correspondent aux valeurs DeviceName et SASAddress du PhyNum répertorié sous le contrôleur 0. Ceci est également valable pour PhyNum 1 à 6 qui ont été omis pour réduire la taille de la table. {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 12 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 13 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 1432 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Le zonage est activé : Dans l'exemple suivant, le zonage est activé et chaque disque est illustré connecté à un seul contrôleur SAS-2. PhyNum 0 à 7 sont connectés au contrôleur 0 et PhyNum 8 à 9 sont connectés au contrôleur 1. Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 15 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Target 13 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target 14 Unit 0 Encl Serv device SUN SAS2 X16DBP 0302 SASAddress 500605b0000272bd PhyNum 18 {0} ok {0} ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <==== Controller 1 FCode Version 1.00.56, MPT Version 2.00, Firmware Version 5.00.13.00 Target a Unit 0 Disk SEAGATE ST914603SSUN146G 0768 286739329 Blocks, 146 GB SASDeviceName 5000c50012ef2247 SASAddress 5000c50012ef2245 PhyNum 8 Configuration de volumes RAID matériels 33 Activation et désactivation du zonage des disques dans le champ Ces rubriques décrivent comment activer et désactiver les zones de disques dans le champ. Remarque – Vous devez disposer de la version 2.1.1 du pack de gestion du matériel d'Oracle (ou une version plus récente) pour avoir accès à la commande zoningcli. ¦ « Activation des zones de disques (commande zoningcli) », page 34 ¦ « Désactivation des zones de disques (commande zoningcli) », page 34 ¦ « Mise à jour du microprogramme pour activer le zonage », page 34 Target b Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d49c77 SASAddress 5000c50003d49c75 PhyNum 9 Target c Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 Target d Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 /pci@400/pci@1/pci@0/pci@4/scsi@0 <==== Controller 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c50017b0c14b SASAddress 5000c50017b0c149 PhyNum 0 [PhyNum 1-6 are omitted to conserve space.] Target 11 Unit 0 Disk SEAGATE ST973402SSUN72G 0400 143374738 Blocks, 73 GB SASDeviceName 5000c50003d5c6a3 SASAddress 5000c50003d5c6a1 PhyNum 7 Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 {0} ok34 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Activation des zones de disques (commande zoningcli) ? Si le zonage a été désactivé, vous pouvez l'activer en exécutant la commande suivante : ? Désactivation des zones de disques (commande zoningcli) ? Si le zonage a été activé, vous pouvez le désactiver en exécutant la commande suivante : ? Mise à jour du microprogramme pour activer le zonage Si votre serveur SPARC T3-1 nécessite un zonage de disques alors qu'il ne dispose pas du niveau de microprogramme système minimal et/ou que le microprogramme LSI du fond de panier ne dispose pas du patch 147034-01, procédez comme suit pour que les contrôleurs fonctionnent correctement. Attention – Veillez à sauvegarder toutes les données stockées sur les disques avant d'installer ce patch. Vous pouvez restaurer les fichiers une fois que le patch est installé. ? Appliquez le patch 147034-01 au microprogramme LSI sur le fond de panier des disques. Ce patch entraîne le partitionnement du fond de panier en deux zones de huit disques décrites dans « Zones de disques pour serveurs SPARC T3-1 dotés de fonds de panier à seize disques », page 28. # zoningcli enable zoning # zoningcli disable zoningConfiguration de volumes RAID matériels 35 Conseil – Lorsque le zonage est activé, la commande devalias pour les emplacements 8 à 15 est incorrecte sauf si le microprogramme système est mis à jour avec la version 8.0.5.b (ou une version plus récente de la version 8.0) ou avec la version 8.1.0 (ou une version plus récente). Pour plus d’informations, reportez-vous à la section « Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs », page 35. Microprogramme système minimal pour assurer la validité de devalias dans les emplacements de disque supérieurs Pour que la commande devalias soit valide pour les emplacements de disque 8 à 15, le niveau du microprogramme système doit être 8.0.5.b (ou un niveau supérieur à 8.0) ou 8.1.0.c (ou un niveau supérieur). Si le microprogramme système de votre serveur ne répond pas à la configuration minimale, vous devez utiliser le chemin d'accès complet au disque afin d'identifier les disques individuels de la plage 8 à 15. Par exemple, s'il est en cours d'exécution avec le niveau minimal du microprogramme système et la commande devalias appropriée, vous pouvez utiliser la ligne de commande suivante pour démarrer le système à partir du disque se trouvant à l'emplacement 12 : Si l'emplacement du disque est un emplacement compris entre 8 et 15 et que le niveau du microprogramme système ne répond pas aux exigences décrites ci-dessus, vous devez indiquer le chemin complet d'accès au périphérique pour le disque d'initialisation. Cet exemple illustre le chemin d'accès du disque 12 : # boot disk12 # boot /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p10c36 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour préparer l’utilisation de l’utilitaire FCode 1. Ouvrez une fenêtre de terminal xterm ou gnome. Les commandes FCode génèrent une sortie détaillée volumineuse. Les fenêtres de terminal xterm ou gnome offrent cependant une fonctionnalité de barre de défilement, destinée à faciliter la visualisation de la sortie. 2. Désactivez le paramètre auto-boot dans OBP et activez l’environnement OBP après une mise sous tension ou une réinitialisation. 3. La commande show-devs dresse la liste des chemins de périphériques connectés au serveur. Remarque – Dans le cas d’un module serveur, le chemin d’accès au périphérique peut correspondre à /pci@400/pci@1/pci@0/pci@2/LSI,sas@0. 4. La commande select vous permet de choisir le contrôleur sur lequel vous souhaitez créer un volume RAID matériel. Au lieu d’utiliser l’intégralité du chemin d’accès au périphérique pour le contrôleur, vous pouvez définir un alias préconfiguré à associer à ce dernier. Par exemple : Pour afficher les alias préconfigurés sur le serveur, exécutez la commande devalias. Reportez-vous à la section « Pour identifier les chemins d’accès aux périphériques », page 43. Affichez les adresses SAS des unités connectées à l’aide de la commande show-children. {0} ok show-devs ... /pci@400/pci@1/pci@0/pci@4/scsi@0 /pci@400/pci@2/pci@0/pci@4/scsi@0 ... {0} ok select /pci@400/pci@2/pci@0/pci@4/scsi@0 {0} ok select scsi0Configuration de volumes RAID matériels 37 Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Commandes de l’utilitaire FCode Informations connexes ¦ « Pour créer un volume RAID matériel », page 38 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 Commande FCode Description show-children Dresse la liste complète des unités physiques et des volumes logiques connectés. show-volumes Dresse une liste détaillée des volumes logiques connectés. create-raid0-volume Crée un volume RAID 0 (au minimum deux cibles). create-raid1-volume Crée un volume RAID 1 (exactement deux cibles). create-raid1e-volume Crée un volume RAID 1e (au minimum trois cibles). delete-volume Supprime un volume RAID. activate-volume Réactive un volume RAID après le remplacement de disques.38 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour créer un volume RAID matériel 1. Préparez la création du volume RAID. Reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 2. La commande show-children permet de répertorier les unités physiques situées sur le contrôleur sélectionné. 3. Exécutez la commande create-raid0-volume, create-raid1-volume ou create-raid1e-volume pour créer une unité logique à partir des disques physiques. Par exemple, pour créer un volume RAID 0 avec les cibles 9 et a, commencez par spécifier les cibles, puis tapez la commande create : Par exemple, pour créer un volume RAID 1e avec les cibles a, b et c, tapez : {0} ok show-children FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001771776f SASAddress 5000c5001771776d PhyNum 0 Target a Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c38c7 SASAddress 5000c5001d0c38c5 PhyNum 1 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097407 SASAddress 5000c5001d097405 PhyNum 2 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09a51f SASAddress 5000c5001d09a51d PhyNum 3 {0} ok {0} ok 9 a create-raid0-volume {0} ok a b c create-raid1e-volumeConfiguration de volumes RAID matériels 39 4. Pour vérifier la création du volume, tapez : 5. Saisissez unselect-dev pour désélectionner le contrôleur. Informations connexes ¦ « Commandes de l’utilitaire FCode », page 37 ¦ « Pour afficher l’invite ok », page 13 Disques hot spare de volumes RAID (LSI) Vous pouvez configurer deux disques hot spare globaux pour protéger les données figurant sur des volumes RAID mis en miroir. Si l'un des disques d'un volume RAID 1 ou RAID 1E mis en miroir échoue, le contrôleur RAID intégré remplace automatiquement le disque défaillant par un disque hot spare, puis resynchronise les données mises en miroir. Utilisez l'utilitaire LSI sas2ircu pour ajouter des disques hot spare globaux. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'ajout de disques hot spare. {0} ok show-volumes {0} ok unselect-dev40 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Diagnostic de l'état de fonctionnement d'un disque Les rubriques suivantes traitent des diverses façons de déterminer si un disque figurant dans un volume RAID a échoué ou non : ¦ « DEL avant du disque de service requis », page 40 ¦ « Messages d'erreur (console système et fichiers journaux) », page 40 ¦ « Affichage de l'état (commande show-volumes, OBP) », page 41 ¦ « Affichage de l'état (utilitaire sas2ircu, LSI) », page 42 DEL avant du disque de service requis Lorsqu'une erreur se produit sur un disque d'un système SPARC T3, la DEL jaune de service requis s'allume à l'avant du disque. Cette DEL jaune vous permet de localiser le disque défaillant dans le système. Par ailleurs, les DEL d’opération de maintenance requise des panneaux avant et arrière s’allument également lorsque le système détecte une panne au niveau du disque dur. Reportez-vous à votre manuel d'entretien pour connaître l'emplacement et la description de ces DEL. Messages d'erreur (console système et fichiers journaux) Lorsqu'une erreur se produit sur un disque, des messages d'erreur s'affichent sur la console système. Il s'agit d'un exemple d'affichage de console système indiquant que le volume 905 a été endommagé par la perte de PhysDiskNum 1 : Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname PhysDiskNum 1 with DevHandle 0xc in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded Mar 16 16:28:26 hostname scsi: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 0 is now degradedConfiguration de volumes RAID matériels 41 Vous pouvez également afficher ces messages en consultant les fichiers /var/adm/messages : Reportez-vous à la rubrique View the System Message Log Files (Affichage des fichiers journaux de messages système) du manuel d'entretien pour plus d'informations sur la consultation de ces messages. ? Affichage de l'état (commande show-volumes, OBP) Vous pouvez arrêter le système et utilisez la commande show-volumes de l'OBP pour savoir si un disque est en panne. 1. Arrêtez le système et affichez l'invite ok de l'OBP. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Mar 16 16:28:26 hostname scsi: WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:28:26 hostname Volume 905 is degraded # more /var/adm/messages* . . . Mar 16 16:45:19 hostname SC Alert: [ID 295026 daemon.notice] Sensor | minor: Entity Presence : /SYS/SASBP/HDD3/PRSNT : Device Absent Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now offline Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname PhysDiskNum 0 with DevHandle 0xd in slot 0 for enclosure with handle 0x0 is now , active, out of sync Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.notice] /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 0 is now degraded Mar 16 16:45:19 hostname scsi: [ID 107833 kern.warning] WARNING: /pci@400/pci@2/pci@0/pci@e/scsi@0 (mpt_sas0): Mar 16 16:45:19 hostname Volume 905 is degraded42 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Sélectionnez le contrôleur SAS. Pour plus d’informations, reportez-vous à la section « Pour préparer l’utilisation de l’utilitaire FCode », page 36. 3. Saisissez la commande show-volumes pour afficher les volumes RAID et les disques qui leur sont associés. Dans l'exemple suivant, le disque secondaire d'un volume RAID 1 est hors ligne. 4. Saisissez la commande unselect-dev pour désélectionner le contrôleur SAS. ? Affichage de l'état (utilitaire sas2ircu, LSI) ? Utilisez l'utilitaire sas2ircu LSI pour afficher l'état du volume RAID et des périphériques qui lui sont associés. Reportez-vous au SAS2 Integrated RAID Solution User Guide (Guide de l'utilisateur des solutions RAID intégrées SAS2) pour plus d'informations sur l'affichage et l'interprétation de l'état du périphérique à l'aide de l'utilitaire sas2ircu. ok select /pci@400/pci@2/pci@0/pci@e/scsi@0 ok show-volumes Volume 0 Target 389 Type RAID1 (Mirroring) Name raid1test WWID 04eec3557b137f31 Degraded Enabled 2 Members 2048 Blocks, 1048 KB Disk 1 Primary Optimal Target c HITACHI H101414SCSUN146G SA25 Disk 0 Secondary Offline Out Of Sync Target 0 SEAGATE ok unselect-devConfiguration de volumes RAID matériels 43 Stratégies de remplacement d'un disque RAID Suivez les stratégies décrites ci-dessous lors du remplacement d'un disque défectueux dans un volume RAID. Remarque – Les instructions cfgadm figurant dans le manuel d'entretien s'appliquent à des disques individuels ne faisant pas partie de volumes RAID. Lorsqu'un disque fait partie d'un volume RAID, il n'est pas nécessaire d'annuler la configuration avant de le remplacer à chaud par un nouveau disque. ? Pour identifier les chemins d’accès aux périphériques La procédure suivante permet de localiser les chemins d’accès aux périphériques propres à votre serveur. 1. Affichez l’invite ok. Reportez-vous à la section « Pour afficher l’invite ok », page 13. Niveau de volume RAID Stratégie RAID 0 Lorsqu'un disque d'un volume RAID 0 tombe en panne, toutes les données figurant sur ce volume sont perdues. Remplacez le disque défectueux par un disque de même capacité, recréez le volume RAID 0, puis restaurez les données à partir d'une sauvegarde. RAID 1 Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID. RAID 1E Retirez le disque défectueux et remplacez-le par un disque de même capacité. Le nouveau disque est automatiquement configuré et synchronisé avec le volume RAID.44 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. A partir de l’invite ok, tapez : Informations connexes ¦ « Pour afficher l’invite ok », page 13 ¦ « Pour préparer l’utilisation de l’utilitaire FCode », page 36 {0} ok devalias screen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0 mouse /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /mouse@1 rcdrom /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3 /storage@2/disk@0 rkeyboard /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/device@4 /keyboard@0 rscreen /pci@400/pci@2/pci@0/pci@0/pci@0/display@0:r1280x1024x60 net3 /pci@400/pci@2/pci@0/pci@7/network@0,1 net2 /pci@400/pci@2/pci@0/pci@7/network@0 net1 /pci@400/pci@2/pci@0/pci@6/network@0,1 net0 /pci@400/pci@2/pci@0/pci@6/network@0 net /pci@400/pci@2/pci@0/pci@6/network@0 disk7 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p3 disk6 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p2 disk5 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p1 disk4 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p0 cdrom /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@p6 scsi1 /pci@400/pci@2/pci@0/pci@4/scsi@0 disk3 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p3 disk2 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p2 disk1 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p1 disk0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 disk /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@p0 scsi0 /pci@400/pci@1/pci@0/pci@4/scsi@0 scsi /pci@400/pci@1/pci@0/pci@4/scsi@0 virtual-console /virtual-devices@100/console@1 name aliases {0} ok45 Modification des informations d’identification du serveur Les sections suivantes décrivent la procédure de stockage des informations (à des fins de contrôle d’inventaire ou de gestion des ressources du site, par exemple) sur le SP et les PROM des FRU à l’aide de l’interface CLI d’ILOM. ¦ « Pour modifier les informations sur les données FRU des clients », page 45 ¦ « Pour modifier les informations d’identification du système », page 46 ? Pour modifier les informations sur les données FRU des clients La propriété /SP customer_frudata permet de stocker des informations dans toutes les PROM de FRU. Ce champ peut servir à identifier un système particulier pour une application tierce ou pour tout autre besoin d’identification au sein de votre environnement. ? A l’invite -> d’ILOM, tapez : Remarque – Vous devez placer la chaîne de données (données) entre guillemets anglo-saxons. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations d’identification du système », page 46 -> set /SP customer_frudata=”data”46 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier les informations d’identification du système La propriété /SP system_identifier permet de stocker les informations d’identification client. Cette chaîne de caractères est codée dans tous les messages d’interruption générés par SNMP. L’affectation d’un identificateur de système unique peut se révéler utile pour déterminer le système qui génère le message SNMP. ? A l’invite -> d’ILOM, tapez : Remarque – La chaîne des données (données) doit être placée entre guillemets anglo-saxons doubles. Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour modifier les informations sur les données FRU des clients », page 45 -> set /SP system_identifier=”data”47 Configuration des paramètres de stratégie Les sections suivantes décrivent la gestion des stratégies de configuration à l’aide d’ILOM. ¦ « Pour définir le mode de refroidissement », page 47 ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’initialisation parallèle du SP et de l’hôte », page 50 ¦ « Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé », page 51 ? Pour définir le mode de refroidissement La propriété HOST_COOLDOWN, lorsqu’elle est activée, oblige le serveur à entrer en mode de refroidissement (cooldown) à la mise hors tension de l’hôte. Dès lors que le serveur est hors tension et que le mode de refroidissement est activé, ILOM est redirigé de manière à contrôler certains composants et à garantir qu’ils restent en dessous d’une température minimale et qu’ils ne présentent aucun danger pour l’utilisateur. Une fois les composants passés en dessous de la température minimale, le serveur n’est plus alimenté en courant ou, si cette opération prend plus de 4 minutes, l’hôte s’éteint. Remarque – La propriété HOST_COOLDOWN ne concerne pas les modules serveur.48 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le serveur refroidit certains composants avant d’être mis hors tension. ¦ disabled : la température des composants n’est pas contrôlée lors de la mise hors tension. Informations connexes ¦ « Pour mettre le serveur hors tension », page 20 ? Pour restaurer l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_LAST_POWER_STATE permet de contrôler le comportement du serveur après une panne de courant inattendue. Une fois le courant externe rétabli, le processeur de service d’ILOM est exécuté automatiquement. En général, l’hôte n’est pas remis sous tension tant que vous n’utilisez pas ILOM pour cette opération. ILOM enregistre l’état de l’alimentation actuelle du serveur dans l’espace de stockage non volatile. Si la stratégie HOST_LAST_POWER_STATE est activée, ILOM peut rétablir l’état d’alimentation précédent de l’hôte. Cette stratégie s’avère pratique en cas de panne d’alimentation ou si vous changez le serveur d’emplacement physique. Par exemple, si le serveur hôte est en cours d’exécution lors d’une panne d’alimentation et que la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur disabled, le serveur hôte demeure hors tension lorsque l’alimentation est rétablie. Si la propriété /SP/policy HOST_LAST_POWER_STATE est définie sur enabled, le serveur hôte redémarre lorsque l’alimentation est rétablie. ? A l’invite -> d’ILOM, tapez : -> set /SP/policy HOST_COOLDOWN=value -> set /SP/policy HOST_LAST_POWER_STATE=enabledConfiguration des paramètres de stratégie 49 où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : lorsque l’alimentation est rétablie, le serveur revient à l’état où il se trouvait au moment de la mise hors tension. ¦ disabled : maintient le serveur hors tension au retour du courant (valeur par défaut). Si vous activez HOST_LAST_POWER_STATE, vous devriez également configurer /SP/policy HOST_POWER_ON_DELAY. Pour plus d’informations, reportez-vous à la section « Pour désactiver ou réactiver le délai de mise sous tension », page 50. Informations connexes ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’état d’alimentation de l’hôte au redémarrage La propriété /SP/policy HOST_AUTO_POWER_ON permet de mettre l’hôte sous tension lorsque le serveur est alimenté par du courant externe. Si cette stratégie est définie sur enabled, le processeur de service définit HOST_LAST_POWER_STATE sur disabled. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : une fois le courant rétabli, l’hôte est automatiquement mis sous tension après l’initialisation du SP. ¦ disabled : maintient l’hôte hors tension au retour du courant (valeur par défaut). Informations connexes ¦ « Pour restaurer l’état d’alimentation de l’hôte au redémarrage », page 48 ¦ « Pour désactiver ou réactiver le délai de mise sous tension », page 50 -> set /SP/policy HOST_AUTO_POWER_ON=value50 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour désactiver ou réactiver le délai de mise sous tension La propriété /SP/policy HOST_POWER_ON_DELAY permet de définir un délai d’attente avant la remise automatique sous tension du serveur. Ce délai est un intervalle aléatoire compris entre une et cinq secondes. Retarder la mise sous tension du serveur permet de minimiser les surintensités au niveau de la source d’alimentation principale. Cela est important lorsque plusieurs serveurs montés en rack se mettent sous tension après une coupure de courant. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : oblige le serveur à attendre un court moment avant de se mettre sous tension automatiquement. ¦ disabled : le serveur se met automatiquement et sans délai sous tension (valeur par défaut). Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour définir l’initialisation parallèle du SP et de l’hôte La propriété /SP/policy PARALLEL_BOOT, lorsqu’elle est activée, permet à l’hôte de s’initialiser/se mettre sous tension parallèlement au SP quand une stratégie de mise sous tension automatique (HOST_AUTO_POWER_ON ou HOST_LAST_POWER_STATE) est activée ou que l’utilisateur appuie sur le bouton de marche/arrêt pendant que le SP est en cours d’initialisation. ILOM doit être en cours d’exécution pour permettre la mise sous tension de l’hôte lorsque l’utilisateur appuie sur le bouton de marche/arrêt ou que les stratégies de mise sous tension automatique sont configurées. Lorsque cette propriété est désactivée, le SP s’initialise avant l’hôte. -> set /SP/policy HOST_POWER_ON_DELAY=valueConfiguration des paramètres de stratégie 51 Remarque – L’initialisation parallèle n’est pas prise en charge par les modules serveur. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled : le SP et l’hôte s’initialisent en même temps. ¦ disabled : le SP et l’hôte s’initialisent de manière consécutive (en série). Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 20 ? Pour configurer le comportement de l’hôte à l’aide de l’état de l’interrupteur à clé La propriété /SYS setkeyswitch_state permet de contrôler la position de l’interrupteur à clé virtuel. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ normal : le serveur peut se mettre automatiquement sous tension et lancer le processus d’initialisation (valeur par défaut). ¦ standby : met l’hôte hors tension et désactive la mise sous tension. ¦ diag : la mise sous tension de l’hôte est autorisée ; ce paramètre remplace ceux de /HOST/diag cible, ce qui se traduit par l’exécution d’un nombre maximum de POST. -> set /SP/policy PARALLEL_BOOT=value -> set /SYS keyswitch_state=value52 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ locked : la mise sous tension de l’hôte est autorisée. Toutefois, vous ne pouvez pas mettre à jour les périphériques flash ni définir la propriété /HOST send_break_action=break. Informations connexes ¦ « Pour mettre le serveur sous tension », page 19 ¦ « Pour mettre le serveur hors tension », page 2053 Configuration des adresses réseau Les sections suivantes décrivent la gestion des adresses réseau à l’aide d’ILOM. ¦ « Options d’adresse réseau du SP », page 53 ¦ « Pour désactiver ou réactiver l’accès réseau au SP », page 54 ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ¦ « Utilisation d’une connexion in-band au SP », page 56 Options d’adresse réseau du SP Vous pouvez accéder au SP de votre système de plusieurs façons. Tenez compte des options disponibles et choisissez la méthode d’accès la plus adaptée à votre environnement. Vous pouvez établir des connexions physiques avec le SP au moyen d’une connexion série ou réseau. La connexion réseau peut être configurée de manière à utiliser une adresse IP statique ou le protocole DHCP (valeur par défaut). Le cas échéant, les serveurs de la série T3 peuvent se connecter au SP via une connexion réseau in-band au lieu d’utiliser le port de gestion réseau out-of-band défini par défaut. Pour plus d’informations sur chaque option, reportez-vous à la documentation suivante : ¦ Pour utiliser une connexion série au SP, consultez la section suivante : Pour connecter un terminal ou un émulateur au port SER MGT, dans le guide d’installation de votre serveur ou Communication avec le module serveur au démarrage, dans le guide d’installation de votre module serveur. ¦ Pour assigner une adresse IP statique au SP, consultez la section suivante : Pour assigner une adresse IP statique au SP, dans le guide d’installation du serveur ¦ Pour utiliser une connexion in-band au SP, reportez-vous à la section suivante : « Gestion in-band (sideband) d’ILOM », page 5654 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ Documentation d’Oracle Integrated Lights Out Manager (ILOM) 3.0 ¦ « Présentation d’ILOM », page 1 ? Pour désactiver ou réactiver l’accès réseau au SP La propriété /SP/network state permet d’activer ou de désactiver l’interface réseau du processeur de service. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ enabled (valeur par défaut) ¦ disabled Informations connexes ¦ « Options d’adresse réseau du SP », page 53 ? Pour afficher l’adresse IP du serveur DHCP Afin d’afficher l’adresse IP du serveur DHCP ayant fourni l’adresse IP dynamique requise par le processeur de service, affichez la propriété dhcp_server_ip. ? A l’invite -> d’ILOM, tapez : -> set /SP/network state=value -> show /SP/network /SP/network Targets: interconnectConfiguration des adresses réseau 55 Remarque – La liste des propriétés peut varier en fonction de votre serveur. Informations connexes ¦ « Pour afficher l’adresse MAC de l’hôte », page 55 ? Pour afficher l’adresse MAC de l’hôte La propriété /HOST macaddress est automatiquement configurée par le logiciel serveur de sorte que vous ne pouvez ni la définir ni la modifier. La valeur est lue et déterminée à partir de la carte de configuration système amovible du serveur (PROM SCC) ou à partir de l’ID de PROM du module serveur, puis stockée en tant que propriété dans ILOM. /HOST macaddress désigne l’adresse MAC du port net0. Chaque adresse MAC de port supplémentaire augmente d’une unité, l’adresse de base étant /HOST macaddress. Par exemple, net1 équivaut à la valeur de /HOST macaddress plus un (1). ipv6 test Properties: commitpending = (Cannot show property) dhcp_server_ip = 10.8.31.5 ipaddress = 10.8.31.188 ipdiscovery = dhcp ipgateway = 10.8.31.248 ipnetmask = 255.255.252.0 macaddress = 00:14:4F:7E:83:4F managementport = /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:21:28:8F:13:5F pendingipaddress = 10.8.31.188 pendingipdiscovery = dhcp pendingipgateway = 10.8.31.248 pendingipnetmask = 255.255.252.0 sidebandmacaddress = 00:21:28:8F:13:5E state = enabled Commands: cd set show56 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour afficher l’adresse IP du serveur DHCP », page 54 Utilisation d’une connexion in-band au SP Les sections suivantes décrivent l’utilisation d’une connexion in-band (ou sideband) au SP. ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 Gestion in-band (sideband) d’ILOM Par défaut, la connexion au SP du serveur est établie par le biais du port de gestion réseau out-of-band (NET MGT). La fonction de gestion sideband ILOM vous permet de sélectionner le port NET MGT ou l’un des ports Gigabit Ethernet du serveur (NETn), en l’occurrence des ports in-band, pour envoyer ou recevoir des commandes ILOM vers et à partir du SP du serveur. Les ports in-band sont également désignés en tant que ports sideband. En utilisant un port de gestion sideband pour gérer le processeur de service du serveur, une connexion par câble et un port de commutateur réseau ne sont plus nécessaires. Dans des configurations où de nombreux serveurs sont gérés, comme par exemple dans les centres de données, la gestion sideband peut ainsi permettre des économies importantes en termes d’utilisation de matériel et de réseau. Remarque – L’utilisation de connexions in-band est déconseillée avec les modules serveur. -> show /HOST macaddressConfiguration des adresses réseau 57 Lorsque la gestion sideband est active dans ILOM, les situations suivantes peuvent se produire : ¦ La connexion au SP du serveur peut être interrompue si vous changez la configuration du port de gestion SP lorsque vous êtes connecté au SP via une connexion réseau, telle que SSH, Web ou ILOM Remote Console. ¦ La connectivité intégrée entre le processeur de service et le système d’exploitation hôte peut ne pas être prise en charge par le contrôleur Gigabit Ethernet hôte intégré. Dans ce cas, utilisez un port différent ou routez le trafic de transmission entre la source et les cibles de destination au lieu d’utiliser la commutation/un pont L2. ¦ Les mises hors et sous tension de l’hôte du serveur peuvent interrompre la connectivité réseau des ports Gigabit Ethernet du serveur (NETn) configurés pour la gestion sideband. Dans ce cas, configurez les ports de commutation/pont contigus sous forme de ports hôtes. Informations connexes ¦ « Pour configurer l’accès in-band (sideband) au SP », page 57 ¦ « Options d’adresse réseau du SP », page 53 ? Pour configurer l’accès in-band (sideband) au SP Cette procédure décrit la méthode d’accès au SP via une gestion in-band (ou sideband) au moyen d’un port réseau hôte. Si vous effectuez cette procédure via une connexion réseau, vous risquez de perdre la connectivité au serveur. Une connexion série pour cette procédure permet d’éviter la perte de connectivité pendant les modifications de configuration de la gestion sideband. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. En cas de connexion par le port série, vous pouvez assigner une adresse IP statique. Pour obtenir les instructions, consultez les informations relatives à l’assignation d’une adresse IP dans le guide d’installation de votre serveur.58 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Affichez les paramètres réseau actuels : 4. Définissez le port de gestion du SP sur un port sideband (où n correspond à un chiffre compris entre 0 et 3) : -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NETMGMT outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NETMGMT sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show -> set /SP/network pendingmanagementport=/SYS/MB/NETn -> set commitpending=trueConfiguration des adresses réseau 59 5. Vérifiez l’application de la modification : Informations connexes ¦ « Gestion in-band (sideband) d’ILOM », page 56 ¦ « Options d’adresse réseau du SP », page 53 -> show /SP/network /SP/network Targets: interconnect ipv6 test Properties: commitpentding = (Cannot show property) dhcp_server_ip = none ipaddress = 129.148.62.55 ipdiscovery = static ipgateway = 129.148.62.225 ipnetmask = 255.255.255.0 macaddress = 00:11:3T:8O:44:B7 managementport= /SYS/MB/SP/NET0 outofbandmacaddress = 00:11:3T:8O:44:B7 pendingipaddress = 129.148.62.55 pendingipdiscovery = static pendingipgateway = 129.148.62.225 pendingipnetmask = 255.255.255.0 pendingmanagementport = /SYS/MB/SP/NET0 sidebandmacaddress = 00:11:3T:8O:44:B7 state = enabled Commands: cd set show60 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201161 Configuration du mode d’initialisation Les propriétés du mode d’initialisation d’ILOM permettent de spécifier la manière dont l’hôte s’initialise dans le cadre de la résolution d’un problème lié à OpenBoot ou Oracle VM Server pour SPARC. ¦ « Présentation du mode d’initialisation », page 61 ¦ « Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC », page 62 ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Pour gérer le script du mode d’initialisation de l’hôte », page 65 ¦ « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66 ¦ « Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur », page 66 Présentation du mode d’initialisation Les propriétés du mode d’initialisation (bootmode) annulent et remplacent la méthode d’initialisation par défaut du serveur. Cette possibilité s’avère pratique pour remplacer des paramètres OpenBoot ou Oracle VM Server particuliers pouvant être incorrects, pour configurer des variables OpenBoot à l’aide d’un script ou pour effectuer d’autres tâches similaires. Si, par exemple, les paramètres OpenBoot viennent à être endommagés, vous pouvez définir la propriété bootmode state sur reset_nvram, puis réinitialiser le serveur sur les paramètres OpenBoot par défaut définis en usine. Le personnel de maintenance peut également vous demander d’utiliser la propriété bootmode script afin de résoudre un problème. La portée intégrale des fonctionnalités de script n’est pas documentée et sert principalement à des fins de débogage.62 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Comme bootmode est destiné à corriger un problème lié aux paramètres OpenBoot ou Oracle VM Server, il ne s’applique qu’à une seule initialisation. De plus, pour éviter qu’un administrateur ne définisse la propriété bootmode state puis l’oublie, celle-ci expire lorsque l’hôte n’est pas réinitialisé dans les 10 minutes suivant la configuration de la propriété bootmode state. Informations connexes ¦ « Pour réinitialiser le serveur à partir du SE Oracle Solaris », page 21 ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation d’OpenBoot », page 4 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour configurer le mode d’initialisation de l’hôte d’Oracle VM Server pour SPARC Remarque – Vous devez utiliser un nom de configuration Oracle VM Server pour cette tâche. 1. Déterminez les configurations Oracle VM Server valides sur votre processeur de service en tapant ce qui suit à l’invite -> d’ILOM : -> show /HOST/domain/configsConfiguration du mode d’initialisation 63 2. Définissez la configuration du mode d’initialisation en tapant ce qui suit à l’invite -> d’ILOM : où la propriété config est dotée d’une valeur configname correspondant à une configuration de domaine logique nommée correcte. Par exemple, si vous avez créé une configuration Oracle VM Server intitulée ldm-set1 : Pour que le mode d’initialisation config revienne à la configuration par défaut d’usine, spécifiez factory-default. Par exemple : Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode config=configname -> set bootmode config=ldm-set1 -> set bootmode config=factory-default64 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations La propriété /HOST/bootmode state contrôle la manière dont les variables de la NVRAM OpenBoot sont utilisées. En général, les paramètres actifs de ces variables sont conservés. Définir /HOST/ bootmode state=reset_nvram permet de ramener les variables de la NVRAM OpenBoot à leurs valeurs par défaut à la réinitialisation suivante. ? A l’invite -> d’ILOM, tapez : où valeur correspond à l’un des paramètres suivants : ¦ normal : conserve les paramètres actifs des variables de la NVRAM à la réinitialisation suivante. ¦ reset_nvram : redéfinit les variables OpenBoot sur les paramètres par défaut à la réinitialisation suivante. Remarque – state=reset_nvram rétablit la valeur « normal » après la prochaine réinitialisation du serveur ou après dix minutes (voir la propriété expires décrite à la section « Pour afficher la date d’expiration du mode d’initialisation de l’hôte », page 66). Les propriétés config et script n’arrivent pas à échéance et sont effacées lors de la prochaine réinitialisation du serveur ou manuellement en définissant la valeur sur "". Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode state=valueConfiguration du mode d’initialisation 65 ? Pour gérer le script du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où script contrôle la méthode d’initialisation du microprogramme OpenBoot PROM du serveur hôte. Le script n’a aucune incidence sur le paramètre /HOST/bootmode actuel. valeur peut compter jusqu’à 64 octets. Vous pouvez spécifier le paramètre /HOST/bootmode et définir le script dans la même commande. Par exemple : Une fois que le serveur est réinitialisé et que l’OpenBoot PROM lit les valeurs stockées dans le script, le microprogramme définit la variable OpenBoot PROM diag-switch? sur la valeur requise par l’utilisateur : true. Remarque – Si vous définissez /HOST/bootmode script="", ILOM configure script sur une valeur vide. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 -> set /HOST/bootmode script=value -> set /HOST/bootmode state=reset_nvram script="setenv diag-switch? true"66 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher la date d’expiration du mode d’initialisation de l’hôte ? A l’invite -> d’ILOM, tapez : où expires correspond aux date et heure d’échéance du mode d’initialisation actif. Informations connexes ¦ « Pour réinitialiser le serveur à partir d’ILOM », page 22 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 5 ? Pour remplacer les paramètres de l’OpenBoot PROM afin de réinitialiser le serveur Cette procédure vous permet de remplacer les paramètres de l’OpenBoot PROM et de lancer la réinitialisation du domaine de contrôle, ce qui entraîne le démarrage de l’hôte à l’invite ok. ? A l’invite -> d’ILOM, tapez : L’hôte redémarre puis s’arrête à l’invite ok. -> show /HOST/bootmode expires Properties: expires = Thu Oct 14 18:24:16 2010 -> set /HOST/domain/control auto-boot=disabled reset /HOST/domain/control [-force] [-script]Configuration du mode d’initialisation 67 Informations connexes ¦ « Pour modifier le comportement du mode d’initialisation de l’hôte lors des réinitialisations », page 64 ¦ « Configuration du mode d’initialisation », page 61 ¦ « Présentation du mode d’initialisation », page 61 ¦ « Présentation d’Oracle VM Server pour SPARC », page 568 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201169 Configuration du comportement du serveur au redémarrage Pour configurer le comportement d’ILOM dans les scénarios de redémarrage ci-dessous, suivez les procédures indiquées ci-après. ¦ « Pour définir le comportement de l’hôte à sa réinitialisation », page 69 ¦ « Pour définir le comportement de l’hôte lorsque son exécution s’arrête », page 70 ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 ? Pour définir le comportement de l’hôte à sa réinitialisation Spécifiez si l’hôte doit continuer à démarrer lorsqu’une erreur se produit. ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ false : l’hôte continue la procédure d’initialisation même s’il rencontre une erreur. ¦ true : l’hôte ne continue pas la procédure d’initialisation s’il rencontre une erreur. Informations connexes ¦ « Configuration des paramètres de stratégie », page 47 -> set /HOST autorunonerror=value70 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le comportement de l’hôte lorsque son exécution s’arrête Spécifiez le comportement d’ILOM lorsque l’hôte quitte l’état d’EXECUTION (à l’expiration de l’horloge chien de garde). ? Définissez cette propriété : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none : ILOM ne prend pas d’autre mesure que l’émission d’un avertissement. ¦ reset : ILOM tente de réinitialiser le serveur lorsque l’horloge chien de garde Oracle Solaris expire (option par défaut). ¦ dumpcore : ILOM tente de forcer un core dump du SE lorsque l’horloge chien de garde expire. Informations connexes ¦ « Pour afficher l’historique de la console », page 80 ? Pour définir l’intervalle du délai d’attente d’initialisation ? Définissez le délai d’attente entre une requête d’initialisation de l’hôte et l’initialisation proprement dite : La valeur par défaut de boottimeout correspond à 0 (zéro seconde) ou aucun délai d’attente. Les valeurs possibles sont comprises entre 0 et 36 000 secondes. Informations connexes ¦ « Pour définir le comportement à l’expiration du délai d’initialisation », page 71 -> set /HOST autorestart=value -> set /HOST boottimeout=secondsConfiguration du comportement du serveur au redémarrage 71 ? Pour définir le comportement à l’expiration du délai d’initialisation Spécifiez le comportement d’ILOM en cas d’échec de l’initialisation de l’hôte avant l’expiration du délai d’initialisation. ? Définissez le comportement au terme de la commande boottimeout : où valeur peut correspondre à l’une des valeurs suivantes : ¦ none (aucune, par défaut) ¦ Réinitialisation Informations connexes ¦ « Pour définir l’intervalle du délai d’attente d’initialisation », page 70 ? Pour définir le comportement en cas d’échec du redémarrage Spécifiez le comportement d’ILOM lorsque l’hôte ne parvient pas à atteindre l’état running pour Oracle Solaris. ? A l’invite -> d’ILOM, tapez : où valeur peut correspondre à l’une des valeurs suivantes : ¦ powercycle ¦ poweroff (valeur par défaut) Informations connexes ¦ « Pour définir le nombre maximum de tentatives de redémarrage », page 72 -> set /HOST bootrestart=value -> set /HOST bootfailrecovery=value72 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour définir le nombre maximum de tentatives de redémarrage Indiquez le nombre de fois qu’ILOM doit tenter de redémarrer l’hôte. ? A l’invite -> d’ILOM, tapez : La valeur par défaut de maxbootfail est 3 (trois tentatives). Si l’initialisation de l’hôte échoue après le nombre de tentatives indiqué par maxbootfail, l’hôte est mis hors tension ou soumis à un cycle d’alimentation progressive (selon la configuration de bootfailrecovery). Dans les deux cas, la commande boottimeout est définie sur 0 (zéro seconde), empêchant d’autres tentatives de redémarrage de l’hôte. Informations connexes ¦ « Pour définir le comportement en cas d’échec du redémarrage », page 71 -> set /HOST maxbootfail=attempts73 Configuration des périphériques Les sections suivantes présentent des informations sur la configuration des périphériques du serveur. ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour déconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=disabled permettant de déconfigurer manuellement les périphériques du serveur. Cette commande identifie le périphérique spécifié comme étant désactivé (disabled). Tout périphérique marqué disabled, que ce soit manuellement ou par le microprogramme système, est supprimé de la description de machine du serveur avant le transfert de contrôle à d’autres couches du microprogramme système, comme l’OpenBoot PROM. ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=disabled74 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour reconfigurer manuellement un périphérique Le microprogramme ILOM dispose d’une commande component_state=enabled permettant de reconfigurer manuellement les périphériques serveur. Cette commande vous permet de marquer le périphérique spécifié comme étant activé (enabled). ? A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 -> set component-name component_state=enabled75 Contrôle du serveur Le serveur dispose de nombreuses méthodes pour signaler un comportement défectueux, notamment les DEL, ILOM et l’autotest de l’allumage (POST). Pour en savoir plus sur les DEL et obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Contrôle des pannes », page 75 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour afficher les composants du serveur », page 86 ¦ « Pour localiser le serveur », page 87 Contrôle des pannes Les sections suivantes présentent un récapitulatif des outils de diagnostic ainsi que des informations de base sur la détection des pannes du serveur à l’aide d’outils exécutés en amont du système d’exploitation, notamment ILOM et le POST. Pour obtenir des informations de dépannage complètes, reportez-vous au manuel d’entretien du serveur. ¦ « Présentation des diagnostics », page 76 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher l’historique de la console », page 80 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ¦ « Pour effacer une panne », page 8376 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation des diagnostics Vous disposez de toute une gamme d’outils de diagnostic, de commandes et d’indicateurs permettant de contrôler et de dépanner un serveur. Reportez-vous au manuel d’entretien de votre serveur pour obtenir des informations complètes sur ces outils de diagnostic : ¦ DEL : fournissent une indication visuelle rapide du statut du serveur et de certaines FRU. ¦ ILOM : microprogramme exécuté sur le processeur de service. Outre l’interface qu’il fournit entre le matériel et le SE, le microprogramme ILOM permet également de suivre et de signaler l’état général des composants clés du serveur. ILOM exploite pleinement le POST et la technologie d’autorétablissement prédictif d’Oracle Solaris pour maintenir le serveur en état de fonctionnement, même en présence d’un composant défectueux. ¦ Autotest de l’allumage (POST) : le POST effectue des tests de diagnostic sur les composants du serveur après une réinitialisation manuelle pour s’assurer de leur intégrité. Configurable, le POST utilise le microprogramme ILOM pour mettre hors tension les composants défectueux, le cas échéant. ¦ Autorétablissement prédictif du SE Oracle Solaris : cette technologie contrôle en permanence l’intégrité du processeur et de la mémoire, et fonctionne avec ILOM pour placer un composant défectueux hors ligne, le cas échéant. Elle permet aux serveurs de prévoir avec précision les pannes de composants et de limiter de nombreux problèmes graves avant qu’ils ne surviennent. ¦ Fichiers journaux et interface de commandes : fournissent les fichiers journaux standard du SE Oracle Solaris, ainsi que les commandes d’investigation qui peuvent être utilisées et affichées sur le périphérique de votre choix. ¦ SunVTS : application qui permet de tester le serveur, de vérifier le fonctionnement du matériel et d’identifier les composants éventuellement défectueux en fournissant des recommandations pour leur réparation. Les DEL, le microprogramme ILOM, l’autorétablissement prédictif du SE et les nombreux fichiers journaux et messages de la console offrent une intégration mutuelle totale. Cela signifie que, par exemple, en cas de panne détectée par le logiciel Oracle Solaris, celle-ci est affichée et consignée, tandis que les informations correspondantes sont transmises à ILOM qui les consigne. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ¦ Consultez la section du manuel d’entretien du serveur concernant la détection et la gestion des pannes.Contrôle du serveur 77 ? Pour détecter les pannes (ILOM) ? A l’invite -> d’ILOM, tapez : Cette commande affiche la cible, la propriété et la valeur de la panne. Par exemple : Informations connexes ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 ¦ « Activation de la récupération automatique du système », page 83 ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 ? Pour détecter les pannes (shell de gestion des pannes d’ILOM) Le shell de gestion des pannes d’ILOM (Fault Management Shell) permet d’utiliser les commandes du gestionnaire des pannes d’Oracle Solaris (fmadm et fmstat à partir d’ILOM, afin de visualiser à la fois les pannes relatives à l’hôte et à ILOM. 1. Pour lancer le shell intégré, à l’invite -> d’ILOM, tapez : -> show faulty -> show faulty Target | Property | Value -----------------+---------------------+------------------------- /SP/faultmgmt/0 | fru | /SYS /SP/faultmgmt/1 | fru | /SYS/MB/CMP0/BOBO/CH1/D0 /SP/faultmgmt/1/ | fru_part_number | 18JS25672PDZ1G1F1 faults/0 | | -> -> start /SP/faultmgmt/shell Are you sure you want to start /SP/Faultmgt/shell (y/n)? y faultmgmtsp>78 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 2. Pour obtenir la liste des pannes actuelles du serveur, tapez : Remarque – Si le serveur détecte le remplacement de la FRU défectueuse, la réparation ne nécessite pas l’exécution d’une commande par l’utilisateur, car la panne sera effacée automatiquement. 3. Détectez des informations complémentaires sur une panne donnée. Recherchez l’identificateur de panne MSG-ID (SPT-8000-42 dans l’exemple précédent), puis saisissez-le dans la zone de recherche à l’adresse http://www.sun.com/msg. 4. Pour réparer la panne, reportez-vous à la section : « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81. 5. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit ->Contrôle du serveur 79 Informations connexes ¦ Article sur l'autorétablissement prédictif (en anglais) « Oracle Solaris 10 OS Feature Sportlight: Predictive Self Healing » disponible à l’adresse www.oracle.com/technetwork/systems/dtrace/self-healing/index.h tml ¦ « Pour se connecter à ILOM », page 11 ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour réparer une panne (shell de gestion des pannes d’ILOM) », page 81 ? Pour détecter les pannes à l’aide du POST L’interrupteur à clé virtuel permet d’exécuter des diagnostics POST complets sans avoir à modifier les paramètres des propriétés de diagnostic. Notez que l’exécution des diagnostics POST peuvent prendre temps considérable lors de la réinitialisation du serveur. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. A l’invite -> d’ILOM, tapez : Le serveur est configuré pour exécuter les diagnostics POST complets au moment de sa réinitialisation. 3. Pour revenir aux paramètres de diagnostic standard après l’exécution du POST, à l’invite -> d’ILOM, tapez ce qui suit : Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour localiser le serveur », page 87 ¦ « Pour effacer une panne », page 83 -> set /SYS keyswitch_state=diag -> set /SYS keyswitch_state=normal80 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher l’historique de la console Cette rubrique décrit la procédure d’affichage des tampons de sortie de la console du serveur hôte. Il existe deux tampons d’historique de console pouvant contenir jusqu’à 1 Mo d’informations. La cible /HOST/console/history écrit tous les types d’informations de journalisation. La cible /HOST/console/bootlog consigne les informations de démarrage et les données d’initialisation dans le tampon de la console jusqu’à ce qu’ILOM soit notifié par le serveur que le SE Oracle Solaris est exécuté et opérationnel. Ce tampon est conservé jusqu’à ce que l’hôte soit réinitialisé. Remarque – Vous devez disposer des droits d’administrateur ILOM pour utiliser cette commande. 1. Pour gérer le journal /HOST/console/history, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 1 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 1 et tout nombre entier ou "" pour indiquer un nombre de lignes illimité. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Si vous tapez la commande show /HOST/console/history sans définir d’arguments préalables à l’aide de la commande set, ILOM affiche toutes les lignes du journal de la console en commençant par la fin. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. -> set /HOST/console/history property=option [...] -> show /HOST/console/historyContrôle du serveur 81 2. Pour afficher le journal /HOST/console/bootlog, à l’invite -> d’ILOM, tapez ce qui suit : où property correspond à l’une des valeurs suivantes : ¦ line_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. La valeur par défaut est toutes les lignes. ¦ pause_count : cette option admet les valeurs comprises entre 0 et 2 048 lignes. Tapez "" pour un nombre illimité de lignes. Par défaut, il n’y a pas de pause. ¦ start_from : les options sont les suivantes : ¦ end : dernière ligne (la plus récente) du tampon (valeur par défaut) ; ¦ beginning : première ligne du tampon. Remarque – Les horodatages enregistrés dans le journal de la console reflètent l’heure du serveur. Ces horodatages reflètent l’heure locale et le journal de la console ILOM utilise l’UTC (temps universel). L’heure système du SE Solaris est indépendante de celle d’ILOM. Informations connexes ¦ « Pour définir l’état d’alimentation de l’hôte au redémarrage », page 49 ? Pour réparer une panne (shell de gestion des pannes d’ILOM) Vous pouvez utiliser la commande fmadm repair pour corriger des pannes diagnostiquées par ILOM. (Contrairement aux pannes détectées par l’hôte, les pannes et erreurs diagnostiquées par ILOM sont dotées d’un ID de message commençant par SPT.) Le seul moment auquel vous devriez utiliser la commande fmadm repair dans le shell de gestion des pannes d’ILOM pour une panne détectée par l’hôte est le cas où la panne est réparée sans qu’ILOM le remarque. Il se peut, par exemple, qu’ILOM ait été hors service lorsque la panne a été réparée. Dans ce cas, l’hôte n’afficherait plus la panne, contrairement à ILOM. Utilisez la commande fmadm repair pour effacer la panne. -> show /HOST/console/bootlog property82 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 1. Localisez la panne : 2. Pour réparer une panne détectée par ILOM, exécutez la commande fmadm repair : Remarque – Vous pouvez utiliser soit le nom NAC (par exemple, /SYS/MB) soit l’UUID (par exemple, fa4a2f86-5156-4243-8e88-d6516db12970) de la panne avec la commande fmadm repair. 3. Pour quitter le shell de gestion des pannes et revenir à ILOM, tapez : Informations connexes ¦ « Pour détecter les pannes (shell de gestion des pannes d’ILOM) », page 77 faultmgmtsp> fmadm faulty ----------------- ------------------------------------- -------------- -------- Time UUID msgid Severity ----------------- ------------------------------------- -------------- -------- 2010-09-03/20:46:23 fa4a2f86-5156-4243-8e88-d6516db12970 SPT-8000-DH Critical Fault class : fault.chassis.voltage.fail FRU : /SYS/MB (Part Number: 541-4197-04) (Serial Number: 1005LCB-1025D40059) Description : A chassis voltage supply is operating outside of the allowable range. Response : The system will be powered off. The chassis-wide service required LED will be illuminated. Impact : The system is not usable until repaired. ILOM will not allow the system to be powered on until repaired. Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> fmadm repair fa4a2f86-5156-4243-8e88-d6516db12970 faultmgmtsp> faultmgmtsp> exit ->Contrôle du serveur 83 ? Pour effacer une panne ? A l’invite -> d’ILOM, tapez : Définissez clear_fault_action sur true pour effacer la panne au niveau du composant et à tous les niveaux inférieurs de l’arborescence /SYS. Informations connexes ¦ « Pour détecter les pannes (ILOM) », page 77 ¦ « Pour détecter les pannes à l’aide du POST », page 79 ¦ « Pour afficher les composants du serveur », page 86 Activation de la récupération automatique du système Les sections suivantes présentent des informations relatives à la configuration du serveur en vue de récupérer automatiquement de pannes mineures. Remarque – Cette section fait référence à la fonction de récupération automatique du système et non à la fonction de dénomination voisine, l’Auto Service Request (requête automatique de service). ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 -> set /SYS/component clear_fault_action=true84 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Présentation de la récupération automatique de système Le serveur assure la récupération automatique du système (ASR) en cas de panne des modules de mémoire ou des cartes PCI. La fonction ASR permet au serveur de reprendre son fonctionnement après certaines défaillances ou pannes matérielles non fatales. Lorsque l’ASR est activée, les diagnostics du microprogramme du système détectent automatiquement les composants matériels en panne. Une fonction de configuration automatique intégrée au microprogramme du système permet au système de déconfigurer les composants en panne et de rétablir le fonctionnement du serveur. Tant que le serveur est en mesure de fonctionner sans le composant en panne, la fonction ASR lui permet de redémarrer automatiquement sans intervention de l’utilisateur. Remarque – Vous devez activer l’ASR manuellement. Reportez-vous à la section « Pour activer la fonction ASR », page 84. Pour plus d’informations sur l’ASR, reportez-vous au manuel d’entretien de votre serveur. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour activer la fonction ASR 1. A l’invite -> d’ILOM, tapez : 2. A l’invite ok, tapez : -> set /HOST/diag mode=normal -> set /HOST/diag level=max -> set /HOST/diag trigger=power-on-reset ok setenv auto-boot? true ok setenv auto-boot-on-error? trueContrôle du serveur 85 Remarque – Pour plus d’informations sur les variables de configuration OpenBoot, reportez-vous au manuel d’entretien du serveur. 3. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke en permanence les modifications apportées aux paramètres et est automatiquement initialisé si la variable de configuration OpenBoot auto-boot? est définie sur true (valeur par défaut). Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ? Pour désactiver la fonction ASR 1. A l’invite ok, tapez : 2. Pour rendre les changements de paramètres effectifs, tapez ce qui suit : Le serveur stocke définitivement le changement de paramètre. Une fois désactivée, la fonction ASR le reste tant que vous ne la réactivez pas. Informations connexes ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour afficher des informations sur les composants concernés par l’ASR », page 86 ¦ « Présentation de la récupération automatique de système », page 84 ok reset-all ok setenv auto-boot-on-error? false ok reset-all86 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour afficher des informations sur les composants concernés par l’ASR ? A l’invite -> d’ILOM, tapez : Dans la sortie de la commande show /SYS/composant component_state, tout périphérique indiqué comme désactivé a été déconfiguré manuellement en utilisant le microprogramme du système. La sortie de la commande indique également les périphériques qui ont échoué aux diagnostics du microprogramme et ont été automatiquement déconfigurés par le microprogramme du système. Informations connexes ¦ « Présentation de la récupération automatique de système », page 84 ¦ « Pour activer la fonction ASR », page 84 ¦ « Pour désactiver la fonction ASR », page 85 ¦ « Pour déconfigurer manuellement un périphérique », page 73 ¦ « Pour reconfigurer manuellement un périphérique », page 74 ? Pour afficher les composants du serveur Affichez des informations en temps réel sur les composants installés sur votre serveur en utilisant la commande show components d’ILOM. ? A l’invite -> d’ILOM, tapez : -> show /SYS/component component_state -> show components Target | Property | Value --------------------+------------------------+------------------- /SYS/MB/RISER0/ | component_state | Enabled PCIE0 | | /SYS/MB/RISER0/ | component_state | Disabled PCIE3 /SYS/MB/RISER1/ | component_state | Enabled PCIE1 | | /SYS/MB/RISER1/ | component_state | EnabledContrôle du serveur 87 Remarque – Les composants varient en fonction du serveur. Informations connexes ¦ « Pour identifier les chemins d’accès aux périphériques », page 43 ? Pour localiser le serveur Si vous avez besoin d’effectuer une opération de maintenance sur un composant, vous identifierez plus facilement le serveur concerné par la DEL de localisation système qui s’allume. Vous n’avez besoin d’aucun droit administrateur pour utiliser les commandes set /SYS/LOCATE et show /SYS/LOCATE. 1. Connectez-vous à ILOM. Reportez-vous à la section « Pour se connecter à ILOM », page 11. 2. Gérez la DEL de localisation à l’aide des commandes suivantes. ¦ Pour activer la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour désactiver la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : ¦ Pour afficher l’état de la DEL de localisation, depuis l’invite de commande du processeur de service ILOM, tapez ce qui suit : Informations connexes ¦ « Contrôle des pannes », page 75 ¦ « Configuration des périphériques », page 73 /SYS/MB/NET0 | component_state | Enabled /SYS/MB/NET1 | component_state | Enabled /SYS/MB/NET2 | component_state | Enabled -> set /SYS/LOCATE value=Fast_Blink -> set /SYS/LOCATE value=off -> show /SYS/LOCATE88 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201189 Mise à jour du microprogramme Les sections suivantes décrivent les procédures de mise à jour du microprogramme système et d’affichage des versions actuelles des microprogrammes des serveurs de la série SPARC T3 d’Oracle. ¦ « Pour afficher la version du microprogramme », page 89 ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Pour afficher la version d’OpenBoot », page 92 ¦ « Pour afficher la version de POST », page 93 ? Pour afficher la version du microprogramme La propriété /HOST sysfw_version affiche des informations relatives à la version du microprogramme système installée sur l’hôte. ? Affichez le paramètre actuel de cette propriété. A l’invite -> d’ILOM, tapez : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST sysfw_version90 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ? Pour mettre à jour le microprogramme 1. Assurez-vous que le port de gestion réseau du processeur de service est configuré. Pour les instructions, reportez-vous au guide d’installation de votre serveur. 2. Ouvrez une session SSH pour vous connecter au processeur de service : 3. Mettez l’hôte hors tension : 4. Définissez le paramètre keyswitch_state sur normal: 5. Tapez la commande load en indiquant le chemin d’accès à la nouvelle image flash. La commande load met à jour à la fois l’image flash du processeur de service et le microprogramme de l’hôte. La commande load requiert les informations suivantes : ¦ Adresse IP d’un serveur TFTP du réseau pouvant accéder à l’image flash ¦ Chemin d’accès complet à l’image flash à laquelle l’adresse IP peut accéder % ssh root@xxx.xxx.xxx.xxx ... Are you sure you want to continue connecting (yes/no) ? yes ... Password: password (nothing displayed) Waiting for daemons to initialize... Daemons ready Integrated Lights Out Manager Version 3.x.x.x Copyright 2010 Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. -> -> stop /SYS -> set /SYS keyswitch_state=normalMise à jour du microprogramme 91 Cette commande s’utilise de la manière suivante : load [-script] -source tftp://xxx.xxx.xx.xxx/chemin d’accès où : ¦ -script : ne demande aucune confirmation et agit comme si yes était spécifié. ¦ -source : indique l’adresse IP et le chemin d’accès complet (URL) de l’image flash. Une fois l’image flash mise à jour, le serveur est réinitialisé automatiquement, puis il exécute les diagnostics et revient à l’invite de connexion sur la console série. -> load -source tftp://129.99.99.99/pathname NOTE: A firmware upgrade will cause the server and ILOM to be reset. It is recommended that a clean shutdown of the server be done prior to the upgrade procedure. An upgrade takes about 6 minutes to complete. ILOM will enter a special mode to load new firmware. No other tasks can be performed in ILOM until the firmware upgrade is complete and ILOM is reset. Are you sure you want to load the specified file (y/n)?y Do you want to preserve the configuration (y/n)? y ................................................................. Firmware update is complete. ILOM will now be restarted with the new firmware. Update Complete. Reset device to use new image. -> U-Boot 1.x.x Custom AST2100 U-Boot 3.0 (Aug 21 2010 - 10:46:54) r58174 *** Net: faradaynic#0, faradaynic#1 Enter Diagnostics Mode [’q’uick/’n’ormal(default)/e’x’tended(manufacturing mode)] ..... 0 Diagnostics Mode - NORMAL Memory Data Bus Test ... PASSED Memory Address Bus Test ... PASSED I2C Probe Test - SP Bus Device Address Result === ============================ ======= ====== 6 SP FRUID (U1101) 0xA0 PASSED 6 DS1338(RTC) (U1102) 0xD0 PASSED PHY #0 R/W Test ... PASSED PHY #0 Link Status ... PASSED92 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Pour afficher la version du microprogramme », page 89 ? Pour afficher la version d’OpenBoot La propriété /HOST obp_version affiche des informations sur la version d’OpenBoot installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 ¦ « Présentation d’OpenBoot », page 4 ETHERNET PHY #0, Internal Loopback Test ... PASSED ## Booting image at 110a2000 ... *** Mounting local filesystems... Mounted all disk partitions. Configuring network interfaces...FTGMAC100: eth0:ftgmac100_open Starting system log daemon: syslogd and klogd. Starting capidirect daemon: capidirectd . Done Starting Event Manager: eventmgr . Done Starting ipmi log manager daemon: logmgr . Done Starting IPMI Stack: . Done Starting sshd. Starting SP fishwrap cache daemon: fishwrapd . Done Starting Host deamon: hostd . Done Starting Network Controller Sideband Interface Daemon: ncsid . Done Starting Platform Obfuscation Daemon: pod . Done Starting lu main daemon: lumain . Done Starting Detection/Diagnosis After System Boot: dasboot Done Starting Servicetags discoverer: stdiscoverer. Starting Servicetags listener: stlistener. Starting Dynamic FRUID Daemon: dynafrud Done hostname login: -> show /HOST obp_versionMise à jour du microprogramme 93 ? Pour afficher la version de POST La propriété /HOST post_version affiche des informations sur la version de POST installée sur l’hôte. ? Affichez la valeur actuelle de cette propriété : Informations connexes ¦ « Pour mettre à jour le microprogramme », page 90 -> show /HOST post_version94 Guide d’administration des serveurs de la série SPARC T3 • Octobre 201195 Mise à jour du système d’exploitation Oracle Solaris Ces rubriques décrivent comment mettre à jour le SE Oracle Solaris sur les serveurs Oracle SPARC de la série T3. ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe de nom universel Le SE Oracle Solaris utilise à présent la syntaxe de nom universel (WWN) au lieu du champ unique au niveau local tn (ID cible) dans les noms de périphériques logiques. Ce changement modifie la façon dont un périphérique de stockage cible est identifié lors du téléchargement du système d'exploitation sur un réseau. Les points suivants sont essentiels pour comprendre l’impact de ce changement :96 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ Avant le passage à la nomenclature WWN, le SE Oracle Solaris identifiait le périphérique d'initialisation par défaut comme étant c0t0d0. ¦ Depuis ce changement, l'identificateur du périphérique d'initialisation par défaut est désormais c0tWWNd0, où WWN correspond à une valeur hexadécimale unique à ce périphérique au niveau mondial. ¦ Cette valeur WWN n'est pas mappée de façon prévisible à l'adresse physique du périphérique auquel elle fait référence. Pour spécifier de manière fiable un périphérique de stockage particulier lors du téléchargement d'un système d'exploitation, vous devez déterminer la correspondance entre la valeur WWN affectée à ce périphérique et son emplacement physique. Vous trouverez cette correspondance à l'aide des commandes OBP ou Oracle Solaris : ¦ Dans OBP, exécutez probe-scsi-all. Voir « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ Dans Oracle Solaris, exécutez la commande format suivie de prtconf -v. Voir « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ou « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111. Ces commandes génèrent des informations sur les contrôleurs SAS et les périphériques de stockage qui leur sont connectés. Ces informations comprennent les noms logiques et physiques que vous pouvez analyser pour déterminer les relations entre les adresses physiques et logiques. Informations connexes ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116Mise à jour du système d’exploitation Oracle Solaris 97 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans une configuration de fond de panier à huit disques. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 7 disques durs dans une configuration de fond de panier à huit disques. Dans cet exemple, les disques durs sont connectés aux deux contrôleurs SAS de la manière suivante : ¦ Quatre disques durs sont connectés au contrôleur SAS 0. Il s'agit des cibles 9, a, b et c. ¦ Trois disques durs, ainsi qu'une unité de DVD SATA sont connectés au contrôleur SAS 1. Il s'agit respectivement des cibles 9, b, c et a. TABLEAU : Mappage des ports de contrôleurs SAS pour les backplanes à huit disques Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 798 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple de configuration est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33fba7 SASAddress 5000c5001d33fba5 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 6 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76e380 SASAddress 5000cca00a76e381 PhyNum 1 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76ddcc SASAddress 5000cca00a76ddcd PhyNum 3 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a75dcac SASAddress 5000cca00a75dcad PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a7680d4 SASAddress 5000cca00a7680d5 PhyNum 2 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d33eb5f SASAddress 5000c5001d33eb5d PhyNum 3 Target c Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d40bf9b SASAddress 5000c5001d40bf99 PhyNum 1Mise à jour du système d’exploitation Oracle Solaris 99 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque dans un fond de panier à seize disques connectés aux contrôleurs SAS intégrés 0 et 1.100 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – La configuration d'un fond de panier à 16 disques par défaut se compose de deux zones isolées de façon logique, les emplacements de disque 0 à 7 pouvant être vus par le contrôleur SAS 0 et les emplacements de disque 8 à 15 pouvant l'être par le contrôleur SAS 1. L'exemple suivant illustre la sortie de probe-scsi-all pour un serveur SPARC T3-1 doté de 9 disques durs dans une configuration de fond de panier à seize disques. Remarque – Le contrôleur 1 gère l'unité de DVD SATA. L'emplacement d'initialisation par défaut (emplacement physique 0) est répertorié sous le nom PhyNum 0 dans la section du contrôleur SAS 0. Son SASDeviceName a la valeur 5000cca00a59278c et son SASAddress a la valeur 5000cca00a59278d. TABLEAU : Mappage des ports de contrôleurs SAS pour les fonds de panier à seize disques Contrôleur SAS PhyNum (Hexadécimal) Emplacement de disque (Décimal) Contrôleur SAS PhyNum (Hexadéci mal) Emplacement de disque (Décimal) 0 0 0 1 8 8 1 1 9 9 2 2 A 10 3 3 B 11 4 4 C 12 5 5 D 13 6 6 E 14 7 7 F 15 ok probe-scsi-all /pci@400/pci@2/pci@0/pci@f/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a746490 SASAddress 5000cca00a746491 PhyNum 8 Target bMise à jour du système d’exploitation Oracle Solaris 101 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d1283 SASAddress 5000c5001d0d1281 PhyNum 9 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a01014c SASAddress 5000cca00a01014d PhyNum a Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0ca947 SASAddress 5000c5001d0ca945 PhyNum b Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0d2857 SASAddress 5000c5001d0d2855 PhyNum c Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02f5d0 SASAddress 5000cca00a02f5d1 PhyNum d Target 10 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d0c3d9b SASAddress 5000c5001d0c3d99 PhyNum e Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001d097737 SASAddress 5000c5001d097735 PhyNum f Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 /pci@400/pci@1/pci@0/pci@4/scsi@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a59278c SASAddress 5000cca00a59278d PhyNum 0 Target b Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7e6fb SASAddress 5000c50017c7e6f9 PhyNum 1 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a4bfcb8 SASAddress 5000cca00a4bfcb9 PhyNum 2 Target d Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c50017c7a3a3 SASAddress 5000c50017c7a3a1 PhyNum 3 Target e Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a02cc18 SASAddress 5000cca00a02cc19 PhyNum 4 Target f Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a76dec0 SASAddress 5000cca00a76dec1 PhyNum 5 Target 10 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00a773eac SASAddress 5000cca00a773ead PhyNum 6102 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 probe-scsi-all Exemple de sortie (SPARC T3-4) Lors de l'analyse de la sortie de probe-scsi-all, recherchez les informations du périphérique SAS suivantes : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. Target 11 Unit 0 Disk SEAGATE ST930003SSUN300G 0768 585937500 Blocks, 300 GB SASDeviceName 5000c5001d09654f SASAddress 5000c5001d09654d PhyNum d Target 12 Unit 0 Encl Serv device SUN SAS2 X16DBP 0305 SASAddress 50800200000272bd PhyNum 18 okMise à jour du système d’exploitation Oracle Solaris 103 ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. Un serveur SPARC T3-4 a deux contrôleurs SAS intégrés, chacun connecté à un fond de panier à quatre disques différent. Le tableau suivant montre la correspondance d'emplacement entre le PhyNum et le disque de ces fonds de panier. Remarque – OBP utilise un chemin d'accès différent au contrôleur SAS 1 dans les serveurs SPARC T3-4, selon que le serveur dispose de quatre ou deux processeurs. Le chemin d'accès au contrôleur SAS 0 est le même pour les deux configurations de processeurs. Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à quatre processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à quatre processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. TABLEAU : Mappage des ports de contrôleurs SAS pour un fond de panier à huit disques SAS Contrôleur PhyNum Emplacement de disque SAS Contrôleur PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7 ok probe-scsi-all /pci@700/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00104 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 105 Chemin d'accès au contrôleur SAS : Serveur SPARC T3-4 à deux processeurs L'exemple suivant illustre la sortie de probe-scsi-all pour un système SPARC T3-4 à deux processeurs et huit disques. Parce que le contrôleur SAS 0 contrôle les disques durs installés dans les emplacements 0 à 3 du fond de panier, l'unité d'initialisation par défaut de cet exemple est PhyNum 0 du groupe de disques durs se trouvant sous le contrôle du contrôleur 0. Son SASDeviceName a la valeur 5000cca00a75dcac et son SASAddress a la valeur 5000cca00a75dcad. ok probe-scsi-all /pci@500/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 1 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5cc8 SASAddress 5000cca00abc5cc9 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abaf620 SASAddress 5000cca00abaf621 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcec4c SASAddress 5000cca00abcec4d PhyNum 2 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc5218 SASAddress 5000cca00abc5219 PhyNum 3 /pci@400/pci@1/pci@0/pci@8/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0 <---- SAS controller 0 FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abcede0 SASAddress 5000cca00abcede1 PhyNum 0 Target a Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abc51a8 SASAddress 5000cca00abc51a9 PhyNum 1 Target b Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000cca00abce89c SASAddress 5000cca00abce89d PhyNum 2106 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Target c Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 G SASDeviceName 5000cca00abc5354 SASAddress 5000cca00abc5355 PhyNum 3Mise à jour du système d’exploitation Oracle Solaris 107 ? Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) Utilisez probe-scsi-all pour afficher les informations suivantes d'un périphérique SAS : ¦ SASDeviceName : Il s’agit de la valeur WWN reconnue par le SE Oracle Solaris. ¦ SASAddress : Il s’agit de la valeur WWN reconnue par OBP. ¦ PhyNum : Il s’agit de la valeur hexadécimale permettant d’identifier le port auquel un disque est connecté. ¦ VolumeDeviceName : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par le SE Oracle Solaris. ¦ VolumeWWID : Lorsqu'un volume RAID a été configuré, il s'agit de la valeur WWN du volume RAID reconnue par OBP. L'exemple suivant est basé sur un serveur SPARC T3-2 à six disques durs. Quatre disques durs sont connectés au contrôleur SAS en tant que périphériques de stockage individuels. Il s'agit de Target 9, d, e et f. Deux disques durs sont configurés en tant que volume RAID. Cette baie de disques est Target 389. ? Exécutez probe-scsi-all. Dans l'exemple suivant, le disque dur installé à l'emplacement physique 0 a la valeur PhyNum 0. Il est désigné Target 9 et son SASDeviceName a la valeur 5000c5001cb4a637. ok probe-scsi-all /pci@400/pci@2/pci@0/pci@4/scsi@0 <---- SAS controller FCode Version 1.00.54, MPT Version 2.00, Firmware Version 5.00.17.00 Target 9 Unit 0 Disk SEAGATE ST930003SSUN300G 0868 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb4a637 SASAddress 5000c5001cb4a635 PhyNum 0 Target a Unit 0 Removable Read Only device TEAC DV-W28SS-R 1.0C SATA device PhyNum 7 Target d Unit 0 Disk HITACHI H103030SCSUN300G A2A8 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb477cb SASAddress 5000c5001cb477c9 PhyNum 1 Target e Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB108 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Remarque – L'exemple de sortie de probe-scsi-all illustré ci-dessus peut être appliqué à l'interprétation de la sortie de probe-scsi-all pour les systèmes SPARC T3-1B. Remarque – La sortie de probe-scsi-all des serveurs SPARC T3-1 et SPARC T3-4 présente des caractéristiques spéciales en raison de leur utilisation de deux contrôleurs SAS intégrés. En outre, sur les serveurs SPARC T3-1 dotés d'un fond de panier à seize disques, les deux contrôleurs se connectent aux disques durs à l'aide d'un expandeur SAS figurant sur le fond de panier. Ces différences sont expliquées dans « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 et « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 SASDeviceName 5000c5001cb47f93 SASAddress 5000c5001cb47f91 PhyNum 2 Target f Unit 0 Disk SEAGATE ST930003SSUN300G 0B70 585937500 Blocks, 300 GB SASDeviceName 5000c5001cb47f7f SASAddress 5000c5001cb47f7d PhyNum 3 Target 389 Volume 0 Unit 0 Disk LSI Logical Volume 3000 583983104 Blocks, 298 GB VolumeDeviceName 3ce534e42c02a3c0 VolumeWWID 0ce534e42c02a3c0 /pci@400/pci@1/pci@0/pci@b/pci@0/usb@0,2/hub@2/hub@3/storage@2 Unit 0 Removable Read Only device AMI Virtual CDROM 1.00Mise à jour du système d’exploitation Oracle Solaris 109 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 dotés d'un fond de panier à seize disques. Ces systèmes disposent d'un expandeur SAS placé entre les deux contrôleurs SAS intégrés et les connecteurs de disque dur. Le fond de panier à 16 disques est divisé en zones, la valeur phy-num associée à chaque disque étant relative à son contrôleur. Remarque – Pour les systèmes dotés d'un fond de panier à huit disques et de deux contrôleurs intégrés, chaque contrôleur fournit une interface à quatre emplacements de disque. La valeur phy-num associée à chaque disque est ainsi relative à son contrôleur. Un exemple de la procédure de configuration d'un seul initiateur est donné dans « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 1. Exécutez la commande format. Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000c5001d3ff2d7d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000c5001d3ff2d7d0. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000C5001D3FF2D7d0 /scsi_vhci/disk@g5000c5001d3ff2d7 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...] Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/sd3a110 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000c5001d3ff2d7. Notez la valeur target-port répertoriée avec cette valeur WWN. Dans cet exemple, il s'agit de 5000c5001d3ff2d5. Il s'agit de l'ID cible du disque physique. Remarque – Dans un système SPARC T3-1 doté d'un fond de panier à seize disques, les deux contrôleurs répertorient le nom logique (la valeur wwn), le nom de port correspondant (valeur target-port) et l'emplacement de disque physique (valeur phy-num) de chaque disque dur connecté. dev_path=/scsi_vhci/disk@g5000c5001d3ff2d7:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000C5001D3FF2D7d0s0 <<=== Device path dev_link=/dev/rsd3a Paths from multipath bus adapters: mpt_sas#2 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ <<=== Hard drive target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 <<=== Hard drive slot number name=’path-class’ type=string items=1 value=’primary’ mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000c5001d3ff2d7’ name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000c5001d3ff2d5’ name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000c5001d3ff2d5,0’ name=’phy-num’ type=int items=1 value=00000004 name=’path-class’ type=string items=1 value=’primary’Mise à jour du système d’exploitation Oracle Solaris 111 4. The value shown for the name=’phy-num’ entry indicates the physical slot containing the hard drive. Dans cet exemple, le périphérique cible se trouve à l'emplacement 4. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 ? Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) La procédure décrite ci-dessous s'applique aux serveurs SPARC T3-1 et aux serveurs SPARC T3-4 d'une configuration de fond de panier à huit disques et un seul initiateur. 1. Exécutez la commande format. # format Searching for disks...done AVAILABLE DISK SELECTIONS: 0. c0t5000CCA00ABBAEB8d0 /scsi_vhci/disk@g5000cca00abbaeb8 1. c0t5000C5001D40D7F7d0 /scsi_vhci/disk@g5000c5001d40d7f7 [...]112 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Les étapes restantes de cet exemple permettent d'identifier l'emplacement physique correspondant au nom du périphérique c0t5000CCA00ABBAEB8d0. 2. Exécutez prtconf -v et recherchez le lien du périphérique c0t5000CCA00ABBAEB8d0. 3. Recherchez dans la sortie de prtconf une entrée name=’wwn’ comportant la valeur WWN 5000cca00abbaeb8. Notez la valeur obp-path répertoriée sous le WWN 5000cca00abbaeb8. Reportez-vous au tableau ci-dessous pour trouver le contrôleur. Pour les serveurs SPARC T3-1, le contrôleur est identifié dans le deuxième champ : pci@1 = contrôleur 0 et pci@2 = contrôleur 1. Pour les serveurs SPARC T3-4, le contrôleur est identifié dans le premier champ. Pour les systèmes équipés de quatre processeurs, pci@400 = contrôleur 0 et pci@700 = contrôleur 1. Pour les systèmes équipés de deux processeurs, pci@400 = contrôleur 0 et pci@500 = contrôleur 1. Device Minor Nodes: dev=(32,0) dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a spectype=blk type=minor dev_link=/dev/dsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/sd3a dev_path=/scsi_vhci/disk@g5000cca00abbaeb8:a,raw spectype=chr type=minor dev_link=/dev/rdsk/c0t5000CCA00ABBAEB8d0s0 <<=== Device path dev_link=/dev/rsd3a SPARC T3-1 Contrôleur 0 /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@400/pci@2/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 4) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@700/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 SPARC T3-1 (processeur 2) Contrôleur 0 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur 1 /pci@500/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0Mise à jour du système d’exploitation Oracle Solaris 113 L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-1. Dans cet exemple de serveur SPARC T3-1, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. L'exemple de sortie suivant montre la valeur obp-path pour un serveur SPARC T3-4. Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’ /pci@400/pci@1/pci@0/pci@4/scsi@0/disk@w5000cca00abbaeb9,0 Paths from multipath bus adapters: mpt_sas#5 (online) name=’wwn’ type=string items=1 value=’5000cca00abbaeb8’ <<=== Hard drive WWN ID name=’lun’ type=int items=1 value=00000000 name=’target-port’ type=string items=1 value=’5000cca00abbaeb9’ <<=== Hard drive Target ID name=’obp-path’ type=string items=1 value=’/pci@400/pci@1/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0’ name=’phy-num’ type=int items=1 value=00000000 name=’path-class’ type=string items=1 value=’primary’114 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 Dans cet exemple de serveur SPARC T3-4, la valeur obp-path est la suivante : D'après le tableau précédent, ce disque se trouve sur le contrôleur 0. 4. Cette valeur phy-num correspond à l'emplacement de disque physique 0, comme indiqué dans la table de mappage des ports suivante. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 /pci@400/pci@1/pci@0/pci@0/LSI,sas@0/disk@w5000cca00abbaeb9,0 Contrôleur SAS PhyNum Emplacement de disque Contrôleur SAS PhyNum Emplacement de disque 0 0 0 1 0 4 1 1 1 5 2 2 2 6 3 3 3 7Mise à jour du système d’exploitation Oracle Solaris 115 Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur une unité de disque précise. Dans cet exemple, le nom du périphérique contient la valeur WWN 5000CCA00A75DCAC. Remarque – Les règles syntaxiques d’Oracle Solaris requièrent la mise en majuscules de tous les caractères alphabétiques. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 # install_type flash_install boot_device c0t5000CCA00A75DCACd0s0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swap116 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID », page 116 Syntaxe WWN d'une installation de système d'exploitation sur un volume RAID L’exemple de profil Oracle Solaris JumpStart suivant illustre l’utilisation de la syntaxe WWN dans le cadre de l’installation du SE sur un volume RAID. Lors de l'installation d'un logiciel sur un volume RAID, utilisez la valeur VolumeDeviceName du périphérique virtuel au lieu du nom de périphérique individuel. Dans cet exemple, le nom du volume RAID est 3ce534e42c02a3c0. Informations connexes ¦ « Syntaxe de nom universel », page 95 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à huit disques) », page 97 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-1, fond de panier à seize disques) », page 99 ¦ « probe-scsi-all Exemple de sortie (SPARC T3-4) », page 102 ¦ « Identification d’un emplacement de disque à l'aide de probe-scsi-all (OBP) », page 107 # install_type flash_install boot_device 3ce534e42c02a3c0 preserve archive_location nfs 129.148.94.249:/export/install/media/solaris/builds/s10u9/flar/latest.flar # Disk layouts # partitioning explicit filesys rootdisk.s0 free / filesys rootdisk.s1 8192 swapMise à jour du système d’exploitation Oracle Solaris 117 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, contrôleurs intégrés) », page 109 ¦ « Identification d'un emplacement de disque à l'aide de prtconf (Oracle Solaris, un seul initiateur) », page 111 ¦ « Syntaxe WWN d'une installation de système d'exploitation sur un périphérique spécifique », page 115118 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011119 Index A A propos, 1 Accès à la console système, 12 Accès réseau, activation ou désactivation, 54 Activation, 84 Adresse MAC de l’hôte, affichage, 55 Affichage de la version, 89, 92, 93 Affichage des composants concernés, 86 Annulation de la configuration, 73 C Câbles, clavier et souris, 15 Chemins d’accès aux périphériques, 43 Clavier, connexion, 15 Commandes, 37 Communication système, 11 Comportement à l’expiration du délai d’initialisation, 71 Comportement en cas d’échec du redémarrage, 71 Comportement lorsque l’hôte cesse de fonctionner, 70 Comportement suite à la réinitialisation de l’hôte, 69 Configuration, 25, 74 Connexion, 11 Console système, connexion, 12 Contournement, 83 Contrôle, 19 Création de volumes, 38 D Date d’expiration, 66 Définition au redémarrage, 49 Définition de l’état d’alimentation de l’hôte au redémarrage, 49 Définition de l’intervalle du délai d’attente d’initialisation, 70 Définition du nombre maximum de tentatives de redémarrage, 72 Désactivation, 85 Détection à l’aide d’ILOM, 77 Détection à l’aide du POST, 79 DHCP, affichage de l’adresse IP du serveur, 54 Diagnostic, 76 E Effacement, 83 Exécution de diagnostics, 79 F FCode, utilitaire, 36 Fonctions spécifiques à la plate-forme, 3 FRU, modification des données, 45 G Gestion, 73, 75 Gestion de la configuration, 62 Gestion du délai de mise sous tension, 50 Gestion du script, 65 Gestion du système, 61 Gestion lors de la réinitialisation, 64 H Historique de la console, affichage, 80 I Identification du système, modification, 46 Interrupteur à clé, comportement de l’hôte, 51 Invite, 12, 15120 Guide d’administration des serveurs de la série SPARC T3 • Octobre 2011 L Localisation du serveur, 87 M Méthodes d’accès, 15 Microprogramme, mise à jour, 90 Mise hors tension, 20 Mise sous tension, 19 Moniteur graphique local, 15 Multiacheminement, logiciel, 6 N Nom d’utilisateur et mot de passe par défaut, 12 O ok, affichage de l’invite, 13 Options d’adresse réseau, 53 Oracle VM Server (LDoms), 62 Oracle VM Server pour SPARC, présentation, 5 P Présentation, 1, 61 Présentation de l’administration système, 1 Prise en charge, 25 R Réinitialisation à partir d’ILOM, 22 Réinitialisation à partir du SE, 21 Restauration au redémarrage, 48 S setting configuration variables, 16 SP, réinitialisation, 23 Stratégie d’initialisation parallèle, 50 SunVTS, 76 SPARC T3-4 Server Service Manual Part No. E20813-02 August 2011, Revision APlease Recycle Copyright © 2010, 2011, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, 2011, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Using This Documentation xi Identifying Server Components 1 Front Components 2 Main Module Components 3 Processor Module Components 4 Rear Components 6 Illustrated Parts Breakdown 8 Detecting and Managing Faults 11 Diagnostics Overview 11 Diagnostics Process 12 Interpreting Diagnostic LEDs 16 Front Panel System Controls and LEDs 16 Rear I/O Module LEDs 19 Managing Faults (ILOM) 23 ILOM Troubleshooting Overview 23 ? Access the Service Processor (ILOM) 25 ? Display FRU Information (show Command) 27 ? Check for Faults (show faulty Command) 28 ? Check for Faults (fmadm faulty Command) 29 ? Clear Faults (clear_fault_action Property) 30 Fault Managment Command Examples 31iv SPARC T3-4 Server Service Manual • August 2011 show faulty Example of a Power Supply Fault 32 fmadm faulty Example of a Power Supply Fault 32 show faulty Example of a POST-Detected Fault 33 show faulty Example of a PSH-Detected Fault 34 Service-Related ILOM Commands 35 Interpreting Log Files and System Messages 36 ? Check the Message Buffer 37 ? View System Message Log Files 37 Using Oracle Solaris Predictive Self-Healing 38 PSH Overview 38 PSH-Detected Fault Example 39 ? Check for PSH-Detected Faults 40 ? Clear PSH-Detected Faults 42 Running POST 43 POST Overview 44 ILOM Properties That Affect POST Behavior 44 ? Configure POST 46 ? Run POST With Maximum Testing 48 ? Interpret POST Fault Messages 49 ? Clear POST-Detected Faults 50 POST Output Reference 51 Managing Components (ASR) 53 ASR Overview 53 ? Display System Components 54 ? Disable System Components 55 ? Enable System Components 56 Verifying SunVTS Installation 57 SunVTS Overview 57Contents v ? Verify SunVTS Installation 58 Preparing for Service 59 Safety Information 59 Safety Symbols 59 ESD Measures 60 Antistatic Wrist Strap Use 60 Antistatic Mat 60 Tools Needed for Service 61 ? Find the Chassis Serial Number 61 ? Locate the Server 62 Understanding Component Replacement Categories 63 FRU Reference 63 Hot Service, Replacement by Customer 64 Cold Service, Replacement by Customer 65 Cold Service, Replacement by Authorized Service Personnel 66 Removing Power From the System 66 ? Power Off the Server (Service Processor Command) 67 ? Power Off the Server (Power Button - Graceful) 68 ? Power Off the Server (Emergency Shutdown) 68 Accessing Internal Components 69 ? Prevent ESD Damage 69 Accessing Main Module Components 70 ? Remove the Main Module 70 ? Install the Main Module 72 Filler Panels 74 Servicing Processor Modules 77 Processor Module Configuration Reference 77vi SPARC T3-4 Server Service Manual • August 2011 Processor Module LEDs 78 Replacing a Faulty Processor Module 80 Processor Module Replacement Guidelines 80 ? Locate a Faulty Processor Module 81 ? Remove a Processor Module 81 ? Install a Processor Module 85 ? Install a New Processor Module 87 ? Verify Processor Module Functionality 90 Servicing DIMMs 91 Memory Fault Handling Overview 91 Understanding DIMM Configurations 92 DIMM Configuration Guidelines 93 Half-Populated Configuration 93 3/4-Populated Configuration 95 Fully-Populated Configuration 97 One Processor Module Memory Configurations 99 Two Processor Module Memory Configurations 100 ? Locate a Faulty DIMM Using the DIMM Fault Remind Button 102 ? Locate a Faulty DIMM Using the show faulty Command 103 ? Remove a DIMM 103 ? Install a DIMM 105 ? Increase System Memory With Additional DIMMs 107 ? Verify DIMM Functionality 109 Servicing Hard Drives 113 Hard Drive Hot-Pluggable Capabilities 113 Hard Drive Configuration Reference 114 Hard Drive LEDs 115Contents vii ? Locate a Faulty Hard Drive 116 ? Remove a Hard Drive 117 ? Install a Hard Drive 120 ? Verify Hard Drive Functionality 121 Servicing Power Supplies 123 Power Supply Overview 123 Power Supply and AC Power Connector Configuration Reference 124 Power Supply and AC Power Connector LEDs 126 ? Locate a Faulty Power Supply 127 ? Remove a Power Supply 128 ? Install a Power Supply 130 ? Verify Power Supply Functionality 133 Servicing RAID Expansion Modules 135 ? Remove the RAID Expansion Module 135 ? Install the RAID Expansion Module 136 Servicing the Service Processor 139 Service Processor Overview 139 ? Locate a Faulty Service Processor 140 ? Remove the Service Processor 140 ? Install the Service Processor 142 ? Verify Service Processor Functionality 144 Servicing the System Battery 145 ? Remove the System Battery 145 ? Install the System Battery 146 ? Verify the System Battery 148 Servicing Fan Modules 151viii SPARC T3-4 Server Service Manual • August 2011 Fan Module Overview 151 Fan Module Configuration Reference 152 Fan Module LED 153 ? Locate a Faulty Fan Module 154 ? Remove a Fan Module 154 ? Install a Fan Module 156 ? Verify Fan Module Functionality 157 Servicing Express Modules 159 Express Module Configuration Reference 159 Express Module FRU Paths 161 FRU Paths For Systems With One Running Processor Module 162 FRU Paths For Systems With Two Running Processor Modules 163 FRU Paths For Systems With One Failed Processor Module 165 ? Locate a Faulty Express Module 167 ? Remove an Express Module 168 ? Install an Express Module 170 ? Verify Express Module Functionality 172 Servicing the Rear I/O Module 175 Rear I/O Module LEDs 175 ? Locate a Faulty Rear I/O Module 178 ? Remove the Rear I/O Module 178 ? Install the Rear I/O Module 179 ? Verify Rear I/O Module Functionality 181 Servicing the System Configuration PROM 183 System Configuration PROM Overview 183 ? Remove the System Configuration PROM 183 ? Install the System Configuration PROM 185Contents ix Servicing the Front I/O Assembly 189 Front I/O Assembly Overview 189 ? Remove the Front I/O Assembly 189 ? Install the Front I/O Assembly 192 Servicing the Storage Backplane 195 ? Remove a Storage Backplane 195 ? Install a Storage Backplane 199 Servicing the Main Module Motherboard 203 Main Module Motherboard Overview 203 Main Module Motherboard LEDs 204 ? Locate a Faulty Main Module Motherboard 205 ? Remove the Main Module Motherboard 206 ? Install the Main Module Motherboard 207 ? Verify Main Module Motherboard Functionality 209 Servicing the Rear Chassis Subassembly 211 Rear Chassis Subassembly Overview 211 ? Remove the Rear Chassis Subassembly 211 ? Install the Rear Chassis Subassembly 213 Returning the Server to Operation 215 ? Connect Power Cords to the Server 215 ? Power On the Server (start /SYS Command) 215 ? Power On the Server (Power Button) 216 Index 217x SPARC T3-4 Server Service Manual • August 2011xi Using This Documentation This service manual is for experienced system engineers with training in servicing Oracle’s SPARC T3-4 servers. The manual contains detailed instructions for troubleshooting, repairing, and upgrading server components. To use the information in this document, you must have experience working with advanced server technology. Note – All internal components except hard drives must be installed by qualified service technicians only. ¦ “Related Documentation” on page xi ¦ “Feedback” on page xii ¦ “Support and Accessibility” on page xii Related Documentation Documentation Links All Oracle products http://www.oracle.com/documentation SPARC T3-4 server http://www.oracle.com/pls/topic/lookup?ctx=E19417-01&id= homepage Integrated Lights Out Manager (ILOM) 3.0 http://www.oracle.com/pls/topic/lookup?ctx=E19860-01&id= homepagexii SPARC T3-4 Server Service Manual • August 2011 Feedback Provide feedback on this documentation at: http://www.oracle.com/goto/docfeedback Support and Accessibility Description Links Access electronic support through My Oracle Support http://support.oracle.com For hearing impaired: http://www.oracle.com/accessibility/support.html Learn about Oracle’s commitment to accessibility http://www.oracle.com/us/corporate/accessibility/index.html1 Identifying Server Components These topics identify key components of the SPARC T3-4 server, including major boards and internal system cables, as well as front and rear panel features. ¦ “Front Components” on page 2 ¦ “Main Module Components” on page 3 ¦ “Processor Module Components” on page 4 ¦ “Rear Components” on page 6 ¦ “Illustrated Parts Breakdown” on page 82 SPARC T3-4 Server Service Manual • August 2011 Front Components FIGURE: Front Components Related Information ¦ “Servicing Hard Drives” on page 113 ¦ “Servicing Processor Modules” on page 77 ¦ “Accessing Main Module Components” on page 70 ¦ “Servicing the Main Module Motherboard” on page 203 Figure Legend 1 Hard drives (8) 2 Processor modules (2) 3 Main module 4 Power supplies (4)Identifying Server Components 3 ¦ “Servicing Power Supplies” on page 123 Main Module Components These components are accessible within the main module when you remove the main module from the front of the server. FIGURE: Main Module Components Figure Legend 1 Hard drives (8) 2 Front I/O assembly and cables 3 RAID expansion module 1 4 Internal USB connectors (not supported) 5 RAID expansion module 04 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Accessing Main Module Components” on page 70 ¦ “Servicing Hard Drives” on page 113 ¦ “Servicing the Front I/O Assembly” on page 189 ¦ “Servicing RAID Expansion Modules” on page 135 ¦ “Servicing the Main Module Motherboard” on page 203 ¦ “Servicing the System Configuration PROM” on page 183 ¦ “Servicing the System Battery” on page 145 ¦ “Servicing the Service Processor” on page 139 ¦ “Servicing the Storage Backplane” on page 195 Processor Module Components These components are accessible within the processor module when you remove the processor module from the front of the server. 6 Main module motherboard 7 System configuration PROM 8 System battery 9 Service processor 10 Storage backplanes and cables Figure Legend (Continued)Identifying Server Components 5 FIGURE: Processor Module Components Related Information ¦ “Servicing Processor Modules” on page 77 ¦ “Servicing DIMMs” on page 91 Figure Legend 1 DIMMs6 SPARC T3-4 Server Service Manual • August 2011 Rear Components FIGURE: Rear Components The following figure shows the components that are accessible within the rear chassis subassembly, which you would be able to access after you have removed all the components from the rear of the server. Figure Legend 1 Fan modules (5) 2 AC power connectors (4) 3 Rear I/O module 4 Express module slots (16)Identifying Server Components 7 FIGURE: Rear Chassis Subassembly Components Related Information ¦ “Servicing Fan Modules” on page 151 ¦ “Servicing Power Supplies” on page 123 ¦ “Servicing the Rear I/O Module” on page 175 ¦ “Servicing Express Modules” on page 159 ¦ “Servicing the Rear Chassis Subassembly” on page 211 Figure Legend 1 System chassis 2 Midplane 3 Rear chassis subassembly8 SPARC T3-4 Server Service Manual • August 2011 Illustrated Parts Breakdown FIGURE: Illustrated Parts Breakdown Figure Legend 1 Power supplies (4) 2 Hard drives (8), within the main module 3 Main module 4 Front I/O assembly, within the main module 5 Processor module 6 Processor module filler panel 7 Fan modules (5) 8 Express modules (16) 9 Rear I/O moduleIdentifying Server Components 9 Related Information ¦ “Servicing Processor Modules” on page 77 ¦ “Servicing DIMMs” on page 91 ¦ “Servicing Hard Drives” on page 113 ¦ “Servicing Power Supplies” on page 123 ¦ “Servicing RAID Expansion Modules” on page 135 ¦ “Servicing the Service Processor” on page 139 ¦ “Servicing the System Battery” on page 145 ¦ “Servicing Fan Modules” on page 151 ¦ “Servicing Express Modules” on page 159 ¦ “Servicing the Rear I/O Module” on page 175 ¦ “Servicing the System Configuration PROM” on page 183 ¦ “Servicing the Front I/O Assembly” on page 189 ¦ “Servicing the Storage Backplane” on page 195 ¦ “Servicing the Main Module Motherboard” on page 203 ¦ “Servicing the Rear Chassis Subassembly” on page 211 10 Rear chassis subassembly 11 Midplane, part of the rear chassis subassembly 12 SPARC T3-4 chassis Figure Legend (Continued)10 SPARC T3-4 Server Service Manual • August 201111 Detecting and Managing Faults These topics explain how to use various diagnostic tools to monitor server status and troubleshoot faults in the server. ¦ “Diagnostics Overview” on page 11 ¦ “Diagnostics Process” on page 12 ¦ “Interpreting Diagnostic LEDs” on page 16 ¦ “Managing Faults (ILOM)” on page 23 ¦ “Interpreting Log Files and System Messages” on page 36 ¦ “Using Oracle Solaris Predictive Self-Healing” on page 38 ¦ “Running POST” on page 43 ¦ “Managing Components (ASR)” on page 53 ¦ “Verifying SunVTS Installation” on page 57 Diagnostics Overview You can use a variety of diagnostic tools, commands, and indicators to monitor and troubleshoot a server: ¦ LEDs – Provide a quick visual notification of the status of the server and of some of the FRUs. ¦ Integrated Lights Out Manager – The ILOM firmware runs on the service processor. In addition to providing the interface between the hardware and OS, ILOM also tracks and reports the health of key server components. ILOM works closely with POST and Oracle Solaris Predictive Self-Healing technology to keep the system running even when there is a faulty component. ¦ Power-on self-test – POST performs diagnostics on system components upon system reset to ensure the integrity of those components. POST is configureable and works with ILOM to take faulty components offline if needed.12 SPARC T3-4 Server Service Manual • August 2011 ¦ Oracle Solaris OS Predictive Self-Healing - The PSH technology continuously monitors the health of the CPU, memory and other components, and works with ILOM to take a faulty component offline if needed. The PSH technology enables systems to accurately predict component failures and mitigate many serious problems before they occur. ¦ Log files and command interface – Provide the standard Oracle Solaris OS log files and investigative commands that can be accessed and displayed on the device of your choice. ¦ SunVTS – An application that exercises the system, provides hardware validation, and discloses possible faulty components with recommendations for repair. The LEDs, ILOM, PSH, and many of the log files and console messages are integrated. For example, when the Oracle Solaris software detects a fault, it displays the fault, logs it, and passes information to ILOM where it is logged. Depending on the fault, one or more LEDs might also be illuminated. The diagnostic flow chart in “Diagnostics Process” on page 12 describes an approach for using the server diagnostics to identify a faulty field-replaceable unit (FRU). The diagnostics you use, and the order in which you use them, depend on the nature of the problem you are troubleshooting. So you might perform some actions and not others. Related Information ¦ “Diagnostics Process” on page 12 ¦ “Interpreting Diagnostic LEDs” on page 16 ¦ “Managing Faults (ILOM)” on page 23 ¦ “Interpreting Log Files and System Messages” on page 36 ¦ “Using Oracle Solaris Predictive Self-Healing” on page 38 ¦ “Running POST” on page 43 ¦ “Managing Components (ASR)” on page 53 ¦ “Verifying SunVTS Installation” on page 57 Diagnostics Process The following flowchart illustrates the complementary relationship of the different diagnostic tools and indicates a default sequence of use.Detecting and Managing Faults 13 FIGURE: Diagnostics Flowchart The following table provides brief descriptions of the troubleshooting actions shown in the flowchart. It also provides links to topics with additional information on each diagnostic action.14 SPARC T3-4 Server Service Manual • August 2011 TABLE: Diagnostic Flowchart Reference Table Flowchart Diagnostic Action Possible Outcome Additional Information 1 Check Power OK and AC Present LEDs on the server. The Power OK LED is located on the front and rear of the chassis. The AC Present LED is located on the rear of the server on each power supply. If these LEDs are not on, check the power source and power connections to the server. • “Interpreting Diagnostic LEDs” on page 16 2 Run the ILOM show faulty command to check for faults. The show faulty command displays the following kinds of faults: • Environmental faults • PSH-detected faults • POST-detected faults Faulty FRUs are identified in fault messages using the FRU name. • “Service-Related ILOM Commands” on page 35 • “Check for Faults (show faulty Command)” on page 28 3 Check the Oracle Solaris log files for fault information. The Oracle Solaris message buffer and log files record system events, and provide information about faults. • If system messages indicate a faulty device, replace the FRU. • For more diagnostic information, review the SunVTS report. (Flowchart item 4) • “Interpreting Log Files and System Messages” on page 36 4 Run SunVTS software. SunVTS is an application you can run to exercise and diagnose FRUs. To run SunVTS, the server must be running the Oracle Solaris OS. • If SunVTS reports a faulty device, replace the FRU. • If SunVTS does not report a faulty device, run POST. (Flowchart item 5) • “Verifying SunVTS Installation” on page 57 5 Run POST. POST performs basic tests of the server components and reports faulty FRUs. • “Running POST” on page 43 • “ILOM Properties That Affect POST Behavior” on page 44Detecting and Managing Faults 15 6 Determine if the fault was detected by the ILOM fault management software. Determine if the fault is an environmental fault or a configuration fault. If the fault listed by the show faulty command displays a temperature or voltage fault, then the fault is an environmental fault. Environmental faults can be caused by faulty FRUs (power supply or fan), or by environmental conditions such as ambient temperature that is too high or lack of sufficient airflow through the server. When the environmental condition is corrected, the fault will automatically clear. If the fault indicates that a fan or power supply is bad, you can replace the FRU. You can also use the fault LEDs on the server to identify the faulty FRU (fans and power supplies). • “Check for Faults (show faulty Command)” on page 28 7 Determine if the fault was detected by PSH. If the fault displayed included a uuid and sunw-msg-id property, the fault was detected by the PSH software. If the fault is a PSH-detected fault, refer to the PSH Knowledge Article web site for additional information. The Knowledge Article for the fault is located at the following link: where message-ID is the value of the sunw-msg-id property displayed by the show faulty command. After the FRU is replaced, perform the procedure to clear PSH-detected faults. • “Using Oracle Solaris Predictive Self-Healing” on page 38 • “Clear PSH-Detected Faults” on page 42 8 Determine if the fault was detected by POST. POST performs basic tests of the server components and reports faulty FRUs. When POST detects a faulty FRU, it logs the fault, and if possible, takes the FRU offline. POST-detected FRUs display the following text in the fault message: Forced fail reason In a POST fault message, reason is the name of the power-on routine that detected the failure. • “Running POST” on page 43 • “Clear POST-Detected Faults” on page 50 9 Contact technical support. The majority of hardware faults are detected by the server’s diagnostics. In rare cases a problem might require additional troubleshooting. If you are unable to determine the cause of the problem, contact your service representative for support. TABLE: Diagnostic Flowchart Reference Table (Continued) Flowchart Diagnostic Action Possible Outcome Additional Information16 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Diagnostics Overview” on page 11 ¦ “Interpreting Diagnostic LEDs” on page 16 ¦ “Managing Faults (ILOM)” on page 23 ¦ “Interpreting Log Files and System Messages” on page 36 ¦ “Using Oracle Solaris Predictive Self-Healing” on page 38 ¦ “Running POST” on page 43 ¦ “Managing Components (ASR)” on page 53 ¦ “Verifying SunVTS Installation” on page 57 Interpreting Diagnostic LEDs Use the following diagnostic LEDs to determine if a component has failed in the server. Front Panel System Controls and LEDs The system status is represented by six LEDs on the front panel. These LEDs are shown in the following figure and described in the table that follows the figure. TABLE: Interpreting Diagnostic LEDs Type of LEDs LED Location Links Server-level LEDs On the front and rear of the server • “Front Panel System Controls and LEDs” on page 16 • “Rear I/O Module LEDs” on page 19 Component-level LEDs On each individual component • “Processor Module LEDs” on page 78 • “Hard Drive LEDs” on page 115 • “Power Supply and AC Power Connector LEDs” on page 126 • “Fan Module LED” on page 153 • “Main Module Motherboard LEDs” on page 204Detecting and Managing Faults 1718 SPARC T3-4 Server Service Manual • August 2011 TABLE: Front Panel System Controls and LEDs No. LED Icon Description 1 System Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rapidly. There are two methods for turning a Locator LED on: • Issuing the ILOM command set /SYS/LOCATE value= Fast_Blink • Pressing the Locator button. 2 System Service Required LED (amber) Indicates that service is required. POST and ILOM are two diagnostics tools that can detect a fault or failure resulting in this indication. The ILOM show faulty command provides details about any faults that cause this indicator to light. Under some fault conditions, individual component fault LEDs are turned on in addition to the Service Required LED. 3 System Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The service processor might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Fast blink – System is running in standby mode and can be quickly returned to full function. • Slow blink – A normal but transitory activity is taking place. Slow blinking might indicate that system diagnostics are running or that the system is booting. 4 System Power button The recessed Power button toggles the system on or off. • Press once to turn the system on. • Press once to shut the system down in a normal manner. • Press and hold for 4 seconds to perform an emergency shutdown.Detecting and Managing Faults 19 Rear I/O Module LEDs The rear I/O module has several LEDs, some of which give system status information, while others provide link information on the NET and QSFP ports. These LEDs are shown in the following figure and described in the table that follows the figure. 5 System Overtemp LED (amber) Provides the following operational temperature indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a temperature failure event has been acknowledged and a service action is required. 6 Rear Fan Module Fault LED (amber) REAR FAN Provides the following operational fan module indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a fan module failure event has been acknowledged and a service action is required on at least one of the fan modules. 7 Rear Express Module Fault LED (amber) REAR EM Provides the following operational express module indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a failure event has been acknowledged and a service action is required on at least one of the express modules. TABLE: Front Panel System Controls and LEDs (Continued) No. LED Icon Description20 SPARC T3-4 Server Service Manual • August 2011 TABLE: Rear Panel Controls and LEDs No. LED Icon Description 1 System Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rapidly. There are two methods for turning a Locator LED on: • Issuing the ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button 2 System Service Required LED (amber) Indicates that service is required. POST and ILOM are two diagnostic tools that can detect a fault or failure resulting in this indication. The ILOM show faulty command provides details about any faults that cause this indicator to light. Under some fault conditions, individual component fault LEDs are turned on in addition to the Service Required LED. 3 System Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The service processor might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Fast blink – System is running in standby mode and can be quickly returned to full function. • Slow blink – A normal but transitory activity is taking place. Slow blinking might indicate that system diagnostics are running or that the system is booting. 4 Service Processor LED SP Indicates the following conditions: • Off – Indicates the AC power might have been connected to the power supplies. • Steady on, green – Service processor is running in its normal operating state. No service actions are required. • Blink, green – Service processor is initializing the ILOM firmware. • Steady on, amber – A service processor error has occurred and service is required.Detecting and Managing Faults 21 Related Information ¦ “Processor Module LEDs” on page 78 ¦ “Hard Drive LEDs” on page 115 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Fan Module LED” on page 153 ¦ “Main Module Motherboard LEDs” on page 204 5 System Overtemp LED (amber) Provides the following operational temperature indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a temperature failure event has been acknowledged and a service action is required. 6 Net Management Link and Activity (green) Indicates the following conditions: • On or blinking – A link is established. • Off – No link is established. 7 Net Management Speed (green) Indicates the following conditions: • On or blinking – The link is operating as a 100-Mbps connection. • Off – The link is operating as a 10-Mbps connection. 8 NET Link and Activity (green) Indicates the following conditions: • Blinking – A link is established. • Off – No link is established. 9 NET Speed (amber/green) Indicates the following conditions: • Green on – The link is operating as a Gigabit connection (1000 Mbps). • Amber on – The link is operating as a 100-Mbps connection. • Off – The link is operating as a 10-Mbps connection or there is no link. 10 QSFP Link and Activity (green) Indicates the following conditions: • Blinking – A link is established. • Off – No link is established. TABLE: Rear Panel Controls and LEDs (Continued) No. LED Icon Description22 SPARC T3-4 Server Service Manual • August 2011 Managing Faults (ILOM) These topics explain how to use ILOM, the service processor firmware, to diagnose faults and verify successful repairs. ¦ “ILOM Troubleshooting Overview” on page 23 ¦ “Access the Service Processor (ILOM)” on page 25 ¦ “Display FRU Information (show Command)” on page 27 ¦ “Check for Faults (show faulty Command)” on page 28 ¦ “Check for Faults (fmadm faulty Command)” on page 29 ¦ “Clear Faults (clear_fault_action Property)” on page 30 ¦ “Fault Managment Command Examples” on page 31 ¦ “Service-Related ILOM Commands” on page 35 Related Information ¦ “POST Overview” on page 44 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ILOM Troubleshooting Overview The ILOM firmware enables you to remotely run diagnostics, such as POST, that would otherwise require physical proximity to the server’s serial port. You can also configure ILOM to send email alerts of hardware failures, hardware warnings, and other events related to the server or to ILOM. The service processor runs independently of the server, using the server’s standby power. Therefore, ILOM firmware and software continue to function when the server OS goes offline or when the server is powered off. Error conditions detected by ILOM, POST, and the Oracle Solaris PSH technology are forwarded to ILOM for fault handling.Detecting and Managing Faults 23 FIGURE: Fault Reporting Through the ILOM Fault Manager The ILOM fault manager evaluates error messages it receives to determine whether the condition being reported should be classified as an alert or a fault. ¦ Alerts – When the fault manager determines that an error condition being reported does not indicate a faulty FRU, it classifies the error as an alert. Alert conditions are often caused by environmental conditions, such as computer room temperature, which may improve over time. They may also be caused by a configuration error, such as the wrong DIMM type being installed. If the conditions responsible for the alert go away, the fault manager will detect the change and will stop logging alerts for that condition. ¦ Faults – When the fault manager determines that a particular FRU’s has an error condition that is permanent, that error is classified as a fault. This causes the Service Required LEDs to be turned on, the FRUID PROMs updated, and a fault message logged. If the FRU has status LEDs, the Service Required LED for that FRU will also be turned on. A FRU identified as having a fault condition must be replaced. The service processor can automatically detect when a FRU has been replaced. In many cases, it does this even if the FRU is removed while the system is not running (for example, if the system power cables are unplugged during service procedures). This function enables ILOM to sense that a fault, diagnosed to a specific FRU, has been repaired. Note – ILOM does not automatically detect hard drive replacement. The Oracle Solaris PSH technology does not monitor hard drives for faults. As a result, the service processor does not recognize hard drive faults and will not light the fault LEDs on either the chassis or the hard drive itself. Use the Oracle Solaris message files to view hard drive faults. For general information about ILOM, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Concepts Guide.24 SPARC T3-4 Server Service Manual • August 2011 For detailed information about ILOM features that are specific to this server, see the SPARC T3 Series Servers Administration Guide. Related Information ¦ “Access the Service Processor (ILOM)” on page 25 ¦ “Display FRU Information (show Command)” on page 27 ¦ “Check for Faults (show faulty Command)” on page 28 ¦ “Check for Faults (fmadm faulty Command)” on page 29 ¦ “Clear Faults (clear_fault_action Property)” on page 30 ? Access the Service Processor (ILOM) There are two approaches to interacting with the service processor: ¦ ILOM shell (default) – The ILOM shell provides access to ILOM’s features and functions through a command-line interface. ¦ ILOM browser interface – The ILOM browser interface supports the same set of features and functions as the shell, but through windows on a browser interface. Note – Unless indicated otherwise, all examples of interaction with the service processor are depicted with ILOM shell commands. Note – The CLI includes a feature that enables you to access Oracle Solaris Fault Manage commands, such as fmadm, fmdump, and fmstat, from within the Oracle ILOM shell. This feature is referred to as the Oracle ILOM faultmgmt shell. For more information about the Oracle Solaris Fault Manager commands, see the SPARC T3 Series Servers Administration Guide and the Oracle Solaris documentation. You can log into multiple service processor accounts simultaneously and have separate ILOM shell commands executing concurrently under each account. 1. Establish connectivity to the service processor, using one of the following methods: ¦ SER MGT – Connect a terminal device (such as an ASCII terminal or laptop with terminal emulation) to the serial management port. Set up your terminal device for 9600 baud, 8 bit, no parity, 1 stop bit and no handshaking, and use a null-modem configuration (transmit and receive signals crossed over to enable DTE-to-DTE communication). The crossover adapters supplied with the server provide a null-modem configuration.Detecting and Managing Faults 25 ¦ NET MGT – Connect this port to an Ethernet network. This port requires an IP address. By default, it is configured for DHCP, or you can assign an IP address. 2. Decide which interface to use: ¦ ILOM CLI – The default ILOM UI and most of the commands and examples in this service manual use this interface. The default login account is root with a password of changeme. ¦ ILOM web interface – Can be used when you access the service processor through the NET MGT port and have a browser. Refer to the ILOM 3.0 documentation for details. This interface is not referenced in this service manual. 3. Log in to ILOM. The default ILOM login account is root with a default password changeme. Example of logging in to the ILOM CLI: The ILOM -> prompt indicates that you are accessing the service processor with the ILOM CLI. 4. Perform ILOM commands that provide the diagnostic information you need. The following ILOM commands are commonly used for fault management: ¦ show command – Displays information about individual FRUs. See “Display FRU Information (show Command)” on page 27. ¦ show faulty command – Displays environmental, POST-detected, and PSH-detected faults. See “Check for Faults (show faulty Command)” on page 28. ¦ clear_fault_action property of the set command – Manually clears PSH-detected faults. See “Clear Faults (clear_fault_action Property)” on page 30. ssh root@xxx.xxx.xxx.xxx Password: Waiting for daemons to initialize... Daemons ready Oracle (R) Integrated Lights Out Manager Version 3.0.12.1 r57146 Copyright (c) 2010, Oracle and/or its affiliates, Inc. All rights reserved. Warning: The system appears to be in manufacturing test mode. Warning: password is set to factory default. ->26 SPARC T3-4 Server Service Manual • August 2011 Note – You can use fmadm faulty in the faultmgmt shell as an alternative to show faulty. See “Check for Faults (fmadm faulty Command)” on page 29. Related Information ¦ “ILOM Troubleshooting Overview” on page 23 ¦ “Display FRU Information (show Command)” on page 27 ¦ “Check for Faults (show faulty Command)” on page 28 ¦ “Check for Faults (fmadm faulty Command)” on page 29 ¦ “Clear Faults (clear_fault_action Property)” on page 30 ? Display FRU Information (show Command) Use the ILOM show command to display information about individual FRUs. ? At the -> prompt, type the show command. In the following example, the show command displays information about a DIMM. -> show /SYS/PM0/CMP0/BOB0/CH0/D0 /SYS/PM0/CMP0/BOB0/CH0/D0 Targets: PRSNT T_AMB SERVICE Properties: Type = DIMM ipmi_name = BOB0/CH0/D0 component_state = Enabled fru_name = 2048MB DDR3 SDRAM fru_description = DDR3 DIMM 2048 Mbytes fru_manufacturer = Samsung fru_version = 0 fru_part_number = M393B5673FH0-CH9 fru_serial_number = 80CE01100506036C9D fault_state = OK clear_fault_action = (none) Commands:Detecting and Managing Faults 27 Related Information ¦ “Diagnostics Process” on page 12 ¦ “Clear Faults (clear_fault_action Property)” on page 30 ? Check for Faults (show faulty Command) Use the show faulty command to display information about faults and alerts diagnosed by the system. See “Fault Managment Command Examples” on page 31 for examples of the kind of information the command displays for different types of faults. ? At the -> prompt, enter the show faulty command. Related Information ¦ “Diagnostics Process” on page 12 ¦ “Clear Faults (clear_fault_action Property)” on page 30 cd set show -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PS0 /SP/faultmgmt/0/ | class | fault.chassis.power.volt-fail faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SPT-8000-LC faults/0 | | /SP/faultmgmt/0/ | uuid | 59654226-50d3-cdc6-9f09-e591f39792ca faults/0 | | /SP/faultmgmt/0/ | timestamp | 2010-08-11/14:54:23 faults/0 | | /SP/faultmgmt/0/ | fru_part_number | 3002235 faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | 003136 faults/0 | | /SP/faultmgmt/0/ | product_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | chassis_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | detector | /SYS/PS0/VOLT_FAULT faults/0 | |28 SPARC T3-4 Server Service Manual • August 2011 ? Check for Faults (fmadm faulty Command) The following is an example of the fmadm faulty command reporting on the same power supply fault as shown in the show faulty example. Note that the two examples show the same UUID value. The fmadm faulty command was invoked from within the ILOM faultmgmt shell. Note – The characters “SPT” at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. 1. At the -> prompt, access the faultmgmt shell. 2. At the faultmgmtsp> prompt, enter the fmadm faulty command. Related Information ¦ “Diagnostics Process” on page 12 ¦ “Check for Faults (show faulty Command)” on page 28 -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ ------------ ------- Time UUID msgid Severity ------------------- ------------------------------------ ------------ ------- 2010-08-11/14:54:23 59654226-50d3-cdc6-9f09-e591f39792ca SPT-8000-LC Critical Fault class : fault.chassis.power.volt-fail Description : A Power Supply voltage level has exceeded acceptible limits. Response : The service required LED on the chassis and on the affected Power Supply may be illuminated. Impact : Server will be powered down when there are insufficient operational power supplies Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exitDetecting and Managing Faults 29 ¦ “Clear Faults (clear_fault_action Property)” on page 30 ? Clear Faults (clear_fault_action Property) Use the clear_fault_action property of a FRU with the set command to manually clear ILOM-detected faults from the service processor. If Oracle ILOM detects the FRU replacement, it will automatically clear the fault so that manual clearing of the fault is not necessary. For PSH diagnosed faults, if the replacement of the FRU is detected by the system or the fault is manually cleared on the host, the fault will also be cleared from the service processor. In such cases, manual fault clearing will typically not be required. Note – For PSH-detected faults, this procedure clears the fault from the service processor but not from the host. If the fault persists in the host, clear it manually as described in “Clear PSH-Detected Faults” on page 42. ? At the -> prompt, use the set command with the clear_fault_action=True property. This example begins with an excerpt from the fmadm faulty command showing power supply 0 with a voltage failure. After the fault condition is corrected (a new power supply has been installed), the fault state is cleared manually. Note – In this example, the characters “SPT” at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. [...] faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2010-08-27/19:46:26 edc898a3-c875-6b86-851a-91a4ed8ad58e SPT-8000-MJ Critical Fault class : fault.chassis.power.fail FRU : /SYS/PS0 (Part Number: 300-2159-05) (Serial Number: 1908BAO-1020A90156) Description : A Power Supply has failed and is not providing power to the server. [...]30 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Diagnostics Process” on page 12 Fault Managment Command Examples When no faults have been detected, the show fault output looks like this: -> set /SYS/PS0 clear_fault_action=true Are you sure you want to clear /SYS/PS0 (y/n)? y -> show /SYS/PS0 Targets: VINOK PWROK CUR_FAULT VOLT_FAULT FAN_FAULT TEMP_FAULT V_IN I_IN V_OUT I_OUT INPUT_POWER OUTPUT_POWER Properties: type = Power Supply ipmi_name = PS0 fru_name = /SYS/PS0 fru_description = Powersupply fru_manufacturer = Delta Electronics fru_version = 03 fru_part_number = 3002235 fru_serial_number = 003136 fault_state = OK clear_fault_action = (none) Commands: cd set show -> show faulty Target | Property | Value --------------------+------------------------+-------------------Detecting and Managing Faults 31 Other examples are shown in the following sections. show faulty Example of a Power Supply Fault The following is an example of the show faulty command reporting a power supply fault. Note – The characters “SPT” at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. fmadm faulty Example of a Power Supply Fault The following is an example of the fmadm faulty command reporting on the same power supply fault as shown in the show faulty example. Note that the two examples show the same UUID value. ----------------------------------------------------------------- -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PS0 /SP/faultmgmt/0/ | class | fault.chassis.power.volt-fail faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SPT-8000-LC faults/0 | | /SP/faultmgmt/0/ | uuid | 59654226-50d3-cdc6-9f09-e591f39792ca faults/0 | | /SP/faultmgmt/0/ | timestamp | 2010-08-11/14:54:23 faults/0 | | /SP/faultmgmt/0/ | fru_part_number | 3002235 faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | 003136 faults/0 | | /SP/faultmgmt/0/ | product_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | chassis_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | detector | /SYS/PS0/VOLT_FAULT faults/0 | |32 SPARC T3-4 Server Service Manual • August 2011 The fmadm faulty command was invoked from within the ILOM faultmgmt shell. Note – The characters “SPT” at the beginning of the message ID indicate that the fault was detected by Oracle ILOM. show faulty Example of a POST-Detected Fault The following is an example of the show faulty command displaying a fault that was detected by POST. These kinds of faults are identified by the message Forced fail reason, where reason is the name of the power-on routine that detected the fault. -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2010-08-27/19:46:26 edc898a3-c875-6b86-851a-91a4ed8ad58e SPT-8000-MJ Critical Fault class : fault.chassis.power.fail FRU : /SYS/PS3 (Part Number: 300-2159-05) (Serial Number: 1908BAO-1020A90156) Description : A Power Supply has failed and is not providing power to the server. Response : The service required LED on the chassis and on the affected Power Supply may be illuminated. Impact : Server will be powered down when there are insufficient operational power supplies Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. faultmgmtsp> exit -> show faulty Target | Property | Value --------------------+------------------------+-------------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0/CMP0/B0B0/CH0/D0Detecting and Managing Faults 33 show faulty Example of a PSH-Detected Fault The following is an example of the show faulty command displaying a fault that was detected by the PSH technology. These kinds of faults are identified by the absence of the characters “SPT” at the beginning of the message ID. Related Information ¦ “Managing Components (ASR)” on page 53 /SP/faultmgmt/0 | timestamp | Oct 12 16:40:56 /SP/faultmgmt/0/ | timestamp | Oct 12 16:40:56 faults/0 | | /SP/faultmgmt/0/ | sp_detected_fault | /SYS/PM0/CMP0/B0B0/CH0/D0 faults/0 | | Forced fail(POST) -> show faulty Target | Property | Value --------------------+------------------------+-------------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0 /SP/faultmgmt/0/ | class | fault.cpu.generic-sparc.strand faults/0 | | /SP/faultmgmt/0/ | sunw-msg-id | SUN4V-8002-6E faults/0 | | /SP/faultmgmt/0/ | uuid | 21a8b59e-89ff-692a-c4bc-f4c5cccc faults/0 | | 7a8a /SP/faultmgmt/0/ | timestamp | 2010-08-13/15:48:33 faults/0 | | /SP/faultmgmt/0/ | chassis_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | product_serial_number | BDL1024FDA faults/0 | | /SP/faultmgmt/0/ | fru_serial_number | 1005LCB-1018B2009T faults/0 | | /SP/faultmgmt/0/ | fru_part_number | 541-3857-07 faults/0 | | /SP/faultmgmt/0/ | mod-version | 1.16 faults/0 | | /SP/faultmgmt/0/ | mod-name | eft faults/0 | | /SP/faultmgmt/0/ | fault_diagnosis | /HOST faults/0 | | /SP/faultmgmt/0/ | severity | Major faults/0 | |34 SPARC T3-4 Server Service Manual • August 2011 Service-Related ILOM Commands These are the ILOM shell commands most frequently used when performing service-related tasks. ILOM Command Description help [command] Displays a list of all available commands with syntax and descriptions. Specifying a command name as an option displays help for that command. set /HOST send_break_action=break Takes the host server from the OS to either kmdb or OpenBoot PROM (equivalent to a Stop-A), depending on the mode Oracle Solaris software was booted. set /SYS/component clear_fault_action=true Manually clears host-detected faults. The UUID is the unique fault ID of the fault to be cleared. start /HOST/console Connects you to the host system. show /HOST/console/history Displays the contents of the system’s console buffer. set /HOST/bootmode property=value [where property is state, config, or script] Controls the host server OpenBoot PROM firmware method of booting. stop /SYS; start /SYS Performs a poweroff followed by poweron. stop /SYS Powers off the host server. start /SYS Powers on the host server. reset /SYS Generates a hardware reset on the host server. reset /SP Reboots the service processor. set /SYS keyswitch_state=value normal | standby | diag | locked Sets the virtual keyswitch. set /SYS/LOCATE value=value [Fast_blink | Off] Turns the Locator LED on the server on or off. show faulty Displays current system faults. See “Check for Faults (show faulty Command)” on page 28. show /SYS keyswitch_state Displays the status of the virtual keyswitch.Detecting and Managing Faults 35 Related Information ¦ “Managing Components (ASR)” on page 53 Interpreting Log Files and System Messages With the Oracle Solaris OS running on the server, you have the full complement of Oracle Solaris OS files and commands available for collecting information and for troubleshooting. If POST or the Oracle Solaris PSH features do not indicate the source of a fault, check the message buffer and log files for notifications for faults. Hard disk drive faults are usually captured by the Oracle Solaris message files. Use the dmesg command to view the most recent system message. To view the system messages log file, view the contents of the /var/adm/messages file. ¦ “Check the Message Buffer” on page 37 ¦ “View System Message Log Files” on page 37 Related Information ¦ “Running POST” on page 43 ¦ “Using Oracle Solaris Predictive Self-Healing” on page 38 show /SYS/LOCATE Displays the current state of the Locator LED as either on or off. show /SP/logs/event/list Displays the history of all events logged in the service processor event buffers (in RAM or the persistent buffers). show /HOST Displays information about the operating state of the host system, the system serial number, and whether the hardware is providing service. ILOM Command Description36 SPARC T3-4 Server Service Manual • August 2011 ? Check the Message Buffer The dmesg command checks the system buffer for recent diagnostic messages and displays them. 1. Log in as superuser. 2. Type: Related Information ¦ “View System Message Log Files” on page 37 ? View System Message Log Files The error logging daemon, syslogd, automatically records various system warnings, errors, and faults in message files. These messages can alert you to system problems such as a device that is about to fail. The /var/adm directory contains several message files. The most recent messages are in the /var/adm/messages file. After a period of time (usually every week), a new messages file is automatically created. The original contents of the messages file are rotated to a file named messages.1. Over a period of time, the messages are further rotated to messages.2 and messages.3, and then deleted. 1. Log in as superuser. 2. Type: 3. If you want to view all logged messages, type: Related Information ¦ “Check the Message Buffer” on page 37 # dmesg # more /var/adm/messages # more /var/adm/messages*Detecting and Managing Faults 37 Using Oracle Solaris Predictive Self-Healing The following topics describe the Oracle Solaris Predictive Self-Healing feature: ¦ “PSH Overview” on page 38 ¦ “PSH-Detected Fault Example” on page 39 ¦ “Check for PSH-Detected Faults” on page 40 ¦ “Clear PSH-Detected Faults” on page 42 PSH Overview The Oracle Solaris Predictive Self-Healing technology enables the server to diagnose problems while the Oracle Solaris OS is running and mitigate many problems before they negatively affect operations. The Oracle Solaris OS uses the Fault Manager daemon, fmd(1M), which starts at boot time and runs in the background to monitor the system. If a component generates an error, the daemon correlates the error with data from previous errors and other relevant information to diagnose the problem. Once diagnosed, the Fault Manager daemon assigns a UUID to the error. This value distinguishes this error across any set of systems. When possible, the Fault Manager daemon initiates steps to self-heal the failed component and take the component offline. The daemon also logs the fault to the syslogd daemon and provides a fault notification with a MSGID. You can use the message ID to get additional information about the problem from the knowledge article database. The PSH technology covers the following server components: ¦ CPU ¦ Memory ¦ I/O subsystem The PSH console message provides the following information about each detected fault: ¦ Type ¦ Severity ¦ Description38 SPARC T3-4 Server Service Manual • August 2011 ¦ Automated response ¦ Impact ¦ Suggested action for system administrator If the PSH facility detects a faulty component, use the fmadm faulty command to display information about the fault. Alternatively, you can use the Oracle ILOM command show faulty for the same purpose. Related Information ¦ “PSH-Detected Fault Example” on page 39 ¦ “Check for PSH-Detected Faults” on page 40 ¦ “Clear PSH-Detected Faults” on page 42 PSH-Detected Fault Example When a PSH fault is detected, an Oracle Solaris console message similar to the following example is displayed. Note – The Service Required LED is also turned on for PSH-diagnosed faults. Related Information ¦ “PSH Overview” on page 38 ¦ “Check for PSH-Detected Faults” on page 40 ¦ “Clear PSH-Detected Faults” on page 42 SUNW-MSG-ID: SUN4V-8000-DX, TYPE: Fault, VER: 1, SEVERITY: Minor EVENT-TIME: Wed Jun 17 10:09:46 EDT 2009 PLATFORM: SUNW,system_name, CSN: -, HOSTNAME: server48-37 SOURCE: cpumem-diagnosis, REV: 1.5 EVENT-ID: f92e9fbe-735e-c218-cf87-9e1720a28004 DESC: The number of errors associated with this memory module has exceeded acceptable levels. Refer to http://sun.com/msg/SUN4V-8000-DX for more information. AUTO-RESPONSE: Pages of memory associated with this memory module are being removed from service as errors are reported. IMPACT: Total system memory capacity will be reduced as pages are retired. REC-ACTION: Schedule a repair procedure to replace the affected memory module. Use fmdump -v -u to identify the module.Detecting and Managing Faults 39 ? Check for PSH-Detected Faults The fmadm faulty command displays the list of faults detected by the Oracle Solaris PSH facility. You can run this command either from the host or through the Oracle ILOM fmadm shell. As an alternative, you could display fault information by running the Oracle ILOM command show. 1. Check the event log using fmadm faulty: In this example, a fault is displayed, indicating the following details: ¦ Date and time of the fault (2010-08-27/19:46:26) ¦ Universal Unique Identifier (UUID). The UUID is unique for every fault (edc898a3-c875-6b86-851a-91a4ed8ad58e) ¦ Message identifier, which can be used to obtain additional fault information (SPT-8000-MJ) -> start /SP/faultmgmt/shell Are you sure you want to start /SP/faultmgmt/shell (y/n)? y faultmgmtsp> fmadm faulty ------------------- ------------------------------------ -------------- ------- Time UUID msgid Severity ------------------- ------------------------------------ -------------- ------- 2010-08-27/19:46:26 edc898a3-c875-6b86-851a-91a4ed8ad58e SPT-8000-MJ Critical Fault class : fault.chassis.power.fail FRU : /SYS/PS3 (Part Number: 300-2159-05) (Serial Number: 1908BAO-1020A90156) Description : A Power Supply has failed and is not providing power to the server. Response : The service required LED on the chassis and on the affected Power Supply may be illuminated. Impact : Server will be powered down when there are insufficient operational power supplies Action : The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.40 SPARC T3-4 Server Service Manual • August 2011 ¦ Faulted FRU. The information provided in the example includes the part number of the FRU (Part Number: 300-2159-05) and the serial number of the FRU (Serial Number: 1908BAO-1020A90156)). The FRU field provides the name of the FRU (/SYS/PS3 for power supply 3 in this example). 2. Use the message ID to obtain more information about this type of fault: a. Obtain the message ID from console output or from the ILOM show faulty command. b. Enter the message ID at the end of the Predictive Self-Healing Knowledge Article web site, http://www.sun.com/msg. In the current example, enter this in the browser address window: http://www.sun.com/msg/SPT-8000-MJ The following example shows the message ID SPT-8000-MJ and provides information for corrective action. 3. Follow the suggested actions to repair the fault. Related Information ¦ “Clear PSH-Detected Faults” on page 42 ¦ “PSH-Detected Fault Example” on page 39 Power Supply general failure Type Fault Severity Critical Description A Power Supply has failed and is not providing power to the server. Automated Response The service required LED on the chassis and on the affected Power Supply may be illuminated. Impact Server will be powered down when there are insufficient operational power supplies. Suggested Action for System Administrator The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information. Details The administrator should review the ILOM event log for additional information pertaining to this diagnosis. Please refer to the Details section of the Knowledge Article for additional information.Detecting and Managing Faults 41 ? Clear PSH-Detected Faults When the Oracle Solaris Predictive Self-Healing facility detects faults, the faults are logged and displayed on the console. In most cases, after the fault is repaired, the corrected state is detected by the system and the fault condition is repaired automatically. However, this repair should be verified. In cases where the fault condition is not automatically cleared, the fault must be cleared manually. 1. After replacing a faulty FRU, power on the server. 2. At the host prompt, use the fmadm faulty command to determine whether the replaced FRU still shows a faulty state. ¦ If no fault is reported, you do not need to do anything else. Do not perform the subsequent steps. ¦ If a fault is reported, continue to Step 3. # fmadm faulty TIME EVENT-ID MSG-ID SEVERITY Aug 13 11:48:33 21a8b59e-89ff-692a-c4bc-f4c5cccca8c8 SUN4V-8002-6E Major Platform : sun4v Chassis_id : Product_sn : Fault class : fault.cpu.generic-sparc.strand Affects : cpu:///cpuid=21/serial=000000000000000000000 faulted and taken out of service FRU : "/SYS/PM0" (hc://:product-id=sun4v:product-sn=BDL1024FDA:server-id= s4v-t5160a-bur02:chassis-id=BDL1024FDA:serial=1005LCB-1019B100A2:part= 511127809:revision=05/chassis=0/motherboard=0) faulty Description : The number of correctable errors associated with this strand has exceeded acceptable levels. Refer to http://sun.com/msg/SUN4V-8002-6E for more information. Response : The fault manager will attempt to remove the affected strand from service. Impact : System performance may be affected. Action : Schedule a repair procedure to replace the affected resource, the identity of which can be determined using ’fmadm faulty’.42 SPARC T3-4 Server Service Manual • August 2011 3. Clear the fault from all persistent fault records. In some cases, even though the fault is cleared, some persistent fault information remains and results in erroneous fault messages at boot time. To ensure that these messages are not displayed, perform the following Oracle Solaris command: For the UUID in the example shown in Step 2, enter this command: 4. Use the clear_fault_action property of the FRU to clear the fault. Related Information ¦ “PSH Overview” on page 38 ¦ “PSH-Detected Fault Example” on page 39 Running POST These topics explain how to use POST as a diagnostic tool. ¦ “POST Overview” on page 44 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Configure POST” on page 46 ¦ “Run POST With Maximum Testing” on page 48 ¦ “Interpret POST Fault Messages” on page 49 ¦ “Clear POST-Detected Faults” on page 50 ¦ “POST Output Reference” on page 51 # fmadm repair UUID # fmadm repair 21a8b59e-89ff-692a-c4bc-f4c5cccc -> set /SYS/PM0 clear_fault_action=True Are you sure you want to clear /SYS/PM0 (y/n)? y set ’clear_fault_action’ to ’trueDetecting and Managing Faults 43 POST Overview Power-on self-test is a group of PROM-based tests that run when the server is powered on or when it is reset. POST checks the basic integrity of the critical hardware components in the server (CMP, memory, and I/O subsystem). You can also run POST as system-level hardware diagnostic tool. To do this, use the Oracle ILOM set command to set the parameter keyswitch_state to diag. You can also set other Oracle ILOM properties to control various other aspects of POST operations. For example, you can specify the events that cause POST to run, the level of testing POST performs, and the amount of diagnostic information POST displays. These properties are listed and described in “ILOM Properties That Affect POST Behavior” on page 44. If POST detects a faulty component, the component is disabled automatically. If the system is able to run without the disabled component, it will boot when POST completes its tests. For example, if POST detects a faulty processor core, the core will be disabled and, once POST completes its test sequence, the system will boot and run using the remaining cores. Related Information ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Run POST With Maximum Testing” on page 48 ¦ “Interpret POST Fault Messages” on page 49 ¦ “Clear POST-Detected Faults” on page 50 ILOM Properties That Affect POST Behavior The following table describes the ILOM properties that determine how POST performs its operations. Note – The value of keyswitch_state must be normal when individual POST parameters are changed.44 SPARC T3-4 Server Service Manual • August 2011 The following flowchart is a graphic illustration of the same set of ILOM set command variables. TABLE: ILOM Properties Used to Manage POST Operations Parameter Values Description /SYS keyswitch_state normal The system can power on and run POST (based on the other parameter settings). This parameter overrides all other commands. diag The system runs POST based on predetermined settings. standby The system cannot power on. locked The system can power on and run POST, but no flash updates can be made. /HOST/diag mode off POST does not run. normal Runs POST according to diag level value. service Runs POST with preset values for diag level and diag verbosity. /HOST/diag level max If diag mode = normal, runs all the minimum tests plus extensive processor and memory tests. min If diag mode = normal, runs minimum set of tests. /HOST/diag trigger none Does not run POST on reset. hw-change (Default) Runs POST following an AC power cycle and when the top cover is removed. power-on-reset Only runs POST for the first power on. error-reset (Default) Runs POST if fatal errors are detected. all-resets Runs POST after any reset. /HOST/diag verbosity normal POST output displays all test and informational messages. min POST output displays functional tests with a banner and pinwheel. max POST displays all test, informational, and some debugging messages. debug none No POST output is displayed.Detecting and Managing Faults 45 FIGURE: Flowchart of ILOM Properties Used to Manage POST Operations ? Configure POST 1. Access the ILOM -> prompt. See “Access the Service Processor (ILOM)” on page 25.46 SPARC T3-4 Server Service Manual • August 2011 2. Set the virtual keyswitch to the value that corresponds to the POST configuration you want to run. The following example sets the virtual keyswitch to normal, which will configure POST to run according to other parameter values. For possible values for the keyswitch_state parameter, see “ILOM Properties That Affect POST Behavior” on page 44. 3. If the virtual keyswitch is set to normal, and you want to define the mode, level, verbosity, or trigger, set the respective parameters. Syntax: set /HOST/diag property=value See “ILOM Properties That Affect POST Behavior” on page 44 for a list of parameters and values. Examples: 4. To see the current values for settings, use the show command. Example: Related Information ¦ “POST Overview” on page 44 -> set /SYS keyswitch_state=normal Set ‘keyswitch_state' to ‘Normal' -> set /HOST/diag mode=normal -> set /HOST/diag verbosity=max -> show /HOST/diag /HOST/diag Targets: Properties: level = min mode = normal trigger = power-on-reset error-reset verbosity = normal Commands: cd set show ->Detecting and Managing Faults 47 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Run POST With Maximum Testing” on page 48 ¦ “Interpret POST Fault Messages” on page 49 ¦ “Clear POST-Detected Faults” on page 50 ? Run POST With Maximum Testing This procedure describes how to configure the server to run the maximum level of POST. 1. Access the ILOM -> prompt: See “Access the Service Processor (ILOM)” on page 25. 2. Set the virtual keyswitch to diag so that POST will run in service mode. 3. Reset the system so that POST runs. There are several ways to initiate a reset. The following example shows a reset by issuing commands that will power cycle the host. Note – The server takes about one minute to power off. Use the show /HOST command to determine when the host has been powered off. The console will display status=Powered Off. 4. Switch to the system console to view the POST output. 5. If you receive POST error messages, follow the guidelines provided in the topic “Interpret POST Fault Messages” on page 49. -> set /SYS keyswitch_state=diag Set ‘keyswitch_state' to ‘Diag' -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /HOST/console48 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “POST Overview” on page 44 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Configure POST” on page 46 ¦ “Interpret POST Fault Messages” on page 49 ¦ “Clear POST-Detected Faults” on page 50 ? Interpret POST Fault Messages 1. Run POST. See “Run POST With Maximum Testing” on page 48. 2. View the output and watch for messages that look similar to the following syntax descriptions and example: ¦ POST error messages use the following syntax: n:c:s > ERROR: TEST = failing-test n:c:s > H/W under test = FRU n:c:s > Repair Instructions: Replace items in order listed by H/W under test above n:c:s > MSG = test-error-message n:c:s > END_ERROR In this syntax, n = the node number, c = the core number, s = the strand number. ¦ Warning and informational messages use the following syntax: INFO or WARNING: message 3. To obtain more information on faults, run the show faulty command. See “Check for Faults (show faulty Command)” on page 28. Related Information ¦ “Clear POST-Detected Faults” on page 50 ¦ “POST Overview” on page 44 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Configure POST” on page 46 ¦ “Run POST With Maximum Testing” on page 48Detecting and Managing Faults 49 ? Clear POST-Detected Faults Use this procedure if you suspect that a fault was not automatically cleared. This procedure describes how to identify a POST-detected fault and, if necessary, manually clear the fault. In most cases, when POST detects a faulty component, POST logs the fault and automatically takes the failed component out of operation by placing the component in the ASR blacklist (see “Managing Components (ASR)” on page 53). Usually, when a faulty component is replaced, the replacement is detected when the service processor is reset or power cycled, and the fault is automatically cleared from the system. 1. After replacing a faulty FRU, at the ILOM prompt, use the show faulty command to identify POST-detected faults. POST-detected faults are distinguished from other kinds of faults by the text: Forced fail. No UUID number is reported. Example: 2. Take one of the following actions based on the show faulty output: ¦ No fault is reported – The system cleared the fault and you do not need to manually clear the fault. Do not perform the subsequent steps. ¦ Fault reported – Go to the next step in this procedure. 3. Use the component_state property of the component to clear the fault and remove the component from the ASR blacklist. Use the FRU name that was reported in the fault in Step 1. Example: The fault is cleared and should not show up when you run the show faulty command. Additionally, the System Fault (Service Required) LED is no longer lit. -> show faulty Target | Property | Value ----------------------+------------------------+----------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0/CMP0/BOB1/CH0/D0 /SP/faultmgmt/0 | timestamp | Dec 21 16:40:56 /SP/faultmgmt/0/ | timestamp | Dec 21 16:40:56 faults/0 | | /SP/faultmgmt/0/ | sp_detected_fault | /SYS/PM0/CMP0/BOB1/CH0/D0 faults/0 | | Forced fail(POST) -> set /SYS/PM0/CMP0/BOB1/CH0/D0 component_state=Enabled50 SPARC T3-4 Server Service Manual • August 2011 4. Reset the server. You must reboot the server for the component_state property to take effect. 5. At the ILOM prompt, use the show faulty command to verify that no faults are reported. Example: Related Information ¦ “POST Overview” on page 44 ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Configure POST” on page 46 ¦ “Run POST With Maximum Testing” on page 48 POST Output Reference POST error messages use the following syntax: In this syntax, n = the node number, c = the core number, s = the strand number. Warning messages use the following syntax: Informational messages use the following syntax: -> show faulty Target | Property | Value --------------------+------------------------+------------------ -> n:c:s > ERROR: TEST = failing-test n:c:s > H/W under test = FRU n:c:s > Repair Instructions: Replace items in order listed by H/W under test above n:c:s > MSG = test-error-message n:c:s > END_ERROR WARNING: message INFO: messageDetecting and Managing Faults 51 In the following example, POST reports an uncorrectable memory error affecting DIMM locations /SYS/PM0/CMP0/B0B0/CH0/D0 and /SYS/PM0/CMP0/B0B1/CH0/D0. The error was detected by POST running on node 0, core 7, strand 2. 2010-07-03 18:44:13.359 0:7:2>Decode of Disrupting Error Status Reg (DESR HW Corrected) bits 00300000.00000000 2010-07-03 18:44:13.517 0:7:2> 1 DESR_SOCSRE: SOC (non-local) sw_recoverable_error. 2010-07-03 18:44:13.638 0:7:2> 1 DESR_SOCHCCE: SOC (non-local) hw_corrected_and_cleared_error. 2010-07-03 18:44:13.773 0:7:2> 2010-07-03 18:44:13.836 0:7:2>Decode of NCU Error Status Reg bits 00000000.22000000 2010-07-03 18:44:13.958 0:7:2> 1 NESR_MCU1SRE: MCU1 issued a Software Recoverable Error Request 2010-07-03 18:44:14.095 0:7:2> 1 NESR_MCU1HCCE: MCU1 issued a Hardware Corrected-and-Cleared Error Request 2010-07-03 18:44:14.248 0:7:2> 2010-07-03 18:44:14.296 0:7:2>Decode of Mem Error Status Reg Branch 1 bits 33044000.00000000 2010-07-03 18:44:14.427 0:7:2> 1 MEU 61 R/W1C Set to 1 on an UE if VEU = 1, or VEF = 1, or higher priority error in same cycle. 2010-07-03 18:44:14.614 0:7:2> 1 MEC 60 R/W1C Set to 1 on a CE if VEC = 1, or VEU = 1, or VEF = 1, or another error in same cycle. 2010-07-03 18:44:14.804 0:7:2> 1 VEU 57 R/W1C Set to 1 on an UE, if VEF = 0 and no fatal error is detected in same cycle. 2010-07-03 18:44:14.983 0:7:2> 1 VEC 56 R/W1C Set to 1 on a CE, if VEF = VEU = 0 and no fatal or UE is detected in same cycle. 2010-07-03 18:44:15.169 0:7:2> 1 DAU 50 R/W1C Set to 1 if the error was a DRAM access UE. 2010-07-03 18:44:15.304 0:7:2> 1 DAC 46 R/W1C Set to 1 if the error was a DRAM access CE. 2010-07-03 18:44:15.440 0:7:2> 2010-07-03 18:44:15.486 0:7:2> DRAM Error Address Reg for Branch 1 = 00000034.8647d2e0 2010-07-03 18:44:15.614 0:7:2> Physical Address is 00000005.d21bc0c0 2010-07-03 18:44:15.715 0:7:2> DRAM Error Location Reg for Branch 1 = 00000000.00000800 2010-07-03 18:44:15.842 0:7:2> DRAM Error Syndrome Reg for Branch 1 = dd1676ac.8c18c045 2010-07-03 18:44:15.967 0:7:2> DRAM Error Retry Reg for Branch 1 = 00000000.00000004 2010-07-03 18:44:16.086 0:7:2> DRAM Error RetrySyndrome 1 Reg for Branch 1 = a8a5f81e.f6411b5a 2010-07-03 18:44:16.218 0:7:2> DRAM Error Retry Syndrome 2 Reg for Branch 1 = a8a5f81e.f6411b5a52 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “ILOM Properties That Affect POST Behavior” on page 44 ¦ “Run POST With Maximum Testing” on page 48 ¦ “Clear POST-Detected Faults” on page 50 Managing Components (ASR) The following topics explain the role played by the Automatic System Recovery feature and how to manage the components it controls. ¦ “ASR Overview” on page 53 ¦ “Display System Components” on page 54 ¦ “Disable System Components” on page 55 ¦ “Enable System Components” on page 56 ASR Overview The ASR feature enables the server to automatically configure failed components out of operation until they can be replaced. In the server, the following components are managed by the ASR feature: ¦ CPU strands ¦ Memory DIMMs 2010-07-03 18:44:16.351 0:7:2> DRAM Failover Location 0 for Branch 1 = 00000000.00000000 2010-07-03 18:44:16.475 0:7:2> DRAM Failover Location 1 for Branch 1 = 00000000.00000000 2010-07-03 18:44:16.604 0:7:2> 2010-07-03 18:44:16.648 0:7:2>ERROR: POST terminated prematurely. Not all system components tested. 2010-07-03 18:44:16.786 0:7:2>POST: Return to VBSC 2010-07-03 18:44:16.795 0:7:2>ERROR: 2010-07-03 18:44:16.839 0:7:2> POST toplevel status has the following failures: 2010-07-03 18:44:16.952 0:7:2> Node 0 ------------------------------- 2010-07-03 18:44:17.051 0:7:2> /SYS/PM0/CMP0/BOB0/CH1/D0 (J1001) 2010-07-03 18:44:17.145 0:7:2> /SYS/PM0/CMP0/BOB1/CH1/D0 (J3001) 2010-07-03 18:44:17.241 0:7:2>END_ERRORDetecting and Managing Faults 53 ¦ I/O subsystem The database that contains the list of disabled components is referred to as the ASR blacklist (asr-db). In most cases, POST automatically disables a faulty component. After the cause of the fault is repaired (FRU replacement, loose connector reseated, and so on), you might need to remove the component from the ASR blacklist. The following ASR commands enable you to view and add or remove components (asrkeys) from the ASR blacklist. You run these commands from the ILOM -> prompt. Note – The asrkeys vary from system to system, depending on how many cores and memory are present. Use the show components command to see the asrkeys on a given system. After you enable or disable a component, you must reset (or power cycle) the system for the component’s change of state to take effect. Related Information ¦ “Display System Components” on page 54 ¦ “Disable System Components” on page 55 ¦ “Enable System Components” on page 56 ? Display System Components The show components command displays the system components (asrkeys) and reports their status. Command Description show components Displays system components and their current state. set asrkey component_state= Enabled Removes a component from the asr-db blacklist, where asrkey is the component to enable. set asrkey component_state= Disabled Adds a component to the asr-db blacklist, where asrkey is the component to disable.54 SPARC T3-4 Server Service Manual • August 2011 ? At the -> prompt, type show components. In the following example, PCI-EM3 is shown as disabled. Related Information ¦ “View System Message Log Files” on page 37 ¦ “Disable System Components” on page 55 ¦ “Enable System Components” on page 56 ? Disable System Components You disable a component by setting its component_state property to Disabled. This adds the component to the ASR blacklist. 1. At the -> prompt, set the component_state property to Disabled. 2. Reset the server so that the ASR command takes effect. -> show components Target | Property | Value --------------------+------------------------+------------------------------- /SYS/MB/REM0/ | component_state | Enabled SASHBA0 | | /SYS/MB/REM1/ | component_state | Enabled SASHBA1 | | /SYS/MB/VIDEO | component_state | Enabled /SYS/MB/PCI- | component_state | Enabled SWITCH0 | | <...> /SYS/PCI-EM0 | component_state | Enabled /SYS/PCI-EM1 | component_state | Enabled /SYS/PCI-EM2 | component_state | Enabled /SYS/PCI-EM3 | component_state | Disabled /SYS/PCI-EM4 | component_state | Enabled /SYS/PCI-EM5 | component_state | Enabled /SYS/PCI-EM6 | component_state | Enabled <...> -> set /SYS/PM0/CMP0/BOB1/CH0/D0 component_state=Disabled -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYSDetecting and Managing Faults 55 Note – In the ILOM shell there is no notification when the system is actually powered off. Powering off takes about a minute. Use the show /HOST command to determine if the host has powered off. Related Information ¦ “View System Message Log Files” on page 37 ¦ “Display System Components” on page 54 ¦ “Enable System Components” on page 56 ? Enable System Components You enable a component by setting its component_state property to Enabled. This removes the component from the ASR blacklist. 1. At the -> prompt, set the component_state property to Enabled. 2. Reset the server so that the ASR command takes effect. Note – In the ILOM shell there is no notification when the system is actually powered off. Powering off takes about a minute. Use the show /HOST command to determine if the host has powered off. Related Information ¦ “View System Message Log Files” on page 37 ¦ “Display System Components” on page 54 ¦ “Disable System Components” on page 55 -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> set /SYS/PM0/CMP0/BOB1/CH0/D0 component_state=Enabled -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS56 SPARC T3-4 Server Service Manual • August 2011 Verifying SunVTS Installation SunVTS is a validation test suite that you can use to test this server. These topics provide an overview and a way to check if the SunVTS software is installed. For comprehensive SunVTS information, refer to the SunVTS 6.1 and SunVTS 7.0 documentation. ¦ “SunVTS Overview” on page 57 ¦ “Verify SunVTS Installation” on page 58 SunVTS Overview SunVTS is a validation test suite that you can use to test this server. The SunVTS software provides multiple diagnostic hardware tests that verify the connectivity and functionality of most hardware controllers and devices for this server. The SunVTS software provides these kinds of test categories: ¦ Audio ¦ Communication (serial and parallel) ¦ Graphic and video ¦ Memory ¦ Network ¦ Peripherals (hard drives, CD-DVD devices, and printers) ¦ Processor ¦ Storage Use the SunVTS software to validate a system during development, production, receiving inspection, troubleshooting, periodic maintenance, and system or subsystem stressing. You can run the SunVTS software through a browser UI, terminal UI, or command UI. You can run tests in a variety of modes for online and offline testing. The SunVTS software also provides a choice of security mechanisms. The SunVTS software is provided on the preinstalled Oracle Solaris OS that shipped with the server, but it might not be installed.Detecting and Managing Faults 57 Related Information ¦ SunVTS documentation ¦ “Verifying SunVTS Installation” on page 57 ? Verify SunVTS Installation 1. Log in as superuser. 2. Check for the presence of SunVTS packages using the pkginfo command. ¦ If information about the packages is displayed, then the SunVTS software is installed. ¦ If you receive messages reporting ERROR: information for package was not found, then the SunVTS software is not installed. You must take action to install the software before you can use it. You can obtain the SunVTS software from the following places: ¦ Oracle Solaris OS media kit (DVDs) ¦ As a download from the web Related Information ¦ SunVTS documentation # pkginfo -l SUNvts SUNWvtsr SUNWvtsts SUNWvtsmn58 SPARC T3-4 Server Service Manual • August 201159 Preparing for Service These topics describe how to prepare the SPARC T3-4 server for servicing. ¦ “Safety Information” on page 59 ¦ “Tools Needed for Service” on page 61 ¦ “Find the Chassis Serial Number” on page 61 ¦ “Locate the Server” on page 62 ¦ “Understanding Component Replacement Categories” on page 63 ¦ “Removing Power From the System” on page 66 ¦ “Accessing Internal Components” on page 69 Safety Information For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment and described in the documentation shipped with your system. ¦ Follow all cautions and instructions marked on the equipment and described in the SPARC T3-4 Server Safety and Compliance Guide. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Follow the electrostatic discharge safety practices as described in this section. Safety Symbols Note the meanings of the following symbols that might appear in this document:60 SPARC T3-4 Server Service Manual • August 2011 Caution – There is a risk of personal injury or equipment damage. To avoid personal injury and equipment damage, follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and might cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. ESD Measures Electrostatic discharge-sensitive devices, such as the express modules, hard drives, and DIMMs require special handling. Caution – Circuit boards and hard drives contain electronic components that are extremely sensitive to static electricity. Ordinary amounts of static electricity from clothing or the work environment can destroy the components located on these boards. Do not touch the components along their connector edges. Caution – You must disconnect all power supplies before servicing any of the components that are inside the chassis. Antistatic Wrist Strap Use Wear an antistatic wrist strap and use an antistatic mat when handling components such as hard drive assemblies, circuit boards, or express modules. When servicing or removing server components, attach an antistatic strap to your wrist and then to a metal area on the chassis. Following this practice equalizes the electrical potentials between you and the server. Antistatic Mat Place ESD-sensitive components such as motherboards, memory, and other PCBs on an antistatic mat.Preparing for Service 61 Related Information ¦ “Removing Power From the System” on page 66 ¦ “Accessing Internal Components” on page 69 Tools Needed for Service You will need the following tools for most service operations: ¦ Antistatic wrist strap ¦ Antistatic mat ¦ No. 1 Phillips screwdriver ¦ No. 2 Phillips screwdriver ¦ No. 1 flat-blade screwdriver (battery removal) Related Information ¦ “Understanding Component Replacement Categories” on page 63 ¦ “Accessing Internal Components” on page 69 ? Find the Chassis Serial Number If you require technical support for your system, you will be asked to provide the server’s chassis serial number. You can find the chassis serial number on a sticker located on the front of the server and on another sticker on the side of the server. If it is not convenient to read either sticker, you can run the ILOM show /SYS command to obtain the chassis serial number. ? Type show /SYS at the ILOM prompt. -> show /SYS /SYS Targets: MB MB_ENV RIO62 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Locate the Server” on page 62 ? Locate the Server You can use the Locator LEDs to pinpoint the location of a server. This procedure is helpful when you need to identify one particular server from many other servers. 1. At the ILOM command line, type: The white Locator LEDs (one on the front panel and one on the rear panel) blink. 2. After locating the server with the blinking Locator LED, turn it off by pressing the Locator button. Note – Alternatively, you can turn off the Locator LED by running the ILOM set /SYS/LOCATE value=off command. PM0 PM1 FM0 ... Properties: type = Host System ipmi_name = /SYS keyswitch_state = Normal product_name = T3-4 product_part_number = 602-1234-01 product_serial_number = 0723BBC006 fault_state = OK clear_fault_action = (none) power_state = On Commands: cd reset set show start stop -> set /SYS/LOCATE value=Fast_BlinkPreparing for Service 63 Related Information ¦ “Find the Chassis Serial Number” on page 61 Understanding Component Replacement Categories ¦ “FRU Reference” on page 63 ¦ “Hot Service, Replacement by Customer” on page 64 ¦ “Cold Service, Replacement by Customer” on page 65 ¦ “Cold Service, Replacement by Authorized Service Personnel” on page 66 FRU Reference The following table identifies the server components that are field-replaceable. TABLE: List of Field-Replaceable Units Description Quantity FRU Name Remove and Replace Instructions Processor module 1 or 2 /SYS/PMn “Servicing Processor Modules” on page 77 DIMM 16 or 32 /SYS/PMn/CMPn/BOBn/CHn/Dn “Servicing DIMMs” on page 91 Hard drive 1 to 8 /SYS/MB/HDDn “Servicing Hard Drives” on page 113 Power supply 4 /SYS/PSn “Servicing Power Supplies” on page 123 RAID expansion module 2 /SYS/MB/REMn “Servicing RAID Expansion Modules” on page 135 Service processor 1 /SYS/MB/SP “Servicing the Service Processor” on page 139 System battery 1 /SYS/MB/BAT “Servicing the System Battery” on page 145 Fan module 5 /SYS/FMn “Servicing Fan Modules” on page 151 Express module 0 to 16 /SYS/PCI-EMn “Servicing Express Modules” on page 15964 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Removing Power From the System” on page 66 ¦ “Returning the Server to Operation” on page 215 Hot Service, Replacement by Customer The following components can be replaced while power is present on the server. These components can be replaced by customers. Rear I/O module 1 /SYS/RIO “Servicing the Rear I/O Module” on page 175 System configuration PROM 1 /SYS/MB/SCC “Servicing the System Configuration PROM” on page 183 Front I/O assembly 1 /SYS/MB/FIO “Servicing the Front I/O Assembly” on page 189 Storage backplane 2 /SYS/MB/SASBPn “Servicing the Storage Backplane” on page 195 Main module motherboard 1 /SYS/MB “Servicing the Main Module Motherboard” on page 203 Rear chassis subassembly 1 N/A “Servicing the Rear Chassis Subassembly” on page 211 Hot Service Components (system can have power present) Notes Processor module A single processor module is a hot service component only if there are two operating processor modules in the server and if you are replacing the module located in processor module slot 1 Hard drive Drive must be offline Hard drive filler panel Needed to preserve proper interior air flow Power supply If three or more power supplies are in use Fan module If four or more fan modules are operational TABLE: List of Field-Replaceable Units (Continued) Description Quantity FRU Name Remove and Replace InstructionsPreparing for Service 65 Although hot service procedures can be performed while the server is running, you should usually bring it to standby mode as the first step in the replacement procedure. You do this by momentarily pressing the Power button on the front panel. See the descriptions of the Power OK LED and the Power Button in “Power Off the Server (Power Button - Graceful)” on page 68 for more information about the standby mode. Related Information ¦ “Accessing Internal Components” on page 69 Cold Service, Replacement by Customer The following components require the server to be powered down. These components can be replaced by customers. See “Power Off the Server (Service Processor Command)” on page 67 for the procedure to shut down the server. Related Information ¦ “Removing Power From the System” on page 66 ¦ “Accessing Internal Components” on page 69 Express module Cold Service (power down system and unplug power cables) Notes Processor module Processor module is a cold service component if there is only one operating processor module in the server DIMM Main module System battery RAID expansion module Service processor Rear I/O module Hot Service Components (system can have power present) Notes66 SPARC T3-4 Server Service Manual • August 2011 Cold Service, Replacement by Authorized Service Personnel The following components must be replaced by authorized service personnel. These replacement procedures can only be done when the server is powered down and power cables are unplugged. See “Power Off the Server (Service Processor Command)” on page 67 for the procedure to shut down the server. Related Information ¦ “Removing Power From the System” on page 66 ¦ “Accessing Internal Components” on page 69 Removing Power From the System These topics describe different methods for removing power from the chassis. ¦ “Power Off the Server (Service Processor Command)” on page 67 ¦ “Power Off the Server (Power Button - Graceful)” on page 68 ¦ “Power Off the Server (Emergency Shutdown)” on page 68 Authorized Service Personnel Only - Cold Service (power down system and disconnect power cables) Notes System configuration PROM Front I/O assembly Storage backplane Main module motherboard Transfer system configuration PROM to new motherboard Rear chassis subassemblyPreparing for Service 67 ? Power Off the Server (Service Processor Command) You can use the service processor to perform a graceful shutdown of the server. This type of shutdown ensures that all of your data is saved and that the server is ready for restart. Note – Additional information about powering off the server is provided in the SPARC T3 Series Servers Administration Guide. 1. Log in as superuser or equivalent. Depending on the type of problem, you might want to view server status or log files. You also might want to run diagnostics before you shut down the server. 2. Notify affected users that the server will be shut down. Refer to the Oracle Solaris system administration documentation for additional information. 3. Save any open files and quit all running programs. Refer to your application documentation for specific information for these processes. 4. Shut down all logical domains. Refer to the Oracle Solaris system administration documentation for additional information. 5. Shut down the Oracle Solaris OS. Refer to the Oracle Solaris system administration documentation for additional information. 6. Switch from the system console to the -> prompt by typing the #. (Hash Period) key sequence. 7. At the -> prompt, type the stop /SYS command. Note – You can also use the Power button on the front of the server to initiate a graceful server shutdown. (See “Power Off the Server (Power Button - Graceful)” on page 68.) This button is recessed to prevent accidental server power off. 8. Unplug all power cords from the server.68 SPARC T3-4 Server Service Manual • August 2011 Caution – Because 3.3v standby power is always present in the system, you must unplug the power cords before accessing any cold-serviceable components. Related Information ¦ “Power Off the Server (Power Button - Graceful)” on page 68 ¦ “Power Off the Server (Emergency Shutdown)” on page 68 ? Power Off the Server (Power Button - Graceful) This procedure places the server in the power standby mode. In this mode, the Power OK LED blinks rapidly. 1. Press and release the recessed Power button. 2. Unplug all power cords from the server. Caution – Because 3.3v standby power is always present in the system, you must unplug the power cords before accessing any cold-serviceable components. Related Information ¦ “Power Off the Server (Service Processor Command)” on page 67 ¦ “Power Off the Server (Emergency Shutdown)” on page 68 ? Power Off the Server (Emergency Shutdown) Caution – All applications and files will be closed abruptly without saving changes. File system corruption might occur. 1. Press and hold the Power button for four seconds. 2. Unplug all power cords from the server. Caution – Because 3.3v standby power is always present in the system, you must unplug the power cords before accessing any cold-serviceable components.Preparing for Service 69 Related Information ¦ “Power Off the Server (Service Processor Command)” on page 67 ¦ “Power Off the Server (Power Button - Graceful)” on page 68 Accessing Internal Components ¦ “Prevent ESD Damage” on page 69 ¦ “Accessing Main Module Components” on page 70 ¦ “Filler Panels” on page 74 ? Prevent ESD Damage Many components housed within the chassis can be damaged by electrostatic discharge. To protect these components from damage, perform the following steps before opening the chassis for service. 1. Prepare an antistatic surface to set parts on during the removal, installation, or replacement process. Place ESD-sensitive components such as the printed circuit boards on an antistatic mat. The following items can be used as an antistatic mat: ¦ Antistatic bag used to wrap a replacement part ¦ ESD mat ¦ A disposable ESD mat (shipped with some replacement parts or optional system components) 2. Attach an antistatic wrist strap. When servicing or removing server components, attach an antistatic strap to your wrist and then to a metal area on the chassis. Related Information ¦ “Safety Information” on page 5970 SPARC T3-4 Server Service Manual • August 2011 Accessing Main Module Components This topic describes how to remove the main module in order to access the following customer-replaceable or field-replaceable components within the main module, and then install the main module back into the server after you have replaced those internal components: ¦ RAID expansion modules ¦ Service processor ¦ System battery ¦ System configuration PROM ¦ Front I/O assembly ¦ Storage backplane For instructions on replacing the motherboard in the main module, see “Servicing the Main Module Motherboard” on page 203. ¦ “Remove the Main Module” on page 70 ¦ “Install the Main Module” on page 72 ? Remove the Main Module 1. Shut down the server. See “Removing Power From the System” on page 66. 2. Locate the main module in the server. See “Front Components” on page 2. 3. Squeeze the release latches together on the two extraction levers and pull the extraction levers out to disengage the main module from the server.Preparing for Service 71 4. Pull the main module halfway out of the server. 5. Press the levers back together, toward the center of the main module. This will keep the levers from getting damaged when you remove the main module from the server. 6. Remove the cover from the main module: a. Press down on the green button at the top of the cover to disengage the cover from the main module.72 SPARC T3-4 Server Service Manual • August 2011 b. Keeping the button pressed down, push the cover toward the rear of the main module and lift the cover up and away from the main module. 7. Service the component inside the main module. The following components are accessible inside the main module: ¦ “Servicing RAID Expansion Modules” on page 135 ¦ “Servicing the Service Processor” on page 139 ¦ “Servicing the System Battery” on page 145 ¦ “Servicing the System Configuration PROM” on page 183 ¦ “Servicing the Front I/O Assembly” on page 189 ¦ “Servicing the Storage Backplane” on page 195 Related Information ¦ “Install the Main Module” on page 72 ? Install the Main Module 1. Place the cover back onto the main module and slide the cover forward until the latch clicks into place.Preparing for Service 73 2. Insert the main module back into its slot in the server. 3. Press the levers back together, toward the center of the module, and press them firmly against the module to fully seat the module back into the server. The levers should click into place when the module is fully seated in the server.74 SPARC T3-4 Server Service Manual • August 2011 4. Power on the server. See “Returning the Server to Operation” on page 215. Related Information ¦ “Remove the Main Module” on page 70 Filler Panels Each server is shipped with module-replacement filler panels for processor modules, disk drives, DIMMs, and express modules. A filler panel is an empty metal or plastic enclosure that does not contain any functioning system hardware or cable connectors. The filler panels are installed at the factory and must remain in the server until you replace them with a purchased module to ensure proper airflow through the system. If you remove a filler panel and continue to operate your system with an empty module slot, the server might overheat due to improper airflow. For instructions on removing or installing a filler panel for a server component, refer to the section in this guide about servicing that component. Related Information ¦ “Accessing Internal Components” on page 69Preparing for Service 7576 SPARC T3-4 Server Service Manual • August 201177 Servicing Processor Modules These topics describe service procedures for the processor modules in the server. ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Replacing a Faulty Processor Module” on page 80 ¦ “Install a New Processor Module” on page 87 ¦ “Verify Processor Module Functionality” on page 90 Processor Module Configuration Reference This topic shows the locations of the processor modules in the server. Note that if only one processor module is installed in the server, the single processor module will be installed in the lower processor module slot (slot 0) and a filler panel will be installed in the upper processor module slot (slot 1).78 SPARC T3-4 Server Service Manual • August 2011 FIGURE: Processor Module Configuration Reference Related Information ¦ “Processor Module LEDs” on page 78 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85 ¦ “Verify Processor Module Functionality” on page 90 Processor Module LEDs Figure Legend 1 Processor module 1 or filler panel 2 Processor module 0Servicing Processor Modules 79 Related Information ¦ “Processor Module Configuration Reference” on page 77 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85 ¦ “Verify Processor Module Functionality” on page 90 Replacing a Faulty Processor Module Note – This topic describes how to replace a processor module that has failed. For instructions on increasing the number of processor modules in your system from one processor module to two, see “Install a New Processor Module” on page 87. The following topics describe the procedures for replacing a faulty processor module, regardless of whether it is a hot-swappable or a cold-swappable component. No. LED Icon Description 1 Ready to Remove (blue) Indicates that a processor module can be removed during a hot-plug operation. 2 Service Required (amber) Indicates that the processor module has experienced a fault condition. 3 OK (green) Indicates if the processor module is available for use. • On – The server is running and the processor module is powered up. • Off – The server is powered down and the processor module is in standby mode. If the server is powered on, then this indicates that the processor module is powered down (the blue Ready to Remove LED will be lit in this case).80 SPARC T3-4 Server Service Manual • August 2011 ¦ “Processor Module Replacement Guidelines” on page 80 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85 Processor Module Replacement Guidelines A processor module could be a hot-service or a cold-service component that can be replaced by a customer, depending on the number of operating processor modules installed in the server and the location of the faulty processor module: ¦ A processor module is a hot-service component if: ¦ There are two operating processor modules in the server. ¦ The faulty processor module that you want to replace is located in processor module slot 1 in the system. See “Processor Module Configuration Reference” on page 77 for the locations of the processor module slots. Note that you can not leave a processor module slot open for longer than 1 minute if you remove a processor module from a running server. You should have a replacement processor module or a processor module filler panel available to install in the empty slot if you think the slot will be left open longer than 1 minute. In addition, if you replace a processor module in a running server, the replacement processor module will not come online until the next power cycle of the server. This allows you to replace a processor module without having to power off the server immediately, and then power cycle the server when it is convenient for you to do so. ¦ A processor module is a cold-service component if there is only one operating processor module in the server or if the faulty processor module that you want to replace is located in processor module slot 0 in the system. Related Information ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85Servicing Processor Modules 81 ? Locate a Faulty Processor Module The following LEDs are lit when a processor module fault is detected: ¦ Front and rear System Fault (system Service Required) LEDs ¦ Service Required LED on the faulty processor module 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. From the front of the server, check the processor module LEDs to identify which processor module needs to be replaced. See “Processor Module LEDs” on page 78. The amber Service Required LED will be lit on the processor module that needs to be replaced. 3. Remove the faulty processor module. See “Remove a Processor Module” on page 81. Related Information ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85 ¦ “Verify Processor Module Functionality” on page 90 ? Remove a Processor Module 1. Locate the processor module in the server that you want to remove. See “Locate a Faulty Processor Module” on page 81 to locate a faulty processor module. 2. Determine how many operating processor modules are in the server. ¦ If there are two operating processor modules in the server, then you may not have to power off the server before removing the processor module. Go to Step 3. ¦ If there is only one operating processor module in the server, then you must power off the server before removing the processor module. See “Removing Power From the System” on page 66, then go to Step 5.82 SPARC T3-4 Server Service Manual • August 2011 3. Determine if the faulty processor module that you will be removing is in processor module slot 0 or slot 1. See “Front Components” on page 2 for the locations of the processor modules in the server. ¦ If the faulty processor module is in slot 0, then you must power off the server before removing the processor module. See “Removing Power From the System” on page 66, then go to Step 5. ¦ If the faulty processor module is in slot 1, then you can remove the processor module without having to power down the system, as long as you have a processor module filler panel that you can install in the empty slot. Note – You can not leave a processor module slot open for longer than 1 minute if you remove a processor module from a running server. If you do not have a processor module filler panel, see “Removing Power From the System” on page 66, then go to Step 5. If you have a processor module filler panel, go to Step 4. 4. Verify that the blue Ready to Remove LED is lit before proceeding. The Ready to Remove LED will come on when certain events prevent a processor module from operating normally after you have powered on the server. See “Processor Module LEDs” on page 78 for the location of the Ready to Remove LED. 5. Squeeze the release latches together on the two extraction levers and pull the extraction levers out to disengage the processor module from the server.Servicing Processor Modules 83 6. Pull the processor module halfway out of the server. 7. Press the levers back together, toward the center of the processor module. This will keep the levers from getting damaged when you remove the processor module from the server. 8. Using two hands, completely remove the processor module and place the module on an antistatic mat. Caution – Do not touch the connectors at the rear of the processor module. 9. If you removed a processor module from a running server, install a processor module filler panel within 1 minute. The remaining processor module may overheat if you leave the empty slot open for longer than 1 minute in a running server. 10. Remove the cover from the processor module: a. Press down on the green button at the top of the cover to disengage the cover from the processor module.84 SPARC T3-4 Server Service Manual • August 2011 b. Keeping the button pressed down, push the cover toward the rear of the processor module and lift the cover up and away from the processor module. 11. Determine if you are replacing a faulty processor module or if you are replacing or installing DIMMs within the processor module. ¦ If you are replacing a faulty processor module, follow these steps: a. Remove all DIMMs from the faulty processor module and set them in a safe place. See “Remove a DIMM” on page 103. You will install the DIMMs into the new processor module after you have replaced the faulty module. You should install the DIMMs in the same slots in the new processor module when you remove them from the old, faulty module, especially if you have mixed memory configurations in old processor module. You can accomplish this by moving the DIMMs over one at a time, from the old processor module to the same slots in the new module, or by laying the DIMMs out on a flat, safe surface in left-to-right rows and groups, and then installing them in the new module in the same order. b. Install a replacement processor module in the server. See “Install a Processor Module” on page 85. If you are not replacing the processor module right away, you must install a processor module filler panel to ensure adequate airflow in the system. ¦ If you are replacing or installing DIMMs within the processor module, see “Servicing DIMMs” on page 91. Related Information ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78Servicing Processor Modules 85 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Servicing DIMMs” on page 91 ¦ “Install a Processor Module” on page 85 ¦ “Verify Processor Module Functionality” on page 90 ? Install a Processor Module 1. Determine if you are installing a processor module after replacing or installing DIMMs, or if you are installing a new processor module to replace a faulty one. ¦ If you are installing a processor module after replacing or installing DIMMs, go to Step 2. ¦ If you are installing a new processor module to replace a faulty one, install all of the DIMMs that you removed from the faulty processor module into the replacement module. See “Install a DIMM” on page 105. 2. Place the cover back onto the processor module and slide the cover forward until the latch clicks into place. 3. Remove the processor module filler panel, if one is installed. 4. Insert the processor module into the empty processor module slot in the server. 5. Bring the levers together toward the center of the module and press them firmly against the module to fully seat the module back into the server. The levers should click into place when the module is fully seated in the server.86 SPARC T3-4 Server Service Manual • August 2011 6. Power on the server, if necessary. See “Returning the Server to Operation” on page 215. 7. Verify the processor module functionality. See “Verify Processor Module Functionality” on page 90. Related Information ¦ Oracle VM Server for SPARC 2.0 Administration Guide ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Servicing DIMMs” on page 91 ¦ “Verify Processor Module Functionality” on page 90Servicing Processor Modules 87 ? Install a New Processor Module This topic describes how to increase the number of processor modules in your system from one processor module to two. For instructions on replacing a processor module that has failed, see “Replacing a Faulty Processor Module” on page 80. 1. Determine if you have logical domains (LDoms) configured on the single processor module that you currently have installed in your server. ¦ If you do not have LDoms configured on the single processor in your server, go to Step 2. ¦ If you have LDoms configured on the single processor module in your server, follow these steps to preserve the original LDoms configuration before you add the second processor module: a. For each of the LDoms created, save the LDom constraints configured as an XML file: For example: Perform this step individually for all LDoms present in your system, saving the constraints for each LDom as a separate xml file. For example, save the primary domain as primary.xml, the first guest domain as ldg1.xml, and so on. b. Power down the system before installing the second processor module. See “Removing Power From the System” on page 66. c. Go to Step 2. 2. Remove the filler panel from the empty processor module slot, if one is installed. 3. Insert the new processor module into the empty processor module slot in the server. 4. Bring the levers together toward the center of the module and press them firmly against the module to fully seat the module back into the server. The levers should click into place when the module is fully seated in the server. # ldm list-constraints -x ldom >ldom.xml # ldm list-constraints -x ldg1 >lgd1.xml88 SPARC T3-4 Server Service Manual • August 2011 5. Power on the server. See “Returning the Server to Operation” on page 215. 6. Determine if you need to restore the LDom configuration information. ¦ If you had not configured LDoms on the single processor module before installing the second one, you do not have to restore the LDom configuration information. Go to Step 7. ¦ If you had configured LDoms on the single processor module before installing the second one, follow these procedures to restore the LDom configuration information that you saved earlier in this process: a. Change the server’s method of booting to its factory default setting: b. Boot the server again using the start /SYS command at the service processor prompt: -> set /HOST/bootmode config=factory-default -> start /SYSServicing Processor Modules 89 c. List all the guest domains that you currently have configured: d. Stop all the guest domains using the -a option: e. Unbind each of the guest domains: f. Destroy each of the guest domains: g. Restore the primary domain configuration: h. Restore each guest domain configuration. For each guest domain, enter the following commands to add, bind, and then restart each domain: 7. Verify the processor module functionality. See “Verify Processor Module Functionality” on page 90. Related Information ¦ Oracle VM Server for SPARC 2.0 Administration Guide ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Verify Processor Module Functionality” on page 90 # ldm ls # ldm stop-domain -a # ldm unbind-domain ldom # ldm destroy ldom # ldm init-system -i primary.xml # ldm add-domain -i ldg1.xml # ldm bind ldg1 # ldm start ldg190 SPARC T3-4 Server Service Manual • August 2011 ? Verify Processor Module Functionality 1. If you replaced a faulty processor module, use the show faulty command to determine if the replaced processor module is shown as enabled or disabled: a. If the output from the show faulty command shows the replacement processor module as enabled, go to Step 2. b. If the output from the show faulty command shows the replacement processor module as disabled, go to “Detecting and Managing Faults” on page 11 to clear the PSH-detected fault from the server. 2. Determine if you replaced a processor module in a running server. If you replaced a processor module in a running server, the replacement processor module will not come online until you have power-cycled the server. Go to “Preparing for Service” on page 59 for instructions on powering off the server, then go to “Returning the Server to Operation” on page 215 for instructions on powering the server back on. 3. Verify that the OK LED is lit on the processor module and that the Fault LED is not lit. See “Processor Module LEDs” on page 78. 4. Verify that the front and rear Service Required LEDs are not lit. See “Front Panel System Controls and LEDs” on page 16 and “Rear I/O Module LEDs” on page 19. 5. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If Step 3 and Step 4 indicate that no faults have been detected, then the processor module has been replaced successfully. No further action is required. Related Information ¦ “Processor Module Configuration Reference” on page 77 ¦ “Processor Module LEDs” on page 78 ¦ “Locate a Faulty Processor Module” on page 81 ¦ “Remove a Processor Module” on page 81 ¦ “Install a Processor Module” on page 85 -> show faulty91 Servicing DIMMs These topics describe service procedures for the DIMMs in the server. ¦ “Memory Fault Handling Overview” on page 91 ¦ “Understanding DIMM Configurations” on page 92 ¦ “Locate a Faulty DIMM Using the DIMM Fault Remind Button” on page 102 ¦ “Locate a Faulty DIMM Using the show faulty Command” on page 103 ¦ “Remove a DIMM” on page 103 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 Memory Fault Handling Overview A variety of features play a role in how the memory subsystem is configured and how memory faults are handled. Understanding the underlying features helps you identify and repair memory problems. The following server features manage memory faults: ¦ POST – By default, POST runs when the server is powered on. For CEs, POST forwards the error to the PSH daemon for error handling. If an uncorrectable memory fault is detected, POST displays the fault with the device name of the faulty DIMMs, and logs the fault. POST then disables the faulty DIMMs. Depending on the memory configuration and the location of the faulty DIMM, POST disables half of physical memory in the system, or half the physical memory and half the processor threads. When this offlining process occurs in normal operation, you must replace the faulty DIMMs based on the fault message and enable the disabled DIMMs with the ILOM command set device component_state=enabled where device is the name of the DIMM being enabled (for example, set /SYS/PM0/CMP0/BOB0/CH0/D0 component_state=enabled).92 SPARC T3-4 Server Service Manual • August 2011 ¦ PSH technology – Oracle Solaris Predictive Self-Healing uses the Fault Manager daemon (fmd) to watch for various kinds of faults. When a fault occurs, the fault is assigned a UUID and logged. PSH reports the fault and suggests a replacement for the DIMMs associated with the fault. If you suspect the server has a memory problem, run the ILOM show faulty command. This command lists memory faults and identifies the DIMM modules associated with the fault. Related Information ¦ “POST Overview” on page 44 ¦ “PSH Overview” on page 38 ¦ “PSH-Detected Fault Example” on page 39 ¦ “Locate a Faulty DIMM Using the DIMM Fault Remind Button” on page 102 ¦ “Locate a Faulty DIMM Using the show faulty Command” on page 103 Understanding DIMM Configurations These topics provide the information that you will need to determine how many DIMMs to install in the processor modules, where those DIMMs should be installed on the processor modules, and what size DIMM you should use. Description Links Understand the DIMM configuration guidelines. “DIMM Configuration Guidelines” on page 93 Understand the different DIMM configuration options that are available to you. • “Half-Populated Configuration” on page 93 • “3/4-Populated Configuration” on page 95 • “Fully-Populated Configuration” on page 97 Determine how to populate the DIMM slots in the processor modules depending on the following factors: • The number of processor modules in your system • The size of the DIMMs that you have available • The total amount of memory that you would like in each processor module • “One Processor Module Memory Configurations” on page 99 • “Two Processor Module Memory Configurations” on page 100Servicing DIMMs 93 DIMM Configuration Guidelines Consider the following guidelines when installing, upgrading, or replacing DIMMs: ¦ There are a total of 32 slots that support DDR3 DIMMs within each processor module. ¦ There are two supported DIMM capacities: 4 GByte and 8 GByte. ¦ The DIMM slots are organized into four branches, with each branch connected to a separate Buffer-on-Board (BOB) ASIC. The four branches are designated BOB0 through BOB3. ¦ Each BOB ASIC has two DDR3 channels, with each channel supporting two DIMMs. These configuration details are illustrated in the figures in the following topics. ¦ DIMM slots that do not have a DIMM installed must have DIMM fillers plugged into the sockets. ¦ Sixteen of the 32 DIMM slots (four banks of four DIMM slots) are associated with CMP0, and the other sixteen DIMM slots are associated with CMP1. The figures in the following topics show which DIMM slots are associated with each CMP. Related Information ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Remove a DIMM” on page 103 ¦ “Install a DIMM” on page 105 ¦ “Verify DIMM Functionality” on page 109 ¦ “Increase System Memory With Additional DIMMs” on page 107 Half-Populated Configuration The following figure shows where the DIMMs should be installed in a half-populated configuration. Use the information in this topic in conjunction with the information provided in the following topics: ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 10094 SPARC T3-4 Server Service Manual • August 2011 A half-populated configuration will have the following characteristics for each processor module: ¦ Eight 4 or 8 Gbyte DIMMs installed in the slots related to CMP 1 ¦ Eight 4 or 8 Gbyte DIMMs installed in the slots related to CMP 0 Also note that the DIMM slots are color coded to help you determine which slots should be populated for different configurations. For a half-populated configuration, the following slots will be populated or empty: ¦ Blue color-coded DIMM slots: Populated ¦ White color-coded DIMM slots: Populated ¦ Black color-coded DIMM slots: Empty TABLE: Legend for Half-Populated Configuration Symbol Meaning Denotes a populated slot. Denotes an unpopulated slot.Servicing DIMMs 95 Related Information ¦ “DIMM Configuration Guidelines” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 3/4-Populated Configuration The following figure shows where the DIMMs should be installed in a 3/4-populated configuration. Use the information in this topic in conjunction with the information provided in the following topics: ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 10096 SPARC T3-4 Server Service Manual • August 2011 A 3/4-populated configuration will have the following characteristics for each processor module: ¦ Sixteen 4 or 8 Gbyte DIMMs installed in the slots related to CMP 1 ¦ Eight 4 or 8 Gbyte DIMMs installed in the slots related to CMP 0 Also note that the DIMM slots are color coded to help you determine which slots should be populated for different configurations. For a 3/4-populated configuration, the following slots will be populated or empty: ¦ Blue color-coded DIMM slots: Populated ¦ White color-coded DIMM slots: Populated ¦ Black color-coded DIMM slots: ¦ CMP 1 bank: Populated ¦ CMP 0 bank: Empty Related Information ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 Fully-Populated Configuration The following figure shows where the DIMMs should be installed in a fully-populated configuration. Use the information in this topic in conjunction with the information provided in the following topics: TABLE: Legend for 3/4-Populated Configuration Symbol Meaning Denotes a populated slot. Denotes an unpopulated slot.Servicing DIMMs 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 A fully-populated configuration will have the following characteristics for each processor module: ¦ Sixteen 4 or 8 Gbyte DIMMs installed in the slots related to CMP 1 ¦ Sixteen 4 or 8 Gbyte DIMMs installed in the slots related to CMP 0 Also note that the DIMM slots are color coded to help you determine which slots should be populated for different configurations. For a fully-populated configuration, the following slots will be populated or empty: ¦ Blue color-coded DIMM slots: Populated ¦ White color-coded DIMM slots: Populated TABLE: Legend for Fully-Populated Configuration Symbol Meaning Denotes a populated slot. Denotes an unpopulated slot.98 SPARC T3-4 Server Service Manual • August 2011 ¦ Black color-coded DIMM slots: Populated Related Information ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 One Processor Module Memory Configurations Total Amount of Memory Processor Module 1 Processor Module 0 Balanced (Recommended) Configurations 64 Gbytes Processor filler module • “Half-Populated Configuration” on page 93 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group 128 Gbytes Processor filler module • “Half-Populated Configuration” on page 93 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 128 Gbytes Processor filler module • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group 256 Gbytes Processor filler module • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 groupServicing DIMMs 99 Related Information ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 Two Processor Module Memory Configurations Other Configurations 128 Gbytes Processor filler module • “3/4-Populated Configuration” on page 95 • 4 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 192 Gbytes Processor filler module • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group Total Amount of Memory Processor Module 1 Processor Module 0 Balanced (Recommended) Configurations 128 Gbytes • “Half-Populated Configuration” on page 93 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “Half-Populated Configuration” on page 93 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group 256 Gbytes • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group 256 Gbytes • “Half-Populated Configuration” on page 93 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group • “Half-Populated Configuration” on page 93 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group Total Amount of Memory Processor Module 1 Processor Module 0100 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 ¦ “Verify DIMM Functionality” on page 109 512 Gbytes • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group Other Configurations 192 Gbytes • “Half-Populated Configuration” on page 93 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “3/4-Populated Configuration” on page 95 • 4 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 192 Gbytes • “Half-Populated Configuration” on page 93 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group 256 Gbytes • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “Half-Populated Configuration” on page 93 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 384 Gbytes • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 4 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 384 Gbytes • “Half-Populated Configuration” on page 93 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group 448 Gbytes • “Fully-Populated Configuration” on page 97 • 4 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group • “Fully-Populated Configuration” on page 97 • 8 Gbyte DIMMs in CMP 1 group • 8 Gbyte DIMMs in CMP 0 group Total Amount of Memory Processor Module 1 Processor Module 0Servicing DIMMs 101 ? Locate a Faulty DIMM Using the DIMM Fault Remind Button 1. Remove the processor module with the faulty DIMM from the server and remove the cover from the processor module. See “Remove a Processor Module” on page 81. 2. Locate the DIMM Fault Remind button on the motherboard. 3. Verify that the DIMM Fault Remind Power LED next to the button is lit. A lit DIMM Fault Remind Power LED indicates that there is power available to light the faulty DIMM LED once you have pressed the DIMM Fault Remind button. 4. Press the DIMM Fault Remind button on the motherboard. This will cause DIMM Fault LED associated with the faulty DIMM to light for a few minutes. 5. Note the DIMM next to the illuminated DIMM Fault LED. 6. Ensure that all other DIMMs are seated correctly in their slots. Related Information ¦ “Locate a Faulty DIMM Using the show faulty Command” on page 103102 SPARC T3-4 Server Service Manual • August 2011 ? Locate a Faulty DIMM Using the show faulty Command The ILOM show faulty command displays current system faults, including DIMM failures. ? Enter show faulty at the -> prompt. Related Information ¦ “Locate a Faulty DIMM Using the DIMM Fault Remind Button” on page 102 ? Remove a DIMM A DIMM is a cold-service component that can be replaced by a customer. Before beginning this procedure, ensure that you are familiar with the cautions and safety instructions described in “Safety Information” on page 59. Caution – Do not leave DIMM slots empty. You must install filler panels in all empty DIMM slots. 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Remove the processor module with the faulty DIMM from the server and remove the cover from the processor module, if you have not already done so. See “Remove a Processor Module” on page 81. -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0/CMP0/BOB1/CH0/D0 /SP/faultmgmt/0 | timestamp | Dec 21 16:40:56 /SP/faultmgmt/0/ | timestamp | Dec 21 16:40:56 faults/0 /SP/faultmgmt/0/ | sp_detected_fault | /SYS/PM0/CMP0/BOB1/CH0/D0 faults/0 | | Forced fail(POST)Servicing DIMMs 103 3. Locate the DIMMs that need to be replaced. See “Locate a Faulty DIMM Using the DIMM Fault Remind Button” on page 102 or “Locate a Faulty DIMM Using the show faulty Command” on page 103. 4. Push down on the ejector tabs on each side of the DIMM until the DIMM is released. Caution – DIMMs and heat sinks on the motherboard might be hot. 5. Grasp the top corners of the faulty DIMM and lift it out of its slot. 6. Place the DIMM on an antistatic mat. 7. Repeat Step 4 through Step 6 for any other DIMMs you intend to remove. 8. Determine if you will be installing replacement DIMMs at this time. ¦ If you will be installing replacement DIMMs at this time, go to “Install a DIMM” on page 105. ¦ If you will not be installing replacement DIMMs at this time, follow these procedures to reinsert the processor module back into the server: a. Install filler panels in the empty DIMM slots. Caution – Do not leave DIMM slots empty. You must install filler panels in all empty DIMM slots. b. Place the cover back onto the processor module and insert the processor module back into its slot in the server. See “Install a Processor Module” on page 85.104 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Memory Fault Handling Overview” on page 91 ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Locate a Faulty DIMM Using the DIMM Fault Remind Button” on page 102 ¦ “Locate a Faulty DIMM Using the show faulty Command” on page 103 ¦ “Install a DIMM” on page 105 ¦ “Verify DIMM Functionality” on page 109 ? Install a DIMM Before beginning this procedure, ensure that you are familiar with the information provided in these topics: ¦ “Safety Information” on page 59 ¦ “DIMM Configuration Guidelines” on page 93 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Remove the processor module from the server and remove the cover from the processor module, if you have not already done so: See “Remove a Processor Module” on page 81. 3. Unpack the replacement DIMMs and place them on an antistatic mat. 4. Ensure that the ejector tabs on the connector that will receive the DIMM are in the open position. 5. Align the DIMM notch with the key in the connector. Caution – Ensure that the orientation is correct. The DIMM might be damaged if the orientation is reversed.Servicing DIMMs 105 6. Push the DIMM into the connector until the ejector tabs lock the DIMM in place. If the DIMM does not easily seat into the connector, check the DIMM’s orientation. 7. Repeat Step 4 through Step 6 until all new DIMMs are installed. 8. Place the cover back onto the processor module and insert the processor module back into its slot in the server. See “Install a Processor Module” on page 85. Related Information ¦ “Memory Fault Handling Overview” on page 91 ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Remove a DIMM” on page 103 ¦ “Verify DIMM Functionality” on page 109106 SPARC T3-4 Server Service Manual • August 2011 ? Increase System Memory With Additional DIMMs Before performing a memory upgrade procedure, become familiar with the memory configuration guidelines described in “DIMM Configuration Guidelines” on page 93. 1. Unpack the new DIMMs and place them on an antistatic mat. 2. Remove the processor module from the server and remove the cover from the processor module, if you have not already done so. See “Remove a Processor Module” on page 81. 3. At a DIMM slot that is to be upgraded, open the ejector tabs and remove the filler panel. Do not dispose of the filler panel. You may want to reuse it if any DIMMs are removed at another time. 4. Ensure that the ejector tabs on the connector that will receive the DIMM are in the open position. 5. Align the DIMM notch with the key in the connector. Caution – Ensure that the orientation is correct. The DIMM might be damaged if the orientation is reversed.Servicing DIMMs 107 6. Push the DIMM into the connector until the ejector tabs lock the DIMM in place. If the DIMM does not easily seat into the connector, check the DIMM’s orientation. 7. Repeat Step 3 through Step 6 until all DIMMs are installed. 8. Place the cover back onto the processor module and insert the processor module back into its slot in the server. See “Install a Processor Module” on page 85 9. Perform the following steps to verify that there are no faults: a. Set the virtual keyswitch to diag so that POST will run in Service mode. b. Power cycle the system. Note – The server takes about one minute to power off. The ILOM console does not indicate when the system is actually powered off. c. Switch to the system console to view POST output. Watch the POST output for possible fault messages. The following output indicates that POST did not detect any faults: Note – The system might boot automatically at this point. If so, go directly to Step e. If it remains at the ok prompt, go to Step d. -> set /SYS keyswitch_state=diag Set ‘keyswitch_state’ to ‘Diag’ -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /HOST/console ... 0:0:0>INFO: 0:0:0> POST Passed all devices. 0:0:0>POST: Return to VBSC. 0:0:0>Master set ACK for vbsc runpost command and spin...108 SPARC T3-4 Server Service Manual • August 2011 d. If the system remains at the ok prompt, type boot. e. Return the virtual keyswitch to Normal mode. Related Information ¦ “Memory Fault Handling Overview” on page 91 ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Half-Populated Configuration” on page 93 ¦ “3/4-Populated Configuration” on page 95 ¦ “Fully-Populated Configuration” on page 97 ¦ “One Processor Module Memory Configurations” on page 99 ¦ “Two Processor Module Memory Configurations” on page 100 ¦ “Remove a DIMM” on page 103 ¦ “Install a DIMM” on page 105 ¦ “Verify DIMM Functionality” on page 109 ? Verify DIMM Functionality 1. Access the ILOM -> prompt. Refer to the SPARC T3 Series Servers Administration Guide for instructions. 2. Use the show faulty command to determine how to clear the fault. ¦ If show faulty indicates a POST-detected fault, go to Step 3. ¦ If show faulty output displays a UUID, which indicates a host-detected fault, skip Step 3 and go directly to Step 4. 3. Use the set command to enable the DIMM that was disabled by POST. In most cases, replacement of a faulty DIMM is detected when the service processor is power cycled. In those cases, the fault is automatically cleared from the system. If show faulty still displays the fault, the set command will clear it. 4. For a host-detected fault, perform the following steps to verify the new DIMM: -> set /SYS keyswitch_state=Normal Set ‘ketswitch_state’ to ‘Normal’ -> set /SYS/PM0/CMP0/BOB0/CH0/D0 component_state=EnabledServicing DIMMs 109 a. Set the virtual keyswitch to diag so that POST will run in Service mode. b. Power cycle the system. Note – Use the show /HOST command to determine when the host has been powered off. The console will display status=Powered Off. Allow approximately one minute before running this command. c. Switch to the system console to view POST output. Watch the POST output for possible fault messages. The following output indicates that POST did not detect any faults: Note – The system might boot automatically at this point. If so, go directly to Step e. If it remains at the ok prompt go to Step d. d. If the system remains at the ok prompt, type boot. e. Return the virtual keyswitch to Normal mode. -> set /SYS keyswitch_state=diag Set ‘keyswitch_state’ to ‘Diag’ -> stop /SYS Are you sure you want to stop /SYS (y/n)? y Stopping /SYS -> start /SYS Are you sure you want to start /SYS (y/n)? y Starting /SYS -> start /HOST/console ... 0:0:0>INFO: 0:0:0> POST Passed all devices. 0:0:0>POST: Return to VBSC. 0:0:0>Master set ACK for vbsc runpost command and spin... -> set /SYS keyswitch_state=Normal Set ‘ketswitch_state’ to ‘Normal’110 SPARC T3-4 Server Service Manual • August 2011 f. Switch to the system console and type the Oracle Solaris OS fmadm faulty command. If any faults are reported, refer to the diagnostics instructions described in “ILOM Troubleshooting Overview” on page 23. 5. Switch to the ILOM command shell. 6. Run the show faulty command. If the show faulty command reports a fault with a UUID, go on to Step 7. If show faulty does not report a fault with a UUID, you are done with the verification process. 7. Switch to the system console and type the fmadm repair command with the UUID. Use the same UUID that was displayed from the output of the ILOM show faulty command. Related Information ¦ “Memory Fault Handling Overview” on page 91 ¦ “DIMM Configuration Guidelines” on page 93 ¦ “Remove a DIMM” on page 103 ¦ “Install a DIMM” on page 105 ¦ “Increase System Memory With Additional DIMMs” on page 107 # fmadm faulty -> show faulty Target | Property | Value --------------------+------------------------+------------------------------- /SP/faultmgmt/0 | fru | /SYS/PM0/CMP0/BOB0/CH1/D0 /SP/faultmgmt/0 | timestamp | Dec 14 22:43:59 /SP/faultmgmt/0/ | sunw-msg-id | SUN4V-8000-DX faults/0 | | /SP/faultmgmt/0/ | uuid | 3aa7c854-9667-e176-efe5-e487e520 faults/0 | | 7a8a /SP/faultmgmt/0/ | timestamp | Dec 14 22:43:59 faults/0 | | # fmadm repair 3aa7c854-9667-e176-efe5-e487e520Servicing DIMMs 111112 SPARC T3-4 Server Service Manual • August 2011113 Servicing Hard Drives These topics describe service procedures for the hard drives in the server. ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Remove a Hard Drive” on page 117 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121 Hard Drive Hot-Pluggable Capabilities The hard drives in the server are hot-pluggable, meaning that the drives can be removed and inserted while the server is powered on. Depending on the configuration of the data on a particular drive, the drive might also be removable while the server is online. However, to hot-plug a drive while the server is online you must take the drive offline before you can safely remove it. Taking a drive offline prevents any applications from accessing it, and removes the logical software links to it. The following situations inhibit your ability to hot-plug a drive: ¦ If the drive contains the operating system, and the operating system is not mirrored on another drive. ¦ If the drive cannot be logically isolated from the online operations of the server. If either of these conditions apply to the drive being serviced, you must take the server offline (shut down the operating system) before you replace the drive.114 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Remove a Hard Drive” on page 117 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121 Hard Drive Configuration Reference This topic provides configuration information for the hard drives. You can install a mix of hard disk drives and solid state drives. The server requires at least one hard drive to be installed and operational. FIGURE: Hard Disk Drive Reference Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 Figure Legend 1 Drive 1 5 Drive 5 2 Drive 0 6 Drive 4 3 Drive 3 7 Drive 7 4 Drive 2 8 Drive 6Servicing Hard Drives 115 ¦ “Remove a Hard Drive” on page 117 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121 Hard Drive LEDs The status of each drive is represented by the same three LEDs. Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Remove a Hard Drive” on page 117 TABLE: Status LEDs for Hard Drives No. LED Icon Description 1 Ready to Remove (blue) Indicates that a drive can be removed during a hot-plug operation. 2 Service Required (amber) Indicates that the drive has experienced a fault condition. 3 OK/Activity (green) Indicates the drive’s availability for use. • On – Read or write activity is in progress. • Off – Drive is idle and available for use.116 SPARC T3-4 Server Service Manual • August 2011 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121 ? Locate a Faulty Hard Drive The following LEDs are lit when a hard drive fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ Service Required LED on the faulty drive 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. From the front of the server, check the drive LEDs to identify which drive needs to be replaced. See “Hard Drive LEDs” on page 115. The amber Service Required LED will be lit on the drive that needs to be replaced. 3. Remove the faulty drive. See “Remove a Hard Drive” on page 117. Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Remove a Hard Drive” on page 117 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121 ? Remove a Hard Drive A hard drive is a hot-service component that can be replaced by a customer. 1. Locate the drive in the server that you want to remove. ¦ See “Front Components” on page 2 for the locations of the drives in the server.Servicing Hard Drives 117 ¦ See “Locate a Faulty Hard Drive” on page 116 to locate a faulty drive. 2. Determine if you need to shut down the OS to replace the drive, and perform one of the following actions: ¦ If the drive cannot be taken offline without shutting down the OS, follow instructions in “Power Off the Server (Service Processor Command)” on page 67 then go to Step 4. ¦ If the drive can be taken offline without shutting down the OS, go to Step 3. 3. Take the drive offline: a. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including drives that are not configured: This command lists dynamically reconfigurable hardware resources and shows their operational status. In this case, look for the status of the drive you plan to remove. This information is listed in the Occupant column. Example: You must unconfigure any drive whose status is listed as configured, as described in Step b. b. Unconfigure the drive using the cfgadm -c unconfigure command. Example: Replace c2::w5000cca00a76d1f5,0 with the drive name that applies to your situation. c. Verify that the drive’s blue Ready-to-Remove LED is lit. 4. Press the drive release button to unlock the drive and pull on the latch to remove the drive. # cfgadm -al Ap_id Type Receptacle Occupant Condition ... c2 scsi-sas connected configured unknown c2::w5000cca00a76d1f5,0 disk-path connected configured unknown c3 scsi-sas connected configured unknown c3::w5000cca00a772bd1,0 disk-path connected configured unknown c4 scsi-sas connected configured unknown c4::w5000cca00a59b0a9,0 disk-path connected configured unknown ... # cfgadm -c unconfigure c2::w5000cca00a76d1f5,0118 SPARC T3-4 Server Service Manual • August 2011 Caution – The latch is not an ejector. Do not force the latch too far to the right. Doing so can damage the latch. 5. Install the replacement drive or a filler tray. See “Install a Hard Drive” on page 120. Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Install a Hard Drive” on page 120 ¦ “Verify Hard Drive Functionality” on page 121Servicing Hard Drives 119 ? Install a Hard Drive 1. Align the replacement drive to the drive slot and slide the drive in until it is seated. Drives are physically addressed according to the slot in which they are installed. If you are replacing a drive, install the replacement drive in the same slot as the drive that was removed. See “Hard Drive Configuration Reference” on page 114 for drive slot information. 2. Close the latch to lock the drive in place. 3. Verify the drive functionality. See “Verify Hard Drive Functionality” on page 121. Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Remove a Hard Drive” on page 117 ¦ “Verify Hard Drive Functionality” on page 121120 SPARC T3-4 Server Service Manual • August 2011 ? Verify Hard Drive Functionality 1. Determine if you replaced or installed a hard drive in a running system or not. ¦ If you replaced or installed a hard drive in a system that is running (if you hot-plugged the hard drive), then no further action is necessary. The Solaris OS will auto-configure your hard drive. ¦ If you replaced or installed a hard drive in a powered-down system, then continue with these procedures to configure the hard drive. 2. If the OS is shut down, and the drive you replaced was not the boot device, boot the OS. Depending on the nature of the replaced drive, you might need to perform administrative tasks to reinstall software before the server can boot. Refer to the Oracle Solaris OS administration documentation for more information. 3. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including any drives that are not configured: This command helps you identify the drive you installed. Example: 4. Configure the drive using the cfgadm -c configure command. Example: Replace c2::w5000cca00a76d1f5,0 with the drive name for your configuration. # cfgadm -al Ap_id Type Receptacle Occupant Condition ... c2 scsi-sas connected configured unknown c2::w5000cca00a76d1f5,0 disk-path connected configured unknown c3 scsi-sas connected configured unknown c3::sd2 disk-path connected unconfigured unknown c4 scsi-sas connected configured unknown c4::w5000cca00a59b0a9,0 disk-path connected configured unknown ... # cfgadm -c configure c2::w5000cca00a76d1f5,0Servicing Hard Drives 121 5. Verify that the blue Ready-to-Remove LED is no longer lit on the drive that you installed. See “Hard Drive LEDs” on page 115. 6. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree, including any drives that are not configured: The replacement drive is now listed as configured. Example: 7. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not verify the drive, see “Diagnostics Process” on page 12. ¦ If the previous steps indicate that the drive is functioning properly, perform the tasks required to configure the drive. These tasks are covered in the Oracle Solaris OS administration documentation. For additional drive verification, you can run the SunVTS software. Refer to the SunVTS documentation for details. Related Information ¦ “Hard Drive Hot-Pluggable Capabilities” on page 113 ¦ “Hard Drive Configuration Reference” on page 114 ¦ “Hard Drive LEDs” on page 115 ¦ “Locate a Faulty Hard Drive” on page 116 ¦ “Remove a Hard Drive” on page 117 ¦ “Install a Hard Drive” on page 120 # cfgadm -al Ap_id Type Receptacle Occupant Condition ... c2 scsi-sas connected configured unknown c2::w5000cca00a76d1f5,0 disk-path connected configured unknown c3 scsi-sas connected configured unknown c3::w5000cca00a772bd1,0 disk-path connected configured unknown c4 scsi-sas connected configured unknown c4::w5000cca00a59b0a9,0 disk-path connected configured unknown ...122 SPARC T3-4 Server Service Manual • August 2011123 Servicing Power Supplies These topics describe service procedures for the power supplies in the server. ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133 Power Supply Overview The server must have at least two functioning power supplies to operate correctly. There are no restrictions into which slots the power supplies have to be installed, so if you have only two power supplies, they can be installed in any of the four power supply slots. If you need to replace a power supply and your server has only two power supplies installed, you must power down the server before you can replace the power supply. Related Information ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133124 SPARC T3-4 Server Service Manual • August 2011 Power Supply and AC Power Connector Configuration Reference FIGURE: Power Supply Configuration Reference (Front of Server) Figure Legend 1 Power supply unit 0 2 Power supply unit 1 3 Power supply unit 2 4 Power supply unit 3Servicing Power Supplies 125 FIGURE: AC Connector Configuration Reference (Rear of Server) Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133 Figure Legend 1 AC connector for power supply unit 3 2 AC connector for power supply unit 2 3 AC connector for power supply unit 1 4 AC connector for power supply unit 0126 SPARC T3-4 Server Service Manual • August 2011 Power Supply and AC Power Connector LEDs Each power supply is provided with a set of three LEDs, which are located at the front of the system. Note – If a power supply fails and you do not have a replacement available, leave the failed power supply installed to ensure proper airflow in the server. Each AC power connector has a single LED. TABLE: Power Supply Status LEDs No. LED Icon Description 1 Fault (amber) Lights when the power supply is faulty. Note - The front and rear panel Service Required LEDs are also lit if the system detects a power supply fault. 2 OK (green) Lights when the power supply DC voltage from the PSU to the server is within tolerance. 3 AC Present (green) ~AC Lights when AC voltage is applied to the power supply.Servicing Power Supplies 127 FIGURE: AC Power Connector LED Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133 ? Locate a Faulty Power Supply The following LEDs are lit when a power supply fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ Fault LED on the faulty power supply 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. TABLE: AC Power Connector LED No. LED Description 1 AC Present (green) Lights to indicate that the power cord connected to this system AC power connector is also plugged into an AC wall socket and is supplying power to this AC power connector. Note that this LED will light only after a minimum of two power cords are supplying power to the AC power connectors.128 SPARC T3-4 Server Service Manual • August 2011 2. From the front of the server, check the power supply fault LEDs to identify which power supply needs to be replaced. See “Power Supply and AC Power Connector LEDs” on page 126. The amber Service Required LED will be lit on the power supply that needs to be replaced. 3. Remove the faulty power supply. See “Remove a Power Supply” on page 128. Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133 ? Remove a Power Supply The power supply is a hot-service component that can be replaced by a customer. 1. Locate the power supply in the server that you want to remove. ¦ See “Front Components” on page 2 for the locations of the power supplies in the server. ¦ See “Locate a Faulty Power Supply” on page 127 to locate a faulty power supply. 2. Determine if you can hot-swap the power supply: ¦ If there are at least three power supplies installed, you can hot-swap the faulty power supply without shutting down the server. Go to Step 6. ¦ If there are two or fewer power supplies installed, you must shut down the server before you can remove the power supply. Go to Step 3 3. Power off the server. See “Removing Power From the System” on page 66 4. Go to the rear of the server and locate the AC power connector at the rear of the server that supplies power to the faulty power supply. See “Power Supply and AC Power Connector Configuration Reference” on page 124.Servicing Power Supplies 129 5. Disconnect the power cord from the AC power connector that is associated with the power supply that will be replaced. 6. Go to the front of the server and, on the power supply to be removed, squeeze the release latches together, then pull the extraction lever toward you to disengage the power supply from the server. 7. Pull the power supply out of the server. 8. Install the replacement power supply. See “Install a Power Supply” on page 130. Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Install a Power Supply” on page 130 ¦ “Verify Power Supply Functionality” on page 133130 SPARC T3-4 Server Service Manual • August 2011 ? Install a Power Supply 1. Align the replacement power supply with the empty power supply chassis bay. Verify that the extraction lever on the power supply is on the right side of the power supply and that the power supply is oriented as shown in the following figure. 2. Slide the power supply into the chassis. 3. Press the lever against the power supply to fully seat the power supply in the server.Servicing Power Supplies 131 4. If you disconnected the power cord for the power supply (if you had to cold-service the power supply), go to the rear of the server and plug the power cord into the AC connector that is associated with the power supply that you just inserted. As soon as power is applied to the server, standby power initializes the service processor. Depending on the server’s OpenBoot PROM settings, the host server might automatically boot, or you might need to boot it manually. The following figures show the locations of the power supplies at the front of the server and the corresponding AC power connectors at the rear of the server. FIGURE: Locating the Power Supplies at the Front of the Server Figure Legend 1 Power supply unit 0 2 Power supply unit 1 3 Power supply unit 2 4 Power supply unit 3132 SPARC T3-4 Server Service Manual • August 2011 FIGURE: Locating the AC Connectors at the Rear of the Server 5. Verify the power supply functionality. See “Verify Power Supply Functionality” on page 133. Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Verify Power Supply Functionality” on page 133 Figure Legend 1 AC connector for power supply unit 3 2 AC connector for power supply unit 2 3 AC connector for power supply unit 1 4 AC connector for power supply unit 0Servicing Power Supplies 133 ? Verify Power Supply Functionality 1. Verify that the power supply Power OK and AC Present LEDs are lit, and that the Fault LED is not lit. See “Power Supply and AC Power Connector LEDs” on page 126. 2. Verify that the front and rear Service Required LEDs are not lit. See “Interpreting Diagnostic LEDs” on page 16. 3. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If Step 1 and Step 2 indicate that no faults have been detected, then the power supply has been replaced successfully. No further action is required. Related Information ¦ “Power Supply Overview” on page 123 ¦ “Power Supply and AC Power Connector Configuration Reference” on page 124 ¦ “Power Supply and AC Power Connector LEDs” on page 126 ¦ “Locate a Faulty Power Supply” on page 127 ¦ “Remove a Power Supply” on page 128 ¦ “Install a Power Supply” on page 130134 SPARC T3-4 Server Service Manual • August 2011135 Servicing RAID Expansion Modules These topics describe service procedures for the RAID expansion modules in the server. ¦ “Remove the RAID Expansion Module” on page 135 ¦ “Install the RAID Expansion Module” on page 136 ? Remove the RAID Expansion Module The RAID expansion module is a cold-service component that can be replaced by a customer. 1. Remove the main module from the server. See “Remove the Main Module” on page 70. 2. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 3. Locate the RAID expansion module that you want to replace on the main module. See “Main Module Components” on page 3. 4. Lift up the extraction lever to unseat the RAID expansion module.136 SPARC T3-4 Server Service Manual • August 2011 5. Grasp the side of the RAID expansion module closest to the lever and lift it up. 6. Pull the RAID expansion module away from the main module. Related Information ¦ “Install the RAID Expansion Module” on page 136 ? Install the RAID Expansion Module 1. Orient the RAID expansion module into position over the slot, with the rubber press point side closest to the lever. 2. Slide one side of the RAID expansion module under the plastic lip in the module holder.Servicing RAID Expansion Modules 137 3. Lower the other side of the RAID expansion module down, and then press on the rubber press point to seat the module into the slot. The lever should lower itself down into position when the module is fully seated. 4. Install the main module back into the server. See “Install the Main Module” on page 72. 5. Determine if you originally had RAID volumes set up on your system before you replaced the RAID expansion module. ¦ If you did not originally have RAID volumes set up on your system, you do not have to perform any other procedures in this topic. ¦ If you did have RAID volumes set up on your system, continue to Step 6 to activate those RAID volumes again after replacing the RAID expansion module. 6. Disable auto-boot in OBP and enter the OBP environment after you have powered the server back on. 7. At the Oracle Solaris OBP prompt, use the show-devs command to list the device paths on the server: You can also use the devalias command to locate device paths specific to your server: 8. Use the select command to choose the RAID expansion module that you just replaced: where rem is either the full device path name (such as /pci@700/pci@1/pci@0/pci@0/@0) or the alias name (such as scsi1). ok show-devs ... /pci@700/pci@1/pci@0/pci@0/@0 ... /pci@400/pci@1/pci@0/pci@0/@0 ... ok devalias ... scsi1 /pci@700/pci@1/pci@0/pci@0/@0 ... scsi0 /pci@400/pci@1/pci@0/pci@0/@0 ... ok select rem138 SPARC T3-4 Server Service Manual • August 2011 9. List all connected logical RAID volumes to determine which volumes are in an inactive state: 10. For every RAID volume that is listed as inactive, enter the following command to activate those volumes: where inactive_volume is the name of the RAID volume that you are activating. Note – For more information on configuring hardware RAID on the server, refer to the SPARC T3 Series Servers Administration Guide. Related Information ¦ “Remove the RAID Expansion Module” on page 135 ok show-volumes ok inactive_volume activate-volume139 Servicing the Service Processor These topics describe service procedures for the service processor in the server. ¦ “Service Processor Overview” on page 139 ¦ “Locate a Faulty Service Processor” on page 140 ¦ “Remove the Service Processor” on page 140 ¦ “Install the Service Processor” on page 142 ¦ “Verify Service Processor Functionality” on page 144 Service Processor Overview If the service processor is replaced, the configuration settings maintained in the service processor will need to be restored. Before replacing the service processor, you should save the configuration using the ILOM backup utility. System firmware consists of both service processor and host components. The service processor component is located on the service processor and the host component is located on the host. These two components must be compatible. When the service processor is replaced, the service processor firmware component on the new service processor may be incompatible with the existing host firmware component. In this case, the system firmware must be loaded as described in “Install the Service Processor” on page 142. Related Information ¦ “Locate a Faulty Service Processor” on page 140 ¦ “Remove the Service Processor” on page 140 ¦ “Install the Service Processor” on page 142 ¦ “Verify Service Processor Functionality” on page 144140 SPARC T3-4 Server Service Manual • August 2011 ? Locate a Faulty Service Processor The following LEDs are lit when a service processor fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ System SP Status LED on the main module or rear I/O module 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. Check the SP Status LED on the main module or the rear I/O module to determine if the service processor needs to be replaced. See “Main Module Motherboard LEDs” on page 204 or “Rear I/O Module LEDs” on page 19. The SP Status LED will be lit amber if the service processor needs to be replaced. 3. Remove the faulty service processor. See “Remove the Service Processor” on page 140. Related Information ¦ “Service Processor Overview” on page 139 ¦ “Remove the Service Processor” on page 140 ¦ “Install the Service Processor” on page 142 ¦ “Verify Service Processor Functionality” on page 144 ? Remove the Service Processor The service processor is a cold-service component that can be replaced by a customer. 1. Back up the service processor configuration information before removing the service processor. At the ILOM prompt, type: where: -> cd /SP/config -> dump -destination uri targetServicing the Service Processor 141 ¦ The acceptable values for uri are: ¦ tftp ¦ ftp ¦ sftp ¦ scp ¦ http ¦ https ¦ target is the remote location where you will want to store the configuration information. For example: 2. Remove the main module from the server. See “Remove the Main Module” on page 70. 3. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 4. Locate the service processor on the main module. See “Main Module Components” on page 3. 5. Grasp the service processor by the two grasp points, and lift up to disengage the service processor from the connectors on the motherboard. 6. Lift the service processor up and away from the motherboard. Related Information ¦ “Service Processor Overview” on page 139 -> dump -destination tftp://129.99.99.99/pathname142 SPARC T3-4 Server Service Manual • August 2011 ¦ “Locate a Faulty Service Processor” on page 140 ¦ “Install the Service Processor” on page 142 ¦ “Verify Service Processor Functionality” on page 144 ? Install the Service Processor 1. Lower the side of the service processor with the Align Tab sticker down on the service processor tab on the motherboard. 2. Lower the other side of the service processor down and press down on the service processor to seat it into the connectors on the motherboard. 3. Install the main module back into the server. See “Install the Main Module” on page 72.Servicing the Service Processor 143 4. Connect a terminal or a terminal emulator (PC or workstation) to the serial management port. If the replacement service processor detects that the service processor firmware is not compatible with the existing host firmware, further action will be suspended and the following message will be delivered over the serial management port. If you see this message, go on to Step 5. 5. Download the system firmware. a. Configure the service processor’s network port to enable the firmware image to be downloaded. Refer to the Oracle ILOM documentation for network configuration instructions. b. Download the system firmware. Follow the firmware download instructions in the Oracle ILOM documentation. Note – You can load any supported system firmware version, including the firmware revision that had been installed prior to the replacement of the service processor. 6. Restore the service processor configuration information that you backed up earlier. At the ILOM prompt, type: where: ¦ The acceptable values for uri are: ¦ tftp ¦ ftp ¦ sftp ¦ scp ¦ http ¦ https Unrecognized Chassis: This module is installed in an unknown or unsupported chassis. You must upgrade the firmware to a newer version that supports this chassis. -> cd /SP/config -> load -source uri target144 SPARC T3-4 Server Service Manual • August 2011 ¦ target is the remote location where you stored the configuration information. For example: 7. Verify the service processor. See “Verify Service Processor Functionality” on page 144. Related Information ¦ “Service Processor Overview” on page 139 ¦ “Locate a Faulty Service Processor” on page 140 ¦ “Remove the Service Processor” on page 140 ¦ “Verify Service Processor Functionality” on page 144 ? Verify Service Processor Functionality 1. Verify that the SP Status LED on the main module or rear I/O module is lit green. See “Main Module Motherboard LEDs” on page 204 or “Rear I/O Module LEDs” on page 19. 2. Verify that the front and rear Service Required LEDs are not lit. See “Interpreting Diagnostic LEDs” on page 16. 3. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If the previous steps indicate that no faults have been detected, then the service processor has been replaced successfully. No further action is required. Related Information ¦ “Service Processor Overview” on page 139 ¦ “Locate a Faulty Service Processor” on page 140 ¦ “Remove the Service Processor” on page 140 ¦ “Install the Service Processor” on page 142 -> load -source tftp://129.99.99.99/pathname145 Servicing the System Battery These topics describe service procedures for the system battery in the server. ¦ “Remove the System Battery” on page 145 ¦ “Install the System Battery” on page 146 ¦ “Verify the System Battery” on page 148 ? Remove the System Battery The system battery is a cold-service component that can be replaced by a customer. 1. Remove the main module from the server. See “Remove the Main Module” on page 70. 2. Locate the system battery in the main module. See “Main Module Components” on page 3. 3. Push the top edge of the battery against the spring and lift it out of the carrier.146 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Install the System Battery” on page 146 ¦ “Verify the System Battery” on page 148 ? Install the System Battery 1. Insert the new system battery in the main module, with the positive side (+) facing out.Servicing the System Battery 147 2. Install the main module back into the server. See “Install the Main Module” on page 72. 3. If the service processor is configured to synchronize with a network time server using the Network Time Protocol (NTP), the ILOM clock will be reset as soon as the server is powered on and connected to the network. Otherwise, proceed to the next step. 4. If the service processor is not configured to use NTP, you must reset the ILOM clock using the ILOM CLI or the web interface. For instructions, see the Oracle Integrated Lights Out Manager (ILOM) 3.0 Documentation Collection. 5. If the service processor is not configured to use NTP, use the ILOM clock command to set the day and time. The following example sets the date to June 17, 2010, and the timezone to GMT. -> set /SP/clock datetime=061716192010 -> show /SP/clock /SP/clock Targets: Properties: datetime = Wed JUN 17 16:19:56 2010 timezone = GMT (GMT)148 SPARC T3-4 Server Service Manual • August 2011 Note – For additional details about setting the ILOM clock, refer to the CLI Procedures Guide for Oracle ILOM. 6. Verify that the new system battery is functioning properly. See “Verify the System Battery” on page 148. Related Information ¦ “Remove the System Battery” on page 145 ¦ “Verify the System Battery” on page 148 ? Verify the System Battery 1. Run show /SYS/MB/BAT/V_BAT to check the status of the system battery. In the output, the /SYS/MB/BAT/V_BAT status should be “OK”, as in the following example. 2. Verify that the value in the Voltage column shows an approximate voltage of 2.8V. usentpserver = disabled Commands: cd set show sc> show /SYS/MB/BAT/V_BAT Voltage sensors (in Volts): ------------------------------------------------------------------------------ Sensor Status Voltage LowSoft LowWarn HighWarn HighSoft ------------------------------------------------------------------------------ /SYS/MB/V_+3V3_STBY OK 3.36 3.13 3.17 3.53 3.60 /SYS/MB/V_+3V3_MAIN OK 3.37 3.06 3.10 3.49 3.53 /SYS/MB/V_+5V0_VCC OK 5.07 4.55 4.65 5.36 5.46 /SYS/MB/V_+12V0_MAIN OK 12.10 10.90 11.15 12.85 13.10 /SYS/MB/BAT/V_BAT OK 2.83 -- 2.69 . . .Servicing the System Battery 149 Related Information ¦ “Remove the System Battery” on page 145 ¦ “Install the System Battery” on page 146150 SPARC T3-4 Server Service Manual • August 2011151 Servicing Fan Modules These topics describe service procedures for the fan modules in the server. ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157 Fan Module Overview The server will continue to operate at full capacity with four or more fan modules installed in the server. The server will not operate with fewer than four fan modules installed and operating. If your server is operating with four fan modules installed and one or more of those four fan modules fails, the server will power down to keep from overheating. You can perform a hot service on a fan module only if four or more fan modules are operational. Related Information ¦ “Fan Module Configuration Reference” on page 152 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157152 SPARC T3-4 Server Service Manual • August 2011 Fan Module Configuration Reference FIGURE: Fan Module Configuration Reference Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157 Figure Legend 1 Fan module 0 2 Fan module 1 3 Fan module 2 4 Fan module 3 5 Fan module 4Servicing Fan Modules 153 Fan Module LED FIGURE: Fan Module LED The front and rear panel Service Required LEDs also turn on if the system detects a fan module fault. If the fan fault causes an overtemperature condition to occur, the system Overtemp LED will turn on, and an error message will be logged and displayed on the system console. Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157 TABLE: Fan Module Status LEDs No. LED Icon Description 1 Service Required (amber) The LED amber when the fan module is faulty. The system Fan Fault LED is also lit when a Fan module LED is amber.154 SPARC T3-4 Server Service Manual • August 2011 ? Locate a Faulty Fan Module The following LEDs are lit when a fan module fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ System Fan Fail LED on the front panel ¦ Service Required LED on the faulty fan module 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. Determine if the System Fan Fail LED on the front panel is lit. See “Front Panel System Controls and LEDs” on page 16. 3. From the rear of the server, check the fan module LEDs to identify which fan module needs to be replaced. See “Fan Module LED” on page 153. The amber Service Required LED will be lit on the fan module that needs to be replaced. 4. Remove the faulty processor module. See “Remove a Fan Module” on page 154. Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152 ¦ “Fan Module LED” on page 153 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157 ? Remove a Fan Module The fan module is a hot-service component that can be replaced by a customer. 1. Locate the faulty fan module that you want to remove from the server.Servicing Fan Modules 155 ¦ See “Rear Components” on page 6 for the locations of the fan modules in the server. ¦ See “Locate a Faulty Fan Module” on page 154 to locate a faulty fan module. 2. Determine if you can remove the fan module with the server running or not. See “Fan Module Overview” on page 151 to determine if you can remove a fan module with the server running or if you must shut down the server before removing a fan module. ¦ If you can remove a fan module with the server running, go to Step 3. ¦ If you cannot remove a fan module with the server running, see “Removing Power From the System” on page 66 to power down the server before continuing. 3. Press down on the middle portion of the fan lever and lower the lever slightly to disengage the fan latch. 4. Lower the fan lever completely and pull out on the fan module to remove the fan module from the system. Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Install a Fan Module” on page 156 ¦ “Verify Fan Module Functionality” on page 157156 SPARC T3-4 Server Service Manual • August 2011 ? Install a Fan Module 1. Insert the fan module into the empty fan module slot. 2. Lift the fan lever up completely until the latch clicks into place to completely seat the fan module into the slot. 3. Power on the server, if necessary. If you had to power off the server before removing and installing a new fan, see “Returning the Server to Operation” on page 215 to power on the server again. 4. Verify the fan module functionality. See “Verify Fan Module Functionality” on page 157. Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152Servicing Fan Modules 157 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Verify Fan Module Functionality” on page 157 ? Verify Fan Module Functionality 1. Check the front or rear panel LEDs for the following indications: ¦ Green System OK LED – illuminated ¦ Amber System Fault LED – not illuminated ¦ Amber System Fan Fault LED – not illuminated See “Front Panel System Controls and LEDs” on page 16 and “Rear I/O Module LEDs” on page 19. If these conditions are met, continue to Step 2. If these conditions are not met, perform the actions described in “Diagnostics Process” on page 12. 2. Run the ILOM show faulty command to check for faults. See “Access the Service Processor (ILOM)” on page 25, and “Check for Faults (show faulty Command)” on page 28. ¦ If faults are reported, perform the actions described in “Diagnostics Process” on page 12. ¦ If no faults are reported, then the fan module has been replaced successfully. No further action is required. Related Information ¦ “Fan Module Overview” on page 151 ¦ “Fan Module Configuration Reference” on page 152 ¦ “Fan Module LED” on page 153 ¦ “Locate a Faulty Fan Module” on page 154 ¦ “Remove a Fan Module” on page 154 ¦ “Install a Fan Module” on page 156158 SPARC T3-4 Server Service Manual • August 2011159 Servicing Express Modules These topics describe service procedures for the express modules in the server. ¦ “Express Module Configuration Reference” on page 159 ¦ “Express Module FRU Paths” on page 161 ¦ “Locate a Faulty Express Module” on page 167 ¦ “Remove an Express Module” on page 168 ¦ “Install an Express Module” on page 170 ¦ “Verify Express Module Functionality” on page 172 Express Module Configuration Reference There are 16 express module slots at the rear of the server. The express module slots are numbered from 0-15 (EM0-EM15) from left to right when viewing the server from the rear.160 SPARC T3-4 Server Service Manual • August 2011 FIGURE: Express Module Configuration Reference All 16 express module slots support the cards with the following characteristics: ¦ Hot-plug express modules ¦ x8 Gen1 and x8 Gen2 express modules You can increase the number of express module slots by connecting an I/O expansion unit to the server. The link card used by an I/O expansion unit can only be installed in express module slots EM2 or EM8 in the server. For a system with a single processor module installed, install the link card used by an I/O expansion unit in express module slot EM8. When installing express modules in the system (other than the link card used by an I/O expansion unit), refer to the following guidelines for the best order to achieve optimal load balancing. Figure Legend 1 Express module slot 0 9 Express module slot 8 2 Express module slot 1 10 Express module slot 9 3 Express module slot 2 11 Express module slot 10 4 Express module slot 3 12 Express module slot 11 5 Express module slot 4 13 Express module slot 12 6 Express module slot 5 14 Express module slot 13 7 Express module slot 6 15 Express module slot 14 8 Express module slot 7 16 Express module slot 15Servicing Express Modules 161 Note that the guidelines above are recommended best-practice guidelines for load balancing. You might choose to populate the express module slots differently due to LDom or redundant failover considerations. Related Information ¦ “Express Module FRU Paths” on page 161 ¦ “Locate a Faulty Express Module” on page 167 ¦ “Remove an Express Module” on page 168 ¦ “Install an Express Module” on page 170 ¦ “Verify Express Module Functionality” on page 172 Express Module FRU Paths The FRU paths for the express modules will vary, depending on the following factors: ¦ The number of processor modules installed in the server ¦ Whether or not a processor module has failed and the FRU paths have been rerouted down backup failover paths The following topics provide example scenarios for express module FRU paths and what the FRU paths would be for each scenario: System With One Processor Module Populate these slots first, in this order: EM0 EM8 EM1 EM9 Populate these slots second, in this order: EM2 EM10 EM3 EM11 Populate these slots third, in this order: EM4 EM12 EM5 EM13 Populate these slots fourth, in this order: EM6 EM14 EM7 EM15 System With Two Processor Modules Populate these slots first, in this order: EM0 EM8 EM4 EM12 Populate these slots second, in this order: EM1 EM9 EM5 EM13 Populate these slots third, in this order: EM2 EM10 EM6 EM14 Populate these slots fourth, in this order: EM3 EM11 EM7 EM15162 SPARC T3-4 Server Service Manual • August 2011 ¦ “FRU Paths For Systems With One Running Processor Module” on page 162 ¦ “FRU Paths For Systems With Two Running Processor Modules” on page 163 ¦ “FRU Paths For Systems With One Failed Processor Module” on page 165 FRU Paths For Systems With One Running Processor Module The following figure shows the express module topology for a server with one running processor module installed, where the running processor module is installed in processor module slot 0 and a filler panel is installed in processor module slot 1.Servicing Express Modules 163 In this scenario, the FRU path for express module slot 7 (EM7) will follow this path, starting from the processor module: 1. Processor 0 in processor module 0, to 2. PCIe switch 0, to 3. Express module slot 7 (EM7) In this scenario, the full FRU path for EM7 would be this: /pci@400/pci@1/pci@0/pci@6 As a second example, the FRU path for express module slot 8 (EM8) will follow this path, starting from the processor module: 1. Processor 1 in processor module 0, to 2. PCIe switch 1, to 3. Express module slot 8 (EM8) In this scenario, the full FRU path for EM8 would be this: /pci@500/pci@1/pci@0/pci@1 Related Information ¦ “FRU Paths For Systems With Two Running Processor Modules” on page 163 ¦ “FRU Paths For Systems With One Failed Processor Module” on page 165 FRU Paths For Systems With Two Running Processor Modules The following figure shows the express module topology for a server with two running processor modules installed.164 SPARC T3-4 Server Service Manual • August 2011 In this scenario, the FRU path for express module slot 7 (EM7) will follow this path, starting from the processor module: 1. Processor 2 in processor module 1, to 2. PCIe switch 0, to 3. Express module slot 7 (EM7) In this scenario, the full FRU path for EM7 would be this: /pci@600/pci@2/pci@0/pci@0 Note that the final pci@ path in the full FRU path would change from pci@6 in a single-processor module scenario to pci@0 for a dual-processor module scenario (see “FRU Paths For Systems With One Running Processor Module” on page 162 for the full FRU path for EM7 in a single-processor module scenario). Express module slot 7Servicing Express Modules 165 is the only express module slot where the final pci@ path in the full FRU path would change between a single-processor module scenario and a dual-processor module scenario. As a second example, the FRU path for express module slot 8 (EM8) will follow this path, starting from the processor module: 1. Processor 1 in processor module 0, to 2. PCIe switch 1, to 3. Express module slot 8 (EM8) In this scenario, the full FRU path for EM8 would be this: /pci@500/pci@1/pci@0/pci@1 Related Information ¦ “FRU Paths For Systems With One Running Processor Module” on page 162 ¦ “FRU Paths For Systems With One Failed Processor Module” on page 165 FRU Paths For Systems With One Failed Processor Module The following figure shows the express module topology for a server with two processor modules installed, but one of the processor modules has failed (in this case, processor module 0). Note that in this scenario, all of the paths to the express module slots that would have come from processor module 0 have been rerouted to processor module 1.166 SPARC T3-4 Server Service Manual • August 2011 In this scenario, the FRU path for express module slot 7 (EM7) will follow this path, starting from the processor module: 1. Processor 2 in processor module 1, to 2. PCIe switch 0, to 3. Express module slot 7 (EM7) In this scenario, the full FRU path for EM7 would be this: /pci@600/pci@2/pci@0/pci@6 As a second example, the FRU path for express module slot 8 (EM8) will follow this path, starting from the processor module: 1. Processor 3 in processor module 1, toServicing Express Modules 167 2. PCIe switch 1, to 3. Express module slot 8 (EM8) In this scenario, the full FRU path for EM8 would be this: /pci@700/pci@2/pci@0/pci@1 Related Information ¦ “FRU Paths For Systems With One Running Processor Module” on page 162 ¦ “FRU Paths For Systems With Two Running Processor Modules” on page 163 ? Locate a Faulty Express Module The following LEDs are lit when an express module fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ System EM Fault LED on the front panel ¦ Service Required LED on the faulty express module 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. Determine if the System EM Fault LED is lit on the front panel. See “Front Panel System Controls and LEDs” on page 16. 3. From the rear of the server, check the express module LEDs to identify which express module needs to be replaced. The amber Service Required LED will be lit on the express module that needs to be replaced. 4. Remove the faulty express module. See “Remove an Express Module” on page 168. Related Information ¦ “Express Module Configuration Reference” on page 159 ¦ “Remove an Express Module” on page 168 ¦ “Install an Express Module” on page 170 ¦ “Verify Express Module Functionality” on page 172168 SPARC T3-4 Server Service Manual • August 2011 ? Remove an Express Module The express module is a hot-service component that can be replaced by a customer. 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Locate the express module at the rear of the server that you want to remove. ¦ See “Rear Components” on page 6 for the locations of the express modules in the server. ¦ See “Locate a Faulty Express Module” on page 167 to locate a faulty express module. 3. Determine if you are removing an express module from a running system. ¦ If you are removing an express module from a system that is running (if you are hot-swapping the express module), go to Step 4. ¦ If you are removing an express module from a powered-down system, go to Step 5. 4. Determine if the express module has an Attention button. If the express module has an Attention button, you can use that button to hot-swap the card from the server. If not, you can use the command line interface to hot-swap the express module. ¦ If the express module has an Attention button, press the button to bring the express module offline. The express module’s Power OK LED should go off, indicating that the module is ready to be removed. Go to Step 5. ¦ If the express module does not have an Attention button, bring the module offline using the command line interface: a. At the Oracle Solaris prompt, type the cfgadm -al command to list all devices in the device tree, including express modules: This command lists dynamically reconfigurable hardware resources and shows their operational status. In this case, look for the status of the drive you plan to remove. This information is listed in the Occupant column. # cfgadm -alServicing Express Modules 169 Example: b. Disconnect the express module using the cfgadm -c disconnect command. Example: Replace Ap_id with the ID of the express module that you want to remove. c. Verify that the express module’s blue Ready-to-Remove LED is lit. 5. Disconnect any cables connected to the card. Tip – Label the cables to ensure proper connection to the replacement card. 6. Pull the express module handle down to disengage the card from the card cage. 7. Remove the express module from the server. Related Information ¦ “Express Module Configuration Reference” on page 159 ¦ “Locate a Faulty Express Module” on page 167 ¦ “Install an Express Module” on page 170 Ap_id Type Receptacle Occupant Condition PCI-EM0 sas/hp connected configured ok PCI-EM1 sas/hp connected configured ok ... # cfgadm -c disconnect Ap_id170 SPARC T3-4 Server Service Manual • August 2011 ¦ “Verify Express Module Functionality” on page 172 ? Install an Express Module Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Insert the express module into the empty express module slot. 3. Close the express module latch to lock the card in place. 4. Reconnect the cables to the express module, if necessary.Servicing Express Modules 171 5. Determine if you replaced or installed an express module in a running system. ¦ If you replaced or installed an express module in a system that is running (if you hot-swapped the express module), go to Step 6. ¦ If you replaced or installed an express module in a powered-down system, power on the system using the instructions provided in “Returning the Server to Operation” on page 215, then go to Step 7. 6. Determine if the express module has an Attention button. If the express module has an Attention button, you can use that button to bring the express card online. If not, you can use the command line interface to bring the express module online. ¦ If the express module has an Attention button, press the button to bring the express module online. The express module’s Power OK LED should go on, indicating that the module is now online. Go to Step 7. ¦ If the express module does not have an Attention button, bring the module online using the command line interface: a. At the Oracle Solaris prompt, type the cfgadm -al command to list all devices in the device tree, including the express modules: This command helps you identify the express module you installed. For example: b. Connect the express module using the cfgadm -c connect command. Example: Replace Ap_id with the ID of the express module that you want to connect. c. Verify that the blue Ready-to-Remove LED is no longer lit on the express module that you installed. d. At the Oracle Solaris prompt, type the cfgadm -al command to list all drives in the device tree: # cfgadm -al Ap_id Type Receptacle Occupant Condition PCI-EM0 sas/hp connected configured ok PCI-EM1 unknown empty unconfigured unknown ... # cfgadm -c connect Ap_id # cfgadm -al172 SPARC T3-4 Server Service Manual • August 2011 The replacement express module is now listed as connected. For example: 7. Verify the express module functionality. See “Verify Express Module Functionality” on page 172. Related Information ¦ “Express Module Configuration Reference” on page 159 ¦ “Locate a Faulty Express Module” on page 167 ¦ “Remove an Express Module” on page 168 ¦ “Verify Express Module Functionality” on page 172 ? Verify Express Module Functionality 1. Verify that the Fault LED is not lit on the express module. 2. Verify that the System Service Required LEDs on the front panel and rear I/O module are not lit. See “Interpreting Diagnostic LEDs” on page 16. 3. Verify that the System EM Fault LED on the front panel is not lit. See “Front Panel System Controls and LEDs” on page 16. 4. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If the previous steps indicate that no faults have been detected, then the express module has been replaced successfully. No further action is required. Related Information ¦ “Express Module Configuration Reference” on page 159 ¦ “Locate a Faulty Express Module” on page 167 ¦ “Remove an Express Module” on page 168 ¦ “Install an Express Module” on page 170 Ap_id Type Receptacle Occupant Condition PCI-EM0 sas/hp connected configured ok PCI-EM1 sas/hp connected configured ok ...Servicing Express Modules 173174 SPARC T3-4 Server Service Manual • August 2011175 Servicing the Rear I/O Module These topics describe service procedures for the rear I/O module in the server. ¦ “Rear I/O Module LEDs” on page 175 ¦ “Locate a Faulty Rear I/O Module” on page 178 ¦ “Remove the Rear I/O Module” on page 178 ¦ “Install the Rear I/O Module” on page 179 ¦ “Verify Rear I/O Module Functionality” on page 181 Rear I/O Module LEDs The rear I/O module has several LEDs, some of which give system status information, while others provide link information on the NET and QSFP ports. FIGURE: Rear I/O Module LEDs176 SPARC T3-4 Server Service Manual • August 2011 TABLE: Rear Panel Controls and LEDs No. LED Icon Description 1 System Locator LED and button (white) The Locator LED can be turned on to identify a particular system. When on, it blinks rabidly. There are two methods for turning a Locator LED on: • Issuing the ILOM command set /SYS/LOCATE value=Fast_Blink • Pressing the Locator button 2 System Service Required LED (amber) Indicates that service is required. POST and ILOM are two diagnostic tools that can detect a fault or failure resulting in this indication. The ILOM show faulty command provides details about any faults that cause this indicator to light. The System Service Required LED will also light on the rear I/O module if the rear I/O module has failed. 3 System Power OK LED (green) Indicates the following conditions: • Off – System is not running in its normal state. System power might be off. The service processor might be running. • Steady on – System is powered on and is running in its normal operating state. No service actions are required. • Fast blink – System is running in standby mode and can be quickly returned to full function. • Slow blink – A normal but transitory activity is taking place. Slow blinking might indicate that system diagnostics are running or the system is booting. 4 Service Processor LED SP Indicates the following conditions: • Off – Indicates the AC power might have been connected to the power supplies. • Steady on, green – Service processor is running in its normal operating state. No service actions are required. • Blink, green – Service processor is initializing the ILOM firmware. • Steady on, amber – A service processor error has occurred and service is required.Servicing the Rear I/O Module 177 Related Information ¦ “Locate a Faulty Rear I/O Module” on page 178 ¦ “Remove the Rear I/O Module” on page 178 ¦ “Install the Rear I/O Module” on page 179 ¦ “Verify Rear I/O Module Functionality” on page 181 5 System Overtemp LED (amber) Provides the following operational temperature indications: • Off – Indicates a steady state, no service action is required. • Steady on – Indicates that a temperature failure event has been acknowledged and a service action is required. 6 Net Management Link and Activity (green) Indicates the following conditions: • On or blinking – A link is established. • Off – No link is established. 7 Net Management Speed (green) Indicates the following conditions: • On or blinking – The link is operating as a 100-Mbps connection. • Off – The link is operating as a 10-Mbps connection. 8 NET Link and Activity (green) Indicates the following conditions: • Blinking – A link is established. • Off – No link is established. 9 NET Speed (amber/green) Indicates the following conditions: • Green on – The link is operating as a Gigabit connection (1000 Mbps). • Amber on – The link is operating as a 100-Mbps connection. • Off – The link is operating as a 10-Mbps connection or there is no link. 10 QSFP Link and Activity (green) Indicates the following conditions: • Blinking – A link is established. • Off – No link is established. TABLE: Rear Panel Controls and LEDs (Continued) No. LED Icon Description178 SPARC T3-4 Server Service Manual • August 2011 ? Locate a Faulty Rear I/O Module The System Service Required LED on the rear I/O module will light when a rear I/O module fault is detected. 1. Determine if the System Service Required LED is lit on the rear I/O module. See “Rear I/O Module LEDs” on page 175. 2. Remove the faulty rear I/O module. See “Remove the Rear I/O Module” on page 178. Related Information ¦ “Rear I/O Module LEDs” on page 175 ¦ “Remove the Rear I/O Module” on page 178 ¦ “Install the Rear I/O Module” on page 179 ¦ “Verify Rear I/O Module Functionality” on page 181 ? Remove the Rear I/O Module The rear I/O module is a cold-service component that can be replaced by a customer. 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Locate the failed rear I/O module. ¦ See “Rear Components” on page 6 for the location of the rear I/O module in the server. ¦ See “Locate a Faulty Rear I/O Module” on page 178 to verify that the rear I/O module has failed. 3. Power off the server. See “Removing Power From the System” on page 66. 4. Label the cables connected to the ports on the rear I/O module, then disconnect the cables from the ports. You will reconnect the cables to the same ports on the replacement rear I/O module.Servicing the Rear I/O Module 179 5. Press the green button on the rear I/O module ejection lever and lower the lever slightly. 6. Lower the lever completely to unseat the rear I/O module, and then pull the module away from the server to remove it. Related Information ¦ “Rear I/O Module LEDs” on page 175 ¦ “Locate a Faulty Rear I/O Module” on page 178 ¦ “Install the Rear I/O Module” on page 179 ¦ “Verify Rear I/O Module Functionality” on page 181 ? Install the Rear I/O Module 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. With the lever in the lowered position, insert the rear I/O module into the slot at the rear of the server.180 SPARC T3-4 Server Service Manual • August 2011 3. Raise the extraction lever up until it clicks into place, fully seating the rear I/O module into the server. 4. Connect the cables to the appropriate ports on the rear I/O module. 5. Power on the server. See “Returning the Server to Operation” on page 215. 6. Verify the rear I/O module functionality. See “Verify Rear I/O Module Functionality” on page 181. Related Information ¦ “Rear I/O Module LEDs” on page 175 ¦ “Locate a Faulty Rear I/O Module” on page 178 ¦ “Remove the Rear I/O Module” on page 178 ¦ “Verify Rear I/O Module Functionality” on page 181Servicing the Rear I/O Module 181 ? Verify Rear I/O Module Functionality 1. Verify that the System Service Required LED on the rear I/O module is not lit. See “Rear I/O Module LEDs” on page 175. 2. Perform one of the following tasks based on your verification results. ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If Step 1 indicated that no faults have been detected, then the rear I/O module has been replaced successfully. No further action is required. Related Information ¦ “Rear I/O Module LEDs” on page 175 ¦ “Locate a Faulty Rear I/O Module” on page 178 ¦ “Remove the Rear I/O Module” on page 178 ¦ “Install the Rear I/O Module” on page 179182 SPARC T3-4 Server Service Manual • August 2011183 Servicing the System Configuration PROM These topics describe service procedures for the system configuration PROM in the server. ¦ “System Configuration PROM Overview” on page 183 ¦ “Remove the System Configuration PROM” on page 183 ¦ “Install the System Configuration PROM” on page 185 System Configuration PROM Overview The System Configuration PROM stores the host ID and MAC address. If you have to replace the motherboard, be sure to move the System Configuration PROM from the old motherboard to the new motherboard. This step will ensure that the server will retain its original host ID and MAC address. Related Information ¦ “Remove the System Configuration PROM” on page 183 ¦ “Install the System Configuration PROM” on page 185 ? Remove the System Configuration PROM The system configuration PROM is a cold-service component that can be replaced only by authorized service personnel.184 SPARC T3-4 Server Service Manual • August 2011 Before beginning this procedure, ensure that you are familiar with the cautions and safety instructions described in “Safety Information” on page 59. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Note – The System Configuration PROM is plugged into a socket on the motherboard. It includes a yellow barcode label. 1. Remove the main module from the server. See “Remove the Main Module” on page 70. 2. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 3. Locate the system configuration PROM on the main module. See “Main Module Components” on page 3. 4. Grasp the system configuration PROM and lift it up to remove it from the main module.Servicing the System Configuration PROM 185 Related Information ¦ “System Configuration PROM Overview” on page 183 ¦ “Install the System Configuration PROM” on page 185 ? Install the System Configuration PROM Before beginning this procedure, ensure that you are familiar with the cautions and safety instructions described in “Safety Information” on page 59. Caution – This procedure involves handling circuit boards that are extremely sensitive to static electricity. Ensure that you follow ESD preventative practices to avoid damaging the circuit boards. Note – The System Configuration PROM is plugged into a socket on the motherboard. It includes a yellow barcode label. 1. Orient the system configuration PROM properly onto the main module.186 SPARC T3-4 Server Service Manual • August 2011 2. Press down on the system configuration PROM until it is completely seated on the main module. 3. Insert the main module back into the server. See “Install the Main Module” on page 72. 4. Verify that the banner display includes an Ethernet address, and Host ID value. The Ethernet address and Host ID values are read from the System Configuration PROM. Their presence in the banner verifies that the service processor and the host can read the System Configuration PROM. 5. For additional verification, run specific commands to display data stored in the System Configuration PROM. ¦ Use the Oracle ILOM show command to display the MAC address: ¦ Use Oracle Solaris OS commands to display the hostid and Ethernet address: . . . SPARC T3-4, No Keyboard . OpenBoot X.XX, 16256 MB memory available, Serial #87304604.Ethernet address *:**:**:**:**:**, Host ID: ******** . . . -> show /HOST macaddress /HOST Properties: macaddress = **:**:**:**:**:** # hostid 8534299c # ifconfig -a lo0: flags=2001000849 mtu 8232 index 1 inet 127.0.0.1 netmask ff000000 igb0: flags=201004843 mtu 1500 index 2 inet 10.6.88.150 netmask fffffe00 broadcast 10.6.89.255 ether *:**:**:**:**:**Servicing the System Configuration PROM 187 Related Information ¦ “System Configuration PROM Overview” on page 183 ¦ “Remove the System Configuration PROM” on page 183188 SPARC T3-4 Server Service Manual • August 2011189 Servicing the Front I/O Assembly These topics describe service procedures for the front I/O assembly in the server. ¦ “Front I/O Assembly Overview” on page 189 ¦ “Remove the Front I/O Assembly” on page 189 ¦ “Install the Front I/O Assembly” on page 192 Front I/O Assembly Overview The front I/O assembly consists of the following components: ¦ Two circuit boards (FIO and VGA boards) ¦ Two cables connecting the FIO and VGA circuit boards to the motherboard Related Information ¦ “Remove the Front I/O Assembly” on page 189 ¦ “Install the Front I/O Assembly” on page 192 ? Remove the Front I/O Assembly The front I/O assembly is a cold-service component that can be replaced only by authorized service personnel. Caution – This procedure requires that you handle components that are sensitive to electrostatic discharge. This discharge can cause server components to fail.190 SPARC T3-4 Server Service Manual • August 2011 1. Remove the main module from the server. See “Remove the Main Module” on page 70. 2. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 3. Locate the front I/O assembly on the main module. See “Main Module Components” on page 3. 4. Locate the two cables that connect the front I/O assembly to the motherboard. FIGURE: Locating the Two Front I/O Cable Assembly Cables 5. Disconnect the two cables. a. Lift up on the connectors that secure the VGA-to-motherboard cable to the front I/O assembly and the motherboard, and remove the VGA-to-motherboard cable from the main module. Figure Legend 1 VGA-to-motherboard cable, motherboard connection 2 FIO-to-motherboard cable, motherboard connection 3 FIO-to-motherboard cable, front I/O assembly connection 4 VGA-to-motherboard cable, front I/O assembly connectionServicing the Front I/O Assembly 191 b. Lift up on the connectors that secure the FIO-to-motherboard cable to the front I/O assembly and the motherboard, and remove the FIO-to-motherboard cable from the main module. 6. Loosen the captive screw that secures the front I/O assembly to the motherboard.192 SPARC T3-4 Server Service Manual • August 2011 7. Gently pull the front I/O assembly toward the back of the main module until the ports at the front of the assembly clear the front of the main module, and then remove the front I/O assembly from the main module. Related Information ¦ “Front I/O Assembly Overview” on page 189 ¦ “Install the Front I/O Assembly” on page 192 ? Install the Front I/O Assembly Caution – This procedure requires that you handle components that are sensitive to static discharge. Static discharges can cause the components to fail. 1. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 2. Insert the front I/O assembly into position in the main module. ¦ Gently slide the front I/O assembly into position with the ports inserted into the port holes in the front of the main module. ¦ Lower the rear of the front I/O assembly so that the captive screw is aligned with the screw hole on the motherboard.Servicing the Front I/O Assembly 193 3. Tighten the captive screw to secure the front I/O assembly to the motherboard. 4. Connect the two cables. a. Lower into place the connectors that secure the FIO-to-motherboard cable to the front I/O assembly and the motherboard and press down on both connectors to connect the FIO-to-motherboard cable. b. Lower into place the connectors that secure the VGA-to-motherboard cable to the front I/O assembly and the motherboard and press down on both connectors to connect the VGA-to-motherboard cable. 5. Install the main module back into the server. See “Install the Main Module” on page 72. Related Information ¦ “Front I/O Assembly Overview” on page 189 ¦ “Remove the Front I/O Assembly” on page 189194 SPARC T3-4 Server Service Manual • August 2011195 Servicing the Storage Backplane These topics describe service procedures for the storage backplane in the server. ¦ “Remove a Storage Backplane” on page 195 ¦ “Install a Storage Backplane” on page 199 ? Remove a Storage Backplane A storage backplane is a cold-service component that can be replaced only by authorized service personnel. 1. Power off the system. See “Removing Power From the System” on page 66. 2. Remove all the hard drives from the front of the server for the storage backplane that you want to replace. You have to remove only hard drives 0–3 or drives 4–7, depending on which storage backplane you want to replace. Also, note the locations of the drives before removing them so that you can install them in their original slots afterwards. See “Remove a Hard Drive” on page 117. 3. Remove the main module from the server. See “Remove the Main Module” on page 70. 4. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 5. Locate the storage backplane that you want to remove.196 SPARC T3-4 Server Service Manual • August 2011 FIGURE: Locating the Storage Backplanes 6. Disconnect the two storage backplane cables from the storage backplane that you want to replace. a. Lift up on the connectors that secure the data cable to the storage backplane and the motherboard, and remove the data cable from the main module. b. Lift up on the connectors that secure the power cable to the storage backplane and the motherboard, and remove the power cable from the main module. Figure Legend 1 Storage backplane for drives 4–7 (SAS_BP1) 2 Storage backplane for drives 0–3 (SAS_BP0)Servicing the Storage Backplane 197 FIGURE: Disconnecting the Storage Backplane Cables 7. Lift up on the plastic retaining panel for the storage backplane that you want to remove to disengage the plastic panel from the top of the hard drive assembly. Figure Legend 1 Data cable, storage backplane connection 2 Power cable, storage backplane connection198 SPARC T3-4 Server Service Manual • August 2011 8. Push the plastic panel toward the rear of the main module, and remove the plastic panel from the main module. 9. Push the top edge of the storage backplane slightly toward the rear of the main module, then lift the storage backplane up and remove it from the main module.Servicing the Storage Backplane 199 Related Information ¦ “Install a Storage Backplane” on page 199 ? Install a Storage Backplane 1. Position the storage backplane in the main module. 2. Lower the storage backplane into place.200 SPARC T3-4 Server Service Manual • August 2011 3. Slide the plastic retaining panel into place over the storage backplane so that the two notches in the panel slide underneath the two metal mounting studs on the hard drive assembly.Servicing the Storage Backplane 201 4. Press on the press point on the retaining panel to secure it to the top of the hard drive assembly. 5. Connect the two storage backplane cables to the storage backplane and the motherboard. a. Connect the data cable to the storage backplane and the motherboard. b. Connect the power cable to the storage backplane and the motherboard. FIGURE: Connecting the Storage Backplane Cables 6. Insert the main module back into the server. See “Install the Main Module” on page 72. 7. Install the hard drives that you removed back into the main module. Refer to the notes that you took when removing the hard drives to install them back into their original slots. See “Install a Hard Drive” on page 120. Figure Legend 1 Data cable, storage backplane connection 2 Power cable, storage backplane connection202 SPARC T3-4 Server Service Manual • August 2011 8. Power on the system. See “Returning the Server to Operation” on page 215. Related Information ¦ “Remove a Storage Backplane” on page 195203 Servicing the Main Module Motherboard These topics describe service procedures for the main module motherboard in the server. ¦ “Main Module Motherboard Overview” on page 203 ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Install the Main Module Motherboard” on page 207 ¦ “Verify Main Module Motherboard Functionality” on page 209 Main Module Motherboard Overview When replacing the main module motherboard, remove the service processor and System Configuration PROM from the old motherboard and install these components on the new motherboard. The service processor contains the Oracle ILOM system configuration data and the System Configuration PROM contains the system host ID and MAC address. Transferring these components will preserve the system-specific information stored on these modules. System firmware consists of two components: a service processor component and a host component. The service processor component is located on the service processor and the host component is located on the motherboard. In order for the system to operate correctly, these two components must be compatible. After replacing the motherboard, the host firmware on the motherboard might be incompatible with the service processor firmware on the service processor that you transferred to the new motherboard. In this case, the system firmware must be loaded as described in “Install the Main Module Motherboard” on page 207.204 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Install the Main Module Motherboard” on page 207 ¦ “Verify Main Module Motherboard Functionality” on page 209 Main Module Motherboard LEDs No. LED Icon Description 1 OK (green) Indicates if the main module is available for use. • On – The server is running and the main module is powered up. • Off – The server is powered down and the main module is in standby mode. 2 Service Required (amber) Indicates that the main module motherboard has experienced a fault condition.Servicing the Main Module Motherboard 205 Related Information ¦ “Main Module Motherboard Overview” on page 203 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Install the Main Module Motherboard” on page 207 ¦ “Verify Main Module Motherboard Functionality” on page 209 ? Locate a Faulty Main Module Motherboard The following LEDs are lit when a main module motherboard fault is detected: ¦ System Service Required LEDs on the front panel and rear I/O module ¦ Service Required LED on the main module 1. Determine if the System Service Required LEDs are lit on the front panel or the rear I/O module. See “Interpreting Diagnostic LEDs” on page 16. 2. From the front of the server, check the main module LEDs to determine if the main module motherboard needs to be replaced. See “Main Module Motherboard LEDs” on page 204. The amber Service Required LED will be lit on the main module if the main module motherboard needs to be replaced. 3 Service Processor LED SP Indicates the following conditions: • Off – Indicates the AC power might have been connected to the power supplies. • Steady on, green – Service processor is running in its normal operating state. No service actions are required. • Blink, green – Service processor is initializing the ILOM firmware. • Steady on, amber – A service processor error has occurred and service is required. No. LED Icon Description206 SPARC T3-4 Server Service Manual • August 2011 3. Remove the main module and replace the main module motherboard. See “Remove the Main Module Motherboard” on page 206. Related Information ¦ “Main Module Motherboard Overview” on page 203 ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Install the Main Module Motherboard” on page 207 ¦ “Verify Main Module Motherboard Functionality” on page 209 ? Remove the Main Module Motherboard The main module motherboard is a cold-service component that can be replaced only by authorized service personnel. 1. Remove the main module from the server. See “Remove the Main Module” on page 70. 2. Make a note of the locations of the components in the main module before removing any of them. The system software keeps track of the location of some components, such as the hard drives and RAID expansion modules, so you might have to reinstall the software on some components if they are moved to different locations in the main module. Make a note of the location of the components in the main module and install these components in the same locations in the new main module so that you do not have to reinstall software on any of these components. 3. Take the necessary ESD precautions. See “Prevent ESD Damage” on page 69. 4. Remove the following components from the main module: ¦ “Remove a Hard Drive” on page 117 ¦ “Remove the RAID Expansion Module” on page 135 ¦ “Remove the Service Processor” on page 140 ¦ “Remove the System Battery” on page 145 ¦ “Remove the Front I/O Assembly” on page 189 ¦ “Remove a Storage Backplane” on page 195Servicing the Main Module Motherboard 207 5. Remove the system configuration PROM from the faulty motherboard. See “Remove the System Configuration PROM” on page 183. Put the system configuration PROM aside to install it on the replacement motherboard. 6. Install the replacement motherboard in the server. See “Install the Main Module Motherboard” on page 207. Related Information ¦ “Main Module Motherboard Overview” on page 203 ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Install the Main Module Motherboard” on page 207 ¦ “Verify Main Module Motherboard Functionality” on page 209 ? Install the Main Module Motherboard 1. Install the system configuration PROM from the old motherboard onto the replacement motherboard. See “Install the System Configuration PROM” on page 185. 2. Replace these components on the main module: ¦ “Install a Storage Backplane” on page 199 ¦ “Install the Front I/O Assembly” on page 192 ¦ “Install the System Battery” on page 146 ¦ “Install the Service Processor” on page 142 ¦ “Install the RAID Expansion Module” on page 136 ¦ “Install a Hard Drive” on page 120 Install the components in the same slots that you removed them from in the old main module to keep from having to reinstall software on these components. 3. Insert the main module back into the server. See “Install the Main Module” on page 72.208 SPARC T3-4 Server Service Manual • August 2011 4. Connect a terminal or a terminal emulator (PC or workstation) to serial management port. If the service processor detects that the new host firmware component is incompatible with service processor firmware domponent, further action will be suspended and the following message will be delivered over the serial management port. If you see this message, go on to Step 5. 5. Download the system firmware. a. If needed, configure the service processor’s network port to enable the firmware image to be downloaded. Refer to the Oracle ILOM documentation for network configuration instructions. b. Download the system firmware. Follow the firmware download instructions in the Oracle ILOM documentation. Note – You can load any supported system firmware version, including the firmware revision that had been installed prior to the replacement of the motherboard. 6. Verify the main module motherboard. See “Verify Main Module Motherboard Functionality” on page 209. Related Information ¦ “Main Module Motherboard Overview” on page 203 ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Verify Main Module Motherboard Functionality” on page 209 Unrecognized Chassis: This module is installed in an unknown or unsupported chassis. You must upgrade the firmware to a newer version that supports this chassis.Servicing the Main Module Motherboard 209 ? Verify Main Module Motherboard Functionality 1. Verify that the OK LED is lit on the main module and that the Fault LED is not lit. See “Main Module Motherboard LEDs” on page 204. 2. Verify that the front and rear Service Required LEDs are not lit. See “Interpreting Diagnostic LEDs” on page 16. 3. Perform one of the following tasks based on your verification results: ¦ If the previous steps did not clear the fault, see “Diagnostics Process” on page 12. ¦ If the previous steps indicate that no faults have been detected, then the main module motherboard has been replaced successfully. No further action is required. Related Information ¦ “Main Module Motherboard Overview” on page 203 ¦ “Main Module Motherboard LEDs” on page 204 ¦ “Locate a Faulty Main Module Motherboard” on page 205 ¦ “Remove the Main Module Motherboard” on page 206 ¦ “Install the Main Module Motherboard” on page 207210 SPARC T3-4 Server Service Manual • August 2011211 Servicing the Rear Chassis Subassembly These topics describe service procedures for the rear chassis subassembly in the server. ¦ “Rear Chassis Subassembly Overview” on page 211 ¦ “Remove the Rear Chassis Subassembly” on page 211 ¦ “Install the Rear Chassis Subassembly” on page 213 Rear Chassis Subassembly Overview The rear chassis subassembly is a single FRU that contains the following components: ¦ Midplane ¦ Express backplane ¦ Power distribution board ¦ AC and DC bus bars Related Information ¦ “Remove the Rear Chassis Subassembly” on page 211 ¦ “Install the Rear Chassis Subassembly” on page 213 ? Remove the Rear Chassis Subassembly The rear chassis assembly is a cold-service component that can be replaced only by authorized service personnel.212 SPARC T3-4 Server Service Manual • August 2011 1. Verify that the rear chassis subassembly needs to be replaced. Use the server software to determine if the rear chassis subassembly needs to be replaced. See “Detecting and Managing Faults” on page 11 for more information. 2. Power down the server. See “Removing Power From the System” on page 66. 3. Go to the rear of the server and remove the following components from the rear chassis subassembly: ¦ All five fans—see “Remove a Fan Module” on page 154. ¦ All express modules or filler panels—see “Remove an Express Module” on page 168. Make note of the slots for each express module or filler panel so that you can install them into the same slots in the replacement rear chassis subassembly. ¦ Rear I/O module—see “Remove the Rear I/O Module” on page 178. You will install these components into the replacement rear chassis subassembly once you have replaced the faulty subassembly. 4. Locate the four green mounting screws for the rear chassis subassembly.Servicing the Rear Chassis Subassembly 213 5. Using a Phillips screwdriver, loosen the four screws that secure the rear chassis subassembly to the system. 6. Slide the rear chassis subassembly out and away from the server. Related Information ¦ “Rear Chassis Subassembly Overview” on page 211 ¦ “Install the Rear Chassis Subassembly” on page 213 ? Install the Rear Chassis Subassembly 1. Slide the rear chassis subassembly into the server. 2. Using a Phillips screwdriver, tighten the four green screws to secure the rear chassis subassembly in the server. 3. Install the following components back into the rear of the server: ¦ All five fans—see “Install a Fan Module” on page 156.214 SPARC T3-4 Server Service Manual • August 2011 ¦ All express modules or filler panels—see “Install an Express Module” on page 170. Verify that you are installing the express modules back in their original slots using the notes that you took when removing the cards from the slots earlier. ¦ Rear I/O module—see “Install the Rear I/O Module” on page 179. 4. Power on the server. See “Returning the Server to Operation” on page 215. Related Information ¦ “Rear Chassis Subassembly Overview” on page 211 ¦ “Remove the Rear Chassis Subassembly” on page 211215 Returning the Server to Operation These topics explain how to return the SPARC T3-4 server from Oracle to operation after you have performed service procedures. ¦ “Connect Power Cords to the Server” on page 215 ¦ “Power On the Server (start /SYS Command)” on page 215 ¦ “Power On the Server (Power Button)” on page 216 ? Connect Power Cords to the Server ? Reconnect the power cords to the power supplies. Note – As soon as the power cords are connected, standby power is applied. Depending on how the firmware is configured, the system might boot at this time. Related Information ¦ “Power On the Server (start /SYS Command)” on page 215 ¦ “Power On the Server (Power Button)” on page 216 ? Power On the Server (start /SYS Command) ? Type start /SYS at the service processor prompt. -> start /SYS216 SPARC T3-4 Server Service Manual • August 2011 Related Information ¦ “Power On the Server (Power Button)” on page 216 ? Power On the Server (Power Button) ? Momentarily press and release the Power button on the front panel. See “Front Panel System Controls and LEDs” on page 16 for the location of the Power button. Related Information ¦ “Power On the Server (start /SYS Command)” on page 215217 Index A AC power connectors con?guration reference, 124 LEDs, 126 locating, 6 accessing the service processor, 25 accounts, ILOM, 25 air?ow, blocked, 15 ALOM CMT compatibility shell ASR asrkeys (system components), 54 blacklist, 54 automatic system recovery, see ASR B blacklist, ASR, 54 C chassis serial number, locating, 61 clear_fault_action property, 30 clearing faults POST-detected faults, 50 PSH-detected faults, 42 cold service components replacement by authorized service personnel, 66 replacement by customer, 65 components accessible from front, 2 accessible from rear, 6 disabled automatically by POST, 54 displaying using showcomponent command, 54 within main module, 3 within processor module, 4 within rear chassis subassembly, 7 con?guration reference AC power connectors, 124 DIMMs, 93 express modules, 159 fan modules, 152 hard drives, 114 power supplies, 124 processor modules, 77 con?guring how POST runs, 46 console command, 108 customer-replaceable units cold-service components, 65 hot-service components, 64 D default ILOM password, 25 diag_level parameter, 45 diag_mode parameter, 45 diag_trigger parameter, 45 diag_verbosity parameter, 45 diagnostics low-level, 44 running remotely, 23 DIMMs con?guration reference, 93 FRU name, 63 increasing system memory, 107 installing, 105 locating, 4 locating faulty using DIMM Fault Remind button, 102 using show faulty command, 103 removing, 103 troubleshooting, 92 verifying functionality, 109 displaying faults, 28 FRU information, 27218 SPARC T3-4 Server Service Manual • August 2011 dmesg command, 37 E electrostatic discharge, see ESD environmental faults, 14, 15, 28 ESD measures, 60 preventing using an antistatic mat, 60 preventing using an antistatic wrist strap, 60 express modules con?guration reference, 159 FRU name, 63 installing, 170 locating, 6 locating faulty, 167 removing, 168 verifying functionality, 172 F fan modules con?guration reference, 152 FRU name, 63 installing, 156 LEDs, 153 locating, 6 locating faulty, 154 overview, 151 removing, 154 verifying functionality, 157 fault messages (POST), interpreting, 49 faults clearing, 30 detecting by Oracle Solaris PSH, 14 by POST, 14 displaying, 28 environmental, 14, 15 forwarded to ILOM, 23 PSH-detected checking for, 40 fault example, 39 ?eld-replaceable units, see FRUs ?ller panels, 74 fmadm command, 42 fmdump command, 40 front components, 2 front I/O assembly FRU name, 63 installing, 192 locating, 3 overview, 189 removing, 189 front panel system controls and LEDs, 16 FRUs FRU ID PROMs, 24 information, displaying, 27 names, 63 quantities, 63 H hard drives con?guration reference, 114 FRU name, 63 hot-pluggable capabilities, 113 installing, 120 LEDs, 115 locating, 2, 3 locating faulty, 116 removing, 117 verifying functionality, 121 hot service components, replacement by customer, 64 hot-pluggable capabilities of hard drives, 113 I I/O subsystem, 44, 54 illustrated parts breakdown, 8 ILOM CLI web interface ILOM commands show faulty, 35 increasing system memory with additional DIMMs, 107 installing DIMMs, 105 express modules, 170 fan modules, 156 front I/O assembly, 192 hard drives, 120 main module, 72 main module motherboard, 207 power supplies, 130 processor modules, 85, 87Index 219 RAID expansion modules, 136 rear chassis subassembly, 213 rear I/O module, 179 service processor, 142 storage backplanes, 199 system battery, 146 system con?guration PROM, 185 L LEDs AC power connectors, 126 fan modules, 153 front panel, 16 hard drives, 115 main module motherboard, 204 NET Link and Activity, 19 Net Management Link and Activity, 19 Net Management Speed, 19 NET Speed, 19 Power OK (system LED), 14 power supplies, 126 processor modules, 78 QSFP Link and Activity, 19 Rear Express Module Fault, 16 Rear Fan Module Fault, 16 rear I/O module, 19, 175 Service Processor, 19 System Locator, 16, 19 System Overtemp, 16, 19 System Power OK, 16, 19 System Service Required, 16, 19 locating AC power connectors, 6 chassis serial number, 61 DIMMs, 4 express modules, 6 fan modules, 6 front I/O assembly, 3 hard drives, 2, 3 main module, 2 main module motherboard, 3 power supplies, 2 processor modules, 2 RAID expansion modules, 3 rear chassis subassembly, 7 rear I/O module, 6 server, 62 system con?guration PROM, 3 locating faulty DIMMs using Fault Remind button, 102 using show faulty command, 103 express modules, 167 fan modules, 154 hard drives, 116 main module motherboard, 205 power supplies, 127 processor modules, 81 service processor, 140 log ?les, viewing, 37 logging into ILOM, 25 M main module accessing internal components, 70 component locations, 3 installing, 72 locating, 2 removing, 70 main module motherboard FRU name, 63 installing, 207 LEDs, 204 locating, 3 locating faulty, 205 removing, 206 verifying functionality, 209 maximum testing with POST, 48 memory fault handling, 91 message buffer, checking the, 37 message identi?er, 40 messages, POST fault, 49 N NET Link and Activity LED, 19 Net Management Link and Activity LED, 19 Net Management Speed LED, 19 NET MGT port, 25 NET Speed LED, 19 network management port, see NET MGT port Normal mode (virtual keyswitch position), 109 O Oracle Solaris log ?les, 14220 SPARC T3-4 Server Service Manual • August 2011 Oracle Solaris OS checking log ?les for fault information, 14 ?les and commands, 36 Oracle Solaris Predictive Self-Healing, see Oracle Solaris PSH Oracle Solaris PSH checking for faults, 28, 40 clearing faults, 42 fault example, 39 faults detected by, 14 memory faults, 92 overview, 38 overview fan modules, 151 front I/O assembly, 189 power supplies, 123 rear chassis subassembly, 211 P password, default ILOM, 25 POST about, 44 clearing faults, 50 components disabled by, 54 con?guration examples, 46 con?guring, 46 detecting faults, 28 faults detected by, 14 interpreting POST fault messages, 49 running in Diag Mode, 48 troubleshooting with, 15 using for fault diagnosis, 14 power cords connecting to server, 215 Power OK (system LED), 14 power supplies con?guration reference, 124 FRU name, 63 installing, 130 LEDs, 126 locating, 2 locating faulty, 127 overview, 123 removing, 128 verifying functionality, 133 powering off server emergency shutdown, 68 gracefully with power button, 68 using service processor command, 67 powering on server using power button, 216 using start /SYS command, 215 power-on self-test, see POST processor modules component locations, 4 con?guration reference, 77 FRU name, 63 installing, 85, 87 LEDs, 78 locating, 2 locating faulty, 81 removing, 81 verifying functionality, 90 PSH Knowledge article web site, 40 Q QSFP Link and Activity LED, 19 R RAID expansion modules FRU name, 63 installing, 136 locating, 3 removing, 135 rear chassis subassembly installing, 213 locating, 7 overview, 211 removing, 211 rear components, 6 Rear Express Module Fault LED, 16 Rear Fan Module Fault LED, 16 rear I/O module FRU name, 63 installing, 179 LEDs, 19, 175 locating, 6 removing, 178 verifying functionality, 181 removing DIMMs, 103 express modules, 168 fan modules, 154 front I/O assembly, 189Index 221 hard drives, 117 main module, 70 main module motherboard, 206 power supplies, 128 processor modules, 81 RAID expansion modules, 135 rear chassis subassembly, 211 rear I/O module, 178 service processor, 140 storage backplanes, 195 system battery, 145 system con?guration PROM, 183 running POST in Diag Mode, 48 S safety information and symbols, 59 SER MGT port, 25 serial management port, see SER MGT port server connecting power cords, 215 locating, 62 powering off emergency shutdown, 68 gracefully with power button, 68 using service processor command, 67 powering on using power button, 216 using start /SYS command, 215 service processor accessing, 25 FRU name, 63 installing, 142 locating faulty, 140 removing, 140 verifying functionality, 144 Service Processor LED, 19 service processor prompt, 67 setkeyswitch parameter, 108 show command, 27 show faulty command, 28, 35, 42, 50 using to check for faults, 14 showcomponent command, 54 stop /SYS (ILOM command), 67 storage backplanes FRU name, 63 installing, 199 removing, 195 SunVTS checking if SunVTS is installed, 58 overview, 57 packages, 58 test types, 57 topics, 57 using for fault diagnosis, 14 system battery FRU name, 63 installing, 146 removing, 145 system components, see components system con?guration PROM FRU name, 63 installing, 185 locating, 3 removing, 183 system controls, front panel, 16 System Locator LED, 16, 19 system message log ?les, viewing, 37 System Overtemp LED, 16, 19 System Power button, 16 System Power OK LED, 16, 19 System Service Required LED, 16, 19 T tools needed for service, 61 troubleshooting AC OK LED state, 14 by checking Oracle Solaris OS log ?les, 14 DIMMs, 92 Power OK LED state, 14 using POST, 14, 15 using SunVTS, 14 using the show faulty command, 14 U UUID, 40 V /var/adm/messages ?le, 37 verifying functionality DIMMs, 109 express modules, 172 fan modules, 157 hard drives, 121222 SPARC T3-4 Server Service Manual • August 2011 main module motherboard, 209 power supplies, 133 processor modules, 90 rear I/O module, 181 service processor, 144 viewing system message log ?les, 37 virtual keyswitch, 108 SPARC T3-4 Server Safety and Compliance Guide Part No. 821-2113-10 December 2010, Revision APlease Recycle Copyright © 2010, Oracle and/or its af?liates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you ?nd any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its af?liates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its af?liates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its af?liates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its af?liates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services. Copyright © 2010, Oracle et/ou ses af?liés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modi?er, breveter, transmettre, distribuer, exposer, exécuter, publier ou af?cher le logiciel, même partiellement, sous quelque forme et par quelque procédé que ce soit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des ?ns d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modi?cation sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurs et vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-speci?c supplemental regulations. As such, the use, duplication, disclosure, modi?cation, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’est pas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses af?liés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses af?liés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédée sous licence par X/Open Company, Ltd. Ce logiciel ou matériel et la documentation qui l’accompagne peuvent fournir des informations ou des liens donnant accès à des contenus, des produits et des services émanant de tiers. Oracle Corporation et ses af?liés déclinent toute responsabilité ou garantie expresse quant aux contenus, produits ou services émanant de tiers. En aucun cas, Oracle Corporation et ses af?liés ne sauraient être tenus pour responsables des pertes subies, des coûts occasionnés ou des dommages causés par l’accès à des contenus, produits ou services tiers, ou à leur utilisation.iii Contents Declaration of Conformity v Regulatory Compliance Statements vii Safety Agency Compliance Statements xi Shielded Cables xxiiiiv SPARC T3-4 Server Safety and Compliance Guide • December 2010v Declaration of Conformity To receive a copy of the latest Declaration of Conformity (DoC) for the product, create an online request at(https://www2.sun.de/dct/forms/reg_us_1607_755_0.jsp), or send email to: compliance_request_ww@oracle.com.vi SPARC T3-4 Server Safety and Compliance Guide • December 2010vii Regulatory Compliance Statements Your Sun product is marked to indicate its compliance class: • Federal Communications Commission (FCC) — USA • Industry Canada Equipment Standard for Digital Equipment (ICES-003) — Canada • Voluntary Control Council for Interference (VCCI) — Japan • Bureau of Standards Metrology and Inspection (BSMI) — Taiwan • Certi?cation and Accreditation Administration of the People’s Republic of China (CNCA) — China • Korea Communications Commission (KCC) — Korea Please read the appropriate section that corresponds to the marking on your Sun product before attempting to install the product. FCC Class A Notice This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy, and if it is not installed and used in accordance with the instruction manual, it may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user will be required to correct the interference at his own expense. Modifications: Any modi?cations made to this device that are not approved by Sun Microsystems, Inc. may void the authority granted to the user by the FCC to operate this equipment. FCC Class B Notice This device complies with Part 15 of the FCC Rules. Operation is subject to the following two conditions: 1. This device may not cause harmful interference. 2. This device must accept any interference received, including interference that may cause undesired operation. Note: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: • Reorient or relocate the receiving antenna. • Increase the separation between the equipment and receiver. • Connect the equipment into an outlet on a circuit different from that to which the receiver is connected. • Consult the dealer or an experienced radio/television technician for help. Modifications: Any modi?cations made to this device that are not approved by Sun Microsystems, Inc. may void the authority granted to the user by the FCC to operate this equipment.viii SPARC T3-4 Server Safety and Compliance Guide • December 2010 ICES-003 Class A Notice - Avis NMB-003, Classe A This Class A digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe A est conforme à la norme NMB-003 du Canada. ICES-003 Class B Notice - Avis NMB-003, Classe B This Class B digital apparatus complies with Canadian ICES-003. Cet appareil numérique de la classe B est conforme à la norme NMB-003 du Canada.Regulatory Compliance Statements ix BSMI Class A Notice The following statement is applicable to products shipped to Taiwan and marked as Class A on the product compliance label. CCC Class A Notice The following statement is applicable to products shipped to China and marked with “Class A” on the product’s compliance label. Korean Class A Notice The following is the Korean Class A Broadcasting and Telecommunication Products for Business Purpose Statement.x SPARC T3-4 Server Safety and Compliance Guide • December 2010xi Safety Agency Compliance Statements Read this section before beginning any procedure. The following text provides safety precautions to follow when installing a Sun Microsystems product. Safety Precautions For your protection, observe the following safety precautions when setting up your equipment: ¦ Follow all cautions and instructions marked on the equipment. ¦ Ensure that the voltage and frequency of your power source match the voltage and frequency inscribed on the equipment’s electrical rating label. ¦ Never push objects of any kind through openings in the equipment. Dangerous voltages may be present. Conductive foreign objects could produce a short circuit that could cause fire, electric shock, or damage to your equipment. ¦ This product is intended for restricted access whereby access is controlled through the use of a means of security (for example, key, lock, tool, badge access) and personnel authorized for access have been instructed on the reasons for the restrictions and any precautions that need to be taken. Symbols The following symbols may appear in this book: Caution – There is a risk of personal injury and equipment damage. Follow the instructions. Caution – Hot surface. Avoid contact. Surfaces are hot and may cause personal injury if touched. Caution – Hazardous voltages are present. To reduce the risk of electric shock and danger to personal health, follow the instructions. Depending on the type of power switch your device has, one of the following symbols may be used: On – Applies AC power to the system. Off – Removes AC power from the system. Standby – The On/Standby switch is in the standby position. Modifications to Equipment Do not make mechanical or electrical modifications to the equipment. Sun Microsystems is not responsible for regulatory compliance of a modified Sun product. Placement of a Sun Product Caution – Do not block or cover the openings of your Sun product. Never place a Sun product near a radiator or heat register. Failure to follow these guidelines can cause overheating and affect the reliability of your Sun product. Noise Level ¦ Product: SPARC T3-4 server In compliance with the requirements defined in ISO 7779, the workplace-dependent noise level of this product is less than 70 db (A). SELV Compliance Safety status of I/O connections comply to SELV requirements.xii SPARC T3-4 Server Safety and Compliance Guide • December 2010 Power Cord Connection Caution – Sun products are designed to work with power systems having a grounded neutral (grounded return for DC-powered products). To reduce the risk of electric shock, do not plug Sun products into any other type of power system. Contact your facilities manager or a qualified electrician if you are not sure what type of power is supplied to your building. Caution – Not all power cords have the same current ratings. Do not use the power cord provided with your equipment for any other products or use. Household extension cords do not have overload protection and are not meant for use with computer systems. Do not use household extension cords with your Sun product. The following caution applies only to devices with a Standby power switch: Caution – The power switch of this product functions as a standby type device only. The power cord serves as the primary disconnect device for the system. Be sure to plug the power cord into a grounded power outlet that is nearby the system and is readily accessible. Do not connect the power cord when the power supply has been removed from the system chassis. The following caution applies only to devices with multiple power cords: Caution – For products with multiple power cords, all power cords must be disconnected to completely remove power from the system. Battery Warning Caution – There is danger of explosion if batteries are mishandled or incorrectly replaced. On systems with replaceable batteries, replace only with the same manufacturer and type or equivalent type recommended by the manufacturer per the instructions provided in the product service manual. Do not disassemble batteries or attempt to recharge them outside the system. Do not dispose of batteries in fire. Dispose of batteries properly in accordance with the manufacturer’s instructions and local regulations. Note that on Sun CPU boards, there is a lithium battery molded into the realtime clock. These batteries are not customer replaceable parts. Rack System Instructions The following or similar rack-mount instructions are included with the installation instructions: ¦ Elevated Operating Ambient – If installed in a closed or multi-unit rack assembly, the operating ambient temperature of the rack environment may be greater than room ambient. Therefore, consideration should be given to installing the equipment in an environment compatible with the maximum ambient temperature (Tma) specified by the manufacturer. ¦ Reduced Air Flow – Installation of the equipment in a rack should be such that the amount of air flow required for safe operation of the equipment is not compromised.Safety Agency Compliance Statements xiii ¦ Mechanical Loading – Mounting of the equipment in the rack should be such that a hazardous condition is not achieved due to uneven mechanical loading. ¦ Circuit Overloading – Consideration should be given to the connection of the equipment to the supply circuit and the effect that overloading of the circuits might have on overcurrent protection and supply wiring. Appropriate consideration of equipment nameplate ratings should be used when addressing this concern. ¦ Reliable Earthing – Reliable earthing of rack-mounted equipment should be maintained. Particular attention should be given to supply connections other than direct connections to the branch circuit (for example, use of power strips). Caution – Slide/rail mounted equipment must not be used as a shelf or workspace. Rack System Warning The following warnings apply to Racks and Rack Mounted systems. Caution – For safety, equipment should always be loaded from the bottom up. That is, install the equipment that will be mounted in the lowest part of the rack first, then the next higher systems, etc. Caution – To prevent the rack from tipping during equipment installation, the anti-tilt bar on the rack must be deployed. Caution – To prevent extreme operating temperature within the rack insure that the maximum temperature does not exceed the product’s ambient rated temperatures. Caution – To prevent extreme operating temperatures due to reduced airflow consideration should be made to the amount of air flow that is required for a safe operation of the equipment. Laser Compliance Notice Sun products that use laser technology comply with Class 1 laser requirements. Conformité aux normes de sécurité Veuillez lire attentivement cette section avant de commencer. Ce texte traite des mesures de sécurité qu’il convient de prendre pour l’installation d’un produit Sun Microsystems. Mesures de sécurité Pour votre sécurité, nous vous recommandons de suivre scrupuleusement les mesures de sécurité ci-dessous lorsque vous installez votre matériel: ¦ Suivez tous les avertissements et toutes les instructions inscrites sur le matériel. ¦ Assurez-vous que la tension et la fréquence de votre source d'alimentation correspondent à la tension et à la fréquence indiquées sur l'étiquette de la tension électrique nominale du matériel ¦ N'introduisez jamais d'objets quels qu'ils soient dans les ouvertures de l'équipement. Vous pourriez vous trouver en présence de hautes tensions dangereuses. Tout objet étranger conducteur risque de produire un court-circuit pouvant présenter un risque d'incendie ou de décharge électrique, ou susceptible d'endommager le matériel. ¦ Ce produit est destiné à être utilisé dans des zones à accès limité, dans lesquelles les accès sont contrôlés au moyen de systèmes de sécurité (par exemple, à clé, verrou, dispositif ou badge). Le personnel autorisé àxiv SPARC T3-4 Server Safety and Compliance Guide • December 2010 accéder à ces zones doit avoir été préalablement informé des raisons justifiant la limitation des accès et de toutes les précautions à prendre. Symboles Vous trouverez ci-dessous la signification des différents symboles utilisés: Attention – Vous risquez d'endommager le matériel ou de vous blesser. Veuillez suivre les instructions. Attention – Surfaces brûlantes. Evitez tout contact. Les surfaces sont brûlantes. Vous risquez de vous blesser si vous les touchez. Attention – Tensions dangereuses. Pour réduire les risques de décharge électrique et de danger physique, observez les consignes indiquées. Selon le type d'interrupteur marche/arrêt dont votre appareil est équipé, l'un des symboles suivants sera utilisé: Marche – Met le système sous tension alternative. Arret – Met le système hors tension alternative. Veilleuse – L'interrupteur Marche/Veille est sur la position de veille. Modification du matériel N'apportez aucune modification mécanique ou électrique au matériel. Sun Microsystems décline toute responsabilité quant à la non-conformité éventuelle d'un produit Sun modifié. Positionnement d’un produit Sun Attention – Evitez d'obstruer ou de recouvrir les orifices de votre produit Sun. N'installez jamais un produit Sun près d'un radiateur ou d'une source de chaleur. Si vous ne respectez pas ces consignes, votre produit Sun risque de surchauffer et son fonctionnement en sera altéré. Niveau de pression acoustique Produit : SPARC T3-4 server Conformément à la norme ISO 7779, le niveau sonore de ce produit sur le lieu de travail est inférieur à 70 db(A). Conformité SELV Le niveau de sécurité des connexions E/S est conforme aux normes SELV. Connexion du cordon d’alimentation Attention – Les produits Sun sont conçus pour fonctionner avec des systèmes d'alimentation équipés d'un conducteur neutre relié à la terre (conducteur neutre pour produits alimentés en CC). Pour réduire les risques de décharge électrique, ne branchez jamais les produits Sun sur une source d'alimentation d'un autre type. Contactez le gérant de votre bâtiment ou un électricien agréé si vous avez le moindre doute quant au type d'alimentation fourni dans votre bâtiment. Attention – Tous les cordons d'alimentation ne présentent pas les mêmes caractéristiques électriques. Les cordons d'alimentation à usage domestique ne sont pas protégés contre les surtensions et ne sont pas conçus pour être utilisés avec des ordinateurs. N'utilisez jamais de cordon d'alimentation à usage domestique avec les produits Sun.Safety Agency Compliance Statements xv L'avertissement suivant s'applique uniquement aux systèmes équipés d'un interrupteur Veille: Attention – L'interrupteur d'alimentation de ce produit fonctionne uniquement comme un dispositif de mise en veille. Le cordon d'alimentation constitue le moyen principal de déconnexion de l'alimentation pour le système. Assurez-vous de le brancher dans une prise d'alimentation mise à la terre près du système et facile d'accès. Ne le branchez pas lorsque l'alimentation électrique ne se trouve pas dans le châssis du système. L'avertissement suivant s'applique uniquement aux systèmes équipés de plusieurs cordons d'alimentation: Attention – Pour mettre un système équipé de plusieurs cordons d'alimentation hors tension, il est nécessaire de débrancher tous les cordons d'alimentation. Mise en garde relative aux batteries Attention – Les batteries risquent d’exploser en cas de manipulation maladroite ou de remplacement incorrect. Pour les systèmes dont les batteries sont remplaçables, effectuez les remplacements uniquement selon le modèle du fabricant ou un modèle équivalent recommandé par le fabricant, conformément aux instructions fournies dans le manuel de service du système. N’essayez en aucun cas de démonter les batteries, ni de les recharger hors du système. Ne les jetez pas au feu. Mettez-les au rebut selon les instructions du fabricant et conformément à la législation locale en vigueur. Notez que sur les cartes processeur de Sun, une batterie au lithium a été moulée dans l'horloge temps réel. Les batteries ne sont pas des pièces remplaçables par le client. Instructions de montage en rack Les instructions de montage en rack suivantes ou similaires à celles-ci sont fournies avec les instructions d'installation : ¦ Température ambiante de fonctionnement élevée : en cas d'installation dans un châssis fermé ou contenant plusieurs appareils, la température ambiante de fonctionnement au niveau du rack peut être supérieure à la température ambiante de la pièce. En conséquence, il convient de veiller à installer le matériel dans un environnement compatible avec la température ambiante maximale (Tma), spécifiée par le fabricant. ¦ Débit d'air réduit : l'installation du matériel dans un rack doit être effectuée de façon à ne pas compromettre le débit d'air nécessaire pour un fonctionnement sûr de ce matériel. ¦ Charge mécanique : le montage de l'équipement en rack doit être réalisé de manière à éviter toute situation dangereuse résultant d'une charge déséquilibrée. ¦ Surcharge de circuit : il convient de prendre les précautions nécessaires pour la connexion du matériel au circuit d'alimentation et de réfléchir aux conséquences d'une éventuelle surcharge des circuits sur la protection de surintensité et sur le câblage d'alimentation. En l'occurrence, les valeurs nominales de la plaque signalétique du matériel doivent être prises en compte. ¦ Mise à la terre fiable : une mise à la terre fiable du matériel monté en rack doit être assurée. Une attention toute particulière est requise pour les raccordements d'alimentation autres que ceux effectués directement sur le circuit principal (par exemple, en cas d'utilisation de blocs multiprises). Attention – L’équipement monté sur glissière/rail ne doit servir ni d’étagère ni d’espace de travail. Mise en garde relative au système en rack La mise en garde suivante s'applique aux racks et aux systèmes montés en rack.xvi SPARC T3-4 Server Safety and Compliance Guide • December 2010 Attention – Pour des raisons de sécurité, le matériel doit toujours être chargé du bas vers le haut. En d'autres termes, vous devez installer, en premier, le matériel qui doit se trouver dans la partie la plus inférieure du rack, puis installer le matériel sur le niveau suivant, etc. Attention – Afin d'éviter que le rack ne penche pendant l'installation du matériel, tirez la barre anti-basculement du rack. Attention – Pour éviter des températures de fonctionnement extrêmes dans le rack, assurez-vous que la température maximale ne dépasse pas la fourchette de températures ambiantes du produit déterminée par le fabricant. Attention – Afin d'empêcher des températures de fonctionnement extrêmes provoquées par une aération insuffisante, assurez-vous de fournir une aération appropriée pour un fonctionnement du matériel en toute sécurité Avis de conformité des appareils laser Les produits Sun qui font appel aux technologies lasers sont conformes aux normes de la classe 1 en la matière. Einhaltung sicherheitsbehördlicher Vorschriften Lesen Sie vor dem Ausführen von Arbeiten diesen Abschnitt. Im folgenden Text werden Sicherheitsvorkehrungen beschrieben, die Sie bei der Installation eines Sun Microsystems-Produkts beachten müssen. Sicherheitsvorkehrungen Treffen Sie zu Ihrem eigenen Schutz bei der Installation des Geräts die folgenden Sicherheitsvorkehrungen: ¦ Beachten Sie alle auf den Geräten angebrachten Warnhinweise und Anweisungen. ¦ Stellen Sie sicher, dass Spannung und Frequenz der Stromversorgung den Nennleistungen auf dem am Gerät angebrachten Etikett entsprechen. ¦ Führen Sie niemals Fremdobjekte in die Öffnungen am Gerät ein. Es können gefährliche Spannungen anliegen. Leitfähige Fremdobjekte können einen Kurzschluss verursachen, der einen Brand, Stromschlag oder Geräteschaden herbeiführen kann. ¦ Dieses Produkt unterliegt Zugangsbeschränkungen. Der Zugang wird mithilfe eines Sicherheitsmechanismus kontrolliert (z. B. einem Schlüssel, einer Sperre, einem Tool oder eines Werksausweises) und das autorisierte Zugangspersonal wurde über die Gründe für die Beschränkungen und die zu treffenden Sicherheitsmaßnahmen unterrichtet. Symbole Die Symbole in diesem Handbuch haben folgende Bedeutung: Achtung – Gefahr von Verletzung und Geräteschaden. Befolgen Sie die Anweisungen. Achtung – Heiße Oberfläche. Nicht berühren, da Verletzungsgefahr durch heiße Oberfläche besteht. Achtung – Gefährliche Spannungen. Befolgen Sie die Anweisungen, um Stromschläge und Verletzungen zu vermeiden.Safety Agency Compliance Statements xvii Je nach Netzschaltertyp an Ihrem Gerät kann eines der folgenden Symbole verwendet werden: Ein – Versorgt das System mit Wechselstrom. Aus– Unterbricht die Wechselstromzufuhr zum Gerät. Wartezustand – Der Ein-/Standby-Netzschalter befindet sich in der Standby-Position. Modifikationen des Geräts Nehmen Sie keine elektrischen oder mechanischen Gerätemodifikationen vor. Sun Microsystems ist für die Einhaltung der Sicherheitsvorschriften von modifizierten Sun-Produkten nicht haftbar. Aufstellung von Sun-Geräten Achtung – Geräteöffnungen Ihres SunProdukts dürfen nicht blockiert oder abgedeckt werden. Sun-Geräte sollten niemals in der Nähe von Heizkörpern oder Heißluftklappen aufgestellt werden. Die Nichtbeachtung dieser Richtlinien kann Überhitzung verursachen und die Zuverlässigkeit Ihres Sun-Geräts beeinträchtigen. Lautstärke Produkt: SPARC T3-4 server Gemäß den Vorgaben in der Norm ISO 7779 beträgt der Geräuschpegel dieses Geräts in Abhängigkeit vom Arbeitsplatz unter 70 db(A). SELV-Konformität Der Sicherheitsstatus der E/A-Verbindungen entspricht den SELV-Anforderungen. Anschluss des Netzkabels Achtung – Sun-Geräte sind für Stromversorgungssysteme mit einem geerdeten neutralen Leiter (geerdeter Rückleiter bei gleichstrombetriebenen Geräten) ausgelegt. Um die Gefahr von Stromschlägen zu vermeiden, schließen Sie das Gerät niemals an andere Stromversorgungssysteme an. Wenden Sie sich an den zuständigen Gebäudeverwalter oder an einen qualifizierten Elektriker, wenn Sie nicht sicher wissen, an welche Art von Stromversorgungssystem Ihr Gebäude angeschlossen ist. Achtung – Nicht alle Netzkabel verfügen über die gleichen Nennwerte. Herkömmliche, im Haushalt verwendete Verlängerungskabel besitzen keinen Überlastschutz und sind daher für Computersysteme nicht geeignet. Verwenden Sie bei Ihrem Sun-Produkt keine Haushalts-Verlängerungskabel. Die folgende Warnung gilt nur für Geräte mit StandbyNetzschalter: Achtung – Beim Netzschalter dieses Geräts handelt es sich nur um einen Ein/StandbySchalter. Zum völligen Abtrennen des Systems von der Stromversorgung dient hauptsächlich das Netzkabel. Stellen Sie sicher, dass das Netzkabel an eine frei zugängliche geerdete Steckdose in der Nähe des Systems angeschlossen ist. Schließen Sie das Stromkabel nicht an, wenn die Stromversorgung vom Systemchassis entfernt wurde. Die folgende Warnung gilt nur für Geräte mit mehreren Netzkabeln: Achtung – Bei Produkten mit mehreren Netzkabeln müssen alle Netzkabel abgetrennt werden, um das System völlig von der Stromversorgung zu trennen.xviii SPARC T3-4 Server Safety and Compliance Guide • December 2010 Warnung bezüglich Batterien Achtung – Bei unsachgemäßer Handhabung oder nicht fachgerechtem Austausch der Batterien besteht Explosionsgefahr. Verwenden Sie bei Systemen mit austauschbaren Batterien ausschließlich Ersatzbatterien desselben Typs und Herstellers bzw. einen entsprechenden, vom Hersteller gemäß den Anweisungen im Service-Handbuch des Produkts empfohlenen Batterietyp. Versuchen Sie nicht, die Batterien auszubauen oder außerhalb des Systems wiederaufzuladen. Werfen Sie die Batterien nicht ins Feuer. Entsorgen Sie die Batterien entsprechend den Anweisungen des Herstellers und den vor Ort geltenden Vorschriften. CPU-Karten von Sun verfügen über eine Echtzeituhr mit integrierter Lithiumbatterie. Diese Batterie darf nur von einem qualifizierten Servicetechniker ausgewechselt werden. Anweisungen zur Rack-Montage Die folgenden oder ähnlichen Anweisungen zur RackMontage wurden in die Installationsanweisungen aufgenommen: ¦ Erhöhte Betriebsumgebungstemperatur - Wenn das Rack in einer geschlossenen Rack-Baugruppe oder in einer Multi-unit-Rack-Baugruppe installiert ist, kann die Betriebsumgebungstemperatur der RackUmgebung höher sein als die Umgebungstemperatur des Raumes. Deshalb sollte berücksichtigt werden, das Gerät in einer Umgebung zu installieren, die kompatibel zu der vom Hersteller angegebenen maximalen Umgebungstemperatur (Tma) ist. ¦ Reduzierter Luftstrom - Die Installation des Geräts in einem Rack sollte so erfolgen, dass die Luftstrommenge, die für den sicheren Betrieb des Geräts erforderlich ist, nicht beeinträchtigt wird. ¦ Mechanische Belastung - Die Montage des Geräts im Rack sollte so erfolgen, dass bei einer ungleichmäßigen mechanischen Belastung keine gefährliche Betriebsbedingung entstehen kann. ¦ Stromkreisüberlastung - Der Anschluss des Geräts an den Speisestromkreis und die Wirkung, die ein Überlasten der Stromkreise auf das ÜberstromschutzGerät und die Speisestromkreisverkabelung haben kann, sollten sorgfältig geprüft und berücksichtigt werden. Beim Behandeln dieses Aspekts sollten besonders die Lastangaben auf dem Leistungsschild des Geräts sorgfältig geprüft werden. ¦ Zuverlässige Erdung - Ausrüstung, die in Racks montiert ist, muss zuverlässig geerdet sein. Besonders müssen hierbei die Stromanschlussleitungen und weniger die direkten Verbindungen zum Abzweigstromkreis beachtet werden (z. B. durch die Verwendung von Adapterleisten). Achtung – Verwenden Sie Geräte in Steckplätzen bzw. auf Schienen nicht als Regal oder Arbeitsbereich. Warnungen bezüglich in Racks eingebauter Systeme Die folgenden Warnungen gelten für Racks und in Racks eingebaute Systeme: Achtung – Aus Sicherheitsgründen sollten sämtliche Geräte von unten nach oben in Racks eingebaut werden. Installieren Sie also zuerst die Geräte, die an der untersten Position im Rack eingebaut werden, gefolgt von den Systemen, die an nächsthöherer Stelle eingebaut werden, usw. Achtung – Verwenden Sie beim Einbau den Kippschutz am Rack, um ein Umkippen zu vermeiden.Safety Agency Compliance Statements xix Achtung – Um extreme Betriebstemperaturen im Rack zu vermeiden, stellen Sie sicher, dass die Maximaltemperatur die Nennleistung der Umgebungstemperatur für das Produkt nicht überschreitet Achtung – Um extreme Betriebstemperaturen durch verringerte Luftzirkulation zu vermeiden, sollte die für den sicheren Betrieb des Geräts erforderliche Luftzirkulation eingesetzt werden. Hinweis zur Laser-Konformität Sun-Produkte, die die Laser-Technologie verwenden, entsprechen den Laser-Anforderungen der Klasse 1. Normativas de seguridad Lea esta sección antes de realizar cualquier operación. En ella se explican las medidas de seguridad que debe tomar al instalar un producto de Sun Microsystems. Medidas de seguridad Para su protección, tome las medidas de seguridad siguientes durante la instalación del equipo: ¦ Siga todos los avisos e instrucciones indicados en el equipo. ¦ Asegúrese de que el voltaje y frecuencia de la fuente de alimentación coincidan con el voltaje y frecuencia indicados en la etiqueta de clasificación eléctrica del equipo. ¦ No introduzca objetos de ningún tipo por las rejillas del equipo, ya que puede quedar expuesto a voltajes peligrosos. Los objetos conductores extraños pueden producir cortocircuitos y, en consecuencia, incendios, descargas eléctricas o daños en el equipo. ¦ Este producto se ha concebido para un acceso restringido y, por tanto, éste se controla mediante mecanismos de seguridad (p. ej., acceso con clave, bloqueo, herramienta y tarjeta de identificación). Las personas con acceso autorizado están al corriente de los motivos de esta restricción y de las precauciones que se deben tomar. Símbolos En este documento aparecen los siguientes símbolos: Precaución – Existe el riesgo de que se produzcan lesiones personales y daños en el equipo. Siga las instrucciones. Precaución – Superficie caliente. Evite todo contacto. Las superficies están calientes y pueden causar lesiones personales si se tocan. Precaución – Voltaje peligroso. Para reducir el riesgo de descargas eléctricas y lesiones personales, siga las instrucciones. En función del tipo de interruptor de alimentación del que disponga el dispositivo, se utilizará uno de los símbolos siguientes: Encendido – Suministra alimentación de CA al sistema. Apagado – Corta la alimentación de CA del sistema. Espera – El interruptor de encendido/espera está en la posición de espera. Modificaciones en el equipo No realice modificaciones de tipo mecánico ni eléctrico en el equipo. Sun Microsystems no se hace responsable del cumplimiento de normativas en caso de que un producto Sun se haya modificado.xx SPARC T3-4 Server Safety and Compliance Guide • December 2010 Colocación de un producto Sun Precaución – No obstruya ni tape las rejillas del producto Sun. Nunca coloque un producto Sun cerca de radiadores ni fuentes de calor. Si no sigue estas indicaciones, el producto Sun podría sobrecalentarse y la fiabilidad de su funcionamiento se vería afectada. Nivel de ruido Producto: SPARC T3-4 server En conformidad con la norma ISO 7779, el nivel de emisión de ruido de este producto en el puesto de trabajo es inferior a los 70 db(A). Cumplimiento de la normativa para instalaciones SELV Las condiciones de seguridad de las conexiones de entrada y salida cumplen los requisitos para instalaciones SELV (del inglés Safe Extra Low Voltage, voltaje bajo y seguro). Conexión del cable de alimentación Precaución – Los productos Sun se han diseñado para funcionar con sistemas de alimentación que cuenten con un conductor neutro a tierra (con conexión a tierra de regreso para los productos con alimentación de CC). Para reducir el riesgo de descargas eléctricas, no conecte ningún producto Sun a otro tipo de sistema de alimentación. Póngase en contacto con el encargado de las instalaciones de su empresa o con un electricista cualificado en caso de que no esté seguro del tipo de alimentación del que se dispone en el edificio. Precaución – No todos los cables de alimentación tienen la misma clasificación eléctrica. Los alargadores de uso doméstico no cuentan con protección frente a sobrecargas y no están diseñados para su utilización con sistemas informáticos. No utilice alargadores de uso doméstico con el producto Sun. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de un interruptor de alimentación de espera: Precaución – El interruptor de alimentación de este producto funciona solamente como un dispositivo de espera. El cable de alimentación hace las veces de dispositivo de desconexión principal del sistema. Asegúrese de que conecta el cable de alimentación a una toma de tierra situada cerca del sistema y de fácil acceso. No conecte el cable de alimentación si la unidad de alimentación no se encuentra en el bastidor del sistema. La siguiente medida solamente se aplica a aquellos dispositivos que dispongan de varios cables de alimentación: Precaución – En los productos que cuentan con varios cables de alimentación, debe desconectar todos los cables de alimentación para cortar por completo la alimentación eléctrica del sistema. Advertencia sobre las baterías Precaución – Si las baterías no se manipulan o reemplazan correctamente, se corre el riesgo de que estallen. En los sistemas que cuentan con baterías reemplazables, reemplácelas sólo con baterías del mismo fabricante y el mismo tipo, o un tipo equivalente recomendado por el fabricante, de acuerdo con las instrucciones descritas en el manual de servicio del producto. No desmonte las baterías ni intente recargarlas fuera del sistema. No intente deshacerse de las baterías echándolas al fuego. Deshágase de las baterías correctamente de acuerdo con las instrucciones del fabricante y las normas locales. Tenga en cuenta que en las placas CPU de Sun, hay una batería de litioSafety Agency Compliance Statements xxi incorporada en el reloj en tiempo real. Los usuarios no deben reemplazar este tipo de baterías. Instrucciones para el montaje en armario Las siguientes instrucciones de montaje en armario u otras similares se incluyen en las instrucciones de instalación: ¦ Temperatura de funcionamiento elevada - si se instala en un armario cerrado o con más unidades, la temperatura ambiente de funcionamiento del entorno del armario puede ser superior a la de la habitación. Por tanto, el equipo debería instalarse en un entorno compatible con la temperatura ambiente máxima (Tma) especificada por el fabricante. ¦ Flujo de aire reducido - para instalar el equipo en un armario hay que asegurarse de que se mantendrá el flujo de aire necesario para el correcto funcionamiento del equipo. ¦ Carga mecánica - el montaje del equipo en el armario debería realizarse de modo que no se dé una situación de peligro debido a una carga mecánica irregular. ¦ Sobrecarga del circuito - debe prestarse atención a la conexión del equipo al circuito de alimentación y a las consecuencias que puede tener la sobrecarga de los circuitos en la protección de sobrecorriente y el cableado de alimentación. En caso de sobrecarga, es recomendable tener en cuenta la potencia del equipo que aparece en la placa de identificación. ¦ Puesta a tierra fiable - debería mantenerse una puesta a tierra fiable del equipo montado en un armario. Debería prestarse especial atención a las conexiones de suministro que no sean las directas al circuito derivado (p. ej., las regletas de distribución). Precaución – Los equipos instalados por deslizamiento o sobre raíles no deben utilizarse como estantería o espacio de trabajo. Advertencia sobre el sistema en bastidor Las advertencias siguientes se aplican a los sistemas montados en bastidor y a los propios bastidores. Precaución – Por seguridad, siempre deben montarse los equipos de abajo arriba. A saber, primero debe instalarse el equipo que se situará en el bastidor inferior; a continuación, el que se situará en el siguiente nivel, etc. Precaución – Para evitar que el bastidor se vuelque durante la instalación del equipo, debe extenderse la barra antivolcado del bastidor. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema en el bastidor, asegúrese de que la temperatura máxima no sea superior a la temperatura ambiente establecida como adecuada para el producto. Precaución – Para evitar que se alcance una temperatura de funcionamiento extrema debido a una circulación de aire reducida, debe considerarse la magnitud de la circulación de aire requerida para que el equipo funcione de forma segura. Aviso de cumplimiento de la normativa para la utilización de láser Los productos Sun que utilizan tecnología láser cumplen los requisitos establecidos para los productos láser de clase 1.xxii SPARC T3-4 Server Safety and Compliance Guide • December 2010 Nordic Lithium Battery Cautions Norge Advarsel – Litiumbatteri — Eksplosjonsfare. Ved utskifting benyttes kun batteri som anbefalt av apparatfabrikanten. Brukt batteri returneres apparatleverandøren. Sverige Varning – Explosionsfara vid felaktigt batteribyte. Använd samma batterityp eller en ekvivalent typ som rekommenderas av apparattillverkaren. Kassera använt batteri enligt fabrikantens instruktion. Danmark Advarsel! – Litiumbatteri — Eksplosionsfare ved fejlagtig håndtering. Udskiftning må kun ske med batteri af samme fabrikat og type. Levér det brugte batteri tilbage til leverandøren. Suomi Varoitus – Paristo voi räjähtää, jos se on virheellisesti asennettu. Vaihda paristo ainoastaan laitevalmistajan suosittelemaan tyyppiin. Hävitä käytetty paristo valmistajan ohjeiden mukaisesti. Nordic Power Distribution Cautions English Caution – This product is also designed for an IT power distribution system with phase-tophase voltage of 230V. Danmark Advarsel! – Dette produkt er også beregnet til et IT-strømfordelingssystem med en fase-tilfase spænding på 230 V. Nordic Grounded Socket Cautions English Caution – The appliance must be connected to a grounded socket. Norge Advarsel – Apparatet må tilkoples jordet stikkontakt. Sverige Varning – Apparaten skall anslutas till jordat uttag. Suomi Varoitus – Laite on liitettävä suojamaadoituskoskettimilla varustettuun pistorasiaan.xxiii Shielded Cables English Hardwire connections between systems or systems and peripherals using ports other than modular jack ports must use shielded cables to comply with radio frequency emission limits. Any modular jack serial ports or wired Ethernet port connections may be made using unshielded twisted pair (UTP) cables. French Les raccords câblés entre les systèmes ou entre les systèmes et les périphériques via des ports autres que ceux de prise modulaire doivent être réalisés au moyen de câbles blindés, de sorte à se conformer aux limites d’émission de fréquences radio. Vous pouvez effectuer toutes les connexions de ports Ethernet ou de ports série de prise modulaire à l’aide de câbles à paire torsadée non blindée. German Für die festverdrahteten Verbindungen zwischen Systemen sowie Verbindungen von Systemen und Peripheriegeräten, die Ports mit nicht modularen Anschlüssen verwenden, müssen abgeschirmte Kabel verwendet werden, um den Grenzwerten für die Emission von Funkfrequenzen zu entsprechen. Alle Verbindungen zu seriellen Ports mit modularen Anschlüssen und verdrahteten Ethernet-Ports können über nicht abgeschirmte Twisted-Pair-(UTP)-Kabel hergestellt werden. Spanish Las conexiones de materiales entre sistemas o entre sistemas y periféricos que utilicen puertos distintos a los puertos de tomas modulares deberán utilizar cables cubiertos que cumplan con los límites de emisión de radiofrecuencias. Cualesquiera conexiones de puertos en serie de tomas modulares o de puertos Ethernet deberán realizarse utilizando cables apareados sin protección (UTP).xxiv SPARC T3-4 Server Safety and Compliance Guide • December 2010